A secret sharing packaging method and device

Abstract

The embodiment of the present specification provides a secret sharing packaging method and device. A plurality of participants respectively encode vectors formed by secret sharing of k data owned by each participant in a specified domain space to obtain first domain elements owned by each participant, wherein the first domain elements have a data structure satisfying additive homomorphism. Then, through the first data interaction based on secure multi-party computation between the plurality of participants, the secret sharing addition operation is performed based on the first domain elements owned by each participant, so that the plurality of participants respectively obtain: the secret sharing of the first sum value of the first domain elements owned by each participant. The secret sharing of the first sum value is used as the secret sharing of the second domain element obtained by encoding the vector formed by k data in the specified domain space.

Description

Technical Field

[0001] This specification relates to one or more embodiments in the field of computer technology, and more particularly to a method and apparatus for secret sharing and packaging. Background Technology

[0002] Secure Multi-Party Computation (MPC) is a cryptographic technique that allows multiple participants to collaborate on computation and analysis while maintaining their individual data privacy. Its core idea is to use cryptographic techniques and algorithms to encrypt the data of each participant before computation, ensuring that each participant only obtains the data and computation results they need, and cannot access the original data of other participants. Many business scenarios involve data computation and interaction between multiple collaborating parties; however, none of the parties want to leak their private data. In such cases, secure multi-party computation based on secret sharing has become a widely deployed security solution. Currently, reducing the computational overhead in secure multi-party computation is an ongoing problem. For example, in traditional Boolean secret sharing schemes, 1 bit of data requires at least 40 bits of verification code during computation, resulting in huge computational and communication overhead.

[0003] Therefore, we hope to find an improved solution that can reduce the overhead of secure multi-party computation. Summary of the Invention

[0004] This specification describes one or more embodiments of a secret sharing packaging method and apparatus to reduce the overhead of secure multi-party computation. The specific technical solution is as follows.

[0005] In a first aspect, the embodiments provide a secret sharing packaging method, executed by multiple participants, including:

[0006] Multiple participants encode the vector formed by sharing the secrets of their respective k data points in a designated domain space, thereby obtaining their respective first domain elements; the first domain elements have a data structure that satisfies additive homomorphism.

[0007] Multiple participants engage in a first data interaction based on secure multi-party computation, and perform a secret sharing addition operation based on their respective first domain elements, so that each participant obtains: a secret sharing of the first sum value of the first domain elements they each possess; the secret sharing of the first sum value is used as a secret sharing of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

[0008] In one implementation, the secret sharing of k data points from any participant is obtained in the following manner:

[0009] The i-th bit of the secret sharing of k data to be processed is determined as the secret sharing of the k data.

[0010] In one implementation, the method further includes:

[0011] Multiple participants perform specified operations through a second data interaction based on secure multi-party computation, based on the secret sharing of the second domain elements they each obtain, so that each participant obtains the secret sharing operation result;

[0012] The result of decoding the secret sharing operation is equal to the result obtained by each of the multiple participants by performing a corresponding operation based on the secret sharing of the i-th bit of the k data to be processed.

[0013] In one implementation, the first data interaction includes:

[0014] Multiple participants secretly share their respective first domain elements through a first data interaction based on secure multi-party computation, so that each participant obtains: the secret sharing of the first domain elements owned by any one participant;

[0015] Multiple participants each sum the secret shares of the multiple first-domain elements they have obtained to obtain the secret share of the first sum value.

[0016] In one implementation, the method further includes: multiple participants using k random numbers to perform a consistency check between the secret sharing of the first sum and the k data.

[0017] In one implementation, the consistency check includes:

[0018] Multiple participants each share a vector formed by their own k random numbers, which is then encoded in a specified domain space to obtain their own third domain element; the third domain element has a data structure that satisfies additive homomorphism.

[0019] Multiple participants perform a secret-shared addition operation on the third domain elements they each possess through a first data interaction based on secure multi-party computation, so that each participant obtains: a secret-shared second sum value of the third domain elements they each possess.

[0020] Multiple participants respectively perform a first combination on the secret sharing of the first sum value and the secret sharing of the second sum value to obtain the secret sharing of the first combined value; respectively perform the first combination on the secret sharing of the k data and the secret sharing of the k random numbers to obtain the secret sharing of the second combined value.

[0021] Any participant reconstructs the first combined value based on the secret sharing of the first combined value owned by each of the multiple participants, and reconstructs the second combined value based on the secret sharing of the second combined value owned by each of the multiple participants. When the result of decoding the first combined value is equal to the second combined value, it is determined that the consistency check has been passed.

[0022] In one implementation, the designated domain space is a space containing multiple m-bit binary domain elements, and the encoding includes operations based on the multiplication-friendly encoding RMFE.

[0023] Secondly, the embodiment provides a secret sharing packaging method, executed by any one of multiple participants, including:

[0024] Encode the vector formed by the secret sharing of k data points in a specified domain space to obtain the first domain element; the first domain element has a data structure that satisfies additive homomorphism.

[0025] Through a first data interaction based on secure multi-party computation with other participants, and a secret sharing addition operation based on the first domain elements owned by each participant, the participants obtain: a secret sharing of the first sum value of the first domain elements owned by each participant; the secret sharing of the first sum value is used as a secret sharing of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

[0026] Thirdly, the embodiment provides a secret sharing and packaging system, the system comprising multiple participants;

[0027] Multiple participants encode the vector formed by the secret sharing of their respective k data points in a specified domain space to obtain their respective first domain elements; the first domain elements have a data structure that satisfies additive homomorphism.

