Secret sharing fragment conversion method and device

Abstract

The embodiment of the invention discloses a secret sharing fragment conversion method and device. The method is applied to any ith computing party in three computing parties, and comprises the following steps: firstly, obtaining the ith fragment of a target value in a first format, including two of the three fragments of the target value; then, two first random fragments held by the party are correspondingly subtracted from two fragments in the ith fragment, and two of three sub-fragments of a first public fragment are obtained; the two first random fragments and the other first random fragment are distributed in the three calculation parties in a circular pairing manner; then, another sub-fragment of the first public fragment is received from other computing parties, and the first public fragment is restored by using the sub-fragment and the two sub-fragments computed by the computing party; and then, constructing an ith fragment of the target value in a second format, the ith fragment including the first public fragment and the two first random fragments.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to the technical field of privacy computing, and in particular to a secret sharing slice conversion method and device, a computer readable storage medium, and a computing device. BACKGROUND

[0002] Machine learning has been widely applied in computer vision, natural language processing, intelligent decision-making and other fields due to its powerful data processing capability, and has shown important technical value. However, in specific scenarios such as distributed neural network training or collaborative inference, multiple participants need to provide data together. In this case, how to ensure the privacy and security of private data of each participant in the computing process has become a key challenge in the design of a privacy-preserving machine learning (PPML) framework. The secret sharing (SS) protocol can support secure multi-party computation while ensuring the confidentiality of participant data through data fragmentation and reorganization, and therefore has become one of the mainstream implementation schemes of PPML.

[0003] However, the existing SS protocol-based PPML scheme has an inherent contradiction between computing performance and communication efficiency, which is difficult to effectively balance: in computing-intensive tasks, communication delay becomes a performance bottleneck; while in scenarios requiring frequent data exchange, computing resources cannot be fully utilized, resulting in limited overall efficiency of the system. Therefore, there is an urgent need for an improved scheme that can effectively optimize the overall efficiency of computing and communication while ensuring data privacy and security. SUMMARY

[0004] The embodiments of the present specification describe a secret sharing slice conversion method and device that can effectively optimize the overall efficiency of computing and communication under MPC (especially in the PPML scenario) while ensuring data privacy and security.

[0005] According to a first aspect, a method for converting shares of a secret is provided, which is applied to an i-th computing party among any three computing parties. The method comprises: obtaining an i-th share of a target value in a first format, wherein the i-th share comprises two shares of the three shares of the target value; subtracting two first random shares held by the i-th computing party from the i-th share to obtain two sub-shares of a first public share; the two first random shares and another first random share are distributed in the three computing parties in a cyclic pairing manner; receiving another sub-share of the first public share from another computing party, and recovering the first public share by using the other sub-share and the two sub-shares calculated by the i-th computing party. An i-th share of the target value in a second format is constructed, wherein the i-th share comprises the first public share and the two first random shares.

[0006] In one embodiment, after the i-th share of the target value in the second format is constructed, the method further comprises: performing secure multi-party computation for a nonlinear operation with other computing parties based on the i-th share in the second format to obtain an i-th share of an output value of the nonlinear operation in the second format.

[0007] Further, in a specific embodiment, the i-th share of the output value in the second format comprises a second public share and two second random shares. After the i-th share of the output value of the nonlinear operation in the second format is obtained, the method further comprises: converting the i-th share of the output value from the second format to a first format, wherein the converted i-th share comprises two shares of the three shares of the output value; and the three shares comprise any two of the two second random shares and another second random share, and a result share obtained by adding the second public share and another share other than the any two.

[0008] Further, in one example, converting the i-th share of the output value from the second format to the first format comprises: in a case that the i-th computing party is a designated party, using two second random shares held by the i-th computing party as the i-th share of the output value in the first format; and in a case that the i-th computing party is not a designated party, subtracting a second random share held by the i-th computing party and another non-designated party from the second public share to obtain the result share.

[0009] According to a second aspect, a method for converting secret sharing shards is provided, applied to an i-th computing party of any of the three computing parties. The method comprises: obtaining an i-th shard of three shards of a target value. Subtracting one of two first random shards held by the i-th computing party from the i-th shard to obtain one of three sub-shards of a first public shard; the two first random shards and another first random shard are distributed in a cyclic pairing manner among the three computing parties. Receiving the other two sub-shards of the first public shard from the other two computing parties, and restoring the first public shard by using the two sub-shards and the one sub-shard calculated locally. Constructing an i-th shard of the target value in a second format, which comprises the first public shard and the two first random shards.

[0010] In one embodiment, the target value corresponds to a plaintext output of a binary multiplication; wherein obtaining an i-th shard of three shards of a target value comprises: performing a secure multi-party computation for the binary multiplication with the other two computing parties to obtain the i-th shard.

[0011] According to a third aspect, a method for converting secret sharing shards is provided, applied to an i-th computing party of any of the three computing parties. The method comprises: obtaining an i-th shard of a first value in a second format, which comprises a public shard of four shards of the first value and two of other three random shards. Converting the i-th shard of the first value from the second format to a first format, the converted i-th shard comprising two of three shards of the first value, the three shards comprising any two of the three random shards and a result shard obtained by adding the public shard and another shard other than the any two. Performing a secure multi-party computation for a linear operation with the other computing parties based on the i-th shard in the first format to obtain an i-th shard of an output value of the linear operation in the first format.

[0012] In one embodiment, converting the i-th shard of the first value from the second format to the first format comprises: in a case that the i-th computing party is a designated party, using the two of the three random shards held by the i-th computing party as the converted i-th shard; in a case that the i-th computing party is not a designated party, subtracting a random shard held by the i-th computing party and another non-designated party from the public shard to obtain the result shard.

[0013] According to a fourth aspect, there is provided a conversion device for secret sharing shards, integrated in an i-th computing party of any of the three computing parties. The device comprises: an original shard obtaining module configured to obtain an i-th shard of a target value in a first format, wherein the i-th shard comprises two of the three shards of the target value; a shard calculating module configured to subtract two first random shards held by the i-th computing party from the two of the i-th shard to obtain two of three sub-shards of a first public shard; the two first random shards and another first random shard are distributed in the three computing parties in a cyclic pairing manner; a sub-shard receiving module configured to receive another sub-shard of the first public shard from the other computing parties; a public shard restoring module configured to restore the first public shard by using the other sub-shard and the two sub-shards calculated by the i-th computing party; and a new shard constructing module configured to construct an i-th shard of the target value in a second format, wherein the i-th shard comprises the first public shard and the two first random shards.

