Efficient optimization method for PVC protocol based on dual-tree structure

Abstract

This invention discloses an efficient optimization method for PVC protocols based on a dual-tree structure, belonging to the field of security protocol optimization. The method includes: in the random seed distribution phase, utilizing the recursive expansion characteristic of GGM trees to uniformly generate random seeds for multiple instances, reducing the number of OT interactions from linearly related to the number of instances to logarithmic levels; in the instance authentication phase, using Merkle trees to aggregate multi-instance data digests, requiring only one digital signature on the root hash to complete unified authentication of all instances. This invention significantly reduces the communication and computational complexity of the PVC protocol while maintaining its covert security and public verifiability, improving the protocol's scalability and deployment efficiency in large-scale secure multi-party computation scenarios.

Description

Technical Field

[0001] This invention belongs to the field of security protocol optimization, and in particular relates to an efficient optimization method for PVC protocol based on a dual-tree structure. Background Technology

[0002] With the rapid development of the internet and digital technologies, data has become a crucial production factor. How to achieve secure data sharing and collaborative computing while protecting data privacy has become a significant issue of common concern to both academia and industry. Secure multi-party computation (MPC), as a key technical approach to privacy-preserving computation, provides a theoretical foundation and technical support for multiple parties to conduct joint computation without disclosing their private data. Based on the adversary's capabilities, traditional MPC security models are typically divided into semi-honest and malicious models: the semi-honest model assumes that participants strictly adhere to the protocol, only attempting to infer others' secrets from received information; it is highly efficient but cannot withstand proactive attacks. The malicious model allows adversaries to arbitrarily deviate from the protocol, but often requires high computational and communication costs. To achieve a balance between security and efficiency, the covert security model has been proposed, allowing adversaries to deviate from the protocol but using probabilistic detection mechanisms to ensure that cheating behavior is detected with a high probability. Building on this, the publicly verifiable covert security model further requires that once cheating behavior is detected, honest participants can generate evidence of cheating that can be independently verified by any third party. The PVC model possesses both covertness and publicly verifiable characteristics, making it more suitable for practical application scenarios where participants highly value reputation and compliance.

[0003] However, existing PVC protocols still suffer from significant performance overhead during practical deployment, primarily in two aspects. First, during the Cut-and-Choose phase, to ensure the independence of inspected and evaluated instances, the sender typically needs to generate an independent random seed for each protocol instance and distribute the randomness through an unintentional transmission protocol. When the protocol contains λ instances, OT interactions linearly related to λ are required. As security parameters increase and the number of instances grows, OT communication and computational overheads increase rapidly, becoming a significant bottleneck affecting protocol efficiency. Second, in achieving public verifiability, existing PVC protocols typically require signing and authenticating key communication records and commitments for each protocol instance. When the number of instances is λ, the sender needs to generate λ signatures, and the receiver also needs to verify each signature individually. Both signature computation and verification overheads increase linearly, further limiting the scalability of the PVC protocol. These two efficiency bottlenecks make it difficult for existing PVC protocols to meet practical application requirements in large-scale circuit computing and multi-party collaborative computing scenarios. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides an efficient optimization method for PVC protocols based on a dual-tree structure, comprising: Based on security parameters and circuit information, multiple protocol instances are generated; Construct a GGM tree based on the master seed, and obtain the leaf node seed corresponding to each of the multiple protocol instances; Based on the evaluation instance index and the path information of the GGM tree, path verification information is obtained through an unintentional transmission protocol, and the leaf node seeds corresponding to other instances besides the evaluation instance are recovered based on the path verification information. Based on the leaf node seed corresponding to each instance, generate the protocol data and corresponding instance commitment for each instance, and record the communication summary for each instance; Based on the instance commitments and communication digests of each instance, a Merkle tree is constructed, the root hash is obtained, and the root hash is digitally signed to obtain the root signature; Based on the leaf node seed corresponding to the inspection instance and the protocol data of the inspection instance, verify the instance commitment and communication digest of the inspection instance, and generate a cheating certificate when the verification fails. Verify the consistency of the selection of the evaluation instance based on the evaluation instance index and the path verification information; Based on the protocol data corresponding to the verified evaluation instance, perform obfuscation circuit evaluation and obtain the calculation results.

