Secure multi-party computing method, computing system, storage medium and program product

Abstract

The embodiment of the invention provides a secure multi-party computing method and system, a storage medium and a program product, and belongs to the field of data processing. The secure multi-party computing method is applied to the computing system, the computing system comprises a plurality of participating devices, and the secure multi-party computing method comprises the following steps: each participating device inputs a device identifier and a generated temporary public key set into a preset hybrid network to obtain a plurality of out-of-order anonymous temporary public key sets; each participating device determines a target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round; all participating devices determine all committee devices in the first target round from all participating devices based on the signature hash values; and under the condition that the round of secure multi-party calculation is the first target round, performing secure multi-party calculation by all the committee equipment in the first target round to obtain a secure multi-party calculation result.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a secure multi-party computing method, a computing system, a storage medium and a program product. Background Art

[0002] With the rapid development of cryptography technology, secure multi-party computing (MPC) has been widely used in various secure computing scenarios. Secure multi-party computing allows multiple participants to jointly calculate the result of a function without revealing private inputs. Usually, the static secure multi-party computing process requires multiple rounds of calculations according to the protocol, requiring the participants to always be active during the calculation process.

[0003] However, since it is difficult for all participants to ensure that they can always participate in the protocol execution process, the participation threshold of static secure multi-party computing is too high, which affects the willingness of participants to conduct multi-party computing. Usually, there are attackers who will destroy or manipulate the devices of the participants. When only a small number of participants always participate in secure multi-party computing, the attackers can quickly identify the participants in the secure multi-party computing process. In addition, when the participants are static, it will be easier for the attacker to identify the participants in the secure multi-party computing process, thereby launching malicious attacks on the participants, resulting in lower security of multi-party computing. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a secure multi-party computing method, a computing system, a storage medium and a program product. The secure multi-party computing method is used to solve the problem of low security of multi-party computing.

[0005] In order to achieve the above-mentioned purpose, in a first aspect, the present application provides a secure multi-party computing method, which is applied to a computing system, the computing system includes multiple participating devices, and the secure multi-party computing method includes:

[0006] Each participating device inputs the device identification and the generated temporary public key set into a preset mixing network to obtain multiple random anonymous temporary public key sets, wherein the preset mixing network is used to permute the index corresponding to the device identification based on a preset permutation relationship to output multiple anonymous temporary public key sets with random relationship between the device identification and the temporary public key;

[0007] Each participating device determines, based on the key index of the first target round, a target temporary public key used in the first target round from the anonymous temporary public key set;

[0008] Each participating device signs based on the temporary private key and the first random number seed to obtain a signature hash value of the participating device in the first target round, wherein the target temporary public key is used to verify the signature;

[0009] All participating devices determine all committee devices in the first target round from all participating devices based on the signature hash value;

[0010] When the round of the secure multi-party computation is the first target round, all committee devices in the first target round perform the secure multi-party computation to obtain a secure multi-party computation result.

[0011] In an embodiment of the present application, the computing system further includes a blockchain device;

[0012] Each participating device determines, based on the key index of the first target round, a target temporary public key used in the first target round from the anonymous temporary public key set, including:

[0013] Each participating device accesses the anonymous temporary public key set in the blockchain device based on a preset access function, and determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round;

[0014] When the round of the secure multi-party computation is the first target round, all committee devices in the first target round perform secure multi-party computation to obtain a secure multi-party computation result, including:

[0015] When the round of the secure multi-party computation is the first target round and the first target round is not the first round, each committee device receives the secret share generated in the second target round sent by the blockchain device, wherein the second target round is a round before the first target round;

[0016] All committee devices in the first target round perform secure multi-party computation based on the secret shares generated in the second target round to obtain a secure multi-party computation result of the first target round.

[0017] In an embodiment of the present application, all committee devices in the first target round perform secure multi-party computing based on the secret shares generated in the second target round to obtain a secure multi-party computing result of the first target round, including:

[0018] Each committee device determines whether the secret share generated in the second target round is a valid share;

[0019] When the secret share generated in the second target round is a valid share, each committee device in the first target round decrypts the secret share generated in the second target round, obtains a decryption result corresponding to the secret share, and determines whether the decryption result is a valid result;

[0020] When the decryption result is a valid result, all committee devices in the first target round perform secure multi-party computation based on the decryption result to obtain a secure multi-party computation result of the first target round.

[0021] In an embodiment of the present application, the secure multi-party computation result of the first target round includes the secret share of the first target round;

[0022] The secure multi-party computation method also includes:

[0023] In the case where there is a third target round for secure multi-party computation, each committee device in the first target round sends the secret share generated in the first target round to the blockchain device based on a verifiable secret sharing algorithm, wherein the third target round is the next round after the first target round.

