Multi-party computation system

Abstract

Disclosed is multi-party computation, MPC, system configured to process a first set of input data M and provide an output, the MPC system comprising a first MPC group comprising S servers, wherein S is equal to or larger than two, each server comprising one or more processing units, wherein the first set of input data M is secretly shared between the servers of the first MPC group so that each server has a set of data M_s based on the first set of input data M, and perform MPC computations on the set of data M_s, the first set of input data M being derivable by processing all set of data M_s together, wherein the MPC system further comprises a second MPC group comprising R servers wherein R is equal to or larger than two, each server comprising one or more processing units.

Description

[0001] Title Multi-party computation system

[0002] Field

[0003] The present disclosure relates to a multi-party computation system (MPC), a server for use in a MPC system, and a method for substituting servers in a MPC system.

[0004] Background

[0005] Multi-party computation (MPC) enables parties to jointly compute a function and receive and output while keeping the inputs private. This enables users to provide data for computation that otherwise for different reasons cannot be shared. This allows the value of the results of those computations to be increased.

[0006] A MPC system typically comprises a plurality of computer servers connected via a computer network. The input data set provided to the MPC system may be continuously expanded, whereby each computer server continuously receives updated input date for processing.

[0007] A computer server periodically needs to receive new system updates. The system updates ensures that the OS of the computer server is operating correctly and may further mitigate any security vulnerabilities.

[0008] This may result in significant downtime for a long running MPC computation, which may have significant negative effects. The problem for MPC computations may further become more sever since the different servers of the MPC system often are independent of each other and not under the control of a central network controller that could be used for coordinating system updates.

[0009] It remains therefore a problem to provide an improved MPC system, a MPC server and a method for performing MPC computations.

[0010] Summary

[0011] According to a first aspect, the disclosure relates to a multi-party computation, MPC, system configured to process a first set of input data M and provide an output, the MPC system comprising a first MPC group comprising S servers, wherein S is equal to or larger than two, each server comprising one or more processing units, wherein the first set of input data M is secretly shared between the servers of the first MPC group so that each server has a set of data M_s based on the first set of input data M, and perform MPC computations on the set of data M_s, the first set of input data M being derivable by processing all set of data M_s together, wherein the MPC system further comprises a second MPC group comprising R servers wherein R is equal to or larger than two, each server comprising one or more processing units, wherein the MPC system is configured to transfer the secretly shared input data M from the servers of the first MPC group to the servers of the second MPC group by having each server of the first MPC group configured to: generate R subkeys k_s_r; provide each server in the second MPC group with access to a subkey k_s_r; share secretly the R generated subkeys k_s_r with the other servers in the first MPC group; and generate a combined key K_s based on the R generated subkeys k_s_r and values received from the other servers in the first MPC group in connection with the secret sharing of their R generated subkey k_s_r; and encrypt the set of data M_s using the combined key K_s resulting in an encrypted set of data C_s; whereby S encrypted set of data C_s are generated and each server in the second MPC group is provided with access to S subkeys k_s_r, and wherein each server in the second MPC group is configured to: share secretly the S subkeys k_s_r with the other servers in the second MPC group; generate a combined key K_r based on the S subkeys k_s_r and the values received from the other servers in the second MPC group in connection with the secret sharing of their S subkeys k_s_r; obtaining an encrypted version C of the first set of input data M, the encrypted version C of the first set of input data M being created by combining the S encrypted set of data C_s; decrypting the encrypted version C of the first set of input data M using the combined key K_r resulting in a set of data M_r, whereby R set of data M_r are generated and wherein the first set of input data M is derivable from the R set of data M_r, whereby the secretly shared input data M is transferred from the first MPC group to the second MPC group.

[0012] Consequently, the secretly shared input data may securely and efficiently be transferred from the servers of the first MPC group to the servers of the second MPC group, without enabling any party access to the full set of input data M.

[0013] Furthermore, by involving the plurality of servers in the first and second MPC group in the substitution process, it may be ensured that a successful transfer only may happen with the consent of all the servers. Substituting servers may further improve security as the potential targets for an attacker continuously may be changed.

[0014] The transfer will further change how the first set of input data M is secretly shared. Thus, even if an attacker has gained access to a set of data M_s of one of the servers in the first MPC group, the transfer of the first set of data M to the second MPC group will render the information of the attacker useless.

[0015] The first set of input data may be provided by a plurality of data sources e.g. at least three data sources.

[0016] Each server of the first MPC group may receive its set of data M_s from a unique data source. The MPC system may be setup so that no single entity at any point in time has access to the entire first set of input data M provided to the MPC system. The first set of input data M may be continuously updated.

[0017] The active servers of the MPC system may continuously provide an output. The output of the active servers of the MPC system may be processed outside of the MPC system. Alternatively, an active server of the MPC system may process the output of the other active servers of the MPC system and provide a combined output.

[0018] Each server of the first MPC group may derive its subkeys k_s_r using a pseudo random number generator (PRG).

[0019] A server in the first MPC group may share secretly a subkey k_s_r with the other servers in the first MPC group by generating S secret shares sk_z_s_r keeping one secret share sk_z_s_r and providing each other server in the first MPC group with a secret share, wherein the subkey k_s_r are derivable by processing the S secret shares sk_z_s_r together. The secret sharing scheme should be linear. Examples of linear secret sharing schemes are Shamir’s secret sharing, additive secret sharing, and replicated secret sharing.

