Verifiable secure multi-party computing method based on block chain

Abstract

The invention provides a verifiable secure multi-party computing method based on a block chain. The method comprises the following steps: acquiring sensitive data, allocating a unique identifier to each participant, and allocating a secret share to each participant according to the sensitive data and the unique identifier of each participant; after each participant receives the secret share, a commitment is generated for the secret share of the participant, the commitment of the secret share is signed, and the secret share, the commitment of the secret share and the signature are uploaded to the block chain; each participant executes local calculation according to the received secret share and securely transmits a local calculation result to all other participants; each participant receives local calculation results transmitted by other participants and reconstructs all the local calculation results so as to restore the local calculation results to obtain a final calculation result; and public verification is carried out on the consistency and validity of calculation results of secure multi-party calculation on the block chain by using zero-knowledge proof.

Description

Technical Field

[0001] The present invention relates to the field of cryptography technology, specifically to the field of secure multi-party computing and privacy-preserving data mining technology, and in particular to a verifiable secure multi-party computing method based on blockchain. Background Art

[0002] As a key component of cloud computing technology, big data has facilitated the development of numerous intelligent applications that create value through data sharing and collaborative processing. However, concerns about information security remain, leading many companies to take a cautious approach to collaboration and data sharing. Take supply chain management as an example: financial institutions seek to conduct risk assessments and provide financing services to enterprises by establishing reliable customer profiles, which makes it necessary to share sensitive data about production, storage, and distribution for joint computing; however, once this sensitive data is shared, there is a potential risk of data theft or unauthorized reuse. In addition, independent enterprises must overcome trust barriers when participating in data sharing and joint computing activities.

[0003] As a means of privacy computing, secure multi-party computing can ensure the separation of data ownership and usage rights, thereby ensuring data privacy. However, in reality, there is still a lack of a mechanism for comprehensive supervision and verification of this distributed secure multi-party computing process. Summary of the invention

[0004] In order to achieve comprehensive supervision and verification of the distributed secure multi-party computing process and improve the security of data sharing, the present invention provides a verifiable secure multi-party computing method based on blockchain.

[0005] The present invention provides a blockchain-based verifiable secure multi-party computing method, comprising the following steps:

[0006] Step 1: Obtain sensitive data, assign a unique identifier to each participant, and assign a secret share to each participant based on the sensitive data and the unique identifier of each participant;

[0007] Step 2: After receiving the secret share, each participant generates a commitment for his or her own secret share, signs the commitment for the secret share, and uploads the secret share, the commitment for the secret share, and the signature to the blockchain;

[0008] Step 3: Each participant performs local computation based on the received secret share and securely transmits the local computation results to all other participants;

[0009] Step 4: Each participant receives the local calculation results transmitted by other participants and reconstructs all local calculation results to restore the final calculation results;

[0010] Step 5: Use zero-knowledge proof to publicly verify the consistency and validity of the computation results of secure multi-party computation on the blockchain.

[0011] Furthermore, in step 1, a secret share is allocated to each participant according to the sensitive data and a unique identifier of each participant, specifically including:

[0012] Construct a random secret sharing polynomial f(x), and assign a secret share to each participant according to the polynomial f(x);

[0013] f(x)=a0+a1x+…+a t-1 x t-1

[0014] s j =f(α j )

[0015] Among them, a0 is sensitive data, a1,...,a t-1 is a randomly generated coefficient, t represents the preset threshold, s j Indicates that the unique identifier is α j The secret shares of the participants.

[0016] Furthermore, in step 2, a commitment is generated for one's own secret share, specifically including: generating a random number t j , based on the random number t j Generate commitment D j : Among them, s j represents the secret share, q represents a preset large prime number, and j represents the index of the participant.

[0017] Furthermore, in step 2, the commitment of the secret share is signed, specifically including: first generating the commitment text CT j : CT j =(α j ||D j ||T j ); regenerate the commitment text CT j Signature ST j : Among them, α j is the unique identifier of the participant, T j is the current timestamp, sk j The private key of the participant, represents a signature operation using a private key, and H(·) represents a secure hash function.

[0018] Furthermore, in step 3, each participant performs local calculations based on the received secret shares, specifically including: for any two shared vectors [x] in the secret shares t and [y] t , perform addition calculation according to the following formula;

[0019]

[0020] in, represents the result of addition calculation, x and y represent the shared vector [x] t and [y] t The corresponding sensitive data.

