Multi-party security computing method and system in gatekeeper mode

Abstract

The invention discloses a multi-party security computing method and system in a gatekeeper mode. The method comprises the following steps: generating and storing a copy of network configuration information for each participant; in response to a starting instruction of a multi-party security computing task, traversing all participant pairs (Pi, Pj) which need to establish communication connection, i is not equal to j, for each pair, initiating a connection request by the participant Pi according to network configuration information stored in the participant Pi, and forwarding through gatekeeper equipment so as to establish a one-way communication link from Pi to Pj; constructing a virtual full-connection computing network covering all participants on the basis of the established multiple one-way communication links; the task initiator distributes the calculation task to the calculation platform through any participant in the virtual full-connection calculation network; and the computing platform coordinates the participants to perform secure multi-party cooperative computing through the virtual full-connection computing network according to the tasks. According to the invention, the multi-party security computing technology can be seamlessly deployed in a high-security environment with strict gatekeeper requirements.

Description

Technical Field

[0001] This invention relates to the field of network security and privacy computing technology, and more specifically, to a multi-party secure computing method and system under a network gateway mode. Background Technology

[0002] Secure multi-party computation is a core technology of privacy-preserving computation. It allows multiple parties to collaboratively compute a predetermined function without revealing their private input data, and to obtain only the result. This technology has broad application prospects in scenarios such as joint risk control in finance, joint analysis of medical data, and collaborative government data.

[0003] However, in actual deployments, especially in areas with extremely high network security requirements (such as bank internal networks, government private networks, and medical institution intranets), network architectures typically employ physical or logical isolation for protection. Network gateways (also known as security isolation and information exchange systems) are common devices in such environments. Through dedicated hardware and protocols, they enable controlled, one-way data exchange while ensuring secure isolation between networks of different security levels. Network gateways typically only open a very limited number of specific, strictly controlled ports for point-to-point data transfer and prohibit arbitrary, bidirectional direct network access.

[0004] Existing multi-party secure computation frameworks (such as MP-SPDZ and ABY) typically rely on traditional network socket communication at the communication layer. Their default network model allows participants to directly establish bidirectional, arbitrary TCP / IP connections. For example, in a three-party computation scenario, each participant may need to establish connections with the other two parties simultaneously, requiring each participant's firewall to open multiple inbound ports. This communication model severely conflicts with network policies in a gateway environment. 1. Insufficient network connectivity: The gateway prohibits direct IP reachability between the participants.

[0005] 2. Port opening restrictions: Network gateway policies typically only allow pre-configured, unidirectional, point-to-point communication channels, which cannot meet the dynamic, many-to-many connection requirements of multi-party computation.

[0006] 3. Communication model mismatch: The communication primitives of the standard MPC protocol assume a fully connected or partially connected graph topology, while the network gateway provides a star or chain-like point-to-point connection.

[0007] Therefore, existing technologies cannot directly deploy multi-party secure computation in production environments with strict network isolation. The common practice is to aggregate all participants' data into the same security domain for computation, but this violates the compliance requirement that data should not leave the domain, or requires cumbersome network policy approvals and modifications, resulting in high implementation costs, long cycles, and poor flexibility.

[0008] In view of this, there is an urgent need for an innovative deployment solution that can adapt to the communication requirements of multi-party secure computing technology without changing the existing network gateway security strategy, so that it can be implemented in a highly secure isolated network environment. Summary of the Invention

[0009] This invention provides a method for multi-party secure computation in a gateway mode to solve the problem in the prior art that multi-party secure computation cannot be directly deployed in a production environment with strict gateway isolation.

