Unknown network secret sharing and broadcasting method and system with low communication overhead

Abstract

The invention discloses an unknown network secret sharing and broadcasting method and system with low communication overhead, and aims to solve the problem of high communication overhead of broadcasting and secret sharing under an unknown network model based on various distributed computing technologies and cryptographic protocols, such as threshold signature, polynomial commitment, erasure code and the like. A broadcast protocol and a secret sharing protocol with linear communication complexity are respectively designed, the protocol efficiency is remarkably improved, communication overhead close to the linear communication complexity is realized, and the method has wide application scenes in the fields of distributed consensus, secure multi-party computing and the like. An erasure code technology in traditional asynchronous consensus, a threshold signature technology in synchronous consensus and a polynomial commitment and Packed technology in asynchronous secret sharing are combined, and a commitment consistency verification protocol is designed, so that the overall communication overhead is optimized, and an important breakthrough is brought to the field of secure multi-party computing.

Description

Technical Field

[0001] This invention belongs to the field of information security technology and relates to a method and system for sharing and broadcasting secrets on unknown networks with low communication overhead. Background Technology

[0002] In the field of secure multi-party computation, broadcasting and secret sharing are the most fundamental components. Broadcasting guarantees the basic functionality of multi-party communication, while secret sharing enables the additive fragmentation of data. Different network models present different challenges to broadcasting and secret sharing schemes. Considering the uncertainties in real-world networks, researchers have conducted in-depth studies on these fundamental functions under various network models.

[0003] Currently, network models can be mainly categorized into synchronous networks, semi-synchronous networks, and asynchronous networks. However, in recent years, many researchers have focused on the fact that real-world networks are often difficult to strictly distinguish, and therefore have dedicated themselves to researching secure multi-party computation methods under unknown network models. An unknown network model refers to a network model in which honest participants are unaware of the current network model. Previous research has largely focused on secure multi-party computation methods based on additive homomorphic encryption, which incurs significant computational overhead. Existing secret-sharing-based schemes also suffer from substantial communication complexity. However, this approach is difficult to implement. Therefore, researching secret sharing and broadcasting schemes with better communication complexity has significant practical implications.

[0004] Existing research on unknown secret sharing schemes over networks faces two main bottlenecks: one is the need for broadcasting. The first is the communication complexity; the second is that its committed polynomial has The communication complexity is low. However, secret sharing in existing synchronous and asynchronous network models often relies on techniques such as KZG commitments, packed secret sharing methods, error-correcting codes, and erasure codes, all of which have achieved linear communication complexity. Therefore, secret sharing schemes under unknown network models still have great potential for further optimization. Summary of the Invention

[0005] This invention addresses the shortcomings of existing technologies by providing a method and system for low-communication-overhead secret sharing and broadcasting over unknown networks, achieving linear communication complexity. A secret sharing scheme under an unknown network model.

[0006] The present invention discloses a low-communication-overhead method for sharing and broadcasting secrets over unknown networks, comprising the following steps: A reliable broadcast protocol is constructed, messages are fragmented using erasure codes, and a threshold signature mechanism is used to aggregate multi-party signatures, achieving a communication complexity of O(log n). Broadcast communication; A secret sharing protocol is constructed based on a bivariate polynomial commitment protocol and multi-secret sharing technology. Multiple secret values ​​are embedded in a single sharing, and the consistency of the polynomial is ensured in the re-sharing phase through a commitment consistency detection protocol. Different adversary thresholds are used in asynchronous and synchronous network models, respectively. and This enables fault tolerance and recovery mechanisms. Furthermore, the reliable broadcast protocol includes an asynchronous data diffusion protocol and a reliable broadcast protocol, wherein: The asynchronous data diffusion protocol includes the steps of data proposal, data confirmation, data reconstruction, and output results. The reliable broadcast protocol includes sender initialization, hash proposal and voting, acknowledgment and aggregation, message recovery and output steps.

