Node state recovery method and system in multi-party security computing

Abstract

The invention discloses a node state recovery method and system in multi-party security computing, which are in one-to-one correspondence, the scheme is suitable for a multi-party security computing system based on a Shamir secret sharing algorithm, and the problem of secret data leakage caused by the fact that the number of multi-party security computing nodes controlled by an attacker reaches a threshold value can be solved. Specifically, based on the scheme, an attacked node can be recovered to a state before attack (namely a trusted system initial state), and security recovery of a data state is completed at the same time, so that data leakage caused by the fact that the number of nodes controlled by an attacker reaches a threshold value is prevented, and the security and reliability of the system are improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a node status recovery method and system in multi-party secure computing. Background Art

[0002] Multi-party secure computation is an important cryptographic technology that enables a group of mutually untrusted parties to jointly complete the calculation of an agreed function, and ensures that each party can only obtain its own calculation results, and cannot infer the input and output data of any other party through the interactive data during the calculation process.

[0003] The Shamir secret sharing algorithm is an important multi-party secure computing scheme. Assuming that the multi-party secure computing system based on the Shamir secret sharing algorithm has a total of n nodes, n is a natural number and n ≥ 3, and the threshold value is t, then any t nodes can cooperate to recover the secret, where t is a natural number and 2 ≤ t ≤ n. All nodes agree on a prime number p to determine the value space of the secret {0, 1, ..., p-1}. Each node P i (i∈{1,2,...,n}) holds the public value x i , satisfying x i ≠0mod p, and for any i≠j, x i ≠x j mod p. For any secret S, S∈{0,1,...,p-1}, the i-th node P i Holds secret shard (x i ,y i,S ), a t-1 ,...,a1 is a random number and a t-1 ≠0mod p, a0=S.

[0004] The multi-party secure computing system based on Shamir secret sharing supports existing public computing protocols, including:

[0005] Calculation protocol 1, new secret S′=constant C+secret S, that is, the node locally adds the secret slice of secret S to the constant C to obtain the secret slice of the new secret S′.

[0006] Calculation protocol 2, new secret S′=secret S1+secret S2, that is, the node locally adds the secret slice of secret S1 to the secret slice of secret S2 to obtain the secret slice of the new secret S′.

[0007] Calculation protocol 3: new secret S′=constant C*secret S, that is, the node locally multiplies the secret shard of secret S by the constant C to obtain the secret shard of the new secret S′.

[0008] Calculation protocol 4, new secret S' = secret S1 * secret S2, that is, the node locally multiplies the secret slice of secret S1 with the secret slice of secret S2, obtains the intermediate result and broadcasts it to all other nodes after processing, and all nodes cooperate to reconstruct the intermediate result of each node to obtain the secret slice of the new secret S'. Taking the GRR98 protocol as an example, select 2t-1 nodes, which first multiply the two secret slices Then construct a random polynomial h of degree t-1 respectively i (x), satisfying h i (0) = c i , Each P i To other computing providers P j (j∈{1,2,...,n}) sends c i Share of c i,j =h i (x j ), node P j receive And calculate Get the secret shard of the new secret S′.

[0009] Computational protocol 5, new secret S' = distributed generated random number R, that is, the node locally generates a new random number variable based on the pre-negotiated shared parameters and the internal state of the random number generator. Let U = {1,2,...,n} be the set of all nodes, is the set of all t-1 nodes, so In the initialization phase, for each All nodes publicly generate a polynomial of degree t-1 satisfy And for all i∈Z m ,have For each Z m ∈A, select a node Node P i Generate random number seeds And send it to all other non-Z m nodes, then each node P j (j∈U) can get the random number seed set In the random number generation phase, each node P i (i∈U) for each "random number seed" held by itself and the internal state of the random number generator ",calculate Generate random numbers And update and record the internal state of the random number generator, where DRNG is a deterministic random number generator, and the initial value of the internal state st is defined by the DRNG function; node P i calculate (x i ,w i ) is the secret shard of the new secret S′. When the system starts, an initialization phase is performed, and all nodes collaborate to share the random number seed. After that, each distributed random number generation only needs to execute the random number generation phase once, and the node locally generates the secret shard of the random number.