[0021] Furthermore, in step 3, each participant performs local calculations based on the received secret shares, specifically including: for any two shared vectors [x] in the secret shares t and [y] t , perform multiplication calculation according to preset rules; the preset rules include:

[0022] Calculate intermediate parameters [e] 2t :=[x] t *[y] t +[r] 2t , and the intermediate parameter [e] 2t Sent to the participant representative for the participant representative to collect the intermediate parameters sent by all participants [e] 2t Reconstruct the secret e; where [r] 2t represents a pre-generated first random vector shared by all participants; the participant representative is pre-selected from all participants;

[0023] Receive the secret e sent by the participant representative, and calculate based on the secret e in, Indicates the result of multiplication calculation, [r] t Represents a pre-generated second random vector shared by all participants.

[0024] Furthermore, step 4 specifically includes:

[0025] For each participant, count all local calculation results [z] t ={z1, z2, ..., z n}; where z1, z2, ..., z n Respectively represent the local calculation results of n participants;

[0026] Set z to represent the desired calculation result, and use the Lagrange interpolation method to take the desired calculation result z as the independent variable of the polynomial f(x) to construct a new t-1 order polynomial f z (w):

[0027]

[0028] Among them, α i A unique identifier representing the participant, p represents a preset large prime number;

[0029] Let w in M(w) be 0, so that f z (w)Convert to f z (0), substitute all local calculation results [z]t into f z (0), by calculating f z (0), obtaining the desired calculation result z;

[0030]

[0031] Furthermore, step 5 specifically includes:

[0032] The verifier receives the commitment text CT j , Commitment Text CT j Signature and public key pk j , participants used the received CT j and T j , calculate the hash value h j =H(CT j ||T j );

[0033] Use the submitter's public key pk j For received ST j Verify (pk j ,ST j , (CT j , H(CT j ||T j ))); among which, (CT j , H(CT j ||T j )) is based on the received CT j And the calculated hash value h j get;

[0034] Participants receive the public key pk from the submitter j 、Signature ST j=(r, v), and obtain a hash value; wherein r, v represent the components of the signature;

[0035] Participants verify whether r and v are in the interval [1, N-1], where N is the order of the ellipse.

[0036] If not, the signature is invalid; if so, the participant continues to use the hash value to calculate the intermediate parameters u1 and u2:

[0037]

[0038] The participant uses u1 and u2 to calculate the point P: P = u1·G + u2·pk j If point P is not on the elliptic curve, the signature is invalid; otherwise, according to the X-axis coordinate x of point P P Judge x P mod n=r whether it holds, if so, the signature is valid, otherwise, the signature is invalid; where G is the base point of the elliptic curve;

[0039] Furthermore, step 5 specifically includes:

[0040] All participants jointly generate a random share of the random number R [R] t ;

[0041] Assuming that there is a malicious adversary who may introduce erroneous values ​​during the calculation process, the correctness of the final calculation result is verified according to the following process:

[0042] For each participant, obtain the data pair ([x] t , [Rx] t ) and ([y] t , [Ry] t ); according to (([x] t , [Rx] t ) and ([y] t , [Ry] t ) in [x] t and [y] t Calculate [z] t =[xy+d] t , according to [Rx] t and [y] t Calculate [Rxy+e] t , according to [z] t and [R] t Calculate and get [Rz+f] t ; Check [Rxy+e] t Is it equal to [Rz+f] tIf so, it means that d, e, and f are all 0, indicating that no error is introduced during the calculation process. Otherwise, it means that an error is introduced during the calculation process, and the calculation is terminated at this time; among them, d, e, and f represent the potential errors introduced by malicious opponents.

[0043] Furthermore, it also includes: generating a public commitment about sensitive data, and signing the public commitment so that participants can verify the public commitment.

