A random banded matrix verifiable threshold sharing method, device and medium

Abstract

The application provides a random strip matrix verifiable threshold sharing method, device and medium, the method comprising: a distributor generates a mask vector to protect privacy data, forms a mask parameter, and synchronously generates a group of random seeds; each random seed corresponding share is calculated by expanding the random seed, the random seed and the corresponding share are distributed to the participants, and the mask parameter is broadcast in the network; in the reconstruction stage, the distributor recovers the random strip matrix row without loop according to the collected share and the random seed, and performs fast alignment; the reconstruction of the mask vector is completed by performing the parallelized Gaussian elimination on the aligned matrix; and the privacy data can be recovered according to the reconstructed mask vector and the mask parameter. The application realizes the data-level parallel acceleration of the Gaussian elimination row transformation, solves the problem that the large integer cannot be directly packed and parallel calculated, significantly reduces the calculation delay of concurrent reconstruction, and thus improves the efficiency of threshold sharing.

Description

Technical Field

[0001] This invention relates to the field of information security, and in particular to a method, device and medium for sharing verifiable thresholds in a random strip matrix. Background Technology

[0002] In the field of information security, data sovereignty and privacy protection are paramount. A single encryption method is insufficient to balance security and usability in multi-party interactions. Threshold sharing technology, as a core primitive for addressing this issue, distributes private data in multiple shares to participating parties, ensuring that only a specific number of legitimate participants can reconstruct the original data through computation, thus mitigating single points of failure and data leakage. However, the traditional Shamir threshold sharing scheme, based on Lagrange interpolation, suffers from a computational bottleneck due to its O(t^2) reconstruction complexity in high-threshold scenarios, prompting linear threshold sharing schemes based on sparse matrices to become a research hotspot. In wireless communication systems, unprotected wireless signals are easily detected and intercepted, compromising communication security. The reference “Sarvar Patel, Giuseppe Persiano, Joon Young Seo, and Kevin Yeo. Efficient Secret Sharing for Large-Scale Applications [C]. Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS '24), 2024: 3065-3079” proposes a scheme based on random striped matrices to reduce complexity, but it only mentions using SIMD instructions for simple data packing and lacks in-depth optimization for the large integer finite field operations required in verifiable threshold sharing. Summary of the Invention

[0003] This application provides a method, device, and medium for verifying threshold sharing of random strip matrices to solve the problems in the background art.

[0004] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0005] According to a first aspect of the embodiments of this application, a method for sharing verifiable thresholds of a random striped matrix is ​​provided. This method for sharing verifiable thresholds of a random striped matrix is ​​characterized by comprising: The distributor generates a mask vector to protect privacy data, forming mask parameters, and simultaneously generates a set of random seeds; by expanding the random seeds, the share corresponding to each random seed is calculated, and the random seeds and corresponding shares are distributed to the participants; and the mask parameters are broadcast in the network. During the reconstruction phase, the distributor receives the shares and corresponding random seeds submitted by the participants, and reconstructs the non-circling random strip matrix rows based on the collected random seeds, and uses a bucket sort-based linked list structure to quickly align the matrix rows. By performing parallel Gaussian elimination on the aligned matrix, the mask vector is reconstructed; the private data can then be recovered based on the reconstructed mask vector and mask parameters.

[0006] According to one embodiment of this application, the distributor generates a mask vector to protect privacy data and simultaneously generates a set of random seeds; the share corresponding to each random seed is calculated by expanding the random seeds and the mask vector, specifically including: Generate a mask vector of length t within a finite field. After obtaining the mask parameters by protecting privacy data using the mask vector, discard the mask vector. Generate a random seed for each participant ; Map the random seed to the starting column offset of the i-th row of the random strip matrix. ; Using seed-driven stream cipher to generate pseudo-random bit streams as elements of striped row vectors ; Based on the initial column offset with strip row vector elements The share corresponding to each random seed is calculated using modular addition.

[0007] According to one embodiment of this application, the calculation formula for the modular addition operation is specifically as follows:

[0008] in, random seed The corresponding share, To preset window width, Let be the number of elements in the finite field.