[0020] Correspondingly, a server in the second MPC group may share secretly a subkey k_s_r with the other servers in the second MPC group by generating R secret shares rk_z_s_r keeping one secret share rk_z_s_r and providing each other server in the second MPC group with a secret share, wherein the subkey k_s_r are derivable by processing the R secret shares rk_z_s_r together. A server in the first MPC group may provide a server in the second MPC group with access to a subkey k_s_r by sending the subkey k_s_r to the server in the second MPC group. Alternatively, a server in the first MPC group may provide a server in the second MPC group with access to a subkey k_s_r by sending a value to the server in the second MPC group that enables the server in the second MPC group to gain access to the subkey k_s_r.

[0021] The combined key K_s may be generated by a server in the first MPC group by processing all the secret shares the server has kept in connection with the secret sharing of the R subkeys k_s_r together with all the secret shares the server has received in connection with the secret sharing performed by the other servers in the first MPC group. As an example, the secret shares may be processed together using a XOR function.

[0022] Correspondingly, the combined key K_r may be generated by a server in the second MPC group by processing all the secret shares the server has kept in connection with the secret sharing of the S subkeys k_s_r together with all the secret shares the server has received in connection with the secret sharing performed by the other servers in the second MPC group. As an example, the secret shares may be processed together using a XOR function.

[0023] The servers in the second MPC group may obtain the encrypted version C of the first set of input data M by receiving an encrypted set of data C_s from each server in the first MPC group. Alternatively, a server in the first MPC group or a server forming part of neither the first MPC group nor the second MPC group may receive an encrypted set of data C_s from each server in the first MPC group combine all encrypted unique set of data C_s to create the encrypted version C of the first set of input data and transmit the encrypted version C of the first set of input data to the servers of the second MPC group.

[0024] When information is send from one server to another in the MPC system the information is preferably encrypted e.g. using asymmetric cryptography, i.e. by encrypting the information with the public key of the recipient, or symmetric cryptography. There may be no overlap between the first MPC group and the second MPC group, i.e. the servers in the first MPC group may differ from the servers in the second MPC group.

[0025] Alternatively, there may be an overlap between the servers in the first MPC group and the servers in the second MPC group, e.g. a server may be in both the first MPC group and the second MPC group. In such a situation the server will perform the action of the both the servers in the first MPC group and the second MPC group. The result for the server will be that the servers share of the first set of input data M, being the servers set of input data M_s, will change to M_r. In some embodiments the first MPC group and the second MPC group comprises at least three servers, i.e., S and R may be at least 3.

[0026] In some embodiments, the servers in the first MPC group are configured to generate the R subkeys k_s_r by generating R seed values q_s_r and provide the R seed values q_s_r to a pseudo random number generator, PRG, outputting the R subkeys k_s_r.

[0027] Consequently, subkeys of a desired length may easily be created.

[0028] In some embodiments, the seed values q_s_r have a size being smaller than the size of the subkeys k_s_r.

[0029] In some embodiments, the size of the subkeys k_s_r are equal to or larger than the size of the set of data M_s.

[0030] Consequently, the subkeys may be used to create a one-time pad.

[0031] In some embodiments, the servers in the first MPC group are configured to provide each server in the second MPC group with access to a subkey k_s_r by transmitting the generated seed values q_s_r to the servers in the second MPC group.

[0032] Consequently, the amount of data being transmitted between the first MPC group and the second MPC group may be lowered. This may be particular important when the subkeys has a length being equal to or larger than the size of the first set of input data M. The servers in the second MPC group may be configured to use a PNG together with the received seeds q_s_r to obtain the subkeys k_s_r.

[0033] In some embodiments, the servers of the first MPC group are configured to obtain a value E and process the combined keys K_s together with the value E to obtain a value K0_1 and the servers in the second MPC group are configured to obtain the value E and process the combined keys K_r together with the value E to obtain a value K0_2 and wherein the MPC system is configured to compare K0_1 and K0_2 to ensure that the transfer and secret sharing of the subkeys k_s_r have been done correctly.

[0034] Consequently, a check may be performed to ensure that all transmissions have been carried correctly. This may reveal malicious actions made by an attacker.

[0035] The combined keys K_s may be seen as secret shares of a master key KS, and the combined keys K_r may be seen as secret shares of a master key KR, where KS is equal to KR. Consequently, K0_1 and K0_2 may reveal if all transfers and secret sharing of the subkeys has been done correctly.

[0036] The servers in the first MPC group may generate the master key KS by secretly sharing their combined keys K_s with the other servers in the first MPC group, having each server in the first MPC group combining all the secret shares of the server forming an intermediate output and combining all S intermediate outputs. Correspondingly, the servers in the second MPC group may be generate the master key KR by secretly sharing their combined keys K_r with the other servers in the second MPC group, having each server in the second MPC group combining all the secret shares of the server forming an intermediate output and combining all R intermediate outputs.

[0037] In some embodiments, the MPC system maintains a blockchain for registering MPC computations and wherein the value E is obtained from the blockchain.

[0038] Consequently, it may be ensured that the servers of the MPC system easily an effectively obtain the same value E. Furthermore, by using a blockchain the MPC system may function without the need of a central coordinating server, whereby the system becomes more flexible and secure.

[0039] The value E may be a random or pseudo random value.

[0040] In some embodiments, the value K0_1 and the value K0_2 are written to a blockchain for comparison.

[0041] In some embodiments, the servers of the first MPC group are configured to process the combined keys K_s together with the value E to obtain the value K0_1 by generating one or more polynomials and evaluating the one or more polynomials using the value E, and the servers of the second MPC group are configured to process the combined keys K_r together with the value E to obtain the value K0_1 by generating one or more polynomials and evaluating the one or more polynomials using the value E.