[0014] According to a fifth aspect, there is provided a conversion device for secret sharing shards, integrated in an i-th computing party of any of the three computing parties. The device comprises: an original shard obtaining module configured to obtain an i-th shard of the three shards of the target value; a shard calculating module configured to subtract one of two first random shards held by the i-th computing party from the i-th shard to obtain one of three sub-shards of a first public shard; the two first random shards and another first random shard are distributed in the three computing parties in a cyclic pairing manner; a sub-shard receiving module configured to receive other two sub-shards of the first public shard from the other two computing parties; a public shard restoring module configured to restore the first public shard by using the two sub-shards and the one sub-shard calculated by the i-th computing party; and a new shard constructing module configured to construct an i-th shard of the target value in a second format, wherein the i-th shard comprises the first public shard and the two first random shards.

[0015] According to a sixth aspect, there is provided a conversion device for secret sharing shards, integrated in an i-th computing party of any of the three computing parties. The device comprises: an original shard obtaining module configured to obtain an i-th shard of a first value in a second format, wherein the i-th shard comprises a public shard of four shards of the first value, and two of the other three random shards. A shard format conversion module configured to convert the i-th shard of the first value from the second format to a first format, wherein the converted i-th shard comprises two of three shards of the first value, the three shards comprising any two of the three random shards, and a result shard obtained by adding the public shard to another one of the three random shards other than the any two. An MPC computing module configured to perform secure multi-party computation for a linear operation based on the i-th shard in the first format, and other computing parties, to obtain an i-th shard of an output value of the linear operation in the first format.

[0016] According to a seventh aspect, there is provided a computer-readable storage medium having stored thereon a computer program, which, when executed in a computer, causes the computer to perform the method according to the first aspect or the second aspect or the third aspect.

[0017] According to an eighth aspect, there is provided a computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to implement the method according to the first aspect or the second aspect or the third aspect.

[0018] In summary, the above-mentioned secret sharing shard conversion method and device disclosed by the embodiments of the present specification can effectively optimize the overall efficiency of computation and communication under the premise of ensuring data privacy and security, and are particularly suitable for scenarios of privacy-preserving machine learning based on secret sharing. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0020] Figure 1 One of the communication interaction diagrams for implementing format conversion of secret sharing shards disclosed by the embodiments of the present specification;

[0021] Figure 2 One of the communication interaction diagrams for implementing format conversion of secret sharing shards disclosed by the embodiments of the present specification;

[0022] Figure 3A method flow chart for realizing format conversion of secret sharing fragments is disclosed for the embodiments of the present specification.

[0023] Figure 4 A functional structure diagram of a secret sharing fragment conversion device is disclosed for the embodiments of the present specification.

[0024] Figure 5 A functional structure diagram of a secret sharing fragment conversion device is disclosed for the embodiments of the present specification.

[0025] Figure 6 A functional structure diagram of a secret sharing fragment conversion device is disclosed for the embodiments of the present specification. DETAILED DESCRIPTION

[0026] Next, the scheme provided by the present specification is described in combination with the accompanying drawings.

[0027] As described above, the scheme for realizing privacy-preserving machine learning (PPML) based on the existing secret sharing (SS) protocol has inherent contradictions between computing performance and communication efficiency, which is difficult to effectively balance. To help understand, the related basic concepts of SS and PPML are first introduced, and then the invention concept and specific implementation of the improved scheme disclosed by the embodiments of the present specification are introduced.

[0028] Note that the symbol system used herein is summarized in Table 1 below, where R-sharing and M-sharing are two different SS protocols, and the formats of SS fragments are different under different protocols, which will be described in more detail later.

[0029] Table 1

[0030]

[0031] 1. Basic concepts of secret sharing (SS)

[0032] SS technology has now become a core basic component of secure multi-party computation (MPC). This technology divides sensitive data (or private data) into multiple shares and distributes them to different participants, so that each party can perform calculations based on its own share, and finally reconstruct the calculation result in collaboration, without revealing any individual information throughout the process.

[0033] Next, taking the R-sharing secret sharing protocol as an example, the working mechanism of SS is described. Let the modulus be m, and assume that three participants need to securely compute the product of two secret inputs x and y The process is as follows:

[0034] 1) Secret sharing phase

[0035] 1) Data splitting: x is split into 3 random values, satisfying x≡(x1+x2+x3) mod m. For brevity, the modulus operator is omitted in subsequent expressions, i.e., mod m. Similarly, y is split into y1, y2, y3, satisfying y≡y1+y2+y3.

[0036] 2) Sharding distribution: Each party holds a different pair of shards, P1 holds (x1, x2) and (y1, y2), P2 holds (x2, x3) and (y2, y3), P3 holds (x3, x1) and (y3, y1).

[0037] 2) Secure product computation

[0038] 1) Local computation: Each party computes local product shards z i 1 i 2 i 3 i 4 i 5 i+1 6 i+ 7 using the shard pair it holds. i Note: All operations are implied modulo m.

[0039] 2) Result reconstruction: Finally, the target product z of the secret values x and y can be obtained by aggregating the results from each party, i.e., z = z1+z2+z3.

[0040] Observation: R-sharing secret sharing protocol supports secure computation of the product of two secret values without revealing either secret value.

[0041] If z is needed for subsequent calculations, each party needs to redistribute the values it holds to meet the cyclic pairing format defined by R-sharing. Specifically, P1 obtains z2 from P2 to construct the shard pair (z1, z2), similarly, P2 constructs the shard pair (z2, z3), and P3 constructs the shard pair (z3, z1).

[0042] Secret sharing (SS) technology can ensure the privacy of the calculation process through information exchange between participants, but it inevitably introduces significant computational and communication overhead.

[0043] When n-Mult (where n > 2) needs to be calculated in the form of SS shards, R-sharing protocol uses a hierarchical 2-Mult architecture, which requires rounds of online communication. To reduce communication overhead, the industry proposes a new SS scheme - M-sharing. Compared with R-sharing, M-sharing reduces the communication rounds of n-Mult from rounds to 1 round by proposing a new shard representation.

