Secure multi-party computation method and electronic device

Abstract

Provided in the present application are a secure multi-party computation method and an electronic device. The method comprises: a first device and a second device negotiating a pseudo-random number seed; first, in a trusted execution environment, the first device generating a random number on the basis of the pseudo-random number seed, and generating an auxiliary parameter on the basis of the random number, a first parameter Y, and a computation task corresponding to Y; then, receiving an encrypted data fragment x1 sent by the second device, and in the trusted execution environment, determining z1 on the basis of x1, Y, the auxiliary parameter and the computation task; and subsequently, sending z1 to the second device, and the second device determining a sum of M2 and z1 as a computation result of a computation task corresponding to X and Y. The technical solution provided in the present application can reduce the communication overheads during secure multi-party computation.

Description

Multi-party secure computation methods and electronic devices

[0001] This application claims priority to Chinese patent application No. 202411534930.5, filed with the State Intellectual Property Office of China on October 30, 2024, entitled "Multi-party secure computing method and electronic device", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of information security technology, and in particular to a multi-party secure computation method and electronic device. Background Technology

[0003] Secure multi-party computation (MPC) is a branch of cryptography that distributes computation among multiple participants. It aims to protect the data privacy of each participant when they input their own data to perform joint computation tasks, and ultimately achieve correct computation results without disclosing the data of each participant.

[0004] Current multi-party secure computations typically require multiple rounds of communication between the participating parties due to security requirements. This makes them highly susceptible to network bandwidth and fluctuations, and the computation time under wide area networks is several orders of magnitude higher than that of plaintext computations, resulting in significant communication overhead. Summary of the Invention

[0005] This application provides a multi-party secure computation method and an electronic device to reduce communication overhead during the multi-party secure computation process.

[0006] To achieve the above objectives, in a first aspect, embodiments of this application provide a multi-party secure computation method applied to a first device, the method comprising:

[0007] A pseudo-random number seed is negotiated with the second device, and the pseudo-random number seed is stored in the trusted execution environment of the first device;

[0008] In a trusted execution environment, random numbers are generated based on a pseudo-random number seed. Based on the random numbers, the first parameter Y, and the computation task corresponding to Y, corresponding auxiliary parameters are generated. The auxiliary parameters include S1, which is determined by the first device based on the random numbers using the target rules.

[0009] Receive data fragment x1 sent by the second device and store it in the trusted execution environment, where x1 = X - S2, X is the second parameter corresponding to the calculation task, and S2 is the random number generated by the second device according to the pseudo-random number seed and then determined by the target rule according to the generated random number, S1 = S2;

[0010] In a trusted execution environment, z1 is determined based on x1, Y, auxiliary parameters, and computation tasks. The sum of z0 and z1 equals the computation results of the computation tasks corresponding to X and Y. z0 = M1, and M1 is determined by the first device using the target rule based on random numbers.

[0011] Send z1 to the second device.

[0012] The multi-party secure computation method provided in this application embodiment involves the first device storing a pseudo-random number seed negotiated with the second device in a trusted execution environment. Then, in the trusted execution environment, a random number is generated based on the pseudo-random number seed, and corresponding auxiliary parameters are generated according to the random number, the first parameter Y, and the computation task corresponding to Y. Next, the first device receives a data fragment x1 sent by the second device (x1 is the result of the second device encrypting the second computation parameter X, x1 = X - S2), stores it in the trusted execution environment, and calculates z1 in the trusted execution environment according to x1, Y, auxiliary parameters, and computation task, and sends z1 to the second device.

[0013] Since the sum of z0 and z1 equals the calculation result of the corresponding computation tasks X and Y, and z0 = M1, where M1 is determined by the first device using a target rule based on random numbers (the second device can similarly determine M2 using the same target rule, so M1 = M2), the second device can obtain the calculation result of the corresponding computation tasks X and Y by adding M2 to z1. Specifically, during the process of the first device receiving x1, calculating z1, and returning z1 to the second device, the first and second devices only communicate when sending computation parameters (i.e., receiving x1) and returning computation results (i.e., returning z1). No communication occurs during the online computation phase (i.e., calculating z1). Therefore, this scheme can reduce the communication overhead in the multi-party secure computation process.

[0014] In one possible implementation of the first aspect, when the calculation task is X multiplied by Y, and Y is input in plaintext, the auxiliary parameters include: a first auxiliary parameter E and a second auxiliary parameter D, wherein E = S1 + R1, D = R1 * Y + M1, R1 is determined by the first device according to the target rule based on the random number; z1 = (E + x1) * YD.

[0015] In one possible implementation of the first aspect, when the computation task is X multiplied by Y, and Y is input via ciphertext, the auxiliary parameters include: a third auxiliary parameter x0, a fourth auxiliary parameter y0, and a fifth auxiliary parameter y1, wherein x0 = S1, y0 = S1, y1 = Y - S1; z1 = x0*y0 + x0*y1 + x1*y0 + x1*y1 - M1.

[0016] In one possible implementation of the first aspect, when the computation task is to compare whether X is greater than Y, and Y is input in plaintext, the auxiliary parameters include: a sixth auxiliary parameter F, where F = Y - S1;

[0017] z1 = b - M1, where if F < x1, then b = 1, and if F ≥ x1, then b = 0.

