Multi-party secure division

Abstract

The embodiment of the invention discloses a multi-party security division method, which relates to n parties, n is a positive integer not less than 3, and each party holds a dividend fragment and a divisor fragment. Any calculation participant can cooperate with the other n-1 parties based on the local fragment of the dividend absolute value and the local fragment of the divisor absolute value, and the local fragment of the quotient absolute value is obtained through one or more rounds of processing. And furthermore, any calculation participant can cooperate with the other n-1 parties based on the local fragment of the quotient absolute value, the local fragment identified by the dividend symbol and the local fragment identified by the divisor symbol to obtain the local fragment of the quotient.

Description

Multi-party security division case explanation

[0001] This application is a divisional application filed in respect of the parent application with application number 202210391889.5, entitled "Multi-party Secure Division". Technical Field

[0002] This specification relates to the field of information security technology, and in particular to a multi-party security division method. Background Technology

[0003] In the era of big data, machine learning is being used more and more widely. Although machine learning models can provide users with convenient prediction services, training and / or prediction of machine learning models in plaintext mode carries the risk of exposing private data.

[0004] Implementing a machine learning framework in encrypted form, i.e., implementing a secure machine learning framework, requires providing a robust underlying protocol. Summary of the Invention

[0005] One embodiment of this specification provides a multi-party secure multiplication involving n parties, where n is a positive integer not less than 3. Each party holds a slice of a first multiplier and a slice of a second multiplier. The multiplication is performed by one of the parties and includes: transmitting local slices of the first multiplier and the second multiplier to the other party or other parties; obtaining other slices of the first multiplier and the second multiplier from the other party or other parties, wherein the number of other parties is not greater than n-2; multiplying the local slices of the first multiplier and the second multiplier to obtain a local product term; multiplying the local slices of the first multiplier and the other slices of the second multiplier respectively to obtain one or more first cross terms; multiplying the local slices of the second multiplier and the other slices of the first multiplier respectively to obtain one or more second cross terms; and obtaining a local slice of the product of the first multiplier and the second multiplier based on the local product term, the one or more first cross terms, and the one or more second cross terms.

[0006] One embodiment of this specification provides a multi-party secure multiplication system involving n parties, where n is a positive integer not less than 3. Each party holds a slice of a first multiplier and a slice of a second multiplier. The system is implemented in one of the parties and includes a multiplier slice sending module, a multiplier slice receiving module, a local product term calculation module, a first cross term calculation module, a second cross term calculation module, and a multiplier slice calculation module. The multiplier slice sending module is used to send the local slices of the first multiplier and the second multiplier to the other parties or other parties. The multiplier slice receiving module is used to receive other slices of the first multiplier and the second multiplier from the other parties or other parties. The number of other parties is not greater than n-2. The local product term calculation module is used to multiply the local slices of the first multiplier and the second multiplier to obtain a local product term. The first cross term calculation module is used to multiply the local slices of the first multiplier and the other slices of the second multiplier respectively to obtain one or more first cross terms. The second cross-term calculation module is used to multiply the local fragments of the second multiplier with other fragments of the first multiplier to obtain one or more second cross-terms. The multiplication fragment calculation module is used to obtain the local fragments of the product of the first multiplier and the second multiplier based on the local product fragments, the one or more first cross-terms, and the one or more second cross-terms.

[0007] One embodiment of this specification provides a multi-party secure multiplication apparatus, including a processor and a storage device, wherein the storage device is used to store instructions, wherein when the processor executes the instructions, multi-party secure multiplication as described in any embodiment of this specification is implemented.

[0008] One embodiment of this specification provides a multi-party secure comparison method involving n parties, where n is a positive integer not less than 3. Each party holds a slice of a first number and a slice of a second number. The method is executed by one of the parties and includes: obtaining a local slice of a first selected random number, a local slice of a second selected random number, and a local slice of a masked random number; the first selected random number is related to the second selected random number; obtaining a local slice of a first comparison function, which reflects the difference between the first number and the second number; obtaining a local slice of a second comparison function, which reflects the difference between the second number and the first number; based on the local slice of the first selected random number and the local slice of the first comparison function, in collaboration with the other n-1 parties, obtaining a local slice of the first product of the first selected random number and the first comparison function through multi-party secure multiplication as described in any embodiment of this specification; based on the local slice of the second selected random number and the local slice of the second comparison function, in collaboration with the other n-1 parties, obtaining a local slice of the second product of the first selected random number and the first comparison function through multi-party secure multiplication as described in any embodiment of this specification; and based on the local slice of the second selected random number and the local slice of the second comparison function, obtaining a local slice of the second product of the first selected random number and the first comparison function through multi-party secure multiplication as described in any embodiment of this specification. Local slices of the second product of a random number and a second comparison function are selected; based on the local slices of the first product and the second product, local slices of the target difference are obtained; based on the local slices of the target difference and the local slices of the masked random number, in collaboration with the remaining n-1 parties, local slices of intermediate products are obtained through multi-party secure multiplication as described in any embodiment of this specification, wherein the intermediate product is equal to the product of the target difference and the masked random number; based on the local slices of the intermediate product, in collaboration with the remaining n-1 parties, the intermediate product is revealed; when the intermediate product is greater than 0, based on the local slices of the first selected random number and the local slices of the second preset value, in collaboration with the remaining n-1 parties, local slices of the XOR result of the first selected random number and the second preset value are obtained, and this is used as the local slice of the result identifier; otherwise, based on the local slices of the first selected random number and the local slices of the first preset value, in collaboration with the remaining n-1 parties, local slices of the XOR result of the first selected random number and the first preset value are obtained, and this is used as the local slice of the result identifier. The first preset value is equal to 1, the second preset value is equal to 0, when the result identifier is equal to 1, it indicates that the first number is not less than the second number, and when the result identifier is equal to 0, it indicates that the first number is less than the second number.

[0009] One embodiment of this specification provides a multi-party secure comparison system involving n parties, where n is a positive integer not less than 3. Each party holds a slice of a first number and a slice of a second number. The system is implemented in one of the parties and includes a random number slice acquisition module, a first comparison function slice acquisition module, a second comparison function slice acquisition module, a first product calculation module, a second product calculation module, a target difference calculation module, an intermediate product calculation module, an intermediate product disclosure module, and a result identification calculation module. The random number slice acquisition module is used to acquire local slices of a first selected random number, local slices of a second selected random number, and local slices of a masked random number, wherein the first selected random number is related to the second selected random number. The first comparison function slice acquisition module is used to acquire local slices of a first comparison function, which reflects the difference between the first number and the second number. The second comparison function slice acquisition module is used to acquire local slices of a second comparison function, which reflects the difference between the second number and the first number. The first product calculation module, in collaboration with the remaining n-1 parties, uses a local partition based on a first selected random number and a local partition based on a first comparison function to obtain a local partition of the first product of the first selected random number and the first comparison function through a multi-party secure multiplication as described in any embodiment of this specification. The second product calculation module, in collaboration with the remaining n-1 parties, uses a local partition based on a second selected random number and a local partition based on a second comparison function to obtain a local partition of the second product of the second selected random number and the second comparison function through a multi-party secure multiplication as described in any embodiment of this specification. The target difference calculation module is used to obtain a local partition of the target difference based on the local partitions of the first product and the second product. The intermediate product calculation module, in collaboration with the remaining n-1 parties, uses a multi-party secure multiplication as described in any embodiment of this specification to obtain a local partition of the intermediate product, where the intermediate product is equal to the product of the target difference and the masked random number. The intermediate product disclosure module is used to disclose the intermediate product in collaboration with the other n-1 parties based on the local fragment of the intermediate product. The result identifier calculation module is used to: when the intermediate product is greater than 0, based on the local fragment of the first selected random number and the local fragment of the second preset value, in collaboration with the other n-1 parties, obtain the local fragment of the XOR result of the first selected random number and the second preset value, and use it as the local fragment of the result identifier; otherwise, based on the local fragment of the first selected random number and the local fragment of the first preset value, in collaboration with the other n-1 parties, obtain the local fragment of the XOR result of the first selected random number and the first preset value, and use it as the local fragment of the result identifier. The first preset value is equal to 1, and the second preset value is equal to 0. When the result identifier is equal to 1, it indicates that the first number is not less than the second number; when the result identifier is equal to 0, it indicates that the first number is less than the second number.

[0010] One embodiment of this specification provides a multi-party secure comparison apparatus, including a processor and a storage device, wherein the storage device is used to store instructions, wherein when the processor executes the instructions, it implements the multi-party secure comparison method as described in any embodiment of this specification.

[0011] One embodiment of this specification provides a multi-party secure method for calculating the natural exponential function, involving n parties, where n is a positive integer not less than 3. Each party holds a slice of a first number. The method is executed by one of the parties and includes: obtaining other slices of the first number from the remaining k parties, where k is not greater than n-2; summing the local slice of the first number and the k other slices to obtain a first recombined slice of the first number; calculating the natural exponential function value of the first recombined slice of the first number to obtain a first natural exponential function value, where the natural exponential function value of the number is the output value of the natural exponential function with the number as the input value; splitting the first natural exponential function value into n parts and distributing n-1 of them. For the remaining n-1 parties, the remaining 1 part is used as a local slice of the first natural exponential function value; the slice of the second natural exponential function value is obtained from the remaining parties and used as a local slice of the second natural exponential function value. The second natural exponential function value is equal to the natural exponential function value of the second recombined slice of the first number. The second recombined slice of the first number is equal to the sum of the other slices of the first number for the remaining n-(1+k) parties; based on the local slice of the first natural exponential function value and the local slice of the second natural exponential function value, in cooperation with the remaining n-1 parties, a local slice of the natural exponential function value of the first number is obtained through multi-party secure multiplication as described in any embodiment of this specification.

[0012] One embodiment of this specification provides a multi-party secure natural exponential function calculation system involving n parties, where n is a positive integer not less than 3. Each party holds a slice of a first number. The system is implemented in one of the parties and includes a first number slice acquisition module, a first recombination module, a first natural exponential function calculation module, a first secret sharing module, a second natural exponential function value slice acquisition module, and a second natural exponential function calculation module. The first number slice acquisition module is used to acquire other slices of the first number from the remaining k parties, where k is not greater than n-2. The first recombination module is used to sum the local slice of the first number and the k other slices to obtain a first recombination slice of the first number. The first natural exponential function calculation module is used to calculate the natural exponential function value of the first recombination slice of the first number to obtain the first natural exponential function value, where the natural exponential function value of the number is the output value of the natural exponential function with the number as input. The first secret sharing module is used to split the first natural exponential function value into n parts, distribute n-1 parts to the remaining n-1 parties, and use the remaining 1 part as a local slice of the first natural exponential function value. The second natural exponential function value fragmentation module is used to obtain fragments of the second natural exponential function value from the remaining parties, as local fragments of the second natural exponential function value. The second natural exponential function value is equal to the natural exponential function value of the second recombined fragment of the first number, and the second recombined fragment of the first number is equal to the sum of the other fragments of the first number in the remaining n-(1+k) parties. The second natural exponential function calculation module is used to obtain local fragments of the natural exponential function value of the first number based on the local fragments of the first natural exponential function value and the local fragments of the second natural exponential function value, in cooperation with the remaining n-1 parties, through multi-party secure multiplication as described in any embodiment of this specification.

[0013] One embodiment of this specification provides a multi-party secure natural exponential function calculation apparatus, including a processor and a storage device. The storage device is used to store instructions, wherein when the processor executes the instructions, it implements the multi-party secure natural exponential function calculation method as described in any embodiment of this specification.

[0014] One embodiment of this specification provides a method for calculating a multi-party secure linear rectifier function, involving n parties, where n is a positive integer not less than 3. Each party holds a slice of a first number. The method is executed by one of the parties and includes: based on the local slice of the first number and the local slice of the second preset value, in cooperation with the other n-1 parties, obtaining a local slice of the comparison result through a multi-party secure comparison method as described in any embodiment of this specification, where the second preset value is equal to 0; based on the local slice of the first number and the local slice of the comparison result, in cooperation with the other n-1 parties, obtaining a local slice of the product result of the first number and the comparison result through a multi-party secure multiplication as described in any embodiment of this specification, and using the local slice of the product result as a local slice of the function value, where the function value is the output value of the linear rectifier function with the first number as the input value.

[0015] One embodiment of this specification provides a multi-party secure linear rectifier function calculation system involving n parties, where n is a positive integer not less than 3. Each party holds a slice of a first number. The system is implemented in one of the parties and includes a first secure comparison module and a first secure multiplication module. The first secure comparison module, in collaboration with the other n-1 parties, obtains a slice of the comparison result based on a local slice of the first number and a local slice of a second preset value, using the multi-party secure comparison method described in any embodiment of this specification. The second preset value is equal to 0. The first secure multiplication module, in collaboration with the other n-1 parties, obtains a slice of the product of the first number and the comparison result based on a local slice of the first number and a local slice of the comparison result, using the multi-party secure multiplication method described in any embodiment of this specification. The slice of the product result is then used as a slice of the function value, where the function value is the output value of the linear rectifier function with the first number as the input value.

[0016] One embodiment of this specification provides a multi-party secure linear rectified function calculation device, including a processor and a storage device. The storage device is used to store instructions, and when the processor executes the instructions, it implements the multi-party secure linear rectified function calculation method as described in any embodiment of this specification.

[0017] One embodiment of this specification provides a multi-party secure division method involving n parties, where n is a positive integer not less than 3. Each party holds a slice of the dividend and a slice of the divisor. The division is performed by one of the parties, including: based on the local slices of the dividend and the divisor respectively, cooperating with the other n-1 parties, through a multi-party secure symbol protocol to determine the local slices identified by the dividend symbol and the divisor symbol; based on the local slices of the dividend and the divisor respectively, cooperating with the other n-1 parties, through a multi-party secure absolute value protocol to determine the local slices of the absolute value of the dividend and the absolute value of the divisor; based on the local slices of the absolute value of the dividend and the divisor respectively, cooperating with the other n-1 parties, through one or more rounds of processing to obtain the local slice of the absolute value of the quotient; based on the local slices of the absolute value of the quotient, the local slices identified by the dividend symbol, and the local slices identified by the divisor symbol, cooperating with the other n-1 parties to obtain the local slice of the quotient. One round of processing includes the following steps: when the precision meets a preset condition, the following steps are executed; otherwise, the current round of processing ends: Based on the local partitions of the absolute value of the dividend and the absolute value of the divisor, in collaboration with the other n-1 parties, a multi-party secure comparison protocol is used to determine whether the absolute value of the dividend is less than the absolute value of the divisor; when the absolute value of the dividend is not less than the absolute value of the divisor, the local partitions of the absolute value of the dividend and the absolute value of the quotient are not updated; otherwise, one or more updates are performed until the absolute value of the dividend is not less than the absolute value of the divisor or the precision no longer meets the preset condition: the local partition of the absolute value of the dividend is updated so that the dividend... The absolute value is multiplied, and the local fragment of the quotient absolute value is updated to increase the quotient absolute value to the same multiple, thus updating the precision number. Based on the local fragments of the dividend absolute value and the divisor absolute value, in collaboration with the other n-1 parties, a multi-party secure decomposition protocol is used to obtain the local fragments of the multiple and the local fragments of the remainder, wherein the multiple multiplied by the divisor absolute value and the remainder added equals the dividend absolute value. The local fragments of the multiple are accumulated into the local fragment of the quotient absolute value, thereby updating the local fragment of the quotient absolute value again. The local fragment based on the remainder is used as the local fragment of the dividend absolute value after the second update.

