Multi-party Secure Computation

Abstract

A multi-party secure computation method uses private input secrets {s0, s1, . . . , s s-1 This allows us to compute an arithmetic function f that can be expressed as a sum of A groups of products of a set S of {}. The dealer node, which keeps the secret, has a basic blind element ρ a is provided, and the foundation blind element ρ a The inverse of is the sum of a set of pseudorandom numbers, each associated with each computation node and not shared with other computation nodes. Each dealer node also contains an exponential blind element λ, which is specific to the secret being provided. a,m is provided, and the sum of all exponential blind elements is 1. The dealer node shares with the computation nodes the product of the secret and the base blind element multiplied by the exponential blind element. Each computation node can independently generate a result share from the product of the shares received from the dealer node without sharing the computation. Summing the result shares provides the result of the computation. In this way, the sum of products can be calculated by the computation nodes without the need to exchange messages between them during the computation.

Description

[Technical field]

[0001] This invention relates to a Secure Multi Party Computation (SMPC) protocol. [Background technology]

[0002] Multi-party secure computation (SMPC) allows a set of parties to collaboratively compute a function on their inputs while keeping the set of parties secret. There are several flavors of SMPC described in the literature, including Yao's scrambled circuit (Non-Patent Document 1), GMW (Non-Patent Documents 2-3), BGW (Non-Patent Document 4), SPDZ (Non-Patent Document 5), BMR (Non-Patent Document 6), and GESS (Non-Patent Document 7). [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Yao, Andrew Qi-Qi (1986). "Methods of Generating and Exchanging Secrets", Symposium on Foundations of Computer Science 1986 (SFCS 1986). 27th Annual Symposium on Foundations of Computer Science, 1986. pp. 162-167. doi:10.1109 / SFCS.1986.25. ISBN 978-0-8186-0740-0 [Non-Patent Document 2] O. Goldreich, S. Micali, and A. Wigderson, "How to Play ANY Mental Game," Proceedings of the 19th Annual ACM Symposium on Theory of Computation, January 1987, pp. 218-229, doi:10.1145 / 28395.28420 [Non-Patent Document 3] T. Schneider, M. Zohner, "GMW vs. Yao? Efficient two-party secure computation encryption with low-depth circuits," Financial Cryptology and Data Security (FC'13), ser. LNCS, vol. 7859. Springer, 2013, pp. 275-292. [Non-Patent Document 4] Ben-Or, M., Goldwasser, S., Wigdelson, A., "A Completeness Theorem for Noncryptographic Fault-Tolerant Distributed Computation," Proceedings of ACM STOC'88, pp. 1-10 (1988) [Non-Patent Document 5] Damgard, I., Pastoro, V., Smart, N., Zacharias, S. (2012) Somewhat homomorphic encryption for multiparty computation, in Safavi-Naini, R., Canetti, R. (eds) Advances in Cryptography - CRYPTO 2012. CRYPTO 2012. Lecture Notes in Computer Science, vol 7417. Springer, Berlin, Heidelberg. https: / / doi.org / 10.1007 / 978-3-642-32009-5_38 [Non-Patent Document 6] Beaver, D., S. Micali, and P. Rogaway. 1990. "Round Complexity of Secure Protocols (Extended Abstract)". 22nd Annual ACM Symposium on Theory of Computation. ACM Press. 503-513. [Non-Patent Document 7] Kalesnikov, V. 2005. “Gate-Evaluated Secret Sharing and Secure One-Round Two-Party Computation”, Advances in Cryptology-ASIACRYPT 2005. Ed. by B. K. Roy. vol. 3788. Lecture Notes in Computer Science. Springer, Heidelberg. 136-155 [Non-Patent Document 8] Beaver, D. "Efficient Multiparty Protocols Using Circuit Randomization". Advances in Cryptology-CRYPTO' Ed. by J. Feigenbaum. Vol. 576. Lecture Notes in Computer Science. Springer, Heidelberg. 420-432 Summary of the Invention [Problem to be solved by the invention]

[0004] There are two main configurations of SMPC: Circuit Garbling (CG) and Linear Secret Sharing (LSS). Circuit Scrambling requires an encryption key with specific instructions to simulate function evaluation. Linear Secret Sharing computes shares from the input and distributes them to the nodes. In this disclosure, we focus on the SMPC flavor with LSS.

[0005] Below is a list of the main roles of nodes participating in the SMPC calculation: Dealer Nodes: These nodes provide input to the calculation. Computational Nodes: These nodes perform the actual SMPC calculations on the inputs provided by the dealer nodes. Result Nodes: These nodes recover results from completed SMPC calculations.

[0006] The LSS SMPC protocol involves three steps: Phase 0 (optional) - Pre-processing: Some LSS SMPC protocols require nodes to run pre-computations such as generation of multiplication triplets in the Beaver version of BGW (8) or in SPDZ. These computations are independent of the private inputs of any particular SMPC computation and can therefore be done in a previous, offline phase.

[0007] Stage 1 - Share Distribution: Each dealer node decomposes each private input for computation into a number of shares, N, and sends each share to a different computation node. Each share does not reveal any information about the private input; it can only be recovered when all N shares from the private input are collected.

[0008] Phase 2 - Compute: Each computation node has one share from each private input to the computation. The computation involves evaluating the output of the function against the private inputs. To do this, the computation node performs an operation on the shares according to the specific function to be evaluated by the SMPC protocol.