[0028] Among multiple participants, a first data interaction based on secure multi-party computation is used to perform a secret sharing addition operation based on the first domain elements owned by each participant, so that each participant obtains: a secret sharing of the first sum value of the first domain elements owned by each participant; the secret sharing of the first sum value is used as a secret sharing of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

[0029] Fourthly, the embodiments provide a secret sharing packaging device, deployed in any one of multiple participants, including:

[0030] An independent encoding module is configured to encode a vector formed by the secret sharing of k data it possesses in a specified domain space to obtain a first domain element; the first domain element has a data structure that satisfies additive homomorphism.

[0031] The joint summation module is configured to perform a secret-shared addition operation based on the first domain elements owned by each party through a first data interaction based on secure multi-party computation with other participants, so that multiple participants respectively obtain: a secret share of the first sum value of the first domain elements owned by each party; the secret share of the first sum value is used as a secret share of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

[0032] Fifthly, an embodiment provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method described in any one of the first and second aspects.

[0033] In a sixth aspect, an embodiment provides a computing device including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of the first and second aspects.

[0034] In the methods and apparatus provided in the embodiments of this specification, by packaging the secret sharing of k data into the secret sharing of a domain element, multiple secret sharings are transformed into a more compact packaged data. Based on the packaged data, a specified operation can be performed to achieve the effect of processing k data simultaneously using a single verification code. Therefore, the performance of secure multi-party computation can be improved and the overhead can be reduced. Attached Figure Description

[0035] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0036] Figure 1 This is a schematic diagram illustrating an implementation scenario of one embodiment disclosed in this specification;

[0037] Figure 2 A flowchart illustrating a secret sharing packaging method is provided for an embodiment.

[0038] Figure 3 A schematic diagram illustrating the principles of the packaging and calculation processes provided for this embodiment;

[0039] Figure 4A schematic block diagram of a secret sharing and packaging system provided for an embodiment;

[0040] Figure 5 This is a schematic block diagram of a secret sharing packaging device provided for an embodiment. Detailed Implementation

[0041] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0042] Figure 1 This is a schematic diagram illustrating an implementation scenario of one embodiment disclosed in this specification. It includes multiple participants, such as participant P0, participant P1, and participant P2. Each participant encodes the vector corresponding to the secret sharing of k data points they possess in a designated space to obtain domain elements, thus each participant obtains their own domain elements. Next, through MPC-based data interaction, the multiple participants perform a secret sharing addition operation on their respective domain elements, and each participant obtains the secret sharing of the sum of all domain elements. Through this packaging / encoding technique, the secret sharing of k data points is transformed into the secret sharing of one domain element; this secret sharing of the sum is the secret sharing of the domain element directly encoded from the vector composed of the k data points. Here, the k data points are the complete data obtained after reconstructing the secret sharing of the k data points possessed by the multiple participants. Reconstruction may include operations such as addition. The k data points are private data, and in practical applications, the reconstruction operation is not performed; the k data points and the reconstruction operation are only used for theoretical analysis. Figure 1 The multiple participants shown are merely an example. In practical applications, the number of participants can be two or more.

[0043] Multiple parties can communicate via the Internet and jointly execute a pre-negotiated software protocol, MPC. The MPC described in this specification may include algorithms such as homomorphic encryption, secret sharing, zero-knowledge proofs, accidental transmission, and obfuscated circuits. Secret sharing, also known as secret sharing, divides confidential information into multiple random fragments, each stored and managed by a different party. The original secret can only be recovered when a certain number of parties cooperate. This can be achieved using... <x>To represent the sharing of X's secret. <x>The subscript indicates the party that possesses the secret share. Secret sharing is a fundamental algorithm in MPC, providing a method for secure information exchange without revealing each other's inputs. This algorithmic mechanism is the cornerstone for building more complex secure multi-party computation protocols, and other secure multi-party computation algorithms can be executed based on the secret sharing algorithm.

[0044] In business processing, multiple parties share a secret set of data to be processed, and these parties perform operations based on this secret share. To ensure the security of the operations and prevent parties from deviating from the agreed-upon procedures, a verification code is attached when performing operations on the secret share of data to be processed. For example, in a two-party Boolean secret sharing scenario, two parties, P0 and P1, each possess a secret share of sensitive data x. <x>0 and <x>1. x takes the value 0 or 1.

[0045] Each party possesses two global L-bit keys, a0 and a1, and each secret share of x is accompanied by L-bit verification codes m0 and m1. Thus, party P0 possesses a0, a0, and a1 keys. <x>0 and m0, participant P1 has a1, <x>1 and m1, and satisfy the following relationship:

[0046] x = <x> 0+ <x>1

[0047] m0+m1=( <x> 0+ <x>1)(a0+a1)

[0048] In practical applications, to ensure sufficient security, the value of L needs to be at least 40. Based on this Boolean secret sharing scheme, any subsequent calculation result needs to maintain such an equation, that is, the corresponding L-bit verification code needs to be calculated, which means that 1 bit of data operation requires L bits of overhead, increasing the cost by a factor of L.