[0042] As an example, each server in the first MPC group may generate a polynomial based on the combined key K_s and evaluate the polynomial using the value E resulting in an output k_01 wherein the outputs k_01 from each server in the first MPC group are processed together to provide the value K0_1. Correspondingly, each server in the second MPC group may generate a polynomial based on the combined key K_r and evaluate the polynomial using the value E resulting in an output k_02 wherein the outputs k_02 from each server in the second MPC group are processed together to provide the value K0_2.

[0043] The polynomial may be generated by splitting the master keys KS KR or the combined keys K_s K_r into N parts and using each part as a coefficient, thereby creating a N-1 degree polynomial.

[0044] In some embodiments, if the values K0_1 and K0_2 do not match all servers of the first MPC group are required to post the generated subkeys.

[0045] In some embodiments, a server in the first group of servers are further configured to receive a control message indicating that the servers in the second group of servers has received the set of data C successfully and in response thereto stop MPC computations. According to a second aspect, the disclosure relates to a server for use in a MPC system, the MPC system being configured to process a first set of input data M and provide an output, the MPC system comprising a first MPC group comprising S servers including the server, wherein S is equal to or larger than two, wherein the first set of input data M is secretly shared between the servers of the first MPC group so that each server has a set of data M_s based on the first set of input data M, and perform MPC computations on the set of data M_s, the first set of input data M being derivable by processing all set of data M_s together, wherein the MPC system further comprises a second MPC group comprising R servers wherein R is equal to or larger than two, wherein the MPC system is configured to transfer the secretly shared input data M from the servers of the first MPC group to the servers of the second MPC group, and wherein the server comprises one or more processing units and is configured to: generate R subkeys k_s_r; provide each server in the second MPC group with access to a subkey k_s_r; share secretly the R generated subkeys k_s_r with the other servers in the first MPC group; and generate a combined key K_s based on the R generated subkeys k_s_r and values received from the other servers in the first MPC group in connection with the secret sharing of their R generated subkey k_s_r; and encrypt the set of data M_s using the combined key K_s resulting in an encrypted set of data C_s.

[0046] According to a third aspect the disclosure relates to a server for use in a MPC system, the MPC system being configured to process a first set of input data M and provide an output, the MPC system comprising a first MPC group comprising S servers, wherein S is equal to or larger than two, wherein the first of input data M is secretly shared between the servers of the first MPC group so that each server has a set of data M_s based on the first set of input data M, and perform MPC computations on the set of data M_s, the first set of input data M being derivable by processing all set of data M_s together, wherein the MPC system further comprises a second MPC group comprising R servers including the server, wherein R is equal to or larger than two, wherein the MPC system is configured to transfer the secretly shared input data M from the servers of the first MPC group to the servers of the second MPC group, and wherein the server comprises one or more processing units and is configured to: obtain access to S subkeys k_s_r; share secretly the S subkeys k_s_r with the other servers in the second MPC group; generate a combined key K_r based on the S subkeys k_s_r and the values received from the other servers in the second MPC group in connection with the secret sharing of their S subkeys k_s_r; obtaining an encrypted version C of the first set of input data M, the encrypted version C of the first set of input data M being created by combining the S encrypted set of data C_s; decrypting the encrypted version C of the first set of input data M using the combined key K_r resulting in a set of data M_r.

[0047] According to a fourth aspect the disclosure relates to a method for transfer secretly shared input data M from servers of a first MPC group to the servers of a second MPC group of a MPC system, the first MPC group comprising S servers, wherein S is equal to or larger than two, each server comprising one or more processing units, wherein the first set of input data M is secretly shared between the servers of the first MPC group so that each server has a set of data M_s based on the first set of input data M, and perform MPC computations on the set of data M_s, the first set of input data M being derivable by processing all set of data M_s together, wherein the second MPC group comprises R servers wherein R is equal to or larger than two, each server comprising one or more processing units, wherein the method comprises: generate, using each server of the first MPC group, R subkeys k_s_r; provide, using each server of the first MPC group, each server in the second MPC group with access to a subkey k_s_r; share secretly, using each server in the first MPC group, the R generated subkeys k_s_r with the other servers in the first MPC group; and generate, using each server in the first MPC group, a combined key K_s based on the R generated subkeys k_s_r and values received from the other servers in the first MPC group in connection with the secret sharing of their R generated subkey k_s_r; encrypt, using each server in the first MPC group, the set of data M_s using the combined key K_s resulting in an encrypted set of data C_s; whereby S encrypted set of data C_s are generated and each server in the second MPC group is provided with access to S subkeys k_s_r, and wherein the method further comprises: share secretly, using each server in the second MPC group, the S subkeys k_s_r with the other servers in the second MPC group; generate, using each server in the second MPC group, a combined key K_r based on the S subkeys k_s_r and the values received from the other servers in the second MPC group in connection with the secret sharing of their S subkeys k_s_r; obtaining, using each server in the second MPC group, an encrypted version C of the first set of input data M, the encrypted version C of the first set of input data M being created by combining the S encrypted set of data C_s; decrypting, using each server of the second MPC group, the encrypted version C of the first set of input data M using the combined key K_r resulting in a set of data M_r, whereby R set of data M_r are generated and wherein the first set of input data M is derivable from the R set of data M_r, whereby the secretly shared input data M is transferred from the first MPC group to the second MPC group.