[0024] In an embodiment of the present application, the committee device includes a leader device and other devices, and the leader device is used to synchronize information to all other devices;

[0025] All participating devices determine all committee devices in the first target round from all participating devices based on the signature hash value, including:

[0026] All participating devices determine all candidate leader devices in the first target round from all participating devices based on the signature hash value, and determine the leader device from all candidate leader devices, wherein the candidate leader device is a participating device whose signature hash value is less than the first target value, and the leader device is a participating device with the smallest signature hash value among all candidate leader devices;

[0027] All participating devices determine all other devices from all participating devices based on the signature hash value, wherein the other devices are participating devices other than the leading device whose signature hash values ​​are less than the second target value, and the second target value is greater than the first target value.

[0028] In an embodiment of the present application, each participating device signs based on the first target round and the first random number seed to obtain a signature hash value of the participating device in the first target round, including:

[0029] When the round of the secure multi-party computing is the fourth target round, each participating device confuses the target temporary private key and the first random number seed to obtain a second random number seed, wherein the fourth target round is any secure multi-party computing round before the first target round;

[0030] Each participating device signs based on the second random number seed to obtain a signature hash value of the participating device in the first target round.

[0031] In an embodiment of the present application, before each participating device determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round, it also includes:

[0032] Each participating device replaces the index corresponding to the device identifier based on a preset replacement relationship, so as to determine the replaced index as the key index of the first target round.

[0033] In an embodiment of the present application, before each participating device respectively inputs the device identification and the generated temporary public key set into the preset hybrid network to obtain multiple random anonymous temporary public key sets, it also includes:

[0034] Each participating device generates a preset number of temporary private keys based on the master key;

[0035] Each participating device generates a temporary public key corresponding to the temporary private key and destroys the master key to obtain a temporary key pair consisting of a preset number of temporary private keys and temporary public keys.

[0036] In a second aspect, the present application provides a computing system, including:

[0037] a memory configured to store instructions; and

[0038] The processor is configured to call instructions from the memory and implement the above-mentioned secure multi-party computing method when executing the instructions.

[0039] In a third aspect, the present application provides a machine-readable storage medium having instructions stored thereon, which, when executed by a processor, configure the processor to execute the above-mentioned secure multi-party computing method.

[0040] In a fourth aspect, the present application provides a computer program product, including a computer program, which implements the above-mentioned secure multi-party computing method when executed by a processor.

[0041] The present application provides a secure multi-party computing method, which is applied to a computing system, wherein the computing system includes a plurality of participating devices, and the secure multi-party computing method includes: each participating device inputs a device identification and a generated temporary public key set into a preset hybrid network to obtain a plurality of random anonymous temporary public key sets; each participating device determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round; each participating device signs based on the first target round and the first random number seed to obtain the signature hash value of the participating device in the first target round; all participating devices determine all committee devices in the first target round from all participating devices based on the signature hash value; when the round of the secure multi-party computing is the first target round, all committee devices in the first target round perform secure multi-party computing to obtain a secure multi-party computing result. The anonymous temporary public key set eliminates the corresponding relationship between the temporary public key of the participating device and its identity, thereby concealing the identity of the participating device. The attacker cannot identify the identity of the participating device, thereby improving the identity concealment and process security of the secure multi-party computing. In addition, the committee devices are quickly selected through anonymous signatures, which ensures that participating devices can dynamically participate in secure multi-party computing, further improving the efficiency and security of secure multi-party computing compared to the static secure multi-party computing process.

[0042] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0044] Figure 1 A flowchart of a secure multi-party computing method provided by an embodiment of the present application is shown;

[0045] Figure 2 A schematic diagram of the structure of a computing system provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0046] The specific implementation of the embodiment of the present invention will be described in detail below in conjunction with the accompanying drawings in the embodiment of the present invention. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0047] The components of the embodiments of the present invention generally described and shown in the drawings herein may be arranged and designed in a variety of different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0048] Hereinafter, the terms "including", "having" and their cognates, which may be used in various embodiments of the present invention, are intended only to indicate specific features, numbers, steps, operations, elements, components or combinations of the foregoing items, and should not be understood as first excluding the existence of one or more other features, numbers, steps, operations, elements, components or combinations of the foregoing items or adding the possibility of one or more features, numbers, steps, operations, elements, components or combinations of the foregoing items.

[0049] Furthermore, the terms “first”, “second”, “third”, etc. are merely used for distinguishing descriptions and are not to be understood as indicating or implying relative importance.

[0050] Unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meanings as those generally understood by those skilled in the art to which the various embodiments of the present invention belong. The terms (such as those defined in generally used dictionaries) will be interpreted as having the same meanings as the contextual meanings in the relevant technical field and will not be interpreted as having idealized meanings or overly formal meanings unless clearly defined in the various embodiments of the present invention.