[0018] One embodiment of this specification provides a multi-party secure division system involving n parties, where n is a positive integer not less than 3. Each party holds a slice of the dividend and a slice of the divisor. The system is implemented in one of the parties and includes a sign determination module, an absolute value determination module, a quotient absolute value calculation module, and a quotient restoration module. The sign determination module, in collaboration with the other n-1 parties, determines the local slices identified by the dividend's sign and the divisor's sign, respectively, based on the local slices of the dividend and the divisor, through a multi-party secure sign protocol. The absolute value determination module, in collaboration with the other n-1 parties, determines the local slices of the absolute values ​​of the dividend and the divisor, respectively, based on the local slices of the dividend and the divisor, through a multi-party secure absolute value protocol. The quotient absolute value calculation module, in collaboration with the other n-1 parties, obtains the local slice of the absolute value of the quotient through one or more rounds of processing, based on the local slices of the absolute values ​​of the dividend and the divisor. The quotient restoration module is used to obtain the local quotient fragment based on the local fragment of the absolute value of the quotient, the local fragment identified by the sign of the dividend, and the local fragment identified by the sign of the divisor, in collaboration with the other n-1 parties. One round of processing includes the following steps: if the precision meets a preset condition, execute the following steps; otherwise, end the current round of processing: based on the local fragments of the absolute value of the dividend and the absolute value of the divisor, in collaboration with the other n-1 parties, determine whether the absolute value of the dividend is less than the absolute value of the divisor through a multi-party secure comparison protocol; if the absolute value of the dividend is not less than the absolute value of the divisor, do not update the local fragments of the absolute value of the dividend and the absolute value of the quotient; otherwise, perform one or more updates as follows until the absolute value of the dividend is not less than the absolute value of the divisor or the precision no longer meets the preset condition: update the local fragment of the absolute value of the dividend so that the dividend... The absolute value is multiplied, and the local fragment of the quotient absolute value is updated to increase the quotient absolute value to the same multiple, thus updating the precision number. Based on the local fragments of the dividend absolute value and the divisor absolute value, in collaboration with the other n-1 parties, a multi-party secure decomposition protocol is used to obtain the local fragments of the multiple and the local fragments of the remainder, wherein the multiple multiplied by the divisor absolute value and the remainder added equals the dividend absolute value. The local fragments of the multiple are accumulated into the local fragment of the quotient absolute value, thereby updating the local fragment of the quotient absolute value again. The local fragment based on the remainder is used as the local fragment of the dividend absolute value after the second update.

[0019] One embodiment of this specification provides a multi-party safe division apparatus, including a processor and a storage device, wherein the storage device is used to store instructions, wherein when the processor executes the instructions, it implements the multi-party safe division as described in any embodiment of this specification.

[0020] One embodiment of this specification provides a method for multi-party secure calculation of absolute value, involving n parties, where n is a positive integer not less than 3. Each party holds a slice of the target number. The method is executed by one of the parties and includes: based on the local slice of the target number and the local slice of a first preset value, cooperating with the other n-1 parties to obtain a local slice with a result identifier through a multi-party secure comparison protocol, wherein the result identifier indicates whether the target number is negative; based on the local slice of the target number and the local slice of the result identifier, cooperating with the other n-1 parties to obtain a local slice of the absolute value of the target number through a multi-party secure multiplication protocol.

[0021] One embodiment of this specification provides a system for securely calculating the absolute value of a multi-party number, involving n parties, where n is a positive integer not less than 3. Each party holds a slice of the target number. The system is implemented in one of the parties and includes a result identifier calculation module and an absolute value calculation module. The result identifier calculation module, based on the local slice of the target number and a local slice of a first preset value, collaborates with the other n-1 parties to obtain the local slice of the result identifier through a multi-party secure comparison protocol. The result identifier indicates whether the target number is negative. The absolute value calculation module, based on the local slice of the target number and the local slice of the result identifier, collaborates with the other n-1 parties to obtain the local slice of the absolute value of the target number through a multi-party secure multiplication protocol.

[0022] One embodiment of this specification provides an apparatus for securely calculating the absolute value of multiple parties, including a processor and a storage device. The storage device is used to store instructions, wherein when the processor executes the instructions, it implements the method for securely calculating the absolute value of multiple parties as described in any embodiment of this specification.

[0023] One embodiment of this specification provides a multi-party secure decomposition method involving n parties, where n is a positive integer not less than 3. Each party holds a slice of a first number and a slice of a second number. The method is executed by one of the parties and includes m+1 rounds of looping, where m is a positive integer. Each round of looping includes: determining the local slice of the current multiple in the current round; based on the local slice of the current multiple and the local slice of the second number, cooperating with the other n-1 parties, and obtaining the local slice of the intermediate product through a multi-party secure multiplication protocol, where the intermediate product is equal to the current multiple multiplied by the second number. Based on the local fragments of the intermediate product and the local fragment of the first number, in collaboration with the remaining n-1 parties, a local fragment with a result identifier is obtained through a multi-party secure comparison protocol. The result identifier indicates whether the intermediate product is less than the first number. Based on the local fragment with the result identifier, in collaboration with the remaining n-1 parties, the result identifier is revealed. When the result identifier indicates that the intermediate product is less than the first number, the local fragment of the current multiple is added to the local fragment of the target multiple. Furthermore, the local fragment of the intermediate product is subtracted from the local fragment of the first number, thereby updating the local fragment of the first number. The local fragment of the target multiple and the updated local fragment of the first number are used as the local fragment of the multiple and the local fragment of the remainder, respectively, where the multiple multiplied by the second number plus the remainder equals the first number.

[0024] One embodiment of this specification provides a multi-party secure decomposition system involving n parties, where n is a positive integer not less than 3. Each party holds a slice of a first number and a slice of a second number. The system is implemented in one party and includes a decomposition module for executing m+1 rounds of iteration, where m is a positive integer. Each round of iteration includes: determining the local slice of the current multiple of the current round; based on the local slice of the current multiple and the local slice of the second number, cooperating with the other n-1 parties, and obtaining the local slice of the intermediate product through a multi-party secure multiplication protocol, where the intermediate product is equal to the current multiple multiplied by 1 / 2. The second number; based on the local fragments of the intermediate product and the local fragments of the first number, in collaboration with the remaining n-1 parties, obtains a local fragment with a result identifier through a multi-party secure comparison protocol. The result identifier indicates whether the intermediate product is less than the first number. Based on the local fragments of the result identifier, in collaboration with the remaining n-1 parties, the result identifier is revealed. When the result identifier indicates that the intermediate product is less than the first number, the local fragments of the current multiple are added to the local fragments of the target multiple. And, the local fragments of the first number are subtracted from the local fragments of the intermediate product, thereby updating the local fragments of the first number. The local fragments of the target multiple of the last round of the loop and the updated local fragments of the first number are respectively used as the local fragments of the multiple and the local fragments of the remainder, wherein the multiple multiplied by the second number plus the remainder equals the first number.

[0025] One embodiment of this specification provides a multi-party secure decomposition apparatus, including a processor and a storage device, wherein the storage device is used to store instructions, wherein when the processor executes the instructions, it implements a multi-party secure absolute value calculation method as described in any embodiment of this specification.

[0026] One embodiment of this specification provides a multi-party secure Sigmoid function calculation method involving n parties, where n is a positive integer not less than 3. Each party holds a slice of a first number. The method is executed by one of the parties and includes: calculating the difference between the local slice of a first preset value and the local slice of the first number to obtain a local slice of the first opposite number, where the first preset value is equal to 0; based on the local slice of the first opposite number, in collaboration with the other n-1 parties, obtaining a local slice of the natural exponential function value of the first opposite number through a multi-party secure natural exponential function calculation method; calculating the sum of the local slice of a third preset value and the local slice of the natural exponential function value of the first opposite number to obtain a local slice of the intermediate sum; based on the local slice of the third preset value and the local slice of the intermediate sum, in collaboration with the other n-1 parties, obtaining a local slice of the Sigmoid function value of the first number through multi-party secure division as described in any embodiment of this specification, where the Sigmoid function value of the first number is the output value of the Sigmoid function with the first number as input, which is equal to the third preset value divided by the intermediate sum, where the third preset value is equal to 1.

[0027] One embodiment of this specification provides a multi-party secure Sigmoid function calculation system involving n parties, where n is a positive integer not less than 3. Each party holds a slice of a first number. The system is implemented in one of the parties and includes a first negative number calculation module, a third natural exponential function calculation module, an intermediate sum calculation module, and a Sigmoid function value calculation module. The first negative number calculation module calculates the difference between the local slice of a first preset value and the local slice of the first number to obtain the local slice of the first negative number, where the first preset value is equal to 0. The third natural exponential function calculation module, based on the local slice of the first negative number, collaborates with the other n-1 parties to obtain the local slice of the natural exponential function value of the first negative number using a multi-party secure natural exponential function calculation method. The intermediate sum calculation module calculates the sum of the local slice of the third preset value and the local slice of the natural exponential function value of the first negative number to obtain the local slice of the intermediate sum. The Sigmoid function value calculation module is used to, in collaboration with the other n-1 parties, obtain the local slice of the Sigmoid function value of the first number through multi-party secure division as described in any embodiment of this specification, based on the local slice of the third preset value and the local slice of the intermediate sum value. The Sigmoid function value of the first number is the output value of the Sigmoid function when the first number is the input value, which is equal to the third preset value divided by the intermediate sum value, where the third preset value is equal to 1.

[0028] One embodiment of this specification provides a multi-party secure Sigmoid function calculation device, including a processor and a storage device, wherein the storage device is used to store instructions, wherein when the processor executes the instructions, it implements the Sigmoid function calculation method as described in any embodiment of this specification.

[0029] One embodiment of this specification provides a multi-party secure Tanh function calculation method involving n parties, where n is a positive integer not less than 3. Each party holds a slice of a first number. The method is executed by one of the parties and includes: calculating the difference between the local slice of a first preset value and the local slice of the first number to obtain the local slice of the first opposite number, where the first preset value is equal to 0; based on the local slice of the first number, collaborating with the other n-1 parties, obtaining the local slice of the natural exponential function value of the first number through a multi-party secure natural exponential function calculation method; and based on the local slice of the first opposite number, collaborating with the other n-1 parties, obtaining the local slice of the natural exponential function value of the first opposite number through a multi-party secure natural exponential function calculation method. The local partitioning is performed as follows: The difference between the local partition of the natural exponential function value of the first number and the local partition of the natural exponential function value of the first opposite number is calculated to obtain the local partition of the intermediate difference; the sum of the local partitions of the natural exponential function value of the first number and the local partitions of the natural exponential function value of the first opposite number is calculated to obtain the local partition of the intermediate sum; based on the local partition of the intermediate difference and the local partition of the intermediate sum, in cooperation with the remaining n-1 parties, the local partition of the Tanh function value of the first number is obtained through multi-party secure division as described in any embodiment of this specification, wherein the Tanh function value of the first number is the output value when the first number is used as the input value of the Tanh function, which is equal to the intermediate difference divided by the intermediate sum.

[0030] One embodiment of this specification provides a multi-party secure Tanh function calculation system involving n parties, where n is a positive integer not less than 3. Each party holds a slice of a first number. The system is implemented in one of the parties and includes a first negative number calculation module, a fourth natural exponential function calculation module, a third natural exponential function calculation module, an intermediate difference calculation module, an intermediate sum calculation module, and a Tanh function calculation module. The first negative number calculation module calculates the difference between the local slice of a first preset value and the local slice of the first number to obtain the local slice of the first negative number, where the first preset value is equal to 0. The fourth natural exponential function calculation module, based on the local slice of the first number, collaborates with the other n-1 parties to obtain the local slice of the natural exponential function value of the first number using a multi-party secure natural exponential function calculation method. The third natural exponential function calculation module, based on the local slice of the first negative number, collaborates with the other n-1 parties to obtain the local slice of the natural exponential function value of the first negative number using a multi-party secure natural exponential function calculation method. The intermediate difference calculation module is used to calculate the difference between the local slice of the natural exponential function value of the first number and the local slice of the natural exponential function value of the first opposite number, to obtain the local slice of the intermediate difference. The intermediate sum calculation module is used to calculate the sum of the local slice of the natural exponential function value of the first number and the local slice of the natural exponential function value of the first opposite number, to obtain the local slice of the intermediate sum. The Tanh function calculation module is used, based on the local slice of the intermediate difference and the local slice of the intermediate sum, in cooperation with the other n-1 parties, to obtain the local slice of the Tanh function value of the first number through multi-party secure division as described in any embodiment of this specification. The Tanh function value of the first number is the output value when the first number is used as the input value of the Tanh function, which is equal to the intermediate difference divided by the intermediate sum.

[0031] One embodiment of this specification provides a multi-party secure Tanh function calculation device, including a processor and a storage device, wherein the storage device is used to store instructions, wherein when the processor executes the instructions, it implements the Tanh function calculation method as described in any embodiment of this specification.

[0032] One embodiment of this specification provides a multi-party secure unsigned number division method involving n parties, where n is a positive integer not less than 3. Each party holds a slice of the dividend and a slice of the divisor. Both the dividend and the divisor are unsigned numbers. The division is performed by one party, including obtaining a local slice of the quotient through one or more rounds of processing. One round of processing includes the following steps when the precision meets a preset condition, otherwise ending the current round of processing: Based on the local slices of the dividend and the divisor, in collaboration with the other n-1 parties, a multi-party secure comparison protocol is used to determine whether the dividend is less than the divisor; if the dividend is not less than the divisor, the local slices of the dividend and the quotient are not updated; otherwise, one or more updates are performed until the dividend is not less than the divisor or the precision no longer meets the preset condition: the local slice of the dividend is updated to make the dividend multiple. Expand and update the local fragment of the quotient to make the quotient expand to the same multiple, and update the precision number; based on the local fragments of the dividend and the divisor, in cooperation with the other n-1 parties, obtain the local fragments of the multiple and the local fragments of the remainder through a multi-party secure decomposition protocol, wherein the multiple multiplied by the divisor and the remainder equals the dividend; accumulate the local fragments of the multiple into the local fragments of the quotient, thereby updating the local fragments of the quotient again; the local fragments based on the remainder are used as the local fragments of the dividend after the second update.

[0033] One embodiment of this specification provides a multi-party secure unsigned number division system involving n parties, where n is a positive integer not less than 3. Each party holds a slice of the dividend and a slice of the divisor. Both the dividend and the divisor are unsigned numbers. The system is implemented in one of the parties, including a quotient calculation module, used to obtain the local slice of the quotient through one or more rounds of processing. One round of processing includes the following steps when the precision meets a preset condition, otherwise ending the current round of processing: Based on the local slices of the dividend and the divisor, in collaboration with the other n-1 parties, a multi-party secure comparison protocol is used to determine whether the dividend is less than the divisor; if the dividend is not less than the divisor, the local slices of the dividend and the quotient are not updated; otherwise, one or more updates are performed until the dividend is not less than the divisor or the precision no longer meets the preset condition: the local slice of the dividend is updated to make the dividend multiple. Expand and update the local fragment of the quotient to make the quotient expand to the same multiple, and update the precision number; based on the local fragments of the dividend and the divisor, in cooperation with the other n-1 parties, obtain the local fragments of the multiple and the local fragments of the remainder through a multi-party secure decomposition protocol, wherein the multiple multiplied by the divisor and the remainder equals the dividend; accumulate the local fragments of the multiple into the local fragments of the quotient, thereby updating the local fragments of the quotient again; the local fragments based on the remainder are used as the local fragments of the dividend after the second update.

