WO2023231340A1

WO2023231340A1 - Execution method and device for shared ot protocol, and secure multi-party computation method and device

Info

Publication number: WO2023231340A1
Application number: PCT/CN2022/135294
Authority: WO
Inventors: 李漓春; 尹栋; 赵原
Original assignee: 蚂蚁区块链科技(上海)有限公司
Priority date: 2022-06-02
Filing date: 2022-11-30
Publication date: 2023-12-07
Also published as: CN115001674A

Abstract

An execution method and device for a shared OT protocol, and a secure multi-party computation method and device based on a shared OT protocol, relating to a first party and a second party. The second party has N privacy numerical values and N random numbers, and the first party has a first serial number of a target privacy numerical value in the N privacy numerical values, a target random number, and a second serial number of the target random number in the N random numbers. The execution method for a shared OT protocol comprises: the second party receives, from the first party, a third serial number calculated by the first party according to the first serial number and the second serial number, and then calculates, according to the third serial number, the N privacy numerical values and the N random numbers, intermediate data respectively corresponding to the remaining N-1 privacy numerical values other than that having the third serial number, and calculates a second share of the target privacy numerical value on the basis of a random number of which the serial number is the third serial number and a privacy numerical value arranged at the first place; the second party can also send, to the first party, the intermediate data respectively corresponding to the remaining N-1 privacy numerical values, so that the first party calculates a first share of the target privacy numerical value.

Description

Share the execution methods of OT protocols, secure multi-party computing methods and devices

This application requests the priority of the Chinese patent application submitted to the State Intellectual Property Office of China on June 2, 2022, with the application number 202210619377. The entire contents of which are incorporated herein by reference.

Technical field

One or more embodiments of this specification relate to the computer field, and in particular, to an execution method of a shared OT protocol, a secure multi-party computing method and device based on a shared OT protocol.

Background technique

The oblivious transfer (OT) protocol is a typical two-party protocol in cryptography, and it is often used to support the execution of secure multi-party computations. When using the OT protocol to support secure multi-party computation (SMPC), different parties involved in secure multi-party computation usually need to transmit a large amount of data, and even multiple rounds may be required between different parties. times of communication.

It is hoped that there will be a new solution that will help complete secure multi-party computation more efficiently.

Contents of the invention

One or more embodiments of this specification provide an execution method for a shared OT protocol, a secure multi-party computing method and device based on the shared OT protocol.

The first aspect provides a method for executing a shared OT protocol, involving a first party and a second party. The second party holds N privacy values arranged in order and N random numbers arranged in order, so The first party holds the first serial number of the target privacy value among the N privacy values, the target random number, and its second serial number among the N random numbers, and the method is applied to the second party . The method includes: receiving from the first party a third sequence number calculated based on the first sequence number and the second sequence number; based on the third sequence number, the N privacy values and the N Random numbers, calculate the intermediate data corresponding to each of the N-1 privacy values except for the third serial number; send the intermediate data corresponding to each of the N-1 privacy values to the first party, so that all The first party calculates the first fragment of the target privacy value; calculates the second fragment of the target privacy value based on the random number whose serial number is the third serial number and the privacy value ranked first, wherein the third fragment is used The result of processing the first fragment and the second fragment by a preset algorithm is equal to the target privacy value.

In a possible implementation, the method further includes: receiving the N random numbers from a third party; wherein the target random number and the second sequence number are sent by the third party to the first party .

In a possible implementation, the third serial number is obtained by using N to perform a modulo operation on the sum of the first serial number and the second serial number. The result of the summation operation of the two slices is equal to the target privacy value.

In a possible implementation, the third serial number is obtained by performing an XOR operation on the first serial number and the second serial number, and the first slice and the second slice are The result of the XOR operation is equal to the target privacy value.

In a possible implementation, based on the third serial number, the N privacy values and the N random numbers, calculate the respective corresponding correspondences of the remaining N-1 privacy values other than the third serial number. The intermediate data includes: for any privacy value with serial number j other than the third serial number, process the random number with serial number j according to the second preset operation rule to obtain its corresponding first data item, based on The first data item, the second data item, the third data item and the privacy value ranked first, calculate the intermediate data with serial number j corresponding to the privacy value with serial number j, wherein the second data item is calculated by using The second preset operation rule is obtained by processing the random number whose serial number is the third serial number. The third data item is a private value with the serial number y. The value of y is the same as using N to pair the third serial number. The result obtained modulo the difference from j.

In a possible implementation, calculating the second fragment of the target privacy value based on the random number whose sequence number is the third sequence number and the privacy value ranked first includes: according to the second data item and The first ranked privacy value calculates the second shard of the target privacy value.

In a possible implementation, the lengths of the N privacy values are all t bits; and processing the random number with serial number j according to the second preset operation rule to obtain its corresponding first data item includes: Calculate the hash value of the random number j with length t bits as its corresponding first data item; or, for the random number j with length greater than t bits, extract the length t bits starting from the predetermined position bit sequence, and use the data represented by this bit sequence as the first data item corresponding to the random number with serial number j.