[0010] To achieve the above objectives, the present invention provides a multi-party secure computation method under a network gateway mode. The method includes: S1, generating and storing network configuration information for each participant; the participants are at least three, each deployed in an independent network area, with network areas isolated by a network gateway device; S2, responding to the start command of the multi-party secure computation task, traversing all participant pairs (Pi, Pj) requiring communication connections, where i≠j; for each pair, participant Pi initiates a connection request based on its stored network configuration information, and the request is forwarded via the network gateway device to establish a unidirectional communication link from Pi to Pj; S3, establishing multiple unidirectional communication links based on step S2 to construct a virtual fully connected computing network covering all participants; S4, the task initiator distributes the computation task to the computing platform through any participant in the virtual fully connected computing network; S5, the computing platform coordinates secure multi-party collaborative computation among the participants through the virtual fully connected computing network according to the task.

[0011] Optionally, the network configuration information of each participant includes at least: a participant identifier party_id, and a gateway list gateway, wherein the gateway list gateway contains at least one gateway entry, and each gateway entry is used to define the gateway address addr to be used to connect to another specific participant Pj; the participant Pi initiates a connection request based on its own stored network configuration information, and establishes a one-way communication link from Pi to Pj by forwarding the request through the network gateway device. This includes: the participant Pi initiates a connection request to the specified gateway address based on the gateway entry in its own stored network configuration information with Pj as the target, and the connection request is forwarded through the network gateway device, eventually reaching the service endpoint of the participant Pj, thereby establishing a one-way communication link from Pi to Pj.

[0012] Optionally, the network configuration information of each participant may also include its own service address (service).

[0013] Optionally, the gateway addresses (addr) configured for the same pair of participants (Pi, Pj) and (Pj, Pi) are different, corresponding to unidirectional communication links traversing different network gateway devices.

[0014] Optionally, the virtual fully connected computing network consists of N participants connected by N×(N-1) unidirectional communication links, where N is the number of participants and N≥3.

[0015] On the other hand, the present invention provides a multi-party secure computing system under a network gateway mode. The system includes: a configuration management unit for generating and storing network configuration information for each participant; the participants are at least three, each deployed in an independent network area, and the network areas are isolated by a network gateway device; a single connection establishment unit for traversing all participant pairs (Pi, Pj) that need to establish a communication connection in response to the start command of the multi-party secure computing task, where i≠j, and for each pair, participant Pi initiates a connection request based on its stored network configuration information, and the request is forwarded by the network gateway device to establish a one-way communication link from Pi to Pj; a full connection establishment unit for establishing multiple one-way communication links based on the single connection establishment unit to construct a virtual full-connection computing network covering all participants; a task distribution unit for the task initiator to distribute computing tasks to the computing platform through any participant in the virtual full-connection computing network; and a computing coordination unit for the computing platform to coordinate the participants to perform secure multi-party collaborative computing according to the task through the virtual full-connection computing network.

[0016] Optionally, the network configuration information of each participant includes at least: a participant identifier party_id, and a gateway list gateway, wherein the gateway list gateway contains at least one gateway entry, and each gateway entry is used to define the gateway address addr to be used to connect to another specific participant Pj; the participant Pi initiates a connection request based on its own stored network configuration information, and establishes a one-way communication link from Pi to Pj by forwarding the request through the network gateway device. This includes: the participant Pi initiates a connection request to the specified gateway address based on the gateway entry in its own stored network configuration information with Pj as the target, and the connection request is forwarded through the network gateway device, eventually reaching the service endpoint of the participant Pj, thereby establishing a one-way communication link from Pi to Pj.

[0017] Optionally, the network configuration information of each participant may also include its own service address (service).

[0018] Optionally, the gateway addresses (addr) configured for the same pair of participants (Pi, Pj) and (Pj, Pi) are different, corresponding to unidirectional communication links traversing different network gateway devices.

[0019] Optionally, the virtual fully connected computing network consists of N participants connected by N×(N-1) unidirectional communication links, where N is the number of participants and N≥3.