[0049] To reduce the computational overhead in secure multi-party computation, embodiments of this specification provide a secret sharing packaging method. This method packages and encodes the secret sharing of k data points into a single domain element. Multiple participants perform specified operations based on this domain element, along with a verification code. Decoding the result of the operation reveals the result obtained by directly performing the corresponding operation on the k data points. However, directly performing the corresponding operation on the k data points requires k such verification codes, resulting in significant overhead. Therefore, the packaging technique of the embodiments of this specification can reduce the overhead in secure multi-party computation.

[0050] It should be noted that multiple participants perform data computation operations through their respective computing devices. These computing devices (i.e., participant devices) are connected via network communication. Each computing device can be implemented using any apparatus, device, platform, or cluster of devices with computing and processing capabilities.

[0051] The following is combined Figure 2 Specific embodiments will be described in detail.

[0052] Figure 2 This embodiment provides a flowchart illustrating a method for secret sharing and packaging. This method is executed by multiple parties. For ease of understanding, this embodiment uses parties P0 and P1 as examples. This embodiment specifically includes the following steps.

[0053] In step S210, multiple participants encode the vector formed by the secret sharing of their respective k data points in a specified domain space, thereby obtaining their respective first domain elements.

[0054] The first field element has a data structure that satisfies additive homomorphism.

[0055] A specified domain space can be a defined numerical domain space, which is a finite field. A specified domain space contains multiple elements. The specified domain space involves corresponding encoding and decoding processes. The encoding algorithm used in the specified domain space is one that satisfies the additive homomorphic property. The first domain element and other domain elements obtained after encoding in the specified domain space (collectively referred to as domain elements) have a data structure that satisfies additive homomorphism; that is, the domain elements possess additive homomorphism and can preserve addition operations.

[0056] In mathematics and cryptography, homomorphism is an important concept that describes the ability of a structure to retain its operational properties under a mapping (such as an encoding function). The property that field elements can retain addition can be expressed as follows: after encoding two vectors X and Y into elements M and N in a specified field space, if a carry-free addition Z = M + N is performed on M and N, and Z is decoded back into a vector C, then C is guaranteed to be equal to the bitwise addition of X and Y, that is, for any i-th bit, C[i] = X[i] + Y[i] (without carry). Here, C[i], X[i], and Y[i] represent the i-th bit data in C, X, and Y, respectively. This encoding and decoding process can be used to embed elements from a small finite field into a larger finite field while maintaining a certain degree of homomorphism.

[0057] In information theory, cryptography, and communication systems, the binary field is an important numerical field and algebraic operation field. The following explanation uses the binary field as an example to illustrate a specific field space. In a binary field, the elements are m-bit binary numbers. This type of field space is often called a binary finite field, also known as a Galois field (GF(2)). m In this field, element operations are modulo 2, meaning they mainly involve addition and multiplication without carry.

[0058] The following explanation uses the Reverse Multiplication-Friendly Embedding (RMFE) algorithm as an example to illustrate encoding algorithms in the binary domain. RMFE is an encoding and decoding technique used in cryptography and MPC. It allows multiple numerical values ​​to be encoded as polynomials, enabling multiplication without revealing the original numerical values. RMFE is an encoding method applied in the binary domain. Its input is a k-bit vector (each element is either 0 or 1), and through an encoding function mapping, the output is an m-bit binary domain element.

[0059] In this scenario, the k data points are binary numbers, and their values ​​can be either 0 or 1. The secret sharing of these k data points forms a k-bit vector, with each element being either 0 or 1. The first field element obtained by each of the participating parties is an m-bit binary field element. The space containing the k-bit vector is a k-bit vector space, where k is typically set between 10 and 20. RMFE can convert elements between the vector space and the binary field space. Furthermore, to increase security, m is usually set to be greater than k, meaning the number of bits in the binary field space is greater than the dimension of the vector space. For example, a setting like k = 12, m = 48 could be used. Setting k and m to other values ​​is also possible.

[0060] The field elements obtained by the RMFE encoding algorithm possess both additive homomorphism (preserving the properties of addition) and multiplicative homomorphism (preserving the properties of multiplication). When two k-bit vectors X and Y are encoded into binary field elements M and N respectively, if a no-carry addition Z = M + N is performed on M and N, and Z is decoded back into a vector C, then C is guaranteed to be equal to the bitwise addition of X and Y. That is, for any i-th bit, C[i] = X[i] + Y[i] (no carry), which demonstrates the property of binary field elements preserving addition. If a multiplication Z = MN is performed on M and N, and Z is decoded back into a vector C, then C is guaranteed to be equal to the bitwise multiplication of X and Y. That is, for all i (1 ≤ i ≤ k), C[i] = X[i] * Y[i], which demonstrates the property of binary field elements preserving multiplication.

[0061] The following content will use E to represent the encoding algorithm (e.g., RMFE encoding algorithm) and D to represent the decoding algorithm (e.g., RMFE decoding algorithm).

[0062] In step S210, the secret sharing of k data items owned by participant P0 can be represented as follows: <x1> 0, <x2>0,…, <x k >0. The vector formed by the secret sharing of k data points by participant P0 can be represented as...

[0063] <x> 0＝( <x1> 0, <x2>0,…, <x k >0) (1)

[0064] The vector can be a k-bit vector, where each element has a value of 0 or 1.