In the second aspect, a method for executing a shared OT protocol is provided, involving a first party and a second party. The second party holds N privacy values arranged in order and N random numbers arranged in order, so The first party holds a target random number with a first serial number among the N privacy values and a second serial number among the N random numbers, and the method is applied to the first party. The method includes: sending a third serial number calculated based on the first serial number and the second serial number to the second party, causing the second party to generate a random number and an arrangement based on the serial number being the third serial number. For the first privacy value, calculate the second fragment of the target privacy value, and return the intermediate data corresponding to each of the remaining N-1 privacy values except for the third serial number; at least according to the first serial number and the target random number to calculate the first fragment of the target privacy value, wherein the first fragment and the second fragment are processed using a first preset operation rule to obtain a result equal to the target privacy value. numerical value.

In a possible implementation, the N random numbers are sent by a third party to the second party; the method further includes: receiving the target random number and the second sequence number from the third party.

In a possible implementation, the third serial number is a result obtained by performing an XOR operation on the first serial number and the second serial number, and the first slice and the second slice are The result obtained by performing an XOR operation is equal to the target privacy value.

In a possible implementation, calculating the first fragment of the target privacy value based on at least the first sequence number and the target random number includes: using a second preset operation rule to process the target random number to Obtain the fourth data item; determine whether the target privacy value is the first-ranked privacy value based on the first serial number, and if so, use the fourth data item as the first fragment of the target privacy value; otherwise The first fragment of the target privacy value is calculated based on the fourth data item and the intermediate data corresponding to the privacy value whose serial number is the second serial number.

In a possible implementation, the length of the N privacy values is t bits; and using the second preset operation rule to process the target random number to obtain the fourth data item includes: calculating the target The length of the random number is a hash value of t bits as the fourth data item; or, for the target random number whose length is greater than t bits, a bit sequence of length t bits is extracted starting from a predetermined position, and the length is The data represented by the bit sequence of t bits is used as the fourth data item.

In the third aspect, a secure multi-party computing method based on the shared OT protocol is provided, involving a first party and a second party. The first party holds a third privacy value that will be used as the first serial number, and the second party Having a second privacy value, the method is applied to the second party. The method includes: generating N privacy values arranged in order, wherein any privacy value with serial number j is obtained by processing serial number j and the second privacy value using a target operation rule, so that the serial number is the third privacy value. The privacy value of the privacy value is equal to the result of using the target operation rule to process the third privacy value and the second privacy value; for the N privacy values and the third privacy value as the first serial number, use rights The method described in any one of claims 1 to 7 jointly executes the shared OT protocol with the first party, obtains the second fragment whose sequence number is the target privacy value of the three privacy values, and makes the first party correspond Obtain the first fragment whose sequence number is the target privacy value of the third privacy value.

In a possible implementation, the second privacy value and the third privacy value are two slices of the fourth privacy value in modulo 2 space, and the first slice and the second slice are The length of each slice is t bits greater than 1; the result of performing an XOR operation on the second privacy value and the third privacy value is equivalent to performing a summation operation on the first fragment and the second fragment. the result of.

In a possible implementation, the target operation rules include summation operation, product operation, bitwise AND operation, bitwise OR operation or bitwise XOR operation.

In a possible implementation, the first preset operation rule includes a summation operation or a bitwise XOR operation.

In a possible implementation, the first party also holds a fourth privacy value, and the sum of the second privacy value and the fourth privacy value is equal to a fifth privacy value; the second shard The sum of the third fragment is equal to the product of the third privacy value and the fifth privacy value, wherein the third fragment is generated by the first party based on the third privacy value, the fourth privacy value The privacy value is calculated with the first shard.

In a possible implementation, the first party also holds a fourth privacy value, the second party also holds a sixth privacy value and a seventh privacy value, the third privacy value and the third privacy value The six privacy values are two XOR slices of the eighth privacy value located in the modulo 2 space in the modulo 2 space, and the sum of the fourth privacy value and the seventh privacy value is equal to the fifth privacy value; so The second privacy value is calculated by the second party based on the sixth privacy value and the seventh privacy value, and the second fragment is used to calculate the fifth privacy value and the eighth privacy value. product of .

The fourth aspect provides a secure multi-party computing method based on the shared OT protocol, involving a first party and a second party. The first party holds a third privacy value that will be used as the first serial number, and the second party Having a second privacy value, the method is applied to the first party. The method includes: using the method described in any one of the second aspects to jointly execute the shared OT protocol with the second party for the third privacy value and the N privacy values as the first serial number, and obtain the serial number of The first fragment of the target privacy value of the three privacy values, and the second party obtains the second fragment of the target privacy value with the sequence number of the third privacy value, wherein any privacy value with the sequence number j is It is obtained by the second party using the target operation rule to process the serial number j and the second privacy value, so that the privacy value with the serial number being the third privacy value is equal to the third privacy value and using the target operation rule. The result of the second privacy value.

In a possible implementation, the sum of the second privacy value and the fourth privacy value held by the first party is equal to the fifth privacy value. The method further includes: calculating a third fragment based on the third privacy value, the fourth privacy value and the first fragment, so that the second fragment is equal to the sum of the third fragment. It is equal to the product of the third privacy value and the fifth privacy value.

In a possible implementation, the first party also holds a fourth privacy value, the second party also holds a sixth privacy value and a seventh privacy value, the third privacy value and the third privacy value The six privacy values are two XOR slices of the eighth privacy value located in the modulo 2 space in the modulo 2 space, and the sum of the fourth privacy value and the seventh privacy value is equal to the fifth privacy value; so The second privacy value is calculated by the second party based on the sixth privacy value and the seventh privacy value, and the first fragment is used to calculate the fifth privacy value and the eighth privacy value. product of .