[0034] One embodiment of this specification provides a multi-party secure unsigned number division apparatus, including a processor and a storage device, wherein the storage device is used to store instructions, wherein when the processor executes the instructions, it implements multi-party secure unsigned number division as described in any embodiment of this specification. Attached Figure Description

[0035] This specification will be further described by way of exemplary embodiments, which will be described in detail with reference to the accompanying drawings. These embodiments are not limiting; in these embodiments, the same reference numerals denote the same structures, wherein: Figure 1 is a schematic diagram of an application scenario of multi-party secure computation according to some embodiments of this specification; Figure 2 is an exemplary flowchart of multi-party secure multiplication according to some embodiments of this specification; Figure 3 is an exemplary flowchart of a multi-party secure comparison method according to some embodiments of this specification; Figure 4 is an exemplary flowchart of a multi-party secure natural exponential function calculation method according to some embodiments of this specification; Figure 5 is an exemplary flowchart of a multi-party secure linear rectified function calculation method according to some embodiments of this specification; Figure 6 is an exemplary flowchart of a multi-party secure linear rectified function calculation method according to some embodiments of this specification; Figure 6 is an exemplary flowchart of a multi-party secure linear rectified function calculation method according to some embodiments of this specification; Figure 7 is an exemplary flowchart of a multi-party secure natural exponential function calculation method according to some embodiments of this specification; Figure 8 is an exemplary flowchart of a multi-party secure linear rectified function calculation method according to some embodiments of this specification; Figure 9 is an exemplary flowchart of a multi-party secure linear rectified function calculation method according to some embodiments of this specification; Figure 1 is a schematic diagram of an application scenario of multi-party secure multiplication according to some embodiments of this specification; Figure 1 is a schematic diagram of an application scenario of multi-party secure multiplication according to some embodiments of this specification; Figure 1 is an exemplary flowchart ... Figure 7 is an exemplary flowchart of a multi-party secure division method according to some embodiments of this specification; Figure 8 is an exemplary flowchart of a local fragmentation method for obtaining the absolute value of the quotient according to some embodiments of this specification; Figure 9 is an exemplary flowchart of a multi-party secure decomposition method according to some embodiments of this specification; Figure 10 is an exemplary flowchart of restoring the absolute value of the quotient to the quotient in a closed state according to some embodiments of this specification; Figure 11 is an exemplary flowchart of a multi-party secure unsigned number division method according to some embodiments of this specification; Figure 12 is a multi-party secure division method according to some embodiments of this specification. Figure 13 is an exemplary flowchart of a method for calculating the Sigmoid function according to some embodiments of this specification; Figure 14 is an exemplary block diagram of a multi-party secure Tanh function according to some embodiments of this specification; Figure 15 is an exemplary block diagram of a multi-party secure comparison system according to some embodiments of this specification; Figure 16 is an exemplary block diagram of a multi-party secure natural exponential function calculation system according to some embodiments of this specification; Figure 17 is an exemplary block diagram of a multi-party secure linear rectified function calculation system according to some embodiments of this specification; Figure 18 is an exemplary block diagram of a multi-party secure linear rectified function calculation system according to some embodiments of this specification; The specification includes exemplary block diagrams of multi-party secure division systems according to some embodiments; Figure 19 is an exemplary block diagram of a multi-party secure absolute value computation system according to some embodiments of the specification; Figure 20 is an exemplary block diagram of a multi-party secure decomposition system according to some embodiments of the specification; Figure 21 is an exemplary block diagram of a multi-party secure unsigned number division system according to some embodiments of the specification; Figure 22 is an exemplary block diagram of a multi-party secure Sigmoid function computation system according to some embodiments of the specification; Figure 23 is an exemplary block diagram of a multi-party secure Tanh function computation system according to some embodiments of the specification. Detailed Implementation

[0036] To more clearly illustrate the technical solutions of the embodiments in this specification, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are merely some examples or embodiments of this specification. For those skilled in the art, these drawings can be applied to other similar scenarios without creative effort. Unless obvious from the context or otherwise specified, the same reference numerals in the drawings represent the same structures or operations.

[0037] It should be understood that the terms “system,” “device,” “unit,” and / or “module” used herein are one way to distinguish different components, elements, parts, sections, or assemblies at different levels. However, if other terms can achieve the same purpose, they may be replaced by other expressions.

[0038] As indicated in this specification, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" do not specifically refer to the singular and may also include the plural. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of expressly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0039] Flowcharts are used in this specification to illustrate the operations performed by the system according to embodiments of this specification. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, the steps can be processed in reverse order or simultaneously. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.

[0040] This manual deals with multi-party secure computation, so we will first introduce multi-party secure computation and related concepts.

[0041] Secure multiparty computation, also known as secure multiparty computation (SMPC / MPC), refers to computation performed among multiple participants without disclosing data privacy.

[0042] Secure multi-party computation can be achieved based on secret sharing (SS). Secret sharing refers to distributing raw data, such as the private data held by the data provider (input), intermediate computation results, and the final computation result (output), in a fragmented manner among different computation participants. There are various fragmentation methods, with additive fragmentation being common. Additive fragmentation means that adding all fragments of the original data can reconstruct the original data. For example, if the original data x has n fragments, denoted as... These n slices can be held by n participating parties, such as each party holding one slice, satisfying the following condition. For any computational participant, the shards it holds can be called local shards.

[0043] It's clear that in secure multi-party computation based on secret sharing, once all fragments of the original data are leaked—for example, if all participants collude or are compromised—the original data will be exposed in plaintext. Exposing the original data carries a certain risk of privacy breach and is therefore considered insecure. For instance, exposing the privacy data of the data provider directly leaks that data. Furthermore, in some cases, exposing intermediate and / or final computation results can lead to the derivation of private data. Of course, in some situations, even though the input is fragmented, plaintext output is permissible; for example, the plaintext exposure of comparison results is allowed in some cases and is considered secure.

[0044] Secure multi-party computation can utilize group operations. In mathematics, a "group" represents an algebraic structure that satisfies closure, associativity, has an identity element, and has inverses, including abelian groups, homomorphisms, and conjugate classes. The multiplication symbol "..." is commonly used in these structures. (This can be omitted when there is no ambiguity) or the addition symbol "+" can be used as the symbol for this binary operation. However, it should be noted that this binary operation is not necessarily equivalent to multiplication or addition in the four arithmetic operations.

[0045] The binary operations on a group satisfy: 1. The closure law, for any element in G... b, Still in G; 2. Associative law, for any element in G b and c have 3. There exists an element e in G such that... 4. It has an inverse element, for any element in G. There exists b in G such that , b and e are inverses of each other, and e is the identity element. It's worth noting that for the binary operation represented by "+", e can also be called the zero element, and the inverse can also be called the negative element (such as the opposite number in this article). For any element in G... b, It can represent +(the inverse of b). The order of group operations is important; add elements... Combining element b with element b will not necessarily yield the same result as combining element b with element b. Combining the same elements, i.e., the commutative law. This is not always true. A group that satisfies the commutative law is called an abelian group, and a group that does not satisfy the commutative law is called a non-abelian group. An abelian group consists of its own set G and binary operations. constitute.

[0046] The multi-party secure computation protocol in this specification can be designed based on the integer abelian group (including negative and non-negative numbers). In particular, for multi-party secure unsigned division, it can also be designed based on the non-negative integer abelian group (containing only non-negative numbers).

[0047] Figure 1 is a schematic diagram of an application scenario of secure multi-party computation according to some embodiments of this specification. Scenario 100 may include one or more data providers 110 (only one is shown in Figure 1), and multiple computation participants 120, such as computation participants 120-1, 120-2, 120-3, ..., 120-n.

[0048] The data provider, also known as the data holder, possesses the complete, privacy-protected raw data. The data provider can divide the raw data (input) x into n parts, each part being assigned as a slice to a computational participant. For ease of description, the slice assigned to computational participant 120-i can be denoted as... Referring to the foregoing, for additive fragmentation, the following conditions must be met: .

[0049] As an example only, scenario 100 can be used to implement a secure machine learning framework. More specifically, the secure machine learning framework may include a secure MPNN (Message Passing Neural Network) framework for drug attribute prediction. In the secure MPNN framework for drug attribute prediction, the drug laboratory can act as the provider of drug data. To prevent drug data leakage, the original (plaintext) drug data is provided to each computing participant (such as a cloud computing server) in fragmented form as input data. Each computing participant can also return fragmented prediction results to the drug laboratory. The drug laboratory can obtain the plaintext prediction results by merging the obtained fragments (such as by adding them). In addition, the plaintext prediction model can be pre-trained, and then the model parameters can be decomposed into fragments and distributed to each computing participant to facilitate secure multi-party computation.

[0050] MPNN has three data processing stages: message passing, update, and readout. The message passing stage can be implemented using fully connected layers and ReLU layers. The update stage can be implemented using GRU (Gated Recurrent Unit) layers. The readout stage can be implemented using two fully connected networks, which can employ fully connected layers and ReLU layers, and their outputs can be connected using the Sigmoid function and bitwise multiplication. Specifically, the fully connected layers involve multiplication, the ReLU layer involves the ReLU function, and the GRU layer involves the Sigmoid function, the Tanh function, and bitwise multiplication.

[0051] It is understandable that implementing a secure MPNN framework relies on the secure implementation of the basic operations involved in MPNN. These basic operations include the aforementioned multiplication, ReLU function, Sigmoid function, Tanh function, and related operations. For example, the Sigmoid and Tanh functions both involve the natural exponential function and division, while the ReLU function involves comparison. That is, a basic multi-party secure computation protocol is needed for the framework, such as multi-party secure multiplication protocols, comparison protocols, division protocols, etc. In some embodiments, multi-party secure computation is mostly applicable to two-party scenarios, which is difficult to meet the needs of scenarios with larger computational tasks and more participating nodes. In some embodiments, three-party secure computation protocols also exist, but these protocols are mostly only applicable to three parties and are difficult to extend to scenarios with more parties, or require deep involvement of a trusted central server (such as relying on the central server to perform some operations) to assist more parties in completing multi-party secure computation. The involvement of the central server undoubtedly increases hardware costs. Therefore, some embodiments of this specification provide a series of multi-party secure computation protocols that do not rely on a trusted central server for computation and are applicable to three-party or higher multi-party secure computation scenarios.

[0052] There are certain dependencies between the multi-party secure computation protocols provided in some embodiments of this specification. Generally, the multiplication protocol is a relatively low-level multi-party secure computation protocol, so this document introduces the relevant multi-party secure computation protocols in turn, starting with multi-party secure multiplication.

[0053] In some multi-party secure computation protocols, the steps / processes executed by two or more computation participants (which can be some or all of them) are symmetrical; therefore, the related diagrams only show the unilateral process. For ease of description, the number of computation participants is denoted as n, where n is a positive integer not less than 3. The multiple parties may include the 0th party, the 1st party, ..., the (n-1)th party, and the party executing the relevant process can be denoted as the i-th party.

[0054] Figure 2 is an exemplary flowchart of a multi-party secure multiplication according to some embodiments of this specification. Flow 200 can be performed by any of the n parties, and as shown in Figure 2, flow 200 may include the following steps.

[0055] Step 210: Transmit the local fragments of the first multiplier and the local fragments of the second multiplier to the other party or the other multiple parties.

[0056] Step 220: Obtain other slices of the first multiplier and other slices of the second multiplier from the other party or the other multiple parties.

[0057] For ease of description, the first multiplier can be denoted as... The second multiplier is denoted as b. For the i-th power (abbreviated as...) ), can hold the first multiplier The local shard is recorded as The local partition of the second multiplier b is denoted as For additive fragmentation, satisfying and .

[0058] In steps 210 and 220, the number of other parties is no greater than n-2. Excluding the current party, the total number of other parties is n-1. Therefore, the restriction here is to exclude the remaining n-1 parties to prevent the plaintext of the first and second multipliers from being exposed. From the receiver's perspective, if the i-th party obtains the remaining (n-1) fragments of any multiplier (excluding the local fragment) from the remaining (n-1) parties, the i-th party can collect all n fragments of that multiplier and thus obtain the plaintext of that multiplier. Similarly, from the sender's perspective, if the i-th party sends the local fragment of any multiplier to the remaining n-1 parties, the adversary only needs to compromise the remaining (n-1) parties (without needing to compromise all participating parties) to collect all n fragments of that multiplier and thus obtain the plaintext of that multiplier. Therefore, for data security reasons, the number of other parties in steps 210 and 220 is no greater than n-2.

[0059] Step 230: Multiply the local partitions of the first multiplier and the local partitions of the second multiplier to obtain the local product term.

[0060] The i-th power can use the first multiplier Local sharding Local partitioning of the second multiplier b Multiplying them together yields the local product term. .

[0061] Step 240: Multiply the local fragments of the first multiplier by the other fragments of the second multiplier to obtain one or more first cross terms.

[0062] The i-th power can use the first multiplier Local sharding Other parts of the second multiplier b Multiplying them together yields one or more first cross terms. ,in, For each received (Refer to step 220) A corresponding first cross term can be obtained. .

[0063] Step 250: Multiply the local fragments of the second multiplier with the other fragments of the first multiplier to obtain one or more second cross terms.

[0064] The i-th party can partition the local portion of the second multiplier b. and the first multiplier respectively Other fragments Multiplying them together yields one or more second cross terms. ,in, For each received (Refer to step 220) A corresponding second cross term can be obtained. .

[0065] Step 260: Based on the local product terms, the one or more first cross terms, and the one or more second cross terms, obtain the local fragment of the product of the first multiplier and the second multiplier.

[0066] For additive partitioning, the first multiplier The product of the second multiplier b It can be decomposed into two types of product terms: local product terms and cross terms (such as the first / second cross terms). Therefore, each computational participant can obtain the product based on the local product terms and cross terms. Local fragments.

[0067] In some embodiments, for efficiency and other considerations, each cross term can be assigned to a unique computational participant for computation, thereby ensuring that each cross term and each local product term in the product is computed by the corresponding computational participant. Accordingly, each computational participant can use the sum of the local product term, the one or more first cross terms, and the one or more second cross terms as a local fragment of the product. That is, for the i-th party, the product... Local fragments can be equal to local product terms. The one or more first cross terms and the one or more second cross terms The sum. As a variation of the above calculation method, the product... Local fragments can also be equal to local product terms. The one or more first cross terms The one or more second cross terms and constant terms The sum is determined by satisfying the constant terms of the n participating computational parties. The sum equals 0 (i.e.) That's all.

[0068] The calculation and allocation of cross-items can depend on the transmission strategy of multiplier fragmentation. An exemplary fragmentation transmission strategy is provided below.

[0069] In some embodiments, each computational participant (denoted as the i-th party) may use the first multiplier. Local sharding Send the data to the (i+n-1)%n, (i+n-2)%n, (i+n-3)%n, and so on until the (i+n-nth)%nth party. (n-1) / 2 )%n square; local fragmentation of the second multiplier b Send the data to the (i+n-1)%n, (i+n-2)%n, (i+n-3)%n, and so on until the (i+n-nth)%nth party. n / 2 )%n^2. Here, % represents the modulo operation (the sign of the remainder is the same as the dividend preceding %). This indicates rounding down to the nearest integer.

[0070] Correspondingly, the i-th power can be derived from the (i+1)%n power, the (i+2)%n power, and so on until the (i+... (n-1) / 2 )%n receives the first multiplier Other fragments Starting from the (i+1)%n power, the (i+2)%n power, and so on until the (i+n)th power. n / 2 )%n receives other fragments of the second multiplier b .

[0071] Receive the first multiplier Other fragments Other slices of the second multiplier b Then, the i-th party can press Calculate the product Local sharding .

[0072] For example, when n=3, The first multiplier can be Local sharding Local partitioning of the second multiplier b Send to and ,Right now .from and ,Right now Receive the first multiplier Other fragments Other slices of the second multiplier b back, It can calculate the product. Local sharding Here, mod represents the modulo operation (the remainder is always a non-negative integer). Specifically, Will from get , , Will from get , , Will from get , .

[0073] In some embodiments, to improve data security, the local fragments used to calculate local product terms and cross terms can be obtained by re-sharding based on the original fragments. That is, the local fragments of the first multiplier and the second multiplier in step 210 can be obtained by the i-th party collaborating with the other n-1 parties, based on their respective original fragments. It is understood that re-sharding does not change the original data corresponding to each fragment. For example, the i-th party holds the first multiplier. raw fragments The original fragment of the second multiplier b After repartitioning, the i-th party can obtain the first multiplier. Local sharding Local partitioning of the second multiplier b ,satisfy and Furthermore, the i-th power can use the first multiplier. Local sharding Local partitioning of the second multiplier b Multiplying them together yields the local product term. ; local fragmentation of the first multiplier Other parts of the second multiplier Multiplying them together yields one or more first cross terms. ; local fragmentation of the second multiplier Each and the other pieces of the first multiplier ( Multiplying these terms yields one or more second cross terms. .