[0009] According to one embodiment of this application, the step of recovering the non-circling random strip matrix rows based on the collected random seeds and quickly aligning the matrix rows using a bucket sort-based linked list structure specifically includes: Recalculate the starting column offset based on the random seed. And restore the corresponding striped row vector elements; For each row, if there are consecutive zero elements at the beginning of the row, the starting column offset is incremented accordingly. And perform a left shift operation on the mask sequence until the first element of the row is non-zero; A bucket sort strategy is used, employing a linked list structure to offset all rows by their aligned starting columns. Mount the index and construct a column-aligned matrix representation.

[0010] According to one embodiment of this application, the reconstruction of the mask vector by performing parallelized Gaussian elimination on the aligned matrix specifically includes: By using SoA data layout in conjunction with the AVX-512 instruction set to perform parallel Gaussian elimination on the aligned matrix, the data is then restored from the SoA layout to the AoS regular layout and stored back into memory, thereby completing the efficient reconstruction of the mask vector.

[0011] According to one embodiment of this application, the parallelization of Gaussian elimination of the aligned matrix using SoA data arrangement in conjunction with the AVX-512 instruction set specifically includes: The original representation of each element in the matrix using four 64-bit segments is converted into a representation format using five 52-bit segments that is compatible with the AVX-512 instruction set. Multiple 256-bit field elements stored contiguously in memory are rearranged into a SoA layout using a transpose operation; The data of the eight prime number fields and large integers in the same position are loaded into the 512-bit register of the AVX-512 to form an aligned parallel data stream; Within a single instruction cycle, Montgomery modular multiplication and accumulation operations are performed synchronously on 8 parallel data streams, and carry is directly absorbed by utilizing the high-bit redundancy reserved by the byte conversion. By leveraging the masking characteristics of AVX-512, conditional modulo subtraction is performed in parallel to normalize to a finite field. Finally, the mask vector is restored from the SoA layout through a reverse reset operation and stored back into memory, thus achieving efficient reconstruction of the mask vector.

[0012] According to one embodiment of this application, the method further includes that after receiving the share and random seed, the participant verifies the validity of the share and random seed, and retains only the shares and random seeds that pass the verification.

[0013] According to one embodiment of this application, the participating party verifies the received share and random seed, specifically including: The participants reconstruct the starting column offset of the corresponding row using a random seed. with strip row vector elements ; Based on the elements of the striped row vector The verification points are obtained by accumulating the commitments at the corresponding locations on the elliptic curve group. The commitment is obtained from the set of homomorphic commitments for privacy data components broadcast by the distributor in the network; The verification points are verified using a preset verification formula.

[0014] According to a second aspect of the embodiments of this application, an electronic device is provided, comprising: At least one processor; and a memory communicatively connected to said at least one processor; The memory stores instructions executable by the at least one processor, which executes the instructions stored in the memory to perform the method as described in the first aspect.

[0015] According to a third aspect of the embodiments of this application, a computer-readable storage medium is provided for storing instructions that, when executed, cause the method described in the first aspect to be implemented.

[0016] Compared with existing technologies, the beneficial effects of adopting the above technical solution are as follows: This invention breaks through the traditional memory access bottleneck by using the SoA layout as its core, and deeply integrates the AVX-512 instruction set to achieve data-level and instruction-level parallel acceleration of Gaussian elimination in the large prime number field, significantly improving the computational throughput of data reconstruction; at the same time, the use of a non-encircling strip matrix structure ensures linear and continuous data storage, effectively eliminating memory skip access and reducing storage overhead and principal component search cost during the elimination process. Specific advantages are as follows: 1. Significantly improves computation and reconstruction performance: Compared with the standard solution based on Patel random strip matrix, this invention innovatively adopts SoA memory layout combined with 52-bit width vectorized parallel optimization, which completely breaks the memory access bottleneck of multi-way large integer operation, improves the share reconstruction speed by about 15 times, and greatly reduces the computational overhead.

[0017] 2. Low communication bandwidth and lightweight verification load: The sparse matrix is ​​compressed to the extreme through a random seed mechanism, which effectively alleviates the communication bandwidth pressure of distributed nodes. At the same time, by using a non-encircling strip sparse structure, the share verification process can be completed with only a small number of elliptic curve point addition operations, realizing lightweight verification for resource-constrained terminals.