[0005] Optionally, the step of constructing a GGM tree based on the master seed and obtaining the leaf node seed corresponding to each of the plurality of protocol instances includes: Set the master seed as the root node seed of the GGM tree; Based on the pseudo-random number generator, the current node seed is expanded into the left child node seed and the right child node seed, which is considered as one node expansion operation; The left child node seed and the right child node seed are used as new current node seeds. The node expansion operation is repeated until the same number of leaf node seeds as the number of protocol instances are generated, with each leaf node seed corresponding to one protocol instance.

[0006] Optionally, obtaining path verification information via an unintentional transport protocol based on the evaluation instance index and the path information of the GGM tree includes: Determine the path corresponding to the evaluation instance index in the GGM tree, the path being composed of path bits at each level; For each layer of the GGM tree, based on the path bits corresponding to that layer, the node information in the opposite direction is selected as the path verification information for that layer. By executing multiple unintentional transmission protocols, path verification information for each layer is obtained. The data transmitted in each unintentional transmission protocol is based on the XOR value of all nodes on the left side and the XOR value of all nodes on the right side of the corresponding layer.

[0007] Optionally, recovering the leaf node seeds corresponding to instances other than the evaluated instance based on the path verification information includes: Based on the path corresponding to the evaluation instance index, process layer by layer from top to bottom; For each layer, based on the obtained path verification information of the layer, the pseudo-random number generator is used to expand and recover the information of all subtree nodes in the layer that are in the opposite direction to the path of the evaluation instance. The steps described above for restoring the information of all subtree nodes in the layer that are in the opposite direction to the path of the evaluation instance are executed recursively until all leaf node seeds except the evaluation instance are obtained.

[0008] Optionally, generating protocol data and corresponding instance commitments for each instance based on the leaf node seed corresponding to each instance includes: Random numbers are derived from the leaf node seed corresponding to each instance; Based on the random number, generate a confusion circuit, input line label, and output line label for each instance; For each instance, a commitment is made to the obfuscated circuit, input line label, and output line label to generate a corresponding instance commitment.

[0009] Optionally, the step of constructing a Merkle tree and obtaining the root hash based on the instance commitments and communication digests of each instance includes: A data digest is constructed for each protocol instance, the data digest containing the instance number, receiver seed commitment, unintentional transmission communication record, instance communication digest, and instance commitment; Set the data summary of all instances as a leaf node of the Merkle tree; The combined hash of adjacent leaf node hashes is calculated from bottom to top until a unique root hash is obtained.

[0010] Optionally, verifying the instance commitment and communication digest of the inspection instance based on the leaf node seed corresponding to the inspection instance and the protocol data of the inspection instance includes: Based on the leaf node seed corresponding to the inspection instance, re-simulate and generate the protocol data for that inspection instance; Calculate the expected instance commitment and the expected communication summary based on the re-simulated protocol data; Compare the expected instance commitment with the received instance commitment, and the expected communication digest with the recorded communication digest; If any comparison result is inconsistent, the verification of the check instance is deemed to have failed.

[0011] Optionally, it also includes the step of executing the Judge algorithm: Based on the instance data digest and the corresponding Merkle path in the cheating certificate, calculate and verify whether the recovered root hash is consistent with the root hash in the certificate. Verify the validity of the root signature using the sender's public key; Based on the seed information in the cheating certificate, replay the receiver's execution process during the unintentional transmission phase to verify whether it is consistent with the communication record in the certificate; The process of the sender executing the protocol instance is replayed based on the recovered seed information to verify whether the expected commitment and communication digest are consistent with those in the certificate, and to determine whether cheating behavior exists based on the verification results.

[0012] On the other hand, the present invention also provides an electronic device including a memory, a processor, and a computing program stored in the memory and executable on the processor, wherein the processor implements the method when executing the computing program.