[0009] Phase 3 - Result Recovery: After phase 2, each computation node has obtained a share from the result of the computation (i.e., the function to be evaluated). The computation node sends its share to one or more result nodes. After collecting all N shares from the result, the result nodes can recover the output of the jointly computed function.

[0010] For example, suppose there are two dealer nodes, each with one string. We want a network of computation nodes to evaluate the result from the comparison of the two strings and to communicate this result to a result node. Since the strings are secret to the dealer nodes, they should not be transmitted to the computation nodes in plain text or encrypted form. Each dealer node breaks the secret string into N shares and sends each share to a different computation node. After receiving one share for each of the two strings to be compared, the computation node follows the SMPC protocol to obtain a resulting share from the computation. This result may be a Boolean, with TRUE values ​​representing matching strings and FALSE values ​​representing mismatching strings. Each node sends its resulting share to the result node, which recovers the TRUE or FALSE result from the string comparison.

[0011] The main challenge with SMPC is the complexity of communication: for the computational nodes to collaboratively obtain their share of the result of the function to be evaluated in stage 2, a large number of message exchanges and / or communication bandwidth is required if this function is complex. By complex function we mean a function with a large number of inputs and a large number of operations on those inputs. Real applications of SMPC usually require complex functions, which significantly impacts the applicability of SMPC in production scenarios.

[0012] For example, in a BGW SMPC, a compute node evaluates arithmetic functions on integer inputs that include additions and multiplications. A compute node running BGW can process an addition without needing to exchange messages. However, evaluating a multiplication requires exchanging messages. Complex functions that include additions and multiplications slow down the overall BGW function evaluation.

[0013] Here we refer to an SMPC flavor that evaluates arithmetic functions as SMPCs in an arithmetic setting. The focus of the invention is on the evaluation of functions for SMPCs in an arithmetic setting. In the arithmetic setting, the function can be expressed without loss of generality as a sum of a group of products of secrets. In this setting, the secrets are natural or integer or real or complex numbers.

[0014] Evaluation of a general function requires the computation of a product of an arithmetic set. State-of-the-art SMPCs require nodes to exchange messages to collaboratively evaluate the arithmetic product. Message exchange is many orders of magnitude slower than the computation on a local CPU. Thus, collaborative evaluation of a nontrivial function on standard SMPCs is orders of magnitude slower than on a central server. [Means for solving the problem]

[0015] Private input secret 0 ,s 1 , ,s s-1A multi-party secure computation method is provided that allows the computation of an arithmetic function f that can be expressed as a sum of a group A of products of a set S of {x,y,y}. The dealer node, holding the secret, calculates the basic blind element ρ a and the base blind element ρ a The inverse of is the sum of a set of pseudorandom numbers, each of which is associated with a respective computation node and is not shared with other computation nodes. Each dealer node furthermore acquires an exponential blinding element λ, which is specific to the secret being provided. a,m where the sum of all of the exponential blind elements is 1. The dealer node shares with the computation nodes the product of the secret and the base blind element augmented by the exponential blind element. Each computation node independently, and without dividing the computation, generates a result share from the product of the shares received from the dealer node. Summing the result shares provides the result of the computation. In this way, the sum of the products can be computed by the computation nodes without requiring message passing between computation nodes during the computation.

[0016] In one aspect, a computation execution method is provided, the computation execution method being executed among a number of D dealer nodes and N computation nodes, and including a private input secret {s 0 ,s 1 , ,s s-1} can be expressed as a sum of A groups of products of a set S of

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

[0017] By providing the dealer node with two different blinding factors defined above, namely the base blinding factor and the exponential blinding factor, the shares sent by the dealer are obscured in a way that completely hides the secret from the computation nodes and allows them to independently perform each computation and arrive at a resulting share that can be combined to reveal the computation result without knowing the blinding factors or the secret.

[0018] The method of the present invention employs a new flavor of SMPC called Nil Message Compute (NMC), which is capable of evaluating any function in an arithmetic setting without the need for the computation nodes to exchange messages during the computation phase (phase 2). NMC thus removes the main performance issue from standard SMPC and allows the evaluation of non-trivial functions for many private inputs, essentially simultaneously with many computation nodes, as done within a single server, with a central server where all information is available in plaintext. The NMC presented in this invention is secure against a passive adversary who can corrupt the sum of N computation nodes to N-1. By definition, a passive adversary follows the protocol specification but does not require the computation to use the private input s 0 ,s 1 , ,s s-1 Try to learn information about.

[0019] In their most basic form, these methods focus on arithmetic settings and on functions that return only one number. The same methods can be readily extended to any number of output values ​​using the techniques described in Appendix A.3 of [5], the contents of which are incorporated herein by reference for this purpose.

[0020] Preferably, step h) comprises: (a) Each computing node calculates the local sum r n sending the result to one or more result nodes; (b) One or more result nodes perform an aggregation of the received local sum results to determine a result of the arithmetic function f. Includes.