[0044] Beneficial effects of the present invention:

[0045] The method of the present invention realizes secret computing that protects user data ownership and data privacy through secure multi-party computing, and at the same time introduces non-interactive zero-knowledge proof, utilizes the immutability and transparency of blockchain, and publicly verifies the data consistency and computational validity of secure multi-party computing on the blockchain, which can enhance the security of secure multi-party computing, realize data privacy protection under multiple security assumptions, and improve the credibility of computing and the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 One of the flowcharts of a blockchain-based verifiable secure multi-party computing method provided by an embodiment of the present invention;

[0047] Figure 2 The second flowchart of a verifiable secure multi-party computing method based on blockchain provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution in the embodiment of the present invention will be clearly described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] Blockchain technology has the characteristics of tamper-proof and high transparency, and the inventor believes that this characteristic can be used to ensure the tracking and monitoring of secure multi-party computing. In addition, zero-knowledge proof technology can verify the correctness of the calculation without leaking sensitive information. Therefore, the concept of the present invention introduces blockchain and zero-knowledge proof technology in the process of secure multi-party computing, thereby providing an effective solution for privacy protection and public auditing. More specifically, the present invention uses Shamir's secret sharing and non-interactive zero-knowledge proof to facilitate verifiable secure multi-party computing without leaking private data.

[0050] Combination Figure 1 and Figure 2As shown, an embodiment of the present invention provides a blockchain-based verifiable secure multi-party computing method, comprising the following steps:

[0051] S101: Task initialization.

[0052] First, the task initializer TG sets the number of participants n and the threshold t, and for each participant DP j Assign unique identifier α j , select two generators g and h from the cyclic group so that their discrete logarithm relationship is unknown to all participants; where j represents the index of the participant.

[0053] Next, sensitive data s is obtained, and a secret share is allocated to each participant according to the sensitive data and a unique identifier of each participant;

[0054] Specifically, this embodiment allocates a secret share to each participant in the following manner: construct a Shamir random secret sharing polynomial f(x), and allocate a secret share to each participant according to the polynomial f(x);

[0055] f(x)=a0+a1x+…+a t-1 x t-1

[0056] s j =f(α j )

[0057] Among them, a0=s is sensitive data, a1,...,a t-1 is a randomly generated coefficient, t represents the preset threshold, α j Indicates the identifier of the participant, s j DP for participants j The secret share held.

[0058] S102: After receiving the secret share, each participant generates a commitment for his or her own secret share, signs the commitment of the secret share, and uploads the secret share, the commitment of the secret share and the signature to the blockchain;

[0059] Specifically, before executing MPC, each participant uploads the secret share, the commitment of the secret share, and the signature to the blockchain. These data can serve as unchangeable and undeniable credentials, helping to verify the consistency of the data.

[0060] In this embodiment, the process of generating the secret share commitment includes: generating a random number t j , based on the random number t j Generate commitment D j : Among them, s jLet \(s\) represent the secret share and \(q\) represent a preset large prime number.

[0061] To maintain the commitment from being tampered with and authenticate the identity of IDP j The process of signing the commitment to the secret share includes: First, generate the commitment text CT j : CT j =(α j ||D j ||T j ); Then, based on its own private key sk j generate the signature ST j of the commitment text CT j : where α j is the unique identifier of the participant, T j is the current timestamp, sk j is the private key of the participant, represents the signature operation using the private key, and H(·) represents the secure hash function.

[0062] Specifically, in this embodiment, the elliptic curve digital signature algorithm is used to generate the signature ST j of the commitment text CT j . The signature process includes: First, randomly select an integer k, 1 < k < N, where N is the order of the elliptic curve, that is, the total number of points on the elliptic curve. It should be noted that k should be kept private and a new k is randomly selected each time a signature is generated. Then, calculate the point P by multiplying the base point G on the elliptic curve by the integer k: P = k·G. Subsequently, derive r from the X-axis coordinate x P coordinate of the point P: r = x P mod N. If r = 0, a new random number k needs to be selected and the above process is repeated. If r ≠ 0, the subsequent steps are executed;

[0063] After that, according to the private key sk j of the participant, the hash value H j of the message, the integer r, and the previously selected random number k, calculate the parameter v:

[0064] v = k -1 (H j + r·sk j ) mod N

[0065] If v = 0, the above process needs to be repeated with a new random number k.

[0066] Finally, the digital signature consists of a pair of integers (r, v), which can be publicly transmitted together with the message and verified using the public key pk j of the signer.

[0067] S103: Each participant performs local calculations based on the received secret shares and securely transmits the local calculation results to all other participants;

[0068] Specifically, in this embodiment, relevant protocols are designed mainly for addition calculations and multiplication calculations involved in the calculation process.

[0069] For example, assuming that the sensitive data s is a combination of sensitive data x and y from two different sources, then according to the above secret share generation process, each participant's secret share should include two parts, namely, the two sub-secret shares x and y corresponding to the sensitive data x and y. j and j ,Right now:

[0070]

[0071]

[0072] Thus, the secret share of all participants about sensitive data x is defined as [x] t ={x1, x2, ..., x n}; Correspondingly, the secret share of all participants about sensitive data y is defined as [y] t ={y1, y2, ..., y n}; For the convenience of description, [x] t and [y] t Denoted as two shared vectors in the entire secret share.