[0020] The beneficial effects of this invention are: This invention provides a method and system for multi-party secure computation (MPC) under a gateway model. The invention creatively proposes a scheme that configures an independent gateway address for each communication pair, decomposing the "many-to-many" fully connected network required for MPC into multiple "point-to-point" unidirectional connections conforming to the gateway policy. This allows MPC technology to be directly deployed in the intranet environments of sensitive fields such as finance, government, and healthcare without altering the existing network security isolation architecture, meeting compliance and security requirements for data not leaving the domain and strong network isolation. Although the physical links are indirectly connected through multiple gateways, logically, a complete, fully connected network topology still exists from the perspective of the participating computing engines. The computing protocol itself does not require any modification and can run normally on this virtual network, greatly reducing the complexity and cost of technology adaptation. Attached Figure Description

[0021] Figure 1 This is a flowchart of a multi-party security calculation method under a network gateway mode provided by an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a multi-party security computing system under a network gateway mode provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of a communication model for secure multi-party computation in a normal network environment, provided by an embodiment of the present invention. Figure 4 This is a network connection diagram of a third-party secure computing deployment under the network gateway mode provided in an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0023] Figure 1 This is a flowchart of a multi-party security calculation method under a network gateway mode provided by an embodiment of the present invention, such as... Figure 1 As shown, the method includes: S1. Generate and store a network configuration information for each participant; there are at least three participants, each deployed in an independent network area, and the network areas are isolated from each other by a network gateway device; This embodiment uses the most common three-party secure computing scenario as an example to describe in detail the implementation of the present invention. Assume the three participants are organization A, organization B, and organization C, and their respective data center networks are isolated from each other via network gateways.

[0024] Organizations A, B, and C belong to three different security domains: Domain A, Domain B, and Domain C. These domains are connected via a network gateway device. Network Gateway _GW_AB: Manages data exchange between domain A and domain B, allowing only communication from a specific IP port of A to a specific IP port of B, and from another specific IP port of B to another specific IP port of A. Bidirectional communication must use separate channels.

[0025] Gateway_GW_BC: Manages data exchange between domain B and domain C, with similar rules.

[0026] Gateway_GW_CA: Manages data exchange between domain C and domain A, with similar rules.

[0027] Figure 3 This is a schematic diagram of a communication model for secure multi-party computation in a normal network environment, provided by an embodiment of the present invention. The "physical isolation, controllable switching" mode of the present invention completely prevents the establishment of connections between A, B, and C. Figure 3 The direct bidirectional fully connected interface shown is illustrated.

[0028] In an optional implementation, the network configuration information of each participant includes at least: a participant identifier party_id, and a gateway list gateway, wherein the gateway list gateway contains at least one gateway entry, and each gateway entry is used to define the gateway address addr to be used to connect to another specific participant Pj; In an optional implementation, the network configuration information of each participant may also include its own service address (service).

[0029] The following is an illustration through a specific example: The network configuration information of participant A is as follows: { “party_id”: “A”, "service": "10.0.1.100:9000", / / Service listening address of Party A “gateway”: [ { “party_id”: “B”, “addr_b1”: “203.0.113.1:7001” / / The peer address on the network gateway _GW_AB, used for connection between A and B. }, { “party_id”: “C”, “addr_c1”: “198.51.100.1:8001” / / Peer address on the gateway _GW_CA, used for connection A to C. } ] } The network configuration information of participant B is as follows: { “party_id”: “B”, "service": "10.0.2.100:9000", “gateway”: [ { “party_id”: “A”, “addr_a1”: “192.0.2.1:7002” / / Another address on the gateway _GW_AB, used for B to connect to A. }, { “party_id”: “C”, “addr_c2”: “203.0.113.2:6001” / / Address on the gateway _GW_BC, used for B to connect to C. } ] } The network configuration information of participant C is as follows: { “party_id”: “C”, "service": "10.0.3.100:9000", “gateway”: [ { “party_id”: “A”, “addr_a2”: “192.0.2.2:8002” / / Another address on the gateway _GW_CA, used for connection C to A. }, { “party_id”: “B”, “addr_b2”: “198.51.100.2:6002” / / Another address on the gateway _GW_BC, used for C to connect to B. } ] } S2. In response to the start command of the multi-party secure computation task, traverse all participating pairs (Pi, Pj) that need to establish a communication connection, where i≠j. For each pair, participating Pi initiates a connection request based on its own stored network configuration information, and the request is forwarded by the network gateway device to establish a one-way communication link from Pi to Pj. In an optional implementation, participant Pi initiates a connection request based on its stored network configuration information, and establishes a one-way communication link from Pi to Pj by forwarding the request through a network gateway device, including: Participant Pi initiates a connection request to the specified gateway address based on the gateway entry with Pj as the target in its stored network configuration information. The connection request is forwarded by the network gateway device and finally reaches the service endpoint of participant Pj, thereby establishing a one-way communication link from Pi to Pj.