[0044] Specifically, under the M-sharing protocol, the secret value x is split into 4 shares, denoted as m x , r1, r2 and r3, and m x = x - r1 - r2 - r3 = x - r, m x are random numbers shared by all participants. P1 holds (m x , r1, r2), P2 holds (m x , r2, r3), and P3 holds (m x , r3, r1).

[0045] For the basic 2-Mult (binary multiplication) operation, the number of communication rounds required by M-sharing is the same as R-sharing. To compute <z> ＝ <xy>All participants need to collaborate to calculate the new common value m. z Its definition is:

[0046] m z =zr z =xy-r z =(m x +r x (m) y +r y )-r z

[0047] =m x m y +m x r y +m y r x +r x r y -r z (1)

[0048] Each participant calculates m z After being fragmented, the value m is provided to other participants, who can then collaboratively reconstruct a new public value m. z Because r x r y and r z It is pre-generated, and the above process can be completed with only a single round of communication.

[0049] In n-Mult (multivariate or multi-input multiplication) operations, M-sharing maintains the characteristics of single-round communication by extending the above process. Given That is, n inputs x1......x n The product of, publicly available value m z The calculation formula is as follows:

[0050]

[0051] Each participant calculates m locally. z The fragments are then provided to other participants to enable reconstruction of m. z .in Independent of the input data, it can be pre-computed. Therefore, regardless of the specific value of n (>2), n-Mult only requires a single round of communication, which can significantly improve communication efficiency.

[0052] The above introduces the basics of Secret Sharing (SS). Next, we will introduce the basic framework of PPML.

[0053] 2. Basic Framework of Privacy-Preserving Machine Learning (PPML)

[0054] First, we introduce the basic components of neural networks, and then we introduce the core design ideas of typical PPML frameworks.

[0055] Neural networks are composed of linear operations and nonlinear operations, which play a key role in data processing and feature transformation. Typical network layers that perform linear operations include fully connected layers and convolutional layers. In fully connected layers, global connections between inputs and outputs are achieved through weight matrices and bias vectors, which are used to capture overall patterns in data. In convolutional layers, only local feature extraction is required through convolution kernels on input data, reducing data complexity.

[0056] Nonlinear operations are essential for modeling complex functions in neural networks. Activation functions and pooling operations are typical representatives of nonlinear operations. Activation functions, such as Rectified Linear Unit (ReLU), Sigmoid, and Tanh, introduce nonlinearity through element-wise transformations. For example, ReLU is defined as ReLU(x) = max(0, x). Pooling operations, including max pooling and average pooling, further increase nonlinearity by downsampling inputs, which helps to control network complexity and prevent overfitting while reducing dimensions.

[0057] The main goal of the PPML framework is to perform secure and efficient computation on distributed data while maintaining the confidentiality of sensitive information. To achieve this goal, MPC has become one of the common methods for implementing PPML. MPC involves a variety of key technologies, including garbled circuits, homomorphic encryption, oblivious transfer, and secret sharing, each of which provides different advantages for secure computation.

[0058] Among these technologies, SS has become particularly prominent in PPML due to its lower computational complexity and relative simplicity. SS-based PPML frameworks build basic operations based on SS, enabling efficient and secure computation. For example, some representative frameworks encode floating-point weights and inputs into fixed-point representations to meet the bit-width limitations of SS protocols. These frameworks gradually build neural network operations from bottom-up primitives, ensuring that the input and output of each layer remain in SS format. This design allows flexible combination of network layers while protecting the confidentiality of intermediate calculations. By following this structure, SS-based PPML frameworks address key privacy issues in machine learning applications, ensuring the security of model parameters and user inputs while supporting scalable and efficient secure deployment.

[0059] The above introduces the basic knowledge of SS, and the basic idea of designing the PPML framework based on SS. Next, the invention idea of the improvement scheme is introduced.

[0060] 3. Invention idea of improvement scheme

[0061] In the design of the PPML framework, a major challenge lies in effectively controlling the balance between computational overhead and communication overhead. Linear operations (such as secure multiplication) require less communication, while nonlinear layers (such as activation functions) often require multiple communication rounds to ensure data privacy. In actual deployment, participants are often distributed among data centers that are geographically remote, which introduces significant network latency. This latency exacerbates communication overhead, especially in nonlinear operations, thus becoming a fundamental bottleneck to system efficiency.

[0062] Table 2

[0063]

[0064] As shown in Table 2, there are significant differences in the communication round requirements between R-sharing and M-sharing for different operations. In linear operations (such as summation and 2-MULT), the two protocols show similar performance, but due to the shorter data bit width of R-sharing, it can achieve more efficient local computation, so its speed is slightly faster. This makes R-sharing particularly suitable for linear operations.

[0065] For nonlinear operations such as ReLU, communication overhead becomes a key bottleneck. Nonlinear operations often involve n-Mult, which requires a large amount of communication. In this case, M-sharing shows a clear advantage, as previously mentioned, it reduces the communication rounds required for n-MULT to only one round. This reduction in communication rounds enables M-sharing to achieve higher efficiency in nonlinear operations.

[0066] Based on the above observations and analysis, an improvement scheme is proposed, which fully utilizes the advantages of R-sharing and M-sharing by mixing the use of protocols. Specifically, by switching between protocols according to the type of operation - using the R-sharing protocol in linear operations and the M-sharing protocol in nonlinear operations - the balance between computation and communication can be achieved while maintaining system security standards. To achieve this, two new conversion protocols, ∏ toCMF and ∏ fromCMF are proposed to handle protocol switching, where CMF in the subscript refers to Co-Prime Framework, which can be translated as Hybrid Protocol Framework.

[0067] 4. Overview of improvement scheme

[0068] The improvement scheme proposes a three-party computation (3-PC) framework based on secret sharing (SS), which is particularly suitable for secure neural network inference. The framework operates under a semi-honest attack model, which assumes that all computing parties (or simply, parties) will follow the protocol flow, but may attempt to infer additional information from the received data.

[0069] In the context of secure neural network inference:

[0070] 1) The following roles are defined: model owner, client, and three computing parties. The model owner holds the weights and structure of the neural network, while the client provides private input data. During secure inference, the parties receive secret shared weights and inputs, perform secure computation, and send the final result to the client. Throughout the computation process, all data is handled in secret sharing form, ensuring that no sensitive information is exposed. Note that the model owner and client can also serve as one of the computing parties.

