Multiparty computing method and system for distributed processors with asymmetric network resources

Abstract

The method for asymmetric multi-party computation involves establishing data communication channels over a network between distributed computing processors. The computing processors are divided into fast and slow parties based on their network performance metrics. In the preprocessing phase, the fast parties execute a lost communication extension protocol to generate correlated randomness values. Inputs specific to both the fast and slow parties are stored. The fast parties then execute an unconditionally lost communication-based protocol to generate an output, which is stored and transmitted to all other parties. The total number of bits communicated over channels with greater latency is independent of the circuit size.

Description

[Technical Field]

[0001] Cross-references to related applications This application claims the interests of U.S. Provisional Patent Application No. 63 / 493,720, filed on 31 March 2023, the contents of which are incorporated herein by reference in their entirety.

[0002] Field of Invention This disclosure broadly relates to the field of secure multi-party computing in distributed computer systems, and more specifically to methods and systems for efficient computing between asymmetric parties with diverse network resources. [Background technology]

[0003] In the field of distributed computing, secure multi-party computation (MPC) is a branch of cryptography that allows a group of parties, each owning private data, to compute a function on their own data without revealing their private inputs to each other. This concept is particularly useful in scenarios where multiple entities wish to cooperate on computations without compromising the confidentiality of their individual data. Secure MPC allows a pair of untrusted parties to compute a function on their private inputs in such a way that nothing is revealed about their inputs other than the output of the computation.

[0004] One of the main factors that can affect the efficiency and performance of the MPC protocol is the speed of the network connection between the participating parties. The speed of the network connection is often called "bandwidth," and is typically measured in bits per second (bps), referring to the maximum amount of data that can be transmitted over the connection in a given time period. Higher bandwidth allows more data to be transferred simultaneously, resulting in a faster connection.

[0005] Another factor that can affect the performance of the MPC protocol is network connection latency. Latency refers to the amount of time it takes for a unit of data, typically a packet, to travel from a source device to a destination device across the network. A connection with lower latency is considered "faster" because data can be exchanged more quickly between the device and the network.

[0006] In addition to bandwidth and latency, the type of network technology used can also affect the speed of a network connection. Different network technologies, such as Ethernet® or Wi-Fi, have varying speed capabilities. For example, devices connected to a network using the latest Wi-Fi standard generally have faster connections than devices using older standards.

[0007] Furthermore, the quality and capacity of the network infrastructure, including routers, switches, and cables, can affect the speed of network connectivity. A well-designed and maintained network with high-quality components can provide faster connectivity compared to a poorly designed or outdated network.

[0008] Finally, the hardware of the computing device itself, such as the network interface card (NIC), processor, and memory, can also affect the speed of the network connection. High-performance NICs and devices with sufficient processing power can handle network traffic more efficiently, leading to faster connections.

[0009] Various tools and methods can be used to measure the bandwidth, latency, and overall performance of a network connection. These include online speed test tools, command-line tools like ping, and network monitoring software applications. By considering these factors and using appropriate testing methods, it is possible to determine the relative speed of a network connection between different computing devices.

[0010] Generally speaking, the current MPC protocol considers the simplest configuration in which all parties have network resources with the same guarantees. In particular, the most common synchronous network model considers a configuration in which all channel latency is capped by a single worst-case latency Δ and all channels have the same communication cost.

[0011] While this model is theoretically interesting, it has significant practical limitations. In particular, Δ must be set to a size large enough to accommodate any possible delay. Even if almost all parties have fast channels with delays δ ≪ Δ, the protocol does not take advantage of this, and the protocol's execution time is influenced by the slowest party. This is especially important for information theory protocols, where all current solutions have round complexity that depends on the depth of the circuit being evaluated. Similarly, protocols designed with this model cannot take advantage of communication costs from inexpensive channels, and the total communication cost is influenced by the most expensive channel.

[0012] By considering parties with asymmetric resources, it becomes possible to model more realistic scenarios where parties have access to resources at different levels, as well as design more sophisticated protocols that leverage such asymmetry. This improves the performance and communication costs of the protocols, while simultaneously achieving a more sophisticated level of security and assumptions.

[0013] Thus, it is necessary to investigate what the achievable trade-off is between the number of acceptable fraud and slow parties compared to the number of slow rounds in models with asymmetric latency. Similarly, there is a further need to investigate the trade-off regarding the number of bits transmitted through expensive channels in models with asymmetric communication costs.

[0014] In summary, traditional MPC protocols assume a symmetrical setup where all parties have similar computing and network resources. These protocols fail to account for the asymmetry of network resources and communication costs that often exists in real-world scenarios. This can lead to inefficiencies in protocol execution time and communication costs, especially in scenarios where there is a significant imbalance in resources among the participating parties. [Overview of the project] [Problems that the invention aims to solve]

[0015] This summary is provided to introduce in a simplified form a selection of concepts that will be further explained in the detailed description below. This summary is not intended to identify any important or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter. [Means for solving the problem]

[0016] Based on the current state of the art, we initiate the study of asymmetric MPC. In asymmetric MPC, the parties are divided into two categories. We consider a high-speed party, which has access to high-end network resources (e.g., channels with low latency, inexpensive channels, etc.), and a low-speed party, which can only access low-end network resources. For the high-speed party, it is privileged in a sense and can be considered as a party with access to high-speed and inexpensive Internet connections, for example, using fiber. On the other hand, the low-speed party is less privileged and only has access to low-speed and expensive connectivity. For example, we can consider Internet of Things (IoT) devices such as mobile devices or sensors that collect data.

[0017] We investigate two different models. In the first model, we consider asymmetric communication delays. The high-speed parties are connected via channels with a small delay δ among themselves, while the channels connecting (at least) one low-speed party have a large delay Δ≫δ. In the second model, we consider asymmetric communication costs. The high-speed parties benefit from channels with inexpensive communication, while the channels connecting the low-speed parties have expensive communication.

[0018] Based on the trade-off between the achievable number t of allowed corruptions and the number s of low-speed parties with respect to the round complexity and communication cost in each model, a range of results can be achieved. Some of the results are described in this specification.

[0019] In the model with asymmetric communication delays, focusing on the information-theoretic (i-t) setting · In a fixed number of low-speed rounds, as long as t + s < n and t < n / 2, a secure i-t asymmetric MPC protocol by abort · We show that achieving an i - t - asymmetric MPC protocol with a number of low - speed rounds independent of the circuit size for t + s = n implies an i - t - synchronous MPC protocol with round complexity independent of the circuit size. This is a major problem in the field of the round complexity of MPC. · We identify a new primitive, asymmetric broadcast, that consistently distributes values among fast parties and later allows the same values to be distributed to slow parties. We fully characterize the feasibility of asymmetric broadcast by showing that it is possible if and only if 2t + s < n. · An i - t - asymmetric MPC protocol with guaranteed output delivery in a number of low - speed rounds independent of the circuit size, as long as t + s < n and t < n / 2.

[0020] In a model with asymmetric communication costs, based on one - way functions (OWFs), as long as t + s < n and t < n / 2, we achieve an asymmetric MPC protocol for security by abort. This protocol communicates a certain number of bits independent of the circuit size over expensive channels. We conjecture that it is necessary to assume OWFs and further provide partial results in this direction.

[0021] Certain embodiments of the present disclosure include a method for asymmetric multiparty computation. This method involves establishing a data communication connection through a computer network among a collection of distributed computerized processors. Within this collection, the processors are classified into two distinct subsets based on their relative processing speeds. One subset includes fast parties and the other includes slower parties. This method includes the identification of these subsets, where the communication channels among fast parties are characterized by relatively small delays and the communication channels involving at least one slow party are characterized by larger delays.

[0022] During the preprocessing phase, the fast parties engage in an oblivious transfer (OT) extension protocol to set up OT channels between each pair of fast parties. This setup helps generate correlated randomness values ​​that remain hidden from other parties. The inputs are electronically stored by both the slow and fast parties, ensuring that each party's inputs are separate and confidential. Subsequently, each fast party executes instructions that result in the generation of an output, using an unconditional OT-based protocol designed for scenarios involving a dishonest majority. This output is electronically stored in each of the fast parties.

[0023] Furthermore, this method involves transmitting output from each of the high-speed parties to all other parties, both high-speed and low-speed, through an established data communication channel. In some embodiments, this method defines a sincere party majority where the number of sincere parties, denoted as t, is less than half of the total number of parties, n / 2. Moreover, this method ensures that the total number of bits communicated through a channel with greater delay remains independent of the size of the circuitry involved in the computation.

[0024] In some cases, the slower party is exempt from executing executable instructions. Instead, correlation generation is performed using an honest-majority multi-party computation (MPC) protocol. Alternatively, correlation randomness may be generated by a trusted dealer who directly distributes a certain number of OT correlations, denoted as k, among the faster parties, where k acts as a security parameter. In specific embodiments, the slower party is solely responsible for generating the MPC correlations.

[0025] This disclosure also describes a system for asymmetric multi-party computing. This system has a network device configured to establish data communication channels through a computerized network between a pair of distributed computerized processors. These processors are divided into relatively fast parties and slow parties. The system also includes a set of processors configured to identify fast and slow parties based on predetermined or detected network performance metrics. During the preprocessing phase, the fast parties execute an OT extension protocol to establish an OT channel between each pair of fast parties, thereby generating correlated randomness values. The fast parties are unaware of other values ​​during this process.

[0026] This system is designed to electronically store a set of inputs in both slow and fast parties, with each party's inputs known only to itself. Each fast party is equipped to execute an unconditional OT-based protocol through a communication channel for a large number of parties, executing commands and generating outputs. The outputs of the command executions are then electronically stored in each fast party. Furthermore, network devices are further configured to transmit the outputs from each fast party to all other parties in the network.

[0027] In some embodiments, the system guarantees a sincere majority of parties if t is less than n / 2. The system is also designed so that the total number of bits communicated through channels with relatively large delays is independent of the circuit size. In specific configurations, slow parties do not execute the executable instructions. Instead, correlations are generated using a sincere majority multi-party computation (MPC) protocol, or correlation randomness is generated by a trusted dealer who directly distributes k OT correlations among fast parties, where k is a security parameter. In some cases, the slow parties are responsible for generating the MPC correlations.

[0028] Furthermore, the disclosure includes a non-temporary processor-readable medium for storing code representing instructions to be executed by processors in a computing device for asymmetric multi-party computing. The code includes commands for establishing data communication channels through a computerized network between a set of distributed computerized processors. It also includes instructions for identifying sets of fast parties and slow parties based on predetermined or detected network performance metrics. During the preprocessing phase, the fast parties execute an OT extension protocol to establish OT channels between each pair of fast parties and generate correlated randomness values ​​without knowing the other values.

[0029] The medium is configured to electronically store a set of inputs in a set of slow and fast parties, ensuring that each party's inputs are known only to itself. Each fast party also includes instructions for executing commands and generating outputs, running an unconditional OT-based protocol through a communication channel for the unfaithful majority. The output of the command execution is then electronically stored in each fast party. Furthermore, the medium includes commands for each fast party to transmit outputs to all other parties in the network.

[0030] In some embodiments, the medium guarantees a sincere majority of parties when t is less than n / 2. Furthermore, the total number of bits communicated through a channel with relatively large latency is independent of the circuit size. In specific configurations, the slower party is responsible for generating MPC correlations rather than executing the executable instructions. The correlations may be generated using a sincere majority multi-party computation (MPC) protocol, or the correlation randomness may be generated by a trusted dealer who directly distributes k OT correlations among the faster parties, where k is a security parameter.