[0065] The secret sharing of k pieces of data possessed by participant P1 can be represented as <x1> 1, <x2>1,…, <x k >1. The vector formed by the secret sharing of k data points by participant P1 can be represented as:

[0066] <x> 1＝( <x1> 1, <x2>1,…, <x k >1) (2)

[0067] The vector can be a k-bit vector, where each element has a value of 0 or 1.

[0068] The k data points are the complete data obtained by reconstructing the data after assuming that each of the k data points held by multiple participants is secretly shared. These k data points are considered private data. The k data points can be represented as x1, x2, ..., x... k A complete vector consisting of k data points can be represented as x = (x1, x2, ..., xk). k And the following relationship exists:

[0069] x = <x> 0+ <x>1 (3)

[0070] Participant P0 has its own k-bit vector <x>Encoding with 0, the resulting m-bit first field element y0 can be represented as:

[0071] y0=E( <x> 0)＝E(( <x1> 0, <x2>0,…, <x k >0)) (4)

[0072] Participant P1 has its own k-bit vector <x>Encoding 1, the first field element y1 of dm bits can be represented as:

[0073] y1=E( <x> 1)＝E(( <x1> 1, <x2>1,…, <x k >1)) (5)

[0074] It is understandable that although both parties obtain field elements y0 and y1, which are both called first field elements, their values ​​are different. Furthermore, the first field elements y0 and y1 are not secret shares, but rather data obtained by encoding the secret share; therefore, they are not represented with angle brackets. The process of encoding k vectors into m-bit binary field elements using RMFE can be implemented using existing techniques, which will not be elaborated here.

[0075] In step S220, multiple participants (e.g., P0 and P1) perform a secret sharing addition operation based on their respective first domain elements y0 and y1 through first data interaction based on MPC, so that each participant P0 and P1 obtains a secret share of the first sum y. The secret sharing of the first sum y is used as a secret sharing of the second domain element E(x) obtained by encoding a vector composed of k data points in a pointing domain space.

[0076] Wherein, the first sum y is the sum of the first field elements y0 and y1 owned by each of the multiple participants, denoted as:

[0077] y = y0 + y1 (6)

[0078] Participant P0 received the secret share of the first sum y. <y>0, participant P1 received the secret share of the first sum y. <y>1.

[0079] In this embodiment, the first data interaction in step S220 can be implemented using various methods in MPC, such as a secret sharing addition algorithm. Based on the first domain elements y0 and y1 owned by each of the multiple participants, the multiple participants P0 and P1 respectively obtain a secret share of the first sum value y. Step S220 may specifically include the following steps 1 and 2 during execution.

[0080] Step 1: Multiple participants secretly share their respective first domain elements through MPC-based first data interaction, so that each participant obtains the secret sharing of the first domain element owned by any one participant.

[0081] For example, participant P0 can split the first domain element y0 into secret sharing. <y0>0 and <y0>1, and share the secret. <y0>1. Send to participant P1. Participant P1 can split the first domain element y1 into secret shares. <y1>0 and <y1>1, and share the secret. <y1>0 is sent to participant P0. Thus, participant P0 obtains the secret share of the first domain element. <y0>0 and <y1>0. Participant P1 obtained the secret sharing of the first domain element. <y0>1 and <y1>1.

[0082] The following relationship exists:

[0083] y0 = <y0> 0+ <y0> 1

[0084] y1＝ <y1> 0+ <y1>1 (7)

[0085] Step 2: Multiple participants sum the secret shares of their respective first domain elements to obtain the secret share of the first sum value y.

[0086] The secret sharing of the first domain element obtained by participant P0. <y0>0 and <y1>Summing by zero yields the sum value. <y0> 0+ <y1>0 =<y0+y1> Sharing the secret of finding the first sum y: 0 <y>0. This is because, according to equation (6), y = y0 + y1.

[0087] The secret sharing of the first domain element obtained by participant P1 <y0>1 and <y1>1. Summation, the sum value obtained. <y0> 1+ <y1>1 =<y0+y1> 1 is the secret to finding the first sum y. <y>1.

[0088] The following explanation, based on theoretical analysis, demonstrates that the secret sharing of the first sum y can be used as the secret sharing of the second field element E(x), i.e., the theoretical correctness of the following relation:

[0089] y=E(x) (8)

[0090] According to equations (4), (5), and (6), we can know

[0091] y = y0 + y1 = E( <x> 0)+E( <x>1)

[0092] According to the properties of RMFE, the field elements obtained after RMFE encoding have a data structure that satisfies addition homomorphism and can preserve addition operations, i.e., the following relationship holds:

[0093] E( <x> 0)+E( <x> 1)＝E( <x> 0+ <x>1)

[0094] According to equation (3):

[0095] E( <x> 0+ <x>1) = E(x)

[0096] Therefore, we can conclude that y = E(x) holds true.

[0097] This gives us a packed form y of the k-bit vector x, and y has been secretly shared. <y>It exists in P0 and P1. In the examples listed above, a 1-bit data operation requires an L-bit verification code. Continuing with this example, when y is an m-bit binary field element, as long as m is greater than 40, only an m-bit verification code is needed to satisfy the required security in the secret sharing of y. Therefore, the embodiment achieves the effect of using a packing and conversion technique to verify the initial k-bit vector x with only an m-bit verification code, reducing the overhead inflation factor from 40 to m / k. For example, if k = 12 and m = 48, then m / k = 4. This effectively reduces the overhead. It is understood that the packing process in this embodiment also includes an encoding process. Therefore, when mentioning packing, it can also be understood as packing and encoding operations.