[0021] Preferably, step a) comprises: (a) Each computing node n, n∈{0, 1, , N-1}, generates a random number X n,a and (a) Each computing node:

number

[0022] Preferably, step (a) comprises: A random number generator G for n, q ∈ {0, 1, , N-1}, where n ≠ q n,q Let n and q be the generators that run synchronously with each other, and let G n,q and providing a collection of Each computation node n generates a random number generator G n,q Generate N-1 random shares from the polynomial p n generating each of the (q+1) random evaluation values; Each computing node calculates the random evaluation value p n (q+1) and p n (0)=X n,a A polynomial p that satisfies n Calculating the coefficient of (x); Each computing node n calculates the coefficients and X n,a From this, the polynomial p n Share of (x) p n Calculate (n+1) and The polynomial p from all other computation nodes q q As its share of (x), each computation node n generates the random number generator G n,q From, p q (n+1); and Each node:

number

number

[0023] Furthermore, a desirable aspect of the method is that it

number

[0024] As a further independent aspect of the present invention, a method is provided for distributing an initial share from a secret share mechanism without sending any messages, under the algorithm "ZeroMessageShareDistribution", as follows, which may be applied to any secret share mechanism that utilizes random number generation, outside the context of the multi-party computation method described here.

[0025] As a further independent aspect of the invention, there is also provided a method for N nodes to jointly add N secrets under the algorithm “AddSecretsWithoutSendingTheirShares” as follows, and to disclose the secret addition result to one or more output nodes while keeping each secret private, although it will be appreciated that this may also be applied outside the context of the multi-party computation method described herein.

[0026] As another further independent aspect of the present invention, under the algorithm "Generate Blind Elements", M a -One node is M a Secret numbers λ 0 ,λ 1 , ,λ Ma―1 A method is also provided in which the nodes jointly generate these numbers so that they sum to 1, without sharing these numbers. It goes without saying that this can also be applied outside the context of the multi-party computation method described here. [Brief description of the drawings]

[0027] [Figure 1] This is a network diagram of a conventional SMPC network, with dealer nodes, computation nodes, and result nodes. [Diagram 2] Figure 1 is a network diagram of computational nodes and dealer nodes running the network NMC algorithm disclosed herein. [Diagram 3]1 is a flowchart including message flows illustrating a network NMC algorithm. [Figure 4] Figure 1 is a network diagram of computational nodes and dealer nodes running the edge NMC algorithm disclosed herein. [Diagram 5] 1 is a flowchart including message flows illustrating the Edge NMC algorithm. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0028] Figure 1 is a network diagram showing multiple nodes cooperating to perform multi-party secure computation (SMPC). The nodes are classified as dealer nodes 10, computation nodes 12, and result nodes 14.

[0029] Although not all of the nodes are labeled with a reference number, it should be understood that all nodes in the same group are of the same type, i.e., all nodes on the left vertical line are dealer nodes 10, all nodes in the center octagonal group are computation nodes, and all nodes on the left vertical line are result nodes.

[0030] It should also be understood by those skilled in the art that the arrangement and number of nodes are not intended to imply any specific entity, and that the nodes may be organized into logical rather than physical groups, with nodes capable of communicating with other nodes by network addresses, over a public or private network, which may be a local area network or a wide area network. The nodes may even be part of the same computer system, such as various processors or cores of a multi-processor system. The communication protocols are the choice of the system designer and may be dictated by the application and security requirements of the system in which they are implemented.

[0031] Each node may be programmed to execute the relevant methods and algorithms disclosed herein and may be executed by a processor of a computer system having memory and access to a network connection, In many implementations, each node will be a suitably programmed computer system.

[0032] Dealer node 10 provides inputs to the computation. Specifically, dealer node 10 is equipped with secret inputs, generates shares from these secret inputs, and distributes the shares to computation nodes 12. The computation nodes perform the actual SMPC computation, and each computation node 12 provides a share of the computation output to each result node 14. The result nodes 14 recover the results from the received result shares.

[0033] In what follows, we make the following assumptions: Assumption 1: A dealer node cannot be a computation node. Otherwise, a node can have more than one role. Assumption 2: The number of computation nodes is equal to or greater than the number of dealer nodes. Assumption 3: There exist secure point-to-point channels between different nodes in the network. Moreover, message broadcasting is supported. Assumption 4: Without loss of generality, all sum terms m a We assume that there is at most one input per dealer for m a This is because if we provide one or more input variables to , it can always replace them with a new input variable equal to their product. Assumption 5: Without loss of generality, we work in finite field arithmetic Z / pZ. That is, all secrets are expressed as integers modulo p, where p is a prime number. Thus, all the following calculations are performed modulo p, denoted as mod p. Then, the arithmetic function f defined in claim 1 can be written more succinctly as (Equation 1):

number

[0034] First, we describe three new algorithms that constitute the building blocks of NMC: Second, we describe two flavors of NMC, one in which most of the computations, corresponding to the pre-processing stage, are done by SMPC computation nodes, and the other in which they are done by dealer nodes.

[0035] basic elements In this section, we present three algorithms. The first one, "Zero Message Share Distribution", is based on a novel idea that allows the initial shares to be distributed from the secret share mechanism without sending any messages. The second, "Secure Addition without Sending Shares", exploits this idea to allow computation nodes to add numbers without requiring them to send shares to the dealer node. The third, "Generating Blind Elements", allows N nodes to generate a number without first distributing shares.

number

[0036] The basic principles of the algorithm "Zero Message Share Distribution" can be applied to any secret share mechanism using random number generation. We present this algorithm for the GMW SMPC and then show how it is instantiated for the BGW SMPC in step 1 of the algorithm "Secret Addition without Sending Shares".