[0031] The above general description of exemplary embodiments and the following detailed description are exemplary aspects of the teachings of this disclosure and do not limit them. [Brief explanation of the drawing]

[0032] Non-exclusive and non-exclusive examples are illustrated with reference to the following diagram. [Figure 1] This is a schematic diagram of an asymmetric multi-party computing system including multiple processor nodes with varying channel speeds, as described in the disclosure. [Figure 2] A schematic diagram of a networked system having multiple processor nodes, based on various aspects of this disclosure, is shown, illustrating a triangular communication topology that accepts the relative speeds of the participating nodes. [Figure 3] This disclosure presents a block diagram of the core components of a computing device, highlighting the relationships between processing units, interface circuits, and memory units, as well as how these components differ in performance and how they affect the relative speed of devices in a multi-party computing system. [Figure 4] This disclosure provides block diagrams of the core components of a computer system, highlighting the roles of each component in the system's operation and how the differences between these components may contribute to the relative speed of the system in a networked environment. [Figure 5] This disclosure presents block diagrams illustrating the flow of instructions within a computing system, demonstrating how specialized processing paths for different types of instructions and processing speeds may differ for different units within the system. [Modes for carrying out the invention]

[0033] The following descriptions illustrate some aspects of the disclosure. However, it should be recognized that such descriptions are not intended to limit the scope of the disclosure. Rather, these descriptions also include combinations and modifications of the illustrative aspects described herein.

[0034] We begin a systematic study of asymmetric MPC with respect to two different models of network resources. In the first model, we consider a network with asymmetric communication latency. High-speed parties are connected via channels with small latency δ between them, while all other channels connected to low-speed parties have large latency Δ. In the second model, we consider a network with asymmetric communication cost. This means that high-speed parties benefit from channels with low communication costs, while other channels incur high communication costs.

[0035] Our focus is on tolerating as many fraudulent and slow parties as possible while simultaneously minimizing the complexity from slow parties (minimizing the number of slow rounds and the use of expensive channels). This will allow us to conduct the first overall study of the asymmetric MPC protocol in a clean manner.

[0036] Previous research has not addressed the asymmetric MPC configuration for any of the aforementioned resource models. For example, a synchronous protocol assumes that all channels have the same worst-case delay and that the communication cost is the same for all channels. Similarly, an asynchronous protocol assumes that all channels have final delivery and that all channels have the same communication cost.

[0037] However, it should be noted that existing protocols using standard cryptographic assumptions achieve a constant number of slow rounds, and FHE-based protocols achieve low communication through expensive channels. Therefore, our focus is on information-theoretic protocols that minimize the number of slow rounds, and non-FHE protocols that minimize communication through expensive channels.

[0038] 1. MPC with asymmetrical delay Model As described above, this model divides parties into two categories: fast parties and slow parties. Parties have access to a full network of point-to-point (P2P) channels. Channels between fast parties have a small delay δ and are designated as fast channels, while all other channels, i.e., channels containing at least one slow party, have a large delay Δ and are designated as slow channels.

[0039] We are interested in counting the number of slow P2P rounds, which is the number of P2P communication steps across all channels, and the number of fast rounds, which is the number of P2P communication steps across fast channels. Ideally, we want to find a protocol that has a certain number of slow P2P rounds, or at least a certain number of slow P2P rounds independent of the circuit being evaluated. Throughout this disclosure, the term P2P will be omitted, and such rounds will simply be referred to as fast rounds and slow rounds.

[0040] Existing solutions The current constant-round solution, based on cryptographic assumptions, is already an asymmetric MPC protocol with a certain number of slow rounds. This is because any constant-round synchronous MPC protocol trivially implies an asymmetric MPC protocol in our setting with a certain number of slow rounds.

[0041] Information-theoretic protocols Information-theoretic protocols are much more interesting. This is because all current synchronization solutions require a number of rounds proportional to the depth of the circuit being evaluated. This is in stark contrast to the protocols in our model, which can achieve a certain number of slow rounds (sometimes even constant) that are independent of the circuit. We propose several information-theoretic protocols for the malicious security setting with abort and guaranteed output delivery.

[0042] Below, let C be the circuit to be evaluated, and let n, s, t be the number of parties, the bound on the number of slow parties, and the bound on the number of misbehaviors, respectively.

[0043] Security through abort First, we present a protocol that achieves security by abort and is secure as long as t + s < n and t < n / 2. The round complexity is O(1) slow rounds and O(depth(C)) fast rounds.

[0044] Theorem 1 Let n, s, t be natural numbers such that t + s < n and t < n / 2. There is an information-theoretic asymmetric MPC protocol among n parties that securely evaluates circuit C with security by abort in the presence of up to t malicious misbehaviors and s slow parties. The round complexity is O(1) slow rounds and O(depth(C)) fast rounds.

[0045] Next, we show that a breakthrough is needed to improve the resilience of our asymmetric MPC protocol. Let t + s = n. Then the following result implies that constant-round information-theoretic MPC in the synchronous model with resilience to up to one misbehavior, which is an information-theoretic asymmetric MPC in a certain number of slow rounds, implies constant-round information-theoretic MPC in information-theoretic MPC.

[0046] Theorem 2 Let \(n, s, t \gt 0\) be natural numbers such that \(t + s=n\). Then, an \(n\)-party information - theoretic asymmetric MPC with security (or guaranteed output delivery) by abort, which is resilient to \(t\) corruptions and \(s\) slow parties in \(R\) low - speed rounds, implies an \((s + 1)\)-party information - theoretic synchronous MPC with security (or guaranteed output delivery) by abort, which is resilient to 1 corruption in \(R\) rounds.

[0047] Guaranteed output delivery In the setting of malicious security with guaranteed output delivery, two results are presented.

[0048] 2t+s <nかつt<n / 3のためのプロトコル We start by presenting a solution (without setup or broadcast) for an information - theoretic protocol with guaranteed output delivery in the regime where \(2t + s\lt n\) and \(t\lt n / 3\).

[0049] Theorem 3 Let \(\kappa\) be the security parameter. Let \(n, s, t\) be natural numbers such that \(2t + s\lt n\) and \(t\lt n / 3\). There is an \(n\)-party asymmetric MPC protocol that securely evaluates circuit \(C\) with guaranteed output delivery in the presence of up to \(t\) malicious corruptions and \(s\) slow parties. The round complexity is \(O(\kappa)\) low - speed rounds and \(O(\text{depth}(C)\cdot\kappa)\) high - speed rounds.

[0050] In the description of the above theorem, if it is assumed that a synchronous broadcast channel is set up (or alternatively, a setup for i - t signatures), the condition \(t\lt n / 3\) is not necessary.

[0051] The above protocol inherently requires the condition \(2t + s\lt n\). However, optimally, we would like to require an honest majority overall, rather than among the fast parties. This means that we would like to find a protocol that handles a dishonest majority among the fast parties.

[0052] Broadcast with asymmetrical delay To overcome this limitation, we identify a natural primitive called asymmetric broadcast in our setting with asymmetric delay. This primitive ensures that all fast parties obtain the output within d bc fast rounds, while slow parties obtain the same output much later, within D bc slow rounds. The quantity d bc is called the fast asymmetric broadcast delay, and D bc is called the slow asymmetric broadcast delay.

[0053] The first step is to investigate the possible trade-offs for asymmetric broadcast. Our results fully characterize the feasibility of asymmetric broadcast from point-to-point channels by showing matching positive and negative results.

[0054] First, in Section 5.2, we show a simple construction of an n-party asymmetric broadcast with a fast sender. Here, d bc and D bc are O(κ), and security holds up to t malicious corruptions and s slow parties as long as 2t + s < n, assuming a PKI setup for signatures. This theorem also holds unconditionally when the setup consists of information-theoretic signatures.

[0055] Theorem 4 Let n, s, t be natural numbers such that 2t + s < n. Assuming a PKI setup for signatures, there is an n-party asymmetric broadcast protocol with d bc = D bc = O(κ) that tolerates t malicious corruptions and s slow parties.

[0056] Perhaps surprisingly, this is the best trade-off that can be achieved, and allowing 2t + s = n for any non-trivial parameters t > 0 and s > 0 is impossible for any number of fast and slow rounds, even using the setup.

[0057] Theorem 5 Let n, s, t > 0 be positive natural numbers such that 2t + s = n. In that case, asymmetric broadcast is impossible for t malicious corruptions and s slow parties, even using the setup.

[0058] t+s <nかつt<n / 2のためのプロトコル . Here, we present an asymmetric MPC protocol that achieves a protocol that is secure as long as the parties have access to an asymmetric broadcast channel with fast and slow delays d bc and D bc , and t + s < n and t < n / 2. The round complexity is O(n·D bc ) slow rounds and O(depth(C)·n·d bc ) fast rounds. In the optimistic case where no party is corrupt, the factor n in the round complexity is omitted. That is, in this case, the protocol requires O(D bc ) slow rounds and O(depth(C)·d bc ).

[0059] Theorem 6 Let n, s, t be natural numbers such that t + s < n and t < n / 2. Assuming an asymmetric broadcast with slow and fast delays D bc and d bc , there is an n-party asymmetric MPC protocol that securely evaluates circuit C with guaranteed output delivery in the presence of up to t corruptions and s slow parties. The round complexity is O(n·D bc ) slow rounds and O(depth(C)·n·d bc) are high-speed rounds. In the case where all parties are honest and not malicious, the round complexity is O(D bc ) low-speed rounds and O(depth(C)·d bc ) high-speed rounds.

[0060] The number of rounds in the above protocol depends linearly on the number of parties in the worst case. This linear dependence can be removed at the cost of requiring any fixed fraction of honest parties among the high-speed parties.

[0061] System 1 Let ε > 0, and let n, s, t be natural numbers such that t < min{(1 - ε)(n - s), n / 2}. Assume an asymmetric broadcast with low-speed and high-speed delays D bc and d bc . There is an asymmetric MPC protocol among n parties that securely evaluates circuit C with guaranteed output delivery in the presence of up to t malicious parties and s low-speed parties. The round complexity is O(D bc ) low-speed rounds and O(depth(C)·d bc ) high-speed rounds.

[0062] 2. MPC with asymmetric communication costs Model . Similar to the previous model, the parties are divided into two categories: high-speed parties and low-speed parties. The parties have access to a complete network of standard synchronous point-to-point channels with the same delay upper bound. However, here the channels are distinguished with respect to the cost of communication. The channels between high-speed parties are marked as low-cost and inexpensive channels, and all other channels, i.e., channels that include at least one low-speed party as a sender or receiver, are marked as high-cost and expensive channels.

[0063] There is an interest in minimizing the number of bits sent through expensive channels. Note that the slow parties need to distribute their inputs, and thus the number of bits sent through expensive channels clearly depends (at least) on the total number of slow parties and their input sizes. Therefore, our main focus is that the number of bits on the expensive channel does not depend on the circuit being evaluated.

[0064] Existing solutions Note that current solutions using (multi-key) fully-homomorphic encryption (FHE) already send a certain number of bits through an expensive channel that is independent [separate] of the circuit being evaluated, considering that the computation is performed under homomorphic evaluation without interaction.

[0065] Protocol from a one-way function In that case, our focus is on protocols that do not use FHE. Furthermore, we focus on protocols that use the weakest possible cryptographic assumptions (preferably one-way functions or no assumptions).

[0066] Provide a protocol that is resilient as long as t + s < n and t < n / 2 and achieves security by abort. The protocol communicates O(poly(n,κ)) bits through an expensive channel and assumes the existence of a one-way function.

[0067] Theorem 7 Let n, s, t be natural numbers such that t + s < n and t < n / 2. Assuming the existence of a one-way function, there is an asymmetric MPC protocol between n parties that securely evaluates circuit C with security by abort in the presence of up to t malicious corruptions and s slow parties. The communication complexity is O(poly(n,κ)) bits of expensive communication and O(poly(n,κ)|C|) bits of cheap communication.