[0010] Computational protocol 6, new secret S′ = new variable A assigned by the user, that is, the user randomly generates a t-1 degree polynomial f(x), so that the value of f(0) mod p is the value of the new variable A, and sends it to node P i Send(x i ,f(x i )), Node P i (x i ,f(x i )) as the secret shard of the new secret S′.

[0011] Among these computing protocols, computing protocols 4 and 6 cannot rely solely on local computing to obtain new secret shards; computing protocols 1, 2, 3, and 5 can synchronize the operation log from a certain node and then calculate the new secret shard locally. In this system, nodes communicate through point-to-point trusted channels to ensure confidentiality and integrity, and nodes usually store operation logs and data.

[0012] During operation, the multi-party secure computing system may encounter abnormal situations such as node failures and network attacks. Nodes usually choose to restart to prevent them. Malicious code infected in memory or executable code can be cleared by restarting, and it will not affect the stored operation logs and other data. After the restart, the node needs to synchronize data with other nodes to restore service capabilities. The multi-party secure computing system itself has extremely high requirements for data security. The security of secret data needs to be guaranteed during data recovery, and the existing security mechanism needs to be not affected.

[0013] The Shamir secret sharing algorithm has a threshold value, which is also the maximum number of nodes that can be attacked. When the number of nodes controlled by the attacker reaches or exceeds the threshold value, he can combine the data of these nodes to restore the original secret information. Therefore, a node state recovery method suitable for a multi-party secure computing system based on the Shamir secret sharing algorithm is needed to restore the attacked node to the state before the attack, so as to prevent the number of nodes controlled by the attacker from reaching the threshold value and causing data leakage, and synchronize the data state to restore the service capability of the multi-party secure computing system.

[0014] In view of this, the present invention is proposed. Summary of the invention

[0015] The purpose of the present invention is to provide a node status recovery method and system, which is applicable to a multi-party secure computing system based on the Shamir secret sharing algorithm, and can solve the problem of secret data leakage caused by the number of multi-party secure computing nodes controlled by an attacker reaching a threshold value.

[0016] The objective of the present invention is achieved through the following technical solutions:

[0017] A node status recovery method, comprising:

[0018] The recovery node restarts to restore its own operating status to the trusted system initial state;

[0019] After the restart, each recovery node communicates with the pre-selected service nodes participating in the recovery, obtains the operation logs of the service nodes participating in the recovery, and reads the operation logs saved before the restart from the storage medium, and obtains the missing operations in the restart process by comparison;

[0020] Each recovery node recovers the node status by local execution or by collaboration with the service nodes involved in the recovery, according to the computing protocol to which the missing operations belong during the restart process.

[0021] A node status recovery system, used to implement the above method, the system comprising:

[0022] The restart unit is used to control the restart of the recovery node to restore its own operating state to the trusted system initial state;

[0023] The node communication and operation log comparison unit is used to control each recovery node after restart to communicate with the pre-selected service nodes participating in the recovery, obtain the operation logs of the service nodes participating in the recovery, and read the operation logs saved before the restart from the storage medium, and obtain the missing operations in the restart process through comparison;

[0024] The node status recovery unit is used to control each recovery node to recover the node status in a local execution manner or in a collaborative manner with the service nodes involved in the recovery according to the computing protocol to which the operations missing during the restart process belong.