[0037] 1) Algorithm Description: “Zero Message Share Distribution” for GMW SMPC Input: N input nodes, where node n is a secret x n , with n ∈ {0, 1, , N-1} Output: Each node ends up with a share of each other node's secret. Purpose: Shares are distributed without exchanging messages.

[0038] In GMW SMPC, the setting

number

number

[0039] G for n, q∈{0,1,···,N-1}, n≠q n,qLet be a collection of random number generators such that node n and node q are generators that run synchronously to generate random bits.

[0040] That is, node n and node q are independent of each other in G n,q You can get the same sequence of random numbers from

[0041] A node is assigned a number generator G to generate random bits g. n,q When moving g←G n,q Each node n writes a secret bit x n From N shares x n,0 ,x n,1 ,x n,N-1 To generate it, we proceed as follows: Step 1- Generate (N-1) random shares. Node n creates a random share set G n,q Using the secret bit x n Random share (i.e., random bits) for x n,q ← G n,q Generate. Step 2- Generate its own share. Node n generates a secret bit x n One more evaluation will complete the entire set of shares. Node n has its share of the secret bits as

number

[0042] In step 1 above, node n is n,q Using the secret bit x n Random Share x n,q Generate a random share x n,q needs to be sent to node q where n ≠ q. However, both nodes n and q use the same random number generator G n,qTherefore, node q can independently create an instance of x without the need for communication. n,q ← G n,q According to this principle, every node n can obtain its share x from the above two-step process. n,n , without ever having to receive or send a single message. q,n ← G q,n Using the secret bit x from all other input nodes q, q Share from x n,q This constitutes a novel procedure that allows input nodes to distribute shares from the secret bit without exchanging messages.

[0043] This completes the description of the algorithm "Zero Message Share Distribution".

[0044] BGW SMPC utilizes Shamir's Secret Sharing (SSS) mechanism for nodes to generate shares from secret inputs for SMPC computation. The main idea of ​​SSS is that a polynomial evaluated at x=0 is equal to the secret, i.e., p n (0)=x n The node is assigned a random coefficient a 1,n ,a 2,n ,···,a N-1,n Polynomials in

number

[0045] The algorithm "Zero Message Share Distribution" can be used in secret share mechanisms that make use of random number generation. This is the case of Shamir's secret share mechanism in BGW SMPC, which works with random polynomial coefficients. We show here how this algorithm can be instantiated in the case of BGW SMPC, to allow input nodes to send shares from secret inputs without message exchange. This constitutes step 1 of the algorithm "Secret Addition without Sending Shares". This algorithm shows how N nodes can add N secrets without disclosing them.

[0046] 2) Description of the algorithm: "Secret addition without transmitting shares" Input: N input nodes, where node n is a secret x n , with n ∈ {0, 1, , N-1} Output:Total

number

[0047] The algorithm includes three stages of standard SMPC. Stage 1 is an instantiation of the "zero message share distribution" for Shamir's secret share mechanism. Stages 2 and 3 are the same as standard BGW SMPC.

[0048] Phase 1 - Share Distribution We present a "zero message share distribution" implementation for Shamir's secret share mechanism.

[0049] G for n, q∈{0,1,···,N-1}, n≠q n,q Let be a collection of random number generators such that node n and node q are synchronous generators that generate random numbers in Z / pZ.

[0050] That is, node n and node q are independent of each other in G n,q We can obtain the same sequence of random numbers from G n,q A simple instantiation of is a cryptographic hash function that takes the output as input and generates the next number, as long as node n and node q start with the same initial input value. However, any pseudorandom number generator that outputs random numbers in Z / pZ will work.

[0051] A node is a number generator G n,q When moving g←G n,q Each node n is written as a polynomial p n To generate N evaluation values ​​from (x), proceed as follows: Step 1- (N-1) random shares p n (q+1), n ​​≠ q. Node n generates G n,q Using the random evaluation value p of the polynomial n (q+1)←G n,q This evaluation value is used as a secret x n Consists of a share from Step 2- Your share n (n+1). Node n now has N-1 shares of the polynomial of degree N-1. With one more share, the polynomial will be fully characterized. Node n will have p as its Nth share. n (0)=x n Select the polynomial p n (x) is fully characterized here, but p n (0) cannot be a valid share because p n(0) is a secret x n The missing share p n To obtain (n+1), node n performs polynomial interpolation (e.g., using Lagrange) to obtain the polynomial

number

[0052] In step 1 above, node n is n,q A random evaluation value p of the polynomial that needs to be sent to node q, where n ≠ q, is n However, both nodes n and q use the same random number generator G n,q Therefore, node q can independently create p n (q+1)←G n,q According to this principle, every node can obtain its share p n (n+1), without the need to send or receive any messages. n (n+1)←G q,n polynomial p from all other computation nodes q using q Share from (x) q (n+1). This constitutes a new procedure that allows the computation nodes to distribute shares from their secrets without exchanging any messages, so that they can jointly compute sums using the BGW SMPC.