[0098] It should be noted that numerical values ​​without angle brackets typically represent complete values, not secret shares. In the embodiments described in this specification, the relationships between complete values ​​are for theoretical analysis only and will not be used in actual data processing. Actual data processing utilizes corresponding secret shares.

[0099] As mentioned above, the secret sharing of the first sum y can be used as the secret sharing of the second field element E(x), provided that all parties correctly execute the prescribed operations and protocols. However, in practical applications, parties may engage in malicious operations. Therefore, based on y = E(x), certain checking steps can be used to ensure the security of the steps performed by each party.

[0100] In one embodiment, multiple participants can use k random numbers to perform consistency verification on the secret sharing of the first sum y and k data points based on y = E(x). Verification can be performed between the participants through data interaction based on MPC. The k random numbers are used to ensure that the privacy of the first sum y and E(x) is not leaked.

[0101] Specifically, the consistency verification process may include the following steps 3 to 6.

[0102] Step 3: Multiple participants share the secrets of their respective k random numbers. <r>The constructed vectors are encoded in a specified domain space to obtain their respective third-domain elements. These third-domain elements possess a data structure that satisfies additive homomorphism. Multiple participants can obtain a secret share of k random numbers by invoking the "random bit generation" process in a traditional Boolean secret sharing scheme. The values ​​of these k random numbers are either 0 or 1.

[0103] The secret sharing of k random numbers possessed by participant P0 is represented as follows: <r> 0， <r> 0＝( <r1> 0, <r2>0,…, <r k >0).

[0104] The secret sharing of k random numbers possessed by participant P1 is represented as follows: <r> 1， <r> 1＝( <r1> 1, <r2>1,…, <r k >1).

[0105] Step 4: Multiple participants (e.g., P0 and P1) perform a secret sharing addition operation on their respective third domain elements through a first data interaction based on MPC, so that each participant obtains a secret share of the second sum value q. <q>.

[0106] The secret sharing of the second sum q is used as the secret sharing of the fourth field element E(r) obtained by encoding a vector of k random numbers in the pointing field space. The second sum q is the sum of the third field elements held by each of the participating parties.

[0107] Based on the above analysis, we can also obtain q = E(r).

[0108] In this embodiment, the specific implementation and explanation of steps 3 and 4 can be found in steps S210 and S220, where k random numbers are equivalent to k data points, the third field element is equivalent to the first field element, and the second sum is equivalent to the first sum. The above equivalence relationships can be used to make corresponding substitutions; further details are omitted.

[0109] Step 5, any one of the multiple participants P0 and P1 performs the following operation: secret sharing of the first sum value y. <y>Secrets of the second sum q <q>The secret sharing of obtaining the first combination value z by performing the first combination. <z>Secret sharing of k data points <x>Sharing the secrets of k random numbers <r>The secret to obtaining the second combination value w by performing the first combination. <w>All participants shall perform this step.

[0110] The first combination can be a linear combination or a nonlinear combination. A linear combination can be an operation such as addition, while a nonlinear combination can be an operation such as multiplication.

[0111] Let's take the first combination as an example, which is a random linear combination. The secret of the first combination value z is revealed. <z>It can be obtained through the following formula:

[0112] <z> ＝ c <y> + <q>(9)

[0113] Where c is a publicly available random bit.

[0114] Sharing the secret of the second combination value w <w>It can be obtained through the following formula:

[0115] <w> ＝c <x> + <r>

[0116] Step 6: Any participant P0 obtains the secret sharing of the first combination value z possessed by participant P1. <z>Using the secret sharing of the participant P0 <z>Reconstruct the first combination value z; obtain the secret sharing of the second combination value w possessed by participant P1. <w>Using the secret sharing of the participant P0 <w>The second combined value w is reconstructed. If the result D(z) after decoding the first combined value z is equal to the second combined value w, the consistency check is passed. If they are not equal, it indicates malicious operation by one of the participants.

[0117] Next, let's discuss... Figure 2 Step S210 in the embodiment will be explained in some ways.

[0118] In some application scenarios, the data to be processed may not be a 1-bit binary number, but rather an h-bit number. In this case, the above embodiment can be used to package the identical bits among the k h-bit data to be processed. Specifically, the secret sharing of k data from any participant is obtained in the following way: the i-th bit of the secret sharing of the k data to be processed is determined as the secret sharing of the k data. i takes a value from 1 to h.

[0119] Among them, the i-th data of the k data to be processed is the k data, which is the complete data.

[0120] Multiple participants perform specified operations through second data interaction based on MPC, based on the secret sharing of their respective second domain elements E(x), so that each participant obtains the secret sharing operation result.

[0121] The result of decoding the secret sharing operation is equal to the result obtained by multiple participants by performing corresponding operations based on the secret sharing of the i-th bit of each of the k data to be processed.