[0071] 2) The R-sharing protocol is mainly used as the input / output format for secure computation. For communication-intensive nonlinear operations, the M-sharing protocol is switched through ∏ toCMF , and then for computation-intensive linear operations, the R-sharing protocol can be switched back through ∏ fromCMF .

[0072] ∏ toCMF and ∏ fromCMF are lightweight protocols for implementing SS protocol switching, which will be introduced below.

[0073] 5) The ∏ toCMF

[0074] ∏ toCMF protocol is used to implement lightweight switching of the shard format from R-sharing to M-sharing. Figure 1 The execution of the ∏ toCMF protocol involves the following three-party communication interaction process, where the three parties are P1, P2, and P3. It should be understood that P i herein refers to any ith computing party, and each computing party can be implemented as any device, platform, server, or device cluster with computing and processing capabilities.

[0075] Figure 1 The communication interaction process shown includes the following steps:

[0076] Step S11, P i The i-th share of the target value in the first format is obtained, which includes two of the three shares of the target value.

[0077] It should be understood that the target value x belongs to a private value, and the first format refers to a share format under an R-sharing protocol. In addition, "first" in "first format" and "second", "third", and the like in other places in the text are used to distinguish the same things and do not have other limitations such as ordering.

[0078] The above three shares (denoted as x1, x2, x3) are constituent shares of the target value x, and the target value can be restored only when the three shares are simultaneously held, that is, x = x1 + x2 + x3.

[0079] The three shares are distributed in the three computing parties P i The i-th R-sharing share obtained by the computing party can be denoted as And It should be noted that in this paper, when i = 3, considering the cycle between 1, 2, and 3, the value of i+1 is 1.

[0080] In one embodiment, the computing party P i The computing party obtains the For example, in the secure neural network inference scenario, the target value can be a model weight, and the computing party P i The computing party receives the Alternatively, the target value can also be a model input, and the computing party P i The computing party receives the

[0081] In another embodiment, the target value can be a plaintext result corresponding to an MPC calculation (such as secure addition or secure multiplication), and accordingly, the computing party P i The computing party obtains the

[0082] Accordingly, the computing party P i The computing party can obtain the i-th R-sharing share of the target value x Specifically, Figure 1 In the figure, P1, P2, and P3 correspondingly obtain (x1, x2), (x2, x3), and (x3, x1).

[0083] Step S12, the computing party P i The party uses two of the i-th partitions to subtract the two first random partitions held by itself to obtain two of the three sub-parts of the first public partition; the two first random partitions and the other first random partition are distributed among the three computing parties in a cyclic pairing.

[0084] It should be understood that the three first random partitions mentioned above can be prepared in advance. For example, P i Fang can generate a random number locally, which will be used as the i-th first random partition r. i And from P i+1 Fang receives the (i+1)th first random fragment r i+1 Therefore, P i Fang holds two first random partitions r i and r i+1 .

[0085] In this step, P i The square can calculate m i =x i -r i , and m i+1 =x i+1 -r i+1 , where m i and m i+1 The corresponding representation is the first public fragment m. x The i-th and i+1-th sub-segments.

[0086] From the above, P i The first public fragment m can be calculated. x Two sub-parts m i and m i+1 . Specifically, Figure 1 The diagram illustrates that P1, P2, and P3 are used to calculate (m1, m2), (m2, m3), and (m3, m1) respectively.

[0087] Step S13, P i Fang receives the first public fragment m from other computing parties. x Another sub-segment m i-1 It should be noted that in this paper, when i = 1, considering the cycle between 1, 2, and 3, the value of i-1 is 3.

[0088] Specifically, Figure 1 The diagram illustrates that P1 receives m3 from P3, P2 receives m1 from P1, and P3 receives m2 from P2. It should be understood that the method of sending and receiving fragments is not uniquely limited, as long as the first publicly disclosed fragment m... x All three sub-segments were P i Once you obtain it, that's all you need.

[0089] Step S14, P i The party uses the received sub-shares and the two sub-shares calculated by the party to restore the first public share. Specifically, P i The party can calculate: m x = m i + m i+1 + m i-1 It can be understood that the essence of the local calculation of P1, P2 and P3 is m x = m1+m2+m3.

[0090] Step S15, P i The party constructs the i-th share of the target value in the second format, which includes the first public share and the two first random shares.

[0091] It should be understood that the second format refers to the share format under the M-sharing protocol. P i The i-th M-sharing share constructed by the party for the target value x can be denoted as <x> i , and <x> i = (m x , r i , r i+1 ). It can be understood that m x + r1+ r2+ r3= (m1+ m2+ m3)+ r1+ r2+ r3= (x1- r1+ x2- r2+ x3- r3)+ r1+ r2+ r3= x.

[0092] From the above, P i can obtain the i-th M-sharing fragment after format conversion for the target value x <x> i =(m x ,r i ,r i+1 ). Specifically, Figure 1 The diagram illustrates the construction of (m) corresponding to P1, P2, and P3. x ,r1,r2),(m x (r2,r3) and (m x ,r3,r1).

[0093] The above combination Figure 1 The improved scheme proposes the ∏ toCMF The protocol enables a lightweight switching of the sharding format from R-sharing to M-sharing, requiring only a small amount of local computation and one round of communication.

[0094] Note that, Figure 1 In the middle, ∏ toCMF The input format of the protocol is The applicant suggested that it could also be This design is in ∏ 2-MULT Then execute ∏ toCMF This is particularly suitable for scenarios where local fragment reconstruction can be performed in conjunction with ∏. toCMF Integration reduces communication rounds. It's important to understand that for ∏... 2-MULT See the preceding introduction to MPC computation for binary multiplication under the R-sharing protocol.

[0095] For ∏ toCMF The input format of the protocol is For details, please refer to Figure 2 It demonstrates the following interactive steps:

[0096] Step S21, P i Fang obtains the i-th slice among the three slices of the target value.

[0097] It should be noted that for the description of the target value and its three segments in this step, please refer to the relevant introduction in the aforementioned embodiment for step S11, which will not be repeated here.