[0053] Step 2 – Calculation This part of the algorithm follows standard BGW SMPC. Every node n hasq (0)=x q is a polynomial p of degree N-1 such that it is secret from node q∈{0,1,···,N-1}, q≠n. q Share p from (x) q (n+1).

number

number

number

[0054] Phase 3 – Reconstructing the results Continuing with standard BGW SMPC, each node sends p(n+1) of their shares p(x) to one or several output nodes. When an output node receives all its shares, it performs polynomial interpolation to find the secret sum equal to, i.e.

number

[0055] This completes the description of the algorithm "Secure addition without transmitting shares".

[0056] 3) Description of the algorithm: "Generate blind elements" Input:M a - 1 input node Output: Ma output nodes, where m∈{0,1, ,M a -1}, the mth result node is

number

[0057] Step 1: For each input node m, m∈{0, 1, ,M a -2} is the random number λ m That is, each node generates a set of 0 ,λ 1 , ,λ Ma-2 (The last lambda λ Ma-1 Generate the number of all lambdas in the sum, excluding

[0058] Step 2: For each input node m, m∈{0, 1, ,M a -2} are their secret inputs, λ m to run the algorithm "Secret addition without transmitting shares". At the end of step 1 of the algorithm “Secure Addition without Sending Shares”, for each input node m, m∈{0, 1, ,M a -2} is the number of random numbers λ 0 ,λ 1 , ,λ Ma-2 From the polynomial share p 0 (m+1),p 1 (m+1),...,p Ma-2 End with (m+1) At the end of step 2 of the algorithm “Secure Addition without Sending Shares”, for each input node m, m∈{0, 1, ,M a -2}, when evaluated at x=0,

number

number

number

[0059] Each input node m has

number

number

number

number

number

number

[0060] At the end of step 3 of the algorithm “Secure Addition without Sending Shares”, each input node m, m∈{0, 1, ,M a -2} is k∈{0,1,···,M a -1}, output node k is assigned λ k So that we can recover λ k p is the share of each polynomial k Send (m+1).

[0061] This completes the description of the algorithm "Generate blind elements".

[0062] NMC SMPC - Formal Definition Recalling (Equation 1), the general form of the function in an arithmetic setting is:

number

[0063] Instead of applying a linear secret sharing (LSS) scheme directly to the secret input, the idea behind both NMC flavours is to obscure the secret input using blinding elements, and then use LSS (e.g. Shamir) to store some of these elements in a network of computations. More specifically, 1) In Network NMC, a masked value ν is obtained from a secret input s as follows: ν=s·ρ λ and a network of computational nodes generates and stores the Shamir shares from ρ and λ. 2) In Edge NMC, the masked value ν is calculated from the secret input s as ν=s·X·ρ λ where a network of computational nodes generates and stores Shamir shares from λ, and dealer nodes generate X and ρ.

[0064] We now define four stages for the network NMC SMPC to evaluate this function.

[0065] Description of the algorithm "Network NMC" Input: D input nodes, where the nth node is the entire set of secrets S={s 0 ,s 1 , ,s s-1} subset S nThe dealer node holds the arithmetic function f = f(s 0 ,s 1 , ,s s-1 ) Output: R result nodes, which are function results containing A sums.

number

[0066] The algorithm "Network NMC" includes four stages: pre-processing, share distribution, computation, and result recovery.

[0067] Phase 0 – Pretreatment This step consists of the following: for each sum a, a∈{0,1,...,A-1},

number

[0068] The following steps are performed in parallel for each sum a, a∈{0,1,...,A-1}. Step 1 (calculation of the foundation blind elements): Each computation node n, n∈{0,1,...,N-1}, generates a random number X n,a Generate. Step 2 (calculation of the foundation blind elements): Each computing node n cooperates with

number

number

number

number

number

number

number

[0069] A subset S of computing nodes 0 ,S 1 ,···,S A-1 Note: These subsets may be selected in any manner. Assumption 2 ensures that such a subset exists. In another embodiment, M a The a-th subset S of the computing nodes in a But N-(M a -1) By adding nodes, you can a , M a -1 <N a≦N, and the m-th added node is λ in step 1 of the algorithm “Generate Blind Elements” for all a∈{0,1,···,A-1} so that (Equation 3) is not changed. a,m =0.

[0070] Performance notes: For each sum a, a∈{0,1,...,A-1}, a -1 and λ a,m Computing N requires the execution of step 3 of the algorithm "Secret Addition without Sending Shares". This step involves the transmission of the message to all dealer nodes. By collecting all messages in one dealer node, each computation node needs to send only one message per dealer node. This makes the total number of messages in the network N·D, where D is the number of dealer nodes.

[0071] At the end of the NMC preprocessing stage, each dealer node d, d∈{0,1,···,D-1} has all the secrets that the dealer node provides to all of the SMPC computations.

number

[0072] Phase 1 - Share Distribution Step 1: Each dealer node d∈{0,1,···,D-1} uses a secret

number

number

number

number

[0073] Security Note: N computing nodes are assigned to the basic blind elements ρ a or the exponential blind element λ a,m Note that we do not know the value of , because all the N computational nodes have is a polynomial share of their values. Thus, the element

number

number

number

[0074] Phase 2 - Calculation Step 1: Each computation node n, n ∈ {0, 1, , N-1}, for each sum a, a ∈ {0, 1, , A-1}, calculate (Equation 4)

number

number

[0075] At this stage, no communication between the computation nodes is required, because each node locally calculates r n,a Because it is possible to calculate

[0076] Phase 3 - Restoring the results Each computing node n, n∈{0,1,...,N-1} is

number

[0077] This completes the description of the algorithm "Network NMC".

