Secure Multi-Party Processing Against Malicious Parties

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing multi-party calculation methods are not secure when parties exhibit malicious behavior, as they can learn information about each other's data, even if the unconscious transfer protocol is secure.

Innovation Solution

The method involves a double execution of the calculation series with role reversal between parties, followed by an equality test to detect cheating, and uses double masking with invertible random values to protect results, ensuring security without significantly increasing execution time.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a standard multi-party calculation method using unconscious transfer protocol is used, then the calculation can be performed with semi-honest security, but the security breaks down when parties exhibit malicious behavior

Engineering Contradiction:
Improvesecurity against malicious partiesVSAvoidcomplexity of calculation protocol
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by performing authentication and generating authentication tags before the main calculation occurs. The parties authenticate their inputs and intermediate results in advance using cryptographic authentication codes, so that when the actual calculation is performed, the security against malicious manipulation is already established. This allows the protocol to maintain security without requiring complex verification mechanisms during the calculation itself.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent introduces authentication tags as an intermediary mechanism between the parties' data. These tags act as mediators that verify the integrity and authenticity of transmitted values without revealing the actual data. The authentication tags enable the protocol to detect malicious behavior while maintaining the confidentiality of the underlying calculation, thus resolving the contradiction between security and complexity.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If authentication mechanisms are added to protect against malicious parties, then security is improved, but execution time increases

Engineering Contradiction:
Improvesecurity against malicious partiesVSAvoidexecution time of calculation
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The authentication tags are generated and verified in advance during setup phases, allowing the main calculation to proceed efficiently without repeated authentication overhead. The preliminary authentication establishes trust boundaries that prevent malicious parties from manipulating results during the actual computation, thus minimizing time loss during the critical calculation phase.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

Each party independently generates and verifies their own authentication tags for their inputs and intermediate results. This self-service approach to authentication eliminates the need for complex centralized verification mechanisms, reducing the overall execution time while maintaining security against malicious behavior.

Inventive Principle:
Principle #25Self-service

3Reliability

If double execution with role reversal is performed to detect cheating, then security against malicious parties is improved, but the execution time significantly increases

Engineering Contradiction:
Improvedetection of malicious behaviorVSAvoidexecution time of calculation
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent extracts the security verification function into a separate authentication mechanism using cryptographic tags, rather than requiring full double execution of the calculation. By taking out the verification aspect and handling it through efficient authentication code comparison, the protocol achieves malicious behavior detection without the time penalty of complete dual execution.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent replaces the mechanical approach of double execution with a cryptographic substitution using authentication tags. Instead of physically re-executing the entire calculation with reversed roles, the system uses cryptographic verification to achieve the same security goal more efficiently, substituting computational mechanics with cryptographic mathematics.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentEP3200387B1Secure multi-party processing method protected against a malicious party
Publication Date: 2020.06.10 IDEMIA IDENTITY & SECURITY FRANCE SAS
  • EP3200387B1 patent drawingFigure 1a
  • EP3200387B1 patent drawingFigure 1b
  • EP3200387B1 patent drawingFigure 2a

AI summary

The invention proposes a method comprising the evaluation of a function F obtained by applying a first operation to n sub-functions fi, the evaluation comprising: - the implementation of a series of computation steps in which a first unit takes the role of client and a second unit takes the role of server, and - the repetition of the series of computation steps in which the roles of client and server are exchanged between the units, each series of steps comprising: a) random generation, by the server, of first data, and of a second data point, b) for each sub-function fi, generation by the server of a set of elements formed by: o a result of fi evaluated in the data of the client and the server, o masked by a first data point, by application of the first operation between the result and the first data point, and o masked by the second data point.by applying a second operation, different from and distributive with respect to the first, between the masked result and the second data point; c) retrieval, by the client, through unconscious transfer, of intermediate data corresponding to one of the elements generated by the server; d) generation, by the server, of a first part of the result, by: • masking each first data point by the second data point, • applying the first operation to all the masked first data points; and e) generation, by the client, of a second part of the result, by applying the first operation to all the intermediate data points.