[0018] In one possible implementation of the first aspect, when the computation task is to compare whether X is greater than Y, and Y is input in ciphertext, the auxiliary parameters include: a third auxiliary parameter x0, a fourth auxiliary parameter y0, and a fifth auxiliary parameter y1, wherein x0 = S1, y0 = S1, and y1 = Y - S1.

[0019] z1 = b - M1, where if x0 - y0 > y1 - x1, then b = 1, and if x0 - y0 ≤ y1 - x1, then b = 0.

[0020] Secondly, embodiments of this application provide a multi-party secure computing device applied to a first device, the device comprising: a processing module, a receiving module, and a sending module;

[0021] The processing module is used to: negotiate a pseudo-random number seed with the second device, and the pseudo-random number seed is stored in the trusted execution environment of the first device;

[0022] In a trusted execution environment, random numbers are generated based on a pseudo-random number seed. Based on the random numbers, the first parameter Y, and the computation task corresponding to Y, corresponding auxiliary parameters are generated. The auxiliary parameters include S1, which is determined by the first device based on the random numbers using the target rules.

[0023] The receiving module is used to: receive data fragment x1 sent by the second device and store it in the trusted execution environment, where x1 = X - S2, X is the second parameter corresponding to the calculation task, and S2 is determined by the second device according to the target rule after generating random numbers based on the pseudo-random number seed, and S1 = S2.

[0024] The processing module is also used to: in a trusted execution environment, determine z1 based on x1, Y, auxiliary parameters and computation tasks, wherein the sum of z0 and z1 is equal to the computation results of the computation tasks corresponding to X and Y, z0 = M1, and M1 is determined by the first device based on random numbers using target rules;

[0025] The sending module is used to send z1 to the second device.

[0026] In one possible implementation of the second aspect, when the calculation task is X multiplied by Y, and Y is input in plaintext, the auxiliary parameters include: a first auxiliary parameter E and a second auxiliary parameter D, wherein E = S1 + R1, D = R1 * Y + M1, R1 is determined by the first device according to the target rule based on the random number; z1 = (E + x1) * YD.

[0027] In one possible implementation of the second aspect, when the computation task is X multiplied by Y, and Y is input via ciphertext, the auxiliary parameters include: a third auxiliary parameter x0, a fourth auxiliary parameter y0, and a fifth auxiliary parameter y1, wherein x0 = S1, y0 = S1, y1 = Y - S1; z1 = x0*y0 + x0*y1 + x1*y0 + x1*y1 - M1.

[0028] In one possible implementation of the second aspect, when the calculation task is to compare whether X is greater than Y, and Y is input in plaintext, the auxiliary parameters include: a sixth auxiliary parameter F, where F = Y - S1;

[0029] z1 = b - M1, where if F < x1, then b = 1, and if F ≥ x1, then b = 0.

[0030] In one possible implementation of the second aspect, when the calculation task is to compare whether X is greater than Y, and Y is input through ciphertext, the auxiliary parameters include: a third auxiliary parameter x0, a fourth auxiliary parameter y0, and a fifth auxiliary parameter y1, wherein x0 = S1, y0 = S1, and y1 = Y - S1.

[0031] z1 = b - M1, where if x0 - y0 > y1 - x1, then b = 1, and if x0 - y0 ≤ y1 - x1, then b = 0.

[0032] Thirdly, embodiments of this application provide a multi-party secure computation method applied to a second device, the method comprising:

[0033] Negotiate a pseudo-random number seed with the first device, and generate random numbers based on the pseudo-random number seed;

[0034] Send data fragment x1 to the first device, where x1 = X - S2, and S2 is determined by the second device based on a random number using a target rule;

[0035] Receive z1 sent by the first device, wherein z1 is determined by the first device based on x1, the first parameter Y, the auxiliary parameter and the calculation task of X and Y, and the auxiliary parameter is generated by the first device in a trusted execution environment based on the random number generated by the pseudo-random number seed, Y and the calculation task;

[0036] The sum of M2 and z1 is determined as the calculation result of the calculation task corresponding to X and Y, where M2 = M1, M2 is determined by the second device according to the target rule based on the random number, and M1 is determined by the first device according to the target rule after generating a random number based on the pseudo-random number seed.

[0037] Fourthly, embodiments of this application provide a multi-party secure computing device applied to a second device, the device comprising: a processing module, a sending module, and a receiving module;

[0038] The processing module is used to: negotiate a pseudo-random number seed with the first device and generate random numbers based on the pseudo-random number seed;

[0039] The sending module is used to: send data fragment x1 to the first device, where x1 = X - S2, and S2 is determined by the second device according to the target rule based on the random number;

[0040] The receiving module is used to: receive z1 sent by the first device, wherein z1 is determined by the first device based on x1, the first parameter Y, the auxiliary parameter and the calculation task of X and Y, and the auxiliary parameter is generated by the first device in a trusted execution environment based on a random number generated by a pseudo-random number seed, Y and the calculation task;

[0041] The processing module is also used to: determine the sum of M2 and z1 as the calculation result of the calculation task corresponding to X and Y, wherein M2 = M1, M2 is determined by the second device according to the target rule based on the random number, and M1 is determined by the first device according to the target rule after generating a random number based on the pseudo-random number seed.

