Verifiable secure multi-party computing method based on improved lattice commitment

Abstract

The invention relates to the technical field of information security and cryptography, and discloses a verifiable secure multi-party computing method based on improved lattice commitment, comprising the following steps: constructing a system model comprising a data owner, a cloud service provider and a honesty verifier; in the offline preprocessing stage, a cloud service provider collaboratively generates cryptographic parameters, a global authentication key, a multiplication triple and an input commitment, and stores auditing transaction records; in the online stage, a data owner submits secret input, a cloud service provider executes secure multi-party calculation based on a pre-calculation material, and an intermediate process and a result commitment are recorded in a case; according to the method, a lattice commitment scheme of post-quantum security is adopted, and an independent verification mechanism based on trusted hardware is introduced, so that high verifiable security capable of resisting quantum attacks is realized while high calculation efficiency and multi-party expansibility are guaranteed, and the security of the computing process is improved. The method is suitable for cooperation scenes with high privacy requirements.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security and cryptography technology, and particularly relates to a verifiable secure multi-party computation method based on an improved commitment. BACKGROUND

[0002] In the digital economy era, data has become a key production factor. Cross-institutional and cross-disciplinary multi-party data collaboration, such as in joint medical research, financial risk modeling, smart city governance, etc., is crucial for releasing data value and improving decision-making quality. The core goal of such collaboration is to jointly train high-performance models using data distributed among parties without centralized collection of raw sensitive data, thereby achieving knowledge co-creation while protecting privacy.

[0003] Secure Multi-Party Computation (SMPC) as the theoretical cornerstone of privacy computing provides a fundamental approach to solving this problem. It allows multiple participants to jointly compute a given function based on their private inputs and only obtain the output result, while any party cannot obtain the original input information of other parties. SPDZ protocol is a milestone framework in this field, which through the two-stage design of "offline preprocessing" and "online computation", preposes most time-consuming cryptographic operations, thereby significantly improving the execution efficiency of the online stage and providing strong security proof under the malicious adversary model. However, with the evolution of computing environment and the escalation of security threats, existing protocols based on the SPDZ framework face two major challenges in actual deployment, especially in the face of future security needs:

[0004] First, the threat of post-quantum security. Most existing SMPC protocols, including many verifiable SPDZ variants, rely on traditional number-theoretic problems such as discrete logarithm or large integer factorization. For example, the widely used Pedersen commitment scheme provides the basis for the verifiability of the protocol. However, the emergence of quantum algorithms such as Shor's algorithm poses a fundamental threat to these classical problems. Once practical quantum computers are available, the cryptographic primitives that rely on these problems will become vulnerable, leading to the failure of the verifiability and security of the entire protocol. This means that many "secure" systems currently deployed may not be able to guarantee long-term data confidentiality and computational integrity.

[0005] Secondly, the trade-off between verifiability, efficiency and generality. To enhance the verifiability of the protocol to deal with malicious behavior, existing research usually introduces additional verification mechanisms. For example, some schemes introduce honest verifiers and combine zero-knowledge proofs to audit the computing process. However, the implementation of these mechanisms is still based on the aforementioned non-quantum-resistant components. On the other hand, in order to pursue extreme efficiency in specific scenarios (such as machine learning inference), special-purpose protocols such as SOCIUM have emerged. These protocols achieve excellent performance by deeply optimizing nonlinear calculations (such as activation functions), but their design is usually strictly limited to three-party scenarios, sacrificing generality and scalability, making it difficult to adapt to dynamic changes in the number of participants or more realistic collaboration needs.

[0006] Specifically, in the high-value and strictly regulated fields of financial technology, medical health, etc., the auditability of the computing process is mandatory. Existing schemes either lack long-term security guarantees due to reliance on non-quantum-resistant components, or are efficient but limited to specific numbers of parties, unable to meet the general needs of multi-party participation in complex business ecosystems.

[0007] Therefore, how to design a secure multi-party computing protocol that can resist quantum computing attacks, maintain high efficiency and support multi-party verifiability has become a key problem in the current privacy computing field that needs to be solved. SUMMARY

[0008] To solve the technical problems of existing technologies that are subject to post-quantum security threats, cannot maintain high efficiency and support multi-party verifiability, the present application provides a verifiable secure multi-party computing method based on improved lattice commitments, and the technical solution is as follows:

[0009] Step 1, a three-party system model including a data owner, a cloud service provider and an honest verifier is constructed, and offline pre-computation is performed to obtain pre-computation materials and store them in a transaction record ;

[0010] Step 2, perform secure computation online, under the support of the pre-computation materials, sequentially complete submission of secret input, linear and multiplication operations, reconstruct the result and verify its integrity;

[0011] Step 3, independently verify the computing result externally, and the honest verifier performs final verification of the computing process and result based on the transaction record .