[0007] Furthermore, in the asynchronous data diffusion protocol: During the data extraction phase, the classic coding algorithm erasure code is used to divide message m into n fragments. Each fragment is signed and then sent to the corresponding node. Data confirmation phase upon receipt After several valid proposals for the same fragment are submitted, aggregate signatures and broadcast. Data reconstruction phase upon receiving The original message is restored after a valid confirmation message is received.

[0008] Furthermore, in the reliable broadcast protocol: The sender signs message m and sends a proposal message to all participants; Participants broadcast the hash value after verifying the proposal and send a vote if no conflicting hash is received; After receiving sufficient votes or confirmation messages, the asynchronous data diffusion protocol is invoked to complete message recovery.

[0009] Furthermore, the secret sharing protocol includes: Commitment Phase: The distributor will secretly embed the bivariate polynomial and generate a BKZG commitment; Distribution phase: Participants verify their share and return a signature; Verification phase: The distributor aggregates signatures and broadcasts the commitment and signature set; Reconstruction Phase: Participants recover the secret or list polynomial by providing help messages; Failure rollback phase: Initiate a re-sharing mechanism when verification fails.

[0010] Furthermore, in the reconstruction phase: If the participant belongs to the commitment set CS, then a help message is generated and sent; If the participant is not a CS, the polynomial is restored and the secret is output after sufficient help messages are received.

[0011] Furthermore, the failure rollback phase includes: The distributor constructs new bivariate polynomials M(x,y) and C(x,y) and generates commitments. ; Call the commitment consistency check protocol Prove the consistency between the new polynomial and the original polynomial; Initiate a new asynchronous VSS protocol to complete the secret re-sharing.

[0012] Preferably, the commitment consistency detection protocol include: The prover generates a random polynomial and sends its commitment; The verifier sends the challenge value; The prover calculates and sends the polynomial after the linear combination; The verifier verifies whether the commitment holds with respect to the polynomial.

[0013] Based on the same inventive concept, the present invention also designs an electronic device, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, it realizes a method for secret sharing and broadcasting over an unknown network with low communication overhead.

[0014] Based on the same inventive concept, the present invention also designs a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a method for secret sharing and broadcasting over an unknown network with low communication overhead.

[0015] The advantages of this invention are: 1. Performance Improvement: Compared to traditional broadcast protocols under unknown network models, erasure codes reduce the message size sent by each participant, making it possible to... In the interaction, only sending is required The codewords are of varying sizes, and multiple signatures are aggregated using threshold signature technology. Therefore, the signature size is independent of the number of participants, and the total communication complexity of the broadcast protocol is only a matter of... .

[0016] Compared to traditional secret-sharing protocols under unknown network models, this approach reduces commitment complexity through KZG commitments and designs a consistency-checking sub-protocol adapted to multinomial commitments to support subsequent multinomial re-sharing. Furthermore, by utilizing the Packed secret-sharing approach, more secret values ​​are carried in a single share, ultimately enabling linear sharing in asynchronous networks. The communication complexity is reduced; in a synchronous network model, only the communication complexity is reduced. The communication complexity is much lower than that of the original scheme. Communication overhead.

[0017] 2. The broadcast protocol and secret sharing protocol in this invention are both basic components of distributed computing and storage, which can directly reduce the overhead of distributed computing and storage in this network model, and have broad application prospects in the fields of consensus and secure multi-party computing.

[0018] 3. Fault Tolerance and Recovery Mechanism: When a malicious node controlled by an adversary sends erroneous data fragments (during the reconstruction phase), the malicious fragments are identified through multinomial commitment verification; when a malicious distributor (dealer) fails to share a consistent secret twice, a zero-knowledge proof protocol is used. Ensure consistency during the re-sharing phase; when a malicious distributor does not send a secret share to a node, other honest participants can help him reconstruct the polynomial to obtain the secret value based on the bivariate polynomial. Attached Figure Description

[0019] Figure 1 Flowchart for implementing reliable broadcast protocol and secret sharing protocol.

[0020] Figure 2 Flowchart for optimizing protocol communication design. Detailed Implementation

[0021] To facilitate understanding of the present invention, the technical process and effects of the present invention will be described in conjunction with the accompanying drawings.