[0078] FIG. 2 shows the computation node 12 and dealer node 10 of FIG. 1 performing the preprocessing-phase 0 steps of a network NMC execution.

[0079] Still referring to FIG. 3, FIG. 3 is a flow chart including message flows between nodes for network NMC execution.

[0080] In step 20, each of the N computation nodes n ∈ {0, 1, . . . , N-1} receives a random number X n,a This is done in parallel for each sum a, a∈{0,1,...,A-1} as described in step 1 of Phase 1 above.

[0081] In step 22, as described in the first part of step 2 of phase 0 above, each computing node inputs a secret input value X n,a We use the algorithm “Secret Addition without Sending Shares” to run the algorithm. This allows each computation node to send a share of each ρ a -1 This results in a share of

[0082] In step 24, the computation node runs the “Generate Blind Elements” in parallel on A instances, as described in the first part of step 3 of phase 0, to generate λ a,m Calculate the share of.

[0083] In step 26, as described following steps 2 and 3 of Phase 0, the computation node sends the shares computed in steps 22 and 24 of Figure 3 to the dealer node.

[0084] In step 28, the dealer node uses polynomial interpolation of the Shamir secret share (e.g., using Lagrange's method) to find the blind element λ a,m , ρ a As noted at the end of the description of Phase 0 above, the steps leading to the restoration of the blinding factors may be performed long before the share blinding and distribution steps of Phase 1.

[0085] It should also be noted that alternative ways of providing the blinding factors are envisioned. For example, in another embodiment, the trusted node may perform the computations from the preprocessing stage and provide the dealer node with the ρ a -1 and λ a,m Send.

[0086] In another embodiment, the N computation nodes perform the computations from the preprocessing stage using another SMPC flavor different from the one described in the algorithm “Secret Addition without Sending Shares” and inform the dealer node that the dealer node has a ρ a -1 and λ a,m Send a message to help restore it.

[0087] In another embodiment, homomorphic encryption is used at one or several nodes, for example using fully homomorphic encryption or sum-what homomorphic encryption as described in [5], to perform a pre-processing stage of computations to inform the dealer node of the sums a, a∈{0,1,...,A-1} of a -1 and λ a,m Send.

[0088] In another embodiment, one or several nodes may use a secure isolated domain or trusted execution environment to perform the computations from the pre-processing stage and provide the dealer node with a ρ a-1 and λ a,m Send.

[0089] Returning to FIG. 3, in step 30, as described above in phase 1, each dealer node 10 uses the secret

number

number

[0090] In step 32, the result of each such computation is broadcast by the dealer node which causes the computation nodes to perform the computation.

[0091] In step 34, as described above in stage 2, each computing node r n Calculate.

[0092] In step 36, each computation node transmits its share r n Send.

[0093] In step 38, the result node recovers the result of function f as the sum of the result shares (mod p) according to (Equation 6). This recovery, which is reached without any communication between the computation nodes, is a very certain result of multi-party computation of arithmetic functions, as set out in the proof below.

[0094] Starting from (Eq. 4) and (Eq. 5),

number

number

[0095] Recall from Assumption 4 that every dealer provides a secret of at most 1 to the product corresponding to the a-th summation term of f. In another embodiment, every dealer node m provides a secret of exactly 1 to the product corresponding to the a-th summation term for all summation terms a∈{0,1,...,A-1}.

number

[0096] We achieve this as follows: (1) If the dealer has already provided a secret of 1 for the a-th term, we do nothing. (2) If the dealer has not provided a secret, the dealer must ensure that its secret is equal to 1, i.e.

number

number

number

[0097] As discussed previously, as an alternative to the network NMC algorithm, the same result can be achieved using an algorithm called edge NMC, and without any communication between the computational nodes.

[0098] Here we define four stages of Edge NMC SMPC that involve joint evaluation of the arithmetic function in (Eq. 1) without disclosing the input secret value. In Edge NMC SMPC, the dealer node is pushed to bear most of the complexity of the pre-processing stage. This requires modifying (with respect to the network NMC algorithm) steps 1 and 2 of stage 0, all of stage 1, and step 1 of stage 2 as follows:

[0099] Writing the Edge NMC Algorithm Input: Same as network NMC Output: Same as network NMC Purpose: Same as network NMC

[0100] Stage 0: Pre-processing New step 1 (replace the old one): All D dealer nodes run the random number generator synchronously. In other words, by running the random number generator, all D dealer nodes generate the same N A random numbers X independently and without message exchange. n,a, get n ∈ {0, 1, , N-1}, a ∈ {0, 1, , A-1}.

[0101] New step 2 (replace the old one): Every dealer node d∈{0,1,···,D-1} locally

number

[0102] Step 3 remains the same: The N computing nodes compute their shares of the exponential blind elements by running the “blind element generation” as described for the network NMC algorithm, and then generate a secret

number

[0103] Phase 1: Share distribution (replace the old one): Step 1: Each dealer node d ∈ {0, 1, . . . , D-1} is assigned a secret if each dealer node is required to calculate the product including the a-th sum term in (Eq. 1).

number

number

number

[0104] Step 2: Each dealer node d ∈ {0, 1, . . . , D-1} reads all secrets owned by node d.

number

[0105] Step 2: Calculation Step 1 (replace the old one): Each computation node n, n ∈ {0, 1, , N-1}, for each sum a, a ∈ {0, 1, , A-1}, calculates (Equation 4, alternative version)

number

[0106] Phase 3: Recovering the results Similar to network NMC

[0107] This completes the description of the algorithm "edge NMC".