[0048] Here and in the following, the term 'processing unit' is intended to comprise any circuit and / or device suitably adapted to perform the functions described herein. In particular, the above term comprises general purpose or proprietary programmable microprocessors, Digital Signal Processors (DSP), Application Specific Integrated Circuits (ASIC), Programmable Logic Arrays (PLA), Field Programmable Gate Arrays (FPGA), special-purpose electronic circuits, etc., or a combination thereof.

[0049] The different aspects of the present invention can be implemented in different ways including a MPC system, a server for use in a MPC system, and a method for substituting servers in a MPC system described above and in the following, each yielding one or more of the benefits and advantages described in connection with at least one of the aspects described above, and each having one or more preferred embodiments corresponding to the preferred embodiments described in connection with at least one of the aspects described above and / or disclosed in the dependant claims. Furthermore, it will be appreciated that embodiments described in connection with one of the aspects described herein may equally be applied to the other aspects.

[0050] Brief description of the drawings

[0051] The above and / or additional objects, features and advantages of the present invention, will be further elucidated by the following illustrative and nonlimiting detailed description of embodiments of the present disclosure, with reference to the appended drawings, wherein:

[0052] Fig. 1 shows a schematic drawing of a MPC system 100 configured to process a set of input data and provide an output according to an embodiment of the disclosure.

[0053] Fig. 2 shows a schematic drawing of a server 200 for use in a MPC system according to an embodiment of the disclosure.

[0054] Fig. 3 shows a MPC system 300 configured to process a set of input data and provide an output according to an embodiment of the disclosure.

[0055] Detailed description

[0056] In the following description, reference is made to the accompanying figures, which show by way of illustration how the invention may be practiced.

[0057] Fig. 1 shows a schematic drawing of a MPC system 100 configured to process a first set of input data M and provide an output according to an embodiment of the disclosure. The MPC system 100 comprises a first MPC group 110 comprising S servers 101 102 103, wherein S is equal to or larger than two, each server comprising one or more processing units. In this embodiment S is 3. The first set of input data M is secretly shared between the three servers of the first MPC group 110 so that each server has a set of data M_s based on the first set of input data M, and perform MPC computations on the set of data M_s, the first set of input data M being derivable by processing all set of data M_s together. The MPC system 100 further comprises a second MPC group comprising R servers 104 105. In this embodiment R is equal to two. Each server 101 102 103 104 105 comprising one or more processing units, wherein the MPC system 100 is configured to transfer the secretly shared input data M from the servers of the first MPC group 110 to the servers of the second MPC group 120. The server 101 is configured to generate two subkeys k_s(1 )_r(1 ) k_s(1 )_r(2); provide the server 104 in the second MPC group with access to subkey k_s(1 )_r(1 ) and the server 105 in the second MPC group with access to subkey k_s(1 )_r(2); and share secretly the two generated subkeys k_s(1 )_r(1 ) k_s(1 )_r(2) with the other servers 102 103 in the first MPC group 110. The server 102 is configured to generate two subkeys k_s(2)_r(1 ) k_s(2)_r(2); provide the server 104 in the second MPC group with access to subkey k_s(2)_r(1 ) and the server 105 in the second MPC group with access to subkey k_s(2)_r(2); and share secretly the two generated subkeys k_s(2)_r(1 ) k_s(2)_r(2) with the other servers 101 103 in the first MPC group 110. The server 103 is configured to generate two subkeys k_s(3)_r(1 ) k_s(3)_r(2); provide the server 104 in the second MPC group with access to subkey k_s(3)_r(1 ) and the server 105 in the second MPC group with access to subkey k_s(3)_r(2); and share secretly the two generated subkeys k_s(3)_r(1 ) k_s(3)_r(2) with the other servers 101 102 in the first MPC group 110. The server 101 is further configured to generate a combined key K_s(1 ) based on the two generated subkeys k_s(1 )_r(1 ) k_s(1 )_r(2) and values received from the other servers 102 103 in the first MPC group 110 in connection with the secret sharing of their two generated subkeys; and encrypt the set of data M_s(1 ) using the combined key K_s(1 ) resulting in an encrypted set of data C_s(1 ). The server 102 is further configured to generate a combined key K_s(2) based on the two generated subkeys k_s(2)_r(1 ) k_s(2)_r(2) and values received from the other servers 101 103 in the first MPC group 110 in connection with the secret sharing of their two generated subkeys; and encrypt the set of data M_s(2) using the combined key K_s(2) resulting in an encrypted set of data C_s(2). The server 103 is further configured to generate a combined key K_s(3) based on the two generated subkeys k_s(3)_r(1 ) k_s(3)_r(2) and values received from the other servers 101 102 in the first MPC group 110 in connection with the secret sharing of their two generated subkeys; and encrypt the set of data M_s(3) using the combined key K_s(3) resulting in an encrypted set of data C_s(3). Consequently, three encrypted set of data C_s(1 )-(3) are generated and each server 104 105 in the second MPC group 120 is provided with access to three subkeys. The server 104 is configured to share secretly the three subkeys k_s(1 )_r(1 ) k_s(2)_r(1 ) k_s(3)_r(1 ) with the other server 105 in the second MPC group 120. Correspondingly, the server 105 is configured to share secretly the three subkeys k_s(1 )_r(2) k_s(2)_r(2) k_s(3)_r(2) with the other server 104 in the second MPC group 120. The server 104 is further configured to generate a combined key K_r(1 ) based on the 3 subkeys k_s(1 )_r(1 ) k_s(2)_r(1 ) k_s(3)_r(1 ) and the values received from the other server in the second MPC group in connection with the secret sharing of its three subkeys; obtain an encrypted version C of the first set of input data M, the encrypted version C of the first set of input data M being created by combining the three encrypted set of data C_s(1 )-(3); and decrypt the encrypted version C of the first set of input data M using the combined key K_r(1 ) resulting in a set of data M_r(1 ). The server 105 is further configured to generate a combined key K_r(2) based on the 3 subkeys k_s(1 )_r(2) k_s(2)_r(2) k_s(3)_r(2) and the values received from the other server in the second MPC group 120 in connection with the secret sharing of its three subkeys; obtain an encrypted version C of the first set of input data M, the encrypted version C of the first set of input data M being created by combining the three encrypted set of data C_s(1 )-(3); and decrypt the encrypted version C of the first set of input data M using the combined key K_r(2) resulting in a set of data M_r(2). Consequently, two set of data M_r(1 ) and M_r(2) are generated and where the first set of input data M is derivable from the two set of data M_r(1 )-(2), whereby the secretly shared input data M is transferred from the first MPC group 110 to the second MPC group 120.

