Secure multi-party computation methods, computing systems, storage media, and software products

Abstract

This application provides a secure multi-party computation method, computing system, storage medium, and program product, belonging to the field of data processing. The secure multi-party computation method is applied to a computing system including multiple participating devices. The method includes: each participating device inputting its device identifier and a generated set of temporary public keys into a preset hybrid network to obtain multiple disordered sets of anonymous temporary public keys; each participating device determining the target temporary public key used in the first target round from the set of anonymous temporary public keys based on the key index of the first target round; all participating devices determining all committee devices in the first target round from all participating devices based on the signature hash value; and when the round of the secure multi-party computation is the first target round, all committee devices in the first target round perform secure multi-party computation to obtain the secure multi-party computation result.

Description

Technical Field

[0001] This invention relates to the field of data processing, and more specifically to a secure multi-party computation method, computing system, storage medium, and program product. Background Technology

[0002] With the rapid development of cryptography, secure multi-party computation (MPC) has been widely applied in various secure computing scenarios. MPC allows multiple participants to jointly compute the result of a function without revealing their private input. Typically, static secure multi-party computation processes require multiple rounds of computation according to a protocol, requiring participants to remain active throughout the computation process.

[0003] However, because it's difficult to guarantee that all parties will consistently participate in the protocol execution process, the participation threshold for static secure multi-party computation is too high, affecting participants' willingness to engage in multi-party computation. Attackers often damage or manipulate participants' devices. With only a small number of participants consistently involved in secure multi-party computation, attackers can quickly identify all participants in the process. Furthermore, when participants are static, attackers can more easily identify them, enabling malicious attacks and resulting in lower security for multi-party computation. Summary of the Invention

[0004] The purpose of this invention is to provide a secure multi-party computation method, computing system, storage medium, and program product. The secure multi-party computation method is used to solve the problem of low security in multi-party computation.

[0005] To achieve the above objectives, in a first aspect, this application provides a secure multi-party computation method applied to a computing system, the computing system including multiple participating devices, the secure multi-party computation method including:

[0006] Each participating device inputs its device identifier and the generated set of temporary public keys into a preset hybrid network to obtain multiple sets of anonymous temporary public keys in a disordered manner. The preset hybrid network is used to permutate the index corresponding to the device identifier based on a preset permutation relationship to output multiple sets of anonymous temporary public keys in a disordered manner between the device identifier and the temporary public key.

[0007] Each participating device determines the target temporary public key used in the first target round from the set of anonymous temporary public keys based on the key index of the first target round;

[0008] Each participating device signs based on a temporary private key and a first random number seed to obtain the signature hash value of the participating device in the first target round, wherein the target temporary public key is used to verify the signature;

[0009] All participating devices are identified from all participating devices for the first target round based on their signature hash values;

[0010] When the round of the secure multi-party computation is the first target round, all committee devices in the first target round perform secure multi-party computation to obtain the secure multi-party computation result.

[0011] In embodiments of this application, the computing system further includes a blockchain device;

[0012] Each participating device determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round, including:

[0013] Each participating device accesses the set of anonymous temporary public keys in the blockchain device based on a preset access function, and determines the target temporary public key used in the first target round from the set of anonymous temporary public keys based on the key index of the first target round.

[0014] When the round of the security multi-party computation is the first target round, all committee equipment in the first target round performs security multi-party computation to obtain the security multi-party computation results, including:

[0015] In the case where the round of secure multi-party computation is the first target round, and the first target round is not the first round, each committee device receives the secret share generated in the second target round sent by the blockchain device, wherein the second target round is the round preceding the first target round;

[0016] All committee devices in the first objective round perform secure multi-party computation based on the secret share generated in the second objective round to obtain the secure multi-party computation result of the first objective round.

[0017] In embodiments of this application, all committee devices in the first target round perform secure multi-party computation based on the secret share generated in the second target round to obtain the secure multi-party computation result of the first target round, including:

[0018] Each committee device determines whether the secret share generated in the second objective round is a valid share;

[0019] If the secret share generated in the second target round is a valid share, each committee device in the first target round decrypts the secret share generated in the second target round, obtains the decryption result corresponding to the secret share, and determines whether the decryption result is a valid result;

[0020] If the decryption result is valid, all committee devices in the first target round perform secure multi-party computation based on the decryption result to obtain the secure multi-party computation result of the first target round.

[0021] In the embodiments of this application, the secure multi-party computation result of the first target round includes the secret share of the first target round;

[0022] Secure multi-party computation methods also include:

[0023] In the case of a third objective round in secure multi-party computation, each committee device in the first objective round sends the secret share generated in the first objective round to the blockchain device based on a verifiable secret sharing algorithm, wherein the third objective round is the round following the first objective round.