[0068] Interestingly, our communication-efficient protocol requires the existence of one-way functions, in contrast to our round-efficient protocol. We conjecture that this is necessary and provide partial results in this direction.

[0069] Lemma 1 Assume n-party asymmetric MPC, and for any natural numbers n, s, t > 0 such that n - s > 1, t + s < n, and t < n / 2, protect up to t semi-honest corruptions and s slow parties so that the slow parties perform a constant computation. Then this implies the existence of one-way functions.

[0070] 3. Technical Overview In this section, we describe the techniques used to achieve the statement of our theorem.

[0071] 3.1 Information-theoretic MPC with asymmetrical delay Present some information-theoretic solutions for the setting of security by abort and guaranteed output delivery.

[0072] Security through abort When \(t + s < n\) and \(t < n / 2\), a simple solution is provided to achieve security by aborting in a constant number of low-speed rounds. This protocol uses an information-theoretic MPC protocol for security by aborting and honest majority, with a linear round complexity in the depth of the circuit, to have all parties generate OT correlations between high-speed parties during the preprocessing phase. Since OT can be generated in parallel and can be computed with a circuit of a certain depth, this requires a constant number of low-speed rounds. Then the parties execute an information-theoretic MPC protocol in the client-server model that achieves security by aborting against a dishonest majority in the OT hybrid model. The party (acting as the client) distributes its input to the high-speed party (acting as the server), and the high-speed party computes the corresponding output and sends them back to their respective parties. Existing protocols are executed in a constant number of rounds during the input and output phases, and the number of rounds during the computation is linear in the depth of the circuit being evaluated. This leads to Theorem 1.

[0073] Next, we show that our protocol achieves optimal resilience. Any asymmetric MPC protocol that is secure when \(t + s=n\) among \(n\) parties and has a constant number of low-speed rounds implies a synchronous MPC protocol with security by aborting that is resilient to at most one corruption in a constant number of rounds, which is a major open problem in the round complexity of MPC. The implication of the proof is obtained from a simple emulation argument. To design a synchronous MPC protocol among \(s + 1\) parties, simply have \(s\) parties emulate each of the low-speed parties in the asymmetric MPC protocol, and the last party emulate all the high-speed parties together (a total of \(t\) parties). The resulting synchronous protocol has the same round complexity as the number of low-speed rounds in the asymmetric MPC protocol, and thus the implication is obtained. This corresponds to Theorem 2.

[0074] Asymmetric broadcast Briefly sketch the discussion characterizing the feasibility of asymmetric broadcast.

[0075] First, note that for a sender who is a slow party, it is clear that even if all parties are honest, it is impossible to expect fast parties to obtain the output quickly. Therefore, focus on the case where the sender is a fast party.

[0076] Assuming a PKI for signatures, for any 2t + s < n, the protocol (for fast senders) to achieve asymmetric broadcast is very simple. The fast parties execute a synchronous broadcast protocol among themselves and reach an agreement on the value v. All fast parties send the value v to the slow parties, and the slow parties take a majority vote. Since there is an honest majority among the fast parties, all slow parties output the same value. This is presented in Theorem 4.

[0077] When 2t + s = n, two ideas are used to show that asymmetric broadcast (for fast senders) is impossible even using a setup. First, note that the fast parties must output before the slow parties can communicate with any fast parties at all. This is because the fast rounds can be much faster than the slow rounds, i.e., the delay δ of the fast channel can be much smaller than the delay Δ of the slow channel, and asymmetric broadcast requires the fast parties to output quickly. Let v represent the value that the fast parties output. Second, since there is a dishonest majority among the fast parties, the malicious parties (including the sender) can simulate an execution with an input value v'≠v towards the slow parties. As a result, the honest slow parties cannot determine a consistent output value. The exact scenario-based proof is presented in Theorem 5.

[0078] Guaranteed output delivery It presents two results. First, it presents some simple solutions for information - theoretic protocols in the regime where 2t + s < n and t < n / 3. The protocol works as follows. First, since t < n / 3, the protocol generates a setup for information - theoretic signatures and emulates a synchronous broadcast channel with guaranteed termination from the slow parties to all parties in O(κ) slow rounds and from the fast parties to themselves in O(κ) fast rounds. Here, κ is the security parameter. Using these broadcast channels, the parties can execute an existing synchronous protocol in the client - server model as follows. All parties first act as the client, while each fast party additionally acts as the server. The client distributes its input to n - s servers, and each synchronous round corresponds to a slow round. The servers then execute the protocol computation, where each synchronous round corresponds to a fast round. Finally, the fast parties robustly reconstruct each output to their respective clients, and each synchronous round corresponds to a slow round. Standard information - theoretic protocols tolerate up to half of the servers being corrupt (assuming 2t < n - s) and any number of clients, have a fixed number of rounds and broadcast calls during the input and output phases, and have a number of rounds proportional to the circuit depth during the computation phase. This results in an asymmetric MPC protocol with O(κ) slow rounds and a number of fast rounds proportional to circuit depth × κ. This corresponds to Theorem 3.

[0079] Next, we present our information - theoretic asymmetric MPC protocol that assumes an asymmetric broadcast, guaranteed output delivery, and resilience [resilience] t + s < n and t < n / 2.

[0080] This protocol follows a shared-based paradigm and has a preprocessing phase and an online phase. During the preprocessing phase, the parties generate raw data unrelated to the input. During the online phase, the parties receive their input and perform protocol evaluation.

[0081] In the preprocessing phase, the MPC protocol by Cramer et al. is used to generate certified Beaver multiplication triples.

[0082] background First, their VSS protocol Π VSS Let's confirm this. The protocol follows a conventional verifiable secret sharing scheme using a two-variable polynomial, but instead of error correction, it uses so-called information-checking (IC) signatures. Abstractly, such signatures can be thought of as information-theoretic signatures that can only be transmitted once. They can be generated unconditionally without setup and also possess linearity properties; given signatures for values ​​x and y, a signature for x+y can be computed.

[0083] To share the value v, dealer D constructs a random bivariate polynomial f(x,y) of maximum degree t, where f(0,0)=v. The univariate polynomial projections f(x,i) and f(i,y) are signed in a manner that (all points (a i1 ,…,a in )=(f(i,1),…,f(i,n)) and (b 1i ,…,b ni Party P) sends (f(1,i), ..., f(n,i)) by sending the following; where each point is signed using IC signature. i The data is sent to [a specific address]. After this, the parties can compare the crosspoint values ​​between parties bilaterally and broadcast the signatures to reveal inconsistent behavior by the dealer. If inconsistency is detected, the dealer is disqualified.

[0084] After the check process, the values ​​held by honest parties are consistent, and there are at least honest parties with nt≧t+1, so these values ​​uniquely define a bivariate polynomial f'(x,y) of degree t at most, which in turn defines a fixed secret v' (v'=v if the dealer is honest). Thus, this already guarantees that the dealer is committed to the value after the sharing phase.

[0085] However, if the adversary sends a corrupted (malicious) share, the reconstruction may fail (the adversary can send any share). To avoid this, P i Each share is also signed by other parties. This, in turn, prevents adversaries from compromising secrecy during reconstruction.

[0086] At the end of VSS, each party P i is subshare (a i1 ,…,a in ) hold, a ij P j It is signed by. This implicitly shares a i We define this, which corresponds to f(i,0) in the case of an honest dealer.

[0087] Using the VSS scheme described above, addition gates can be processed locally (taking advantage of the fact that IC signatures are linear). Multiplication gates are processed using Gennaro, Rabin, and the well-known methods of Rabin. Each party P i is the share of input wires a and b a i and b i Multiply locally, and the result d i =a i b i The VSS is shared using VSS. This results in n VSSs, and the appropriate sharing of output wire c can be calculated as a fixed linear combination of these. The authors suggest that d i =a i b i Pi It's a secret. i Share it and show how he can properly prove that he did so.

[0088] Online Protocol At the start of the online phase, a sufficient number of triples (x,y,z) are shared using the protocol described above, and share x i , y i , z i Each of these is a corresponding subshare signed by another party via Party P i It is implicitly maintained by [the method]. Note that generating such proven beaver triples requires O(1) calls to broadcast, since they can be generated in parallel.

[0089] The online phase will proceed as follows: The party will be Π VSS It distributes its inputs using Π. The add gate is computed locally (since the share and IC signature are linear, simply add the share and IC signature). In the multiply gate, the fast party exposes two random values ​​(ax) and (by), where a and b are the values ​​of the input wires to the multiply gate. This is Π except that it distributes its share using asymmetric broadcast. VSS This is achieved by performing the same reconstruction procedure. Since the values ​​are IC signed, the fraudulent fast party can only withhold its share. As the fast party distributes its share via an asymmetric broadcast channel, this implies that all fast and slow parties will agree on a set of fraudulent parties, without contributing their share.

[0090] Note that since the threshold is t < n - s, if all fast parties contribute their shares, the slow party need not participate (and the protocol can proceed among the fast parties without incurring additional slow rounds). However, if not all shares are received, a process to identify and expel the cheating parties is executed. The fast parties wait for the slow party to help them publish their shares (note that n - t > t, and thus all honest parties can publish their shares together). Next, the identified cheating parties are expelled from the computation, and the protocol resumes without the expelled parties. This process incurs an overhead of a constant number of slow asymmetric broadcast delays. And each time at least one cheating party is expelled, the overhead incurred with respect to the total number of slow rounds is linear in the number of parties. This corresponds to Theorem 6.

[0091] 3.2 MPC with asymmetric communication costs We describe a protocol for MPC that communicates O(poly(n, κ)) bits over low-speed connections and achieves tolerances t + s < n and t < n / 2. The protocol is based on one-way functions and is similar to the simple protocol mentioned in Theorem 1 in the asymmetric delay model.

[0092] In this protocol, the communication-costly step is the generation of OT correlations that depends on the circuit size. To address this, we utilize an OT extension protocol that can be based on one-way functions.

[0093] More specifically, since t < n / 2, the parties can jointly create κ OT correlations between each pair of fast parties using an honest-majority MPC protocol. This step communicates O(poly(n, κ)) bits over low-speed connections. Then, the fast parties execute an OT extension protocol to set up an OT channel between each pair of fast parties.

[0094] Using this setup, the parties can then execute an unconditional protocol that achieves a dishonest majority in the OT hybrid model among the fast parties. The theorem stating the security of this protocol is Theorem 7.

[0095] The protocol described above utilizes one-way functions. We conjecture that this is necessary and provide partial results. We show that any asymmetric MPC protocol with at least two fast parties, where the slow parties perform little computation and has resilience t + s < n, implies the existence of one-way functions.

[0096] The high-level idea is to construct an OT extension protocol from an asymmetric MPC protocol. Since OT extension implies the existence of one-way functions, the claim holds.

[0097] Assume there is an asymmetric MPC protocol that outputs a large number of OTs. Using the protocol for dishonest majority, the computation of each slow party can be emulated. Note that since each slow party performs a small amount of computation, the circuit used to emulate this computation also uses a small number of (seed) OTs. This is stated in Lemma 1.

[0098] 4. Model and Definition Consider a set P = {P1,..., P n} of n parties. Divide the set of parties into two known categories: slow parties and fast parties. P = S ∪ F. The security parameter is denoted by κ.

[0099] 4.1 Communication networks and adversaries Consider a complete network of secure point-to-point channels. Parties have access to a synchronized clock, and messages sent by honest parties are guaranteed to be delivered within a known upper limit of delay. Consider two asymmetric network models.