[0013] On the other hand, the present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method.

[0014] Compared with the prior art, the present invention has the following advantages and technical effects: This invention significantly reduces the communication and computational overhead of the PVC protocol while maintaining its original covert security and public verifiability. In the Cut-and-Choose phase, a GGM tree structure is introduced to structurally reconstruct the generation and distribution process of random seeds for multiple instances. Utilizing the recursive expansion characteristics of the GGM tree, the OT interaction complexity, which was originally linearly related to the number of instances, is reduced to logarithmic levels, effectively alleviating communication bottlenecks in large-scale instance scenarios. In the public verification phase, a Merkle tree is introduced to aggregate data digests from multiple protocol instances. Unified authentication of all instances can be completed with only one digital signature on the root hash, compressing the number of signature generation and verification operations from a linear scale to a constant scale. The synergistic optimization of the two tree structures significantly reduces both the overall communication and computational complexity of the protocol, improving the scalability and practical deployment efficiency of the PVC protocol in cloud computing, multi-party collaborative computing, and large-scale secure multi-party computing scenarios. Attached Figure Description

[0015] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a PVC protocol interaction diagram according to an embodiment of the present invention; Figure 2 This is a flowchart of the Judge algorithm according to an embodiment of the present invention. Detailed Implementation

[0016] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0017] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0018] Example 1 like Figure 1 and Figure 2 As shown, this embodiment provides an efficient optimization method for the PVC protocol based on a dual-tree structure, including: Based on security parameters and circuit information, multiple protocol instances are generated; Construct a GGM tree based on the master seed, and obtain the leaf node seed corresponding to each of the multiple protocol instances; Based on the evaluation instance index and the path information of the GGM tree, path verification information is obtained through an unintentional transmission protocol, and the leaf node seeds corresponding to other instances besides the evaluation instance are recovered based on the path verification information. Based on the leaf node seed corresponding to each instance, generate the protocol data and corresponding instance commitment for each instance, and record the communication summary for each instance; Based on the instance commitments and communication digests of each instance, a Merkle tree is constructed, the root hash is obtained, and the root hash is digitally signed to obtain the root signature; Based on the leaf node seed corresponding to the inspection instance and the protocol data of the inspection instance, verify the instance commitment and communication digest of the inspection instance, and generate a cheating certificate when the verification fails. Verify the consistency of the selection of the evaluation instance based on the evaluation instance index and the path verification information; Based on the protocol data corresponding to the verified evaluation instance, perform obfuscation circuit evaluation and obtain the calculation results.

[0019] The specific process includes: In this embodiment, before the protocol is executed, the sender... With the recipient Safety parameters to be determined through joint consultation Number of protocol instances And the Boolean circuit C to be calculated. Wherein, the sender... Holding digital signature private key Its corresponding public key It will be made public to both parties.

[0020] Recipient First, a random seed is generated for each protocol instance. , where the subscript j represents the instance number. Then, Calculate the commitment value for each random seed. And send the full commitment value to the sender. .

[0021] sender Randomly select a master seed This primary seed is set as the root node of the GGM tree. Starting from this root node, The pseudo-random number generator recursively expands the current node seed into a left child seed and a right child seed, and then recursively executes the above expansion steps until the number of generated nodes matches the protocol instance count. Construct a tree containing the same number of leaf nodes. A complete binary tree with n leaf nodes is called a GGM tree. In this GGM tree, each leaf node corresponds to a random seed of a protocol instance, denoted as . After the GGM tree is constructed, Calculate the XOR value of all nodes in the left node of each level. and the XOR value of all nodes in the right node , where l represents the layer index, and the XOR value above is used as the data to be sent in subsequent unintentional transmission protocols. Receiver Randomly select an evaluation instance from all protocol instances, denoted by its index. The remaining instances are used as inspection instances.