[0051] See also Figure 1 , Figure 1 A flow chart of a secure multi-party computing method provided by an embodiment of the present application is shown. Figure 1 The secure multi-party computing method in the present invention is applied to a computing system, wherein the computing system includes multiple participating devices. Figure 1 The secure multi-party computation methods in include:

[0052] S110, each participating device inputs the device identification and the generated temporary public key set into the preset hybrid network respectively to obtain multiple random anonymous temporary public key sets, wherein the preset hybrid network is used to permute the index corresponding to the device identification based on a preset permutation relationship to output multiple anonymous temporary public key sets in which the device identification and the temporary public key are in a random relationship.

[0053] In the secure multi-party computing scenario, the computing system includes multiple participating devices, and the number of parameter devices is set according to actual needs and is not limited here. Each participating device generates multiple sets of temporary key pairs corresponding to multiple computing rounds of secure multi-party computing, where each set of temporary key pairs includes a temporary public key and a temporary secret key. The number of temporary key pairs generated by each participating device is set according to the actual needs of the secure multi-party computing task. The number of temporary key pairs can be determined according to the secure multi-party computing protocol, or a fixed number of temporary key pairs can be generated, which is not limited here.

[0054] Based on multiple sets of temporary key pairs generated by each participating device, the set of temporary key pairs constructed is in, The qth temporary private key generated for the ith participating device, The qth temporary public key generated for the ith participating device, n is the total number of the plurality of participating devices, and Q is the total number of temporary key pairs included in the temporary key pair set.

[0055] Usually, a participating device can identify itself through a device identifier. It should be understood that the type of device identifier is set according to actual needs, and an identity ID (IDentifier) ​​can be used, etc., which is not limited here. For ease of understanding, in the embodiment of the present application, each participating device inputs the device identifier and the temporary public key set into a preset hybrid network to obtain multiple random anonymous temporary public key sets to eliminate the corresponding relationship between the temporary public key of the participating device and its identity, thereby concealing the identity of the participating device.

[0056] The preset hybrid network is used to permute the public keys in the temporary public key set based on the preset permutation relationship, so as to output multiple anonymous temporary public key sets with a disordered relationship between the device identification and the temporary public key. For ease of understanding, the multiple anonymous temporary public key sets output by the preset hybrid network in the embodiment of the present application are Among them, j is the key index, which is obtained by replacing the index corresponding to the device identification of the participating device. is the anonymous temporary public key with key index j in the qth temporary public key set, n is the total number of multiple participating devices, and Q is the total number of temporary key pairs included in the temporary key pair set.

[0057] S120, each participating device determines a target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round;

[0058] The index corresponding to the device identification is replaced based on the preset replacement relationship to obtain the key index, thereby disrupting the corresponding relationship between the participating device and the temporary public key. Each participating device determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round. Each participating device can only determine the index corresponding to the temporary public key, but cannot determine other information of the preset replacement relationship, thereby eliminating the corresponding relationship between the participating device and the temporary public key, thereby realizing the identity hiding of the participating device.

[0059] S130, each participating device signs based on the temporary private key and the first random number seed to obtain a signature hash value of the participating device in the first target round, wherein the target temporary public key is used to verify the signature.

[0060] Each participating device signs based on the first target round and the first random number seed, and obtains the signature hash value of the participating device in the first target round based on the preset hash function. Normally, any current participating device can use the generated temporary private key to sign, and other participating devices except the current participating device can use the temporary public key corresponding to the temporary private key to verify the validity of the signature. Since the temporary public key is anonymized, the identity information of the signer will not be exposed during the signature verification process.

[0061] S140, all participating devices determine all committee devices in the first target round from all participating devices based on the signature hash value.

[0062] In the scenario of secure multi-party computing, multiple rounds of computing are required, and each round of secure multi-party computing requires a committee to perform the computing, where the committee includes at least two committee devices. When all participating devices have completed the signature, all committee devices in the first target round are determined from all participating devices based on the size of the signature hash value of each participating device. By quickly selecting committee devices through anonymous signatures, participating devices can dynamically participate in the secure multi-party computing process according to the secure multi-party computing rounds, which further improves the scalability and security of secure multi-party computing compared to the static secure multi-party computing process.

[0063] It should be understood that in multiple computing processes, the committee devices in the committee are required to meet the requirements of the honest majority, for example, at least 2 / 3 of the committee devices are honest, which will not be elaborated here.