In the fifth aspect, a secure multi-party computing method based on the shared OT protocol is provided, involving a first party and a second party. The first party holds a third privacy value that will be used as the first serial number, and the second party Holding the fifth privacy value and the sixth privacy value, the third privacy value and the sixth privacy value are two XOR slices in the modulo 2 space of the eighth privacy value located in the modulo 2 space, so The method is applied to the first party. The method includes: the second party generates N privacy values arranged in order, wherein any privacy value with serial number j is equal to the XOR result of serial number j and the fifth privacy value using the target operation rule. Obtained, the XOR result with serial number j is obtained by performing an XOR operation on serial number j and the sixth privacy value, so that the target privacy value with the serial number being the third privacy value is equal to the target privacy value processed using the target operation rule The result of the fifth privacy value and the eighth privacy value; the first party and the second party adopt the first method for the third privacy value and the N privacy values as the first serial number. The method described in any one of the aspect and the second aspect jointly executes the sharing OT protocol, and obtains the first fragment and the second fragment whose sequence numbers are the target privacy values of the three privacy values.

The sixth aspect provides an execution device for sharing OT, involving a first party and a second party. The second party holds N privacy values arranged in order and N random numbers arranged in order. The first party holds the first serial number of the target privacy value among the N privacy values, the target random number, and its second serial number among the N random numbers, and the device is deployed on the second party. The device includes: a communication processing unit configured to receive from the first party a third sequence number calculated based on the first sequence number and the second sequence number; a first calculation unit configured to receive the third sequence number based on the third sequence number. serial number, the N privacy values and the N random numbers, and calculate the intermediate data corresponding to each of the N-1 privacy values except the sequence number being the third serial number; the communication processing unit is also configured to provide The first party sends the intermediate data corresponding to each of the N-1 privacy values, so that the first party calculates the first fragment of the target privacy value; the second calculation unit is configured to calculate the first fragment of the target privacy value based on the sequence number. The random number of the third serial number and the privacy value ranked first are used to calculate the second fragment of the target privacy value, wherein the first preset operation rule is used to process the results of the first fragment and the second fragment. equal to the target privacy value.

In the seventh aspect, an execution device for sharing OT is provided, involving a first party and a second party. The second party holds N privacy values arranged in order and N random numbers arranged in order. The first party holds the first serial number of the target privacy value among the N privacy values, the target random number, and its second serial number among the N random numbers, and the device is deployed on the first party. The device includes: a communication processing unit configured to send a third sequence number calculated based on the first sequence number and the second sequence number to the second party, so that the second party determines the third sequence number based on the sequence number. The random number of the serial number and the privacy value ranked first, calculate the second fragment of the target privacy value, and return the intermediate data corresponding to each of the remaining N-1 privacy values except the third serial number; calculate A processing unit configured to calculate a first fragment of the target privacy value based on at least the first sequence number and the target random number, wherein the first fragment and the second fragment are processed using a first preset operation rule. The result of fragmentation is equal to the target privacy value.

In an eighth aspect, a secure multi-party computing device based on the OT protocol is provided, involving a first party and a second party. The first party holds a third privacy value to be used as the first serial number, and the second party holds There is a second privacy value and the device is deployed on the second party. The device includes: a calculation processing unit configured to generate N privacy values arranged in order, wherein any privacy value with serial number j is obtained by processing serial number j and the second privacy value using a target operation rule, so that The privacy value whose serial number is the third privacy value is equal to the result of using the target operation rule to process the third privacy value and the second privacy value; the processing unit is called and is configured to sum the N privacy values as the third privacy value. For the third privacy value with a serial number, the shared OT execution device described in the sixth aspect jointly executes the shared OT protocol with the first party to obtain the second target privacy value with a serial number of the three privacy values. fragment, and the first party obtains the first fragment corresponding to the target privacy value whose sequence number is the third privacy value.

In the ninth aspect, a secure multi-party computing device based on the shared OT protocol is provided, involving a first party and a second party. The first party holds a third privacy value to be used as the first serial number, and the second party Holding a second privacy value, the device is deployed on the first party. The device is configured to jointly execute the shared OT protocol with the second party through the shared OT execution device described in the seventh aspect for the third privacy value and the N privacy values as the first serial number, and obtain the serial number. Be the first fragment of the target privacy value of the three privacy values, and enable the second party to obtain the second fragment of the target privacy value with the sequence number of the third privacy value, wherein any privacy value with the sequence number is j It is obtained by the second party using the target operation rule to process the serial number j and the second privacy value, so that the privacy value with the serial number being the third privacy value is equal to the third privacy value using the target operation rule. and the result of the second privacy value.

In a tenth aspect, a computer-readable storage medium is provided with a computer program stored thereon. When the computer program is executed in a computing device, the computing device performs the method described in any one of the first to fourth aspects. .

In an eleventh aspect, a computing device includes a memory and a processor. A computer program is stored in the memory. When the processor executes the computer program, it implements any one of the first to fourth aspects. method.