[0018] 3. High robustness and high concurrency adaptability: While providing strong, verifiable threshold security protection, it can effectively identify malicious nodes and forged shares. Thanks to the extremely low reconstruction latency brought by SoA data-level parallelism, this solution can easily handle massive concurrent requests, perfectly meeting the high reliability and rapid recovery requirements in complex environments of cluster networks. Attached Figure Description

[0019] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0020] Figure 1 This is a flowchart of a method for verifying threshold sharing of a random strip matrix according to an embodiment of this application.

[0021] Figure 2 This is a flowchart of a verifiable threshold sharing system for a random strip matrix, as described in an embodiment of this application.

[0022] Figure 3 This is a vectorized parallel data flow diagram based on SoA layout and 52-limb reconstruction in an embodiment of this application.

[0023] Figure 4 This is a comparison chart of the distribution-verification-reconstruction performance of different schemes in the embodiments of this application.

[0024] Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0025] The embodiments of this application are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar modules or modules having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application. Rather, the embodiments of this application include all variations, modifications, and equivalents falling within the spirit and scope of the appended claims.

[0026] This invention addresses the problem of low threshold sharing reconstruction efficiency in large-scale distributed systems by proposing a verifiable threshold sharing method for random striped matrices based on SoA memory layout and highly parallel computing. SoA (Structure of Arrays) is a data arrangement method that centrally and contiguously stores the same attribute (e.g., the same weight bits of multiple large integers) of multiple independent data sets in physical memory. In traditional AoS (Array of Structures) layouts, the data blocks within each large integer are stored completely and contiguously. When the processor needs to compute multiple large integers simultaneously, it must perform jump-step retrievals from memory, leading to severe read latency and disrupting parallel continuity. This application overcomes this bottleneck by using SoA layout to tightly rearrange the data blocks of multiple large integers with the same weight, transforming them into a perfectly aligned parallel data stream that can be loaded continuously by the processor in one go. This achieves data-level parallel acceleration of Gaussian elimination row transformation, solves the problem of large integers not being able to be directly packaged for parallel computation, significantly reduces the computational latency of concurrent reconstruction, and has significant application value for building high-concurrency, low-latency distributed security systems. Verifiable threshold sharing, as a core cryptographic primitive for building distributed trust, introduces a mathematical commitment mechanism that enables participants to audit the validity and consistency of their shares without disclosing the privacy data itself. This invention, based on the standard "distribution-verification-reconstruction" three-stage model, constructs a complete implementation process centered on SoA memory layout and deeply integrated with vectorized parallel computing (such as the AVX instruction set) for acceleration.

[0027] For details, please refer to Figure 1 , Figure 2 The random banded matrix can be used to verify the threshold sharing method, specifically including the following steps: S100: The distributor generates a mask vector to protect privacy data, forming mask parameters, and simultaneously generates a set of random seeds; by expanding the random seeds, the share corresponding to each random seed is obtained, and the random seeds and corresponding shares are distributed to the participants; and the mask parameters are broadcast in the network.

[0028] In this embodiment, the distributor first in a finite field Internal generation length is mask vector .

[0029] Then, the publicly available cryptographic hash function is called. Evaluate the mask vector and output the hash. With the root key to be protected By performing algebraic addition, the mask parameters can be calculated. The mask parameters are then broadcast over the network as baseline data for subsequent reconstruction of the root key. It's important to note that the mask vector is discarded after the mask parameters are calculated and is not saved.

[0030] At the same time, the distributor also broadcasts a set of homomorphic commitments for privacy data components on the network, which are used by participants to verify their shares and random seeds.

[0031] To avoid constructing and distributing a globally dense matrix in memory, the distributor uses a secure pseudo-random number generation algorithm to independently generate a random seed with a fixed bit width for each participant in the network, based on a unified global random system state. .

[0032] Using the cryptographic SM3 hash algorithm to generate a random seed Mapped to a random banded matrix Row start column offset This determines the position range of the row in the global matrix.