[0025] It can be seen from the technical solution provided by the present invention that when it is applied to a multi-party secure computing system based on the Shamir secret sharing algorithm, the attacked node can be restored to the state before the attack (that is, the trusted system initial state), and the data state can be safely restored through the technology in this patent, thereby preventing the number of nodes controlled by the attacker from reaching a threshold value and causing data leakage, thereby improving the security and reliability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 A flowchart of a node status recovery method provided by an embodiment of the present invention;

[0028] Figure 2 A schematic diagram of three types of nodes in a system provided by an embodiment of the present invention;

[0029] Figure 3 A flowchart of node status recovery provided by an embodiment of the present invention;

[0030] Figure 4 A flowchart of node status recovery using local execution provided by an embodiment of the present invention;

[0031] Figure 5 A flowchart of recovering a node state by using a cooperative method of service nodes participating in the recovery provided by an embodiment of the present invention;

[0032] Figure 6 A schematic diagram of a node status recovery system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0033] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the protection scope of the present invention.

[0034] First, the terms that may be used in this article are explained as follows:

[0035] The terms "include", "comprises", "contains", "has" or other descriptions with similar semantics should be interpreted as non-exclusive inclusion. For example, including certain technical feature elements (such as raw materials, components, ingredients, carriers, dosage forms, materials, dimensions, parts, components, mechanisms, devices, steps, procedures, methods, reaction conditions, processing conditions, parameters, algorithms, signals, data, products or products, etc.) should be interpreted as including not only certain technical feature elements explicitly listed, but also other technical feature elements known in the art that are not explicitly listed.

[0036] The term "consisting of..." means excluding any technical feature elements not explicitly listed. If this term is used in a claim, it will make the claim closed, so that it does not contain technical feature elements other than the technical feature elements explicitly listed, except for the conventional impurities related to them. If this term only appears in a clause of a claim, it only limits the elements explicitly listed in the clause, and the elements recorded in other clauses are not excluded from the overall claim.

[0037] The following is a detailed description of a node status recovery method and system provided by the present invention. The contents not described in detail in the embodiments of the present invention belong to the prior art known to professional and technical personnel in the field. If no specific conditions are specified in the embodiments of the present invention, they shall be carried out according to the conventional conditions in the field or the conditions recommended by the manufacturer.

[0038] Embodiment 1

[0039] The embodiment of the present invention provides a node status recovery method, such as Figure 1 As shown, it mainly includes the following steps:

[0040] Step 1: Restart the recovery node to restore its own operating status to the trusted system initial status.

[0041] In an embodiment of the present invention, the provided scheme is applicable to a multi-party secure computing system based on the Shamir secret sharing algorithm. It is necessary to pre-select several nodes as recovery nodes, and select service nodes participating in the recovery from the remaining nodes; wherein: the total number of nodes is recorded as n, and r nodes are selected from the n nodes as recovery nodes, and the recovery nodes are regarded as nodes that may be attacked, 1≤r≤nt; the remaining nr nodes can normally provide multi-party secure computing services as service nodes, and t service nodes are selected from them as service nodes participating in the recovery, and t is a threshold value.

[0042] Step 2: After restart, each recovery node communicates with the pre-selected service nodes participating in the recovery, obtains the operation logs of the service nodes participating in the recovery, and reads the operation logs saved before the restart from the storage medium, and obtains the missing operations in the restart process by comparison.

[0043] In an embodiment of the present invention, the operation log includes: a plurality of entries arranged in sequence, each entry includes: the operation type involved, the variable name involved and the constant involved; wherein the operation type involved includes: addition, multiplication, random number generation and assignment; the variable name involved is one or more. Before restarting, the recovery node saves its own operation log and data to a storage medium. After restarting, the recovery node reads the operation log from the storage medium and communicates with the pre-selected service nodes participating in the recovery to obtain the operation log of the service nodes participating in the recovery. By comparing the missing entries in the operation log, the missing operations in the restart process are determined, and only the missing operations are subsequently synchronized, thereby reducing the node status recovery time and the communication volume in the recovery process.

[0044] Step 3: Each recovery node recovers the node status by local execution or by collaboration with the service nodes involved in the recovery, according to the computing protocol to which the missing operations belong during the restart process.