[0073] Based on the above content, the addition calculation protocol specifically includes: for any two shared vectors [x] in the secret share t and [y] t , perform addition calculation according to the following formula;

[0074]

[0075] in, represents the result of addition calculation, x and y represent the shared vector [x] t and [y] t Corresponding sensitive data. It is understandable that the above equation can also be expressed as:

[0076]

[0077] For multiplication, it is not possible to directly calculate [z] t =[x] t *[y] t Instead, we need to use a set of random double shares ([r] t , [r]2t ) to calculate [z] t The multiplication calculation protocol specifically includes: calculating the intermediate parameter [e] 2t :=[x] t *[y] t +[r] 2t , and the intermediate parameter [e] 2t Sent to the participant representative for the participant representative to collect the intermediate parameters sent by all participants [e] 2t Reconstruct the secret e; where [r] 2t represents a pre-generated first random vector shared by all participants; the participant representative is pre-selected from all participants; the secret e sent by the participant representative is received, and the secret e is calculated based on the secret e in, Indicates the result of multiplication calculation, [r] t Represents a pre-generated second random vector shared by all participants.

[0078] S104: Each participant receives the local calculation results transmitted by other participants, and reconstructs all local calculation results to restore the final calculation results;

[0079] Specifically, for a certain participant, when the number of local calculation results received by the participant is not less than t, the reconstruction process can be started according to all local calculation results at this time.

[0080] In this embodiment, the reconstruction process is described by taking the case where a participant receives the local calculation results of all other participants as an example. That is, for each participant, all local calculation results [z] are counted. t ={z1, z2, ..., z n}; where z1, z2, ..., z n Respectively represent the local calculation results of n participants;

[0081] Let z represent the desired calculation result, and construct the t-1 order polynomial f for restoring the secret calculation result through Lagrange interpolation method. z (w):

[0082]

[0083] Among them, α i A unique identifier representing the participant, p represents a preset large prime number;

[0084] Let w in M(w) be 0, so that f z (w)Convert to f z(0), all local calculation results [z] t Substitute f z (0), by calculating f z (0), obtaining the desired calculation result z;

[0085]

[0086] S105: After the calculation is completed, the consistency and validity of the calculation results of the secure multi-party calculation are publicly verified on the blockchain using zero-knowledge proof.

[0087] Specifically, this step mainly includes the validity verification of the signature and commitment and the correctness verification of the calculation result. The validity verification process of the signature includes:

[0088] The verifier receives the commitment text CT j =(α j ||D j ||T j ), Commitment Text CT j Signature and public key pk j , participants used the received CT j and T j , calculate the hash value h j =H(CT j ||T j );

[0089] It can be understood that when participant a needs to verify the data submitted by participant b, participant a is the verifier and participant b is the submitter.

[0090] Use the submitter's public key pk j For received ST j Verify (pk j ,ST j , (CT j , H(CT j ||T j ))); among which, (CT j , H(CT j ||T j )) is based on the received CT j And the calculated hash value h j get;

[0091] Participants receive the public key pk from the submitter j 、Signature ST j =(r, v), and obtain the hash value h j; Among them, r, v represent the components of the signature;

[0092] The participant verifies whether r and v are in the interval [1, n-1], where n represents the number of participants; if not, the signature is invalid; if so, the participant continues to use the hash value h j Calculate the intermediate parameters u1 and u2:

[0093]

[0094] The participant uses u1 and u2 to calculate the point P: P = u1·G + u2·pk j If point P is not on the elliptic curve, the signature is invalid; otherwise, according to the X-axis coordinate x of point P P Judge x P mod n=r. If yes, the signature is valid, otherwise, the signature is invalid; where G is the base point of the elliptic curve.