[0042] Fifthly, embodiments of this application provide an electronic device, including: a memory and a processor, wherein the memory is used to store a computer program; and the processor is used to execute the method described in any of the embodiments of the first or third aspect above when the computer program is invoked.

[0043] In a sixth aspect, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in any of the embodiments of the first or third aspect described above.

[0044] In a seventh aspect, embodiments of this application provide a computer program product that, when run on an electronic device, causes the electronic device to perform the method described in any of the embodiments of the first or third aspect described above.

[0045] Eighthly, embodiments of this application provide a chip system including a processor coupled to a memory. The processor executes a computer program stored in the memory to implement the method described in any of the embodiments of the first or third aspects. The chip system may be a single chip or a chip module composed of multiple chips.

[0046] It is understood that the beneficial effects of aspects two through eight above can be found in the relevant descriptions in aspect one above, and will not be repeated here. Attached Figure Description

[0047] Figure 1 is a schematic diagram illustrating the application of the multi-party secure computation method provided in this application embodiment in a model reasoning scenario;

[0048] Figure 2 is a schematic diagram illustrating the application of the multi-party secure computation method provided in this application embodiment in a database joint query scenario;

[0049] Figure 3 is a flowchart illustrating a multi-party secure computation method provided in an embodiment of this application;

[0050] Figure 4 is a schematic diagram of a multiplication calculation process where Y is a plaintext input, provided in an embodiment of this application;

[0051] Figure 5 is a schematic diagram of a multiplication calculation process where Y is a ciphertext input, provided in an embodiment of this application;

[0052] Figure 6 is a schematic diagram of a comparison calculation process where Y is plaintext input, provided in an embodiment of this application;

[0053] Figure 7 is a schematic diagram of a comparison calculation process where Y is a ciphertext input provided in an embodiment of this application;

[0054] Figure 8 is a schematic diagram of a multi-party secure computing device provided in an embodiment of this application;

[0055] Figure 9 is a schematic diagram of another multi-party secure computing device provided in an embodiment of this application;

[0056] Figure 10 is a schematic diagram of the structure of the electronic device provided in the embodiment of this application. Detailed Implementation

[0057] The embodiments of this application are described below with reference to the accompanying drawings. The terminology used in the implementation section of this application is only for explaining specific embodiments and is not intended to limit the application. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0058] Secure multi-party computation is a class of cryptographic protocols that enhance privacy protection. It aims to protect the data privacy of each participant when multiple parties input their respective data to perform a joint computation task, ultimately achieving correct computation results without disclosing any party's data. Examples include Cheetah and ABY3.

[0059] Due to security requirements, multi-party secure computation typically requires multiple rounds of communication among the participating parties, making it highly susceptible to network bandwidth and fluctuations. In wide area networks, the computation time is several orders of magnitude longer than that of plaintext computation, resulting in significant communication overhead.

[0060] To address this, this application provides a multi-party secure computation method. The method first involves a first device and a second device negotiating a pseudo-random number seed. Then, the first and second devices generate the same random number based on the pseudo-random number seed, with the first device storing the pseudo-random number seed in a trusted execution environment (TEE). Next, within the TEE, the first device generates corresponding auxiliary parameters based on the random number, a first parameter Y, and the computation task corresponding to Y. Then, the first device receives a data fragment x1 (x1 being the result of the second device encrypting the second computation parameter X) sent by the second device, stores it in the TEE, and calculates z1 within the TEE based on x1, Y, the auxiliary parameters, and the computation task, and sends z1 to the second device.

[0061] Since the sum of z0 and z1 equals the calculation result of the corresponding computation tasks X and Y, and z0 = M1, where M1 is determined by the first device using a target rule based on random numbers (the second device can similarly determine M2 using the same target rule, so M1 = M2), the second device can obtain the calculation result of the corresponding computation tasks X and Y by adding M2 to z1. Specifically, during the process of the first device receiving x1, calculating z1, and returning z1 to the second device, the first and second devices only communicate when sending computation parameters (i.e., receiving x1) and returning computation results (i.e., returning z1). No communication occurs during the online computation phase (i.e., calculating z1). Therefore, this scheme can reduce the communication overhead in the multi-party secure computation process.

[0062] A Trusted Execution Environment (TEE) is a hardware-supported isolated area in a computer that can securely execute code and process data without interference from the operating system or other applications.

[0063] The multi-party secure computation method provided in this application can be applied to machine learning inference scenarios with fixed model parameters, such as object detection, face recognition, biometric verification, and anomaly detection.

[0064] For example, as shown in Figure 1, in a model inference application involving sensitive user information, the user needs to input sensitive data. The user sends encrypted sensitive data to the model parameter provider, and the model parameter provider uses trusted hardware to quickly calculate and return the inference result without decrypting the sensitive data.

[0065] Trusted hardware refers to a hardware environment isolated from the external operating system. The CPU can isolate a separate area to execute programs within the trusted hardware. While the trusted hardware still allows access to all CPU and memory functions, it remains unaffected by other programs within the operating system. This prevents external programs from obtaining sensitive information and data within the trusted hardware through the operating system. Examples include Intel Software Guard Extensions (SGX), TrustZone, Trusted Computing Technology (TCT), and China Secure Virtualization (CSV).

[0066] The multi-party secure computation method provided in this application can also be applied to joint query services that emphasize data privacy protection, such as banking, medical, and government systems.