Through the methods and devices provided in one or more embodiments of this specification, when the second party holds N privacy values and the first party holds the sequence number of the target privacy value among the N privacy values, the first party The first party and the second party can each obtain a shard of the target privacy value by executing the sharing OT protocol while ensuring the security of the target privacy value and its sequence number. This allows the first party and the second party to implement secure multi-party calculations of privacy values based on the shared OT protocol. When the first and second parties implement secure multi-party calculations, the amount of data they need to transmit is small and the number of communication rounds is relatively long. less, so that secure multi-party computation can be completed more efficiently.

Description of the drawings

In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings needed to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. Those of ordinary skill in the art can also obtain other drawings based on these drawings without exerting creative efforts.

Figure 1 is a schematic process diagram of a shared OT protocol execution method provided in the embodiment of this specification;

Figure 2 is one of the process schematic diagrams of an exemplary secure multi-party computing method based on the shared OT protocol;

Figure 3 is an exemplary process diagram of the secure multi-party computing method based on the shared OT protocol;

Figure 4 is the third schematic process diagram of the secure multi-party computing method based on the shared OT protocol provided as an example;

Figure 5 is an exemplary process diagram of the fourth secure multi-party computing method based on the shared OT protocol;

Figure 6 is one of the schematic diagrams of an execution device for sharing an OT protocol provided in the embodiment of this specification;

Figure 7 is a second schematic diagram of an execution device for sharing an OT protocol provided in the embodiment of this specification;

Figure 8 is a schematic diagram of a secure multi-party computing device based on the shared OT protocol.

Detailed ways

Each non-limiting embodiment provided in this specification will be described in detail below with reference to the accompanying drawings.

The OT protocol is a typical two-party protocol in cryptography. Taking the two participants executing the protocol including Alice and Bob as an example, the requirements of the OT protocol are: Alice, as the OT receiver (or first party), holds a privacy value p, p is an integer and satisfies 0=<p =<N-1; Bob, as the OT sender (or called the second party), holds N privacy values of length t bits and arranged in order {x ₀ , x ₁ ,..., x _N-1 }; Alice After jointly executing the OT protocol with Bob, Alice can obtain the privacy value x _p with serial number p among the N privacy values, but cannot know other privacy values held by Bob. Bob cannot know the p held by Alice. It should be noted that in view of the fact that the smallest non-negative integer when a computing device represents a value through a bit sequence is 0, for the sequence number of any j-th data in a certain sequence data in the sequence data, in the embodiment of this specification, it is usually It is set to j-1 instead of j. For example, the aforementioned privacy value x ₀ is the first privacy value among the aforementioned N privacy values. It can be expressed as the first privacy value among the N privacy values. However, The sequence number among the aforementioned N privacy values is 0 instead of 1, so p is required to be an integer and satisfy 0=<p=<N-1. It can be understood that in terms of technical implementation, other sequence number setting rules can also be used. For example, the sequence number of any j-th data in any sequence data can be set to j instead of j-1. , specifically, for example, the sequence number of the aforementioned privacy value x ₀ among the aforementioned N privacy values can be set to 1. Correspondingly, the sequence number p can be required to be an integer and satisfy 1=<p=<N. In addition, it should be noted that Alice and Bob can each be implemented as any device, device, platform or device cluster with computing/processing capabilities.

The Random Occasional Transmission (Random OT) protocol is a variant of the above-mentioned OT protocol and can be used to construct the above-mentioned OT protocol. The Random OT protocol can be implemented through a variety of cryptography techniques. The requirements of the Random OT protocol are: Bob can obtain N random numbers {r ₀ , r ₁ ,..., r _N-1 } arranged in order; Alice can obtain the i+1th random number among the N random numbers. r _i and its sequence number i among the N random numbers. The method of constructing an OT protocol through the Random OT protocol may include but is not limited to the following steps S01 to S03:

Step S01, Alice calculates the intermediate sequence number e=(i+p)%N, and sends e to Bob;

Step S02: For each privacy value x _j with serial number j among the N privacy values {x ₀ , x ₁ ,..., x _N-1 } except the privacy value re with serial number _e , use N random numbers Encrypt x _j with a random number with serial number (ej)%N in {r ₀ , r ₁ ,…, r _N-1 } to obtain ciphertext f _j with serial number j, and send the ciphertext f _j to Alice;

Step S03, Alice uses the random number r i she holds with serial number _i to decrypt the ciphertext _fi corresponding to the privacy value x _i she received with serial number i, and can obtain the privacy value x with serial number p. _p .

Secure multi-party computation is a calculation result of a function that is jointly calculated by multiple participants. During the calculation process, the input data of the function held by multiple participants is not disclosed. The input data held by each participant is usually It is treated as private data and cannot be known by other participants, but the calculation results are allowed to be disclosed to designated objects. For example, there may be the following secure multi-party computation requirements: Alice holds the private value A, and Bob holds the private value B. After performing secure multi-party computation, Alice obtains the fragment c0 and Bob obtains the fragment c1, in which preset operation rules are used to process c0 and c1. The result is equal to the result of processing A and B using the target operation rule g. The aforementioned target operation rules g may include but are not limited to safe modulo conversion, summation operation, quadrature operation, bitwise AND operation, bitwise OR operation or bitwise XOR operation, etc.; the aforementioned preset operation rules may include but Not limited to summation operations or XOR operations.