[0045] In an embodiment of the present invention, the recovery node analyzes the type of operation that is missing from its own data variables. If the missing operation supports local calculation, the recovery node performs data status recovery locally. If the missing operation cannot be completed locally, the above-mentioned collaborative node status recovery method is executed, thereby reducing the amount of calculation and communication for node status recovery.

[0046] The above solution provided by the embodiment of the present invention can restore the attacked node to the state before the attack (that is, the trusted system initial state), thereby preventing data leakage from occurring when the number of nodes controlled by the attacker reaches a threshold value, thereby improving the security of the system.

[0047] In order to more clearly demonstrate the technical solution and technical effects provided by the present invention, the method provided by the embodiment of the present invention is described in detail with reference to specific embodiments below.

[0048] 1. Node selection.

[0049] In the embodiment of the present invention, three types of nodes are included: recovery nodes, service nodes participating in recovery, and ordinary service nodes. The recovery nodes and the service nodes participating in recovery collaborate to complete the recovery of the recovery node status, and during the node status recovery process, the service nodes participating in recovery and the ordinary service nodes can still provide multi-party secure computing functions normally.

[0050] In the embodiment of the present invention, the total number of nodes is recorded as n, and r nodes that may be attacked are selected from the n nodes as recovery nodes, 1≤r≤nt; the remaining nr nodes can normally provide multi-party secure computing services as service nodes, and t service nodes are selected from them as service nodes participating in recovery, and t is a threshold value.

[0051] Figure 2 An example is provided in which the system includes 5 nodes, where the threshold value is 3, including 1 recovery node, 3 service nodes participating in recovery and 1 ordinary service node, but it is understandable that the system can contain n nodes, the threshold value is t, including r recovery nodes, t service nodes participating in recovery and nrt ordinary service nodes, as long as n, t, r are natural numbers and n≥3, 2≤t≤n-1, 1≤r≤nt.

[0052] 2. Restart the node.

[0053] In the embodiment of the present invention, the recovery node is restarted to restore the running state of the recovery node to a credible system initial state.

[0054] 3. Compare node communication and operation logs.

[0055] In an embodiment of the present invention, each recovery node after restart communicates with the pre-selected service nodes participating in the recovery, obtains the operation logs of the service nodes participating in the recovery, and reads the operation logs saved before its own restart from the storage medium, and obtains the missing operations in the restart process through comparison.

[0056] Generally speaking, when all nodes provide multi-party secure computing services normally, they will save operation logs and data in the storage medium. The embodiment of the present invention does not regard this step as part of the node status recovery process, but the node status recovery process depends on the operation logs and data stored in this step.

[0057] In the embodiment of the present invention, the operation log is composed of a plurality of entries arranged in sequence, and each entry includes: the operation type involved (which may be addition, multiplication, random number generation, assignment), the variable name involved (which may be multiple) and the constant. After the recovery node is restarted, it reads the operation log from the storage medium and compares it with the operation log of the service node to determine the missing operations in the restart process. It only needs to synchronize these missing operations in sequence, thereby reducing the node status recovery time and the communication volume of the recovery process.

[0058] 4. Node status is restored.

[0059] like Figure 3 As shown, the following steps are included:

[0060] Step 1) The recovery node checks whether there are any operations that need to be synchronized. If there are no operations that need to be synchronized, it means that the data status of the node has been restored, and the recovery process ends. The node becomes a normal service node. If there are operations that need to be synchronized, the process continues.

[0061] Step 2) The recovery node selects an operation that needs to be synchronized and checks whether the operation supports local execution. If the operation supports local execution, the recovery node executes the local node data status recovery method. If the operation does not support local recovery, the recovery node and the service nodes participating in the recovery execute the collaborative node data status recovery method.

[0062] Step 3) Return to step 1) to check whether there are other operations that need to be synchronized.