[0067] For example, as shown in Figure 2, in a database federated query scenario, neither the initiator nor the participants of the query want to disclose additional information to other parties. By submitting a federated query, database A, as the initiator, sends encrypted data to database B. Database B uses trusted hardware to perform rapid calculations and returns the query results to database A.

[0068] The multi-party secure computation method provided in this application can be applied to electronic devices, including but not limited to personal computers (PCs), smartphones, netbooks, tablets, and handheld computers.

[0069] Figure 3 is a flowchart illustrating a multi-party secure computation method provided in an embodiment of this application. As shown in Figure 3, the method may include three processes: a preprocessing stage, an online computation stage, and a return of computation results.

[0070] The preprocessing stage may include the following steps:

[0071] S110, The first device and the second device negotiate the pseudo-random number seed.

[0072] Specifically, the first device and the second device can negotiate a pseudo-random number seed according to a standard key exchange protocol. After negotiating the pseudo-random number seed, the first device can store the pseudo-random number seed in a trusted execution environment, ensuring that the pseudo-random number seed is always in the trusted execution environment. The second device can store the pseudo-random number seed in the trusted execution environment or in a general environment. The embodiments of this application will subsequently use the example of the second device storing the pseudo-random number seed in a trusted execution environment for illustrative purposes.

[0073] S120. In a trusted execution environment, the first device generates a random number based on a pseudo-random number seed, and generates corresponding auxiliary parameters based on the random number, the first parameter Y, and the computational task corresponding to Y.

[0074] Specifically, the first device can first generate random numbers based on a pseudo-random number seed in a trusted execution environment and store them in the trusted execution environment. The generated random numbers can be significantly larger than Y. When Y is a signed 32-bit integer, the random numbers can be 64-bit unsigned integers, and the range of values ​​for the random numbers can be [2]. 32 ,2 63 ).

[0075] Then, in a trusted execution environment, the first device can generate corresponding auxiliary parameters based on the random number, the first parameter Y, and the computational task corresponding to Y. Different computational tasks will result in different auxiliary parameters.

[0076] The auxiliary parameter may include S1, which can be determined by the first device based on the random number using the target rule. For example, the first device may use the first digit, the last digit, etc. of the random number as S1.

[0077] S130, The second device generates random numbers based on a pseudo-random number seed.

[0078] The random number generated by the second device can be significantly larger than X. When X is a signed 32-bit integer, the random number can be a 64-bit unsigned integer, and the range of the random number can be [2]. 32 ,2 63 The first and second devices generate random numbers in the same way based on the pseudo-random number seed, and the generated random numbers are also the same.

[0079] S140, The second device encrypts the second parameter X and generates a data fragment x1.

[0080] Specifically, the second device can let x1 = X - S2, where X is the second parameter corresponding to the calculation task, and S2 is generated by the second device based on the generated random number using the same target rule as when the first device generated S1, and S1 = S2.

[0081] S150, the second device sends data fragment x1 to the first device.

[0082] The second device can send data fragment x1 to the first device through an encrypted channel.

[0083] S160, the first device receives data fragment x1 sent by the second device and stores it in a trusted execution environment.

[0084] The online computation phase may include the following steps:

[0085] S170. In a trusted execution environment, the first device calculates z1 based on x1, Y, auxiliary parameters, and the computation task.

[0086] Specifically, the first device can perform one or more rounds of calculation in a trusted execution environment according to the corresponding calculation task, based on x1, Y, auxiliary parameters, and the calculation task, to obtain z1. The sum of z0 and z1 equals the calculation result of the corresponding calculation task for X and Y, where z0 = M1, and M1 is determined by the first device based on the random number using a target rule. For example, the second device can use the second digit, the second-to-last digit, etc., of the random number as M1.

[0087] Returning the calculation results may include the following steps:

[0088] S180, the first device sends z1 to the second device.

[0089] The first device can send z1 to the second device through an encrypted channel.

[0090] S190, the second device receives z1 sent by the first device and determines the sum of M2 and z1 as the calculation result of the corresponding calculation tasks of X and Y.

[0091] M2 is generated by the second device based on random numbers, using the same target rules as when the first device generated M1, and M1 = M2. Since M1 = M2, therefore, M2 + z1 = M1 + z1 = z0 + z1, that is, the sum of M2 and z1 equals the calculation result of the corresponding calculation tasks of X and Y. In other words, the second device can obtain the calculation result of the corresponding calculation tasks of X and Y by adding M2 and z1.

[0092] During the process of the first device receiving x1, calculating z1, and returning z1 to the second device, the first device and the second device only communicate when sending calculation parameters (i.e., receiving x1) and returning calculation results (i.e., returning z1). There is no communication during the online calculation phase (i.e. calculating z1). Therefore, this scheme can reduce the communication overhead in the multi-party secure calculation process.

[0093] The following example of a specific computational task illustrates the multi-party secure computation method provided in this application.

[0094] Figure 4 is a schematic diagram of a multiplication calculation process where Y is a plaintext input according to an embodiment of this application. As shown in Figure 4, the process may include the following steps:

[0095] 1.1 The first and second devices negotiate the pseudo-random number seed.

[0096] The first device stores the pseudo-random number seed in a trusted execution environment, and the second device stores the pseudo-random number seed in a trusted execution environment.