[0012] Further, the specific steps of pre-computation in step 1 are as follows:

[0013] Step 1.1, the cloud service provider collaboratively runs a distributed key generation algorithm to generate a public key and a private key share held by the cloud service provider Meanwhile, the public parameter matrix of the BDLOP+ commitment scheme is generated, which is composed of block matrices and vertically spliced, where and are random matrices;

[0014] Step 1.2, the cloud service providers jointly generate a global message authentication code key by a distributed protocol , which is held by each cloud service provider in the form of a share of additive secret sharing ;

[0015] Step 1.3, pre-compute the Beaver triple for secure multiplication in the form of , where , which is stored in the form of secret sharing ;

[0016] Step 1.4, for each expected input value , pre-generate a random number share and its corresponding BDLOP+ commitment ;

[0017] Step 1.5, store the pre-computed materials obtained in the above steps, including all public keys generated, the public parameter matrix of the commitment scheme, the message authentication code key share, the Beaver triple, and the input commitment, in a verifiable transaction record .

[0018] Further, the step 2 is specifically:

[0019] Step 2.1, in the input stage, for a participant who has an input , all cloud service providers cooperate to reveal the pre-generated random number share and the BDLOP+ commitment to the participant , the participant calculates the mask and broadcasts after verifying the correctness of the commitment, and all cloud service providers locally recover the secret sharing value of the input ;

[0020] Step 2.2, in the calculation stage, the cloud service providers perform linear operations based on the secret sharing value and the pre-computed materials without interaction, and perform multiplication operations using the Beaver triple of step 1.3: ;

[0021] Step 2.3, in the result disclosure phase, the honest verifier obtains the shared value , the cloud service provider exchanges random number shares to reconstruct the plaintext , while using message authentication code shares for verification , aborting the protocol if verification fails.

[0022] Further, the step 3 is specifically:

[0023] Step 3.1, the honest verifier obtains all relevant input commitments, intermediate commitments, and output commitments from the transaction record ;

[0024] Step 3.2, according to the calculation circuit, reconstruct and verify the consistency of each addition and multiplication operation: for addition, verify ; for multiplication, verify , where and are mask values disclosed in the online phase.

[0025] Step 3.3, if all commitments pass the verification, the honest verifier confirms the integrity of the calculation result and returns the result to the data owner, otherwise triggers the protocol to abort and refuses to output any result.

[0026] Further, in the three-party system model: the data owner includes medical institutions and insurance service providers, responsible for standardizing preprocessing of their respective sensitive data, and submitting the processed data as secret input to the cloud service provider; the cloud service provider is composed of multiple mutually independent cloud server nodes, collectively serving as secure multi-party computing nodes, responsible for executing all calculations in step 2; the honest verifier is a third-party server independent of the cloud service provider, deployed in a hardware-based trusted execution environment, specifically responsible for performing the verification work in step 3.

[0027] Further, in step 1.1, the parameters of the BDLOP+ commitment scheme need to satisfy: the matrix dimension , and each component of the random vector satisfies norm constraint , where is the discrete Gaussian distribution parameter, is the dimension of the polynomial ring.

[0028] Further, in step 1.1, the computational hiding of the BDLOP+ commitment scheme relies on the difficulty of the Decisional Knapsack problem, and the computational binding relies on the difficulty of the Extended-Search Knapsack problem.

[0029] Further, in the step 1.3, the Beaver triple of the secure multiplication is generated by the following steps: each cloud service provider locally generates a random number share And And encrypts it into ciphertext And After aggregating all the ciphertexts, the homomorphic encryption multiplication is calculated Finally, through the Reshare protocol, the Is decrypted and converted into the form of secret sharing of the product . .

[0030] Further, in the step 3.2, it is required that the message lengths corresponding to the commitments of all participating operations are equal, and for the messages with insufficient length, zero padding is performed in the high bit before the commitment operation.