[0033] Subsequently, a pseudo-random bit stream is generated using seed-driven stream cipher as the elements of a striped row vector. In the set window width Internal filtering of privacy data components. The distributor uses modular addition to calculate the share corresponding to each random seed. This process utilizes It achieves a compact representation of sparse row vectors, effectively reducing the communication load and storage overhead during the initialization phase, and ensuring that each seed can uniquely and deterministically reconstruct the row structure of the matrix; In one embodiment, after receiving the share and random seed, participants also need to combine it with a set of homomorphic commitments to privacy data components pre-published by the distributor. The validity of shares and random seeds is verified, and only shares and random seeds that pass the verification are retained. Since the matrix rows have a sparse banded structure and non-zero elements are only 1s, the verification process involves only a small number of dot addition operations, achieving lightweight verification.

[0034] Specifically, the participants are based on a random seed. And use the cryptographic SM3 hash algorithm to generate the starting column offset of the corresponding row. Stream ciphers generate pseudo-random generators to generate striped row vector elements. This accurately pinpoints the index range of the privacy data component corresponding to that share. Then, the participants accumulate their commitments at the corresponding positions on the elliptic curve group based on the mask to obtain the verification point. Finally, the formula was verified. The validity of the verification is used to confirm the authenticity and consistency of the identified shares, and the verified shares and random seed are retained. Since the matrix rows have sparse properties and the non-zero coefficients are only 1, the verification process mainly involves elliptic curve point addition operations, which greatly reduces the expensive scalar multiplication operations, thus realizing lightweight verification for random banded matrix structures.

[0035] After the participants complete the verification, they wait for the distributor to initiate the reconstruction operation.

[0036] S200. During the reconstruction phase, the distributor receives the shares and corresponding random seeds submitted by the participants, and reconstructs the non-circling random strip matrix rows based on the collected random seeds, and uses a bucket-sorted linked list structure to quickly align the matrix rows.

[0037] When the distributor needs to recover privacy data, it enters the reconstruction phase. First, the distributor receives the valid shares and their corresponding random seed sets submitted by surviving participating nodes that meet the threshold requirements. Then, according to... Recalculate the starting column offset And restore the corresponding striped row vector elements. Then, a crucial line alignment preprocessing step is performed: for each line, if there are consecutive zero elements at the beginning of the line, the alignment is incremented accordingly. Then, a left shift operation is performed on the mask sequence until the first element is non-zero, ensuring that the pivot column of each row can be directly located. Next, a bucket sort strategy is used, utilizing a linked list structure to sort all rows according to their alignment. By mounting indexes, a column-aligned matrix representation is constructed. Through a preprocessing alignment mechanism, wrapping structures are eliminated and the first element is forced to be non-zero, transforming the complex global pivot search into an efficient local linear access, significantly reducing the computational complexity and storage overhead of subsequent elimination processes.

[0038] In one embodiment, before proceeding to the Gaussian elimination solution, the distributor also needs to perform the aforementioned verification logic based on homomorphic point addition on the collected shares.

[0039] S300. By performing parallel Gaussian elimination on the aligned matrix, the mask vector is reconstructed; the privacy data can be recovered based on the reconstructed mask vector and mask parameters.

[0040] For the aligned matrix, this embodiment breaks with the traditional memory access pattern, adopts SoA layout to reorganize the data, and deeply integrates the AVX-512 instruction set to perform vectorized Gaussian elimination, achieving efficient reconstruction of the mask vector. Through the fusion of data arrangement optimization and instruction-level parallelism, the throughput of finite field operations is significantly improved.

[0041] This embodiment uses the SM2 prime field (256 bits) as an example to illustrate the reconstruction process of the mask vector. Please refer to [link / reference]. Figure 3 The detailed process can be further divided into: S301, Parallel-Oriented Limb Format Refactoring Specifically, the original compact and contiguous representation of each finite field element consisting of four 64-bit segments is converted into a five-bit representation format adapted for vectorized parallel computing and AVX-512 floating-point multiplication instructions. This conversion is achieved through bit shifting and masking operations, which effectively utilizes redundant bits in wide registers to delay carry processing, eliminates cross-channel carry synchronization waits in parallel computing, and avoids frequent overflow detection.