[0064] It should also be understood that in the embodiments of the present application, each participating device can be limited to participate in only one round of multi-party computing to further improve the security of multi-party computing. To this end, when the current participating device participates in secure multi-party computing, the current participating device can use a temporary private key to sign a message. After the message is broadcast, the current participating device immediately destroys the temporary private key used for signing to prevent the temporary private key from being obtained and used by the attacker.

[0065] In an embodiment of the present application, each participating device signs based on the first target round and the first random number seed to obtain a signature hash value of the participating device in the first target round, including:

[0066] When the round of the secure multi-party computing is the fourth target round, each participating device confuses the target temporary private key and the first random number seed to obtain a second random number seed, wherein the fourth target round is any secure multi-party computing round before the first target round;

[0067] Each participating device signs based on the second random number seed to obtain a signature hash value of the participating device in the first target round.

[0068] Since the secure multi-party computing scenario involves multiple rounds of computing between participating devices, the nodes that serve as committee devices in the first computing round need to be determined in advance in the fourth target round. The fourth target round is any secure multi-party computing round before the first target round. The value of the fourth target round is set according to actual needs and is not limited here.

[0069] For ease of understanding, a method similar to a Verifiable Random Function (VRF) is used in the embodiments of the present application to determine the committee device. VRF is an encryption function that generates a pseudo-random number based on data input and attaches a certificate. The current participating device can verify whether it is selected as a committee device through local calculation, while other participating devices other than the current participating device cannot verify.

[0070] When the round of secure multi-party computation is the fourth target round, each participating device confuses the target temporary private key and the first random number seed to obtain a second random number seed. Specifically, an obfuscator is pre-selected and synchronized to all participating devices. After receiving the obfuscator, the participating device inputs the first random number seed and the target temporary private key into the obfuscator together, so that the second random number seed is output through the obfuscator.

[0071] Each participating device signs based on the second random number seed to obtain the signature hash value of the participating device in the first target round. The signing process is anonymous and secure, and the process of generating the second random number seed is simple and can be applied to a variety of scenarios. At the same time, the committee device is quickly selected through the anonymous signature, so that the participating devices can safely participate in the secure multi-party computing according to the secure multi-party computing round.

[0072] In an embodiment of the present application, the committee device includes a leader device and other devices, and the leader device is used to synchronize information to all other devices;

[0073] All participating devices determine all committee devices in the first target round from all participating devices based on the signature hash value, including:

[0074] All participating devices determine all candidate leader devices in the first target round from all participating devices based on the signature hash value, and determine the leader device from all candidate leader devices, wherein the candidate leader device is a participating device whose signature hash value is less than the first target value, and the leader device is a participating device with the smallest signature hash value among all candidate leader devices;

[0075] All participating devices determine all other devices from all participating devices based on the signature hash value, wherein the other devices are participating devices other than the leading device whose signature hash values ​​are less than the second target value, and the second target value is greater than the first target value.

[0076] Each participating device locally calculates whether the signature hash value is less than the first target value. If the signature hash value is less than the first target value, the participating device is determined as a candidate leader device. The candidate leader devices synchronize signature hash values, and then determine the participating device with the smallest signature hash value among all candidate leader devices as the leader device.

[0077] It should be understood that it is usually necessary to determine the committee devices for this round and the next round, and the participating devices determined as committee devices can determine whether to dynamically participate in the secure multi-party computing process based on actual computing resources. In the case where the leader device with the smallest signature hash value exits the secure multi-party computing, the candidate leader device with the second smallest signature hash value is determined as the leader device, and so on, until the current leader device is determined to participate in the secure multi-party computing.

[0078] The process of determining other devices is similar to the process of determining the leader device. Each participating device locally calculates whether the signature hash value is less than the second target value, where the second target value is greater than the first target value. When the signature hash value is less than the second target value, the participating devices other than the leader device are determined to be other devices. The participating devices determine whether they are selected as committee devices by locally calculating the signature hash value. The identities of other members are unknown to each other among the committee devices, and the committee devices cannot disclose the committee member allocation results before participating in the calculation, so as to avoid the attacker pre-determining the participating devices that need to be attacked, thereby improving the security of multi-party computing.

[0079] S150: When the round of the secure multi-party computation is the first target round, all committee devices in the first target round perform the secure multi-party computation to obtain a secure multi-party computation result.

[0080] In the secure multi-party computing scenario, the secure multi-party computing process is carried out in rounds, and the committee devices of the first target round need to be determined in advance, where the first target round can be any round in multiple rounds of multi-party computing, and is not limited here. When the round of the secure multi-party computing is the first target round, all committee devices of the first target round perform secure multi-party computing to obtain the secure multi-party computing result. Through the preset hybrid network, multiple anonymous temporary public key sets with disordered relationships between device identification and temporary public keys are obtained, eliminating the corresponding relationship between the temporary public key and the identity of the participating device, thereby concealing the identity of the participating device. The attacker cannot quickly identify the identity of the participating device, thereby improving the identity anonymity and process security of the secure multi-party computing.