[0074] In some embodiments, for any computational participant (denoted as...) The repartitioning process of the original fragment may include: generating a local first random number (denoted as ). , ), the first random number of the local machine Transmitted to the other party From the other party (denoted as ); , Get other first random numbers Based on the first local random number Other first random numbers The difference and the original fragment To obtain local fragments of the original data s (such as the first multiplier / second multiplier). It's understandable that for additive sharding, since the sum of the original shards of each party is already equal to the original data, the sum of the random number differences between each party can be equal to 0, so that the sum of the local shards of each party after resharding still equals the original data. For example, it can be done by... Calculate local fragments ,satisfy .

[0075] In some embodiments, You can generate the first random number locally. Transmit to and from Receive other first random numbers .Right now, The remaining party is the (i+n-1)%n-th party, and correspondingly, The remaining party is the (i+1)%n party.

[0076] In some embodiments, You can generate the first random number locally. Transmit to and from Receive other first random numbers .Right now, The remaining party is the (i+1)%n-th party, and correspondingly, The remaining party is the (i+n-1)%n party.

[0077] In some embodiments, You can generate the first random number locally. Transmit to and from Receive other first random numbers .in, It is a positive integer between 0 and n (excluding 0 and n). That is, The remaining party is the first Fang, correspondingly, The remaining other party is the first square.

[0078] In some embodiments, You can generate the first random number locally. Transmit to and from Receive other first random numbers .in, It is a positive integer between 0 and n (excluding 0 and n). That is, The remaining party is the first Fang, correspondingly, The remaining other party is the first square.

[0079] Figure 3 is an exemplary flowchart of a multi-party secure comparison method according to some embodiments of this specification. Each party holds a first number (denoted as...). The first number is a fragment of the first number (denoted as b), and the second number is a fragment of the second number (denoted as b). The first and second numbers are the two numbers participating in the security comparison. The first number held by the i-th party is b. The local fragment can be denoted as The local fragment of the second number b held can be denoted as Process 300 can be executed by any of the n parties, as shown in Figure 3. Process 300 may include the following steps.

[0080] Step 310, obtain the first selected random number Local sharding Second choice of random number Local sharding And the local fragmentation of the mask random number r .

[0081] Among them, the second choice of random number With the first choice of random number Related, i.e., the second choice of random number With the first choice of random number The values ​​of these factors influence each other. For details on the roles of the first / second random number selection and the masking random number, please refer to the detailed description in steps 360-380.

[0082] Step 320: Obtain the local fragment of the first comparison function f. .

[0083] The first comparison function f reflects the first number The difference between subtracting the second number b .

[0084] Step 330, Obtain the second comparison function Local sharding .

[0085] Second comparison function Reflects the second number b minus the first number The difference .

[0086] Step 340, based on the first selected random number Local sharding And the local partition of the first comparison function, in collaboration with the other n-1 parties, obtains the first selection random number. The first product with the first comparison function f Local sharding .

[0087] It is understood that the steps for calculating the product in this specification (such as steps 340, 350, 370, 392, 394, etc.) can be implemented using multi-party secure multiplication. In some embodiments, the multi-party secure multiplication used in the relevant steps of this specification can be the multi-party secure multiplication shown in Figure 3.

[0088] Step 350, based on the second selected random number Local sharding and the second comparison function The local partition, in collaboration with the other n-1 parties, obtains the second random number. Compared with the second comparison function The second product Local sharding .

[0089] Step 360, based on the first product Local sharding and the second product Local sharding Obtain the local fragment of the target difference sub. .

[0090] It is understandable that the target difference sub equals the first product. Second product The combined result, for example, the target difference sub, could be the first product. With the second product The sum of The value of the chosen random number determines whether the selected object, which is multiplied by it, is selected. There are two possible random numbers to choose from (…). and The values ​​of the two selected objects (the first comparison function) affect each other, therefore the values ​​of the two selected objects (the first comparison function) affect each other. Second comparison function Only one of the selected random numbers will be chosen. That is, depending on the value of the chosen random number, the target difference sub will either reflect the first number or... The difference between subtracting the second number b It either reflects the second number b minus the first number. The difference Therefore, it can be concluded that the sign of the target difference and the value of the chosen random number can reflect the first number. The relationship between the second number b and the second number b will be used in subsequent steps 380 to calculate the slices of the comparison result (result identifier), which will not be explained in detail here.

[0091] In some embodiments, the first selection of a random number It can be 0 or 1, and correspondingly, the second choice is a random number. It can be equal to (1- Thus, the first choice of random number. Second choice of random number There is always one number that is 0 and another number that is 1, and their respective selected objects ( Corresponding to f, After multiplication (corresponding to g), one object is always canceled out by the effect of 0, thus selecting the other object. That is, either the first comparison function f is selected, or the second comparison function f is selected. Selected. Of course, the first choice is a random number. If the result is 0 or 1, the second random number is selected. Alternatively, (1-) The set multiple, such as 2(1- ).

[0092] In some embodiments, when the first random number is selected The second choice of random number is 0 or 1. equals (1- When ), the first choice is a random number. Local sharding It can be obtained from a standalone device. A standalone device can refer to a device that does not participate in secure computation, such as the device of the data provider or other trusted party, which can generate a random number as the first choice of random. ,Will The algorithm is divided into n parts and distributed among n computational participants. When the i-th participant receives the first random selection... Local sharding Then, the first selected random value can be subtracted from the local fragment of the first preset value. Local sharding The second random number (1-) is obtained. Local fragments The first preset value is equal to 1. It can be understood that the parties can agree on a fragmentation value such that the sum of the fragments held by each party for the first preset value is 1; that is, the local fragments held by each party for the first preset value can be pre-configured. For example, the parties can agree that one party's fragments are equal to 1 and the fragments of the other parties are all equal to 0. It can be understood that any preset value mentioned in this specification can be obtained through pre-configuration.

[0093] Step 370, Local fragmentation based on target difference sub And the local fragmentation of the mask random number r In collaboration with the remaining n-1 parties, a local fragment of the intermediate product e is obtained. .

[0094] The intermediate product e equals the product of the target difference sub and the masking random number r. As per step 380, the intermediate product is to be revealed on the n-side, but due to the presence of the masking random number r (the size of r is unknown to either side), the target difference reflecting the difference between the first and second numbers is prevented from being exposed. It is understood that exposing the target difference is considered insecure or poses a privacy risk.

[0095] Step 380, Local fragmentation based on intermediate product e Together with the remaining n-1 parties, they reveal the intermediate product e.

[0096] In some embodiments, the parties may agree that one party collects all fragments of the intermediate product e, meaning that the one party can receive other fragments of the intermediate product e from the other n-1 parties, and obtain the intermediate product e based on the local fragments of the intermediate product e and the n-1 other fragments of the intermediate product e. The other party (e.g. The intermediate product e can be sent to the remaining n-1 sides (e.g.) ), or inform the sign of the intermediate product e of the remaining n-1 sides.

[0097] In some embodiments, each computational participant may also send its local fragment of the intermediate product e to the remaining n-1 participants. In this way, each computational participant can receive the other fragments of the intermediate product e from the remaining n-1 participants and obtain the intermediate product e based on the local fragment of the intermediate product and the n-1 other fragments of the intermediate product e.

[0098] If the intermediate product e is greater than 0, step 392 can be executed. If the intermediate product e is less than or equal to 0, step 394 can be executed.

[0099] Step 392, based on the first selected random number Local sharding In collaboration with the other n-1 parties, the local fragment of the comparison result identifier d is obtained. ,in, .

[0100] Step 394, based on the first selected random number Local sharding In collaboration with the other n-1 parties, the local fragment of the comparison result identifier d is obtained. ,in, .

[0101] In this instruction manual, Indicates XOR.

[0102] The masking random number r can be a number whose sign is known but whose specific value is unknown and is not 0. This allows us to determine the sign of the target difference sub based on the sign of the intermediate product e (the product of the target difference sub and the masking random number r), and then combine it with the first-choice random number. The value of can determine the first number And the relationship between the size of the second number b.

[0103] To intuitively understand the relationship between the sign of the intermediate product e and the comparison result, let's assume that the masked random number r is a positive number, and the first number... If both the second number b and the second number are integers, then: (1) e > 0 and hour, (2) e>0 and hour, (3) e < 0 and hour, (4) e < 0 and hour, Therefore, when e > 0, the first random number can be selected. The result of the XOR operation with 0 is used to determine the comparison result identifier d. When e < 0, the first selected random number can be used. The result of the XOR operation with 1 is used to determine the comparison result identifier d. Here, d=1 indicates... d=0 indicates .

[0104] In some embodiments, the case of a=b also needs to be considered. Generally, the case of two numbers being equal will be classified into one of the two types of comparison results. In some embodiments, the first comparison function can be set to ab and the second comparison function can be set to ba. However, when a and b are equal, the target difference is equal to 0, and the intermediate product e is also equal to 0, which will expose the privacy information that a and b are equal. In view of this, in some alternative embodiments, a basic numerical interval can be added to one of the comparison functions. For example, the first comparison function can be 1+ab, where when secure multi-party computation is defined on the set of integers, 1 is the basic numerical interval, that is, the minimum difference between any two numbers in the set of integers can only be 1. Then, the case of a=b can be effectively concealed by selecting random numbers. Specifically: (1) e>0 and hour, (2) e>0 and hour, (3)e 0 and hour, (4)e 0 and hour, Therefore, when e > 0, the first random number can be selected. The result of the XOR operation with 0 is used to determine the comparison result identifier d. When e < 0, the first selected random number can be used. The result of the XOR operation with 1 is used to determine the comparison result identifier d. Here, d=1 indicates... d=0 indicates .

[0105] In some embodiments, the binary XOR operation can be equivalent to a combination of binary addition and binary multiplication. Specifically, Correspondingly, in multi-party secure computation, Local partitions of p can be summed. Local sharding with q The first part of the local fragment obtained by XORing p and q ( Local fragmentation based on p and q's local shards In collaboration with the remaining n-1 parties, the second part of the local slice of the XOR result of p and q is obtained. .and then, The local fragment of the XOR result of p and q can be obtained by subtracting the second part from the first part of the local fragment.

[0106] For example, when the comparison result identifier is equal to the first selected random number When XORing with 0, You can sum the first random number. Local sharding The local fragment with the second preset value (equal to 0) is compared with the local fragment with the result identifier d. The first part; based on the first selection of random numbers Local sharding The local fragment with the second preset value, together with the other n-1 parties, obtains the local fragment with the comparison result identifier d. The second part. Furthermore, The comparison result can be identified by the local fragment d. Subtracting the second part from the first part yields the local fragment identified by the comparison result d. It is understandable that the parties can agree on a sharding value to ensure that the sum of the shards held by each party with the second preset value is equal to 0. For example, each party can set the shards with the second preset value to 0.

[0107] For example, when the comparison result identifier is equal to the first selected random number. When XORing the result with 1, You can sum the first random number. Local sharding The local fragment with the first preset value (equal to 1) is compared with the local fragment with the result identifier d. The first part; based on the first selection of random numbers Local sharding The local fragment with the first preset value, together with the other n-1 parties, obtains the local fragment with the comparison result identifier d. The second part. Furthermore, The comparison result can be identified by the local fragment d. Subtracting the second part from the first part yields the local fragment identified by the comparison result d. .

[0108] In some embodiments, the i-th party can generate a random number and use it as a local fragment of the mask random number r. To ensure that the masking random number r is either positive or negative, the parties may agree that local fragments can be generated within either a positive or negative range. Referring to the previous section on obtaining the first random local fragment, the i-th party can also obtain the local fragment of the mask random number r from an independent device. To ensure that the masking random number r is either positive or negative, a separate device can generate the masking random number r within either a positive or negative range.

[0109] Figure 4 is an exemplary flowchart of a multi-party secure natural exponential function calculation method according to some embodiments of this specification. Each party holds a slice of a first number (denoted as x), which is the input (i.e., the exponent) of the natural exponential function. The local slice of the first number x held by the i-th party can be denoted as... .

[0110] One characteristic of exponential functions is that the sum of the input values ​​can be converted into the product of the output values, i.e. Based on this, the fragments of the first number x can be recombined to obtain two recombined fragments. Furthermore, the multi-party secure computation of the exponential function can be transformed into multi-party secure multiplication. Specifically, any two of the n parties can obtain the recombined fragments of the first number x. For ease of description, these two parties are denoted as... and That is, the executor of process 400 can be or .

[0111] As shown in Figure 4, process 400 may include the following steps.

[0112] Step 410: Obtain the other slices of the first number from the remaining k squares.

[0113] Referring to the relevant descriptions of steps 210 and 220, k is no greater than n-2 to avoid exposing the first number.

[0114] Assumption From the rest Fang obtains the other fragments of the first number. From the rest If the first number of other fragments is obtained, then the remaining fragments... Fang and the rest The square constitutes the exception and The remaining n-2 sides, of which, .

[0115] Step 420: Sum the local fragment of the first number and k other fragments to obtain the first recombined fragment of the first number.

[0116] Continuing with the previous assumptions, The obtained recombined fragment (denoted as x1) can be the first number x. The sum of each piece, The obtained recombined fragment (denoted as x2) can be the first number x of ( The sum of the ) pieces satisfies x = x1 + x2.

[0117] It should be understood that The obtained recombined fragment is the first recombined fragment for itself, but for others... This refers to the second recombined fragment (see step 450). Similarly, The obtained recombined fragment is the first recombined fragment for itself, but for others... In other words, it is the second recombined fragment.

[0118] Step 430: Calculate the output value of the natural exponential function when the first recombined fragment of the first number is used as the input value, and obtain the value of the first natural exponential function.

[0119] The recombined fragment x1 of the first number can be input into the natural exponential function to obtain the output value e. x1 . The first number's recombined fragment x2 can be input into the natural exponential function to obtain the output value e. x2 .

[0120] It should be understood that The calculated value of the natural exponential function is the first natural exponential function value for itself, but for... In other words, it is the value of the second natural exponential function (see step 450). Similarly, The obtained natural exponential function value is the first natural exponential function value for itself, but for... In other words, it is the value of the second natural exponential function.

[0121] Step 440: Divide the first natural exponential function value into n parts, distribute n-1 of them to the remaining n-1 parts, and use the remaining 1 part as a local fragment of the first natural exponential function value.

[0122] The function value e can be x1 Divide into n parts, distribute n-1 parts to the remaining n-1 parts, and use the remaining 1 part as the function value e. x1 Local fragments. The function value e can be x2 Divide into n parts, distribute n-1 parts to the remaining n-1 parts, and use the remaining 1 part as the function value e. x2 Local fragments.

[0123] Step 450: Obtain the fragment of the second natural exponential function value from the remainder, and use it as the local fragment of the second natural exponential function value.

[0124] The second natural exponential function value is equal to the natural exponential function value of the second recombined piece of the first number, and the second recombined piece of the first number is equal to the sum of the other pieces of the first number to the power of n-(1+k).

[0125] Refer to step 440. Available from Obtain the function value e x2 The fragments are used as function values ​​e x2 Local sharding, Available from Obtain the function value e x1 The fragments are used as function values ​​e x1 The local fragment. In fact, in n-squared, besides... and Each party outside can be from Obtain the function value e x2 The fragments are used as function values ​​e x2 Local sharding, and can be obtained from Obtain the function value e x1 The fragments are used as function values ​​e x1 Local fragments.

[0126] Step 460: Based on the local partitions of the first natural exponential function value and the second natural exponential function value, and in collaboration with the remaining n-1 parties, obtain the local partition of the target natural exponential function value.

[0127] Wherein, the target natural exponential function value (denoted as c) is the output value of the natural exponential function when the first number x is taken as the input value, that is... And the target natural exponential function value c is equal to the first natural exponential function value. With the value of the second natural exponential function The product of, i.e., c or .

[0128] In fact, it's not just... or Local slices of the target natural exponential function value can be obtained. Each of the n parties can obtain local slices of the target natural exponential function value in collaboration with the other n-1 parties, based on local slices of the first and second natural exponential function values.