[0024] In embodiments of this application, the committee equipment includes a leadership device and other devices, wherein the leadership device is used to synchronize information to all other devices;

[0025] All participating devices are identified from all participating devices in the first target round based on their signature hash values, including:

[0026] Based on the signature hash value, all participating devices are selected from all participating devices to determine all candidate leader devices in the first target round, and the leader device is determined from all candidate leader devices. The candidate leader device is the participating device whose signature hash value is less than the first target value, and the leader device is the participating device with the smallest signature hash value among all candidate leader devices.

[0027] All participating devices are determined from all participating devices based on their signature hash values. Other devices are participating devices other than the leader device whose signature hash values ​​are less than the second target value, and the second target value is greater than the first target value.

[0028] In embodiments of this application, each participating device performs a signature based on a first target round and a first random number seed to obtain the signature hash value of the participating device in the first target round, including:

[0029] In the case that the round of secure multi-party computation is the fourth target round, each participating device confuses the target temporary private key and the first random number seed to obtain the second random number seed. The fourth target round is any secure multi-party computation round before the first target round.

[0030] Each participating device signs based on a second random number seed to obtain the signature hash value of the participating device in the first target round.

[0031] In embodiments of this application, before each participating device determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round, the method further includes:

[0032] Each participating device permutes the index corresponding to the device identifier based on a preset permutation relationship, so as to determine the permuted index as the key index for the first target round.

[0033] In the embodiments of this application, before each participating device inputs its device identifier and the generated set of temporary public keys into a preset hybrid network to obtain multiple out-of-order anonymous temporary public key sets, the method further includes:

[0034] Each participating device generates a preset number of temporary private keys based on the master key;

[0035] Each participating device generates a temporary public key corresponding to its temporary private key and destroys the master key to obtain a preset number of temporary key pairs consisting of temporary private keys and temporary public keys.

[0036] Secondly, this application provides a computing system, comprising:

[0037] The memory is configured to store instructions; and

[0038] The processor is configured to retrieve instructions from memory and, when executing instructions, to implement the aforementioned secure multi-party computation method.

[0039] Thirdly, this application provides a machine-readable storage medium storing instructions that, when executed by a processor, configure the processor to perform the aforementioned secure multi-party computation method.

[0040] Fourthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned secure multi-party computation method.

[0041] This application provides a secure multi-party computation method applied to a computing system comprising multiple participating devices. The secure multi-party computation method includes: each participating device inputting its device identifier and a generated set of temporary public keys into a preset hybrid network to obtain multiple disordered sets of anonymous temporary public keys; each participating device determining the target temporary public key used in the first target round from the anonymous temporary public key sets based on the key index of the first target round; each participating device signing based on the first target round and a first random number seed to obtain a signature hash value of the participating device in the first target round; all participating devices determining all committee devices in the first target round from all participating devices based on the signature hash values; and, if the round of the secure multi-party computation is the first target round, all committee devices in the first target round perform secure multi-party computation to obtain the secure multi-party computation result. The anonymous temporary public key sets eliminate the correspondence between the temporary public keys of participating devices and their identities, thereby concealing the identities of the participating devices. Attackers cannot identify the identities of the participating devices, thus improving the identity concealment and process security of the secure multi-party computation. Furthermore, the use of anonymized signatures to quickly select committee devices ensures that participating devices can dynamically participate in secure multi-party computation, further improving the efficiency and security of secure multi-party computation compared to a static secure multi-party computation process.

[0042] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0043] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings:

[0044] Figure 1 A flowchart of the secure multi-party computation method provided in an embodiment of this application is shown;

[0045] Figure 2 A schematic diagram of the structure of the computing system provided in an embodiment of this application is shown. Detailed Implementation

[0046] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustrative and explanatory purposes only and are not intended to limit the scope of the present invention.

[0047] The components of the embodiments of the invention described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0048] In the following, the terms “comprising,” “having,” and their cognates, which may be used in various embodiments of the invention, are intended only to indicate a particular feature, number, step, operation, element, component, or combination thereof, and should not be construed as excluding, firstly, the presence of one or more other features, numbers, steps, operations, elements, components, or combinations thereof, or adding the possibility of one or more features, numbers, steps, operations, elements, components, or combinations thereof.

[0049] Furthermore, the terms "first," "second," and "third" are used only to distinguish descriptions and should not be interpreted as indicating or implying relative importance.

[0050] Unless otherwise specified, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which the various embodiments of the invention pertain. Terms (such as those defined in commonly used dictionaries) shall be interpreted as having the same meaning as in their contextual meaning in the relevant technical field and shall not be interpreted as having an idealized or overly formal meaning, unless clearly defined in the various embodiments of the invention.