[0100] Network with asymmetrical latency .

[0101] In the first model, we consider a network with asymmetrical latency. Channels between fast parties deliver messages within a small latency δ and are designated as fast channels. All channels containing at least one slow party have a large latency Δ and are designated as slow channels. Round complexity is measured as the number of slow P2P rounds (communication steps across all channels) and fast P2P rounds (communication steps across fast channels). We will omit references to the term P2P and simply refer to such rounds as fast rounds and slow rounds.

[0102] Networks with asymmetric communication costs The second model considers a network with asymmetric communication costs. Here, all channels have the same latency limit, similar to a standard synchronous network model, but the communication costs are asymmetric. Consider expensive communication, which is the number of bits transmitted over a channel containing at least one slow party, and inexpensive communication, which is the number of bits transmitted over a channel containing only fast parties.

[0103] adversaries At the beginning of the protocol, consider a static adversary who harms the party in any way.

[0104] 4.2 Broadcast Broadcasting allows a designated party, called the sender, to consistently distribute a message among a set of recipients.

[0105] Synchronized broadcast A synchronous broadcast channel with guaranteed termination delivers output to a set of receivers after a fixed number of rounds. There are also protocols with stochastic termination, in which case parties receive output after a certain number of rounds that are expected. However, configuring such protocols involves many nuances. If there are up to a third of fraudulent parties, a synchronous broadcast protocol with guaranteed termination can be achieved within O(κ) rounds. This is also true for a good-faith majority if the setup is available. In a setting of a bad-faith majority, synchronous broadcasting is unconditionally achievable in O(n) rounds using a PKI setup, and even using a setup for information-theoretic signing.

[0106] When these protocols are implemented using an asymmetric network latency model, they achieve an actual number of rounds proportional to the slowest channel. This means that if all parties involved (sender and receiver) are connected via fast channels, the output will be received after a fixed number of fast rounds. However, if some of the channels between the parties considered are slow, the protocol ensures that the receiver will receive the output after a fixed number of slow rounds.

[0107] 4.3 Secret sharing [Secret sharing] Some of our protocols utilize the Shamir secret sharing scheme, a t-out-of-n linear secret sharing scheme over a finite field F, consisting of two protocols (Sh,Rec) called sharing and reconstitution.

[0108] Protocol Sh involves designated parties called dealers, and n parties P1, ..., P nWe allow the distribution of values ​​s∈F between them. To do this, the dealer samples a uniform random polynomial f∈F[x] of at most degree t, according to the fact that f(0)=s. Then the dealer assigns the value f(i)=s i P i Send to s. i P i The share of the vector [s] t =(s1,…,s n This is called a share of degree t of s. The degree may be omitted if it is clear from the context. Note that any set of t shares reveals nothing about the secret.

[0109] Protocol Rec allows parties to jointly reconstruct secret s'. s' corresponds to the original secret s, provided the dealer is in good faith.

[0110] The Shamir secret sharing scheme also satisfies the following characteristics: • Additive homomorphism: ∀[x] t ,[y] t [x+y] t =[x] t +[y] t • Shared local multiplication of degree t: ∀[x] t ,[y] t , [x·y] 2t =[x] t ·[y] t .

[0111] 4.4 Lost Communication Oblivious transfer is a two-party primitive between a sender S and a receiver R. The sender has two inputs x0, x1 ∈ {0, 1} called the message, and the receiver R has an input c ∈ {0, 1} called the selection bit. Oblivious transfer is when R

number

[0112] 5. MPC with asymmetrical latency In this section, we introduce protocols in models with asymmetric delays. We are interested in protocols that incur as few, preferably a constant number of, slow rounds, and tolerate a large number of corruptions and slow parties.

[0113] 5.1 Security through Aborts Protocol description We present a naive protocol that achieves security using abort in a constant number of slow rounds when t + s < n and t < n / 2.

[0114] The protocol uses an (synchronous) information-theoretic MPC protocol with security by abort and for honest majority with linear round complexity in the circuit depth being evaluated, to have all parties generate OT correlations among the fast parties during the preprocessing phase. Note that since OT can be generated in parallel and can be computed with a constant-depth circuit, this is possible in a constant number of slow rounds. Then, the parties execute an information-theoretic MPC protocol that achieves security by abort against a dishonest majority in the OT hybrid model, in the client-server model. All parties act as clients, distribute their inputs to the fast parties, and the fast parties act as servers. The fast parties then compute the corresponding outputs and send them back to their respective parties. Existing protocols run in a constant number of rounds during the input and output phases, and the number of rounds during the computation is linear in the depth of the circuit being evaluated. As a result, the overall protocol incurs a constant number of slow rounds and a number of fast rounds proportional to the depth of the circuit. This leads to the following theorem.

[0115] Theorem 1 Let \(n\), \(s\), and \(t\) be natural numbers such that \(t + s < n\) and \(t < n / 2\). There is an information - theoretic asymmetric MPC protocol among \(n\) parties that securely evaluates circuit \(C\) with security - by - abort in the presence of up to \(t\) malicious corruptions and \(s\) slow parties. The round complexity is \(O(1)\) slow rounds and \(O(\text{depth}(C))\) fast rounds.

[0116] Barrier results Our results show that improving the resilience achieved by the protocols in the above sections is a breakthrough in the field of information - theoretic synchronous MPC. In particular, if there is an information - theoretic protocol with a constant number of slow rounds when \(t + s=n\), this implies that a constant - round information - theoretic synchronous MPC protocol can securely protect at most one corruption.

[0117] Theorem 2 Let \(n\), \(s\), \(t>0\) be natural numbers such that \(t + s=n\). Then, an \(n\) - party information - theoretic asymmetric MPC with security - by - abort (or guaranteed output delivery) that is resilient to \(t\) corruptions and \(s\) slow parties in \(R\) slow rounds implies an \((s + 1)\) - party information - theoretic synchronous MPC with security - by - abort (or guaranteed output delivery) that is resilient to 1 corruption in \(R\) rounds.

[0118] 5.2 Broadcast with Asymmetrical Latency The asymmetric broadcast channel guarantees the delivery of consistent messages, fast for fast parties and slow for slow parties. More precisely, the asymmetric broadcast channel has, for slow parties, after \(D\) bc slow rounds, and for fast parties, after \(d\) bcAfter a number of fast rounds, achieve a guaranteed output. We use this channel in protocols for guaranteed output delivery with resilience t + s < n and t < n / 2, but in this section, we study the realizability of this primitive from a full network of point-to-point channels as an independent problem.

[0119] Function: F sBC . Sender P * Given an input x from, outputs x to the adversary. Then, x is sent to all parties in S after D bc slow rounds and to all parties in F after d bc fast rounds.

[0120] First, note that it is impossible to achieve asymmetric broadcast when the sender is slow, since at least one slow round is needed to distribute the value to the fast parties. Thus, below we focus on the more interesting case where the sender is a fast party.

[0121] Realizability. Assuming a setup, it is easy to see that asymmetric broadcast with a fast sender is achievable when 2t + s < n. The protocol proceeds as follows. The sender with input s uses a synchronous broadcast protocol to distribute its value among all fast parties. Since there is an honest majority of fast parties, for example, the protocol by Katz and Koo can be used. All fast parties reach agreement on a value s' (which is s if the sender is honest) within O(κ) fast rounds, send their values to the slow parties, and the slow parties take a majority vote and output the result. Thus, the slow parties output after O(κ) fast rounds and one slow round.

[0122] Theorem 4 Let \(n\), \(s\), and \(t\) be natural numbers such that \(2t + s < n\). Assuming a PKI setup for signing, there is an \(n\)-party asymmetric broadcast protocol with \(d = D = O(\kappa)\) that tolerates \(t\) malicious corruptions and \(s\) slow parties. bc =D bc If a setup for information-theoretic signatures is assumed, this protocol can be achieved with unconditional security.

[0123]

[0124] impossibility Note that for any non-trivial parameters \(t>0\) and \(s>0\), asymmetric broadcast is impossible when \(2t + s=n\) for fast senders (even using a setup). This is in contrast to synchronous broadcast which can be achieved for any number of corruptions assuming a PKI setup (or unconditionally assuming information-theoretic signatures). The main issue is to achieve agreement between fast and slow parties. Intuitively, since asymmetric broadcast requires fast parties to obtain the output quickly, a fast party needs to determine its output value (let's denote this as \(v\)) without receiving any value from slow parties. Moreover, since there is a dishonest majority among fast parties, fast parties can act towards slow parties as if their output value was \(v'\neq v\). As a result, honest slow parties do not output \(v\) and consistency is lost.

[0125] Theorem 5 Let \(n\), \(s\), \(t>0\) be positive natural numbers such that \(2t + s=n\). In that case, asymmetric broadcast is impossible for \(t\) malicious corruptions and \(s\) slow parties even using a setup.

[0126] 5.3 Guaranteed Output Delivery ​In this section, we present two protocols. The first protocol achieves lower resilience but operates only assuming a point-to-point channel. The second protocol has higher resilience but utilizes asymmetric broadcast.

[0127] 2t+s <nかつt<n / 3のためのプロトコル In the regime where \(2t + s < n\) and \(t < n / 3\), it is easy to design an asymmetric MPC protocol by simply delegating the computation to the faster parties. Since \(t < n / 3\), the parties can create a setup for information-theoretic signatures and use this to construct a synchronous broadcast channel from the slow parties to all parties in \(O(\kappa)\) slow rounds and among themselves from the fast parties in \(O(\kappa)\) fast rounds. Note that they can do this.

[0128] Using the emulated synchronous broadcast channel, the parties can then execute an honest-majority protocol as follows. The slow parties using the emulated broadcast channel share their inputs towards the fast parties (with threshold \(t\)) using a verifiable secret sharing scheme, and the fast parties securely evaluate the circuit among themselves. The fast parties can then securely reconstruct the output for each receiver. The total round complexity is \(O(\kappa)\) slow rounds and \(O(\text{depth})\cdot\kappa)\) fast rounds. The theorem is as follows.

[0129] Theorem 3 Let \(\kappa\) be the security parameter. Let \(n, s, t\) be natural numbers such that \(2t + s < n\) and \(t < n / 3\). There is an \(n\)-party asymmetric MPC protocol that securely evaluates a circuit \(C\) with guaranteed output delivery in the presence of up to \(t\) malicious corruptions and \(s\) slow parties. The round complexity is \(O(\kappa)\) slow rounds and \(O(\text{depth}(C)\cdot\kappa)\) fast rounds.

[0130] Note that the condition \(t < n / 3\) is not necessary when a synchronous broadcast channel is given (or a setup for information-theoretic signatures).

[0131] t+s <nかつt<n / 2のためのプロトコル In this section, we present a protocol that achieves guaranteed output delivery with the higher trade-offs \(t + s < n\) and \(t < n / 2\). The resulting protocol has a round complexity of \(O(n\cdot D bc )\) low-speed rounds and \(O(\text{depth}(C)\cdot n\cdot d bc )\) high-speed rounds, assuming an asymmetric broadcast.

[0132] Proven Beaver Triple Generation Generate Beaver multiplication triples \((a,b,c)\) shared among all parties. The triples are certified in the sense that all shares are signed via information-checking signatures. This signature can be thought of as an information-theoretic signature that can be transferred only once. This signature is also homomorphic in the sense that for two values that can be verified in this way, any linear combination of them can be verified without additional information.

[0133] Generate the triples using the protocol by Cramer et al. that utilizes such an IC signature scheme. The protocol makes \(O(1)\) calls to the asymmetric broadcast (taking a total of \(O(D bc )\) low-speed rounds) since it can generate multiplication triples in parallel.