[0129] In some embodiments, the first natural exponential function value can be regarded as the first multiplier and the second natural exponential function value can be regarded as the second multiplier, thereby implementing step 460 through multi-party secure multiplication as shown in FIG2.

[0130] Figure 5 is an exemplary flowchart of a multi-party secure linear rectified function calculation method according to some embodiments of this specification. Each party holds a slice of a first number x, where the first number is the input value of the linear rectified function (i.e., the ReLU function).

[0131] The ReLU function can be expressed as ReLU(x) = max(x, 0), where max represents finding the maximum value, that is, when... When, ReLU(x) = x; when When the input value is zero, ReLU(x) = 0. This can be understood as the ReLU function being converted into the product of the sign function and the input value, i.e., ReLU(x) = ... Among them, when hour, ;when hour, Furthermore, multi-party safe computation of the ReLU function can be transformed into multi-party safe multiplication. Additionally, multi-party safe computation of the sign function can be achieved through multi-party safe comparison.

[0132] Process 500 can be executed by any of the n parties, as shown in Figure 5. Process 500 may include the following steps.

[0133] Step 510: Based on the local fragments of the first number and the local fragments of the second preset value, the local fragments of the second preset value are obtained in collaboration with the other n-1 parties through a multi-party secure comparison protocol.

[0134] Wherein, the second preset value is equal to 0, and the comparison result is the comparison result (identifier) ​​between the first number x and 0, that is, the sign identifier of the first number x.

[0135] In some embodiments, the second preset value (0) can be regarded as the second number, so that the local fragment of the symbol identifier can be obtained by the multi-party secure comparison method shown in FIG3.

[0136] Step 520: Based on the local fragment of the first number and the local fragment of the comparison result, in collaboration with the remaining n-1 parties, through a multi-party secure multiplication protocol, obtain the local fragment of the product of the first number and the comparison result, and use the local fragment of the product as the local fragment of the function value.

[0137] The function value is the output value of the linear rectifier function when the first number x is the input value, i.e., ReLU(x).

[0138] In some embodiments, the first number x can be regarded as the first multiplier, and the comparison result sgn(x) can be regarded as the second multiplier, so that the product can be obtained by multi-party secure multiplication as shown in Figure 2. Local fragments.

[0139] Figure 6 is an exemplary flowchart of a multi-party secure division according to some embodiments of this specification. Each party holds the dividend. The partitioning of and the partitioning of the divisor b.

[0140] Process 600 can be executed by any of the n parties, as shown in Figure 6. Process 600 may include the following steps.

[0141] Step 610: Based on the local fragments of the dividend and the local fragments of the divisor, respectively, in collaboration with the other n-1 parties, determine the local fragments identified by the dividend symbol and the local fragments identified by the divisor symbol through a multi-party security symbol protocol.

[0142] A multi-party secure symbol protocol can be implemented based on a multi-party secure comparison protocol, for example, to achieve a secure comparison of a target number (such as a dividend or divisor) with 0. That is, a multi-party secure symbol protocol can include a multi-party secure comparison protocol. For more details on multi-party secure symbol protocols, please refer to the detailed description in step 510.

[0143] Step 620: Based on the local fragments of the dividend and the divisor respectively, in collaboration with the other n-1 parties, determine the local fragments of the absolute value of the dividend and the absolute value of the divisor through a multi-party secure absolute value protocol.

[0144] The absolute value of a number is related to its sign; that is, the absolute value of a non-negative number is equal to itself, and the absolute value of a negative number is equal to its opposite. Based on this, in some embodiments, for any computational participant, the multi-party secure absolute value protocol may include: based on a local fragment of the target number and a local fragment of a first preset value, collaborating with the other n-1 parties, to obtain a local fragment of a result identifier through a multi-party secure comparison protocol, wherein the result identifier indicates whether the target number is negative; based on the local fragment of the target number and the local fragment of the result identifier, collaborating with the other n-1 parties, to obtain a local fragment of the absolute value of the target number through a multi-party secure multiplication protocol. Specifically, when determining the local fragment of the absolute value of the dividend, the local fragment of the target number is the local fragment of the dividend, i.e., the target number is the dividend; when determining the local fragment of the absolute value of the divisor, the local fragment of the target number is the local fragment of the divisor, i.e., the target number is the divisor.

[0145] Referring to other parts of this document regarding symbol identification, the first preset value can be taken as a critical value used to determine the positive or negative sign. That is, comparing the target number with this critical value can determine the positive or negative sign of the target number (e.g., whether it is negative). For example, the first preset value can be equal to 0 or a value near 0 (e.g., ...). ).

[0146] It is understood that the result identifier can use two different values ​​to indicate the case where the target number is negative and the case where the target number is not negative, respectively. Furthermore, based on the target number and the result identifier, the absolute value of the target number can be reconstructed. As an example, let's denote the target number as x, and the result identifier can be equal to... Among them, when hour, ;when hour, Accordingly, the absolute value of the target number x can be reconstructed as It can be seen that the absolute value of the reconstruction is essentially the sum of the target number x and the sum of the two values. The product of these terms requires a multi-party secure multiplication protocol. When the result identifier indicates a negative target number, the result identifier (e.g., 0) can be mapped to - When the result identifier indicates that the target number is not negative (i.e., non-negative), the result identifier (e.g., 1) can be mapped to... .

[0147] For more details on the multi-party security absolute value protocol, please refer to Figure 7 and its related description.

[0148] Step 630: Based on the local partitions of the absolute value of the dividend and the absolute value of the divisor, and in collaboration with the other n-1 parties, the local partitions of the absolute value of the quotient are obtained through one or more rounds of processing.

[0149] A quotient is essentially a multiple of the divisor, and obtaining the quotient can be viewed as decomposing the dividend into divisors that are multiples of the divisor. However, it's important to note that decomposition usually means the dividend is greater than or equal to the divisor. On one hand, relying solely on decomposition to calculate the quotient cannot handle cases where the dividend is less than the divisor. On the other hand, when the dividend is greater than the divisor, the quotient can be approximated as a multiple determined by decomposing the dividend (e.g., for 11 divided by 4, the determined multiple is 2, and the remainder 3 is ignored); when the dividend is less than the divisor (e.g., 3 divided by 6), the quotient can be determined as 0 (equivalent to the dividend being directly ignored as a remainder). Clearly, ignoring the remainder leads to a loss of calculation precision, and the closer the remainder is to the divisor, the greater the calculation error. Therefore, the multi-party secure division protocol provided in this specification amplifies the remainder by multiples and further decomposes the amplified remainder, ensuring that a calculation result meeting certain precision requirements can be obtained regardless of the relationship between the dividend and divisor. For more details on the multi-party secure division protocol provided in this specification, please refer to Figure 8 and its related description.

[0150] Step 640: Based on the local fragments of the absolute value of the quotient, the local fragments identified by the dividend sign, and the local fragments identified by the divisor sign, the local fragments of the quotient are obtained in collaboration with the other n-1 parties.

[0151] The sign of the dividend can indicate the sign of the dividend, and the sign of the divisor can indicate the sign of the divisor. The signs of the dividend and divisor determine the signs of the quotient. Therefore, based on the signs of the dividend and divisor, the absolute value of the quotient can be restored to the quotient. Thus, based on the local partitions of the absolute value of the quotient, the local partitions of the dividend and divisor, the local partitions of the quotient can be obtained.

[0152] For details on the implementation of step 640, please refer to Figure 10 and its related description.

[0153] Figure 7 is an exemplary flowchart of a multi-party secure absolute value computation method according to some embodiments of this specification. Each party holds the target number. Fragments .

[0154] Process 700 can be executed by any of the n parties, as shown in Figure 7. Process 700 may include the following steps.

[0155] Step 710: Based on the target number of local fragments and the first preset value of local fragments, the local fragments are obtained in collaboration with the other n-1 parties through a multi-party security comparison protocol, and the result-identified local fragments are obtained.

[0156] The first preset value can be 0 or a value near 0 (e.g., ...). The result identifier indicates whether the target number is negative. For example, the first preset value can be equal to 0. When the target number is not less than 0, that is... When x < 0, the result identifier is equal to 1; otherwise, when x < 0, the result identifier is equal to 0.

[0157] Step 720: Based on the local fragments of the target number and the local fragments of the result identifier, the local fragments of the absolute value of the target number are obtained in collaboration with the other n-1 parties through a multi-party secure multiplication protocol.

[0158] The absolute value of the target number can be reconstructed based on the target number and the result identifier. Specifically, the result identifier can be mapped to... absolute value of the target number Equal to the target number x and The product of the targets. Correspondingly, each side can be based on local partitions of the target number x. The local fragment of the result identifier, in collaboration with the other n-1 parties, obtains the absolute value of the target number through a multi-party secure multiplication protocol. Local sharding .

[0159] In some embodiments, the first preset value can be equal to 0. When the target number is not less than 0... When the result is true, the result identifier is equal to 1; otherwise, it is equal to 0. Let's denote the result identifier here as... Based on this, the i-th party can base its decision on the result identifier. The local fragment and the local fragment of the second preset value, together with the other n-1 parties, cooperate to obtain the local fragment with a sign identifier through a multi-party secure multiplication protocol. Here, the sign identifier indicates the sign of the target number; specifically, non-negative numbers can correspond to... Correspondingly, symbolic representation can be equal to Negative numbers can correspond to Correspondingly, symbolic representation can be equal to Furthermore, each party can base its decisions on symbolic identifiers (such as...). The local fragments of the target number x and the local fragments of the target number x. In collaboration with the remaining n-1 parties, the absolute value of the target number is obtained through a multi-party secure multiplication protocol. (equal to the target number x and) Local fragments of the product The second preset value can be determined based on the specific result identifier and symbol identifier. For example, suppose: the result identifier is denoted as... ; hour, Symbol identification equals ; hour, Symbol identification equals Therefore, the second preset value can be equal to 2, and each party can base its decision on the result identifier. The local fragment and the local fragment with the second preset value, together with the other n-1 parties, cooperate to obtain the third product (equal to the local fragment with the second preset value) through a multi-party secure multiplication protocol. The local fragments of the third product. Then, each party can subtract the local fragments of the third preset value (equal to 1) from the local fragments of the third product to obtain the symbol identifier (equal to...). This can be considered a local fragment of the updated third product. The absolute value of the target number is equal to the updated third product multiplied by the target number, i.e. Therefore, each party can collaborate with the other n-1 parties, based on the local partition of the updated third product and the local partition of the target number, to obtain the absolute value of the target number through a multi-party secure multiplication protocol. Local fragments.

[0160] Figure 8 is an exemplary flowchart of a local fragment for obtaining the absolute value of a quotient according to some embodiments of this specification. The process may include one or more rounds of processing. Each round of processing may include executing steps 810-840 when the precision number meets a preset condition, otherwise ending the current round of processing. The precision number can be used to determine whether the precision meets the requirements. For example, the preset condition may be... ,in, This indicates the precision value. Furthermore, the precision value is updatable (see the relevant description in step 810). When the precision value is updated to the point where it no longer meets the preset condition, a quotient absolute value calculation result that meets the precision requirement can be obtained. Specifically, the precision requirement here may refer to retaining a preset number of decimal places, such as 16 digits (i.e., setting...). =16).

[0161] Step 810: Determine the absolute value of the dividend. Is it less than the absolute value of the divisor? .

[0162] Each party holds the absolute value of the dividend. Pieces and absolute value of divisor The partitioning, therefore the absolute value of the dividend. and the absolute value of the divisor The relative sizes of the dividends can be determined using a multi-party secure comparison protocol. Specifically, either party can base its comparison on the absolute value of the dividend. Local sharding and the absolute value of the divisor Local sharding In collaboration with the remaining n-1 parties, the absolute value of the dividend is determined through a multi-party secure comparison protocol. Is it less than the absolute value of the divisor? The comparison results here can be disclosed to n parties; details of the disclosure can be found in the relevant description of step 380.

[0163] Referring to Figure 8, when Or (before the update) the precision number does not meet the preset conditions (e.g., If the condition is met, do not update and continue to step 820; otherwise, when... And the precision number meets the preset conditions (e.g., When this happens, 812 needs to be updated once or multiple times until the absolute value of the dividend is not less than the absolute value of the divisor (i.e., ...). ) or (after updating) the precision number no longer meets the preset conditions (such as Each update involves three variables: first, updating the absolute value of the dividend. Local sharding The absolute value of the dividend is such that Secondly, the absolute value of the update quotient increases exponentially; Local sharding This makes the absolute value of the quotient Third, update the precision. That is, when performing step 820, the absolute value of the dividend is not less than the absolute value of the divisor, or the (updated) precision no longer meets the preset condition.

[0164] As an example only, when using a decimal fixed point, refer to Figure 8. Each update can change the absolute value of the dividend. absolute value of quotient All are increased to 10 times. In some embodiments, the absolute value of the dividend is... absolute value of quotient Amplification can be achieved through a multi-party secure multiplication protocol. In some embodiments, the absolute value of the dividend is... absolute value of quotient The amplification can be implemented locally on each side; that is, each side can amplify the absolute value of the dividend. Local sharding absolute value of quotient Local sharding Magnify by the same factor, for example, as shown in Figure 8, all magnify to 10 times (i.e. , This also allows us to achieve the absolute value of the dividend. absolute value of quotient Magnification by the same factor, and local amplification, can save on communication between computational participants.

[0165] As shown in Figure 8, updating the precision number can include decrementing the precision number by 1, i.e., p = p - 1. After several updates, the precision number decreases to 0 (i.e., the precision number no longer meets the preset condition), at which point the last round of processing ends, and finally a slice of the absolute value of the quotient that meets the precision requirement is obtained. For example, continuing the previous example, the initial value of the precision number can be 16. After 16 updates, the precision number decreases to 0, and in the 17th round of processing, a slice of the absolute value of the quotient with 16 decimal places (approximately equal to 3.6) can be obtained. As another example, if the precision requirement in the previous example is adjusted to retaining 1 decimal place, the initial value of the precision number can be 1. After 1 update, the precision number decreases to 0, and in the 2nd round of processing, a slice of the absolute value of the quotient with 1 decimal place (equal to 3.6) can be obtained.

[0166] This specification does not impose any restrictions on the initial value of the precision number or the rules for updating the precision number. For example, in some embodiments, for the first round of processing, the precision number p can be a preset integer (denoted as p). ,like The preset conditions for the precision number p can include that the precision number p is less than a threshold. ,satisfy Updating the precision can include incrementing the precision by 1; after several updates, the precision increases to [a higher value]. (That is, if the precision number no longer meets the preset condition), the next round of processing can be directly ended, and finally the slice with the absolute value of the quotient that meets the precision requirement is obtained.

[0167] Step 820, obtain the multiplier Local sharding and remainder Local sharding .

[0168] Either side can be based on the absolute value of the dividend. Local sharding and the absolute value of the divisor Local sharding In collaboration with the remaining n-1 parties, a multiplier is obtained through a multi-party secure decomposition protocol. Local sharding and remainder Local sharding .

[0169] For more details on the multi-party secure decomposition protocol, please refer to Figure 9 and its related description.

[0170] Step 830, multiply Local sharding Accumulated to the absolute value of the quotient Local sharding In the middle, the absolute value of the updated quotient Local sharding .Right now, .

[0171] It is understandable that in the first round of processing, the absolute value of the quotient before the update... It can be equal to 0. Specifically, in the first round of processing, each side can multiply the amount by 0. Local sharding Accumulate to the local fragment with the first preset value (equal to 0) to update the absolute value of the quotient. Local sharding Of course, in the first round, each side can also directly multiply the amount. Local sharding As the updated absolute value of the quotient Local sharding This is actually equivalent to the aforementioned approach.

[0172] Step 840, change the remainder Local sharding As the updated absolute value of the dividend Local sharding .Right now, .