[0098] From the above, P i This allows obtaining the i-th slice x of the target value x. i . Specifically, Figure 2 The diagram shows that P1, P2, and P3 obtain x1, x2, and x3 respectively.

[0099] Step S22, P i The party subtracts one of the two first random partitions held by itself from the i-th partition to obtain one of the three sub-parts of the first public partition; the two first random partitions and the other first random partition are distributed among the three computing parties in a cyclic pairing.

[0100] It needs to be understood that P i Fang can pre-store two first random partitions r i and r i+1 For a description of the first random partition mentioned in this step, please refer to the foregoing embodiments.

[0101] In this step, P i Fang can utilize the i-th slice x i Subtract the i-th first random segment r i To obtain the i-th sub-fragment m among the three sub-fragments of the first public fragment. i This can be written as m i =x i -r i . Specifically, Figure 2 The diagram illustrates how P1, P2, and P3 are used to calculate m1, m2, and m3 respectively.

[0102] Step S23, P i Fang receives the other two sub-fragments of the first public fragment from the other two computing parties.

[0103] Specifically, P i Fang Cong P i+1 Fang receives the first publicly disclosed fragment m x The (i+1)th sub-segment m i+1 From P i-1 Fang receives the first publicly disclosed fragment m x The (i-1)th sub-segment m i-1 See also Figure 2 This illustrates that P1 receives m2 and m3, P2 receives m1 and m2, and P3 receives m3 and m1.

[0104] Step S24, P i Fang uses the two received sub-segments and one locally calculated sub-segment to reconstruct the first public segment. Specifically, P i The square can be calculated as: m x =m i +m i+1 +m i-1 It can be understood that the actual calculations of P1, P2, and P3 locally are all m. x =m1+m2+m3.

[0105] Step S25, P i The method further includes constructing the i-th shard of the target value in the second format, wherein the i-th shard includes the first public shard and the two first random shards.

[0106] It is to be understood that the description of this step can be found in the foregoing description of step S15.

[0107] From the above, P i The method further includes constructing the i-th shard of the target value in the second format, wherein the i-th shard includes the first public shard and the two first random shards. <x> i =(m x ,r i ,r i+1 ). Figure 2 The diagram illustrates the construction of (m) corresponding to P1, P2, and P3. x ,r1,r2),(m x (r2,r3) and (m x ,r3,r1).

[0108] It needs to be understood that in P i After converting the i-th fragment of the target value x from R-sharing to M-sharing, MPC calculations for nonlinear operations can be performed based on the converted fragments, thereby accelerating communication efficiency. It can be understood that the output fragments of this MPC calculation are still in M-sharing format.

[0109] To aid understanding, Algorithm 1 is shown below, which gives the π / 2... toCMF The pseudocode for the protocol.

[0110]

[0111] ∏ toCMF The protocol is used to convert SS fragments from R-sharing format to M-sharing format, a conversion that requires only one round of communication online. During the pre-configuration (or pre-processing) phase, the computer generates and stores random fragments. This is used to mask the fragments of the input data. The participants use random fragmentation to obtain (x1-r1, x2-r2), (x2-r2, x3-r3), and (x3-r3, x1-r1). Then, P... i Fang Jiang m i =x i -r i Send to P i-1 Therefore, all participating parties can calculate m. x =xr.

[0112] ∏ toCMF The protocol can also receive a single fragment x i As input. In this case, each participant P i m i Simultaneously provided to P i-1 and P i+1 The communication rounds are maintained at one round. This approach is particularly suitable for executing ∏. 2-MULT Then execute ∏ toCMF In this scenario, because the local sharding reconstruction process can be synchronized with ∏ toCMF Integration reduces communication rounds.

[0113] Next, let's discuss ∏ toCMF The security of the protocol can be defined by the following Lemma 1.

[0114] Lemma 1: For any i, P i Fang is executing ∏ toCMF The secret value x cannot be recovered during the protocol process.

[0115] The proof of Lemma 1 is as follows:

[0116] If the protocol input is in the form of Then P i Fang holds m i =x i -r i m i+1 =x i+1 -r i+1 and receive m i-1 =x i-1 -r i-1 Adding these three together gives us m. x During the addition process, the plaintext x will not be leaked.

[0117] If the protocol input is in the form of x i Then P i Fang holds m i =x i -r i and receive m i+1 =x i+1 -r i+1 and m i-1 =x i-1 -r i-1 Similar to the previous case, the plaintext x will not be leaked when these three are added together.

[0118] The above introduction introduces the ∏ proposed in the improvement plan. toCMF Next, we will introduce ∏ fromCMF .

[0119] 6. The ∏ proposed in the improvement plan fromCMF

[0120] ∏ fromCMF Used to implement a lightweight switching of the sharding format from M-sharing to R-sharing. Figure 3 Showing ∏ fromCMF The execution of the protocol involves a method flow, and the executing entity of this method is any one of the three computation parties P1, P2, and P3. i And P i It can be implemented for any device, platform, server, or equipment cluster with computing and processing capabilities.

[0121] Figure 3 The method flow shown includes the following steps:

[0122] Step S31, P i The i-th M-sharing shard of the first value in the second format is obtained, which includes the public shard of the four shards containing the first value and two of the three random shards.

[0123] It should be understood that the following multiplexing mathematical symbols x, r and m x The first value x belongs to the private value, and the second format refers to the shard format under the M-sharing protocol. The above four shards (denoted as m x , r1, r2 and r3) are the constituent shards of the first value x, and only when all four shards are simultaneously held can the first value be restored, that is, x = m x +r1+r2+r3.

[0124] The public shard m x is shared by the three computing parties, and the three random shards r1, r2 and r3 are distributed in the three computing parties in the form of cyclic pairing, P i The i-th M-sharing shard obtained by the P <x> i , and <x> i = (m x , r i , r i+1 ).

[0125] In one embodiment, the P i from the data party holding the first numerical value <x> i In another embodiment, <x> i may be P i The output obtained by the computing party and other computing parties through MPC calculation.

[0126] From the above, P i The computing party can obtain the i-th share of the first value x <x> i = (m x i = (m i+1 x = (m x x = (m

[0127] In step S32, the P i party converts the i-th share of the first value from the second format to the first format, and the converted i-th share of the first value comprises two of the three shares of the first value, the three shares comprising any two of the three random shares and a result share obtained by adding the public share to the other one of the three shares.