[0134] In this protocol, the value \(s\) is shared using a bivariate polynomial \(f(x,y)\) of degree at most \(t\). At the end of the sharing protocol, each honest party \(P i has the value \(s\) that lies on a polynomial of degree \(t\) corresponding to the values \(f(i,1),\ldots,f(i,n)\) if the dealer is honest. i1 ,\ldots,sin holds. This is the share of P i where s = f(i,0). i Furthermore, each value s ij is signed by party P j , and such a signature (from P j to P i ) is denoted by σ(s ij ,P j ,P i ). With this signature, P i can transfer the value s ij in an orthodox way. In section 7, the protocol is reproduced in detail.

[0135] Online Phase .

[0136] At the start of the online phase, enough triples (a, b, c) are shared using the protocol of Cramer et al. This means that each party P i implicitly holds each of the shares a i , b i , c i through the corresponding subshares signed by the other parties.

[0137] The online phase proceeds as follows. The parties distribute their inputs using the VSS scheme Π VSS of Cramer et al. Addition gates can be computed locally (since they are linear, simply by adding the shares locally and adding the signatures locally (add)). For multiplication gates, the fast parties distribute the shares using an asymmetric broadcast, except for Π VSSBy performing the same reconstruction procedure, two random values (x - a) and (y - b) are robustly opened. Here, x and y are the values of the input wires to the multiplication gate. Since the values are signed, a malicious party can only withhold its share. Since the fast parties distribute their shares via an asymmetric broadcast channel, this implies that all fast and slow parties do not contribute their shares and reach an agreement on the set of malicious parties.

[0138] Note that since the threshold is t < n - s, if all fast parties contribute their shares, the slow parties do not need to participate (and thus no additional slow rounds are needed). However, if not all shares are received, a process of identifying and expelling malicious parties is executed. The fast parties wait for the slow parties that help to open the shares (note that n - t > t, and thus all honest parties can jointly open the shares). Next, the identified malicious parties are expelled from the computation, and the protocol resumes without the expelled parties. This process involves O(D bc ) slow rounds. And the total number of slow rounds that occur each time at least one malicious party is expelled is proportional to the number of parties multiplied by the broadcast slow delay. The protocol is formally described below.

[0139] Protocol: Π rgod Initialize t' = t, F' = F. Pre-treatment phase 1: The parties generate the following using Cramer et al.'s protocol. · n k random sharings of the proven Beaver triples ([a k , [b k , [c m ). Here, nm As explained earlier, this is the number of multiplication gates. This is the number of honest parties P for each triple (a, b, c) i However, subshare a i1 , ..., a in By holding their share a i This means holding P. Here, each subshare is P j The IC is signed by these subshares. These subshares lie on a polynomial of degree t, and share a i It also lies on a polynomial f of degree t, where f(0) = a. The same applies to the values ​​b and c = ab. Input Phase x j Party P j This will be the input. 1:P j Protocol PI VSS Share your input xj using (as described in Section 7). Addition gate 1: The fast party locally adds the shares using the linearity of the sharing scheme and computes the corresponding IC signature using its linearity property. Multiplication gate Let [x] and [y] be shared inputs to the gate.

[0140] 1: The fast party within F' is Π VSS Using the reconstruction procedure (initiated only by the fast parties here), the values ​​xa and yb are publicly reconstructed among the fast parties using a multiplication triple ([a],[b],[c]). That is, the fast parties distribute their shares and corresponding IC signatures to all parties using asymmetric broadcasting. 2: Time d bc Afterward, all fast parties reach an agreement on whether all received shares have the correct IC signature and are t-consistent. If not, the fast parties will total 2D bcContinue to wait for that period of time. Otherwise, execute Step 5. 3: Time D bc After that, all the slow parties reach an agreement on whether the shares allocated by the fast parties are correct (t - consistent and have correct signatures). If not, the slow parties participate in the reconstruction by broadcasting their shares and IC signatures. 4: Time 2D bc After that, are there enough shares to reconstruct in Step 2, or at least one dishonest fast party P k ∈F' who did not contribute their share among all the honest parties (fast and slow). In this case, the parties expel the identified dishonest party and resume the protocol using the now threshold t' = t' - 1, and set F' = F\{P k}. 5: The fast parties within F' locally calculate the share of the output to the gate as [z]=(x - a)[b]+(y - b)[a]+[c]+(x - a)(y - b) (by locally adding each of the sub - shares) and update the IC signature as appropriate using the linearity property. Output phase 1: P j To reconstruct the sharing [x] towards P, the parties use the VSS reconstruction protocol within Π VSS to securely reconstruct the secret for P j .

[0141] Theorem 6 Let n, s, t be natural numbers such that t + s < n and t < n / 2. Assume an asymmetric broadcast with slow and fast delays D bc and d bc . Π rgod is an asymmetric MPC protocol among n parties that securely evaluates the circuit C with guaranteed output delivery in the presence of at most t dishonest and s slow parties. The round complexity is O(n·D bc) low - speed rounds and O(depth(C)·n·d bc ) high - speed rounds. In the non - adversarial optimistic case, the round complexity is O(D bc ) low - speed rounds and O(depth(C)·d bc ) high - speed rounds.

[0142] The number of low - speed rounds is independent of the depth of the circuit but has the drawback that in the worst - case it depends on the number of parties. However, assuming that a constant fraction of the high - speed parties are honest, the above protocol can be modified to achieve a round complexity of O(D bc ) low - speed rounds and O(depth(C)·d bc ) high - speed rounds. Then the adversary needs ε(n - s) dishonest parties that do not send messages to execute steps 3 and 4 in the multiplication step, and all these parties are identified and removed from the computation. This can happen at most 1 / ε times.

[0143] System 1 Let ε>0 and let n, s, t be natural numbers such that t < min{(1 - ε)(n - s), n / 2}. Assuming an asymmetric broadcast with low - speed and high - speed delays D bc and d bc , there is an asymmetric MPC protocol among n parties that securely evaluates a circuit C with guaranteed output delivery in the presence of at most t dishonest and s low - speed parties. The round complexity is O(D bc ) low - speed rounds and O(depth(C)·d bc ) high - speed rounds.

[0144] 6. MPC with asymmetric communication costs In this section, we introduce various protocols for models with asymmetric communication costs. We are interested in protocols that send as few bits as possible over expensive channels (channels that include at least one slow party), and that tolerate a large number of malicious parties and slow parties.

[0145] Looking more closely, our protocol from Theorem 3 already achieves reducing expensive communication, independent of the circuit, since the expensive communication only occurs at the input and output stages. However, the resilience is only 2t + s < n. Therefore, we are interested in protocols that achieve resilience t + s < n and t < n / 2.

[0146] 6.1 Security through Aborts Provide a protocol that achieves security by aborting and communicates O(poly(n,κ)) bits over an expensive channel. This protocol is obtained from existing results under the assumption of the existence of one-way functions. The idea is to generate pairwise OT correlations among the fast parties during the preprocessing phase. This is possible since there is an honest majority t < n / 2 of the parties and the total number of bits communicated over the expensive channel is independent of the circuit size. More specifically, each party prepares κ OT correlations per fast connection. (In total, O(n 2 κ) OTs. Using the results of Harnik, Ishai, and Kushilevitz, this can be reduced to O(nκ) OTs when there is a constant fraction of honest fast parties, i.e., when t < (1 - ε)(n - s) for some constant ε > 0. The said results are combined from distributing computations among several committees from Bracha, techniques for combining lost communication from Harnik et al., and the construction of dispersers.) Each pair of fast parties can use the OT extension protocol to set up an OT channel between them.

[0147] Once the OT channel is prepared, standard unconditional OT-based protocols for the dishonest majority can be executed to perform the computation during the fast parties and deliver the output to all parties, leading to the statement of the following theorem.

[0148] Theorem 7 Let \(n\), \(s\), \(t\) be natural numbers such that \(t + s < n\) and \(t < n / 2\). Assuming the existence of one-way functions, there is an asymmetric MPC protocol between \(n\) parties that securely evaluates circuit \(C\) with security-by-abort in the presence of up to \(t\) malicious corruptions and \(s\) slow parties. The communication complexity is \(O(\text{poly}(n,\kappa))\) bits of expensive communication and \(O(\text{poly}(n,\kappa)|C|)\) bits of cheap communication.

[0149] 6.2 Barriers of Communication Complexity In this section, we show that when assuming asymmetric MPC where slow parties perform a small amount of computation, this implies OT extension.

[0150] Lemma 1 Assume \(n\)-party asymmetric MPC and for any natural numbers \(n,s,t > 0\) such that \(n - s>1\), \(t + s < n\), and \(t < n / 2\), protect up to \(t\) semi-honest corruptions and \(s\) slow parties such that the slow parties perform constant computation. Then this implies the existence of one-way functions.

[0151] 7 Protocol Pi rgod Preprocessing phase In this section, we describe the details of the preprocessing phase of protocol \(\Pi\) in Section 5.3 that uses the protocol by Cramer et al. rgod of the protocol \(\Pi\).

[0152] 7.1 Information Check Information checking (IC) is a tool for authenticating information-theoretic data. The IC scheme consists of the following protocols between three parties (referred to as the dealer D, the intermediary INT, and the receiver R): • Dist: A dealer with input s sends s to INT and any auxiliary information to INT and R. AuthVal:INT(with input s) guarantees that R will output s in the Reveal protocol. Reveal:R receives a value s' from an INT along with some auxiliary data, and either accepts or rejects s'.

[0153] definition 1 The IC scheme is a triple protocol (Dist, AuthVal, Reveal) between parties D, INT, and R, where D starts with input s in Dist, and R outputs a value in Reveal that satisfies the following characteristics with overwhelming probability: - Correctness: If D, INT, and R are honest, and D has input s in Dist, then R outputs s in Reveal. If INT and R are honest, after performing Dist and AuthVal, INT will output the value s, so that R will output s if Reveal is performed. If D and R are honest, and D has input s in Dist, then R does not output s'≠s in Reveal. -Privacy: R does not contain any information about secrets after Dist. - Linearity: Suppose s1 and s2 are input values ​​for D, and D, INT, and R perform Dist and AuthVal on both inputs. Then, without interaction, the parties can locally emulate an execution using input s1+s2.

[0154] IC signature Later, n Party P1, ..., Pn The information check between them is used. Protocol Dist is used by Dealer D, Intermediary INT and Receiver P1, ..., P n The process is executed, and each has the same input value s. The information sent to INT by D is called the IC signature, and such a signature is represented as σ(s,D,INT).

[0155] To verify signatures between parties, the AuthVal protocol uses INT and each party P i It is executed bilaterally. And in the Reveal protocol, INT broadcasts s and authentication information, and if the t+1 party accepts s, the signature is said to be verified.

[0156] These signatures allow D to provide INT with a signature that only INT can use to convince other parties of the authenticity of the value received from the dealer. Thus, these IC signatures can be used as signatures specifically given from D to INT, thereby allowing INT to prove the authenticity of the received value to any party.

[0157] 7.2 Verifiable secret sharing Let's recall the definition of verifiable secret sharing (VSS).

[0158] definition 2 A t-secure VSS scheme for sharing a secret s∈F is a pair of n-party protocols (Sh,Rec) that satisfies the following property even if there are adversaries who allow up to t parties to cheat: - Correctness: Once all honest parties have terminated protocol Sh, there exists a fixed value s'∈F∪⊥ such that the following requirement holds: If Dealer D is honest, then s'=s, and each honest party outputs s' in Protocol Rec. · If the dealer is dishonest, each honest party outputs s' in protocol Rec. - Privacy: If the dealer is honest and there is no honest party that has started Rec, the adversary has no information about the shared secret s. - Termination: If dealer D is honest, all honest parties terminate Sh, and if an honest party calls Rec, each honest party eventually terminates Rec.