[0095] The calculation results are mainly verified by dual verification. The correctness verification process of the calculation results includes: all participants jointly generate a random share of the random number R [R] t ;

[0096] Assuming that there is a malicious adversary who may introduce erroneous values ​​during the calculation process, the correctness of the final calculation result is verified according to the following process:

[0097] For each participant, obtain the data pair ([x] t , [Rx] t ) and ([y] t , [Ry] t ); according to (([x] t , [Rx] t ) and ([y] t , [Ry] t ) in [x] t and [y] t Calculate [z] t =[xy+d] t , according to [Rx] t and [y] t Calculate [Rxy+e] t , according to [z] t and [R] t Calculate and get [Rz+f] t ; Check [Rxy+e] t Is it equal to [Rz+f] tIf yes, then d, e, and f are all 0, indicating that no error is introduced during the calculation process. Otherwise, it means that an error is introduced during the calculation process, and the calculation is terminated at this time; where d, e, and f represent potential errors introduced by malicious adversaries. It can be understood that in the above process, all [] t The values ​​of [] can all be calculated using the constructed secret sharing polynomial, and the multiplication calculations involved are calculated using the multiplication calculation protocol.

[0098] The verifiable secure multi-party computing method based on blockchain provided by the embodiment of the present invention realizes secret computing that protects user data ownership and data privacy through secure multi-party computing, and at the same time introduces non-interactive zero-knowledge proof, utilizes the immutability and transparency of blockchain, and publicly verifies the data consistency and computational validity of secure multi-party computing on the blockchain, which can enhance the security of secure multi-party computing, realize data privacy protection under a variety of security assumptions, and improve the credibility of computing and the security of the system.

[0099] Furthermore, in order to ensure that the secret share received by each participant is correctly constructed based on the sensitive data and polynomial set by the data sharer, this implementation also includes: generating a public commitment about the sensitive data and signing the public commitment so that the participants can verify the public commitment.

[0100] Specifically, generate public commitments about sensitive data, including: q Uniformly randomly select t random numbers r from i , i = 0, 1, ..., t-1, for each coefficient a of the polynomial f(x) i , generating the commitment coefficient C i : Published by TG. C0, C1, ..., C t-1 These commitments encrypt the coefficients and together form a commitment to the secret shared polynomial f(x), which is also a public commitment about the sensitive data.

[0101] It can be understood that the process of signing the public commitment can refer to the above-mentioned generation of the signature ST j The process will not be described in detail here.

[0102] The process of verifying the signature of a public commitment by a participant includes: Share verification is performed by the recipient using the public commitment C they received i The verification procedure includes the participation of DP j calculate

[0103]

[0104] Through this process, without revealing the content of the secret share, each participant can ensure that their secret share is correctly constructed based on the initial secret (i.e., sensitive data s) and the polynomial set by the data sharer. If the verification fails, it means that the data sharer may have issued a wrong share or been deceived during the public commitment setting.

[0105] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A verifiable secure multi-party computing method based on blockchain, characterized in that: include: Step 1: Obtain sensitive data, assign a unique identifier to each participant, and assign a secret share to each participant based on the sensitive data and the unique identifier of each participant; Step 2: After receiving the secret share, each participant generates a commitment for his or her own secret share, signs the commitment for the secret share, and uploads the secret share, the commitment for the secret share, and the signature to the blockchain; Step 3: Each participant performs local computation based on the received secret share and securely transmits the local computation results to all other participants; Step 4: Each participant receives the local calculation results transmitted by other participants and reconstructs all local calculation results to restore the final calculation results; Step 5: Use zero-knowledge proof to publicly verify the consistency and validity of the computation results of secure multi-party computation on the blockchain.

2. According to claim 1, a blockchain-based verifiable secure multi-party computing method is characterized in that: In step 1, a secret share is allocated to each participant based on the sensitive data and the unique identifier of each participant, specifically including: Construct a random secret sharing polynomial f(x), and assign a secret share to each participant according to the polynomial f(x); f(x)=a0+a1x+…+a t-1 x t-1 s j =f(a j ) Among them, a0 is sensitive data, a1,...,a t-1 is a randomly generated coefficient, t represents the preset threshold, s j Indicates that the unique identifier is α j The secret shares of the participants.

3. The blockchain-based verifiable secure multi-party computing method according to claim 1, characterized in that: In step 2, generate a commitment for your own secret share, specifically including: generating a random number t j , based on the random number t j Generate commitment D j : Among them, s j represents the secret share, q represents a preset large prime number, and j represents the index of the participant.

4. The blockchain-based verifiable secure multi-party computing method according to claim 3, characterized in that: In step 2, the commitment to the secret share is signed, which specifically includes: first generating the commitment text CT j : CT j =(α j ||D j ||T j ); regenerate the commitment text CT j Signature ST j : Among them, α j is the unique identifier of the participant, T j is the current timestamp, sk j The private key of the participant, represents a signature operation using a private key, and H(·) represents a secure hash function.