[0128] It should be understood that the first format refers to the format of the shares under the R-sharing protocol. For the sake of clarity, the following description will mainly take any two of the three random shares, r2 and r3, as an example. The above three shares (denoted as m x +r1, r2, r3) are the constituent shares of the first value x, and the first value x can be restored only when the three shares are simultaneously possessed, i.e., x = (m x +r1) + r2 + r3. The three shares are distributed in the three computing parties in a cyclic pairing manner.

[0129] For the implementation of this step, in one implementation, the P i party is the designated party, and at this time, the P i party can directly use the two random shares r i i+1 as the converted i-th R-sharing share For example,

[0130] In another implementation, the P i party is not the designated party, and at this time, the P i party can use the public share m x and the random share held in common with another non-designated party to obtain the above-mentioned result share, and use the result share and the random share not possessed in common with the other non-designated party as the converted i-th R-sharing share. For example, Or,

[0131] Accordingly, the P i party can obtain the converted i-th R-sharing share ​​​​For example, P1, P2, and P3 respectively obtain (m x +r1,r2), (r2,r3) and (m x +r1,r3).

[0132] The above introduction introduces the ∏ proposed in the improvement plan. fromCMF The protocol enables lightweight switching of the sharding format from M-sharing to R-sharing, requiring only a small amount of local computation and no communication.

[0133] It should be noted that after performing step S32 above, the method may further include: step S33, P i The first fragment is based on the first value in the first format. By collaborating with other computational parties to perform secure multi-party computation on the linear operation, the i-th slice of the output value of the linear operation in the first format is obtained. This effectively improves the efficiency of the linear operation.

[0134] For example, linear operations may include linear transformations in fully connected layers, convolution operations in convolutional layers, matrix multiplication, weighted summation, and so on.

[0135] Next, let's discuss ∏ fromCMF The security of the protocol can be defined by the following Lemma 2.

[0136] Lemma 2: For any i, P i Fang is executing ∏ fromCMF x cannot be recovered during the protocol process.

[0137] The proof of Lemma 2 is as follows: In ∏ fromCMF The protocol eliminates the need for communication. As long as the M-sharing fragments before conversion are secure, no participant can recover plaintext x using only the fragments they hold without collusion.

[0138] The above introduction introduces the ∏ proposed in the improvement plan. fromCMF It should be noted that, in the above discussion of ∏... toCMF and ∏ fromCMF The introduction primarily focuses on Privacy-Preserving Machine Learning (PPML) scenarios. However, the application of these two transformation protocols is not limited to PPML; they can be used as needed in other MPC computation scenarios involving linear and nonlinear operations. In practical applications, π can be used independently. toCMF or ∏ fromCMF They can also be used in combination.

[0139] Next, let's introduce ∏ toCMF Its application in safe nonlinear operations, specifically, introduces the application based on π. toCMF Grouped Computation and Multiplication protocol GCM , and Enhanced Private Compare protocol GCM EPC , where the subscript GCM stands for Grouped Computation and Multiplication, and EPC stands for Enhanced Private Compare.

[0140] 7. The improved Grouped Computation and Multiplication protocol toCMF GCM

[0141] The improved Grouped Computation and Multiplication protocol GCM is proposed to efficiently handle multiplication of n inputs (in SS form) on FPGA. As shown in Algorithm 2, the improved GCM protocol b-MULT (see the aforementioned introduction of the basic knowledge of multi-input multiplication based on M-sharing sharding) is used as the basic multiplication unit to process the input data, where b is a configurable parameter representing the group size in GCM . The improved GCM protocol can reduce the communication rounds required for multi-input multiplication in nonlinear operations and form a natural pipeline structure that can achieve high parallelization on FPGA.

[0142]

[0143] In the preprocessing phase, participants calculate input-independent random shards according to the description of formula (2). In the online phase, the data shards are converted in format by applying the improved toCMF protocol. To ensure that the length n of the input array is a power of b and can be divided by b iteratively until it equals 1, a padding element <1> is added at the end of the input data. The padding element <1> does not change the final calculation result, but is crucial for maintaining an efficient pipeline structure on FPGA.

[0144] The improved GCM protocol divides the data shards of n inputs into n / b groups, each containing b input data shards. The improved b-MULT protocol is applied to each group to generate a new set of data shards. This process is repeated iteratively until only one data shard <x0>Finally, execute ∏ fromCMF The protocol converts data shares back to R-sharing format. This computational model is highly compatible with pipeline architectures, capable of generating multiplication modules based on the number of iterations, thereby improving π / 4... GCM The computational efficiency of the protocol.

[0145] Regarding communication overhead, ∏ GCM The agreement requires Round-robin communication. The choice of parameter b affects the number of communication rounds and computational overhead. As b increases, the number of random fragment sets in the preprocessing stage and the computational overhead of each execution... b-MULT The required local computation also increases. Therefore, parameter b plays a balancing role between communication and computation, allowing users to fine-tune the cumulative multiplication process according to specific application needs and hardware capabilities.

[0146] ∏ GCM The security of this protocol is defined by the following Lemma 3.

[0147] Lemma 3: For any i, if Lemmas 1 and 2 hold, P i Fang Zai∏ GCM The secret value x cannot be recovered from the protocol.

[0148] The proof of Lemma 3 is as follows: In ∏ GCM In the agreement, besides ∏ toCMF There is no other communication. According to Lemma 2, ∏ fromCMF It is safe. Therefore, as long as ∏ toCMF It is safe, P i Fang cannot recover x by manipulating his own fragment alone (in the absence of collusion).

[0149] As can be seen from the above, the grouped cumulative multiplication calculation protocol is ∏ GCM It is safe. Next, we will introduce the π-based... GCM Further design of privacy comparison protocol ∏ EPC .

[0150] 8. The improved scheme proposes a system based on π. GCM Privacy comparison protocol design ∏ EPC

[0151] Traditional privacy comparison schemes involve numerous multi-input multiplication operations, significantly increasing communication overhead, i.e., requiring... Round-robin communication, where l represents the bit width of the secret shared fragment. In the improved scheme, M-sharing and π are introduced. GCM An enhanced privacy comparison protocol was designed. EPC Reduce the number of communication rounds to The following algorithm shows 3 pairs of π EPC A detailed description is made.