[0159] Protocol Description The protocol is based on classical protocols but uses IC signatures instead of error correction.

[0160] To share the value s, dealer D uses a two-variable polynomial f(x,y) of degree at most t. The projections f(x,i) and f(i,y) are sent to party P i (all points are signed using IC signatures). Here, the parties can bilaterally compare the cross-point values between parties and use the signatures to reveal inconsistent behavior by the dealer. This implies that the values held by honest parties are consistent, and since there are at least n - t > t + 1 honest parties, these values uniquely define a two-variable polynomial f'(x,y) of degree at most t, which defines the secret. Thus, this already guarantees that the dealer is committed to the value after the sharing phase.

[0161] However, if the adversary sends an incorrect share, reconstruction may still fail. To avoid this, each share of P i is also signed by other parties. This in turn prevents the adversary from tampering with the secret during reconstruction.

[0162] Protocol: Π VSS share Take s as the input for dealer D. 1:D selects a random bivariate polynomial f(x,y) with a maximum degree of t for each variable such that f(0,0)=s. ij Let =f(i,j). The dealer is Party P. i to, value a li =s li , ..., a ni =s ni and b i1 =s i1 , ..., b in =s in Send. Each value a ji , b ij Regarding D, the IC signature σ(a ji ,D, P i ) and σ(b ij ,D,P i ) Attach. 2: Party P i is two sets a 1i , ..., a ni and b i1 , ...,b in However, it checks for consistency. If these values ​​are not consistent, Pi broadcasts them with D's signature. If a party hears a broadcast of values ​​that do not match the dealer's signature, D is deemed ineligible and execution is stopped. 3:P i is, a ji and, a ij The signature σ(a) that I generated ji ,P i ,P j ) and P j Send privately. 4: Party P i In the previous step, P j Value a received from ij The value b received from D. ij Compare with P. If there is a contradiction, i is, b ij and σ(b ij ,D,P i Broadcast ). 5: Party P i is the value a that you holdji a different value b ji , σ(b ji , D, P j ) is broadcast by P j to check whether such a broadcast exists. If such a broadcast exists, P i broadcasts a ji and σ(a ji , D, P i ). 6: For an index pair (i, j), if a party hears two broadcasts with signatures from different dealers for different values, D is disqualified and the execution is stopped.<​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​Multiplication gates are handled using the well-known methods of Gennaro, Rabin, and Rabin. i is the share of input wires a and b a i and b i Multiply locally and use VSS to get the result d i =a i b i This results in n VSSs, and the appropriate sharing of the output wire c can be calculated as a fixed linear combination of these.

[0167] 8. Network Factors The system can be configured to identify sets of fast parties and sets of slow parties, where channels between fast parties have relatively small delays, and channels containing at least one slow party have relatively large delays.

[0168] In this paper, when discussing the speed of a computing device's connection to a network, the terms "faster" and "slower" are often used to describe the rate at which data can be transmitted between the device and the network. A device with a "faster" connection can send and receive data more quickly than a device with a "slower" connection. Several factors contribute to the speed of a network connection.

[0169] 1. Bandwidth: Bandwidth refers to the maximum amount of data that can be transmitted through a network connection over a given period of time, and is typically measured in bits per second (bps). The higher the bandwidth, the more data can be transmitted simultaneously, resulting in a faster connection. For example, a 100 Mbps Ethernet connection has a higher bandwidth and is considered faster than a 10 Mbps Ethernet connection.

[0170] 2. Latency: Latency is the time it takes for a data packet to travel from a source device to a destination device and vice versa, and is often measured in milliseconds (ms). Lower latency means that data can be exchanged more quickly between devices and the network, resulting in a faster connection. Latency can be influenced by factors such as the physical distance between devices, the number of network hops, and the processing time of network equipment.

[0171] 3. Network Technology: Different network technologies have different speed capabilities. For example, networks using modern Wi-Fi standards such as Wi-Fi 6 (802.11ax) generally have faster connections than devices using older standards such as Wi-Fi 4 (802.11n). Similarly, devices connected to a network via a wired Gigabit Ethernet connection typically have faster connections than devices using wireless connections or older Ethernet standards.

[0172] 4. Network Infrastructure: The quality and capacity of network infrastructure, including routes, switches, and cables, can affect connection speed. A well-designed and maintained network with high-quality components can provide faster connections than a poorly designed or outdated network.

[0173] 5. Device Hardware: The hardware of a computing device, such as its network interface card (NIC), processor, and memory, can also affect the speed of its network connection. A more powerful NIC and a device with sufficient processing power can handle network traffic more efficiently, resulting in a faster connection.

[0174] To determine whether one device has a faster connection than another, the system can use various tools and methods to measure the bandwidth, latency, and overall performance of each device's network connection. These include: 1. Speed ​​Test: Online speed test tools can measure the download and upload speeds of a device connecting to a remote server and provide an estimate of available bandwidth. 2. Ping Test: Ping is a command-line tool that measures the round-trip time (latency) between a device and a specified network destination. 3. Network Monitoring Tools: Software applications such as Wireshark or SolarWinds Network Performance Monitor can provide detailed insights into network traffic and help identify bottlenecks and performance issues that may affect connection speed.

[0175] By considering these factors and using appropriate testing methods, the system can be configured to determine whether one computing device has a faster network connection than another.

[0176] When evaluating the speed of a network connection, one important factor to consider is latency (also known as delay). Latency is the amount of time it takes for a unit of data, typically a packet, to travel from a source device to a destination device across the network. Connections with lower latency are considered "faster," while connections with higher latency are considered "slower."

[0177] Several factors contribute to the delay experienced by data packets traversing a network. 1. Propagation Delay: This is the time it takes for a signal to travel from the source to the destination through a physical medium (copper wire, fiber optic, or air). Propagation delay is determined by the distance between devices and the speed at which the signal travels through the medium. For example, in copper wire, the signal travels at about 2 / 3 the speed of light, and in fiber optic, it travels at nearly the speed of light. 2. Transmission Delay: Transmission delay is the time it takes for a device to push all the bits of a packet onto the network medium. This delay depends on the size of the packet and the bandwidth of the network link. Higher bandwidth links can transmit packets more quickly, reducing the transmission delay. 3. Processing Delay: Each network device (such as routers and switches) along the path between the source and destination needs to process incoming packets, determine the appropriate exit interface, and place those packets in a queue for transmission. The time taken for these tasks contributes to the overall delay. More powerful network devices with faster processors and more efficient algorithms can reduce the processing delay. 4. Queueing Delay: When packets arrive at a network device faster than they can be processed and transmitted, the packets are placed in a queue. Queueing delay can vary depending on the network load and the capacity of the network device. When the network is congested, the queueing delay increases significantly. 5. Serialization Delay: Serialization delay is the time it takes to encode and decode data packets at the source and destination devices. This includes the time required to convert parallel data into a serial format suitable for transmission over the network from the device's computer bus, or vice versa.

[0178] To measure the delay between two devices on a network, a system can be configured to use the ping command. Ping involves sending a small packet (usually an ICMP echo request) from a source device to a destination device and measuring the time it takes for the destination to send a response (an ICMP echo reply) back to the source. This round-trip time (RTT) includes propagation delay, transmission delay, processing delay, queue delay, and serialization delay in both directions.

[0179] For example, if a system is configured to ping a remote server and the average RTT is 50 milliseconds (ms), this means that it takes 25 ms for a packet to travel from the first device to the server and another 25 ms for the response to return. A lower RTT indicates a faster connection with less latency.

[0180] To provide more detailed information about the delays encountered at each hop along the network path, other tools and protocols such as Traceroute and TWAMP (Two-Way Active Measurement Protocol) may be used by the system.

[0181] When comparing two network connections based on latency, a connection with consistently lower RTT and less variability in latency (known as jitter) can be considered faster. However, the system can consider other factors such as bandwidth and packet loss to gain an understanding of network performance.

[0182] 9. System Implementation In some respects, this disclosure relates to methods and systems for asymmetric multi-party computing (MPC). More specifically, this disclosure provides techniques for efficient computing between a set of distributed computerized processors classified as fast parties and slow parties based on network connection speeds. The methods and systems described herein can leverage the advantages of both fast and slow parties to optimize the overall computing process.

[0183] In some cases, the method and system include a preprocessing phase in which the fast parties execute an extended Lost Communications (OT) protocol to set up OT channels between each pair of fast parties. This process generates correlated randomness about the fast parties, enhancing the security and efficiency of the computation. The method and system may also include storing a set of inputs at both the slow and fast parties; executing a standard unconditional OT-based protocol for the dishonest majority at each of the fast parties; and transmitting the output to the slow parties.

[0184] In some embodiments, the total number of bits communicated through channels with relatively larger latency, often associated with slower parties, is independent of circuit size. This feature can offer substantial advantages in scenarios where network bandwidth is limited or ineffective. Furthermore, slower parties do not need to execute executable instructions, thereby reducing their own computational load and potentially improving the overall efficiency of the system.

[0185] In other embodiments, correlated randomness may be generated using a sincere majority MPC protocol or by a trusted dealer who directly distributes a predetermined number of OT correlations among fast parties. These techniques can enhance the security and efficiency of the computation process.

[0186] The methods and systems described in this paper can provide a novel approach to asymmetric multi-party computing, offering potential benefits in terms of computational efficiency, network resource utilization, and security. These benefits can be particularly valuable in distributed computing environments where network resources and computing power differ among different parties.

[0187] Referring to Figure 1, an asymmetric multi-party computation involving multiple processor nodes is depicted. In some aspects, the system includes a processor node 110 labeled "slow," which receives input data 111 and is connected via channel 150 with a large delay 150. Similarly, another processor node 120, also labeled "slow," receives input data 121 and is connected via a channel with an even larger delay 155. These slow processor nodes may have slower network connectivity or lower computational tests compared to the other nodes in the system.

[0188] In some cases, the system also includes a processor node 130 labeled "fast," which receives input data 131, executes an unconditional OT-based protocol 132, and produces output 133. This node is connected via an OT channel 160 characterized by lower latency, indicating faster network connectivity or higher computing resources. Another processor node 140, also labeled "fast," receives input data 141, executes an unconditional OT-based protocol 142, and produces output 143.

[0189] In some embodiments, outputs 133 and 143 are distributed to all other nodes in the system through arbitrary channels. This distribution may be performed in a manner that minimizes the total number of bits communicated through expensive channels, independent of circuit size. In some cases, slower parties do not execute executable instructions, thereby reducing their own computational load and potentially improving the overall efficiency of the system.

[0190] In some aspects, correlated randomness for fast parties may be generated using a sincere majority MPC protocol, or by a trusted dealer who directly distributes a predetermined number of OT correlations among fast parties, where the number of correlations is a security parameter. In some cases, slow players are responsible for generating the MPC correlations. This configuration allows for a flexible and efficient computation process that can accommodate diverse network conditions and computing resources among participating nodes.

[0191] Figure 2 is a block diagram of system 200 in which the techniques and principles described in this paper may be implemented. System 200 has multiple processor nodes 210, 215, and 220, three of which are shown in Figure 2. Each processor node can participate in multi-party computation (MPC) together with one or more of the other processor nodes. As described in this paper, multi-party computation techniques allow the computation of congruence functions on sensitive (private) inputs from parties that do not trust each other, without requiring those parties to disclose these inputs to trusted third parties or to each other (thus protecting the privacy of these inputs). Cryptographic protocols ensure that no participating party (or a coalition of parties) knows anything from the computation other than the intended portion of the computation result. In the system shown in Figure 2, inputs for computation can be provided by one or more processor nodes and / or by one or more input nodes (not shown in Figure 2). The output of the computation can be returned to the node that provided the input(s), such as one or more processor nodes and / or one or more input nodes, and / or the output can be provided to one or more nodes that did not provide input, such as one or more other processor nodes or one or more output nodes (not shown in Figure 2). Often, the recipient of the MPC output is the node that requested the computation.