The aforementioned OT protocol can generally be used to support the aforementioned secure multi-party computation. The method of implementing the aforementioned secure multi-party computation through the aforementioned OT protocol may include but is not limited to the following steps S11 to S14:

Step S11, Bob generates a random value as fragment c1;

Step S12, Bob calculates N privacy values arranged in order, among which any j+1th privacy value x _j =g(j,B)-c1. The N privacy values generated by Bob are also the ones in the aforementioned OT protocol. N privacy values arranged in order;

Step S13, Alice uses A as p in the aforementioned OT protocol;

Step S14, Alice jointly executes the aforementioned OT protocol based on A as p in the OT protocol and Bob based on the N privacy values calculated by it. The execution result is: Alice obtains x _A =g(A ,B)-c1.

In the process of implementing the aforementioned secure multi-party computation based on the aforementioned OT protocol, multiple rounds of communication are required between Alice and Bob and the amount of data to be transmitted is relatively large. In view of the above problems, the embodiments of this specification provide an execution method of the shared OT protocol, a secure multi-party computing method and device based on the shared OT protocol, in order to reduce the amount of data that needs to be transmitted when implementing secure multi-party computation, thereby making it more efficient. Efficiently complete secure multi-party computations.

Figure 1 is a schematic process diagram of a method for executing a shared OT protocol provided in an embodiment of this specification. In this method, Alice serves as the OT receiver (i.e., the first party) sharing the OT protocol, and Bob serves as the OT sender (i.e., the second party) sharing the OT protocol. Before executing the method shown in Figure 1, Alice and Bob By executing the Random OT protocol or other methods mentioned above, Bob can obtain N random numbers {r ₀ , r ₁ ,...r _N-1 } arranged in order, and Alice can obtain the target random number r _i and other Serial number i among N random numbers. For example, Bob can specifically receive the aforementioned N random numbers {r ₀ , r ₁ ,..., r _N-1 } from a third party, and Alice can receive r _i and its sequence number i among the aforementioned N random numbers from a third party. . In addition, the same as the OT protocol mentioned above, Bob can also hold N privacy values {x ₀ , x ₁ ,..., x _N-1 } arranged in order, and Alice can also hold the target privacy value x _p in the aforementioned The first sequence number p among the N privacy values {x ₀ , x ₁ ,..., x _N-1 }. On this basis, Alice and Bob can jointly execute the following method steps 100 to 110 as shown in Figure 1.

First, in step 100, Alice calculates sequence number e based on sequence number p and sequence number i. For example, Alice can use N to perform a modulo operation on the sum of serial number p and serial number i to obtain serial number e, or she can perform an XOR operation on serial number p and serial number i to obtain serial number e, or she can use N to perform a modulo operation on the sum of serial number p and serial number i. The difference is taken modulo to obtain the sequence number e.

Next, in step 102, Alice sends sequence number e to Bob.

Next, in step 104, Bob calculates the intermediate data corresponding to each of the remaining N-1 privacy values except the sequence number e, based on the sequence number e, the N privacy values he holds, and the N random numbers.

For any privacy value x _j with serial number j among the N privacy values {x ₀ , x ₁ ,..., x _N-1 } except serial number e, Bob can use the second preset operation rule h to process N random The random number r _j with serial number j in the number {r ₀ , r ₁ ,..., r _N-1 } is used to obtain the first data item h(r _j ) corresponding to the privacy value x _j ; and then based on the first data item h (r _j ), the second data item, the third data item and the privacy value x ₀ ranked first, calculate the intermediate data f _j with serial number j corresponding to the privacy value x _j . The aforementioned second data item is h( _re ) obtained by processing the random number re with serial number _e using the second preset operation rule h, and the aforementioned third data item is the random number with serial number y among the N privacy values. The value of privacy value x _y , y is the same as the result obtained by using N to perform the modulo operation on the difference between e and j.

The N privacy values {x ₀ , x ₁ ,..., x _N-1 } can all be integers in the modulo 2 ^t space. In this case, it is necessary to ensure that the second preset operation rule h is used to process any random number held by Bob. , data with a length of t bits can be output corresponding to any random number. For example, if the length of any random number r j with serial number _j among the N random numbers {r ₀ , r ₁ ,..., r _N-1 } is not greater than t bits, the second preset operation rule h is used to process the random number r j The first data item h(r _j ) obtained from the number r _j can be the hash value of the length t bits of the random number r _j calculated by Bob; if N random numbers {r ₀ , r ₁ ,..., The length of any random number r _j with serial number j in r _N-1 } is greater than t bits. The first data item h(r _j ) obtained by processing the random number r _j using the second preset operation rule h can be Data represented by a sub-bit sequence of length t bits extracted starting from a predetermined position in the bit sequence characterizing the random number r _j . The process in which Bob uses the second preset operation rule to process the random number r e with serial number _e to obtain the second data item h( _re ) is the same as the process in which Bob uses the second preset operation rule to process the random number r _j to obtain its corresponding The first data item h(r _j ) of , therefore will not be described again.

More specifically, Bob can calculate the intermediate data f _j corresponding to the privacy value x _j through the following formula 1:

f _j =h(r _j )+h(re _e )-x ₀ +x _(ej)%N (1)

It can be understood that the intermediate data f _j corresponding to the privacy value x _j can also be calculated through other methods, such as adding specific coefficients in front of some or all data items in Formula 1 or making certain deformations to the aforementioned Formula 1. More specifically, For example, all the addition and subtraction operations involved in Formula 1 can be replaced with XOR operations.