[0152]

[0153] In Π EPC , the prover holds the SS shares of a number β in the number field and a public value r, both of which have bit-width l. and represent the SS shares of a random bit β in the fields and respectively. is the SS share of a random number m in the field is the SS share of a random number m in the field

[0154] In Algorithm 3, the first 5 lines perform the initial data processing. The multiplication operation in line 2 requires one round of communication, while the subsequent XOR and addition operations are local operations that can be computed directly by the prover without communication.

[0155] In line 6, each prover computes the share denoted as e locally. After introducing the mask m, the input of Π GCM becomes an odd number, so data padding is needed. By pre-computing e, the number of inputs of Π GCM can be ensured to be even, which facilitates the implementation of the pipeline structure of FPGA. In general multiplication operations, the prover usually needs to exchange local shares to obtain the final result. However, since Π toCMF protocol will be applied next, the prover can directly use the local share e as input, thus skipping the communication step.

[0156] In line 7, each prover uses e and the held c[i] to perform Π GCM protocol to obtain <d>Since d needs to be made public, in ∏ GCM In the final multiplication operation, each participant sends all its local fragments to the other participants, that is, simultaneously sends its information about m. d and r d Local sharding. Each participant can then directly reconstruct d, thus eliminating the need to execute ∏. toCMF Protocol. The number of communication rounds required for the entire process is: Lines 8 and 9 calculate the bit fragments of the comparison results, which can be done locally.

[0157] From the above, ∏ EPC Total required Round-robin communication. Through integration of π GCM Agreement, ∏ EPC It became a hardware-friendly protocol. By adjusting the packet size b, ∏ EPC It provides an efficient and flexible solution for privacy comparison tasks.

[0158] ∏ EPC The security of the protocol is defined by the following Lemma 4.

[0159] Lemma 4: For any i, if Lemma 3 holds, P i Fang Zai∏ EPC The secret value x cannot be recovered from the protocol.

[0160] The proof of Lemma 4 is as follows: In ∏ EPC In the agreement, besides executing ∏ GCM There is no other communication besides that. Therefore, as long as ∏ GCM It is safe, and the computing party cannot recover x by manipulating its own fragment alone (in the absence of collusion).

[0161] The above introduces ∏ toCMF Its application in nonlinear operations is specifically introduced based on π. toCMF Design of a grouped cumulative multiplication protocol ∏ GCM and further based on ∏ GCM Privacy comparison protocol design ∏ EPC The two newly designed protocols can effectively reduce the number of communication rounds and achieve hardware friendliness.

[0162] In summary, the method for converting secret-shared fragments disclosed in the embodiments of this specification, such as ∏ toCMF or ∏ fromCMF The protocol can effectively optimize the overall efficiency of computing and communication while ensuring data privacy and security, and is particularly suitable for privacy-preserving machine learning (PPML) scenarios.

[0163] Corresponding to the conversion method of the secret sharing shards described above, the embodiments of the present disclosure further disclose a conversion device. Specifically as follows:

[0164] Figure 4 The conversion device 400 of the secret sharing shards is shown, which is integrated into the i-th computing party of any of the three computing parties, and includes the following functional modules:

[0165] The original shard acquisition module 410 is configured to acquire the i-th shard of the target value in the first format, which includes two of the three shards of the target value. The shard calculation module 420 is configured to subtract two first random shards held by the party from the two shards in the i-th shard to obtain two of the three sub-shards of the first public shard; the two first random shards and another first random shard are distributed in the three computing parties in the form of cyclic pairing. The sub-shard receiving module 430 is configured to receive another sub-shard of the first public shard from other computing parties. The public shard restoration module 440 is configured to restore the first public shard together with the two sub-shards calculated by the party. The new shard construction module 450 is configured to construct the i-th shard of the target value in the second format, which includes the first public shard and the two first random shards.

[0166] Figure 5 The conversion device 500 of the secret sharing shards is shown, which is integrated into the i-th computing party of any of the three computing parties, and includes the following functional modules:

[0167] The original shard acquisition module 510 is configured to acquire the i-th shard of the three shards of the target value. The shard calculation module 520 is configured to subtract one of the two first random shards held by the party from the i-th shard to obtain one of the three sub-shards of the first public shard; the two first random shards and another first random shard are distributed in the three computing parties in the form of cyclic pairing. The sub-shard receiving module 530 is configured to correspondingly receive the other two sub-shards of the first public shard from the other two computing parties. The public shard restoration module 540 is configured to restore the first public shard together with the two sub-shards calculated by the party. The new shard construction module 550 is configured to construct the i-th shard of the target value in the second format, which includes the first public shard and the two first random shards.

[0168] Figure 6 The conversion device 600 of the secret sharing shards is shown, which is integrated into the i-th computing party of any of the three computing parties, and includes the following functional modules:

[0169] The original fragment obtaining module 610 is configured to obtain the ith fragment of the first value in a second format, wherein the first value includes a public fragment of four fragments of the first value and two of the other three random fragments. The fragment format conversion module 620 is configured to convert the ith fragment of the first value from the second format to a first format, and the converted ith fragment of the first value includes two of three fragments of the first value, the three fragments including any two of the three random fragments and a result fragment obtained by adding the public fragment to another fragment other than the any two. The MPC calculation module 630 is configured to perform, based on the ith fragment of the first value, secure multi-party computation for a linear operation with other calculation parties to obtain an ith fragment of an output value of the linear operation in the first format.

[0170] It should be noted that the above-described functional units can also be understood in conjunction with the above-described flow methods.

[0171] According to another aspect, embodiments further provide a computer-readable storage medium having stored thereon a computer program, which, when executed in a computer, causes the computer to perform the above-described method. Figure 1 or Figure 2 or Figure 3 described method.

[0172] According to another aspect, embodiments further provide a computer-readable storage medium having stored thereon a computer program, which, when executed in a computer, causes the computer to perform the above-described method. Figure 1 or Figure 2 or Figure 3 described method.

[0173] Those skilled in the art should be aware that, in the above one or more examples, the functions described in the present application can be implemented in hardware, software, firmware or any combination thereof. When implemented in software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on a computer readable medium.