[0030] Specifically, the service field is the entry address for other parties to connect to it. In a real gateway environment, this address may be an address that is reachable within the participating party's domain but is not visible to the outside. External connections can only reach the gateway's external network interface address (i.e., gateway.addr).

[0031] For the A→B connection, A uses the address 203.0.113.1:7001. This address is the external interface of the gateway _GW_AB on the B domain side. After the connection request reaches the gateway, it is forwarded to the service address (10.0.2.100:9000) of B according to the established policy.

[0032] S3. Based on step S2, establish multiple unidirectional communication links to construct a virtual fully connected computing network covering all participants; In one optional implementation, the gateway addresses (addr) configured for the same pair of participants (Pi, Pj) and (Pj, Pi) are different, each corresponding to a one-way communication link traversing different network gateway devices.

[0033] For the connection from B to A, B uses a completely different address, 192.0.2.1:7002, which is the external interface of the gateway _GW_AB on the A domain side. This demonstrates the unidirectional nature and channel independence of the gateway.

[0034] For the three participants, six unidirectional communication links need to be established, namely (A→B using addr_b1 address, B→A using addr_a1 address, A→C using addr_c1 address, C→A using addr_a2 address, B→C using addr_c2 address, C→B using addr_b2 address). Figure 4 This is a network connection diagram of a third-party secure computing deployment under the network gateway mode provided in an embodiment of the present invention, as shown below. Figure 4 As shown, a virtual fully connected computing network covering all participants is constructed.

[0035] S4. The task initiator distributes the computing task to the computing platform through any participant in the virtual fully connected computing network; S5. The computing platform coordinates secure multi-party collaborative computing among all participants through the virtual fully connected computing network according to the task.

[0036] The following example illustrates the computational task: A user initiates a joint statistical task through Organization A's portal system. The computing platform receives the request and parses the task into an MPC protocol description (e.g., input is private data from the three parties, output is the summation result). The computing platform then sends the detailed protocol description and parameters of the computing task to all participants via any established link (e.g., via the A→B link). Alternatively, it can distribute the task through broadcast or flooding within a virtual fully connected computing network.

[0037] Each participating party's MPC engine loads the protocol and begins executing specific multi-party secure computation algorithms. For example, a secret-sharing protocol might be implemented. Each participant splits its private input data into secret shares locally.

[0038] Party A needs to send the secret share to B through the A→B link and the secret share to C through the A→C link.

[0039] The same procedure applies to both Party B and Party C.

[0040] The computation process requires multiple rounds of interaction. In each round, each party sends messages through the corresponding outgoing link and receives messages through the incoming link. Since it is logically fully connected, the steps specified in the protocol as "send to all participants" or "send to a specific participant" can be mapped to a specific physical link for execution.

[0041] It works throughout the entire communication process, encrypting all MPC protocol messages transmitted on each link (such as using TLS or custom session key-based encryption) to ensure that even the network gateway cannot snoop on the data content, thus realizing a layered security model of "network gateway manages channel security, MPC manages data privacy".

[0042] Once the computation protocol is executed, each participant receives an encrypted fragment of the final result. Each participant then sends this encrypted fragment to the computation platform via a virtual fully connected computing network. The computation platform collects all encrypted fragments, reconstructs or decrypts them to obtain the final plaintext computation result, and returns the final result to the user who initiated the task.