[0022] Subsequently, both parties execute logλ times the 1-out-of-2 OT unintentional transmission protocol. For each level of the GGM tree, the sender... This layer ( , These are two input options for the unintentional transmission protocol. (Receiver) The selection bits for each layer are determined based on the binary representation of the evaluation instance index ĵ. Specifically, let the path bits corresponding to the l-th layer be ĵ. ,when hour, Select the XOR value corresponding to the right node. ;when hour, Select the XOR value corresponding to the left node. ,Right now Always select the XOR value of the node in the opposite direction of the path where the evaluation instance is located. Meanwhile, the receiver... The randomness used in unintentional transmission protocols is determined by their local seed. Derivation occurs. After all unintentional transmission and interaction are completed, Based on the XOR values ​​of the nodes obtained at each layer, and combined with the expansion operation of the pseudo-random number generator, the node information of each layer other than the path corresponding to the evaluation instance is recovered layer by layer from top to bottom, thereby obtaining the random seed for all instances except the evaluation instance. A complete communication record of each unintentional transmission is saved as... .

[0023] For each protocol instance, the sender Using the random seed corresponding to this instance Generate random numbers, and use these random numbers to generate the obfuscation circuit, input line labels, and output line labels for this instance. (Receiver) The input tags corresponding to the evaluation instances are obtained through an unintentional transmission protocol. After the protocol execution for all instances is completed, a communication summary for each instance is recorded. .

[0024] For each protocol instance, the sender Make commitments to the obfuscation circuit, input line labels, and output line labels of this example, and generate corresponding commitment values. The randomness used in all commitments is determined by the random seed corresponding to that instance. Derivation. Subsequently. Promise values ​​of all instances Send to the recipient .

[0025] sender Construct a data digest for each protocol instance Where H is the cryptographic hash function, and j is the instance number. The seed commitment value for the recipient. To inadvertently transmit communication records, For instance communication summary, This is the commitment value for the instance. After the data digest for all instances is constructed, Each digest value is set as a leaf node in the Merkle tree, and the combined hash of adjacent leaf node hash values ​​is calculated layer by layer from bottom to top until a unique root hash value, RootHash, is obtained. Then... Digitally sign the root hash to obtain the root signature. and will Send to the recipient Recipient Based on locally stored data related to each instance, including Recalculate the data summary for each instance. Then, the Merkle tree is reconstructed in the same way as the sender's tree to obtain the root hash 'RootHash'. Subsequently, Using the sender's public key Verify root signature Does it correspond to 'RootHash'? If signature verification fails, it indicates an inconsistency in the authentication information, and the protocol immediately terminates and outputs the result.

[0026] For all inspection instances, the receiver Using the obtained random seed, re-simulate the sender. During the calculation process of generating the obfuscated circuit and the commitment stage, the desired communication digest and the desired commitment value are obtained. The expected value is compared with the actual received communication digest and commitment value; that is, it verifies whether the expected instance commitment matches the received instance commitment, and whether the expected communication digest matches the recorded communication digest. If an inconsistency is found, the sender is determined to be the cause of the discrepancy. Cheating has occurred, and a cheating certificate has been generated. This cheating certificate contains, but is not limited to, the following data required for public verification: instance number, communication records, communication digest, commitment value, the Merkle path corresponding to the instance, and root signature.

[0027] Recipient To the sender Public Evaluation Instance Index And path node information obtained through unintentional transmission protocols during the GGM seed distribution phase. Sender Based on the evaluation instance index Determine the corresponding GGM tree path and verify the receiver by combining it with the unintentional transmission interaction records. Check whether the disclosed path information is consistent with the selection result in the previous OT protocol. If the verification fails, the protocol terminates immediately and outputs the result.

[0028] sender To the recipient Send the obfuscated circuit, input tags, commitment information, and decommitment data corresponding to the evaluation instance. (Receiver) First, verify the correctness of the commitment; after the commitment is verified, Based on its own input tags and the received input tags, the system completes the evaluation of the confusion circuit, and finally obtains and outputs the calculation result.