[0097] 1.2 The first device generates random numbers based on the pseudo-random number seed, generates S1, R1, and M1 based on the random numbers, and generates the corresponding first auxiliary parameter E and second auxiliary parameter D based on the random numbers, the first parameter Y, and the multiplication calculation task X*Y, where E = S1 + R1 and D = R1*Y + M1.

[0098] Where S1 can be the first digit of the random number, R1 can be the second digit of the random number, and M1 can be the third digit of the random number.

[0099] 1.3 The second device generates random numbers based on the pseudo-random number seed, and generates S2, R2, and M2 based on the random numbers. Wherein, S1 = S2, R1 = R2, and M1 = M2.

[0100] 1.4 The second device encrypts the second parameter X to obtain data fragment x1, where x1 = X - S2, and X is the second parameter corresponding to the multiplication calculation task.

[0101] 1.5 The second device sends data fragment x1 to the first device.

[0102] 1.6 The first device receives the data fragment x1 sent by the second device, and in the trusted execution environment, calculates z1 based on x1, Y, E, D and the multiplication calculation task.

[0103] Where z1=(E+x1)*YD=(S1+R1+X-S2)*Y-(R1*Y+M1)=(R1+X)*Y-(R1*Y+M1)=X*Y-M1. Taking M1 as the first slice z0 of the calculation result of X*Y, and z1 as the second slice of the calculation result of X*Y, we have z0+z1=M1+X*Y-M1=X*Y.

[0104] 1.7 The first device returns z1 to the second device.

[0105] 1.8 The second device determines the sum of M2 and z1 as the calculation result of X*Y, and outputs the sum of M2 and z1.

[0106] Since M1 = M2, therefore, M2 + z1 = M1 + Z1 = z0 + z1 = X * Y. The second device adds M2 and z1 to obtain the calculation result of X * Y.

[0107] Figure 5 is a schematic diagram of a multiplication calculation process where Y is a encrypted input, according to an embodiment of this application. As shown in Figure 5, the process may include the following steps:

[0108] 2.1 The first and second devices negotiate the pseudo-random number seed.

[0109] 2.2 The first device generates random numbers based on the pseudo-random number seed, generates S1 and M1 based on the random numbers, and generates the corresponding third auxiliary parameter x0, fourth auxiliary parameter y0 and fifth auxiliary parameter y1 based on the random numbers, the first parameter Y and the multiplication calculation task X*Y, where x0 = S1, y0 = S1, and y1 = Y - S1.

[0110] 2.3 The second device generates random numbers based on the pseudo-random number seed, and generates S2 and M2 based on the random numbers. Wherein, S1 = S2, M1 = M2.

[0111] 2.4 The second device encrypts the second parameter X to obtain data fragment x1, where x1 = X - S2, and X is the second parameter corresponding to the multiplication calculation task.

[0112] 2.5 The second device sends data fragment x1 to the first device.

[0113] 2.6 The first device receives the data fragment x1 sent by the second device, and in the trusted execution environment, calculates z1 based on x0, x1, y0, y1 and the multiplication calculation task.

[0114] Where z1=x0*y0+x0*y1+x1*y0+x1*y1-M1=S1*S1+S1*(Y-S1)+(X-S2)*S1+(X-S2)*(Y-S1)=X*Y-M1. Taking M1 as the first slice z0 of the calculation result of X*Y, and z1 as the second slice of the calculation result of X*Y, we have z0+z1=M1+X*Y-M1=X*Y.

[0115] 2.7 The first device returns z1 to the second device.

[0116] 2.8 The second device determines the sum of M2 and z1 as the calculation result of X*Y, and outputs the sum of M2 and z1.

[0117] Since M1 = M2, therefore, M2 + z1 = M1 + Z1 = z0 + z1 = X * Y. The second device adds M2 and z1 to obtain the calculation result of X * Y.

[0118] Figure 6 is a schematic diagram of a comparison calculation process where Y is a plaintext input according to an embodiment of this application. As shown in Figure 6, the process may include the following steps:

[0119] 3.1 The first and second devices negotiate the pseudo-random number seed.

[0120] 3.2 The first device generates random numbers based on the pseudo-random number seed, generates S1 and M1 based on the random numbers, and generates the corresponding sixth auxiliary parameter F based on the random numbers, the first parameter Y and the calculation task (comparing whether X is greater than Y), where F = Y - S1.

[0121] 3.3 The second device generates random numbers based on the pseudo-random number seed, and generates S2 and M2 based on the random numbers. Wherein, S1 = S2, M1 = M2.

[0122] 3.4 The second device encrypts the second parameter X to obtain data fragment x1, where x1 = X - S2, and X is the second parameter corresponding to the comparison calculation.

[0123] 3.5 The second device sends data fragment x1 to the first device.

[0124] 3.6 The first device receives the data fragment x1 sent by the second device, and calculates z1 in the trusted execution environment based on x1, Y, F and comparison calculation.

[0125] Where z1 = b - M1, if F < x1, then b = 1, if F ≥ x1, then b = 0. That is, if X > Y, then b = 1, if X ≤ Y, then b = 0.

[0126] Let M1 be the first slice z0 of the comparison calculation result, and z1 be the second slice z0 of the comparison calculation result, then z0 + z1 = b.

[0127] 3.7 The first device returns z1 to the second device.

[0128] 3.8 The second device determines the sum of M2 and z1 as the result of the comparison calculation and outputs the sum of M2 and z1.