Step 106: Bob sends the intermediate data corresponding to each of the remaining N-1 privacy values to Alice. That is, Bob needs to send to Alice the intermediate data f _j corresponding to each privacy value x _j calculated by him except the sequence number e.

Step 108: Alice calculates the first fragment c0 of the target privacy value x _p based on the sequence number p and the target random number r _i .

Alice can use the aforementioned second preset operation rule h to process the target random number r _i she holds to obtain the fourth data item h(ri ₎ . Alice's method of obtaining the fourth data item h( _ri ) can be the same as Bob's. Obtain the second data item h( _re ) or the first data item h(r _j ) corresponding to the privacy value x _j , so no details will be given. Alice can determine whether the target privacy value x _p is the first-ranked privacy value x ₀ based on the sequence number p. If so, use the fourth data item h(r _i ) as the first fragment c0 of the target privacy value x _p . Otherwise, Alice The first fragment c0 of the target privacy value x _p can be calculated based on the fourth data item h(ri ₎ and the intermediate data _fi corresponding to the privacy value x _i with serial number i, for example, c0=fi _-h ( _ri ), or c0 is the result of the XOR operation on the intermediate data _fi and the fourth data item h(ri ₎ .

Step 110: Bob calculates the second fragment c1 of the target privacy value x _p based on the random number r _e with serial number e and the privacy value x ₀ ranked first. Bob can use the second operation rule h to process the random number re with serial number _e to obtain the second data item h( _re ), and then in step 110, it can be based on the second data item h( _re ) and the privacy value. x ₀ calculates the second fragment c1 of the target privacy value x _p , for example, c1 = x ₀ -h( _re ), or the second fragment c1 can also be the pair of privacy value x ₀ and the second data item h(r _e ) The result of XOR operation.

Referring to the previous process of Alice obtaining fragment c0 and Bob obtaining fragment c1, it can be seen that the result of processing fragment c0 and fragment c1 using the first preset operation rule is equal to the target privacy value x _p , where the first preset operation rule is specific It can be a summation operation or a bitwise XOR operation. In other words, the result of a summation operation or a bitwise XOR operation on the slice c0 and the slice c1 is equal to the target privacy value x _p . In addition, in the process of getting Alice and Bob to obtain fragment c0 and fragment c1 respectively, Alice cannot know the target privacy value x _p , ensuring the security of the target privacy value x _p .

The aforementioned shared OT protocol can be used to support Alice and Bob to perform secure multi-party calculations on two private values a and b. Among them, secret sharing is widely used in secure multi-party computation. Its basic principle is to split the secret value into multiple shards (shares) and hand them over to different participants for safekeeping. Only participants exceeding a threshold number can The shards held by each are merged to recover the original secret value. The threshold number is usually the same as the number of parties participating in the secure multi-party computation. Therefore, during the actual execution of secure multi-party computation by Alice and Bob, for the privacy value a and privacy value b expected to be processed through the target operation rules, their typical data holding situations are except for case 1 as shown below, Alice and Bob’s data holding situations may include the following situations 2 to 4:

Case 1, Alice holds a and Bob holds b. Where a and b can both be single-bit values 0 or 1 in the modulo 2 space; or a and b can both be integers in the modulo 2 ^t space; or a can be a single-bit value 0 or 1 in the modulo 2 space, And b is an integer in modulo 2 ^t space.

Case 2, a is a single-bit value 0 or 1 in the modulo 2 space, and b is an integer in the modulo 2 space; Alice holds the slice b0 of a and b in the modulo 2 ^t space, and Bob holds b in the modulo 2 space. Slice b1 in ^t space, where the sum of b0 and b1 is equal to b.

Case 3, a is a single-bit value 0 or 1 in the modulo 2 space, and b is an integer in the modulo 2 space; Alice holds the slice a0 of a in the modulo 2 space and the slice of b in the modulo 2 ^t space. b0, Bob holds a's slice a1 in the modulo 2 space and b's slice b1 in the modulo 2 ^t space. The result of the XOR operation on a0 and a1 is equal to a, and b0 and b1 are summed. The result of the operation is equal to b.

Case 4, a is a single-bit value 0 or 1 in the modulo 2 space, and b is an integer in the modulo 2 space; Alice holds the slice a0 of a in the modulo 2 space, and Bob holds b and a in the modulo 2 space. Slice a1 within , where the result of the XOR operation on a0 and a1 is equal to a.

For the aforementioned situations 1 to 4, the aforementioned shared OT protocol can be used to implement secure multi-party calculations of the privacy value a and the privacy value b. However, for different data holding situations, Alice and Bob use the aforementioned shared OT protocol. The process by which protocols implement secure multi-party computations for a and b may differ. The following describes in detail the process by which Alice and Bob implement secure multi-party calculations of privacy value a and privacy value b based on the aforementioned sharing OT protocol under the aforementioned four data holding situations.

Figure 2 is one of the process diagrams of the secure multi-party computing method based on the shared OT protocol. In the implementation shown in Figure 2, Alice will serve as the receiver (ie, the first party) of the shared OT protocol, and Bob will serve as the sender (ie, the second party) of the shared OT protocol. See Figure 2. Alice and Bob can implement secure multi-party computation of privacy value a and privacy value b through step 200 and step 202 in the aforementioned data holding situation 1.