[0058] Fig. 2 shows a schematic drawing of a server 200 for use in a MPC system according to an embodiment of the disclosure. The server 200 comprises one or more processing units 201 and one or more memory units 202. The one or more memory units 202 stores a set of data M_s. The processing unit 201 being configured to perform MPC computations using the set of data M as input. The server 200 further comprises a communication unit (not shown) for allowing the server 200 to communicate with other servers via a network.

[0059] Fig. 3 shows a MPC system 300 configured to process a first set of input data M and provide an output according to an embodiment of the disclosure. The MPC system 300 comprises a first MPC group 310 comprising S servers 301 302, wherein S is equal to or larger than two, each server comprising one or more processing units. In this embodiment S is 2. The first set of input data M is secretly shared between the two servers of the first MPC group 310 so that each server has a set of data M_s based on the first set of input data M, and perform MPC computations on the set of data M_s, the first set of input data M being derivable by processing all set of data M_s together. The MPC system 300 further comprises a second MPC group 320 comprising R servers 304 305. In this embodiment R is equal to two. Each server 301 302 304 305 comprising one or more processing units, wherein the MPC system 300 is configured to transfer the secretly shared input data M from the servers of the first MPC group 310 to the servers of the second MPC group 320. The server 301 is configured to generate two subkeys k_s(1 )_r(1 ) k_s(1 )_r(2), by generating two seed values q_s(1 )_r(1 ) q_s(1 )_r(2) and provide the two seed values to a pseudo random number generator, PRG, outputting the two subkeys k_s(1 )_r(1 ) k_s(1 )_r(2). In this embodiment, the seed values have a size being smaller than the size of the sets of data M_s(1 )-(2). As an example, the seeds may have a size of 256 bits and the sets of data M_s(1 )-(2) may have a size of many gigabytes. In this embodiment, the size of the subkeys k_s(1 )_r(1 )-(2) are equal to or larger than the size of the set of data M_s(1 ). The server 301 is further configured to provide the server 304 in the second MPC group 320 with access to subkey k_s(1 )_r(1 ) and the server 305 in the second MPC group 320 with access to subkey k_s(1 )_r(2), by transmitting the seed value q_s(1 )_r(1 ) to the server 304 and the seed value q_s(1 )_r(2) to the server 305. Furthermore, the server 301 is configured to share secretly the generated subkey k_s(1 )_r(1 ) with the other server 302 in the first MPC group 310 by generating two secret shares sk_z(1 )_s(1 )_r(1 ) sk_z(2)_s(1 )_r(1 ) keeping one secret share sk_z(1 )_s(1 )_r(1 ) and provide the other server 302 in the first MPC group 310 with the secret share sk_z(2)_s(1 )_r(1 ), wherein the subkey k_s(1 )_r(1 ) is derivable by processing the two secret shares together. Correspondingly, the server 301 is configured to share secretly the generated subkey k_s(1 )_r(2) with the other server 302 in the first MPC group 310 by generating two secret shares sk_z(1 )_s(1 )_r(2) sk_z(2)_s(1 )_r(2) keeping one secret share sk_z(1 )_s(1 )_r(2) and provide the other server 302 in the first MPC group 310 with the secret share sk_z(2)_s(1 )_r(2), wherein the subkey k_s(1 )_r(2) is derivable by processing the two secret shares together. The server 302 is configured to generate two subkeys k_s(2)_r(1 ) k_s(2)_r(2), by generating two seed values q_s(2)_r(1 ) q_s(2)_r(2) and provide the two seed values to a PRG outputting the two subkeys k_s(2)_r(1 ) k_s(2)_r(2). In this embodiment, the size of the subkeys k_s(2)_r(1 )-(2) are equal to the size of the subkeys k_s(1 )_r(1 )-(2). The server 302 is further configured to provide the server 305 in the second MPC group 320 with access to subkey k_s(2)_r(1 ) and the server 305 in the second MPC group 320 with access to subkey k_s(2)_r(2), by transmitting the seed value q_s(2)_r(1 ) to the server 304 and the seed value q_s(2)_r(2) to the server 305. Furthermore, the server 302 is configured to share secretly the generated subkey k_s(2)_r(1 ) with the other server 301 in the first MPC group 310 by generating two secret shares sk_z(1)_s(2)_r(1 ) sk_z(2)_s(2)_r(1 ) keeping one secret share sk_z(1 )_s(2)_r(1) and provide the other server 301 in the first MPC group 310 with the secret share sk_z(2)_s(2)_r(1 ), wherein the subkey k_s(2)_r(2) is derivable by processing the two secret shares together. Correspondingly, the server 302 is configured to share secretly the generated subkey k_s(2)_r(2) with the other server 301 in the first MPC group 310 by generating two secret shares sk_z(1 )_s(2)_r(2) sk_z(2)_s(2)_r(2) keeping one secret share sk_z(1 )_s(2)_r(2) and provide the other server 301 in the first MPC group 310 with the secret share sk_z(2)_s(2)_r(2), wherein the subkey k_s(2)_r(2) is derivable by processing the two secret shares together.