[0051] Please see Figure 1 , Figure 1 A flowchart of a secure multi-party computation method provided in an embodiment of this application is shown. Figure 1 The secure multi-party computation method is applied to a computing system that includes multiple participating devices. Figure 1 The secure multi-party computation methods in China include:

[0052] S110, each participating device inputs its device identifier and the generated set of temporary public keys into a preset hybrid network to obtain multiple sets of anonymous temporary public keys in random order. The preset hybrid network is used to permutate the index corresponding to the device identifier based on a preset permutation relationship to output multiple sets of anonymous temporary public keys in random order between the device identifier and the temporary public key.

[0053] In a secure multi-party computation scenario, the computation system includes multiple participating devices. The number of devices is set according to actual needs and is not limited here. Each participating device generates multiple sets of temporary key pairs corresponding to multiple computation rounds of the secure multi-party computation. Each temporary key pair includes a temporary public key and a temporary private key. The number of temporary key pairs generated by each participating device is set according to the actual needs of the secure multi-party computation task. The number of temporary key pairs can be determined according to the secure multi-party computation protocol, or a fixed number of temporary key pairs can be generated; this is not limited here.

[0054] Based on the multiple temporary key pairs generated by each participating device, the set of temporary key pairs constructed is as follows: in, For the q-th temporary private key generated by the i-th participating device, The q-th temporary public key is generated for the i-th participating device, where n is the total number of participating devices, and Q is the total number of temporary key pairs included in the temporary key pair set.

[0055] Typically, participating devices can identify themselves using device identifiers. It's important to understand that the type of device identifier is set according to actual needs and can use identity IDs (IDentifiers), etc., without limitation here. For ease of understanding, in the embodiments of this application, each participating device inputs its device identifier and a set of temporary public keys into a preset hybrid network to obtain multiple disordered anonymous temporary public key sets. This eliminates the correspondence between the temporary public keys of participating devices and their identities, thereby concealing the identities of the participating devices.

[0056] A preset hybrid network is used to permutate the public keys in a set of temporary public keys based on a preset permutation relationship, outputting multiple sets of anonymous temporary public keys in a disordered order between the device identifier and the temporary public keys. For ease of understanding, in the embodiments of this application, the multiple sets of anonymous temporary public keys output by the preset hybrid network are... Where j is the key index, which is obtained by permuting the index corresponding to the device identifier of the participating device. Let be the anonymous temporary public key with key index j in the q-th temporary public key set, n be the total number of participating devices, and Q be the total number of temporary key pairs included in the temporary key pair set.

[0057] S120, each participating device determines the target temporary public key used in the first target round from the set of anonymous temporary public keys based on the key index of the first target round;

[0058] The index corresponding to the device identifier is permuted based on a preset permutation relationship to obtain the key index, thereby disrupting the correspondence between participating devices and temporary public keys. Each participating device determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round. Each participating device can only determine the index corresponding to the temporary public key, but cannot determine other information of the preset permutation relationship, thus eliminating the correspondence between participating devices and temporary public keys and achieving identity concealment of participating devices.

[0059] S130, each participating device signs based on a temporary private key and a first random number seed to obtain the signature hash value of the participating device in the first target round, wherein the target temporary public key is used to verify the signature.

[0060] Each participating device signs based on the first target round and the first random number seed, and obtains the signature hash value of the participating device in the first target round based on a preset hash function. Normally, any currently participating device can sign using the generated temporary private key, and other participating devices can verify the validity of the signature using the temporary public key corresponding to the temporary private key. Since the temporary public key is anonymized, the identity information of the signer will not be exposed during the signature verification process.

[0061] S140, based on the signature hash value, all participating devices determine all committee devices in the first target round from all participating devices.

[0062] Secure multi-party computation (SMPC) scenarios require multiple rounds of computation, each round of which necessitates a committee to perform the computation. This committee comprises at least two committee devices. With all participating devices having signed, the committee devices for the first target round are determined based on the hash value of each participating device's signature. This anonymized signature-based, rapid selection of committee devices allows participating devices to dynamically participate in the SMPC process according to the rounds, further improving the scalability and security of secure multi-party computation compared to a static process.

[0063] It is important to understand that in multiple calculation processes, the committee equipment in the committee needs to meet the requirement of an honest majority, for example, at least 2 / 3 of the committee equipment must be honest, which will not be elaborated here.

[0064] It should also be understood that, in the embodiments of this application, each participating device may be limited to participating in only one round of multi-party computation to further improve the security of multi-party computation. Therefore, when a participating device participates in secure multi-party computation, it can use a temporary private key to sign the message. After the message is broadcast, the participating device immediately destroys the temporary private key used for signing to prevent the temporary private key from being obtained and used by an attacker.