[0173] Combining steps 820-840, we can understand that the absolute value of the dividend... absolute value of quotient Enlarging by the same factor ensures the correctness of the cumulative multiplication. Specifically, in the (i+1)th round of processing, the absolute value of the dividend is enlarged. In reality, it is the remainder generated from the decomposition in the previous round (i.e., the i-th round) and the absolute value of the expanded quotient in the (i+1)-th round. This is actually the sum of the multiples obtained from the decomposition in the previous i rounds of processing (hereinafter referred to as the historical cumulative multiples). For example, suppose... , The calculation result is a decimal number with a precision requirement of retaining 16 decimal places. In the first round of processing, 11 is decomposed in dense state to obtain a multiple of 3 and a remainder of 2. The remainder 2 becomes the absolute value of the updated dividend. (Right now In the second round of processing, the absolute value of the dividend... Expanded to 10 times, the updated absolute value of the dividend In dense state, 20 is decomposed to obtain a multiple of 6 and a remainder of 2. The remainder 2 becomes the absolute value of the updated dividend. (Right now In the third round of processing, the absolute value of the dividend. Expanded to 10 times, the updated absolute value of the dividend In dense state, 20 is decomposed to obtain a multiple of 6 and a remainder of 2. ). Similarly, in the 17th round of processing, decomposing 20 in the dense state yields a multiple of 6. The absolute value of the quotient. The integer corresponding to the infinitely repeating decimal 3.66... ​​is obtained by retaining 16 decimal places (equivalent to removing the decimal point or magnifying the fixed-point number to 10). 16 (times) equals It is not difficult to see that the absolute value of the dividend The absolute value of the quotient increases every time the remainder from the previous round is multiplied. The historical cumulative multiplier needs to be increased by the same multiplier to ensure that the multipliers obtained after 17 rounds of processing (3, 6, 6...) are arranged sequentially to form the retained theoretical value (equal to...). The final calculation result is a fixed-point number with 16 decimal places (approximately 3.6). Of course, the final result is distributed across n squares in a piecewise manner.

[0174] Figure 9 is an exemplary flowchart of a multi-party secure decomposition method according to some embodiments of this specification. Each party holds a first number Fragments And the second number Fragments The first number (Non-negative numbers) are the objects to be factored, the second number. (Positive numbers) are the units of factorization, therefore The process consists of m+1 rounds of iteration, where m is a positive integer (also known as the encryption length). As shown in Figure 9, the i-th round of iteration may include the following steps, where i is a positive integer not greater than m+1. It can be understood that the first number... It can be the absolute value of the aforementioned dividend. The second number It can be the absolute value of the aforementioned divisor. .

[0175] Step 910: Determine the current multiple for the current round (round i). Local sharding .

[0176] In some embodiments, the local shards of the multiples corresponding to each round of the loop can be the same or different. To efficiently (e.g., faster and more thoroughly) factor the first number, the current multiple can be... This variable is set to decrease as the loop progresses (i.e., as the loop number i increases). In other words, in earlier loops, a larger scale of the current multiple is used to attempt to factor the first number, and the scale of the factorization gradually decreases as the loop progresses. (For example only, the current multiple...) It can equal 2 m +1-i , where i is the ordinal number of the current round (i.e., the i-th round). Due to the current multiple It can be a set of constants, therefore, the current multiple held by each side. Local sharding This can be pre-configured, and during use, the local partition corresponding to the current multiplier is retrieved based on the current loop number for calculation. For example, the current multiplier in the last training round. Either party can Local sharding Pre-configured as 1, the remaining n-1 sides will Local sharding The default value is 0. In some embodiments, either party may temporarily generate the current multiplier locally. And split it into n parts, and take one part as Local sharding The remaining n-1 shares are then distributed to the other n-1 parties, so that each party can hold [a certain number of shares]. Fragments It is understood that any preset value of the fragments mentioned in this specification may also be temporarily generated and allocated by one party.

[0177] Step 920: Obtain the local fragment of the intermediate product e. .

[0178] The intermediate product e equals the current multiple. Multiply by the second number ,Right now Therefore, either party can base their decision on the current multiple. Local sharding And the second number Local sharding In collaboration with the remaining n-1 parties, a local fragment of the intermediate product e is obtained through a multi-party secure multiplication protocol. .

[0179] Step 930: Obtain the local fragment of the result identifier s. .

[0180] The result identifier 's' indicates whether the intermediate product 'e' is less than the first number. Therefore, either party can use local fragmentation based on the intermediate product e. And the first number Local sharding In collaboration with the remaining n-1 parties, a local fragment of the result identifier s is obtained through a multi-party secure comparison protocol. When the intermediate product e is less than the first number (Right now When ), it indicates that it can be decomposed into units. From the decomposition object Decompose into multiples As a multiple Part of it, that is, from the decomposition of objects Decompose into more decomposition units .

[0181] Step 940, reveal the result identifier s.

[0182] Either party can use local fragments based on the result identifier s In collaboration with the remaining n-1 parties, the result identifier s is revealed in order to determine whether the intermediate product e is less than the first number. For more details regarding the disclosure of result identifier s, please refer to the relevant description in step 380.

[0183] Based on the foregoing, when the result identifier s indicates that the intermediate product e is less than the first number... At that time, multiple Can be used as a multiple As part of this, the corresponding executable step 950.

[0184] Step 950, set the current multiplier. Local sharding Local fragments accumulated to the target multiple t In order to update the target multiple Local sharding ,Right now ; and, the first number Local sharding Local fragments minus the intermediate product e To update the first number Local sharding ,Right now .

[0185] It's understandable that the target multiple for the first round of the cycle is... It can equal 0. Of course, in the first round of the loop, each side can directly set the current multiplier. Local sharding Local fragments as the updated target multiple t Each time the current multiple of a round is accumulated (i.e., each time a multiple is decomposed), the first number must be subtracted from the corresponding intermediate product in dense state to ensure that the next round continues to decompose based on the remaining part of the first number (subtracted from the intermediate product). After completing m+1 rounds of iteration, the local fragment of the target multiple t of the last round can be obtained. As a multiple Local sharding And the first number after the update Local sharding as remainder Local sharding It can be seen that the multiple Local sharding It equals the summation in round m+1 (the condition is) All current multiples of ) Local sharding The sum of ; equivalent, when the current multiple As described in step 910, set it to 2. m+1-i At that time, multiple It can be stored as a binary number of length m+1, where the intermediate product e is the first number. The size relationship determines that each bit of the binary number is either 0 or 1. Specifically, in the i-th iteration of the loop, if... If the first bit is 1, then the i-th bit of the binary number (the most significant bit is the 1st bit, the second most significant bit is the 2nd bit, and so on, with the least significant bit being the (m+1)th bit) is 1; otherwise, the i-th bit of the binary number is 0. Multiples Multiply by the second number Add the remainder equal to the first number ,Right now It should be noted that the remainder mentioned in this manual is not entirely equivalent to the mathematical concept of remainder. In mathematics, the remainder is generally defined as less than the divisor (only considering the non-negative range, corresponding to the second number as the unit of factorization), but the remainder in this manual... (such as remainder) () can be less than the second number (such as the absolute value of the divisor) (It can also be no less than the second number) .

[0186] The following example will help to intuitively understand the multi-party security decomposition method shown in Figure 9. First, let's assume: =36, =7; And m=3. Therefore, there are a total of 4 rounds of iteration: In the first round of iteration, the current multiple... intermediate product Correspondingly, the slice [t] of the target multiple t is still 0 (equal to 0). 2 3 The first number of fragments [0] is the first number of fragments [0]. Fragments The number of fragments remains at 36

[36] ; in the second round of the loop, the current multiplier... Correspondingly, the slice [t] of the target multiple t is updated to 4 (equal to 0). 2 3 +1 22) fragmentation[4], first number Fragments Updated to 8 (equivalent to 36-22) 7) Slicing [8]; In the third round of the loop, the current multiple intermediate product Correspondingly, the slice [t] of the target multiple t is still 4 (equal to 0). 2 3 +1 22+0 2 1 The first number of fragments [4] of the ... Fragments The partition is still 8 [8]; in the 4th cycle, the current multiple intermediate product Correspondingly, the slice [t] of the target multiple t is updated to 5 (equal to 0). 2 3 +1 22+0 2 1 +1 2 0 The local fragment of )[4], the first number Fragments The slice was updated to 1 [1]. Finally, the multiple Fragments Remainder Fragments There are 36 = 5 7+1, clearly the above dense-state decomposition process is as expected.

[0187] Figure 10 is an exemplary flowchart illustrating the restoration of the absolute value of the quotient to the quotient in a closed state according to some embodiments of this specification. Wherein, when the dividend... Non-negative numbers When, the dividend sign indicates It equals 1, otherwise (i.e.) The divisor b is not negative. When, the divisor sign indicates It equals 1, otherwise (i.e.) ) equals 0.

[0188] As shown in Figure 10, process 1000 may include the following steps.

[0189] Step 1010: Obtain the commercial symbol identifier. Local sharding .

[0190] Each side can be identified based on the sign of the dividend. Local sharding and divisor sign Local sharding In collaboration with the remaining n-1 parties, a quotient symbol is obtained. Local sharding Among them, the commercial symbol is identified. =Equal to the sign of the dividend with divisor symbol The XOR result, i.e. When the dividend and divisor have the same sign... At that time, the quotient d is greater than 0 and the quotient symbol indicates... It is 0; when the dividend is 0. The divisor b has the opposite sign. When the quotient d is not greater than 0 and the quotient symbol is used to identify... The value is 1. In some embodiments, the XOR operation can be equivalent to a combination of addition and multiplication, for example, Based on this, all parties can obtain the quotient symbol identifier through a multi-party secure multiplication protocol. Local sharding Among them, the commercial symbol is identified. It equals the sum of the dividend and divisor signs minus twice the product of the dividend and divisor signs, i.e. .

[0191] Step 1020, obtain the fourth product Local sharding .

[0192] Each party can use a local fragmentation based on a second preset value (equal to 2)[2] and a quotient symbol identifier. Local sharding In collaboration with the remaining n-1 parties, the fourth product is obtained through a multi-party secure multiplication protocol. Local sharding In some embodiments, each party may also directly calculate 2 multiplied by the quotient symbol locally. Local sharding ,get .

[0193] Step 1030: Subtract the local fragments of the fourth product from the local fragments of the third preset value to obtain the updated local fragments of the fourth product. .

[0194] Wherein, the third preset value is equal to 1, and step 1030 can be expressed as: .

[0195] Step 1040: Obtain the local fragment [d] of quotient d.

[0196] Each side can be based on the local fragments of the updated fourth product. and absolute value of quotient Local sharding In collaboration with the remaining n-1 parties, a local fragment [d] of the quotient d is obtained through a multi-party secure multiplication protocol. Here, the quotient d is equal to the fourth product (updated to...). Multiply by the absolute value of the quotient ,Right now Based on the foregoing, hour, ; hour, .thereby, hour, ; hour, Clearly, the commercial restoration is in line with expectations.

[0197] Figure 11 is an exemplary flowchart of multi-party secure unsigned number division according to some embodiments of this specification. Each party holds the dividend. The partitioning of the divisor b and the partitioning of the dividend b Both the divisor b and the divisor b are unsigned numbers. This process can be executed by any of the n parties.

[0198] It is worth noting that the multi-party secure unsigned number division shown in Figure 11 can also be applied to signed number division. Specifically, when the dividend... The sign and divisor All symbols are publicly available information. If the symbols do not involve data privacy or all related data are non-negative, then the commercial... The symbol is also publicly available information. Thus, n can compute the numerical part of the dividend separately in dense mode. The quotient d of the divisor and the numerical part b is used as the divisor. With divisor The business The numerical part, that is, the numerical part of the dividend. The numerical part 'b' of the divisor can be substituted into unsigned number division as an unsigned number (or the absolute value of a signed number). It's understandable that unsigned numbers don't require consideration of sign or absolute value; therefore, the i-th power can be based on the dividend. Local sharding And the local partition of divisor b In collaboration with the other n-1 parties, through one or more rounds of processing, a local fragment of the quotient d can be obtained. Each round of processing may include executing steps 1110 to 1040 when the precision number p meets a preset condition (e.g., p>0), otherwise ending the current round of processing.

[0199] Step 1110, Determine the dividend Is it less than the divisor? .

[0200] Each party holds the dividend The partitioning of the dividend and the partitioning of the divisor b, therefore the dividend The relationship between the dividend and the divisor b can be determined using a multi-party secure comparison protocol. Specifically, each party can compare the dividend and the divisor b based on the divisor b. Local sharding And the local partition of divisor b In collaboration with the remaining n-1 parties, the dividend is determined through a multi-party secure comparison protocol. Is it less than the divisor b? The comparison result here can be disclosed to n-side; for details of disclosure, please refer to the relevant description in step 380.

[0201] when and When updating, perform one or more updates until the dividend is not less than the divisor (i.e., ...). ) or the precision does not meet the preset conditions (such as Otherwise, no update is performed, and step 820 can be continued. Each update involves three variables: first, the updated dividend. Local sharding The dividend First, multiply the value; second, update the local fragment [d] of the quotient d so that the quotient d is multiplied by the same factor; third, update the precision number p.

[0202] In some embodiments, as shown in Figure 11, each side can divide the dividend. Local sharding And the local sharding of d All magnified to 10x.

[0203] Step 1120, obtain the multiplier Local sharding and remainder Local sharding .

[0204] Either side can base its decision on the dividend. Local sharding And the local partition of divisor b In collaboration with the remaining n-1 parties, a multiplier is obtained through a multi-party secure decomposition protocol. Local sharding and remainder Local sharding .

[0205] For more details on the multi-party secure decomposition protocol, please refer to Figure 9 and its related description.

[0206] Step 1130, multiply Local sharding Accumulated to the business Local sharding In the middle, to update the business Local sharding .Right now, .

[0207] Step 1140, change the remainder Local sharding As the updated dividend Local sharding .Right now, .

[0208] Since the absolute value of a signed number can be considered as an unsigned number, more details about the process shown in Figure 11 can be found in Figure 8 and its related description.

[0209] Figure 12 is an exemplary flowchart of a method for calculating a multi-party secure Sigmoid function according to some embodiments of this specification. Each party holds a first number. Fragments The first number is the input to the Sigmoid function.

[0210] Process 1200 can be executed by any of the n parties, as shown in Figure 12. Process 1200 may include the following steps.

[0211] Step 1210: Calculate the local fragment of the first preset value and the first number. Local sharding The difference yields the first opposite number. Local sharding .

[0212] Wherein, the first preset value is equal to 0, and step 1210 can be expressed as: .

[0213] Step 1220, obtain the first opposite number. Local partitioning of the natural exponential function value .

[0214] The natural exponential function value of the first negative number refers to the output value of the natural exponential function when the first negative number is used as input. Each side can be based on the first negative number. Local sharding In collaboration with the remaining n-1 parties, a multi-party secure natural exponential function calculation method is used to obtain the result with the first negative number. The input natural exponential function value Local sharding .

[0215] In some embodiments, step 1220 can be implemented by the multi-party secure natural exponential function calculation method shown in Figure 4.

[0216] Step 1230: Calculate the local fragment and natural exponential function value of the third preset value. Local sharding The sum of the values ​​is used to obtain the middle sum. Local sharding .

[0217] Wherein, the third preset value is equal to 1, and step 1230 can be expressed as: .

[0218] Step 1240, obtain the first number Local partitioning of Sigmoid function values .

[0219] The Sigmoid function value for the first number refers to the output value of the Sigmoid function when the first number is taken as the input value. The Sigmoid function can be defined as follows: Therefore, each party can base its local fragmentation on a third preset value (equal to 1) [1] and the intermediate sum value. Local sharding In collaboration with the remaining n-1 parties, the first number is obtained through a multi-party secure division protocol. Local partitioning of Sigmoid function values .

[0220] In some embodiments, step 1240 can be implemented by multi-party safe division as shown in FIG6.

[0221] In some embodiments, step 1240 can be implemented by multi-party secure unsigned number division as shown in FIG11.