[0031] Further, the message authentication code key And the pre-computed material generated in the step 1 are verified by the honest verifier before the start of the step 3, and the corresponding commitment and zero-knowledge proof stored in the transaction record Are verified in a one-time batch to verify their correctness.

[0032] Beneficial effects:

[0033] The present application replaces the Pedersen commitment in the traditional protocol with the anti-quantum BDLOP+ commitment scheme, so that the entire calculation process (especially the verification link) can resist attacks by future quantum computers, providing long-term security for the future, and the BDLOP+ commitment scheme can generate shorter commitment values under the same security level, reducing storage and transmission overhead; The offline / online two-stage design brings forward a large number of cryptographic operations, making the online calculation faster, especially suitable for scenarios that need to frequently execute the same calculation circuit; The protocol design of the present application is based on the SPDZ framework, which can guarantee the confidentiality of input data as long as at least one computing node is honest in the static corruption model, and even if all computing nodes collude, the integrity of the calculation result cannot be destroyed, so that privacy and correctness are both considered; Unlike some specialized protocols (such as SOCIUM) that are limited to three parties, the SPDZ framework based on the present application naturally supports multi-party expansion, and in the classic MNIST classification task, the present method not only maintains the multi-party expansion capability, but also outperforms the three-party dedicated protocol in terms of performance, and has more practical application value; The present application introduces an honest verifier as an independent third party, which does not participate in actual calculation, but only audits based on public transaction records, and this mechanism provides transparent verification that does not depend on any single participant, enhancing the credibility of the protocol in high-risk scenarios such as financial supervision and cross-institutional cooperation. BRIEF DESCRIPTION OF DRAWINGS

[0034] Figure 1 Flowchart of the improved commitment-based verifiable secure multi-party computation method;

[0035] Figure 2 Time consumption comparison chart of BDLOP+, Pedersen and SVC commitment schemes in the key generation stage in the embodiment of the present application;

[0036] Figure 3 Time consumption comparison chart of BDLOP+, Pedersen and SVC commitment schemes in the commitment generation stage in the embodiment of the present application;

[0037] Figure 4 Time consumption comparison chart of BDLOP+, Pedersen and SVC commitment schemes in the commitment verification stage in the embodiment of the present application. DETAILED DESCRIPTION

[0038] The specific embodiments of the present application will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application.

[0039] Embodiment: Privacy protection joint risk assessment based on medical data and insurance data

[0040] This embodiment simulates a medical health data analysis scenario: multiple hospitals (holding patient electronic health records EHR) and insurance companies (holding customer insurance and claim records) hope to jointly train a risk assessment model without revealing their original data, so as to more accurately predict the health risk of individuals. The present application provides an improved commitment-based verifiable secure multi-party computation method.

[0041] I. System initialization and entity roles

[0042] As shown in the figure, the three-party system model of the present application includes three types of entities: Figure 1

[0043] Data owner (DO): including multiple hospitals and an insurance company. They each standardize and desensitize the local sensitive data for preprocessing.

[0044] Cloud service provider (CSP): composed of three mutually independent cloud servers (CSP1, CSP2, CSP3), which together constitute an SMPC computing cluster.

[0045] Honest verifier (HV): an independently deployed server running in a trusted execution environment with Intel SGX function.

[0046] ​All entities are interconnected through secure channels. Data owners transmit encrypted or secret shared data to CSPs, and CSPs transmit interactive messages required for protocol execution to each other and to HV.

[0047] II. Protocol execution process

[0048] 1. Offline preprocessing phase

[0049] CSP1, CSP2, CSP3 collaboratively perform the following operations:

[0050] (1) Parameter generation: three parties run a distributed key generation protocol to obtain a public key of an SHE scheme Each CSP holds a share of the private key . At the same time, a public matrix of BDLOP+ commitment is generated , the security parameter is set to 128 bits, the ring dimension is , and the modulus is a specific prime number.

[0051] (2) Message authentication code (MAC) key generation: each CSP locally samples a random number as a MAC key share , after encryption and zero-knowledge proof exchange, collaboratively decrypt to obtain the global MAC key , but The actual value still exists in the form of secret sharing .

[0052] (3) Material pre-computation: according to the estimated model computation amount (such as the number of iterations of logistic regression), a sufficient number of multiplication triples are pre-generated. At the same time, for each feature data item submitted by the hospital and the insurance company, the corresponding random mask share and its BDLOP+ commitment are pre-generated.