[0065] In embodiments of this application, each participating device performs a signature based on a first target round and a first random number seed to obtain the signature hash value of the participating device in the first target round, including:

[0066] In the case that the round of secure multi-party computation is the fourth target round, each participating device confuses the target temporary private key and the first random number seed to obtain the second random number seed. The fourth target round is any secure multi-party computation round before the first target round.

[0067] Each participating device signs based on a second random number seed to obtain the signature hash value of the participating device in the first target round.

[0068] Because secure multi-party computation scenarios involve multiple rounds of computation among participating devices, the nodes of the devices that served as committee members in the first computation round must be determined in advance in the fourth objective round. The fourth objective round can be any secure multi-party computation round preceding the first objective round. The value of the fourth objective round is set according to actual needs and is not limited here.

[0069] For ease of understanding, embodiments of this application use a method similar to a Verifiable Random Function (VRF) to determine committee devices. A VRF is an cryptographic function that generates pseudo-random numbers based on data input and attaches a proof. The currently participating device can verify whether it has been selected as a committee device through local computation, while other participating devices cannot perform this verification.

[0070] In the fourth target round of secure multi-party computation, each participating device obfuscates the target temporary private key and the first random number seed to obtain a second random number seed. Specifically, an obfuscator is pre-selected and synchronized to all participating devices. After receiving the obfuscator, each participating device inputs the first random number seed and the target temporary private key into the obfuscator to output the second random number seed.

[0071] Each participating device signs based on a second random number seed to obtain its signature hash value in the first target round. The signing process is anonymous and secure, and the generation of the second random number seed is simple and applicable to various scenarios. Simultaneously, the anonymized signature allows for rapid selection of committee devices, enabling participating devices to securely participate in secure multi-party computation according to the rounds of secure multi-party computation.

[0072] In embodiments of this application, the committee equipment includes a leadership device and other devices, wherein the leadership device is used to synchronize information to all other devices;

[0073] All participating devices are identified from all participating devices in the first target round based on their signature hash values, including:

[0074] Based on the signature hash value, all participating devices are selected from all participating devices to determine all candidate leader devices in the first target round, and the leader device is determined from all candidate leader devices. The candidate leader device is the participating device whose signature hash value is less than the first target value, and the leader device is the participating device with the smallest signature hash value among all candidate leader devices.

[0075] All participating devices are determined from all participating devices based on their signature hash values. Other devices are participating devices other than the leader device whose signature hash values ​​are less than the second target value, and the second target value is greater than the first target value.

[0076] Each participating device locally calculates whether its signature hash value is less than a first target value. If the signature hash value is less than the first target value, the participating device is determined as a candidate leader device. The candidate leader devices synchronize their signature hash values, and then the participating device with the smallest signature hash value among all candidate leader devices is determined as the leader device.

[0077] It's important to understand that it's typically necessary to determine the committee devices for the current and next round. The participating devices, once identified as committee devices, can dynamically participate in the secure multi-party computation process based on available computing resources. If the leader device with the smallest signature hash value withdraws from the secure multi-party computation, the candidate leader device with the second smallest signature hash value is determined, and so on, until the current leader device is confirmed to participate in the secure multi-party computation.

[0078] The process of identifying other devices is similar to that of identifying the leader device. Each participating device locally calculates whether its signature hash value is less than a second target value, where the second target value is greater than a first target value. If the signature hash value is less than the second target value, the participating device other than the leader device is identified as another device. Participating devices determine whether they are selected as committee devices by calculating their signature hash values ​​locally. Committee devices are unaware of the identities of other members, and committee devices cannot disclose the committee member allocation results before participating in the computation. This prevents attackers from pre-determining which participating devices to attack, thereby improving the security of multi-party computation.

[0079] S150, when the round of the secure multi-party computation is the first target round, all committee equipment in the first target round performs secure multi-party computation to obtain the secure multi-party computation result.

[0080] In secure multi-party computation (MMC) scenarios, the MMC process is performed sequentially in rounds. The committee devices for the first target round need to be determined in advance. This first target round can be any round in a multi-round MMC, without limitation. When the target round is the first round of the MMC, all committee devices in that round perform the MMC to obtain the result. By using a pre-defined hybrid network, multiple anonymous temporary public keys with a disordered relationship between device identifiers and temporary public keys are obtained. This eliminates the mapping between the temporary public keys and identities of participating devices, thus concealing their identities. Attackers cannot quickly identify the participating devices, thereby improving the anonymity and process security of the secure MMC.