[0108] FIG. 4 shows the compute node 12 and dealer node 10 of FIG. 1 performing preprocessing for step-edge NMC execution in phase 0.

[0109] Still referring to FIG. 5, this is a flowchart containing message flows between nodes in an Edge NMC implementation.

[0110] In step 40, the computation node runs the “Generate Blind Elements” in parallel on A instances, as described in the first part of step 3 of phase 0 of the Edge NMC algorithm above, to generate λ a,m Calculate the share of.

[0111] In step 42 (which may be performed after step 20 or before in parallel with step 20), each dealer node synchronizes its random number generator to generate the same random number X without message exchange, as described in step 1 of phase 0. n,a Generate a set of

[0112] In step 44, as described in step 2 of phase 0, each dealer node locally calculates ρ a (or ρ a -1 ) to calculate

[0113] In step 46, the computing node calculates the λ a,m The shares are then sent to the dealer node.

[0114] In step 48, the dealer node calculates, from the disclosed shares, λ a,m Those skilled in the art will appreciate that the same options exist for providing blind elements to dealer nodes as in the network NMC algorithm.

[0115] In step 50, as described above in phase 1, step 1, each dealer node 10 transfers all of the secret

number

[0116] In step 52, these shares are transmitted to each compute node as described for phase 1, step 2.

[0117] In step 54, the computation node receives the result share r n Calculate a modified version of

[0118] In step 56, the result share is sent to the result node, which in step 58 recovers the result of the function f.

[0119] The proof for the edge NMC flavor is roughly the same as that of Equation 6 in the network NMC flavor, with the only difference being that

number

number

number

number

[0120] Sometimes, a dealer node will want to use the network of computation nodes solely to memorize and recover the value of an input secret. We now discuss this process in both NMC protocols.

[0121] In Phase 1 of the Network NMC Protocol, dealer nodes:

number

number

[0122] In Phase 1 of the Edge NMC protocol, dealer nodes:

number

number

number

[0123] (Additional Note) (Appendix 1) 1. A method of performing computations, comprising: It runs among multiple D dealer nodes and N computation nodes, Private input secret 0 ,s 1 , ,s s-1} can be expressed as a sum of A groups of products of a set S of

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

[0124] (Appendix 2) Step h) (a) Each computing node calculates the local sum r n sending the result to one or more result nodes; (a) the one or more result nodes performing an aggregation of the received local sum results to identify a result of an arithmetic function f; 2. A method for performing the calculations according to claim 1, comprising:

[0125] (Appendix 3) Step a) (a) Each computing node n, n∈{0, 1, , N-1}, generates a random number X n,a and (a) Each computing node:

number

[0126] (Appendix 4) Step (I) is A random number generator G for n, q ∈ {0, 1, , N-1} with n ≠ q n,q Let n and q be the generators that run synchronously with each other, and let G n,q and providing a collection of Each computing node n generates the random number generator G n,q Generate N-1 random shares from the polynomial p n generating each of the (q+1) random evaluation values; Each computing node calculates the random evaluation value p n (q+1) and pn (0)=X n,a A polynomial p that satisfies n Calculating the coefficient of (x); Each computing node n calculates the coefficients and X n,a From this, the polynomial p n Share of (x) p n Calculate (n+1) and The polynomial p from all other computation nodes q q As its share of (x), each computation node n generates the random number generator G n,q From, p q (n+1); and Each node:

number

number

[0127] (Appendix 5) Step a) is a. The dealer node receives the basic blind element ρ from a trusted node. a ―1 and b. The computation node determines whether the dealer node calculates ρ for each sum a, a∈{0, 1, , A-1}. a ―1sending a message to the dealer node, the message being generated using multi-party secure computation to recover the secret X n,a transmitting a message generated by the dealer nodes cooperatively from c. One or more nodes other than the dealer node perform homomorphic encryption to encrypt the basic blind element ρ a ―1 and transmitting the basic blind element to the dealer node providing the sum a; d. One or more nodes other than the dealer node execute the basic blind element ρ in a secure isolated area or trusted execution environment. a ―1 and transmitting the basic blind element to said dealer node providing the sum a; 3. A method for performing the calculations according to claim 1 or 2, comprising one of the steps:

Claims

1. 1. A method of performing computations, comprising: The method is executed among a plurality of D dealer nodes (10) and N computation nodes (12), Private input secret {s ０ , s １ , ..., s ｓ－１}, the sum of A groups of products of a set S of [0010] computing a result of an arithmetic function f such that Each group m of the product ａ , a ∈ {0, 1, ..., A-1} is M of the set S of private input secrets. ａ Product of secrets [0025] , a∈{0, 1, ..., A-1}, m∈{0, 1, ..., M ａ -1} ａ，ｍ identifies a private input secret from a set of S secrets; the S secrets are selected from integers, real numbers, or complex numbers; Each secret is known to one of the dealer nodes (10); The method comprises: a) Product m ａ Secret to the group [0030] Each dealer node (10) providing the product m ａ A common basic blind element ρ for all secrets shared by the group ａ providing The foundation blind element ρ ａ is a set of (N×A) random or pseudorandom numbers X, each associated with a respective one of the N computational nodes (12), where n ∈ {0, 1, ..., N-1} and a ∈ {0, 1, ..., A-1}. ｎ，ａ For a set of [0045] (modulo p, where p is a prime number), The method comprises: b) Product m ａ Secret to the group [0050] Each dealer node (10) providing said secret [006] The exponential blind element λ ａ，ｍ providing The exponent blind element λ ａ，ｍ The set of, taken together, is [0070] (modulo p), The method comprises: c) For n ∈ {0, 1, ..., N-1} and a ∈ {0, 1, ..., A-1}, the (N x A) random or pseudo-random numbers X ｎ，ａ storing a set of (a) storing at said computation nodes (12) in a first operational mode ("network mode"), whereby each of said N computation nodes (12) stores a subset of A random or pseudo-random numbers specific to that node (12); or (a) storing in said dealer node (10) in a second operation mode ("edge mode"), whereby each dealer node (10) stores at least said (N x A) random or pseudo-random numbers X corresponding to the sum to a secret provided by said dealer; ｎ，ａ , memorizing a subset of The method comprises: d) Each dealer node (10) [0080] , computing one or more shares to the secret, In the above network mode of operation, a single share [0090] (modulo p), In the edge mode of operation, the secret [0010] The product m provided ａ N random or pseudorandom numbers X associated with a group of ｎ，ａ Using 、 Multiple N shares ##EQU00011## (modulo p), The method comprises: e) each dealer node (10) sending a respective share message to each of said computation nodes (12); In the network mode of operation, each share message contains the same single share v ａ，ｍ Including, In the edge mode of operation, each share message contains N shares v ｎ，ａ，ｍ Includes one of each of The method comprises: f) Each computation node (12) calculates the product m ａ The received shares v associated with each of the groups ａ，ｍ or ν ｎ，ａ，ｍ and computing a local multiplication result for In said network mode of operation, ##EQU00012## (modulo p), In said edge mode of operation: ##EQU00013## (modulo p), The method comprises: g) each computation node (12) selects from its local set of multiplication results: ##EQU00014## Computing a local sum result modulo p; h) combining said local summation results from N of said computation nodes (12); ##EQU00015## to calculate the output of the function f; Including, Step a) comprises: a. the dealer node (10) receiving the basic blind component ρ a −1 from a trusted node; b) the computation node (12) sending messages to the dealer node (10) such that the dealer node (10) can recover ρ a −1 for each sum a, a ∈ {0, 1, ..., A-1}, the messages being collaboratively generated by the dealer nodes (10) from the secret X n,a using multi-party secure computation; c) one or more nodes other than the dealer node (10) performing homomorphic encryption to generate the basic blind element ρ a −1 and transmitting the basic blind element to the dealer node (10) providing the sum a; d. one or more nodes other than the dealer node (10) calculate the basic blind component ρ a −1 in a secure isolated area or trusted execution environment and transmit the basic blind component to the dealer node (10) providing the sum a; Including one of the following: How the calculation is performed.

2. Step h) (a) Each computing node (12) calculates a local sum r ｎ to one or more result nodes (14); (a) the one or more result nodes (14) performing an aggregation of the received local summation results to identify a result of an arithmetic function f; 2. The method of claim 1, comprising:

3. Step a) is (a) Each computation node n, n ∈ {0, 1, ..., N-1} receives a random number X ｎ，ａand (a) each computing node (12) ##EQU00016## (mod p) ａ Share of (x) p ａ (n+1); and (c) Each computing node (12) ａ －１ to each dealer node d, d∈{0, 1, ..., D-1}; (iv) Each dealer node (10) calculates the corresponding basic blind element ρ from the received shares. ａ －１ To restore the 3. A method for performing computations according to claim 1 or 2, comprising:

4. Step (I) is A random number generator G for n, q ∈ {0, 1, ..., N-1}, where n ≠ q ｎ，ｑ The random number generator G is a generator that operates in sync with the computation nodes n and q (12). ｎ，ｑ and providing a collection of Each computation node n is configured to generate the random number generator G ｎ，ｑ , generate N-1 random shares and use them as a polynomial p ｎ generating (q+1) random evaluation values; Each computing node n calculates each random evaluation value p ｎ (q+1) and p ｎ (0) = X ｎ，ａ A polynomial p that satisfies ｎ Calculating the coefficients of (x); Each computing node n calculates the coefficients and X ｎ，ａ From this, the polynomial p ｎ Share of (x) p ｎ (n+1); and The polynomial p from all other computation nodes q ｑAs its share of (x), each computation node n generates the random number generator G ｎ，ｑ From p ｑ (n+1); and Each node: ##EQU00017## Calculate the polynomial p evaluated at n+1. ａ providing a share p(n+1) of (x); Each dealer node (10) calculates the secret sum [0018] is equal to x ０ p equivalent to ａ Each computation node (12) computes the product m ａ Each dealer node (10) serving a group of ａ transmitting a share p(n+1) of (x); 4. The method of claim 3, comprising:

Images