[0129] Since M1 = M2, therefore, M2 + z1 = M1 + Z1 = z0 + z1 = b. The second device adds M2 and z1 to obtain the result of the comparison calculation. That is, if M2 + z1 = 1, then X > Y; if M2 + z1 = 0, then X ≤ Y.

[0130] Figure 7 is a schematic diagram of a comparison calculation process where Y is a encrypted input according to an embodiment of this application. As shown in Figure 7, the process may include the following steps:

[0131] 4.1 The first and second devices negotiate the pseudo-random number seed.

[0132] 4.2 The first device generates random numbers based on the pseudo-random number seed, generates S1 and M1 based on the random numbers, and generates the corresponding third auxiliary parameter x0, fourth auxiliary parameter y0 and fifth auxiliary parameter y1 based on the random numbers, the first parameter Y and the calculation task (comparing whether X is greater than Y), where x0 = S1, y0 = S1, and y1 = Y - S1.

[0133] 4.3 The second device generates random numbers based on the pseudo-random number seed, and generates S2 and M2 based on the random numbers. Wherein, S1 = S2, M1 = M2.

[0134] 4.4 The second device encrypts the second parameter X to obtain data fragment x1, where x1 = X - S2, and X is the second parameter corresponding to the comparison calculation.

[0135] 4.5 The second device sends data fragment x1 to the first device.

[0136] 4.6 The first device receives the data fragment x1 sent by the second device, and calculates z1 in the trusted execution environment based on x0, x1, y0, y1 and comparison calculation.

[0137] Where z1 = b - M1, if x0 - y0 > y1 - x1, then b = 1; if x0 - y0 ≤ y1 - x1, then b = 0. That is, if X > Y, then b = 1; if X ≤ Y, then b = 0.

[0138] Let M1 be the first slice z0 of the comparison calculation result, and z1 be the second slice z0 of the comparison calculation result, then z0 + z1 = b.

[0139] 4.7 The first device returns z1 to the second device.

[0140] 4.8 The second device determines the sum of M2 and z1 as the result of the comparison calculation and outputs the sum of M2 and z1.

[0141] Since M1 = M2, therefore, M2 + z1 = M1 + Z1 = z0 + z1 = b. The second device adds M2 and z1 to obtain the result of the comparison calculation. That is, if M2 + z1 = 1, then X > Y; if M2 + z1 = 0, then X ≤ Y.

[0142] The multi-party secure computation method provided in this application embodiment involves the first device storing a pseudo-random number seed negotiated with the second device in a trusted execution environment. Then, in the trusted execution environment, a random number is generated based on the pseudo-random number seed, and corresponding auxiliary parameters are generated according to the random number, the first parameter Y, and the computation task corresponding to Y. Next, the first device receives a data fragment x1 (x1 is the result of the second device encrypting the second computation parameter X, x1 = X - S2) sent by the second device, stores it in the trusted execution environment, and calculates z1 in the trusted execution environment according to x1, Y, auxiliary parameters, and computation task, and sends z1 to the second device.

[0143] Since the sum of z0 and z1 equals the calculation result of the corresponding computation tasks X and Y, and z0 = M1, where M1 is determined by the first device using a target rule based on random numbers (the second device can similarly determine M2 using the same target rule, so M1 = M2), the second device can obtain the calculation result of the corresponding computation tasks X and Y by adding M2 to z1. Specifically, during the process of the first device receiving x1, calculating z1, and returning z1 to the second device, the first and second devices only communicate when sending computation parameters (i.e., receiving x1) and returning computation results (i.e., returning z1). No communication occurs during the online computation phase (i.e., calculating z1). Therefore, this scheme can reduce the communication overhead in the multi-party secure computation process.

[0144] Those skilled in the art will understand that the above embodiments are exemplary and not intended to limit this application. Where possible, the execution order of one or more of the above steps can be adjusted to obtain one or more other embodiments. For example, in some embodiments, step S130 can be executed before step S120; in some embodiments, steps S130 and S140 can be executed before step S120; in some embodiments, steps S130 and S120 can be executed simultaneously; and in some embodiments, steps S140 and S120 can be executed simultaneously. Those skilled in the art can arbitrarily select and combine the above steps as needed, and all combinations that do not depart from the essence of the present application fall within the protection scope of this application.

[0145] Based on the same concept, as an implementation of the method executed by the first electronic device in the above embodiments, this application provides a multi-party secure computing device applied to the first device. This device embodiment corresponds to the aforementioned method embodiment executed by the first electronic device. For ease of reading, this device embodiment will not describe the details of the aforementioned method embodiment executed by the first electronic device one by one, but it should be clear that the device in this embodiment can correspondingly implement all the contents of the aforementioned method embodiment executed by the first electronic device.

[0146] Figure 8 is a schematic diagram of a multi-party secure computing device provided in an embodiment of this application. As shown in Figure 8, the device provided in this embodiment may include: a processing module 210, a receiving module 220, and a sending module 230.

[0147] Processing module 210 is used to: negotiate a pseudo-random number seed with the second device, the pseudo-random number seed being stored in the trusted execution environment of the first device;

[0148] In a trusted execution environment, random numbers are generated based on a pseudo-random number seed. Based on the random numbers, the first parameter Y, and the computation task corresponding to Y, corresponding auxiliary parameters are generated. The auxiliary parameters include S1, which is determined by the first device based on the random numbers using the target rules.