[0081] In an embodiment of the present application, the computing system further includes a blockchain device;

[0082] Each participating device determines, based on the key index of the first target round, a target temporary public key used in the first target round from the anonymous temporary public key set, including:

[0083] Each participating device accesses the anonymous temporary public key set in the blockchain device based on a preset access function, and determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round;

[0084] When the round of the secure multi-party computation is the first target round, all committee devices in the first target round perform secure multi-party computation to obtain a secure multi-party computation result, including:

[0085] When the round of the secure multi-party computation is the first target round and the first target round is not the first round, each committee device receives the secret share generated in the second target round sent by the blockchain device, wherein the second target round is a round before the first target round;

[0086] All committee devices in the first target round perform secure multi-party computation based on the secret shares generated in the second target round to obtain a secure multi-party computation result of the first target round.

[0087] The anonymous temporary public key set output by the preset hybrid network is written into the blockchain device. For ease of understanding, a smart contract is also provided in the embodiment of the present application. The preset access function included in the smart contract is access(B,ps), where B is the blockchain used by the blockchain device, and ps is the storage location of the anonymous temporary public key set on the blockchain.

[0088] Each participating device accesses the anonymous temporary public key set in the blockchain device based on the preset access function, and determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round. For ease of understanding, in the embodiment of the present application, the preset substitution relationship is ψ: in, is the set of participating devices, and n is the total number of participating devices. Using this preset substitution relationship, the index j=ψ(i) corresponding to the target temporary public key used by each participating device in the first target round is obtained from the anonymous temporary public key set stored on the blockchain, where j is the key index, which is obtained by substituting the index corresponding to the device identifier of the i-th participating device.

[0089] Based on the key index of the first target round, each participating device accesses the blockchain device through the preset access function in the smart contract, determines the target temporary public key used in the first target round corresponding to the key index from the anonymous temporary public key set, and then obtains the anonymous temporary public key tuple: Among them, j is the key index, which is obtained by replacing the index corresponding to the device identifier of the i-th participating device. is the temporary public key corresponding to the key index, and n is the total number of multiple participating devices.

[0090] The public key used to encrypt the information is In the case of , only the identity ID corresponding to the public key is Only the participating devices can decrypt the information, while other participating devices including the message sender cannot decrypt the message, thereby hiding the identity of the corresponding participating devices and improving the security of multi-party computing.

[0091] In addition, multiple rounds of secure multi-party computation are performed continuously. In the embodiment of the present application, blockchain is used to transmit information during secure multi-party computation. Specifically, when the round of secure multi-party computation is the first target round, and the first target round is not the first round, each committee device receives the secret share generated in the second target round and sent by the blockchain device, wherein the second target round is the previous round of the first target round; all committee devices in the first target round perform multi-party computation based on the secret share generated by the second target round to obtain the secure multi-party computation result of the first target round.

[0092] Existing secure multi-party computing methods usually use peer-to-peer (P2P) communication between participating devices. In this embodiment, blockchain devices are used to achieve hidden communication. Since blockchain networks usually design efficient node discovery and data addressing and forwarding strategies, they can be used as secure broadcast channels in secure multi-party computing processes, thereby reducing communication complexity. In addition, using an efficient blockchain network has higher message transmission efficiency than using communication methods such as P2P networks.

[0093] If a dedicated blockchain network is used between blockchain devices, blockchain settings are required. For ease of understanding, in the embodiments of this application, the dedicated blockchain network adopts the PoS (Proof of Stake) consensus mechanism. The block sequence of the blockchain is B0, B1, ..., B m B0 is the genesis block, and the data structure of the genesis block is:

[0094]

[0095] Among them, j is the key index, which is obtained by replacing the index corresponding to the device identifier of the i-th participating device. is the temporary public key corresponding to the key index, n is the total number of multiple participating devices, Q is the total number of temporary key pairs generated for each participating device, stake is the equity value, and aux is the auxiliary information required to execute the blockchain protocol. The data structure of the i-th block is B i =[H(B i-1 ),d,aux], where H(B i-1 ) is the hash value of the i-1th block, and d is the data stored in the block.

[0096] In an embodiment of the present application, all committee devices in the first target round perform secure multi-party computing based on the secret shares generated in the second target round to obtain a secure multi-party computing result of the first target round, including:

[0097] Each committee device determines whether the secret share generated in the second target round is a valid share;

[0098] When the secret share generated in the second target round is a valid share, each committee device in the first target round decrypts the secret share generated in the second target round, obtains a decryption result corresponding to the secret share, and determines whether the decryption result is a valid result;

[0099] When the decryption result is a valid result, all committee devices in the first target round perform secure multi-party computation based on the decryption result to obtain a secure multi-party computation result of the first target round.