[0029] Furthermore, to ensure the effectiveness of the public accountability mechanism, this invention also provides a cheating verification algorithm (hereinafter referred to as the Judge algorithm) for verifying the authenticity and integrity of cheating certificates and determining whether any party to the protocol has engaged in publicly verifiable cheating behavior. The Judge algorithm uses the cheating certificate and the sender's public key... And with circuit C as input, the following verification steps are performed: The Judge algorithm first uses the instance authentication digest from the cheating certificate. The algorithm calculates the hash value of each node in the Merkle tree layer by layer from bottom to top, based on the corresponding Merkle path, to recover the root hash 'RootHash'. The algorithm checks whether the recovered root hash is consistent with the root hash carried in the certificate. If they are inconsistent, the certificate is deemed invalid, and 0 is output.

[0030] Subsequently, the Judge algorithm utilizes the sender's public key. Verify the signature corresponding to the root hash RootHash The validity of the certificate is checked. If the signature verification fails, the certificate is deemed invalid and 0 is output.

[0031] The Judge algorithm verifies the recipient based on the random seed information contained in the cheating certificate and the communication records. The randomness used in the GGM seed distribution phase is checked against its pre-promised randomness. Simultaneously, the receiver's execution process during the seed distribution phase is replayed based on this randomness, and the simulated communication messages are checked against the communication records in the certificate. If any inconsistency exists, the certificate is deemed invalid and 0 is output.

[0032] The Judge algorithm uses the recovered random seed and communication records to re-simulate the sender. The algorithm executes the corresponding protocol instance and calculates the expected commitment value and the expected communication digest. Then, it checks whether the expected value matches the actual value in the certificate: (1) if the commitment value and the communication digest are completely consistent, output 0; (2) if the commitment value is inconsistent, determine the sender's identity. If cheating occurs, output 1; (3) If the commitment values ​​are consistent but the communication digests are inconsistent, locate the first inconsistent message. If the message was sent by the sender If the signal is received, output 1; otherwise, output 0.

[0033] The above embodiments fully define the publicly verifiable covert security protocol optimization method based on GGM trees and Merkle trees provided by this invention. In the GGM tree random seed distribution stage, this method reduces the number of unintended transmission interactions from linearly related to the number of instances to logarithmic levels by setting the master seed as the root node of the GGM tree and recursively expanding to generate leaf node seeds for each instance, combined with determining the OT selection direction based on the evaluation instance index path bits. In the Merkle tree authentication stage, by setting the data digest of each instance as a leaf node and calculating the root hash from bottom to top, unified authentication of all instances can be completed by performing a digital signature on the root hash only once. These steps together constitute the overall technical solution of this invention, which differs from existing technologies. While maintaining the covert security and publicly verifiable nature of the PVC protocol, it achieves a synergistic reduction in protocol communication complexity and computational complexity.

[0034] On the other hand, this embodiment also provides an electronic device, including a memory, a processor, and a computing program stored in the memory and executable on the processor, wherein the processor implements the method when executing the computing program.

[0035] On the other hand, this embodiment also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method.

[0036] The above are merely preferred embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A highly efficient optimization method for PVC protocol based on a dual-tree structure, characterized in that, include: Based on security parameters and circuit information, multiple protocol instances are generated; Construct a GGM tree based on the master seed, and obtain the leaf node seed corresponding to each of the multiple protocol instances; Based on the evaluation instance index and the path information of the GGM tree, path verification information is obtained through an unintentional transmission protocol, and the leaf node seeds corresponding to other instances besides the evaluation instance are recovered based on the path verification information. Based on the leaf node seed corresponding to each instance, generate the protocol data and corresponding instance commitment for each instance, and record the communication summary for each instance; Based on the instance commitments and communication digests of each instance, a Merkle tree is constructed, the root hash is obtained, and the root hash is digitally signed to obtain the root signature; Based on the leaf node seed corresponding to the inspection instance and the protocol data of the inspection instance, verify the instance commitment and communication digest of the inspection instance, and generate a cheating certificate when the verification fails. Verify the consistency of the selection of the evaluation instance based on the evaluation instance index and the path verification information; Based on the protocol data corresponding to the verified evaluation instance, perform obfuscation circuit evaluation and obtain the calculation results.