[0042] S302, Memory rearrangement based on SoA layout To address the issue of contiguous element-wise storage in AoS (Object-Oriented System) preventing concurrent loading of elements with the same weight, this step utilizes matrix transpose to rearrange multiple contiguous 256-bit field elements in memory into a SoA (Sort-of-Area) layout. Under this layout, elements with the same weight from multiple different elements are forced to be adjacent in physical memory, providing a perfect foundation for memory contiguity in subsequent vectorized batch processing.

[0043] S303, Vectorized loading of equal-weighted bits Leveraging the sequential memory access advantages of the S302's SoA layout, SIMD load instructions are used to load data from eight prime number fields containing large integers in the same limb into a 512-bit register in a single, step-free manner, forming an independent and highly parallelized limb-level data stream. By fully utilizing the ultra-wide register, synchronous loading of eight data bits with the same weight is achieved, providing efficient data supply for subsequent computation processes.

[0044] S304, Branchless Parallel Montgomery Modular Multiplication This system performs Montgomery modular multiplication and accumulation operations on eight data streams in a single instruction cycle. Utilizing independent data channels built with a SoA (Sort-of-Aspects) architecture, it employs dedicated SIMD instructions such as vpmadd52 and vpmullq to complete multi-channel 52-bit multiplication and accumulation within a single cycle. Furthermore, it directly absorbs carry-overs from intermediate processes through high-bit redundancy reserved in the S301, completely decoupling the dependencies between multiple data streams and significantly reducing the computational latency of row transformations during elimination.

[0045] S305, Parallel Conditional Normalization and Inversion Utilizing the unique mask register feature of the AVX-512, branchless conditional modulo subtraction operations are performed in parallel. The operation is then performed based on whether the result of each calculation exceeds the prime field order. Automatically generate a mask, synchronously perform subtraction or skip operations on 8 data streams, and normalize the results. Within the interval. Finally, the normalized data is restored from the SoA layout to the AoS regular layout and stored back into memory through the inverse operation, completing the batch concurrent transformation.

[0046] In addition, this embodiment also provides pseudocode descriptions of the aforementioned S301~S305, as follows:

[0047] To further verify the advantages of this invention, comparative experiments demonstrated the significant computational efficiency advantage of the proposed scheme. The experimental environment was a Windows 64-bit platform equipped with a 6-core 3.70 GHz AMD Ryzen 5 7500F processor and 32GB DDR5 memory. All test results were obtained in a multi-threaded environment. The experiments compared the traditional Shamir threshold sharing scheme (SHAMIR-F-VSS), the standard VSS scheme based on Patel random striped matrices (RB-F-VSS), the scheme based on non-circling striped matrices but without vectorization optimization (CERB-F-VSS), the 4×64-bit vectorization scheme based on AoS layout (CERB-F-VSS AoS 4×64), and the deep vectorization scheme based on SoA layout and 5×52-bit reconstruction proposed in this invention (CERB-F-VSS SoA 5×52).

[0048] In the share distribution and verification phase, the proposed scheme performs comparably to the standard strip matrix scheme and is far superior to the Shamir scheme based on Lagrange interpolation. In the critical reconstruction phase, experimental data shows that as the threshold size increases, the computation time of all schemes increases, but the vectorization scheme based on SoA proposed in this invention exhibits extremely high computational throughput. Figure 4 The distribution, verification, reconstruction, and total time consumption under different schemes are compared (corresponding to subgraphs (a), (b), (c), and (d) respectively). It can be seen that, due to the introduction of SoA memory rearrangement and the 52-bit representation format, this scheme not only eliminates cross-channel carry latency when processing large prime number operations, but also completely breaks through the memory access bottleneck of multi-path concurrency. Its reconstruction time is significantly lower than other comparative schemes. For example, under the highest test scale, the SoA parallel scheme of this invention improves the speedup by approximately 4 times compared to the unoptimized non-encircling strip matrix scheme, and by nearly 15 times compared to the Patel standard implementation scheme, fully verifying the huge acceleration effect of SoA layout-coordinated data-level parallel computing on Gaussian elimination.