[0174] The above detailed description sets forth the purposes, technical solutions and beneficial effects of the present application. It should be understood that the above detailed description is only a specific implementation of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present application shall be included in the protection scope of the present application.< / d> ​ ​​< / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / xy> < / z>

Claims

1. A method for converting secret-shared fragments, applied to any i-th computational party among three computational parties, comprising: Obtain the i-th fragment of the target value in the first format, which includes two of the three fragments of the target value; By subtracting the two first random fragments held by this party from the two fragments in the i-th fragment, two of the three sub-fractions of the first public fragment are obtained; the two first random fragments and the other first random fragment are distributed in the three computing parties in a cyclic pairing manner; Receive another sub-fragment of the first public fragment from other computing parties, and use this sub-fragment and the two sub-fragments calculated by this party to jointly reconstruct the first public fragment; Construct the i-th fragment of the target value in the second format, which includes the first public fragment and the two first random fragments.

2. The method according to claim 1, wherein, After constructing the i-th fragment of the target value in the second format, the process further includes: Based on the i-th fragment in the second format, secure multi-party computation for nonlinear operations is performed together with other computation parties to obtain the i-th fragment of the output value of the nonlinear operation in the second format.

3. The method according to claim 2, wherein, The i-th fragment of the output value in the second format includes a second public fragment and two second random fragments; wherein, after obtaining the i-th fragment of the output value of the nonlinear operation in the second format, the method further includes: The i-th fragment of the output value is converted from the second format to the first format. The converted i-th fragment includes two of the three fragments of the output value. The three fragments include any two of the two second random fragments and another second random fragment, as well as the result fragment obtained by adding the second public fragment to the other two.

4. The method according to claim 3, wherein, Converting the i-th fragment of the output value from the second format to the first format includes: In the case where the i-th computer is a designated computer, the two second random fragments held by it are taken as the i-th fragment of the output value in the first format; If the i-th computer is not the designated party, the result fragment is obtained by subtracting the second random fragment jointly held by the i-th computer and another non-designated party from the second public fragment.

5. A method for converting secret-shared fragments, applied to any i-th computational party among three computational parties, comprising: Get the i-th slice of the three slices of the target value; By subtracting one of the two first random partitions held by this party from the i-th partition, one of the three sub-partitions of the first public partition is obtained; the two first random partitions and the other first random partition are distributed in the three computing parties in a cyclic pairing manner; The other two sub-fragments of the first public fragment are received from the other two computing parties, and the first public fragment is restored by combining the two sub-fragments with a sub-fragment calculated locally. Construct the i-th fragment of the target value in the second format, which includes the first public fragment and the two first random fragments.

6. The method according to claim 5, wherein, The target value corresponds to the plaintext output of a binary multiplication; wherein, obtaining the i-th slice of the three slices of the target value includes: Together with the other two computation parties, a secure multi-party computation is performed on the binary multiplication to obtain the i-th slice.

7. A method for converting secret-sharing fragments, applied to any i-th computational party among three computational parties, comprising: Obtain the i-th fragment of the first value in the second format, which includes the public fragment of the four fragments of the first value, and two of the other three random fragments; The i-th fragment of the first value is converted from the second format to the first format. The converted i-th fragment includes two of the three fragments of the first value. The three fragments include any two of the three random fragments, and the result fragment is obtained by adding the public fragment to the other two random fragments. Based on the i-th fragment under the first format, secure multi-party computation for the linear operation is performed together with other computation parties to obtain the output value of the linear operation in the i-th fragment under the first format.

8. The method according to claim 7, wherein, Converting the i-th fragment of the first value from the second format to the first format includes: If the i-th computer is a designated computer, then two of the three random fragments held by that computer shall be used as the i-th fragment after the transformation. If the i-th computer is not the designated party, the result fragment is obtained by subtracting the random fragment jointly held by the i-th computer and another non-designated party from the public fragment.

9. A secret-sharing fragment conversion device, integrated into any i-th computational party among three computational parties, comprising: The original fragment acquisition module is configured to acquire the i-th fragment of the target value in the first format, which includes two of the three fragments of the target value; The sharding calculation module is configured to subtract the two first random shards held by the party from the two shards in the i-th shard to obtain two of the three sub-shards of the first public shard; the two first random shards and the other first random shard are distributed among the three calculation parties in a cyclic pairing manner; A sub-fragment receiving module is configured to receive another sub-fragment of the first public fragment from another computing party; The public fragment restoration module is configured to restore the first public fragment using the other sub-fragment and the two sub-fragments calculated by the user. The new sharding construction module is configured to construct the i-th shard of the target value in the second format, which includes the first public shard and the two first random shards.

10. A secret-sharing fragment conversion device, integrated into any i-th computational party among three computational parties, comprising: The original fragment acquisition module is configured to acquire the i-th fragment among the three fragments of the target value; The sharding calculation module is configured to subtract one of the two first random shards held by the party from the i-th shard to obtain one of the three sub-shards of the first public shard; the two first random shards and the other first random shard are distributed among the three calculation parties in a cyclic pairing manner; The sub-fragment receiving module is configured to receive two other sub-fragments of the first public fragment from the other two computing parties. The public fragment restoration module is configured to restore the first public fragment using the two sub-fragments and a locally calculated sub-fragment. The new sharding construction module is configured to construct the i-th shard of the target value in the second format, which includes the first public shard and the two first random shards.

11. A secret-sharing fragment conversion device, integrated into any i-th computational party among three computational parties, comprising: The original fragment acquisition module is configured to acquire the i-th fragment of the first value in the second format, including the public fragment of the four fragments of the first value, and two of the other three random fragments; The fragment format conversion module is configured to convert the i-th fragment of the first value from the second format to the first format. The converted i-th fragment includes two of the three fragments of the first value. The three fragments include any two of the three random fragments, and the result fragment is obtained by adding the public fragment to the other two random fragments. The MPC computation module is configured to perform secure multi-party computation for linear operations in conjunction with other computation parties based on the i-th fragment under the first format, so as to obtain the output value of the linear operation in the i-th fragment under the first format.

12. A computer-readable storage medium having a computer program stored thereon, wherein, When the computer program is executed in the computer, it causes the computer to perform the method of any one of claims 1-8.

13. A computing device comprising a memory and a processor, wherein, The memory stores executable code, and when the processor executes the executable code, it implements the method of any one of claims 1-8.

Images