2. The method according to claim 1, characterized in that, The step of constructing a GGM tree based on the master seed and obtaining the leaf node seed corresponding to each of the multiple protocol instances includes: Set the master seed as the root node seed of the GGM tree; Based on the pseudo-random number generator, the current node seed is expanded into the left child node seed and the right child node seed, which is considered as one node expansion operation; The left child node seed and the right child node seed are used as new current node seeds. The node expansion operation is repeated until the same number of leaf node seeds as the number of protocol instances are generated, with each leaf node seed corresponding to one protocol instance.

3. The method according to claim 1, characterized in that, The step of obtaining path verification information via an unintentional transfer protocol based on the evaluation instance index and the path information of the GGM tree includes: Determine the path corresponding to the evaluation instance index in the GGM tree, the path being composed of path bits at each level; For each layer of the GGM tree, based on the path bits corresponding to that layer, the node information in the opposite direction is selected as the path verification information for that layer. By executing multiple unintentional transmission protocols, path verification information for each layer is obtained. The data transmitted in each unintentional transmission protocol is based on the XOR value of all nodes on the left side and the XOR value of all nodes on the right side of the corresponding layer.

4. The method according to claim 3, characterized in that, Based on the path verification information, recover the leaf node seeds corresponding to other instances besides the evaluated instance, including: Based on the path corresponding to the evaluation instance index, process layer by layer from top to bottom; For each layer, based on the obtained path verification information of the layer, the pseudo-random number generator is used to expand and recover the information of all subtree nodes in the layer that are in the opposite direction to the path of the evaluation instance. The steps described above for restoring the information of all subtree nodes in the layer that are in the opposite direction to the path of the evaluation instance are executed recursively until all leaf node seeds except the evaluation instance are obtained.

5. The method according to claim 1, characterized in that, The step of generating protocol data and corresponding instance commitments for each instance based on the leaf node seed corresponding to each instance includes: Random numbers are derived from the leaf node seed corresponding to each instance; Based on the random number, generate a confusion circuit, input line label, and output line label for each instance; For each instance, a commitment is made to the obfuscated circuit, input line label, and output line label to generate a corresponding instance commitment.

6. The method according to claim 1, characterized in that, The step of constructing a Merkle tree and obtaining the root hash based on the instance commitments and communication digests of each instance includes: A data digest is constructed for each protocol instance, the data digest containing the instance number, receiver seed commitment, unintentional transmission communication record, instance communication digest, and instance commitment; Set the data summary of all instances as a leaf node of the Merkle tree; The combined hash of adjacent leaf node hashes is calculated from bottom to top until a unique root hash is obtained.

7. The method according to claim 1, characterized in that, The step of verifying the instance commitment and communication digest of the inspection instance based on the leaf node seed corresponding to the inspection instance and the protocol data of the inspection instance includes: Based on the leaf node seed corresponding to the inspection instance, re-simulate and generate the protocol data for that inspection instance; Calculate the expected instance commitment and the expected communication summary based on the re-simulated protocol data; Compare the expected instance commitment with the received instance commitment, and the expected communication digest with the recorded communication digest; If any comparison result is inconsistent, the verification of the check instance is deemed to have failed.

8. The method according to claim 1, characterized in that, It also includes the step of executing the Judge algorithm: Based on the instance data digest and the corresponding Merkle path in the cheating certificate, calculate and verify whether the recovered root hash is consistent with the root hash in the certificate. Verify the validity of the root signature using the sender's public key; Based on the seed information in the cheating certificate, replay the receiver's execution process during the unintentional transmission phase to verify whether it is consistent with the communication record in the certificate; The process of the sender executing the protocol instance is replayed based on the recovered seed information to verify whether the expected commitment and communication digest are consistent with those in the certificate, and to determine whether cheating behavior exists based on the verification results.

Images