[0100] Before performing secure multi-party computation, it is usually necessary to generate system public parameters:

[0101] pp←Setup(1 λ )

[0102] Wherein, pp is the system public parameter of the computing system, and λ is the system security parameter of the computing system, which is usually 128 or 256.

[0103] After the committee devices are determined, the secure multi-party computation process can be started. When the first target round is the first round, it is not necessary to receive the secret shares of the previous round. When the first target round is not the first round, the second target round is the previous round of the first target round, and the committee device of the first target round receives the secret shares sent by the committee device of the second target round. For ease of understanding, in the embodiment of the present application, the committee device P participating in the rth round of calculation i The secret shares are distributed using a publicly verifiable secret sharing algorithm:

[0104]

[0105] in, c l is the secret share sent to the committee device with key index l in round r+1, Pr sh is the evidence corresponding to the secret share, is the committee device P in round r i A temporary public key determined based on the key index, is the temporary private key corresponding to the temporary public key, n is the total number of multiple participating devices, pp is the system public parameter, r+1 is the first target round, that is, the r+1th round, is the anonymous public key set of the committee device in the r+1th round, and s is the secret to be shared, that is, the confidential data.

[0106] After the committee device of the first target round receives the secret share sent by the committee device of the second target round, the committee device of the first target round determines whether the secret share of the second target round is a valid share. For ease of understanding, in the embodiment of the present application, the algorithm for verifying whether the secret share is a valid share is:

[0107]

[0108] Among them, 0 / 1 is the output result of whether the secret share is a valid share. When the output result is 1, the secret share is a valid share. When the output result is 0, the secret share is an invalid share. pp is the system public parameter. is the temporary public key determined by the committee device in round r based on the key index, is the anonymous public key and secret share set of the committee device in round r+1, c l is the secret share received by the committee device with key index l in round r+1, n is the total number of participating devices, Pr sh is the evidence corresponding to the secret share.

[0109] When the secret shares received in the second target round are valid shares, each committee device decrypts the secret shares of the second target round to obtain the decryption results corresponding to the secret shares:

[0110]

[0111] Among them, a l is the decryption result obtained by decrypting the secret share, is the evidence of correct decryption of the secret share, pp is the system public parameter, is the temporary public key determined by the committee device in round r based on the key index, The temporary public key determined by the committee device in round r+1, is the temporary private key corresponding to the temporary public key, c l is the secret share received by the committee device with key index l in round r+1.

[0112] After decrypting the secret share and obtaining the decryption result corresponding to the secret share, it is determined whether the decryption result is a valid result. For ease of understanding, in the embodiment of the present application, the algorithm for determining whether the decryption result is a valid result is:

[0113]

[0114] Among them, 0 / 1 is the output result of whether the decryption result is a valid result. When the output result is 1, the decryption result is a valid result. When the output result is 0, the decryption result is an invalid result. pp is the system public parameter. is the temporary public key determined by the committee device in round r based on the key index, c l is the secret share received by the committee device with key index l in round r+1, a l is the decryption result obtained after decrypting the secret share, is proof of correct decryption of the secret share.

[0115] When the decryption result is a valid result, all committee devices of the first target round perform secure multi-party computation based on the decryption result to obtain the secure multi-party computation result of the first target round.

[0116] In an embodiment of the present application, the secure multi-party computation result of the first target round includes the secret share of the first target round;

[0117] The secure multi-party computation method also includes:

[0118] In the case where there is a third target round for secure multi-party computation, each committee device in the first target round sends the secret share generated in the first target round to the blockchain device based on a verifiable secret sharing algorithm, wherein the third target round is the next round after the first target round.

[0119] For ease of understanding, in the embodiment of the present application, based on the (t, n)-threshold secret sharing algorithm, taking the first target round as an example, after all committee devices of the first target round perform secure multi-party computation based on the decryption result, the following secret recovery algorithm can be used to obtain the secure multi-party computation result of the first target round:

[0120] s r+1 ←Rec(pp,{A l :l∈L})

[0121] Among them, s r+1 is the secure multi-party computation result of the first target round, pp is the system public parameter, A l is the new secret share obtained by all committee devices of the first target round after calculation based on the received secret share, l is the index corresponding to the device identifier of the committee device in the r+1th round, L∈[n], n is the total number of multiple participating devices, if the value of L is t+1, the committee devices of the first target round can calculate together to restore the secure multi-party computation result of the first target round.