[0053] (4) Storage and verification: write , , the commitment of all multiplication triples, the commitment of all input masks, etc., and the zero-knowledge proof for proving the correctness of their generation, into a blockchain or auditable database called . HV subsequently accesses to verify the validity of all commitments and proofs. Only after verification, the protocol enters the next phase.

[0054] 2. Online computation and verification phase

[0055] (1) Data input: the hospital submits a feature vector of a patient, and the insurance company submits a corresponding feature vector , respectively, to three CSPs. Specifically, for input value , CSPs use pre-generated masks , let data owner compute and broadcast, CSPs locally recover . Meanwhile, the relationship between input value submitted by the data owner and the mask is recorded in .

[0056] (2) Model training computation: Suppose a logistic regression model is used. CSPs securely compute the prediction value, loss function, and gradient on the secret shared and model weights . This process involves a large number of additions (local computation) and multiplications (using pre-computed triples). For example, computing the inner product requires multiple calls to the secure multiplication sub-protocol. The intermediate values (such as mask difference ) disclosed in each multiplication operation and their commitments are also appended to .

[0057] (3) Result output and verification: After training is complete, the final model weights need to be output to all data owners. CSPs collaboratively open the shares of , reconstruct , and verify its integrity using MAC shares. All opened values and verification data are submitted to .

[0058] (4) HV final audit: HV is triggered and begins work. It reads the complete computation history from , including all input commitments, input / output commitments of each multiplication gate, and the final result commitment. HV re-computes the expected commitment relationship for each step (such as the commitment transformation formula for homomorphic addition, multiplication) according to the computation circuit logic. HV independently verifies whether each relationship is correct. For example, for a multiplication gate, it verifies: . Only when all verifications pass, does HV sign a confirmation in and release as the valid result to the hospital and insurance company. Otherwise, HV issues a suspension alert, and all participants know that the computation is invalid.

[0059] III. Performance and Effect

[0060] To evaluate the performance of the method of the embodiment, tests were conducted in an experimental environment configured with an AMD Ryzen 9 processor and 16 GB of RAM, and compared with existing solutions.

[0061] (1) Commitment scheme efficiency: As shown in Table 1, the BDLOP + commitment scheme adopted in the present application is significantly faster than another post-quantum scheme SVC in key generation and commitment generation stages under the security level of 128-2048 bits. Figures 2 to 4

[0062] (2) Overall protocol performance: Simulation was performed on the training task of the MNIST dataset image classification model. As shown in Table 1, the present application protocol takes 2.46 seconds to complete the training in a local area network environment, and takes 42.87 seconds in a wide area network environment, both of which are superior to the current advanced three-party dedicated protocol SOCIUM.

[0063]

[0064] Table 1 Comparison of overall performance of embodiments of the present application and SOCIUM protocol.

[0065] (3) Security effect: In the three-party setting of the present embodiment, as long as one CSP remains honest (does not collude with HV), the original data of the hospital and the insurance company will not be leaked. Even if all three CSPs collude maliciously and try to output incorrect model weights, the independent HV will discover and prevent it with a high probability through the commitment verification mechanism, thereby ensuring the correctness of the calculation result.

[0066] The above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.​

Claims

1. A verifiable and secure multi-party computation method based on improved lattice commitments, characterized in that: Includes the following steps: Step 1: Construct a three-party system model including the data owner, cloud service provider, and honest verifier, and perform offline pre-computation to obtain pre-computation materials and store them in the transaction records. middle; Step 2: Perform secure computation online. With the support of the pre-computation materials, complete the submission of secret inputs, linear and multiplication operations in sequence, reconstruct the results, and verify their integrity. Step 3: External independent verification of the calculation results, the honest verifier based on the transaction records. The calculation process and results are then verified.