[0222] Figure 13 is an exemplary flowchart of a method for calculating a multi-party secure Tanh function according to some embodiments of this specification. Each party holds a first number. Fragments The first number is the input to the Tanh function.

[0223] Process 1300 can be executed by any of the n parties, as shown in Figure 13. Process 1300 may include the following steps.

[0224] Step 1310: Calculate the local fragment of the first preset value and the first number. Local sharding The difference yields the first opposite number. Local sharding .

[0225] Wherein, the first preset value is equal to 0, and step 1310 can be expressed as: .

[0226] Step 1320, obtain the first number Local partitioning of the natural exponential function value .

[0227] The natural exponential function value of the first number refers to the output value of the natural exponential function when the first number is used as the input value. Each side can be based on the first number. Local sharding In collaboration with the remaining n-1 parties, a multi-party secure natural exponential function calculation method is used to obtain the result with the first number as the basis. The input natural exponential function value Local sharding .

[0228] In some embodiments, step 1320 can be implemented by the multi-party secure natural exponential function calculation method shown in Figure 4.

[0229] Step 1330, obtain the first opposite number. Local partitioning of the natural exponential function value .

[0230] The natural exponential function value of the first negative number refers to the output value of the natural exponential function when the first negative number is used as input. Each side can be based on the first negative number. Local sharding In collaboration with the remaining n-1 parties, a multi-party secure natural exponential function calculation method is used to obtain the result with the first negative number. The input natural exponential function value Local sharding .

[0231] In some embodiments, step 1330 can be implemented by the multi-party secure natural exponential function calculation method shown in Figure 4.

[0232] Step 1340, calculate the first number Local partitioning of the natural exponential function value Local partitions of the natural exponential function value of the first negative number The difference is used to obtain the median difference. Local sharding .Right now, .

[0233] Step 1350, calculate the first number Local partitioning of the natural exponential function value Local partitions of the natural exponential function value of the first negative number The sum of the values ​​is used to obtain the middle sum. Local sharding .Right now, .

[0234] Step 1360, First Number Local fragmentation of Tanh function values .

[0235] The Tanh function value for the first number refers to the output value of the Tanh function when the first number is taken as input. The Tanh function can be defined as follows: Therefore, each side can base its decision on the intermediate difference. Local sharding and the middle sum Local sharding In collaboration with the remaining n-1 parties, the first number is obtained through a multi-party secure division protocol. Local fragmentation of Tanh function values .

[0236] In some embodiments, step 1360 can be implemented by a multi-party safe division as shown in FIG6.

[0237] In some embodiments, step 1360 can be implemented by multi-party secure unsigned number division as shown in FIG11.

[0238] It should be noted that the above description of the process is for illustrative purposes only and does not limit the scope of this specification. Those skilled in the art can make various modifications and changes to the process under the guidance of this specification. However, these modifications and changes remain within the scope of this specification.

[0239] Figure 14 is an exemplary block diagram of a multi-party secure multiplication system according to some embodiments of this specification. Each party holds a slice of a first number and a slice of a second number.

[0240] System 1400 can be implemented in any of the n sides, as shown in Figure 14. System 1400 may include a multiplier fragment sending module 1410, a multiplier fragment receiving module 1420, a local product term calculation module 1430, a first cross term calculation module 1440, a second cross term calculation module 1450, and a multiplier fragment calculation module 1460.

[0241] The multiplier fragment sending module 1410 can be used to send local fragments of the first multiplier and local fragments of the second multiplier to the other party or the other multiple parties.

[0242] The multiplier fragment receiving module 1420 can be used to receive other fragments of the first multiplier and other fragments of the second multiplier from the other party or the other multiple parties. The number of the other multiple parties is no greater than n-2.

[0243] The local product term calculation module 1430 can be used to multiply the local fragments of the first multiplier and the local fragments of the second multiplier to obtain the local product term.

[0244] The first cross term calculation module 1440 can be used to multiply the local fragments of the first multiplier by the other fragments of the second multiplier to obtain one or more first cross terms.

[0245] The second cross term calculation module 1450 can be used to multiply the local fragments of the second multiplier with other fragments of the first multiplier to obtain one or more second cross terms.

[0246] The multiplier slice calculation module 1460 can be used to obtain a local slice of the product of the first multiplier and the second multiplier based on the local product term, the one or more first cross terms and the one or more second cross terms.

[0247] For more details about System 1400 and its modules, please refer to Figure 2 and its related description.

[0248] Figure 15 is an exemplary block diagram of a multi-party secure comparison system according to some embodiments of this specification. Each party holds a first number of fragments and a second number of fragments.

[0249] System 1500 can be implemented in any of the n sides, as shown in Figure 15. System 1500 may include a random number sharding acquisition module 1510, a first comparison function sharding acquisition module 1520, a second comparison function sharding acquisition module 1530, a first product calculation module 1540, a second product calculation module 1550, a target difference calculation module 1560, an intermediate product calculation module 1570, an intermediate product disclosure module 1580, and a result identification calculation module 1590.

[0250] The random number fragment acquisition module 1510 can be used to acquire local fragments of a first selected random number, a second selected random number, and a masked random number, wherein the first selected random number is related to the second selected random number.

[0251] The first comparison function fragment acquisition module 1520 can be used to acquire the local fragment of the first comparison function, which reflects the difference between the first number and the second number.

[0252] The second comparison function fragment acquisition module 1530 can be used to acquire the local fragment of the second comparison function, which reflects the difference between the second number and the first number.

[0253] The first product calculation module 1540 can be used for local partitioning based on the first selected random number and the first comparison function, and in cooperation with the other n-1 parties, to obtain the local partition of the first product of the first selected random number and the first comparison function through multi-party secure multiplication as described in any embodiment of this specification.

[0254] The second product calculation module 1550 can be used for local sharding based on the second selected random number and the second comparison function, and in cooperation with the other n-1 parties, to obtain the local sharding of the second product of the second selected random number and the second comparison function through multi-party secure multiplication as described in any embodiment of this specification.

[0255] The target difference calculation module 1560 can be used to obtain the local fragments of the target difference based on the local fragments of the first product and the local fragments of the second product.

[0256] The intermediate product calculation module 1570 can be used for local sharding based on the target difference and local sharding of the mask random number, in collaboration with the other n-1 parties, to obtain local sharding of the intermediate product through multi-party secure multiplication as described in any embodiment of this specification, wherein the intermediate product is equal to the product of the target difference and the mask random number.

[0257] The intermediate product disclosure module 1580 can be used for local fragmentation based on the intermediate product, in collaboration with the other n-1 parties, to disclose the intermediate product.

[0258] The result identifier calculation module 1590 can be used to: when the intermediate product is greater than 0, based on the local partition of the first selected random number and the local partition of the second preset value, in collaboration with the other n-1 parties, obtain a local partition of the XOR result of the first selected random number and the second preset value, and use it as the local partition of the result identifier; otherwise, based on the local partition of the first selected random number and the local partition of the first preset value, in collaboration with the other n-1 parties, obtain a local partition of the XOR result of the first selected random number and the first preset value, and use it as the local partition of the result identifier. The first preset value is equal to 1, the second preset value is equal to 0, when the result identifier is equal to 1, it indicates that the first number is not less than the second number, and when the result identifier is equal to 0, it indicates that the first number is less than the second number.

[0259] For more details about System 1500 and its modules, please refer to Figure 3 and its related description.

[0260] Figure 16 is an exemplary block diagram of a multi-party secure natural exponential function calculation system according to some embodiments of this specification. Each party holds a slice of the first number.

[0261] System 1600 can be implemented in one of the n sides, as shown in Figure 16. System 1600 may include a first number segmentation acquisition module 1610, a first recombination module 1620, a first natural exponential function calculation module 1630, a first secret sharing module 1640, a second natural exponential function value segmentation acquisition module 1650, and a second natural exponential function calculation module 1660.

[0262] The first number slice acquisition module 1610 can be used to acquire other slices of the first number from the remaining k squares, where k is no greater than n-2.

[0263] The first recombination module 1620 is used to sum the local fragments of the first number and k other fragments to obtain the first recombined fragment of the first number.

[0264] The first natural exponential function calculation module 1630 can be used to calculate the natural exponential function value of the first recombined piece of the first number, and obtain the first natural exponential function value. The natural exponential function value of the number is the output value of the natural exponential function when the number is used as the input value.

[0265] The first secret sharing module 1640 can be used to split the first natural exponential function value into n parts, distribute n-1 of them to the remaining n-1 parties, and use the remaining 1 part as a local fragment of the first natural exponential function value.

[0266] The second natural exponential function value slice acquisition module 1650 can be used to obtain slices of the second natural exponential function value from the rest, as local slices of the second natural exponential function value. The second natural exponential function value is equal to the natural exponential function value of the second recombined slice of the first number. The second recombined slice of the first number is equal to the sum of the other slices of the first number in the remaining n-(1+k) squares.

[0267] The second natural exponential function calculation module 1660 can be used to obtain the local slice of the natural exponential function value of the first number by cooperating with the other n-1 parties through multi-party secure multiplication as described in any embodiment of this specification.

[0268] For more details about System 1600 and its modules, please refer to Figure 4 and its related description.

[0269] Figure 17 is an exemplary block diagram of a computational system for a multi-party secure linear rectified function according to some embodiments of this specification. Each party holds a first number of slices.

[0270] System 1700 can be implemented in any of the n sides, as shown in Figure 17. System 1700 may include a first secure comparison module 1710 and a first secure multiplication module 1720.

[0271] The first security comparison module 1710 can be used to obtain the local fragmentation of the comparison result based on the local fragmentation of the first number and the local fragmentation of the second preset value, in cooperation with the other n-1 parties, through the multi-party security comparison method as described in any embodiment of this specification, where the second preset value is equal to 0.

[0272] The first secure multiplication module 1720 can be used to obtain a local slice of the product of the first number and the comparison result based on the local slice of the first number and the local slice of the comparison result, in cooperation with the other n-1 parties, through multi-party secure multiplication as described in any embodiment of this specification, and use the local slice of the product result as a local slice of the function value, wherein the function value is the output value of the linear rectified function with the first number as the input value.

[0273] For more details about System 1700 and its modules, please refer to Figure 5 and its related description.

[0274] Figure 18 is an exemplary block diagram of a multi-party secure division system according to some embodiments of this specification. Each party holds a slice of the dividend and a slice of the divisor.

[0275] System 1800 can be implemented in any of the n squares, as shown in Figure 18. System 1800 may include a sign determination module 1810, an absolute value determination module 1820, a quotient absolute value calculation module 1830, and a quotient restoration module 1840.

[0276] The symbol determination module 1810 can be used, in collaboration with the other n-1 parties, to determine the local fragment identified by the dividend symbol and the local fragment identified by the divisor symbol, respectively, based on the local fragment of the dividend and the local fragment of the divisor, through a multi-party secure symbol protocol.

[0277] The absolute value determination module 1820 can be used, in collaboration with the other n-1 parties, to determine the local fragments of the absolute value of the dividend and the local fragments of the absolute value of the divisor based on the local fragments of the dividend and the local fragments of the divisor, respectively, through a multi-party secure absolute value protocol.

[0278] The quotient absolute value calculation module 1830 can be used for local partitioning based on the absolute value of the dividend and the absolute value of the divisor, and in collaboration with the other n-1 parties, to obtain the local partition of the quotient absolute value through one or more rounds of processing.

[0279] The quotient restoration module 1840 can be used to obtain the local quotient based on the absolute value of the quotient, the local quotient identified by the sign of the dividend, and the local quotient identified by the sign of the divisor, in collaboration with the other n-1 parties.

[0280] For more details about System 1800 and its modules, please refer to Figure 6 and its related description.

[0281] Figure 19 is an exemplary block diagram of a system for securely calculating absolute values ​​of multiple parties according to some embodiments of this specification. Each party holds a slice of the target number.

[0282] System 1900 can be implemented in any of the n sides, as shown in Figure 19. System 1900 may include a result identification calculation module 1910 and an absolute value calculation module 1920.

[0283] The result identifier calculation module 1910 can be used to obtain the local fragment with the result identifier based on the target number and the local fragment with the first preset value, in collaboration with the other n-1 parties, through a multi-party secure comparison protocol. The result identifier indicates whether the target number is negative.

[0284] The absolute value calculation module 1920 can be used for local partitioning based on the target number and local partitioning based on the result identifier. In collaboration with the other n-1 parties, it obtains the local partitioning of the absolute value of the target number through a multi-party secure multiplication protocol.

[0285] For more details about System 1900 and its modules, please refer to Figure 7 and its related description.

[0286] Figure 20 is an exemplary block diagram of a multi-party secure decomposition system according to some embodiments of this specification. Each party holds a first number of fragments and a second number of fragments.

[0287] System 2000 can be implemented in any of the n sides, as shown in Figure 20. System 2000 may include decomposition module 2010.

[0288] The decomposition module 2010 can be used to execute m+1 rounds of looping, where m is a positive integer. Each round of looping includes: determining the local slice of the current multiple in the current round; based on the local slice of the current multiple and the local slice of the second number, cooperating with the remaining n-1 parties, obtaining the local slice of the intermediate product through a multi-party secure multiplication protocol, where the intermediate product is equal to the current multiple multiplied by the second number; based on the local slice of the intermediate product and the local slice of the first number, cooperating with the remaining n-1 parties, obtaining the local slice of the result identifier through a multi-party secure comparison protocol, where the result identifier indicates whether the intermediate product is less than the first number; based on the local slice of the result identifier, cooperating with the remaining n-1 parties, revealing the result identifier; when the result identifier indicates that the intermediate product is less than the first number, accumulating the local slice of the current multiple into the local slice of the target multiple; and subtracting the local slice of the intermediate product from the local slice of the first number, thereby updating the local slice of the first number. The local partition of the target multiple in the last round of the loop and the local partition of the updated first number are used as the local partition of the multiple and the local partition of the remainder, respectively. The multiple multiplied by the second number and the remainder equals the first number.

[0289] For more details about System 2000 and its modules, please refer to Figure 9 and its related description.

[0290] Figure 21 is an exemplary block diagram of a multi-party secure unsigned number division system according to some embodiments of this specification. Each party holds a slice of the dividend and a slice of the divisor, both of which are unsigned numbers.

[0291] System 2100 can be implemented in any of the n sides, as shown in Figure 21. System 2100 may include a quotient calculation module 2110.

[0292] The quotient calculation module 2110 can be used to obtain the local fragment of the quotient through one or more rounds of processing. One round of processing includes the following steps: if the precision meets a preset condition, execute the following steps; otherwise, end the current round of processing: based on the local fragments of the dividend and the divisor, collaborate with the other n-1 parties to determine whether the dividend is less than the divisor through a multi-party secure comparison protocol; if the dividend is not less than the divisor, do not update the local fragments of the dividend and the quotient; otherwise, perform one or more updates as follows until the dividend is not less than the divisor or the precision no longer meets the preset condition: update the local fragment of the dividend to make the dividend equal to the divisor. The quotient is multiplied and its local fragment is updated to the same multiplier, and the precision is updated. Based on the local fragments of the dividend and the divisor, in collaboration with the remaining n-1 parties, a multi-party secure decomposition protocol is used to obtain the local fragments of the multiplier and the local fragments of the remainder, wherein the multiplier multiplied by the divisor and the remainder equals the dividend. The local fragments of the multiplier are added to the local fragments of the quotient, thereby updating the local fragments of the quotient again. The local fragments of the remainder are used as the local fragments of the dividend after the second update.

[0293] For more details about System 2100 and its modules, please refer to Figure 11 and its related description.

[0294] Figure 22 is an exemplary block diagram of a multi-party secure Sigmoid function computation system according to some embodiments of this specification. Each party holds a first number of slices.

[0295] System 2200 can be implemented in any of the n squares, as shown in Figure 22. System 2200 may include a first negative number calculation module 2210, a third natural exponential function calculation module 2220, an intermediate sum calculation module 2230, and a Sigmoid function value calculation module 2240.