[0149] The receiving module 220 is used to: receive data fragment x1 sent by the second device and store it in the trusted execution environment, where x1 = X - S2, X is the second parameter corresponding to the calculation task, and S2 is determined by the second device according to the target rule after generating random numbers based on the pseudo-random number seed, and S1 = S2.

[0150] The processing module 210 is also used to: in a trusted execution environment, determine z1 based on x1, Y, auxiliary parameters and computation tasks, wherein the sum of z0 and z1 is equal to the computation results of the computation tasks corresponding to X and Y, z0 = M1, and M1 is determined by the first device based on random numbers using target rules;

[0151] The sending module 230 is used to send z1 to the second device.

[0152] As an optional implementation, when the calculation task is X multiplied by Y, and Y is input in plaintext, the auxiliary parameters include: a first auxiliary parameter E and a second auxiliary parameter D, where E = S1 + R1, D = R1 * Y + M1, R1 is determined by the first device according to the target rule based on the random number; z1 = (E + x1) * YD.

[0153] As an optional implementation, when the calculation task is X multiplied by Y, and Y is input in ciphertext, the auxiliary parameters include: a third auxiliary parameter x0, a fourth auxiliary parameter y0, and a fifth auxiliary parameter y1, where x0 = S1, y0 = S1, y1 = Y - S1; z1 = x0*y0 + x0*y1 + x1*y0 + x1*y1 - M1.

[0154] As an optional implementation, when the calculation task is to compare whether X is greater than Y, and Y is input in plaintext, the auxiliary parameters include: a sixth auxiliary parameter F, where F = Y - S1;

[0155] z1 = b - M1, where if F < x1, then b = 1, and if F ≥ x1, then b = 0.

[0156] As an optional implementation, when the calculation task is to compare whether X is greater than Y, and Y is input through ciphertext, the auxiliary parameters include: a third auxiliary parameter x0, a fourth auxiliary parameter y0, and a fifth auxiliary parameter y1, where x0 = S1, y0 = S1, and y1 = Y - S1;

[0157] z1 = b - M1, where if x0 - y0 > y1 - x1, then b = 1, and if x0 - y0 ≤ y1 - x1, then b = 0.

[0158] The device provided in this embodiment can execute the method executed by the first electronic device in the above embodiment. Its implementation principle and technical effect are similar, and will not be described again here.

[0159] Based on the same concept, as an implementation of the method executed by the second electronic device in the above embodiments, this application provides a multi-party secure computing device applied to the second electronic device. This device embodiment corresponds to the aforementioned method embodiment executed by the second electronic device. For ease of reading, this device embodiment will not describe the details of the aforementioned method embodiment executed by the second electronic device one by one, but it should be clear that the device in this embodiment can correspondingly implement all the contents of the aforementioned method embodiment executed by the second electronic device.

[0160] Figure 9 is a schematic diagram of another multi-party secure computing device provided in an embodiment of this application. As shown in Figure 9, the device provided in this embodiment may include: a processing module 310, a sending module 320, and a receiving module 330.

[0161] Processing module 310 is used to: negotiate a pseudo-random number seed with the first device and generate random numbers based on the pseudo-random number seed;

[0162] The sending module 320 is used to: send data fragment x1 to the first device, where x1 = X - S2, and S2 is determined by the second device according to the target rule based on the random number;

[0163] The receiving module 330 is used to: receive z1 sent by the first device, wherein z1 is determined by the first device based on x1, the first parameter Y, the auxiliary parameter and the calculation task of X and Y, and the auxiliary parameter is generated by the first device in a trusted execution environment based on a random number generated by a pseudo-random number seed, Y and the calculation task;

[0164] The processing module 310 is further configured to: determine the sum of M2 and z1 as the calculation result of the calculation task corresponding to X and Y, wherein M2 = M1, M2 is determined by the second device according to the target rule based on the random number, and M1 is determined by the first device according to the target rule after generating a random number based on the pseudo-random number seed.

[0165] The device provided in this embodiment can execute the method executed by the second electronic device in the above embodiment. Its implementation principle and technical effect are similar, and will not be described again here.

[0166] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0167] Based on the same concept, this application also provides an electronic device. FIG10 is a schematic diagram of the structure of the electronic device provided in this application embodiment. As shown in FIG10, the electronic device provided in this application embodiment may include: a memory 410 and a processor 420. The memory 410 is used to store a computer program; the processor 420 is used to implement the method described in the above method embodiment when the computer program is called.

[0168] The electronic device provided in this embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, so they will not be described again here.

[0169] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the methods described in the above-described method embodiments.

[0170] This application also provides a computer program product that, when run on an electronic device, causes the electronic device to implement the method described in the above-described method embodiments.

[0171] This application also provides a chip system including a processor coupled to a memory. The processor executes a computer program stored in the memory to implement the method described in the above-described method embodiments. The chip system may be a single chip or a chip module composed of multiple chips.

[0172] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, or magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0173] Those skilled in the art will understand that implementing all or part of the processes in the above embodiments can be accomplished by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium can include various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

[0174] The naming or numbering of steps in this application does not imply that the steps in the method flow must be executed in the time / logical order indicated by the naming or numbering. The execution order of the named or numbered process steps can be changed according to the technical purpose to be achieved, as long as the same or similar technical effect can be achieved.