[0063] Figure 3 The node data status recovery process of a single recovery node is taken as an example, but it can be understood that all recovery nodes follow this process, and the node data status recovery processes of different recovery nodes do not interfere with each other and can be executed in parallel.

[0064] In the embodiment of the present invention, the computing protocols supported by the multi-party secure computing system can be divided into 6 categories:

[0065] Computational protocol 1, new secret S′ = constant C + secret S;

[0066] Computation protocol 2, new secret S′ = secret S1 + secret S2;

[0067] Computational protocol 3, new secret S′ = constant C*secret S;

[0068] Calculation protocol 4, new secret S′ = secret S1 * secret S2;

[0069] Computational protocol 5, new secret S′ = distributed generated random number R;

[0070] Computational protocol 6, new secret S′ = new variable A assigned by the user;

[0071] If the missing operation during the restart process belongs to computing protocol 1, computing protocol 2, computing protocol 3, or computing protocol 5, the node status is restored by local execution; if the missing operation during the restart process belongs to computing protocol 4 or computing protocol 6, the node status is restored by collaboration with the service nodes participating in the recovery.

[0072] The process of restoring node status by local execution is as follows: Figure 4 As shown, it mainly includes:

[0073] 1) If the missing operation in the restart process belongs to calculation protocol 1: new secret S′=constant C+secret S, or calculation protocol 3: new secret S′=constant C*secret S, then the recovery node obtains the variable names of secret S and new secret S′, as well as the value of the public constant C, from the operation log of the service node participating in the recovery; according to the variable name of secret S, the recovery node reads the secret slice of secret S from the storage medium and executes calculation protocol 1 or calculation protocol 3 locally; for calculation protocol 1, the recovery node adds the secret slice of secret S held by itself to constant C to obtain the secret slice of new secret S′; for calculation protocol 3, the recovery node multiplies the secret slice of secret S held by itself by constant C to obtain the secret slice of new secret S′. The variable name of secret S and constant C are both public data, which can be obtained by the recovery node from any service node participating in the recovery. Then, the recovery node can correctly calculate the new secret slice locally through this process without affecting the security of the system.

[0074] 2) If the missing operation in the restart process belongs to the calculation protocol 2: new secret S′ = secret S1 + secret S2, then the recovery node obtains the variable names of secret S1, secret S2 and new secret S′ from the operation log of the service node participating in the recovery; according to the variable names of secret S1 and secret S2, the recovery node reads the secret slice of secret S1 and the secret slice of secret S2 from the storage medium, and locally executes the calculation protocol 2, that is, the recovery node adds the secret slice of S1 and the secret slice of S2 held by itself to obtain the secret slice of the new secret S′. The variable names of secret S1 and secret S2 are public data, which can be obtained by the recovery node from any service node participating in the recovery. Then, the recovery node can correctly calculate the new secret slice locally through this process without affecting the security of the system.

[0075] 3) If the missing operation in the restart process belongs to the calculation protocol 5: new secret S′ = distributed generated random number R, first pre-negotiate the shared parameters according to the calculation protocol 5. When data recovery is required, the recovery node obtains the variable name of the new secret S′ from the operation log of the service node participating in the recovery, and then reads the pre-negotiated shared parameters and the internal state value of the random number generator from the storage medium, and locally executes the calculation protocol 5, that is, the recovery node generates a new share of the random number variable according to the parameters and the state of the random number generator as the secret shard of the new secret S′. The shared parameters are pre-coordinated when the system is established, and subsequently only the internal state value of the random number generator needs to be calculated and updated locally. The data synchronization process also only needs to obtain public data such as variable names and execution logs from other service nodes participating in the recovery.

[0076] The solution for recovering the node status by cooperating with the service nodes involved in the recovery is as follows, which mainly targets the two cases of computing protocol 4 and computing protocol 6.