[0081] In embodiments of this application, the computing system further includes a blockchain device;

[0082] Each participating device determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round, including:

[0083] Each participating device accesses the set of anonymous temporary public keys in the blockchain device based on a preset access function, and determines the target temporary public key used in the first target round from the set of anonymous temporary public keys based on the key index of the first target round.

[0084] When the round of the security multi-party computation is the first target round, all committee equipment in the first target round performs security multi-party computation to obtain the security multi-party computation results, including:

[0085] In the case where the round of secure multi-party computation is the first target round, and the first target round is not the first round, each committee device receives the secret share generated in the second target round sent by the blockchain device, wherein the second target round is the round preceding the first target round;

[0086] All committee devices in the first objective round perform secure multi-party computation based on the secret share generated in the second objective round to obtain the secure multi-party computation result of the first objective round.

[0087] An anonymous temporary public key set output by a pre-defined hybrid network is written into the blockchain device. For ease of understanding, this application embodiment also provides a smart contract, which includes a pre-defined access function access(B,ps), where B is the blockchain used by the blockchain device and ps is the storage location of the anonymous temporary public key set on the blockchain.

[0088] Each participating device accesses the set of anonymous temporary public keys in the blockchain device based on a preset access function, and determines the target temporary public key used in the first target round from the set of anonymous temporary public keys based on the key index of the first target round. For ease of understanding, in the embodiments of this application, the preset permutation relation is ψ: in, Let n be the set of participating devices, and n be the total number of participating devices. Using this preset permutation relation, the index j = ψ(i) corresponding to the target temporary public key used by each participating device in the first target round is obtained from the set of anonymous temporary public keys stored on the blockchain, where j is the key index, which is obtained by permuting the index corresponding to the device identifier of the i-th participating device.

[0089] Each participating device, based on the key index of the first target round, accesses the blockchain device through a preset access function in the smart contract, determines the target temporary public key used in the first target round corresponding to the key index from the anonymous temporary public key set, and thus obtains an anonymous temporary public key tuple: Where j is the key index, which is obtained by permuting the index corresponding to the device identifier of the i-th participating device. is the temporary public key corresponding to the key index, and n is the total number of participating devices.

[0090] The public key used for encrypting information is In this case, only the identity ID corresponding to the public key is Only the participating devices can decrypt the information, while other participating devices, including the message sender, cannot decrypt the message, thus concealing the identity of the corresponding participating devices and improving the security of multi-party computation.

[0091] Furthermore, the multi-round secure multi-party computation is performed continuously. In the embodiments of this application, blockchain is used for information transmission during the secure multi-party computation process. Specifically, when the round of secure multi-party computation is a first target round, and the first target round is not the first round, each committee device receives a secret share generated in the second target round and sent through a blockchain device, wherein the second target round is the round preceding the first target round; all committee devices in the first target round perform multi-party computation based on the secret share generated in the second target round to obtain the secure multi-party computation result of the first target round.

[0092] Existing secure multi-party computation methods typically employ peer-to-peer (P2P) communication between participating devices. This embodiment uses a blockchain device to achieve covert communication. Since blockchain networks are generally designed with efficient node discovery and data addressing and forwarding strategies, they can serve as secure broadcast channels in the secure multi-party computation process, thereby reducing communication complexity. Furthermore, using an efficient blockchain network offers higher message passing efficiency compared to communication methods such as P2P networks.

[0093] If a dedicated blockchain network is used between blockchain devices, blockchain setup is required. For ease of understanding, in the embodiments of this application, the dedicated blockchain network adopts the PoS (Proof of Stake) consensus mechanism. The block sequence of the blockchain consists of B0, B1, ..., B m Composition: B0 is the genesis block, and the data structure of the genesis block is as follows:

[0094]

[0095] Where j is the key index, which is obtained by permuting the index corresponding to the device identifier of the i-th participating device. Let be the temporary public key corresponding to the key index, n be the total number of participating devices, Q be the total number of temporary key pairs generated for each participating device, stake be the stake value, and aux be the auxiliary information required to execute the blockchain protocol. The data structure of the i-th block is B. i =[H(B i-1 ),d,aux], where H(B i-1 ) represents the hash value of the (i-1)th block, and d represents the data stored in that block.

[0096] In embodiments of this application, all committee devices in the first target round perform secure multi-party computation based on the secret share generated in the second target round to obtain the secure multi-party computation result of the first target round, including:

[0097] Each committee device determines whether the secret share generated in the second objective round is a valid share;

[0098] If the secret share generated in the second target round is a valid share, each committee device in the first target round decrypts the secret share generated in the second target round, obtains the decryption result corresponding to the secret share, and determines whether the decryption result is a valid result;

[0099] If the decryption result is valid, all committee devices in the first target round perform secure multi-party computation based on the decryption result to obtain the secure multi-party computation result of the first target round.