[0122] Multiple participants interact via a third-party data exchange based on MPC. Each participant performs corresponding operations (which can be considered the initial operations) based on a secret sharing of the i-th bit of each of the k data to be processed, resulting in a specific outcome for each participant. The processing here involves performing the initial operations on the i-th bit of each data to be processed, combined with the accompanying verification code. When the data to be processed contains h bits and there are k data to be processed, k*h initial operations are required.

[0123] By packaging the i-th bit of k data to be processed, we can obtain h packaged second field elements. Then, for each second field element, we can perform h specified operations in combination with the attached verification code and decode the results to obtain the same result. However, the number of operations is reduced from k*h to h, which can significantly reduce the overhead.

[0124] The aforementioned primitive operations can include multiplication, addition, and logical operations. Logical operations include XOR and AND operations. When the primitive operation is multiplication or addition, the specified operation is also multiplication or addition. When the primitive operation is XOR, the specified operation is addition. When the primitive operation is AND, the specified operation is multiplication.

[0125] The following is combined Figure 3 The example shown illustrates this. Figure 3 This is a schematic diagram illustrating the principles of the packaging and computation processes provided for an embodiment. The data to be processed, d1 and d2, are 32-bit numbers. Figure 3 The 32 horizontal boxes represent one piece of data to be processed, and the k vertical boxes list k pieces of data to be processed.

[0126] Taking the data d1 to be processed as an example, during packaging, the first element of each of the k data d1 to be processed can be used to form a vector, and then... Figure 2 The method in this embodiment is packaged into a domain element E(d1), and multiple participants each obtain a secret share of the domain element E(d1).<E(d1)> Similarly, the first bit of each of the k data points d2 to be processed can be used to construct a vector, and then... Figure 2 The method in this embodiment is packaged into a domain element E(d2), and multiple participants each obtain a secret share of the domain element E(d2).<E(d2)> Multiple parties share secrets.<E(d1)> Share with secrets<E(d2)> After multiple data interactions and specified calculations, the result C is obtained.

[0127] If the packaging scheme of this embodiment is not adopted, but instead the original operation is performed directly based on the secret sharing of the first bit of the data to be processed in d1 and the secret sharing of the first bit of the data to be processed in d2 owned by multiple participants, the result c is obtained after multi-party interaction. Based on the description of the above embodiment, it can be seen that D(C) obtained by decoding the result C is equal to c.

[0128] When multiple parties perform various data interactions based on MPC (including the first data interaction and subsequent data interactions), their functions and statuses are the same, the operations they perform and the types of data they obtain are the same, but the numerical values ​​of the data themselves are different. For example, the value of the first sum y shared secretly by party P0 is different from the value shared secretly by party P1. It should be noted that although multiple secret shares can reconstruct the complete data, the complete data is not reconstructed during data processing; instead, data processing is based on the secret shares.

[0129] In this specification, the terms "first" in the first field element, first sum value, and first data interaction, as well as the corresponding "second" (if present) in the text, are merely for the convenience of distinction and description, and do not have any limiting meaning.

[0130] The foregoing description describes specific embodiments of this specification; other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than those shown in the embodiments, and the desired result may still be achieved. Furthermore, the processes depicted in the drawings do not necessarily need to follow the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0131] Figure 4 This is a schematic block diagram of a secret sharing and packaging system provided for an embodiment. The system 400 includes multiple participants, such as participant 410, participant 420, and participant 430. The system 400 and... Figure 2 The method embodiments shown correspond to those described.

[0132] Multiple participants encode the vector formed by the secret sharing of their respective k data points in a specified domain space to obtain their respective first domain elements; the first domain elements have a data structure that satisfies additive homomorphism.

[0133] Among multiple participants, a first data interaction based on secure multi-party computation is used to perform a secret sharing addition operation based on the first domain elements owned by each participant, so that each participant obtains: a secret sharing of the first sum value of the first domain elements owned by each participant; the secret sharing of the first sum value is used as a secret sharing of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

[0134] In one implementation, any participating party obtains the secret share of the k data by determining the i-th bit of the secret share of the k data to be processed as the secret share of the k data.

[0135] In one implementation, multiple participants further engage in a second data interaction based on secure multi-party computation, performing specified operations based on the secret sharing of the second domain elements they each obtain, so that each participant receives a secret sharing operation result. The result of decoding the secret sharing operation result is equal to the result obtained by each participant through corresponding operations performed based on the secret sharing of the i-th bit of the k data to be processed.

[0136] In one implementation, the first data interaction includes:

[0137] Multiple participants secretly share their respective first domain elements through a first data interaction based on secure multi-party computation, so that each participant obtains: the secret sharing of the first domain elements owned by any one participant;

[0138] Multiple participants each sum the secret shares of the multiple first-domain elements they have obtained to obtain the secret share of the first sum value.

[0139] In one implementation, multiple parties are further configured to use k random numbers to perform a consistency check between the secret sharing of the first sum and the k data.

[0140] In one implementation, consistency verification includes:

[0141] Multiple participants each share a vector formed by their own k random numbers, which is then encoded in a specified domain space to obtain their own third domain element; the third domain element has a data structure that satisfies additive homomorphism.

[0142] Multiple participants perform a secret-shared addition operation on the third domain elements they each possess through a first data interaction based on secure multi-party computation, so that each participant obtains: a secret-shared second sum value of the third domain elements they each possess.