[0022] To better understand this invention, the specific symbols are described as follows: KZG: Multinomial Commitment Agreement.

[0023] KZG commits to initial parameters.

[0024] Complexity function.

[0025] Number of participants.

[0026] Packed: A multi-secret sharing technique implemented using higher-order polynomials.

[0027] In an asynchronous network model, the optimal adversary threshold is the maximum number of nodes that the adversary can control, satisfying the following conditions: .

[0028] The optimal adversary threshold under the synchronous network model satisfies... .

[0029] Message to be shared.

[0030] :sign.

[0031] Threshold signature algorithm.

[0032] : Multinomial commitment.

[0033] Secret value.

[0034] A trusted set of secret sharing in the first stage.

[0035] A classic binary consensus protocol that outputs a consistent single bit 0 / 1.

[0036] Two-stage secret sharing of a trusted set.

[0037] Elliptic curve algebraic group.

[0038] A hash algorithm can be instantiated using MD5 or SM2, etc.

[0039] Classical coding algorithm.

[0040] Maximum waiting time (should be adjusted to the estimated maximum network latency based on actual network conditions).

[0041] 1. The KZG commitment includes the following three algorithms, which run on group-based algorithms. Under the bilinear pairing structure, the following algorithms are included: Random selection make For the group generator, For the group middle element, set ,definition .return .

[0042] :calculate return 。

[0043] :make

[0044]

[0045] : like Returns 1 otherwise returns 0. 2. BKZG Commitment: A bipolynomial version of the KZG commitment, supporting commitments for two-dimensional polynomials. The working principle of BKZG is as follows: :return .

[0046] :extract The coefficients, and the row polynomial Finally, it returns the row commitment vector. ,Right now:

[0047]

[0048] Given a row commitment verification vector The list is parsed as Calculate the complete commitment , return A.

[0049] : .

[0050] Given a One difference The proof vector for evaluating at point Generate at point as follows Complete proof of the evaluation at point and return :

[0051]

[0052] : .

[0053] 3. Multi-signature schemes: The following is a brief introduction to multi-signature schemes based on Schnorr, including ( Five algorithms: Input security parameters Returns a public-private key pair .

[0054] Enter private key and messages awaiting signature Get random numbers Output signature .

[0055] Enter public key ,information and signature ,like Output 1 if the condition is met, otherwise output 0.

[0056] Input by public key The vector formed A vector consisting of a signature of the same length. Output aggregate signature .

[0057] Input vector and messages ,like If the condition is met, output 1; otherwise, output 0.

[0058] 4. RS Erasure Code Scheme: Includes two algorithms: encoding and decoding, with parameters n (code length) and... (Threshold) is the basic input parameter: Message Perform bit splitting to obtain coefficients Construct polynomial Output codeword

[0059] Code And the corresponding index to locate the points of the polynomial, interpolating the polynomial. And reconstruct the coefficients Output .

[0060] Example 1 The purpose of this invention is to propose a low-communication-overhead method and system for sharing and broadcasting secrets in unknown networks, thereby reducing the communication complexity of broadcasting and secret sharing in this model, and promoting the implementation of applications such as unknown network consensus and general secure multi-party computation, which are applicable to scenarios such as distributed computing and distributed storage.

[0061] This embodiment discloses a low-communication-overhead method for sharing and broadcasting secrets over unknown networks, with an overall communication complexity of linear level. The scheme introduces a threshold signature mechanism, draws inspiration from classic broadcast protocols, and combines erasure coding technology to construct a reliable broadcast protocol with linear communication overhead, applicable to different network models. Furthermore, the scheme integrates KZG commitments based on binary polynomials with packed secret sharing technology, enabling each round of sharing to carry multiple secret values, further improving communication efficiency. Through the integration of these multiple technologies, a communication complexity of O(n log n) is ultimately achieved in unknown network environments. This invention provides a highly efficient secret sharing protocol. The solution can be divided into two parts: reliable broadcasting and secret sharing. A detailed description follows: 1) Reliable Broadcast: Enables the Dealer to broadcast messages. Introduces a communication complexity of O(log n). Traditional broadcasting solutions It achieves a broadcast protocol with linear complexity to the message by broadcasting a small set of user information. : a) Dealer uses an erasure code algorithm to convert the code of length to... News Encoded as The length is vector And construct a Merkle tree using this vector, where the root of the tree is... The message verification path is And obtain the message after signing it. Send to the participants .