[0100] Before performing secure multi-party computation, it is usually necessary to generate publicly available system parameters:

[0101] pp←Setup(1 λ )

[0102] Where pp is the publicly available system parameter of the computing system, and λ is the system security parameter of the computing system, which is usually taken as 128 or 256.

[0103] Once the committee device is identified, the secure multi-party computation process can begin. If the first target round is round 1, then it is not necessary to receive the secret share from the previous round. If the first target round is not round 1, the second target round is the round preceding the first target round, and the committee device in the first target round receives the secret share sent by the committee device in the second target round. For ease of understanding, in the embodiments of this application, the committee device P participating in the r-th round computation... i The secret share is distributed using a publicly verifiable secret-sharing algorithm:

[0104]

[0105] in, c l For the secret share sent to the committee device with key index l in the (r+1)th round, Pr sh Evidence corresponding to the secret share For the committee equipment P in round r i Based on the temporary public key determined by the key index, Here, is the temporary private key corresponding to the temporary public key, n is the total number of participating devices, pp is the publicly available system parameter, and r+1 is the first target round, i.e., the (r+1)th round. Let s be the set of anonymous public keys for the committee equipment in round r+1, and s be the secret to be shared, i.e., the encrypted data.

[0106] After receiving the secret share from the committee device of the second target round, the committee device of the first target round determines whether the secret share of the second target round is a valid share. For ease of understanding, in the embodiments of this application, the algorithm for verifying whether the secret share is a valid share is as follows:

[0107]

[0108] Here, 0 / 1 indicates whether the secret share is a valid share. An output of 1 indicates a valid secret share, while an output of 0 indicates an invalid secret share. pp is a publicly disclosed system parameter. For the committee device in round r, a temporary public key is determined based on the key index. Let c be the set of anonymous public keys and secret shares of the committee equipment in round r+1. l Pr represents the secret share received by the committee device with key index l in round r+1, where n is the total number of participating devices. sh Evidence corresponding to the secret share.

[0109] If the secret share received in the second target round is a valid share, each committee device decrypts the secret share of the second target round to obtain the decryption result corresponding to the secret share:

[0110]

[0111] Among them, a l The decryption result obtained by decrypting the secret share. pp is a publicly available system parameter that serves as evidence for the correct decryption of the secret share. For the committee device in round r, a temporary public key is determined based on the key index. The temporary public key determined for the committee equipment in round r+1. c is the temporary private key corresponding to this temporary public key. l This is the secret share received by the committee device with key index l in round r+1.

[0112] After decrypting the secret share and obtaining the corresponding decryption result, it is determined whether the decryption result is valid. For ease of understanding, in the embodiments of this application, the algorithm for determining whether the decryption result is valid is as follows:

[0113]

[0114] Here, 0 / 1 indicates whether the decryption result is valid. An output of 1 indicates a valid decryption result, while an output of 0 indicates an invalid decryption result. pp is a publicly available system parameter. For the temporary public key determined by the key index for the committee device in round r, c l For the secret share received by the committee device with key index l in round r+1, a l The result obtained after decrypting this secret share. Evidence for the proper decryption of secret shares.

[0115] If the decryption result is valid, all committee devices in the first target round perform secure multi-party computation based on the decryption result to obtain the secure multi-party computation result of the first target round.

[0116] In the embodiments of this application, the secure multi-party computation result of the first target round includes the secret share of the first target round;

[0117] Secure multi-party computation methods also include:

[0118] In the case of a third objective round in secure multi-party computation, each committee device in the first objective round sends the secret share generated in the first objective round to the blockchain device based on a verifiable secret sharing algorithm, wherein the third objective round is the round following the first objective round.

[0119] For ease of understanding, the embodiments of this application are based on the (t,n)-threshold secret sharing algorithm. Taking the first target round as an example, after all committee devices in the first target round have performed secure multi-party computation based on the decryption results, the following secret recovery algorithm can be used to obtain the secure multi-party computation result of the first target round:

[0120] s r+1 ←Rec(pp,{A l :l∈L})

[0121] Among them, s r+1 The result of the security multi-party calculation for the first objective round, pp represents the publicly available system parameters, and A... l The new secret share is calculated by all committee devices in the first target round based on the received secret share. l is the index corresponding to the device identifier of the committee device in the (r+1)th round, L∈[n], and n is the total number of participating party devices. If the value of L is t+1, the committee devices in the first target round can jointly perform calculations to recover the secure multi-party calculation result of the first target round.

[0122] In embodiments of this application, before each participating device determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round, the method further includes:

[0123] Each participating device permutes the index corresponding to the device identifier based on a preset permutation relationship, so as to determine the permuted index as the key index for the first target round.