[0049] This invention proposes a verifiable threshold sharing method for random striped matrices based on SoA memory layout and vectorized parallel computation. By combining the non-encircling sparsity of the striped matrix with data-level parallel computation depth, it effectively solves the computation and memory access bottlenecks in large-scale reconstruction scenarios. Compared with traditional solutions, this invention significantly reduces the computational latency of share reconstruction while ensuring verification reliability, and greatly improves the system's concurrent throughput. Furthermore, the SoA linear layout and 52-limb transformation technology designed for operations on large prime numbers provide a technical approach for high-performance distributed secure systems that balances cryptographic security and underlying architectural efficiency, and has significant practical application value for building low-latency, high-concurrency privacy-preserving computing platforms.

[0050] Based on the same technical concept, embodiments of this application also provide an electronic device that can implement the method flow for sharing a verifiable threshold for a random strip matrix provided in the above embodiments of the present invention. In one embodiment, the electronic device can be a server, a terminal device, or other electronic devices. Figure 5 As shown, the electronic device may include: At least one processor and a memory connected to the at least one processor. In this embodiment of the invention, the specific connection medium between the processor and the memory is not limited. Figure 5 The example used is the connection between the processor and memory via a bus. The bus... Figure 5 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. Buses can be divided into address buses, data buses, control buses, etc., but for ease of representation, [the specific bus type is not shown here]. Figure 5 The processor is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, a processor can also be called a controller; there are no restrictions on the name.

[0051] In this embodiment of the invention, the memory stores instructions executable by at least one processor. By executing the instructions stored in the memory, the at least one processor can execute the previously discussed method for verifyable threshold sharing of a random striped matrix. The processor can implement... Figure 5 The functions of each module in the device shown.

[0052] The processor is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory and calling data stored in memory, it can monitor the device's various functions and process data, thereby enabling overall monitoring of the device.

[0053] In an alternative design, the processor may include one or more processing units. The processor may integrate an application processor and a modem processor, wherein the application processor primarily handles the operating system, user interface, and applications, while the modem processor primarily handles wireless communication. It is understood that the modem processor may also not be integrated into the processor. In some embodiments, the processor and memory may be implemented on the same chip; in some embodiments, they may also be implemented separately on separate chips.

[0054] The processor can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit, field-programmable array, or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the random strip matrix verifiable threshold sharing method disclosed in the embodiments of this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0055] Memory, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory can include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. Memory is any other medium capable of carrying or storing desired program code in the form of instructions or data structures, and accessible by a computer, but is not limited thereto. In embodiments of the present invention, memory can also be a circuit or any other device capable of implementing storage functions, used to store program instructions and / or data.

[0056] By designing and programming the processor, the code corresponding to the verifiable threshold sharing method for random striped matrices described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute the steps of the methods described in the foregoing embodiments during runtime. How to design and program the processor is a technique well-known to those skilled in the art and will not be elaborated upon here.

[0057] Based on the same inventive concept, embodiments of the present invention also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform a method for sharing a verifiable threshold of a random strip matrix as described above.

[0058] In some alternative embodiments, the present invention also provides a method for sharing a verifiable threshold of a random strip matrix that can also be implemented as a program product comprising program code that, when the program product is run on a device, causes the control device to perform the steps in a method for sharing a verifiable threshold of a random strip matrix according to various exemplary embodiments of the present invention as described in this specification.

[0059] It should be noted that although several units or sub-units of the apparatus have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the invention, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units. Furthermore, although the operation of the method of the invention is described in a specific order in the drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0060] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0061] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a server, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0062] Program code for performing the operations of this invention can be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0063] In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0064] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0065] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0066] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A verifiable threshold sharing method for a random strip matrix, characterized in that, include: The distributor generates a mask vector to protect privacy data, forming mask parameters, and simultaneously generates a set of random seeds; by expanding the random seeds, the share corresponding to each random seed is calculated, and the random seeds and corresponding shares are distributed to the participants; and the mask parameters are broadcast in the network. During the reconstruction phase, the distributor receives the shares and corresponding random seeds submitted by the participants, and reconstructs the non-circling random strip matrix rows based on the collected shares and random seeds, and uses a bucket sort-based linked list structure to quickly align the matrix rows. By performing parallel Gaussian elimination on the aligned matrix, the mask vector is reconstructed; the private data can then be recovered based on the reconstructed mask vector and mask parameters.