[0062] b) All participants received Then, the message is sent to all other participants, and they wait. If no other messages are received after a certain time. Then, a threshold signature scheme is used to vote on the Merkelgen, that is, to send a message to all participants. .

[0063] c) All participants received Then, if the number of valid signatures exceeds And have already received The aggregation yields the complete signature. and send For all participants.

[0064] d) Dealer initializes a collection When receiving a legitimate Later Add to Waiting time Afterwards, if Using classic broadcasts Broadcast Collection .

[0065] e) The waiting time for all participants Then, determine whether the collection has been received. If received, it will be sent to the binary consensus protocol. Enter 1 if you want to enter 1, otherwise enter 0.

[0066] f) Waiting for the agreement If the output is 1, then the set is accepted. If the value is 0, the Dealer needs to rebroadcast the new set. ,satisfy .

[0067] g) Finally, all participants that have received a valid shard send the data shard to all other nodes. And reconstruct the message using these fragments. .

[0068] 2) Commitment to Consistency Testing Protocol : a) Given the set of commitments already published by the Dealer And the Dealer knows the set of polynomials promised. and For the verification point The dealer needs to make a commitment a random polynomial satisfy Receive a promise The promise was then broadcast.

[0069] b) User Give random challenges And send it to the Dealer.

[0070] c) Dealer Calculation , and towards send .

[0071] d) User calculate And verify whether it is correct. The promise.

[0072] 3) Secret Sharing Protocol: a) Given a secret Embed it randomly Bivariate polynomial of order ,satisfy And given randomness Bivariate polynomial of order Subsequently, a commitment polynomial was made. ,Right now Then broadcast and give to the participants send .

[0073] b) Broadcast after all participants verify the consistency between the polynomial they received and their commitment. .

[0074] c) Dealer in time Internal collection Received no less than Construct a set after each message and broadcast using broadcast protocols. .

[0075] d) If in time Received a broadcast message Then to the binary consensus protocol Input message Otherwise to Input message .

[0076] e) If The output is 1: a) Dealer for all items not in the set User key Order sharing, i.e., constructing polynomials as well as ,satisfy and Re-pass To commit polynomial polynomial and After arranging and combining them in order, we get the following results. Bivariate polynomial of order ,calculate Broadcast commitment And for each user send .

[0077] b) User Through the protocol Check the received commitments and Consistency, and verification polynomial With promise After achieving consistency, broadcast .

[0078] c) Dealer Collection Received no less than Construct a set after each message and broadcast using broadcast protocols. .

[0079] d) All participating parties If it belongs to a set , will message Send to all .

[0080] e) All participating parties If it belongs to a set Accepting polynomials Output If it does not belong to the set Then by receiving Interpolation reconstructs the polynomial and output .

[0081] f) If The output is 0: a) The Dealer needs to rebroadcast the size. set .

[0082] b) All participating parties ,receive If later belongs to To all participating parties send and (and related commitment certificates).

[0083] c) All participating parties If it does not belong to the set , using the received Reconstructing the polynomial and to all participants send .

[0084] d) All participating parties ,receive The polynomial was then reconstructed using polynomial interpolation. and output .

[0085] Example 2 Based on the same inventive concept, the present invention also designs an electronic device, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, it realizes a method for secret sharing and broadcasting over an unknown network with low communication overhead.

[0086] Since the device described in Embodiment 2 of this invention is an electronic device used to implement the low-communication-overhead unknown network secret sharing and broadcasting method of Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of the system based on the method described in Embodiment 1 of this invention, and therefore will not be described again here. All electronic devices used in any method of this invention are within the scope of protection of this invention.