[0077] For ease of description, the service nodes participating in the recovery are denoted as P1, P2, ...P t , the recovery node is denoted as P t+1 ,P t+2 ,...P t+r , where t is the threshold value and r is the number of restored nodes; for restored nodes P t+m , m∈{1,2,...,r}, which holds the secret slice (x t+m ,y t+m ), where x t+m Public to all nodes, y t+m is the value that needs to be restored; for the service node P participating in the recovery i , i∈{1,2,...,t}, its secret shard with respect to the secret S is (x i ,y i ), where x i For public information, i is a secret shard; for the service node P participating in the recovery i , which generates t random numbers r i,j , j∈{1,2,...,t}, satisfying Where mod is the modulus operation, p is the agreed prime number; the service node P participating in the recovery i The random number r i,j Sent to the corresponding service node P participating in the recovery j , and retains the random number r i,i ; Service nodes P participating in recovery i Calculate random numbers (i.e., the intermediate values ​​of the interactive protocol, used to hide the transmitted secret information) Among them, r j,i The service node P that participates in the recovery j Generate and send to the service node P participating in the recovery i The random number, and then calculate the information And send it to the recovery node P t+m ;Recovery node P t+m Calculated All recovery nodes use the same method to calculate the secret shard of the secret S they hold to achieve node status recovery.

[0078] Figure 5 A related process example is provided, which mainly includes the following steps:

[0079] 1) Service node P1 holds the secret shard (x1, y1), service node P2 holds the secret shard (x2, y2), service node P3 holds the secret shard (x3, y3), and recovery node P4 needs to restore the secret shard (x4, y4), where y4 is the value that needs to be restored.

[0080] 2) Service node P1 generates a random number r 1,1 ,r 1,2 ,r 1,3 , satisfying r 1,1 +r 1,2 +r 1,3 =0modp. Service node P2 generates a random number r 2,1 ,r 2,2 ,r 2,3 , satisfying r 2,1 +r 2,2 +r 2,3 =0modp. Service node P3 generates a random number r 3,1 ,r 3,1 ,r 3,3 , satisfying r 3,1 +r 3,2 +r 3,3 =0modp.

[0081] 3) Service node P1 sends the random number r 1,2 Send to service node P2, the random number r 1,3 Send to service node P3, retain the random number r 1,1 . Service node P2 sends the random number r 2,1 Send to service node p1, the random number r 2,3 Send to service node p3, retain the random number r 2,2 . Service node p3 sends the random number r 3,1 Send to service node P1, the random number r 3,1 Send to service node P2, retain the random number r 3,3 .

[0082] 4) Service node P1 calculates r1=r 1,1 +r 2,1 +r 3,1 modp. Service node P2 calculates r2 = r 1,2 +r 2,2 +r 3,2 modp. Service node P3 calculates r3 = r 1,3 +r 2,3 +r 3,3 modp.

[0083] 5) Service node P1 calculation Service Node P2 Computing Service Node P3 Computing

[0084] 6) Service node P1 sends s1 to recovery node P4, service node P2 sends s2 to recovery node P4, and service node P3 sends s3 to recovery node P4.

[0085] 7) Restore node P4 and calculate y4=s1+s2+s3modp.

[0086] Figure 5 The illustrated process provides an example of three service nodes participating in recovery, but it is understandable that the node collaborative data state recovery method is also applicable to other numbers of service nodes participating in recovery, as long as the number meets the constraints mentioned above.

[0087] The node data recovery method provided in the embodiment of the present invention adopts Shamir secret sharing technology and zero-knowledge proof technology. During the data recovery process, a temporarily generated random number is used to hide the secret data of the service nodes involved in the recovery, which not only realizes the correctness and effectiveness of the recovered data, but also ensures the security of the data recovery process.