[0192] The multiple processor nodes in Figure 2 can be thought of as a "committee" of processor nodes capable of executing the MPC. A single committee may execute the entire MPC, but in some cases, multiple committees (each containing multiple processor nodes) can execute different parts of the MPC.

[0193] Processor nodes are interconnected and can therefore exchange signaling (indicated as signals 225, 230, 235) with each other. The processor nodes may be local to each other, or one or more processor nodes may be remote from other processor nodes. In this case, the processor nodes may be interconnected via one or more wireless or wired networks, including the Internet and local area networks. As discussed above, some of the interconnections may utilize high-end network resources (e.g., channels with low latency, low-cost channels, etc.).

[0194] Each processor node can be any type of electronic or computing device. For example, a processor node can be any suitable type of electronic or computing device, such as a server, computer, laptop, smartphone, or part of one. It will be understood that the processor nodes shown in Figure 2 do not need to be of the same type. For example, one or more processor nodes may be servers, and one or more processor nodes may be desktop computers, and so on.

[0195] Referring to Figure 2, a schematic representation of a networked system with multiple processor nodes is depicted. In some aspects, processor node 210 is connected to processor node 215 via communication link 225. This connection provides a path for data exchange or communication between these nodes. In some cases, processor node 215 is further connected to processor node 220 via another communication link 235. This connection establishes a network configuration in which processor node 220 can communicate with both processor node 210 and processor node 215. This forms a triangular communication topology that can provide efficient data exchange between processor nodes.

[0196] In some embodiments, a triangular communication topology between processor nodes may be used to optimize data flow and reduce communication latency. This configuration can be particularly beneficial in scenarios where processor nodes have varying computing resources or network conditions. The use of multiple communication links, such as communication links 225 and 235, can allow for parallel data transmission and reception, potentially improving the overall performance of multi-party computing processes.

[0197] In some cases, additional communication links, such as communication link 230, may be established between other pairs of processor nodes to further improve the network configuration. These additional communication links can provide alternative paths for data exchange, thereby increasing the robustness and flexibility of the networked system.

[0198] It should be understood that the specific arrangement and number of processor nodes and communication links depicted in Figure 2 are merely illustrative. In other embodiments, the networked system may include more or fewer processor nodes and communication links arranged in different topologies, depending on the specific requirements of the multi-party computing process.

[0199] Figure 3 is a block diagram of an exemplary processor node. The processor node 300 includes an interface circuit 310 for enabling data connectivity to other devices or nodes. In particular, the interface circuit can enable connectivity between the processor node and a network, such as the Internet or a local area network, via any desired wired or wireless communication protocol. The processor node further includes a processing unit 305 for performing operations on data and generally controlling the operation of the processor node. The processor node further includes a memory unit 315 for storing any data required for performing the techniques described herein and for storing computer program code for causing the processor unit to perform method steps described in more detail below.

[0200] Referring to Figure 3, a block diagram of the core components of a computing device is shown. The processing unit 305 can be implemented in numerous ways, such as a microprocessor, a central processing unit, or a specialized processing device, such as an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), or a network processor. The processing unit 305 may be configured to execute a set of executable instructions of a predetermined size, which may be stored in the memory unit 315. The processing unit can be implemented in numerous ways using software and / or hardware to perform the various functions described in this paper. The processing unit may include one or more microprocessors or digital signal processors (DSPs) which may be programmed using software or computer program code to perform the required functions and / or control the components of the processing unit to perform the required functions. The processing unit may be implemented as a combination of dedicated hardware that performs some functions (e.g., amplifiers, preamplifiers, analog-to-digital converters (ADCs) and / or digital-to-analog converters (DACs)) and processors that perform other functions (e.g., one or more programmed microprocessors, controllers, DSPs and associated circuits). Examples of components that may be used in various embodiments of this disclosure include, but are not limited to, conventional microprocessors, DSPs, application-specific integrated circuits (ASICs), and field-programmable gate arrays (FPGAs).

[0201] The memory unit 315 may include any type of non-temporary machine-readable memory, such as cache or system memory, and may also include volatile and non-volatile computer memory, such as random access memory (RAM), static RAM (SRAM), dynamic RAM (DRAM), read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), and electrically erasable PROM (EEPROM). When a processor node stores or holds one or more datasets that can be processed in multi-party computing, such datasets may be stored in the memory unit. The memory unit 315 is shown as a storage component for holding data and executable instructions. The memory unit 315 may include various types of storage media, such as random access memory (RAM), read-only memory (ROM), flash memory, or other types of non-volatile memory. In some embodiments, the memory unit 315 may store a set of executable instructions of a predetermined size that can be accessed and executed by the processing unit 305.

[0202] The interface circuit 310 is shown as a component that facilitates data communication with other devices or networks. In some cases, the interface circuit 310 may enable connections between multiple distributed computerized processors. The connections may be established via various communication protocols, including wired or wireless connections, and may involve different types of networks, such as local area networks (LANs), wide area networks (WANs), or the internet.

[0203] The diagram in Figure 3 illustrates the fundamental relationship between these elements, where the processing unit 305 utilizes the memory unit 315 to access instructions and data, while the interface circuit 310 enables communication with the outside world. This configuration can provide a flexible and efficient platform for performing a variety of operations, including those involving asymmetric multi-party computing.

[0204] Figures 4 and 5 illustrate exemplary computer systems useful for implementing the various embodiments described herein. The various embodiments may be implemented using one or more computer systems, such as the computer system 500 shown in Figure 4. One or more computer systems 500 may be used, for example, to implement any of the embodiments, combinations thereof, and subcombinations discussed herein.

[0205] The computer system 500 may include one or more processors (also called a central processing unit, processing device, or CPU), for example, a processor 504. The processor 504 may be connected to a communication infrastructure 506 (for example, a bus).

[0206] The computer system 500 may include input / output devices 503, such as a monitor, keyboard, pointing device, etc. These may communicate with a communication infrastructure 506 through a user input / output interface 502. One or more of the processors 504 may be graphics processing units (GPUs). In one embodiment, the GPU may be a processor that is a specialized electronic circuit designed to process mathematically intensive applications. The GPU may have an efficient parallel structure for parallel processing of large data blocks common in computer graphics applications, images, video, etc.

[0207] The computer system 500 may also include main memory 508, such as random access memory (RAM). The main memory 508 may include one or more levels of cache. The main memory 508 may store control logic (i.e., computer software, instructions, etc.) and / or data. The computer system 500 may also include one or more secondary storage devices or secondary memory 510. The secondary memory 510 may include, for example, a hard disk drive 512 and / or a removable storage device or removable storage drive 514. The removable storage drive 514 may interact with a removable storage unit 518. The removable storage unit 518 may include a computer-accessible or readable storage device that may store computer software (control logic) and / or data. The removable storage drive 514 may read from and / or write to the removable storage unit 518.

[0208] The secondary memory 510 may include other means, devices, components, equipment or other approaches that allow computer programs and / or other instructions and / or data to be accessed by the computer system 500. Such means, devices, components, equipment or other approaches may include, for example, a removable storage unit 522 and an interface 520. Examples of the removable storage unit 522 and interface 520 may include a program cartridge and cartridge interface, a removable memory chip (e.g., EPROM or PROM) and associated socket, a memory stick and USB port, a memory card and associated memory card slot and / or other arbitrary removable storage units and associated interfaces.

[0209] The computer system 500 may further include a communication interface 524 (for example, a network interface). The communication interface 524 may enable the computer system 500 to communicate with and interact with any combination of external devices, external networks, external entities, etc. (individually or collectively referred to as remote devices, networks, entities 528). For example, the communication interface 524 may allow the computer system 500 to communicate with external or remote devices, networks, entities 528 through a communication path 526. The communication path 526 may be wired and / or wireless (or a combination thereof) and may include any combination such as a LAN, WAN, or the internet. Control logic and / or data may be transmitted to and from the computer system 500 through the communication path 526.

[0210] Computer system 500 may be any of the following, to give some, not limited to, personal digital assistants (PDAs), desktop workstations, laptop or notebook computers, netbooks, tablets, smartphones, smartwatches or other wearable devices, appliances, parts of the Internet of Things and / or embedded systems, or any combination thereof.

[0211] The computer system 500 may be a client or server computing device that accesses or hosts any application and / or data through any delivery paradigm. Such any delivery paradigm may include, but is not limited to, remote or distributed cloud computing solutions; local or on-premises software ("on-premises" cloud-based solutions); "as a service" models (e.g., Content as a Service (CaaS), Digital Content as a Service (DCaaS), Software as a Service (SaaS), Managed Software as a Service (MSaaS), Platform as a Service (PaaS), Desktop as a Service (DaaS), Framework as a Service (FaaS), Backend as a Service (BaaS), Mobile Backend as a Service (MBaaS), Infrastructure as a Service (IaaS), etc.); and / or hybrid models including any combination of the above examples or other service or delivery paradigms.

[0212] Figure 5 shows an exemplary machine of computer system 900 in which a set of instructions for causing the machine to perform any one or more of the operations discussed in this paper may be executed. In alternative implementations, the machine may be connected to other machines (e.g., networked) in a LAN, intranet, extranet and / or internet. The machine may operate as a server or client in a client-server network environment, as a peer machine in a peer-to-peer (or distributed) network environment, or as a server or client machine in a cloud computing infrastructure or environment.

[0213] A machine can be any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be performed by a personal computer (PC), tablet PC, set-top box (STB), personal digital assistant (PDA), mobile phone, web appliance, server, network router, switch or bridge, specialized application or network security appliance or device, or any machine. Furthermore, although a single machine is shown, the term “machine” can also be interpreted to include any collection of machines that individually or jointly execute a set (or set) of instructions to perform any one or more of the methodologies discussed in this paper.

[0214] An exemplary computer system 900 includes a processing device 902, main memory 904 (e.g., read-only memory (ROM), flash memory, dynamic random-access memory (DRAM), e.g., synchronous DRAM (SDRAM)), static memory 906 (e.g., flash memory, static random-access memory (SRAM)), and data storage devices 918, which communicate with each other via a bus 930.

[0215] The processing device 902 represents one or more processing devices, such as a microprocessor or a central processing unit. More specifically, the processing device may be a complex instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, or a processor implementing a processor or combination of instruction sets. The processing device 902 may also be one or more special-purpose processing devices, such as an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), or a network processor. The processing device 902 is configured to execute instructions 926 for performing the operations and steps discussed in this paper.

[0216] The computer system 900 may further include a network interface device 908 for communication through the network 920. The computer system 900 may also include a video display unit 910, an alphanumeric input device 912 (e.g., a keyboard), a cursor control device 914 (e.g., a mouse), a graphics processing unit 922, a signal generation device 916 (e.g., a speaker), another graphics processing unit 922, a video processing unit 928, and an audio processing unit 932.

[0217] The data storage device 918 may include a machine-readable medium 924 (also known as a computer-readable storage medium) in which one or more sets of instructions 926 (e.g., software instructions) that embody any one or more of the operations described in this paper are stored. The instructions 926 may reside entirely or at least partially in the main memory 904 and / or the processing device 902 during execution by the computer system 900. The main memory 904 and the processing device 902 also constitute a machine-readable storage medium.