5. According to claim 2, a blockchain-based verifiable secure multi-party computing method is characterized in that: In step 3, each participant performs local computation based on the received secret shares, including: for any two shared vectors [x] in the secret shares t and [y] t , perform addition calculation according to the following formula; in, represents the result of addition calculation, x and y represent the shared vector [x] t and [y] t The corresponding sensitive data.

6. A blockchain-based verifiable secure multi-party computing method according to claim 2, characterized in that: In step 3, each participant performs local computation based on the received secret shares, including: for any two shared vectors [x] in the secret shares t and [y] t , perform multiplication calculation according to preset rules; the preset rules include: Calculate intermediate parameters [e] 2t :=[x] t *[y] t +[r] 2t , and the intermediate parameter [e] 2t Sent to the participant representative for the participant representative to collect the intermediate parameters sent by all participants [e] 2t Reconstruct the secret e; where [r] 2t represents a pre-generated first random vector shared by all participants; the participant representative is pre-selected from all participants; Receive the secret e sent by the participant representative, and calculate based on the secret e in, Indicates the result of multiplication calculation, [r] t Represents a pre-generated second random vector shared by all participants.

7. The blockchain-based verifiable secure multi-party computing method according to claim 2, characterized in that: Step 4 specifically includes: For each participant, count all local calculation results [z] t ={z1, z2, ..., z n }; where z1, z2, ..., z n Respectively represent the local calculation results of n participants; Set z to represent the desired calculation result, and use the Lagrange interpolation method to take the desired calculation result z as the independent variable of the polynomial f(x) to construct a new t-1 order polynomial f z (w): Among them, α i A unique identifier representing the participant, p represents a preset large prime number; Let w in M(w) be 0, so that f z (w)Convert to f z (0), all local calculation results [z] t Substitute f z (0), by calculating f z (0), obtaining the desired calculation result z; 8. The blockchain-based verifiable secure multi-party computing method according to claim 4, characterized in that: Step 5 specifically includes: The verifier receives the commitment text CT j , Commitment Text CT j Signature and public key pk j , participants used the received CT j and T j , calculate the hash value h j =H(CT j ||T j ); Use the submitter's public key pk j For received ST j Verify, the verification process is: Verify(pk j ,ST j , (CT j , H(CT j ||T j ))); among which, (CT j , H(CT j ||T j )) is based on the received CT j And the calculated hash value h j get; Participants receive the public key pk from the submitter j 、Signature ST j =(r, v), and obtain a hash value; wherein r, v represent the components of the signature; The participant verifies whether r and v are in the interval [1, n-1], where n represents the number of participants; if not, the signature is invalid; if so, the participant continues to use the hash value to calculate the intermediate parameters u1 and u2: The participant uses u1 and u2 to calculate the point P: P = u1·G + u2·pk j If point P is not on the elliptic curve, the signature is invalid; otherwise, according to the X-axis coordinate x of point P P Judge x P mod n=r. If yes, the signature is valid, otherwise, the signature is invalid; where G is the base point of the elliptic curve.

9. The blockchain-based verifiable secure multi-party computing method according to claim 8, characterized in that: Step 5 specifically also includes: All participants jointly generate a random share of the random number R [R] t ; Assuming that there is a malicious adversary who may introduce erroneous values ​​during the calculation process, the correctness of the final calculation result is verified according to the following process: For each participant, obtain the data pair ([x] t , [Rx] t ) and ([y] t , [Ry] t ); according to (([x] t , [Rx] t ) and ([y] t , [Ry] t ) in [x] t and [y] t Calculate [z] t =[xy+d] t , according to [Rx] t and [y] t Calculate [Rxy+e] t , according to [z] t and [R] t Calculate and get [Rz+f] t ; Check [Rxy+e] t Is it equal to [Rz+f] t If so, it means that d, e, and f are all 0, indicating that no error is introduced during the calculation process. Otherwise, it means that an error is introduced during the calculation process, and the calculation is terminated at this time; among them, d, e, and f represent the potential errors introduced by malicious opponents.

10. A blockchain-based verifiable secure multi-party computing method according to any one of claims 1 to 9, characterized in that: Also includes: Generate a public commitment about the sensitive data and sign the public commitment so that the participants can verify the public commitment.

Images