[0296] The first inverse number calculation module 2210 can be used to calculate the difference between the local fragment of the first preset value and the local fragment of the first number, so as to obtain the local fragment of the first inverse number, where the first preset value is equal to 0.

[0297] The third natural exponential function calculation module 2220 can be used for local partitioning based on the first negative number, in collaboration with the other n-1 parties, to obtain the local partition of the natural exponential function value of the first negative number through a multi-party secure natural exponential function calculation method.

[0298] The intermediate sum calculation module 2230 can be used to calculate the sum of the local slice of the third preset value and the local slice of the natural exponential function value of the first opposite number, so as to obtain the local slice of the intermediate sum.

[0299] The Sigmoid function value calculation module 2240 can be used to obtain the local slice of the Sigmoid function value of the first number based on the local slice of the third preset value and the local slice of the intermediate sum value, in cooperation with the other n-1 parties, through multi-party safe division as described in any embodiment of this specification. The Sigmoid function value of the first number is the output value of the Sigmoid function when the first number is the input value, which is equal to the third preset value divided by the intermediate sum value, and the third preset value is equal to 1.

[0300] For more details about System 2200 and its modules, please refer to Figure 12 and its related description.

[0301] Figure 23 is an exemplary block diagram of a multi-party secure Tanh function computation system according to some embodiments of this specification. Each party holds a first number of slices.

[0302] System 2300 can be implemented in any of the n squares, as shown in Figure 23. System 2300 may include a first negative number calculation module 2310, a fourth natural exponential function calculation module 2320, a third natural exponential function calculation module 2330, an intermediate difference calculation module 2340, an intermediate sum calculation module 2350, and a Tanh function calculation module 2360.

[0303] The first inverse number calculation module 2310 is used to calculate the difference between the local fragment of the first preset value and the local fragment of the first number, and obtain the local fragment of the first inverse number. The first preset value is equal to 0.

[0304] The fourth natural exponential function calculation module 2320 can be used to obtain the local fragment of the natural exponential function value of the first number by collaborating with the other n-1 parties through a multi-party secure natural exponential function calculation method.

[0305] The third natural exponential function calculation module 2330 can be used for local partitioning based on the first negative number, in collaboration with the other n-1 parties, to obtain the local partition of the natural exponential function value of the first negative number through a multi-party secure natural exponential function calculation method.

[0306] The intermediate difference calculation module 2340 can be used to calculate the difference between the local slice of the natural exponential function value of the first number and the local slice of the natural exponential function value of the first opposite number, and obtain the local slice of the intermediate difference.

[0307] The intermediate sum calculation module 2350 can be used to calculate the sum of the local slice of the natural exponential function value of the first number and the local slice of the natural exponential function value of the first opposite number, so as to obtain the local slice of the intermediate sum.

[0308] The Tanh function calculation module 2360 can be used to obtain a local slice of the Tanh function value of a first number based on the local slice of the intermediate difference and the local slice of the intermediate sum, in cooperation with the other n-1 parties, through multi-party secure division as described in any embodiment of this specification. The Tanh function value of the first number is the output value when the first number is used as the input value of the Tanh function, which is equal to the intermediate difference divided by the intermediate sum.

[0309] For more details about System 2300 and its modules, please refer to Figure 13 and its related description.

[0310] It should be understood that the systems and modules shown in Figures 14-23 can be implemented in various ways. For example, in some embodiments, the systems and modules can be implemented by hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated hardware. Those skilled in the art will understand that the methods and systems described above can be implemented using computer-executable instructions and / or included in processor control code, for example, on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The systems and modules of this specification can be implemented not only by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., but also by software executed by various types of processors, or by a combination of the aforementioned hardware circuits and software (e.g., firmware).

[0311] It should be noted that the above description of the system and its modules is for convenience only and should not be construed as limiting this specification to the embodiments described. It is understood that those skilled in the art, after understanding the system's principles, may arbitrarily combine the modules or construct subsystems connected to other modules without departing from these principles. For example, in some embodiments, the fourth natural exponential function calculation module 2320 and the third natural exponential function calculation module 2330 may be two modules or combined into one module. Such modifications are all within the scope of this specification.

[0312] The beneficial effects that the embodiments of this specification may bring include, but are not limited to: (1) providing some basic multi-party secure computation protocols, such as multiplication, division, comparison, absolute value calculation, natural exponential function calculation, etc. Based on one or more of these basic protocols, solutions applicable to various privacy protection scenarios can be proposed, such as secure MPNN for drug property prediction; (2) the provided multi-party secure computation protocols support three or more computation participants, and the number of participants can be flexibly set; (3) the dependence on auxiliary third parties (such as third-party servers that generate random numbers and secretly share them) in the multi-party secure computation process can be removed, thereby reducing the interaction frequency. (4) Conventional multi-party secure comparison protocols are only applicable to the comparison of binary values. For input values ​​in other bases (such as decimal), they need to be converted to binary before comparison. The multi-party secure comparison protocols provided in some embodiments of this specification support various bases (such as binary, octal, hexadecimal, etc.) without the need for base conversion, which can improve the efficiency of multi-party secure comparison. The multi-party secure comparison protocol is called frequently, so it can also improve the execution efficiency of other multi-party secure comparison protocols. (5) The provided multi-party secure division protocol has good calculation accuracy and can flexibly set relevant parameters, such as precision number p, encryption length m, etc. It should be noted that different embodiments may produce different beneficial effects. In different embodiments, the beneficial effects that may be produced can be any one or a combination of the above, or any other possible beneficial effects.

[0313] The basic concepts have been described above. Obviously, for those skilled in the art, the detailed disclosure above is merely illustrative and does not constitute a limitation on the embodiments of this specification. Although not explicitly stated herein, those skilled in the art may make various modifications, improvements, and corrections to the embodiments of this specification. Such modifications, improvements, and corrections are suggested in the embodiments of this specification, and therefore, such modifications, improvements, and corrections still fall within the spirit and scope of the exemplary embodiments of this specification.

[0314] Furthermore, this specification uses specific terms to describe embodiments thereof. For example, "an embodiment," "one embodiment," and / or "some embodiments" refer to a particular feature, structure, or characteristic associated with at least one embodiment of this specification. Therefore, it should be emphasized and noted that references to "an embodiment," "one embodiment," or "an alternative embodiment" in different locations throughout this specification do not necessarily refer to the same embodiment. Moreover, certain features, structures, or characteristics in one or more embodiments of this specification can be appropriately combined.

[0315] Furthermore, those skilled in the art will understand that various aspects of the embodiments of this specification can be described and illustrated through several patentable types or situations, including any new and useful combinations of processes, machines, products, or substances, or any new and useful improvements thereto. Accordingly, various aspects of the embodiments of this specification can be implemented entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. All of the above hardware or software can be referred to as a "data block," "module," "engine," "unit," "component," or "system." Furthermore, various aspects of the embodiments of this specification may be embodied as a computer product located on one or more computer-readable media, the product including computer-readable program code.

[0316] Computer storage media may contain a propagated data signal containing computer program code, for example, on baseband or as part of a carrier wave. This propagated signal may take various forms, including electromagnetic, optical, and suitable combinations thereof. Computer storage media can be any computer-readable medium other than a computer-readable storage medium, which can be connected to an instruction execution system, apparatus, or device to enable communication, propagation, or transmission of a program for use. The program code located on the computer storage medium can be propagated through any suitable medium, including radio, cable, fiber optic cable, RF, or similar media, or any combination of the above media.

[0317] The computer program code required for the operation of each part of the embodiments in this specification can be written in any one or more programming languages, including object-oriented programming languages ​​such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C++, C#, VB.NET, Python, etc., conventional procedural programming languages ​​such as C, Visual Basic, Fortran2003, Perl, COBOL2002, PHP, ABAP, dynamic programming languages ​​such as Python, Ruby, and Groovy, or other programming languages. This program code can run entirely on the user's computer, or as a standalone software package on the user's computer, or partially on the user's computer and partially on a remote computer, or entirely on a remote computer or processing device. In the latter case, the remote computer can be connected to the user's computer through any network, such as a local area network (LAN) or wide area network (WAN), or connected to an external computer (e.g., via the Internet), or in a cloud computing environment, or used as a service such as Software as a Service (SaaS).

[0318] Furthermore, unless expressly stated in the claims, the order of processing elements and sequences, the use of numbers and letters, or other names described in the embodiments of this specification are not intended to limit the order of the processes and methods of the embodiments of this specification. Although some inventive embodiments that are currently considered useful have been discussed by way of various examples in the foregoing disclosure, it should be understood that such details are for illustrative purposes only, and the appended claims are not limited to the disclosed embodiments. Rather, the claims are intended to cover all modifications and equivalent combinations that conform to the spirit and scope of the embodiments of this specification. For example, although the system components described above can be implemented by hardware devices, they can also be implemented solely by software solutions, such as installing the described system on existing processing devices or mobile devices.

[0319] Similarly, it should be noted that, in order to simplify the description of the embodiments disclosed in this specification and thereby aid in the understanding of one or more embodiments of the invention, the foregoing description of the embodiments in this specification may sometimes combine multiple features into a single embodiment, drawing, or description thereof. However, this method of disclosure does not imply that the objects of the embodiments in this specification require more features than those mentioned in the claims. In fact, the embodiments have fewer features than all the features of the single embodiments disclosed above.

[0320] For each patent, patent application, patent application publication, and other material, such as articles, books, specifications, publications, and documents, referenced in this specification, the entire contents of which are incorporated herein by reference. This excludes historical application documents that are inconsistent with or conflict with the content of this specification, as well as documents that limit the broadest scope of the claims of this application (currently or subsequently appended to this application). It should be noted that in the event of any inconsistency or conflict between the descriptions, definitions, and / or terminology used in the supplementary materials to this specification and the content of this specification, the descriptions, definitions, and / or terminology used in this specification shall prevail.

[0321] Finally, it should be understood that the embodiments described in this specification are merely illustrative of the principles of the embodiments described herein. Other variations may also fall within the scope of the embodiments described herein. Therefore, alternative configurations of the embodiments described herein are intended to be illustrative rather than limiting, and are considered consistent with the teachings of this specification. Accordingly, the embodiments described herein are not limited to those explicitly introduced and described herein.

Claims

1. A method for securely calculating the absolute value of a target number by multiple parties, involving n parties, where n is a positive integer not less than 3, each party holding a slice of the target number, the method being executed by one of the parties, comprising: Based on the target number of local fragments and the first preset value of local fragments, the local fragments with the result identifier are obtained in collaboration with the other n-1 parties through a multi-party security comparison protocol. The result identifier indicates whether the target number is negative; Based on the local fragments of the target number and the local fragments of the result identifier, the local fragments of the absolute value of the target number are obtained in collaboration with the other n-1 parties through a multi-party secure multiplication protocol.

2. The method as described in claim 1, wherein, The first preset value is equal to 0. When the target number is not less than the first preset value, the result identifier is equal to 1; otherwise, it is equal to 0. The local fragment based on the target number and the local fragment based on the result identifier, in collaboration with the other n-1 parties, obtains the local fragment of the absolute value of the target number through a multi-party secure multiplication protocol. This includes: the local fragment based on the result identifier and the local fragment based on the second preset value, in collaboration with the other n-1 parties, obtains the local fragment with the sign identifier through a multi-party secure multiplication protocol; the sign identifier indicates the positive or negative sign of the target number; the local fragment based on the sign identifier and the local fragment based on the target number, in collaboration with the other n-1 parties, obtains the local fragment of the absolute value of the target number through a multi-party secure multiplication protocol.

3. The method as described in claim 2, wherein, The second preset value is equal to 2; the local fragment based on the result identifier and the local fragment based on the second preset value, in collaboration with the other n-1 parties, obtains the local fragment with the symbol identifier through a multi-party secure multiplication protocol, including: the local fragment based on the result identifier and the local fragment based on the second preset value, in collaboration with the other n-1 parties, obtains the local fragment with the third product through a multi-party secure multiplication protocol; the third product is equal to the result identifier multiplied by the second preset value; the local fragment with the third preset value is subtracted from the local fragment with the third product to obtain the local fragment with the symbol identifier; the third preset value is equal to 1.

4. A system for securely calculating the absolute value of a target number by multiple parties, involving n parties, where n is a positive integer not less than 3, each party holding a slice of the target number, wherein the system is implemented in one of the parties, including a result identifier calculation module and an absolute value calculation module; the result identifier calculation module is used to cooperate with the other n-1 parties, based on the local slice of the target number and the local slice of a first preset value, to obtain the local slice of the result identifier through a multi-party secure comparison protocol; the result identifier indicates whether the target number is negative; the absolute value calculation module is used to cooperate with the other n-1 parties, based on the local slice of the target number and the local slice of the result identifier, to obtain the local slice of the absolute value of the target number through a multi-party secure multiplication protocol.

5. An apparatus for multi-party secure computation of absolute value, comprising a processor and a storage device, the storage device being used to store instructions, wherein, When the processor executes instructions, it implements the method for multi-party secure computation of absolute values ​​as described in any one of claims 1 to 3.

6. A multi-party secure decomposition method involving n parties, where n is a positive integer not less than 3, each party holding a slice of the first number and a slice of the second number, the method being executed by one party, comprising m+1 rounds of looping, where m is a positive integer, and one round of looping comprising: Determine the local shard for the current multiple in the current round; Based on the local fragments of the current multiple and the local fragments of the second multiple, and in collaboration with the remaining n-1 parties, the local fragments of the intermediate product are obtained through a multi-party secure multiplication protocol. The intermediate product equals the current multiple multiplied by the second number; based on the local fragment of the intermediate product and the local fragment of the first number, in collaboration with the other n-1 parties, the local fragment of the result identifier is obtained through a multi-party secure comparison protocol; The result identifier indicates whether the intermediate product is less than the first number; based on the result identifier, the local fragment, in collaboration with the other n-1 parties, exposes the result identifier; When the result indicator shows that the intermediate product is less than the first number, the local fragment of the current multiple is added to the local fragment of the target multiple; And, subtract the local fragments of the intermediate product from the local fragments of the first number, and then update the local fragments of the first number; The local partition of the target multiple in the last round of the loop and the local partition of the updated first number are used as the local partition of the multiple and the local partition of the remainder, respectively. The multiple multiplied by the second number and the remainder equals the first number.

7. The method of claim 6, wherein, The current multiple is 2 m+1-i , where i is the ordinal number of the current cycle; when the current cycle is the first cycle, the target multiplier is equal to 0.

8. The method of claim 6, wherein, The local shards for the current multiple are pre-configured.

9. A multi-party secure decomposition system involving n parties, where n is a positive integer not less than 3, each party holding a slice of a first number and a slice of a second number, the system being implemented in one of the parties, including a decomposition module for executing m+1 rounds of looping, where m is a positive integer, and one round of looping includes: Determine the local shard for the current multiple in the current round; Based on the local fragments of the current multiple and the local fragments of the second multiple, and in collaboration with the remaining n-1 parties, the local fragments of the intermediate product are obtained through a multi-party secure multiplication protocol. The intermediate product equals the current multiple multiplied by the second number; based on the local fragment of the intermediate product and the local fragment of the first number, in collaboration with the other n-1 parties, the local fragment of the result identifier is obtained through a multi-party secure comparison protocol; The result identifier indicates whether the intermediate product is less than the first number; based on the result identifier, the local fragment, in collaboration with the other n-1 parties, exposes the result identifier; When the result indicator shows that the intermediate product is less than the first number, the local fragment of the current multiple is added to the local fragment of the target multiple; And, subtract the local fragments of the intermediate product from the local fragments of the first number, and then update the local fragments of the first number; The local partition of the target multiple in the last round of the loop and the local partition of the updated first number are used as the local partition of the multiple and the local partition of the remainder, respectively. The multiple multiplied by the second number and the remainder equals the first number.

10. A multi-party secure decomposition apparatus, comprising a processor and a storage device, the storage device being used to store instructions, wherein, When the processor executes instructions, it implements the method for multi-party secure computation of absolute values ​​as described in any one of claims 6 to 8.

Images