[0087] Example 3 Based on the same inventive concept, the present invention also designs a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a method for secret sharing and broadcasting over an unknown network with low communication overhead.

[0088] Since the device described in Embodiment 3 of this invention is a computer-readable medium used to implement the low-communication-overhead unknown network secret sharing and broadcasting method of Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this computer-readable medium based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All computer-readable media used in any method of this invention are within the scope of protection of this invention.

[0089] The specific embodiments described herein are merely illustrative of the spirit of the invention. Those skilled in the art to which this invention pertains may make various modifications or additions to the described specific embodiments or use similar methods to substitute them, without departing from the spirit of the invention or exceeding the scope defined by the appended claims.

Claims

1. A low communication overhead method for secret sharing and broadcasting in an unknown network, characterized in that, The method comprises the following steps: A reliable broadcast protocol is constructed, message is fragmented by using erasure code, threshold signature mechanism is combined to realize multi-party signature aggregation, and broadcast communication with communication complexity of ​ A secret sharing protocol is constructed based on a bivariate polynomial commitment protocol and a multi-secret sharing technology, a plurality of secret values are embedded in one sharing, and the commitment consistency detection protocol is used to ensure the consistency of the polynomial in the re-sharing stage; In the asynchronous network and synchronous network model, different adversary thresholds are adopted and , to achieve fault tolerance and recovery mechanisms.

2. The method of claim 1, wherein, The reliable broadcast protocol comprises an asynchronous data diffusion protocol and a reliable broadcast protocol, wherein: The asynchronous data diffusion protocol comprises data submission, data confirmation, data reconstruction and output result steps; The reliable broadcast protocol comprises sender initialization, hash proposal and voting, confirmation and aggregation, message recovery and output steps.

3. The method of claim 2, wherein, In the asynchronous data diffusion protocol: The data submission stage uses a classical encoding algorithm erasure code to divide the message m into n fragments, and each fragment is sent to the corresponding node after being signed; The data validation phase occurs after receiving a valid proposal for the same shard, aggregates the signature and broadcasts it; The data reconfiguration phase restores the original message upon receiving a valid acknowledgement message.

4. The method of claim 2, wherein, In the reliable broadcast protocol: The sender signs the message m and sends a proposal message to all participants; After verifying the proposal, the participants broadcast the hash value, and send a vote when no conflicting hash is received; After receiving enough votes or confirmation messages, the asynchronous data diffusion protocol is called to complete message recovery.

5. The method of claim 1, wherein, The secret sharing protocol comprises: The commitment stage: the distributor embeds the secret in the bivariate polynomial and generates the BKZG commitment; The distribution stage: the participants verify the share and return the signature; The verification stage: the distributor aggregates the signature and broadcasts the commitment and signature set; The reconstruction stage: the participants recover the secret or the column polynomial through the help message; The failure fallback stage: the re-sharing mechanism is started when the verification fails.

6. The method of claim 5, wherein, In the reconstruction stage: If the participant belongs to the commitment set CS, the participant generates and sends the help message; If the participant does not belong to CS, the participant waits for enough help messages to recover the polynomial and output the secret.

7. The method of claim 5, wherein, The failure fallback stage comprises: The distributor constructs a new bivariate polynomial M(x, y) and C(x, y), and generates a commitment ; Calling a commitment consistency detection protocol proves the consistency of the new polynomial with the original polynomial; A new asynchronous VSS protocol is started to complete secret re-sharing.

8. The method of claim 1, wherein, The commitment consistency detection protocol Comprises: The prover generates a random polynomial and sends its commitment; The verifier sends a challenge value; The prover calculates and sends the polynomial after linear combination; The verifier verifies whether the commitment and the polynomial are consistent.

9. An electronic device comprising a processor and a memory, wherein the memory stores a computer program, and the computer program is executed by the processor to implement the method of any one of claims 1 to 8.

10. A computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the method of any one of claims 1 to 8.

Images