[0060] The server 301 is further configured to generate a combined key K_s(1 ) based on the two generated subkeys k_s(1 )_r(1 ) k_s(1 )_r(2) and values (secret shares) received from the other server 302 in the first MPC group 310 in connection with the secret sharing of its two generated subkeys. In particular, the server 301 is configured to generate the combined key K_s(1 ) by processing the four secret shares sk_z(1 )_s(1 )_r(1 ) sk_z(1 )_s(1 )_r(2) sk_z(2)_s(2)_r(1 ) and sk_z(2)_s(2)_r(2) together e.g. using an XOR operation. The combined key K_s(1 ) is then used to encrypt the set of data M_s(1 ) resulting in an encrypted set of data C_s(1 ).

[0061] The server 302 is further configured to generate a combined key K_s(2) based on the two generated subkeys k_s(2)_r(1 ) k_s(2)_r(2) and values (secret shares) received from the other server 301 in the first MPC group 310 in connection with the secret sharing of its two generated subkeys. In particular, the server 302 is configured to generate the combined key K_s(2) by processing the four secret shares sk_z(2)_s(1 )_r(1 ) sk_z(2)_s(1 )_r(2) sk_z(1 )_s(2)_r(1 ) and sk_z(1 )_s(2)_r(2) together e.g. using an XOR operation. The combined key K_s(2) is then used to encrypt the set of data M_s(2) resulting in an encrypted set of data C_s(2). In this embodiment, the combined keys K_s(1 ) and K_s(2) have a length equal to the length of the subkeys. This allows the combined keys K_s(1 ) and K_s(2) to be used as a one-time pad. Consequently, two encrypted set of data C_s(1 )-(2) are generated and each server 304 305 in the second MPC group 320 is provided with access to two subkeys.

[0062] The server 304 in the second MPC group 320 is configured to use a PNG together with the received seeds q_s(1 )_r(1 ) q_s(2)_r(1 ) to obtain the subkeys k_s(1 )_r(1 ) k_s(2)_r(1 ). The server 304 is configured to share secretly the subkey k_s(1 )_r(1 ) with the other server 305 in the second MPC group 320 by generating two secret shares rk_z(1 )_s(1 )_r(1 ) rk_z(2)_s(1 )_r(1 ) keeping one secret share rk_z(1 )_s(1 )_r(1 ) and provide the other server 305 in the second MPC group 320 with the secret share rk_z(2)_s(1 )_r(1 ), wherein the subkey k_s(1 )_r(1 ) is derivable by processing the two secret shares together. Correspondingly, the server 304 is configured to share secretly the subkey k_s(2)_r(1 ) with the other server 305 in the second MPC group 320 by generating two secret shares rk_z(1 )_s(2)_r(1 ) rk_z(2)_s(2)_r(1 ) keeping one secret share rk_z(1 )_s(2)_r(1 ) and provide the other server 305 in the second MPC group 320 with the secret share rk_z(2)_s(2)_r(1 ), wherein the subkey k_s(2)_r(1 ) is derivable by processing the two secret shares together.

[0063] The server 305 in the second MPC group 320 is configured to use a PNG together with the received seeds q_s(1 )_r(2) q_s(2)_r(2) to obtain the subkeys k_s(1 )_r(2) k_s(2)_r(2). The server 305 is configured to share secretly the subkey k_s(1 )_r(2) with the other server 304 in the second MPC group 320 by generating two secret shares rk_z(1 )_s(1 )_r(2) rk_z(2)_s(1 )_r(2) keeping one secret share rk_z(1 )_s(1 )_r(2) and provide the other server 304 in the second MPC group 320 with the secret share rk_z(2)_s(1 )_r(2), wherein the subkey k_s(1 )_r(2) is derivable by processing the two secret shares together. Correspondingly, the server 305 is configured to share secretly the subkey k_s(2)_r(2) with the other server 304 in the second MPC group 320 by generating two secret shares rk_z(1 )_s(2)_r(2) rk_z(2)_s(2)_r(2) keeping one secret share rk_z(1 )_s(2)_r(2) and provide the other server 304 in the second MPC group 320 with a secret share rk_z(2)_s(2)_r(2), wherein the subkey k_s(2)_r(2) is derivable by processing the two secret shares together. The server 304 is further configured to generate a combined key K_r(1 ) based on the two subkeys k_s(1 )_r(1 ) k_s(2)_r(1 ) and values (secret shares) received from the other server 305 in the second MPC group 320 in connection with the secret sharing of its two subkeys. In particular, the server 304 is configured to generate the combined key K_r(1 ) by processing the four secret shares rk_z(1 )_s(1 )_r(1 ) rk_z(1 )_s(2)_r(1) rk_z(2)_s(1 )_r(2) and rk_z(2)_s(2)_r(2) together e.g. using an XOR operation.