[0143] Multiple participants respectively perform a first combination on the secret sharing of the first sum value and the secret sharing of the second sum value to obtain the secret sharing of the first combined value; respectively perform the first combination on the secret sharing of the k data and the secret sharing of the k random numbers to obtain the secret sharing of the second combined value.

[0144] Any participant reconstructs the first combined value based on the secret sharing of the first combined value owned by each of the multiple participants, and reconstructs the second combined value based on the secret sharing of the second combined value owned by each of the multiple participants. When the result of decoding the first combined value is equal to the second combined value, it is determined that the consistency check has been passed.

[0145] The above system embodiments correspond to the method embodiments, and detailed descriptions can be found in the method embodiment section, which will not be repeated here. The system embodiments and the corresponding method embodiments have the same technical effects, and detailed descriptions can be found in the corresponding method embodiments.

[0146] Figure 5 This is a schematic block diagram of a secret sharing packaging device provided for an embodiment. The device 500 and Figure 2 The method described corresponds to the method executed in any one of the participating parties in the illustrated embodiment. The apparatus 500, deployed in any one of the multiple participating parties, includes the following modules.

[0147] Independent encoding module 510 is configured to encode a vector formed by the secret sharing of k data it owns in a specified domain space to obtain a first domain element; the first domain element has a data structure that satisfies additive homomorphism;

[0148] The joint summation module 520 is configured to perform a secret-shared addition operation based on the first domain elements owned by each party through a first data interaction based on secure multi-party computation with other participants, so that multiple participants respectively obtain: a secret share of the first sum value of the first domain elements owned by each party; the secret share of the first sum value is used as a secret share of the second domain element obtained by encoding the vector composed of the k data in the pointing domain space.

[0149] In one embodiment, a data acquisition module (not shown in the figure) is further included, configured to obtain the secret share of the k data in the following manner: the i-th bit of the secret share of the k data to be processed is determined as the secret share of the k data.

[0150] In one embodiment, the apparatus 500 further includes: a data processing module (not shown in the figure), configured to perform specified operations based on the secret sharing of the second domain elements obtained by each party through a second data interaction based on secure multi-party computation with other parties, so that multiple parties obtain secret sharing operation results respectively;

[0151] The result of decoding the secret sharing operation is equal to the result obtained by multiple participants by performing corresponding operations based on the secret sharing of the i-th bit of the k data to be processed, respectively.

[0152] In one implementation, the joint summation module 520 includes a sharing submodule 521 and a summation submodule 522. The sharing submodule 521 is configured to secretly share its own first domain elements with other participating parties through a first data interaction based on secure multi-party computation, such that each participating party receives a secret share of the first domain elements held by any one of the participating parties. The summation submodule 522 is configured to sum the secret shares of the multiple first domain elements it receives, obtaining a secret share of a first sum value.

[0153] In one embodiment, the device 500 further includes a consistency verification module 530, configured to perform consistency verification with other participants on the secret sharing of the first sum and the k data using k random numbers.

[0154] In one embodiment, the consistency verification module 530 includes: an encoding submodule, a summation submodule, a combination submodule, a reconstruction submodule, and a verification submodule (not shown in the figure).

[0155] The encoding submodule is configured to encode a vector formed by the secret sharing of its own k random numbers in a specified domain space to obtain a third domain element; the third domain element has a data structure that satisfies additive homomorphism.

[0156] The summation submodule is configured to perform a secret-shared addition operation on the third domain elements owned by each party through a first data interaction based on secure multi-party computation with other parties, so that multiple parties obtain: a secret-shared second sum value of the third domain elements owned by each party.

[0157] The combination submodule is configured to perform a first combination on the secret sharing of the first sum value and the secret sharing of the second sum value to obtain the secret sharing of the first combined value; and to perform the first combination on the secret sharing of the k data and the secret sharing of the k random numbers to obtain the secret sharing of the second combined value.

[0158] The reconstruction submodule is configured to reconstruct the first combined value based on the secret sharing of the first combined value owned by each of the multiple participants, and to reconstruct the second combined value based on the secret sharing of the second combined value owned by each of the multiple participants.

[0159] The verification submodule is configured to determine that the consistency check passes when the result of decoding the first combined value is equal to the second combined value.

[0160] The above-described apparatus embodiments correspond to the method embodiments, and detailed descriptions can be found in the description of the method embodiments section, which will not be repeated here. The apparatus embodiments are derived based on the corresponding method embodiments and have the same technical effects as the corresponding method embodiments; detailed descriptions can be found in the corresponding method embodiments.

[0161] This specification also provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform... Figures 1 to 3 Any one of the methods described.

[0162] This specification also provides a computing device, including a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to implement... Figures 1 to 3 Any one of the methods described.

[0163] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for storage media and computing devices are basically similar to the method embodiments, so they are described more simply; relevant parts can be referred to the descriptions of the method embodiments.

[0164] Those skilled in the art will recognize that the functions described in the embodiments of the present invention in one or more of the above examples can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium.