[0218] In one example, instruction 926 includes instructions that implement the operations and functionality corresponding to the disclosed subject matter. Although the machine-readable storage medium 924 is shown as a single medium in the exemplary implementation, the term “machine-readable storage medium” should be interpreted to include a single or multiple medium (e.g., a centralized or distributed database and / or associated caches and servers) that stores one or more sets of instructions 926. The term “machine-readable storage medium” should be interpreted to include any medium capable of storing or encoding a set of instructions 926 that causes a machine to perform one or more of the operations disclosed herein. Thus, the term “machine-readable storage medium” should be interpreted to include, but not be limited to, solid-state memory, optical media and magnetic media.

[0219] Some parts of the detailed explanation have been presented using algorithms and symbolic representations of operations on data bits in computer memory. These algorithmic descriptions are the way that those skilled in data processing use to most effectively communicate their research to others skilled in the art. Here, an algorithm is also generally considered to be a self-consistent sequence of operations that leads to a desired result. Operations require the physical manipulation of physical quantities. These quantities, though not always, typically take the form of electrical or magnetic signals that can be stored, combined, compared, and otherwise manipulated. Sometimes, mainly for convention, it is convenient to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, etc.

[0220] However, it should be kept in mind that these and similar terms are related to appropriate physical quantities and are merely convenient labels applied to those quantities. Unless otherwise specifically stated, as is evident from the above discussion, discussions using terms such as “identify,” “determine,” “execute,” “perform,” “collect,” “create,” or “transmit” are understood to refer to actions or processes of a computer system or similar electronic computing device that manipulate and transform data represented as physical (electronic) quantities in the registers and memory of the computer system into other data similarly represented as physical quantities in the memory or registers or other such information storage devices of the computer system.

[0221] This disclosure also relates to an apparatus for performing the operations described herein. This apparatus may include a computer that is specifically constructed for the intended purpose or that is selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored on a computer-readable storage medium. The computer-readable storage medium is, for example, a floppy disk, optical disk, CD-ROM, magneto-optical disk, read-only memory (ROM), random access memory (RAM), EPROM, EEPROM, magnetic or optical card, or any type of medium suitable for storing electronic instructions, each coupled to a computer system bus.

[0222] The operations and examples presented in this paper are inherently related to any specific computer or other device. Various types of systems may be used with programs based on the teachings in this paper. Alternatively, it may be convenient to construct more specialized devices for performing such operations. Structures for these diverse systems will become apparent as described in this paper. Furthermore, this disclosure is written with reference to any specific programming language. It will be understood that a variety of programming languages ​​may be used to implement the teachings of the disclosure described in this paper.

[0223] This disclosure may be provided as a computer program product or software which may include a machine-readable medium that stores instructions which may be used to program a computer system (or other electronic device) to perform the processes described herein. The machine-readable medium includes any mechanism for storing information in a machine-readable format. For example, machine-readable (e.g., computer-readable) medium includes machine-readable (e.g., computer)-readable storage media, such as read-only memory (ROM), random-access memory ("RAM"), magnetic disk storage media, optical storage media, flash memory devices, and the like.

[0224] In some embodiments, a tangible, non-temporary device or product including a tangible, non-temporary computer-usable or readable medium on which control logic (software) is stored may also be referred to in this paper as a computer program product or program storage device. This includes, but is not limited to, tangible products embodying the computer system 500, main memory 508, secondary memory 510, and removable storage units 518 and 522, as well as any combination thereof. When such control logic is executed by one or more data processing devices (such as the computer system 500), such data processing devices may be made to operate as described in this paper.

[0225] Based on the teachings contained herein, it will be obvious to those skilled in the art how embodiments of the disclosure may be created and used with data processing devices, computer systems, and / or computer architectures other than those shown in Figures 4 and 5. In particular, embodiments may operate with software, hardware, and / or operating system implementations other than those described herein.

[0226] It is understood that the section of detailed description, and no other section, is intended to be used for interpreting the claims. Other sections may describe one or more, but not all, exemplary embodiments conceived by the inventors and are therefore not intended to limit the present disclosure or the accompanying claims in any way.

[0227] While this disclosure describes exemplary embodiments for exemplary fields and applications, it should be understood that this disclosure is not limited thereto. Other embodiments and modifications thereof are possible and are included in the scope and spirit of this disclosure. For example, without limiting the generality of this section, embodiments are not limited to the software, hardware, firmware, and / or entities shown in the drawings relating to this application. Furthermore, embodiments (whether expressly described herein or otherwise) have significant utility for fields and applications beyond the examples described herein.

[0228] Embodiments have been described in this paper by using functional configuration blocks that demonstrate the implementation of specified functions and their relationships. The boundaries of these functional configuration blocks have been arbitrarily defined in this paper for the sake of clarity. Alternative boundaries can be defined, as long as the specified functions and relationships (or their equivalents) are performed appropriately. Furthermore, alternative embodiments may execute functional blocks, steps, operations, methods, etc., in a different order than those described in this paper.

[0229] In this paper, references to “one embodiment,” “a particular embodiment,” “exemplary embodiment,” or similar phrases indicate that the embodiments described may include certain features, structures, or characteristics, but not all embodiments may necessarily include those particular features, structures, or characteristics. Furthermore, such phrases do not necessarily refer to the same embodiment. Moreover, when certain features, structures, or characteristics are described in relation to an embodiment, it would be within the knowledge of those skilled in the art to incorporate such features, structures, or characteristics into other embodiments, whether or not they are explicitly mentioned in this paper. Furthermore, some embodiments may be described using the expressions “combined” and “connected,” along with their derivatives. These terms are not necessarily intended to be synonymous with each other. For example, some embodiments may be described using the terms “connected” and / or “combined” to indicate that two or more elements are in direct physical or electrical contact with each other. However, the term “combined” may also mean that two or more elements are not in direct contact with each other, yet still cooperate or interact with each other.

[0230] The breadth and scope of this disclosure should not be limited by any of the exemplary embodiments described above, but should be defined solely in accordance with the appended claims and their equivalents. In the above specification, implementations of the disclosure have been described with reference to their specific exemplary implementations. It will be apparent that various modifications can be made to the implementations of the disclosure described in the appended claims without departing from the broad intent and scope of those implementations. Therefore, the specification and drawings should be considered illustrative, not restrictive.

Claims

1. A method for asymmetric multi-party computation, the method being: A step of establishing a data communication channel through a computerized network between a distributed set of computerized processors, wherein a first subset of the computerized processors is a relatively high-speed party, and a second subset of the computerized processors is a relatively low-speed party; A step of identifying sets of high-speed parties and sets of low-speed parties based on predetermined or detected network performance metrics, wherein channels between high-speed parties have relatively low latency, and channels containing at least one low-speed party have relatively high latency; In the preprocessing phase, the set of fast parties executes the Lost Communication (OT) extension protocol to establish OT channels between each pair of fast parties and generate correlated random values ​​for the fast parties, where the fast parties are unaware of the other values; A step in which a set of inputs is electronically stored in a set of slow parties and a set of fast parties, wherein the inputs in any party are unique and unknown to other parties; In each of the high-speed parties, the steps include: executing an unconditional OT-based protocol through the communication channel for the dishonest majority to execute instructions for generating output; The steps include: electronically storing the output of the execution of the instruction in each of the high-speed parties; The steps include transmitting the output from each high-speed party to each of the other high-speed parties and each of the low-speed parties via the data communication channel. Methods that include...

2. The method according to claim 1, wherein t < n / 2 parties have a sincere majority.

3. The method according to claim 1 or 2, wherein the total number of bits communicated through a channel with a relatively larger delay is independent of the circuit size.

4. The method according to claim 1 or 2, wherein the slow party does not execute the executable instruction.

5. The method according to claim 1 or 2, wherein the correlation is generated using a sincere majority multi-party computation (MPC) protocol.

6. The method according to claim 1 or 2, wherein the correlation randomness is generated by a trusted dealer who directly distributes k OT correlations among fast parties, where k is a security parameter.

7. The method according to claim 1 or 2, wherein the slow party merely generates the correlation of the multi-party calculation (MPC).

8. A system for asymmetric multi-party computation, the system is: A network device configured to establish data communication channels through a computerized network between a distributed set of computerized processors, wherein a first subset of the computerized processors is a relatively high-speed party and a second subset of the computerized processors is a relatively low-speed party; It includes a set of processors, the set of processors being: A step of identifying sets of high-speed parties and sets of low-speed parties based on predetermined or detected network performance metrics, wherein channels between high-speed parties have relatively low latency, and channels containing at least one low-speed party have relatively high latency; In the preprocessing phase, the set of fast parties executes the Lost Communication (OT) extension protocol to establish OT channels between each pair of fast parties and generate correlated random values ​​for the fast parties, where the fast parties are unaware of the other values; A step in which a set of inputs is electronically stored in a set of slow parties and a set of fast parties, wherein the inputs in any party are unique and unknown to other parties; In each of the high-speed parties, the steps include: executing an unconditional OT-based protocol through the communication channel for the dishonest majority to execute instructions for generating output; The steps include: electronically storing the output of the execution of the instruction in each of the high-speed parties; The steps include transmitting the output from each high-speed party to each of the other high-speed parties and each of the low-speed parties via the data communication channel. A system configured to perform the following actions.

9. The system according to claim 8, wherein t < n / 2 parties have a sincere majority.

10. The system according to claim 8 or 9, wherein the total number of bits communicated through channels with relatively larger delays is independent of the circuit size.

11. The system according to claim 8 or 9, wherein the slow party does not execute the executable instruction.

12. The system according to claim 8 or 9, wherein the correlation is generated using a sincere majority multi-party computation (MPC) protocol.

13. The correlation randomness is generated by a trusted dealer who directly distributes k OT correlations among fast parties, where k is a security parameter, according to claim 8 or 9.

14. The system according to claim 8 or 9, wherein the slow party merely generates the correlation of the multi-party calculation (MPC).

15. A non-temporary processor-readable medium storing code representing instructions to be executed by a processor in a computing device for asymmetric multi-party computing, wherein the code further: A step of establishing a data communication channel through a computerized network between a distributed set of computerized processors, wherein a first subset of the computerized processors is a relatively high-speed party, and a second subset of the computerized processors is a relatively low-speed party; A step of identifying sets of high-speed parties and sets of low-speed parties based on predetermined or detected network performance metrics, wherein channels between high-speed parties have relatively low latency, and channels containing at least one low-speed party have relatively high latency; In the preprocessing phase, the set of fast parties executes the Lost Communication (OT) extension protocol to establish OT channels between each pair of fast parties and generate correlated random values ​​for the fast parties, where the fast parties are unaware of the other values; A step in which a set of inputs is electronically stored in a set of slow parties and a set of fast parties, wherein the inputs in any party are unique and unknown to other parties; In each of the high-speed parties, the steps include: executing an unconditional OT-based protocol through the communication channel for the dishonest majority to execute instructions for generating output; The steps include: electronically storing the output of the execution of the instruction in each of the high-speed parties; The steps include transmitting the output from each high-speed party to each of the other high-speed parties and each of the low-speed parties via the data communication channel. A medium that further includes commands for executing the command.

16. The medium according to claim 15, wherein t < n / 2 parties have a sincere majority.

17. The medium according to claim 15 or 16, wherein the total number of bits communicated through a channel with a relatively larger delay is independent of the circuit size.

18. The medium according to claim 15 or 16, wherein the slow party does not execute the executable instructions, and the slow party only generates the correlation of the multi-party computation (MPC).

19. The correlation is generated using a sincere majority multi-party computation (MPC) protocol, according to claim 15 or 16.

20. The correlation randomness is generated by a trusted dealer who directly distributes k OT correlations among fast parties, where k is a security parameter, according to claim 15 or 16.

Images