2. The verifiable secure multi-party computation method based on improved lattice commitment as described in claim 1, characterized in that: The specific steps for pre-calculation in step 1 are as follows: Step 1.1: The cloud service provider collaborates to run a distributed key generation algorithm to generate the public key for the homomorphic encryption scheme. and the share of private keys held by cloud service providers Simultaneously, a common parameter matrix for the BDLOP+ commitment scheme is generated, which is: , by block matrix and It is composed of vertical splicing, among which and It is a random matrix; Step 1.2: The cloud service provider jointly generates a global message authentication code key through a distributed protocol. The key The shares are held by each cloud service provider in the form of additive secret sharing. ; Step 1.3: Pre-calculate the Beaver triples for safe multiplication, in the form of... ,in The triple is shared in secret. storage; Step 1.4: For each expected input value Pre-generate a random number share and its corresponding BDLOP+ commitment. ; Step 1.5: The pre-computation materials obtained in the above steps, including all generated public keys, The public parameter matrix of the commitment scheme, message authentication code key share, Beaver triple, and input commitment are stored in verifiable transaction records. middle.

3. The verifiable secure multi-party computation method based on improved lattice commitment as described in claim 2, characterized in that: Step 2 specifically involves: Step 2.1: In the input phase, for those who have input... Participants All cloud service providers collaborate to reveal pre-generated random number shares to them. and BDLOP+ commitment Participants Calculate the mask after verifying the commitment is correct. And broadcast it, so that all cloud service providers can locally recover the input accordingly. Secret shared value ; Step 2.2: During the computation phase, the cloud service provider bases its calculations on the aforementioned secret shared value. With pre-calculated materials, linear operations are performed without interaction, and multiplication is performed using the Beaver triples from step 1.3: ; Step 2.3: In the results disclosure phase, for the shared values ​​that need to be output... Cloud service providers exchange random number shares To reconstruct plaintext At the same time, utilize message authentication code share verify If verification fails, the agreement will be terminated.

4. The verifiable secure multi-party computation method based on improved lattice commitment as described in claim 3, characterized in that: Step 3 specifically involves: Step 3.1, the honest verifier examines the transaction records. Obtain all relevant input commitments, intermediate commitments, and output commitments from the source. Step 3.2: Based on the computational circuit, reconstruct and verify the commitment consistency of each addition and multiplication operation gate by gate: For addition, verify... For multiplication, verify ,in and The mask value disclosed during the online phase; Step 3.3: If all commitments pass verification, the honest verifier confirms the integrity of the calculation result and returns the result to the data owner; otherwise, the protocol is terminated and no result is output.

5. The verifiable secure multi-party computation method based on improved lattice commitment as described in claim 1, characterized in that: In the aforementioned tripartite system model: data owners include medical institutions and insurance service providers, who are responsible for standardizing and preprocessing their respective sensitive data and submitting the processed data as secret input to the cloud service provider; the cloud service provider consists of multiple independent cloud server nodes, which together act as secure multi-party computation nodes and are responsible for executing all computations in step 2; the honest verifier is a third-party server independent of the cloud service provider, deployed in a hardware-based trusted execution environment, and is specifically responsible for executing the verification work in step 3.

6. The verifiable secure multi-party computation method based on improved lattice commitment as described in claim 2, characterized in that: In step 1.1, the parameters of the BDLOP+ commitment scheme must satisfy: matrix dimension and random vector Each component satisfies Norm Constraints ,in The parameters are discrete Gaussian distribution parameters. Let be the dimension of the polynomial ring.

7. The verifiable secure multi-party computation method based on improved lattice commitment as described in claim 2, characterized in that: In step 1.1, the computational hiding property of the BDLOP+ commitment scheme depends on the difficulty of the Decisional Knapsack problem, and the computational binding property depends on the difficulty of the Extended-Search Knapsack problem.

8. The verifiable secure multi-party computation method based on improved lattice commitment as described in claim 2, characterized in that: In step 1.3, the Beaver triples for secure multiplication are generated by the following steps: each cloud service provider generates a random number share locally. and And encrypt it into ciphertext and After aggregating all ciphertexts, multiplication is performed using homomorphic encryption. Finally, through the Reshare protocol, it will be... Decrypt and convert to product Secret sharing form .

9. The verifiable secure multi-party computation method based on improved lattice commitment as described in claim 4, characterized in that: In step 3.2, it is required that the message lengths corresponding to all commitments participating in the operation are equal. For messages that are not long enough, zero padding must be added to the high bits before the commitment operation is performed.

10. The verifiable secure multi-party computation method based on improved lattice commitment as described in claim 1, characterized in that: The message authentication code key generated in step 1 And pre-calculated materials, before starting step 3, are verified by an honest verifier in the transaction records. The correctness of the corresponding commitments and zero-knowledge proofs is verified in a one-time batch.

Images