[0165] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, or improvements made based on the technical solutions of the present invention should be included within the scope of protection of the present invention.< / w> < / w> < / z> < / z> < / r> < / x> < / w> < / w> < / q> < / y> < / z> < / z> < / w> < / r> < / x> < / z> < / q> < / y> < / q> < / r1> < / r> < / r> < / r1> < / r> < / r> < / r> < / y> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / y> < / y0> < / y> < / y0> < / y1> < / y0> < / y0> < / y> < / y> < / x1> < / x> < / x> < / x1> < / x> < / x> < / x> < / x> < / x1> < / x> < / x1> < / x1> < / x> < / x1> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x>

Claims

1. A method for secretly sharing packages, executed by multiple participants, including: Multiple participants each share a vector of k data points they possess, which is then encoded in a specified domain space to obtain their respective first domain elements. The first domain elements have a data structure that satisfies additive homomorphism, and an encoding algorithm that satisfies additive homomorphism is used during encoding. Multiple participants engage in a first data interaction based on secure multi-party computation, and perform a secret sharing addition operation based on their respective first domain elements, so that each participant obtains: a secret sharing of the first sum value of the first domain elements they each possess; the secret sharing of the first sum value is used as a secret sharing of the second domain element obtained by encoding the vector composed of the k data in the specified domain space.

2. The method according to claim 1, wherein the secret sharing of k data points of any participant is obtained in the following manner: The i-th bit of the secret sharing of k data to be processed is determined as the secret sharing of the k data.

3. The method according to claim 2, further comprising: Multiple participants perform specified operations through a second data interaction based on secure multi-party computation, based on the secret sharing of the second domain elements they each obtain, so that each participant obtains the secret sharing operation result; The result of decoding the secret sharing operation is equal to the result obtained by each of the multiple participants by performing a corresponding operation based on the secret sharing of the i-th bit of the k data to be processed.

4. The method according to claim 1, wherein the first data interaction comprises: Multiple participants secretly share their respective first domain elements through a first data interaction based on secure multi-party computation, so that each participant obtains: the secret sharing of the first domain elements owned by any one participant; Multiple participants each sum the secret shares of the multiple first-domain elements they have obtained to obtain the secret share of the first sum value.

5. The method according to claim 1, further comprising: Multiple participants, based on the condition that the first sum should be equal to the second field element, and through data interaction based on multi-party secure computation (MPC), use k random numbers to perform consistency verification on the secret sharing of the first sum and the k data; the k random numbers are used to ensure that the privacy data of the first sum and the second field element is not leaked.

6. The method according to claim 5, wherein the consistency verification includes: Multiple participants each share a vector formed by their own k random numbers, which is then encoded in a specified domain space to obtain their own third domain element; the third domain element has a data structure that satisfies additive homomorphism. Multiple participants perform a secret-shared addition operation on the third domain elements they each possess through a first data interaction based on secure multi-party computation, so that each participant obtains: a secret-shared second sum value of the third domain elements they each possess. Multiple participants respectively perform a first combination on the secret sharing of the first sum value and the secret sharing of the second sum value to obtain the secret sharing of the first combined value; respectively perform the first combination on the secret sharing of the k data and the secret sharing of the k random numbers to obtain the secret sharing of the second combined value. Any participant reconstructs the first combined value based on the secret sharing of the first combined value owned by each of the multiple participants, and reconstructs the second combined value based on the secret sharing of the second combined value owned by each of the multiple participants. When the result of decoding the first combined value is equal to the second combined value, it is determined that the consistency check has been passed.

7. The method according to claim 1, wherein the designated field space is a space containing a plurality of m-bit binary field elements, and the encoding includes operations based on multiplication-friendly encoding RMFE.

8. A method for secretly sharing packages, executed by any one of multiple participants, including: Encode the vector formed by the secret sharing of the k data points you possess in the specified domain space to obtain the first domain element; The first field element has a data structure that satisfies additive homomorphism, and an encoding algorithm that satisfies additive homomorphism is used during encoding; Through a first data interaction based on secure multi-party computation with other participants, and a secret sharing addition operation based on the first domain elements owned by each participant, the participants obtain: a secret sharing of the first sum value of the first domain elements owned by each participant; the secret sharing of the first sum value is used as a secret sharing of the second domain element obtained by encoding the vector composed of the k data in the specified domain space.

9. A secret sharing and packaging system, the system comprising multiple participants; Multiple participants encode a vector formed by the secret sharing of their respective k data points in a specified domain space, thereby obtaining their respective first domain elements. The first domain elements have a data structure that satisfies additive homomorphism, and an encoding algorithm that satisfies additive homomorphism is used during encoding. Among multiple participants, a first data interaction based on secure multi-party computation is used to perform a secret sharing addition operation based on the first domain elements owned by each participant, so that each participant obtains: a secret sharing of the first sum value of the first domain elements owned by each participant; the secret sharing of the first sum value is used as a secret sharing of the second domain element obtained by encoding the vector composed of the k data in the specified domain space.

10. A secret-sharing packaging device, deployed in any one of a plurality of participants, comprising: An independent encoding module is configured to encode a vector formed by the secret sharing of its own k data points in a specified domain space to obtain the first domain element; The first field element has a data structure that satisfies additive homomorphism, and an encoding algorithm that satisfies additive homomorphism is used during encoding; The joint summation module is configured to perform a secret-shared addition operation based on the first domain elements owned by each party through a first data interaction based on secure multi-party computation with other participants, so that multiple participants respectively obtain: a secret share of the first sum value of the first domain elements owned by each party; the secret share of the first sum value is used as a secret share of the second domain element obtained by encoding the vector composed of the k data in the specified domain space.

11. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-8.

12. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-8.

Images