[0043] In one alternative implementation, after the computation task is completed, the participants can either maintain the connection for subsequent tasks or close all connections according to a policy. The connection process will be repeated the next time a task is started.

[0044] In one optional implementation, the virtual fully connected computing network consists of N participants connected by N×(N-1) unidirectional communication links, where N is the number of participants and N≥3.

[0045] For example, in a four-party computation (A, B, C, D), participant A's gateway list will contain three entries, used to connect to B, C, and D respectively. Each entry points to a different gateway address pre-configured on the network gateway. The connection establishment process is similar to the three-party scenario, except that each participant needs to initiate (N-1) outbound connections and listen for (N-1) inbound connections. The resulting virtual network is a logically fully connected graph with N nodes.

[0046] This invention simulates full-connectivity communication capabilities across N parties using N×(N-1) pre-configured unidirectional links. All communication strictly follows the channels specified by the network gateway, adhering to the principle of "minimum openness" in network security, and ensuring complete audit logs. It is transparent to the upper-layer MPC protocol, requiring no protocol modification. This forms a dual guarantee of "network gateway channel security + MPC data privacy." This invention breaks down the deployment barriers between highly secure isolated network environments and cutting-edge privacy computing technologies.

[0047] Figure 2 This is a schematic diagram of the structure of a multi-party security computing system under a gateway mode provided in an embodiment of the present invention; as shown below. Figure 2 As shown, the system includes: The configuration management unit 201 is used to generate and store a copy of network configuration information for each participant; there are at least three participants, each of which is deployed in an independent network area, and the network areas are isolated from each other by a network gateway device. A single connection unit 202 is established to respond to the start command of the multi-party secure computing task, traverse all participating pairs (Pi, Pj) that need to establish a communication connection, where i≠j. For each pair, the participating party Pi initiates a connection request based on its own stored network configuration information, and forwards it through the network gateway device to establish a one-way communication link from Pi to Pj. A fully connected unit 203 is established to establish multiple unidirectional communication links based on the single connected unit, thereby constructing a virtual fully connected computing network covering all participants. The task distribution unit 204 is used by the task initiator to distribute the computing task to the computing platform through any participant in the virtual fully connected computing network; The coordination computing unit 205 is used by the computing platform to coordinate the participants to perform secure multi-party collaborative computing through the virtual fully connected computing network according to the task.

[0048] In an optional implementation, the network configuration information of each participant includes at least: a participant identifier party_id, and a gateway list gateway, wherein the gateway list gateway contains at least one gateway entry, and each gateway entry is used to define the gateway address addr to be used to connect to another specific participant Pj; The participant Pi initiates a connection request based on its stored network configuration information, and establishes a one-way communication link from Pi to Pj by forwarding the request through a network gateway device, including: Participant Pi initiates a connection request to the specified gateway address based on the gateway entry with Pj as the target in its stored network configuration information. The connection request is forwarded by the network gateway device and finally reaches the service endpoint of participant Pj, thereby establishing a one-way communication link from Pi to Pj.

[0049] In an optional implementation, the network configuration information of each participant may also include its own service address (service).

[0050] In one optional implementation, the gateway addresses (addr) configured for the same pair of participants (Pi, Pj) and (Pj, Pi) are different, each corresponding to a one-way communication link traversing different network gateway devices.

[0051] In one optional implementation, the virtual fully connected computing network consists of N participants connected by N×(N-1) unidirectional communication links, where N is the number of participants and N≥3.

[0052] The system of the present invention corresponds to the method described above, and the specific implementation of the system will not be repeated here.