[0064] Correspondingly, the server 305 is further configured to generate a combined key K_r(2) based on the two subkeys k_s(1 )_r(2) k_s(2)_r(2) and values (secret shares) received from the other server 304 in the second MPC group 320 in connection with the secret sharing of its two subkeys. In particular, the server 305 is configured to generate the combined key K_r(2) by processing the four secret shares rk_z(2)_s(1 )_r(1 ) rk_z(2)_s(2)_r(1 ) rk_z(1 )_s(1)_r(2) and rk_z(1 )_s(2)_r(2) together e.g. using an XOR operation.

[0065] The server 304 is further configured to obtain an encrypted version C of the first set of input data M, the encrypted version C of the first set of input data M being created by combining the two encrypted set of data C_s(1 )-(2). As an example, the server 301 may be configured to combine C_s(1 )-(2) creating C and transmit C to the server 304. The server 304 is further configured to decrypt the encrypted version C of the first set of input data M using the combined key K_r(1 ) resulting in a set of data M_r(1 ).

[0066] Correspondingly, the server 305 is configured to obtain an encrypted version C of the first set of input data M, the encrypted version C of the first set of input data M being created by combining the two encrypted set of data C_s(1 )-(2). As an example, the server 301 may also be configured to transmit C to the server 305. The server 305 is further configured to decrypt the encrypted version C of the first set of input data M using the combined key K_r(2) resulting in a set of data M_r(2). Consequently, the secretly shared input data M is transferred from the first MPC group 310 to the second MPC group 320. The servers 301 302 may now stop performing MPC computations and preferably delete their secret shares of the first set of input data M, i.e. delete M_s(1 ) and M_s(2). Furthermore, the secret shares are changes since M_s(1 ) will differ from M_r(1 ) and M_s(2) will differ from M_r(2). Thus, in the event an attacker has gained access to M_s(1 ) that information may now be worthless.

[0067] Although some embodiments have been described and shown in detail, the invention is not restricted to them, but may also be embodied in other ways within the scope of the subject matter defined in the following claims. In particular, it is to be understood that other embodiments may be utilised and structural and functional modifications may be made without departing from the scope of the present disclosure. In device claims enumerating several means, several of these means can be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims or described in different embodiments does not indicate that a combination of these measures cannot be used to advantage.

[0068] It should be emphasized that the term "comprises / comprising" when used in this specification is taken to specify the presence of stated features, integers, steps or components but does not preclude the presence or addition of one or more other features, integers, steps, components or groups thereof.

Claims

Claims:1 . A multi-party computation, MPC, system configured to process a first set of input data M and provide an output, the MPC system comprising a first MPC group comprising S servers, wherein S is equal to or larger than two, each server comprising one or more processing units, wherein the first set of input data M is secretly shared between the servers of the first MPC group so that each server has a set of data M_s based on the first set of input data M, and perform MPC computations on the set of data M_s, the first set of input data M being derivable by processing all set of data M_s together, wherein the MPC system further comprises a second MPC group comprising R servers wherein R is equal to or larger than two, each server comprising one or more processing units, wherein the MPC system is configured to transfer the secretly shared input data M from the servers of the first MPC group to the servers of the second MPC group by having each server of the first MPC group configured to: generate R subkeys k_s_r; provide each server in the second MPC group with access to a subkey k_s_r; share secretly the R generated subkeys k_s_r with the other servers in the first MPC group; and generate a combined key K_s based on the R generated subkeys k_s_r and values received from the other servers in the first MPC group in connection with the secret sharing of their R generated subkey k_s_r; and encrypt the set of data M_s using the combined key K_s resulting in an encrypted set of data C_s;whereby S encrypted set of data C_s are generated and each server in the second MPC group is provided with access to S subkeys k_s_r, and wherein each server in the second MPC group is configured to: share secretly the S subkeys k_s_r with the other servers in the second MPC group; generate a combined key K_r based on the S subkeys k_s_r and the values received from the other servers in the second MPC group in connection with the secret sharing of their S subkeys k_s_r; obtaining an encrypted version C of the first set of input data M, the encrypted version C of the first set of input data M being created by combining the S encrypted set of data C_s; decrypting the encrypted version C of the first set of input data M using the combined key K_r resulting in a set of data M_r, whereby R set of data M_r are generated and wherein the first set of input data M is derivable from the R set of data M_r, whereby the secretly shared input data M is transferred from the first MPC group to the second MPC group.

2. A MPC system according to claim 1 , wherein the servers in the first MPC group are configured to generate the R subkeys k_s_r by generating R seed values q_s_r and provide the R seed values q_s_r to a pseudo random number generator, PRG, outputting the R subkeys k_s_r-3. A MPC system according to claim 2, wherein the seed values q_s_r have a size being smaller than the size of the subkeys k_s_r.

4. A MPC system according to claim 3, wherein the size of the subkeys k_s_r are equal to or larger than the size of the set of data M_s.

5. A MPC system according to any one of claims 2 to 4, wherein the seed values q_s_r have a size being smaller than the size of the subkeys k_s_r.

6. A MPC system according to any one of claims 2 to 5, wherein the servers in the first MPC group are configured to provide each server in the second MPC group with access to a subkey k_s_r by transmitting the generated seed values q_s_r to the servers in the second MPC group.