First, in step 200, Bob generates N privacy values arranged in order according to the privacy value b.

That is, N privacy values {x ₀ , x ₁ ,..., x _N-1 } arranged in order in the aforementioned sharing OT protocol are generated. For any privacy value x _{j with serial number j} among the N privacy values, it can be obtained by processing serial number j and privacy value b using the target operation rule g, so that the target privacy value x with serial number a can be obtained _a is equal to the result of using the target operation rule g to process the privacy value a and the privacy value b. When a and b are both integers or single-bit private values in the default space, the target operation rule g may include, but is not limited to, summation operations, quadrature operations, bitwise AND operations, bitwise OR operations, or Bitwise XOR operation; when a is a single-bit value in the modulo 2 space and b is an integer in the modulo 2 ^t space, the target operation rule may include, for example, but is not limited to a quadrature operation. What needs special explanation here is that the value of N in step 200 should be greater than the privacy value a held by Alice.

Then, in step 202, Alice and Bob jointly execute the sharing OT protocol based on the privacy value a as the sequence number p and the N privacy values generated by it, so that Alice obtains the first fragment c0 of the target privacy value x _p , and Bob obtains The second fragment c1 of the target privacy value x _p . Since a is equal to p, the target privacy value x _p is obtained by Bob using the target operation rule g to process the sequence number p and the privacy value b. Therefore, the first preset operation rule is used to process the first fragment c0 and the target privacy value x _p . The result of the second slice c1 is equal to the result of processing a and b using the target operation rule g, so that Alice and Bob complete the secure multi-party calculation of a and b. It should be noted that when a and b are two XOR slices of a certain privacy value in the modulo 2 space, that is, the result of the XOR operation on a and b is equal to a certain private value in the modulo 2 space. When the privacy value _c is used, since the first fragment c0 and the second fragment c1 of the target ^privacy value Two shards a and b perform safe mode conversion.

Figure 3 is the second process diagram of the secure multi-party computing method based on the shared OT protocol. In the implementation shown in Figure 3, Alice will serve as the receiver (ie, the first party) of the shared OT protocol, and Bob will serve as the sender (ie, the second party) of the shared OT protocol. As shown in Figure 3, Alice and Bob can implement secure multi-party calculations of privacy value a and privacy value b through steps 300 to 306 in the aforementioned data holding situation 2.

First, in step 300, Bob generates N privacy values arranged in order according to the slice b1.

That is, N privacy values {x ₀ , x ₁ ,..., x _N-1 } arranged in order in the aforementioned sharing OT protocol are generated. For any privacy value x _j with serial number j among the N privacy values, it can be obtained by processing serial number j and fragment b1 using the target operation rule g, for example, performing the integral of serial number j and fragment b1 Obtained by the operation, in this way, the target privacy value x _a with the serial number a can be equal to the result of processing a and b1 using the target operation rule g.

Then, in step 302, Alice and Bob jointly execute the sharing OT protocol based on the privacy value a as the sequence number p and the N privacy values generated by it, so that Alice obtains the first fragment c0 of the target privacy value x _p , and Bob obtains The second fragment c1 of the target privacy value x _p . Since a is equal to p, x _p is obtained by Bob using the target operation rule g to process the sequence number p and the fragment b1. Therefore, the first fragment c0 and the second fragment c1 of x _p are summed or XORed. The result is equal to the result of using the target operation rule g to process the serial numbers a and b1, thus completing the secure multi-party calculation of a and b1.

Next, in step 304, Alice calculates the third fragment c0g based on the first fragment c0 of x _p , the privacy value a and the fragment b0. For example, Alice can calculate the slice c0g through c0g=a*b0+c0, so that the result of the summation operation of the slice c0g and the second slice of x _p is equal to the result of processing a and b using the target operation rule. It should be noted that c0g may also be obtained by performing an XOR operation on a, b0 and c0.

Figure 4 is the third process diagram of the secure multi-party computing method based on the shared OT protocol. The implementation shown in Figure 4 includes execution process 1 and execution process 2: In execution process 1, Alice will be the receiver (i.e. the first party) of the shared OT protocol, and Bob will be the sender of the shared OT protocol. Party (i.e. the second party); in execution process 2, Alice will be the sender of the shared OT protocol, and Bob will be the receiver of the shared OT protocol. As shown in Figure 4, Alice and Bob can implement secure multi-party calculations of privacy value a and privacy value b through steps 400 to 407 in the aforementioned data holding situation 3. Steps 400 to 402 belong to the execution process 1. 403 to 405 belong to execution process 2. Execution process 1 and execution process 2 can be executed independently of each other and there is no necessary sequence relationship.

In step 400, Bob calculates the privacy value L1 based on the slice a1 and the slice b1. The privacy value L1 can be calculated, for example, by the formula L1 = (b1-2a1*b1) or the deformation based on this formula.

In step 401, Bob generates N privacy values arranged in order according to the privacy value L1.