[0088] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above embodiments can be implemented by software, or by means of software plus necessary general hardware platforms. Based on such understanding, the technical solutions of the above embodiments can be embodied in the form of software products, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0089] Embodiment 2

[0090] The present invention also provides a node status recovery system, which is mainly used to implement the method provided in the above embodiment, such as Figure 6 As shown, the system mainly includes:

[0091] The restart unit is used to control the restart of the recovery node to restore its own operating state to the trusted system initial state;

[0092] The node communication and operation log comparison unit is used to control each recovery node after restart to communicate with the pre-selected service nodes participating in the recovery, obtain the operation logs of the service nodes participating in the recovery, and read the operation logs saved before the restart from the storage medium, and obtain the missing operations in the restart process through comparison;

[0093] The node status recovery unit is used to control each recovery node to recover the node status in a local execution manner or in a collaborative manner with the service nodes involved in the recovery according to the computing protocol to which the operations missing during the restart process belong.

[0094] Technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the system can be divided into different functional modules to complete all or part of the functions described above.

[0095] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A node status recovery method, characterized in that: include: The recovery node restarts to restore its own operating status to the trusted system initial state; After the restart, each recovery node communicates with the pre-selected service nodes participating in the recovery, obtains the operation logs of the service nodes participating in the recovery, and reads the operation logs saved before the restart from the storage medium, and obtains the missing operations in the restart process by comparison; Each recovery node recovers the node status by local execution or by collaboration with the service nodes involved in the recovery, according to the computing protocol to which the missing operations belong during the restart process.

2. A node status recovery method according to claim 1, characterized in that: Also includes: Pre-select several nodes as recovery nodes, and select service nodes participating in recovery from the remaining nodes; among them: The total number of nodes is recorded as n, and r nodes are selected from the n nodes as recovery nodes, 1≤r≤nt; the remaining nr nodes can normally provide multi-party secure computing services as service nodes, and t service nodes are selected from them as service nodes participating in recovery, and t is the threshold value.

3. A node status recovery method according to claim 1, characterized in that: The operation log includes: a plurality of entries arranged in sequence, each entry includes: the operation type involved, the variable name involved and the constant involved; wherein the operation type involved includes: addition, multiplication, random number generation and assignment; the variable name involved is one or more.

4. A node status recovery method according to claim 2, characterized in that: The restarted recovery node communicates with the pre-selected service node participating in the recovery, obtains the operation log of the service node participating in the recovery, and reads the operation log saved before the restart from the storage medium, and obtains the missing operations in the restart process by comparison, including: Before restarting, the recovery node saves its own operation log and data to the storage medium. After restarting, the recovery node reads the operation log from the storage medium and communicates with the pre-selected service nodes participating in the recovery to obtain the operation log of the service nodes participating in the recovery. By comparing the missing entries in the run log, determine the missing operations during the restart process.

5. A node status recovery method according to claim 1, characterized in that: The recovery node recovers the node status in a local execution manner or in a collaborative manner with the service nodes involved in the recovery, according to the computing protocol to which the operations missing during the restart process belong, including: Computing protocols include the following six categories: Computational protocol 1, new secret S′ = constant C + secret S; Computation protocol 2, new secret S′ = secret S1 + secret S2; Computational protocol 3, new secret S′ = constant C * secret S; Calculation protocol 4, new secret S′=secret S1*secret S2; Computational protocol 5, new secret S′ = distributed generated random number R; Computational protocol 6, new secret S′ = new variable A assigned by the user; If the missing operations during the restart process belong to computing protocol 1, computing protocol 2, computing protocol 3, or computing protocol 5, the node status is restored by local execution; If the missing operations during the restart process belong to computing protocol 4 or computing protocol 6, the node status is restored by cooperating with the service nodes participating in the recovery.