[0175] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0176] In the embodiments provided in this application, it should be understood that the disclosed apparatus / devices and methods can be implemented in other ways. For example, the apparatus / device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0177] It should be understood that in the description of this application and the appended claims, the terms "comprising," "including," "having," and any variations thereof are intended to cover a non-exclusive inclusion and mean "including but not limited to," unless otherwise specifically emphasized. For example, a process, method, system, product, or apparatus that includes a series of steps or modules is not necessarily limited to those steps or modules that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to such process, method, product, or apparatus.

[0178] In the description of this application, unless otherwise stated, " / " indicates that the objects before and after are in an "or" relationship. For example, A / B can mean A or B. "And / or" in this application is used to describe the relationship between the related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural.

[0179] Furthermore, in the description of this application, unless otherwise stated, "multiple" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0180] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0181] Furthermore, in the description of this application and the appended claims, the terms "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence, nor should they be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein; features defined as "first" or "second" may explicitly or implicitly include at least one of those features.

[0182] In the embodiments described in this application specification, the words "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplarily" or "for example" in the embodiments of this application specification should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of the words "exemplarily" or "for example" is intended to present the relevant concepts in a specific manner.

[0183] References to "one embodiment" or "some embodiments" in this specification mean that one or more embodiments of this specification include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in still other embodiments" appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized.

[0184] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A multi-party secure computation method, applied to a first device, characterized in that, include: Negotiate a pseudo-random number seed with the second device, and the pseudo-random number seed is stored in the trusted execution environment of the first device; In the trusted execution environment, random numbers are generated based on the pseudo-random number seed, and corresponding auxiliary parameters are generated according to the random numbers, the first parameter Y, and the computational task corresponding to Y; the auxiliary parameters include S1, which is determined by the first device based on the random numbers using target rules; The system receives data fragment x1 sent by the second device and stores it in the trusted execution environment, where x1 = X - S2, X is the second parameter corresponding to the computing task, and S2 is the random number generated by the second device according to the pseudo-random number seed and then determined by the target rule based on the generated random number, S1 = S2. In the trusted execution environment, z1 is determined based on x1, Y, the auxiliary parameters, and the computation task, wherein the sum of z0 and z1 equals the computation result of the computation task corresponding to X and Y, and z0 = M1, where M1 is determined by the first device using the target rule based on the random number. Send z1 to the second device.

2. The method according to claim 1, characterized in that, When the calculation task is X multiplied by Y, and Y is input in plaintext, the auxiliary parameters include: a first auxiliary parameter E and a second auxiliary parameter D, where E = S1 + R1, D = R1 * Y + M1, R1 is determined by the first device according to the target rule based on the random number; z1 = (E + x1) * YD.

3. The method according to claim 1, characterized in that, When the calculation task is X multiplied by Y, and Y is input in ciphertext, the auxiliary parameters include: a third auxiliary parameter x0, a fourth auxiliary parameter y0, and a fifth auxiliary parameter y1, where x0 = S1, y0 = S1, y1 = Y - S1; z1 = x0*y0 + x0*y1 + x1*y0 + x1*y1 - M1.

4. The method according to claim 1, characterized in that, When the calculation task is to compare whether X is greater than Y, and Y is input in plaintext, the auxiliary parameters include: a sixth auxiliary parameter F, where F = Y - S1; z1 = b - M1, where if F < x1, then b = 1, and if F ≥ x1, then b = 0.

5. The method according to claim 1, characterized in that, When the calculation task is to compare whether X is greater than Y, and Y is input in ciphertext, the auxiliary parameters include: a third auxiliary parameter x0, a fourth auxiliary parameter y0, and a fifth auxiliary parameter y1, wherein x0 = S1, y0 = S1, and y1 = Y - S1; z1 = b - M1, where if x0 - y0 > y1 - x1, then b = 1, and if x0 - y0 ≤ y1 - x1, then b = 0.

6. A multi-party secure computation method, applied to a second device, characterized in that, include: Negotiate a pseudo-random number seed with the first device, and generate random numbers based on the pseudo-random number seed; Send data fragment x1 to the first device, where x1 = X - S2, and S2 is determined by the second device according to the target rule based on the random number; Receive z1 sent by the first device, wherein z1 is determined by the first device based on x1, the first parameter Y, the auxiliary parameter and the calculation task of X and Y, and the auxiliary parameter is generated by the first device in a trusted execution environment based on the random number generated by the pseudo-random number seed, Y and the calculation task; The sum of M2 and z1 is determined as the calculation result of the calculation task corresponding to X and Y, where M2 = M1, M2 is determined by the second device according to the target rule based on the random number, and M1 is determined by the first device according to the target rule after generating a random number based on the pseudo-random number seed.

7. An electronic device, characterized in that, include: A memory and a processor, the memory being used to store a computer program; the processor being used to execute the method as described in any one of claims 1-6 when the computer program is invoked.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-6.

9. A computer program product, characterized in that, When the computer program product is run on an electronic device, it causes the electronic device to perform the method as described in any one of claims 1-6.

10. A chip system, characterized in that, The chip system includes a processor coupled to a memory, the processor executing a computer program stored in the memory to implement the method as described in any one of claims 1-6.

Images