[0122] In an embodiment of the present application, before each participating device determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round, it also includes:

[0123] Each participating device replaces the index corresponding to the device identifier based on a preset replacement relationship, so as to determine the replaced index as the key index of the first target round.

[0124] Each participating device replaces the index corresponding to the device identifier based on the preset replacement relationship to determine the replaced index as the key index of the first target round, so that the device identifier and the temporary public key in the anonymous temporary public key set are in a disordered relationship. Each participating device determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round. Each participating device can only determine the index corresponding to the temporary public key, but cannot determine other information of the preset replacement relationship, which improves the security of multi-party computing.

[0125] In an embodiment of the present application, before each participating device respectively inputs the device identification and the generated temporary public key set into the preset hybrid network to obtain multiple random anonymous temporary public key sets, it also includes:

[0126] Each participating device generates a preset number of temporary private keys based on the master key;

[0127] Each participating device generates a temporary public key corresponding to the temporary private key and destroys the master key to obtain a temporary key pair consisting of a preset number of temporary private keys and temporary public keys.

[0128] Each participating device generates a master key locally, and generates a preset number of temporary private keys based on the master key. Each participating device generates a temporary public key corresponding to each temporary private key, and obtains a preset number of temporary public keys. Each temporary private key and the corresponding temporary public key form a pair of temporary key pairs. When the preset number of temporary key pairs are obtained, the master key is destroyed to prevent the master key from being maliciously stolen and used.

[0129] The present application provides a secure multi-party computing method, which is applied to a computing system, wherein the computing system includes a plurality of participating devices, and the secure multi-party computing method includes: each participating device inputs a device identification and a generated temporary public key set into a preset hybrid network to obtain a plurality of random anonymous temporary public key sets; each participating device determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round; each participating device signs based on the first target round and the first random number seed to obtain the signature hash value of the participating device in the first target round; all participating devices determine all committee devices in the first target round from all participating devices based on the signature hash value; when the round of the secure multi-party computing is the first target round, all committee devices in the first target round perform secure multi-party computing to obtain secure multi-party computing results. The anonymous temporary public key set eliminates the corresponding relationship between the temporary public key of the participating device and its identity, thereby concealing the identity of the participating device. The attacker cannot quickly identify the identity of the participating device, thereby improving the identity concealment and process security of the secure multi-party computing. In addition, the committee devices are quickly selected through anonymous signatures, which ensures that participating devices can dynamically participate in the secure multi-party computing process. Compared with the static secure multi-party computing process, the scalability and security of secure multi-party computing are further improved.

[0130] The present application also provides a computing system, including:

[0131] a memory configured to store instructions; and

[0132] The processor is configured to call instructions from the memory and implement the above-mentioned secure multi-party computing method when executing the instructions.

[0133] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set to solve the problem of low security of multi-party computing by adjusting kernel parameters.

[0134] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0135] See also Figure 2 , Figure 2 A schematic diagram of the structure of a computing system provided in an embodiment of the present application is shown.

[0136] In this embodiment, the computing system 200 also includes multiple participating devices 210 and blockchain devices 220. For ease of understanding, the memory and processor are no longer shown in the figure. Each participating device 210 inputs the device identification and the generated temporary public key set into the preset hybrid network 300 to obtain multiple random anonymous temporary public key sets. The preset hybrid network 300 writes the obtained anonymous temporary public key set into the blockchain device 220, and the participating device 210 accesses the blockchain device 220 to query the anonymous temporary public key to perform secure multi-party computing.

[0137] In this embodiment, the blockchain device 220 is used to store an anonymous temporary public key set so that the participating device 210 can quickly query the anonymous temporary public key. The blockchain device 220 is also used to implement covert communication. Specifically, during the secure multi-party computing process, the participating device 210 embeds the verifiable secret share into the transaction data of the blockchain, and the blockchain device 220 synchronizes the transaction data to the blockchain network node through the message synchronization mechanism in the blockchain network. The blockchain network node recovers the verifiable secret share based on the received transaction data, and then performs share validity verification and secure multi-party computing.

[0138] An embodiment of the present application also provides a machine-readable storage medium, on which instructions are stored. When the instructions are executed by a processor, the processor is configured to execute the above-mentioned secure multi-party computing method.

[0139] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above-mentioned secure multi-party computing method when executed by a processor.