6. A node status recovery method according to claim 1 or 5, characterized in that: If the missing operations during the restart process belong to the calculation protocol 1: new secret S′ = constant C + secret S, or the calculation protocol 3: new secret S′ = constant C * secret S, the node status is restored by local execution, including: The recovery node obtains the variable names of the secret S and the new secret S′, as well as the value of the public constant C, from the running logs of the service nodes participating in the recovery. According to the variable name of the secret S, the recovery node reads the secret shard of the secret S from the storage medium and executes the calculation protocol 1 or the calculation protocol 3 locally. For computation protocol 1, the recovery node adds the secret slice of the secret S it holds to the constant C to obtain the secret slice of the new secret S′; for computation protocol 3, the recovery node multiplies the secret slice of the secret S it holds to the constant C to obtain the secret slice of the new secret S′.

7. A node status recovery method according to claim 1 or 5, characterized in that: If the missing operation during the restart process belongs to the calculation protocol 2: new secret S′ = secret S1 + secret S2, the node status is restored by local execution. include: The recovery node obtains the variable names of secret S1, secret S2 and new secret S′ from the running logs of the service nodes participating in the recovery; according to the variable names of secret S1 and secret S2, the recovery node reads the secret slice of secret S1 and the secret slice of secret S2 from the storage medium, and executes calculation protocol 2 locally, that is, the recovery node adds the secret slice of S1 and the secret slice of S2 held by itself to obtain the secret slice of the new secret S′.

8. A node status recovery method according to claim 1 or 5, characterized in that: If the missing operation during the restart process belongs to the computation protocol 5: new secret S′ = distributed generated random number R, the node status is restored by local execution, including: The recovery node obtains the variable name of the new secret S′ from the running log of the service node participating in the recovery, reads the pre-negotiated shared parameters and the state of the random number generator from the storage medium, and locally executes the calculation protocol 5, that is, the recovery node generates a share of the new random number variable according to the parameters and the state of the random number generator as the secret shard of the new secret S′.

9. A node status recovery method according to claim 1 or 5, characterized in that: If the missing operation during the restart process belongs to the calculation protocol 4: new secret S′ = secret S1 * secret S2, or the calculation protocol 6: new secret S′ = new variable A assigned by the user, the node status is restored by the cooperation of the service nodes participating in the recovery, including: The service nodes participating in the recovery are denoted as P1, P2, ...P t , the recovery node is denoted as P t+1 , P t+2 , ...P t+r , where t is the threshold value and r is the number of recovery nodes; For the recovery node P t+m , m∈{1,2,...,r}, which holds the secret slice (x t+m ,y t+m ), where x t+m Public to all nodes, y t+m is the value that needs to be restored; for the service node P participating in the recovery i , i∈{1, 2, ..., t}, its secret shard with respect to the secret S is (x i ,y i ), where x i For public information, i is a secret shard; for the service node P participating in the recovery i , which generates t random numbers r i，j , j∈{1, 2, ..., t}, satisfying Where mod is the modulus operation, p is the agreed prime number; the service node P participating in the recovery i The random number r i，j Sent to the corresponding service node P participating in the recovery j , and retains the random number r i，i ; Service nodes P participating in recovery i Calculating random numbers Among them, r j，i The service node P that participates in the recovery j Generate and send to the service node P participating in the recovery i The random number, and then calculate the information And send it to the recovery node P t+m ;Recovery node P t+m Calculated All recovery nodes use the same method to calculate the secret shard of the secret S they hold to achieve node status recovery.

10. A node status recovery system, characterized in that: For implementing the method described in any one of claims 1 to 9, the system comprises: The restart unit is used to control the restart of the recovery node to restore its own operating state to the trusted system initial state; The node communication and operation log comparison unit is used to control each recovery node after restart to communicate with the pre-selected service nodes participating in the recovery, obtain the operation logs of the service nodes participating in the recovery, and read the operation logs saved before the restart from the storage medium, and obtain the missing operations in the restart process through comparison; The node status recovery unit is used to control each recovery node to recover the node status in a local execution manner or in a collaborative manner with the service nodes involved in the recovery according to the computing protocol to which the operations missing during the restart process belong.

Images