[0124] Each participating device permutes the index corresponding to its device identifier based on a preset permutation relationship, using the permuted index as the key index for the first target round. This results in a disordered relationship between the device identifier and the temporary public keys in the anonymous temporary public key set. Each participating device then determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index for the first target round. Each participating device can only determine the index corresponding to the temporary public key and cannot determine other information related to the preset permutation relationship, thus improving the security of multi-party computation.

[0125] In the embodiments of this application, before each participating device inputs its device identifier and the generated set of temporary public keys into a preset hybrid network to obtain multiple out-of-order anonymous temporary public key sets, the method further includes:

[0126] Each participating device generates a preset number of temporary private keys based on the master key;

[0127] Each participating device generates a temporary public key corresponding to its temporary private key and destroys the master key to obtain a preset number of temporary key pairs consisting of temporary private keys and temporary public keys.

[0128] Each participating device generates a master key locally and generates a preset number of temporary private keys based on the master key. Each participating device generates a temporary public key for each temporary private key, resulting in a preset number of temporary public keys. Each temporary private key and its corresponding temporary public key form a temporary key pair. Once the preset number of temporary key pairs are obtained, the master key is destroyed to prevent it from being maliciously stolen and used.

[0129] This application provides a secure multi-party computation method applied to a computing system comprising multiple participating devices. The secure multi-party computation method includes: each participating device inputting its device identifier and a generated set of temporary public keys into a preset hybrid network to obtain multiple disordered sets of anonymous temporary public keys; each participating device determining the target temporary public key used in the first target round from the anonymous temporary public key sets based on the key index of the first target round; each participating device signing based on the first target round and a first random number seed to obtain a signature hash value for the participating device in the first target round; all participating devices determining all committee devices in the first target round from all participating devices based on the signature hash values; and, if the round of the secure multi-party computation is the first target round, all committee devices in the first target round perform secure multi-party computation to obtain the secure multi-party computation result. The anonymous temporary public key sets eliminate the correspondence between the temporary public keys of participating devices and their identities, thereby concealing the identities of the participating devices. Attackers cannot quickly identify the identities of the participating devices, thus improving the identity concealment and process security of the secure multi-party computation. Furthermore, the use of anonymized signatures to quickly select committee devices ensures that participating devices can dynamically participate in the secure multi-party computation process, which further improves the scalability and security of secure multi-party computation compared to a static secure multi-party computation process.

[0130] This application also provides a computing system, including:

[0131] The memory is configured to store instructions; and

[0132] The processor is configured to retrieve instructions from memory and, when executing instructions, to implement the aforementioned secure multi-party computation method.

[0133] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and the security issues associated with multi-party computation can be addressed by adjusting kernel parameters.

[0134] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0135] Please see Figure 2 , Figure 2 A schematic diagram of the structure of the computing system provided in an embodiment of this application is shown.

[0136] In this embodiment, the computing system 200 also includes multiple participating devices 210 and a blockchain device 220. For ease of understanding, the memory and processor are not shown in the figure. Each participating device 210 inputs its device identifier and the generated set of temporary public keys into the preset hybrid network 300 to obtain multiple sets of disordered anonymous temporary public keys. The preset hybrid network 300 writes the obtained sets of anonymous temporary public keys into the blockchain device 220. The participating devices 210 access the blockchain device 220 to query the anonymous temporary public keys for secure multi-party computation.

[0137] In this embodiment, blockchain device 220 is used to store a set of anonymous temporary public keys, facilitating rapid lookup of these keys by participating device 210. Blockchain device 220 is also used to implement covert communication. Specifically, during secure multi-party computation, participating device 210 embeds a verifiable secret share into the blockchain's transaction data. Blockchain device 220 synchronizes the transaction data to blockchain network nodes through the message synchronization mechanism within the blockchain network. Based on the received transaction data, the blockchain network nodes reconstruct the verifiable secret share, and then perform share validity verification and secure multi-party computation.

[0138] This application also provides a machine-readable storage medium storing instructions that, when executed by a processor, configure the processor to perform the aforementioned secure multi-party computation method.

[0139] This application also provides a computer program product, including a computer program that implements the above-described secure multi-party computation method when executed by a processor.