2. The method for verifiable threshold sharing of random striped matrices according to claim 1, characterized in that, The distributor generates a mask vector to protect privacy data and simultaneously generates a set of random seeds; the share corresponding to each random seed is calculated by expanding the random seeds and the mask vector, specifically including: Generate a mask vector of length t within a finite field. After obtaining the mask parameters by protecting privacy data using the mask vector, discard the mask vector. Generate a random seed for each participant ; Map the random seed to the starting column offset of the i-th row of the random strip matrix. ; Using seed-driven stream cipher to generate pseudo-random bit streams as elements of striped row vectors ; Based on the initial column offset with strip row vector elements The share corresponding to each random seed is calculated using modular addition.

3. The method for verifyable threshold sharing of random striped matrices according to claim 2, characterized in that, The specific formula for the modular addition operation is as follows: in, random seed The corresponding share, To preset window width, Let be the number of elements in the finite field.

4. The method for verifyable threshold sharing of random striped matrices according to claim 1, characterized in that, The process of recovering non-circling random strip matrix rows based on the collected shares and random seeds, and then using a bucket-sort-based linked list structure to quickly align the matrix rows, specifically includes: Recalculate the starting column offset based on the random seed. And restore the corresponding striped row vector elements; For each row, if there are consecutive zero elements at the beginning of the row, the starting column offset is incremented accordingly. And perform a left shift operation on the mask sequence until the first element of the row is non-zero; A bucket sort strategy is used, employing a linked list structure to offset all rows by their aligned starting columns. Mount the index and construct a column-aligned matrix representation.

5. The method for verifyable threshold sharing of random striped matrices according to claim 1, characterized in that, The reconstruction of the mask vector by performing parallelized Gaussian elimination on the aligned matrix specifically includes: By using SoA data layout in conjunction with the AVX-512 instruction set to perform parallel Gaussian elimination on the aligned matrix, the data is then restored from the SoA layout to the AoS regular layout and stored back into memory, thereby completing the efficient reconstruction of the mask vector.

6. The method for verifyable threshold sharing of random striped matrices according to claim 5, characterized in that, The parallel Gaussian elimination performed on the aligned matrix using SoA data arrangement and AVX-512 instruction set specifically includes: The original representation of each element in the matrix using four 64-bit segments is converted into a representation format using five 52-bit segments that is compatible with the AVX-512 instruction set. Multiple 256-bit field elements stored contiguously in memory are rearranged into a SoA layout using a transpose operation; The data of the eight prime number fields and large integers in the same position are loaded into the 512-bit register of the AVX-512 to form an aligned parallel data stream; Within a single instruction cycle, Montgomery modular multiplication and accumulation operations are performed synchronously on 8 parallel data streams, and carry is directly absorbed by utilizing the high-bit redundancy reserved by the byte conversion. By leveraging the masking characteristics of AVX-512, conditional modulo subtraction is performed in parallel to normalize to a finite field. Finally, the mask vector is restored from the SoA layout through a reverse reset operation and stored back into memory, thus achieving efficient reconstruction of the mask vector.

7. The method for verifying threshold sharing of a random strip matrix according to claim 1 or 2, characterized in that, It also includes the requirement that after receiving the share and random seed, participants verify the validity of the share and random seed, and only retain the shares and random seeds that pass the verification.

8. The method for verifyable threshold sharing of random striped matrices according to claim 7, characterized in that, The participating parties verify the received share and random seed, specifically including: The participants reconstruct the starting column offset of the corresponding row using a random seed. with strip row vector elements ; Based on the elements of the striped row vector The verification points are obtained by accumulating the commitments at the corresponding locations on the elliptic curve group. The commitment is obtained from the set of homomorphic commitments for privacy data components broadcast by the distributor in the network; The verification points are verified using a preset verification formula.

9. An electronic device, characterized in that, include: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which executes the instructions stored in the memory to perform the method as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store instructions that, when executed, cause the method as described in any one of claims 1 to 8 to be implemented.

Images