[0140] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0141] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0142] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0143] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0144] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0145] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0146] Machine-readable storage media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0147] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0148] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A secure multi-party computing method, characterized in that: Applied to a computing system, the computing system includes a plurality of participating devices, and the secure multi-party computing method includes: Each of the participating devices inputs the device identification and the generated temporary public key set into a preset hybrid network to obtain multiple random anonymous temporary public key sets, wherein the preset hybrid network is used to permute the index corresponding to the device identification based on a preset permutation relationship to output multiple anonymous temporary public key sets in which the device identification and the temporary public key are in a random relationship; Each of the participating devices determines, based on the key index of the first target round, a target temporary public key used in the first target round from the anonymous temporary public key set; Each of the participating devices signs based on a temporary private key and a first random number seed to obtain a signature hash value of the participating device in the first target round, wherein the target temporary public key is used to verify the signature; All participating devices determine all committee devices in the first target round from all participating devices based on the signature hash value; When the round of the secure multi-party computation is the first target round, all committee devices in the first target round perform the secure multi-party computation to obtain a secure multi-party computation result.

2. The secure multi-party computing method according to claim 1, characterized in that: The computing system also includes a blockchain device; Each of the participating devices determines, based on the key index of the first target round, a target temporary public key used in the first target round from the anonymous temporary public key set, including: Each of the participating devices accesses the anonymous temporary public key set in the blockchain device based on a preset access function, and determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round; When the round of the secure multi-party computation is the first target round, all committee devices in the first target round perform secure multi-party computation to obtain a secure multi-party computation result, including: When the round of secure multi-party computation is the first target round and the first target round is not the first round, each of the committee devices receives the secret share generated in the second target round sent by the blockchain device, wherein the second target round is a previous round of the first target round; All the committee devices in the first target round perform secure multi-party computing based on the secret shares generated in the second target round to obtain a secure multi-party computing result of the first target round.

3. The secure multi-party computing method according to claim 2, characterized in that: All the committee devices in the first target round perform secure multi-party computing based on the secret shares generated in the second target round to obtain a secure multi-party computing result of the first target round, including: Each of the committee devices determines whether the secret share generated in the second target round is a valid share; In a case where the secret share generated in the second target round is a valid share, each of the committee devices in the first target round decrypts the secret share generated in the second target round to obtain a decryption result corresponding to the secret share, and determines whether the decryption result is a valid result; When the decryption result is a valid result, all the committee devices in the first target round perform secure multi-party computation based on the decryption result to obtain a secure multi-party computation result of the first target round.

4. The secure multi-party computing method according to claim 2, characterized in that: The secure multi-party computation result of the first target round includes the secret share of the first target round; The method further comprises: In the case where there is a third target round in the secure multi-party computation, each of the committee devices in the first target round sends the secret share generated in the first target round to the blockchain device based on a verifiable secret sharing algorithm, wherein the third target round is the next round of the first target round.

5. The secure multi-party computing method according to claim 1, characterized in that: The committee device includes a leader device and other devices, and the leader device is used to synchronize information to all the other devices; All the participating devices determine all committee devices in the first target round from all the participating devices based on the signature hash value, including: All participating devices determine all candidate leader devices in the first target round from all participating devices based on the signature hash value, and determine a leader device from all candidate leader devices, wherein the candidate leader device is a participating device whose signature hash value is less than the first target value, and the leader device is a participating device with the smallest signature hash value among all candidate leader devices; All participating devices determine all other devices from all participating devices based on the signature hash value, wherein the other devices are participating devices other than the leading device whose signature hash values ​​are less than a second target value, and the second target value is greater than the first target value.

6. The secure multi-party computing method according to claim 1, characterized in that: Each of the participating devices signs based on the first target round and the first random number seed to obtain a signature hash value of the participating device in the first target round, including: When the round of secure multi-party computing is the fourth target round, each of the participating devices confuses the target temporary private key with the first random number seed to obtain a second random number seed, wherein the fourth target round is any secure multi-party computing round before the first target round; Each participating device signs based on the second random number seed to obtain a signature hash value of the participating device in the first target round.

7. The secure multi-party computing method according to claim 1, characterized in that: Before each of the participating devices determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round, the method further comprises: Each participating device replaces the index corresponding to the device identifier based on the preset replacement relationship, so as to determine the replaced index as the key index of the first target round.

8. The secure multi-party computing method according to claim 1, characterized in that: Before each of the participating devices inputs the device identification and the generated temporary public key set into the preset hybrid network to obtain multiple random anonymous temporary public key sets, the method further includes: Each of the participating devices generates a preset number of temporary private keys based on the master key; Each of the participating devices generates a temporary public key corresponding to the temporary private key and destroys the master key to obtain a temporary key pair consisting of a preset number of the temporary private keys and the temporary public keys.

9. A computing system, characterized in that: include: a memory configured to store instructions; as well as A processor is configured to call the instructions from the memory and implement the secure multi-party computing method according to any one of claims 1 to 8 when executing the instructions.

10. A machine-readable storage medium having instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor is configured to perform the secure multi-party computing method according to any one of claims 1 to 8.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the secure multi-party computing method according to any one of claims 1 to 8.

Images