[0140] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0141] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0142] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0143] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0144] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0145] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0146] Machine-readable storage media include both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0147] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0148] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A secure multi-party computation method, characterized in that, The secure multi-party computation method is applied to a computing system, which includes multiple participating devices, and includes: Each participating device inputs its device identifier and the generated set of temporary public keys into a preset hybrid network to obtain multiple sets of anonymous temporary public keys in random order. The preset hybrid network is used to permutate the index corresponding to the device identifier based on a preset permutation relationship to output multiple sets of anonymous temporary public keys in random order between the device identifier and the temporary public key. Each participating device determines the target temporary public key used in the first target round from the set of anonymous temporary public keys based on the key index of the first target round; Each participating device signs based on a temporary private key and a first random number seed to obtain the signature hash value of the participating device in the first target round, wherein the target temporary public key is used to verify the signature; Based on the signature hash value, all participating devices determine all committee devices in the first target round from all participating devices; When the round of secure multi-party computation is the first target round, all committee devices in the first target round perform secure multi-party computation to obtain the secure multi-party computation result; The committee equipment includes a leadership device and other devices, wherein the leadership device is used to synchronize information to all the other devices; Based on the signature hash value, all participating devices determine all committee devices in the first target round from all participating devices, including: Based on the signature hash value, all participating devices determine all candidate leader devices in the first target round from all participating devices, and determine the leader device from all candidate leader devices, wherein the candidate leader device is a participating device whose signature hash value is less than the first target value, and the leader device is the participating device with the smallest signature hash value among all candidate leader devices; Based on the signature hash value, all participating devices determine all other devices from all participating devices, wherein the other devices are participating devices other than the leader device whose signature hash value is less than the second target value, and the second target value is greater than the first target value.

2. The secure multi-party computation method according to claim 1, characterized in that, The computing system also includes a blockchain device; Each participating device determines the target temporary public key used in the first target round from the set of anonymous temporary public keys based on the key index of the first target round, including: Each participating device accesses the set of anonymous temporary public keys in the blockchain device based on a preset access function, and determines the target temporary public key used in the first target round from the set of anonymous temporary public keys based on the key index of the first target round; When the round of secure multi-party computation is the first target round, all committee devices in the first target round perform secure multi-party computation to obtain the secure multi-party computation result, including: In the case where the round of secure multi-party computation is the first target round, and the first target round is not the first round, each committee device receives the secret share generated in the second target round sent by the blockchain device, wherein the second target round is the round preceding the first target round; All committee devices in the first target round perform secure multi-party computation based on the secret share generated in the second target round to obtain the secure multi-party computation result of the first target round.

3. The secure multi-party computation method according to claim 2, characterized in that, All committee devices in the first target round perform secure multi-party computation based on the secret share generated in the second target round to obtain the secure multi-party computation result of the first target round, including: Each committee device determines whether the secret share generated in the second target round is a valid share; If the secret share generated in the second target round is a valid share, each committee device in the first target round decrypts the secret share generated in the second target round to obtain the decryption result corresponding to the secret share, and determines whether the decryption result is a valid result; If the decryption result is valid, all committee devices in the first target round perform secure multi-party computation based on the decryption result to obtain the secure multi-party computation result of the first target round.

4. The secure multi-party computation method according to claim 2, characterized in that, The secure multi-party computation result of the first target round includes the secret share of the first target round; The method further includes: In the case of a third objective round in secure multi-party computation, each committee device in the first objective round sends the secret share generated in the first objective round to the blockchain device based on a verifiable secret sharing algorithm, wherein the third objective round is the round following the first objective round.

5. The secure multi-party computation method according to claim 1, characterized in that, Each participating device performs a signature based on the first target round and the first random number seed to obtain the signature hash value of the participating device in the first target round, including: When the round of secure multi-party computation is the fourth target round, each of the participating devices confuses the target temporary private key and the first random number seed to obtain the second random number seed, wherein the fourth target round is any secure multi-party computation round before the first target round; Each participating device signs based on the second random number seed to obtain the signature hash value of the participating device in the first target round.

6. The secure multi-party computation method according to claim 1, characterized in that, Before each participating device determines the target temporary public key used in the first target round from the anonymous temporary public key set based on the key index of the first target round, the method further includes: Each participating device permutes the index corresponding to the device identifier based on the preset permutation relationship, so as to determine the permuted index as the key index of the first target round.

7. The secure multi-party computation method according to claim 1, characterized in that, Before each participating device inputs its device identifier and the generated set of temporary public keys into the preset hybrid network to obtain multiple disordered sets of anonymous temporary public keys, the process further includes: Each participating device generates a preset number of temporary private keys based on the master key; Each participating device generates a temporary public key corresponding to the temporary private key and destroys the master key to obtain a preset number of temporary key pairs consisting of the temporary private key and the temporary public key.

8. A computing system, characterized in that, include: The memory is configured to store instructions; as well as A processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the secure multi-party computation method according to any one of claims 1 to 7.

9. A machine-readable storage medium storing instructions thereon, characterized in that, When executed by a processor, this instruction causes the processor to be configured to perform the secure multi-party computation method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the secure multi-party computation method according to any one of claims 1 to 7.

Images