7. A MPC system according to any one of claims 1 to 6, wherein the servers of the first MPC group are configured to obtain a value E and generate a master key KS by processing the combined keys K_s together and process the master key KS together with the value E to obtain a value K0_1 and the servers in the second MPC group are configured to obtain the value E and generate a master key KR by processing the combined keys K_r together and process the master key KR together with the value E to obtain a value K0_2 and wherein the MPC system is configured to compare K0_1 and K0_2 to ensure that the transfer and secret sharing of the subkey k_s_r have been done correctly.

8. A MPC system according to claim 7, wherein the MPC system maintains a blockchain for registering MPC computations and wherein the value E is obtained from the blockchain.

9. A MPC system according to claims 7 or 8, wherein the value K0_1 and the value K0_2 are written to a blockchain for comparison.

10. A MPC system according to any one of claims 7 to 9, wherein the master keys KS KR are processed together with the value E, by generating a polynomial from the master keys Ks Kr and evaluating the polynomial using the value E.11 . A MPC system according to any one of claims 2 to 5, wherein if the values K0_1 and K0_2 do not match all servers of the first MPC group are required to post the generated subkeys.

12. A MPC system according to any one of claims 1 to 11 , wherein a server in the first group of servers is further configured to receive a control message indicating that the servers in the second group of servers has received the set of data C successfully and in response thereto stop MPC computations.

13. A server for use in a MPC system, the MPC system being configured to process a first set of input data M and provide an output, the MPC system comprising a first MPC group comprising S servers including the server, wherein S is equal to or larger than two, wherein the first set of input data M is secretly shared between the servers of the first MPC group so that each server has a set of data M_s based on the first set of input data M, and perform MPC computations on the set of data M_s, the first set of input data M being derivable by processing all set of data M_s together, wherein the MPC system further comprises a second MPC group comprising R servers wherein R is equal to or larger than two, wherein the MPC system is configured to transfer the secretly shared input data M from the servers of the first MPC group to the servers of the second MPC group, and wherein the server comprises one or more processing units and is configured to: generate R subkeys k_s_r; provide each server in the second MPC group with access to a subkey k_s_r; share secretly the R generated subkeys k_s_r with the other servers in the first MPC group; and generate a combined key K_s based on the R generated subkeys k_s_r and values received from the other servers in the first MPC group in connection with the secret sharing of their R generated subkey k_s_r; and encrypt the set of data M_s using the combined key K_s resulting in an encrypted set of data C_s.

14. A server for use in a MPC system, the MPC system being configured to process a first set of input data M and provide an output, the MPC systemcomprising a first MPC group comprising S servers, wherein S is equal to or larger than two, wherein the first set of input data M is secretly shared between the servers of the first MPC group so that each server has a set of data M_s based on the first set of input data M, and perform MPC computations on the set of data M_s, the first set of input data M being derivable by processing all set of data M_s together, wherein the MPC system further comprises a second MPC group comprising R servers including the server, wherein R is equal to or larger than two, wherein the MPC system is configured to transfer the secretly shared input data M from the servers of the first MPC group to the servers of the second MPC group, and wherein the server comprises one or more processing units and is configured to: obtain access to S subkeys k_s_r; share secretly the S subkeys k_s_r with the other servers in the second MPC group; generate a combined key K_r based on the S subkeys k_s_r and the values received from the other servers in the second MPC group in connection with the secret sharing of their S subkeys k_s_r; obtaining an encrypted version C of the first set of input data M, the encrypted version C of the first set of input data M being created by combining the S encrypted set of data C_s; decrypting the encrypted version C of the first set of input data M using the combined key K_r resulting in a set of data M_r.

15. A method for transfer secretly shared input data M from servers of a first MPC group to the servers of a second MPC group of a MPC system, the first MPC group comprising S servers, wherein S is equal to or larger than two, each server comprising one or more processing units, wherein the first set of input data M is secretly shared between the servers of the first MPC group so that each server has a set of data M_s based on the first set of input data M, and perform MPC computations on the set of data M_s, the first set of input data M being derivable by processing all set of data M_s together, wherein thesecond MPC group comprises R servers wherein R is equal to or larger than two, each server comprising one or more processing units, wherein method comprises: generate, using each server of the first MPC group, R subkeys k_s_r; provide, using each server of the first MPC group, each server in the second MPC group with access to a subkey k_s_r; share secretly, using each server in the first MPC group, the R generated subkeys k_s_r with the other servers in the first MPC group r; and generate, using each server in the first MPC group, a combined key K_s based on the R generated subkeys k_s_r and values received from the other servers in the first MPC group in connection with the secret sharing of their R generated subkey k_s_r; encrypt, using each server in the first MPC group, the set of data M_s using the combined key K_s resulting in an encrypted set of data C_s; whereby S encrypted set of data C_s are generated and each server in the second MPC group is provided with access to S subkeys k_s_r, and wherein the method further comprises: share secretly, using each server in the second MPC group, the S subkeys k_s_r with the other servers in the second MPC group; generate, using each server in the second MPC group, a combined key K_r based on the S subkeys k_s_r and the values received from the other servers in the second MPC group in connection with the secret sharing of their S subkeys k_s_r; obtaining, using each server in the second MPC group, an encrypted version C of the first set of input data M, the encrypted version C of the first set of input data M being created by combining the S encrypted set of data C_s; decrypting, using each server of the second MPC group, the encrypted version C of the first set of input data M using the combined key K_r resulting in a set of data M_r,whereby R set of data M_r are generated and wherein the first set of input data M is derivable from the R set of data M_r, whereby the secretly shared input data M is transferred from the first MPC group to the second MPC group.

Images