[0053] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A multi-party security calculation method under a network gateway mode, characterized in that, The method includes: S1. Generate and store a network configuration information for each participant; there are at least three participants, each deployed in an independent network area, and the network areas are isolated from each other by a network gateway device; S2. In response to the start command of the multi-party secure computation task, traverse all participating pairs (Pi, Pj) that need to establish a communication connection, where i≠j. For each pair, participating Pi initiates a connection request based on its own stored network configuration information, and the request is forwarded by the network gateway device to establish a one-way communication link from Pi to Pj. S3. Based on step S2, establish multiple unidirectional communication links to construct a virtual fully connected computing network covering all participants; S4. The task initiator distributes the computing task to the computing platform through any participant in the virtual fully connected computing network; S5. The computing platform coordinates secure multi-party collaborative computing among all participants through the virtual fully connected computing network according to the task.

2. The method according to claim 1, characterized in that: The network configuration information for each participant includes at least: a participant identifier party_id, and a gateway list gateway, wherein the gateway list gateway contains at least one gateway entry, and each gateway entry is used to define the gateway address addr that should be used to connect to another specific participant Pj; The participant Pi initiates a connection request based on its stored network configuration information, and establishes a one-way communication link from Pi to Pj by forwarding the request through a network gateway device, including: Participant Pi initiates a connection request to the specified gateway address based on the gateway entry with Pj as the target in its stored network configuration information. The connection request is forwarded by the network gateway device and finally reaches the service endpoint of participant Pj, thereby establishing a one-way communication link from Pi to Pj.

3. The method according to claim 2, characterized in that: The network configuration information of each participant also includes its own service address (service).

4. The method according to claim 2, characterized in that: The gateway addresses (addr) configured for the same pair of participants (Pi, Pj) and (Pj, Pi) are different, corresponding to unidirectional communication links traversing different network gateway devices.

5. The method according to claim 1, characterized in that: The virtual fully connected computing network consists of N participants connected by N×(N-1) unidirectional communication links, where N is the number of participants and N≥3.

6. A multi-party security computing system under a network gateway mode, characterized in that, The system includes: A configuration management unit is used to generate and store a copy of network configuration information for each participant; there are at least three participants, each deployed in an independent network area, and the network areas are isolated from each other by a network gateway device; A single connection unit is established to respond to the start command of the multi-party secure computing task. It traverses all participating pairs (Pi, Pj) that need to establish a communication connection, where i≠j. For each pair, the participating party Pi initiates a connection request based on its own stored network configuration information, and the request is forwarded by the network gateway device to establish a one-way communication link from Pi to Pj. Establish a fully connected unit, which is used to establish multiple unidirectional communication links based on the single connected unit, and construct a virtual fully connected computing network covering all participants; The task distribution unit is used by the task initiator to distribute the computing task to the computing platform through any participant in the virtual fully connected computing network; The coordination computing unit is used by the computing platform to coordinate secure multi-party collaborative computing among all participants through the virtual fully connected computing network according to the task.

7. The system according to claim 6, characterized in that: The network configuration information for each participant includes at least: a participant identifier party_id, and a gateway list gateway, wherein the gateway list gateway contains at least one gateway entry, and each gateway entry is used to define the gateway address addr that should be used to connect to another specific participant Pj; The participant Pi initiates a connection request based on its stored network configuration information, and establishes a one-way communication link from Pi to Pj by forwarding the request through a network gateway device, including: Participant Pi initiates a connection request to the specified gateway address based on the gateway entry with Pj as the target in its stored network configuration information. The connection request is forwarded by the network gateway device and finally reaches the service endpoint of participant Pj, thereby establishing a one-way communication link from Pi to Pj.

8. The system according to claim 7, characterized in that: The network configuration information of each participant also includes its own service address (service).

9. The system according to claim 7, characterized in that: The gateway addresses (addr) configured for the same pair of participants (Pi, Pj) and (Pj, Pi) are different, corresponding to unidirectional communication links traversing different network gateway devices.

10. The system according to claim 6, characterized in that: The virtual fully connected computing network consists of N participants connected by N×(N-1) unidirectional communication links, where N is the number of participants and N≥3.

Images