That is, N privacy values {x ₀ , x ₁ ,..., x _N-1 } arranged in order in the aforementioned sharing OT protocol are generated. For any privacy value x _j with serial number j among the N privacy values, it can be obtained by processing the serial number j and the privacy value L1 using the target operation rule g, for example, by performing a multiplication operation on the serial number j and L1. Obtained, in this way, the target privacy value with serial number a0 can be equal to the result of processing a0 and L1 using the target operation rule g.

In step 402, Alice jointly executes the sharing OT protocol based on the privacy value a0 as the sequence number p, and the N privacy values generated by Bob based on it, so that Alice obtains the target privacy value with the sequence number a0 among the N privacy values generated by Bob. The first fragment c00, Bob obtains the second fragment c01 of the target privacy value with serial number a0 among the N privacy values generated by Bob.

In step 403, Alice calculates the privacy value L0 based on the fragment a0 and the fragment b0. The privacy value L0 can be calculated, for example, by the formula L0=(b0-2a0*b0) or the deformation based on this formula.

In step 404, Alice generates N privacy values arranged in order according to the privacy value L0.

That is, N privacy values {x ₀ , x ₁ ,..., x _N-1 } arranged in order in the aforementioned sharing OT protocol are generated. For any privacy value x _j with serial number j among the N privacy values, it can be obtained by processing the serial number j and the privacy value L0 using the target operation rule g, for example, by performing a multiplication operation on the serial number j and L0. Obtained, in this way, the privacy value with serial number a1 can be equal to the result of processing a1 and L0 using the target operation rule g.

In step 405, Bob jointly executes the sharing OT protocol based on the privacy value a1 as the sequence number p, and Alice based on the N privacy values generated by it, so that Bob obtains the target privacy value with the sequence number a1 among the N privacy values generated by Alice. The first fragment c10, Alice obtains the second fragment c11 of the target privacy value with serial number a1 among the N privacy values generated by Alice.

In step 406, Alice calculates slice m0 based on slice a0, slice b0, slice c00, and slice c11. For example, Alice can obtain the slice m0 through the formula m0=a0*b0+c00+c11 or its deformation calculation.

In step 407, Bob calculates slice m1 based on slice a1, slice b1, slice c01, and slice c10. For example, Bob can obtain the slice m1 through the formula m1=a1*b1+c01+c10 or its deformation calculation.

Referring to the calculation process of Alice and Bob calculating m0 and m1, it can be seen that the result of the summation operation of m0 and m1 is equal to the result of using the target operation rule to process a and b, so that Alice and Bob pass the above steps 400~ based on the shared OT protocol. 407 Complete the secure multi-party calculation of privacy value a and privacy value b. In addition, it can be understood that the addition and multiplication operations in the foregoing formula for calculating sharding can also be replaced by XOR operations.

Figure 5 is the fourth process diagram of the secure multi-party computing method based on the shared OT protocol. In the implementation shown in Figure 5, Alice will serve as the receiver (ie, the first party) of the shared OT protocol, and Bob will serve as the sender (ie, the second party) of the shared OT protocol. See Figure 5. Alice and Bob can implement secure multi-party calculations of privacy value a and privacy value b through steps 500 to 502 in the aforementioned data holding situation 4.

First, in step 500, Bob generates N privacy values arranged in order according to the fragment a1 and the privacy value b.

That is, N privacy values {x ₀ , x ₁ ,..., x _N-1 } arranged in order in the aforementioned sharing OT protocol are generated. Among them, any privacy value x j with serial number _j is equal to the result obtained by using the target operation rule g to process the XOR result with serial number j and the privacy value b (i.e., the fifth privacy value). The XOR result with serial number j is obtained by comparing the serial number j is obtained by performing an XOR operation on fragment a1 (i.e., the sixth privacy value), so that the target privacy value with serial number a0 (i.e., the third privacy value) among the N privacy values is equivalent to using the target operation rule to process privacy. The result of the value b and the privacy value a is, for example, equal to the result of the multiplication operation of the privacy value a and the privacy value b.

Next, in step 502, Alice and Bob jointly execute the sharing OT protocol based on the fragment a0 as the sequence number p and the N privacy values generated by Bob, so that Alice obtains the target with the sequence number a0 among the N privacy values generated by Bob. For the first fragment c0 of the privacy value, Bob obtains the second fragment c1 of the target privacy value numbered a0 among the N privacy values generated by Bob. The result of the summation operation or the XOR operation of the first slice c0 and the second slice c1 is equal to the result of processing a and b using the target operation rule.

Through the technical solutions of the embodiments of this specification, when the second party holds N privacy values and the first party holds the sequence number of the target privacy value among the N privacy values, the first party and the second party can pass Execute the sharing OT protocol to ensure that the first party and the second party can each obtain a shard of the target privacy value while ensuring the security of the target privacy value and its sequence number. This allows the first party and the second party to implement secure multi-party calculations of two privacy values based on the shared OT protocol. The amount of data that the first party and the second party need to transmit when implementing secure multi-party calculations is small and the communication is round-robin. With fewer times, secure multi-party computation can be completed more efficiently.

It should be noted that in the aforementioned method embodiments shown in Figures 2 to 5, when the privacy value a is a single-bit value in the modulo 2 space, the value of N can generally be 2, which can be more effective. Reduce the amount of calculations Alice and Bob need to perform when implementing secure multi-party computations on a and b.

Based on the same concept as the foregoing method embodiments, the embodiments of this specification also provide an execution device for sharing OT, involving a first party and a second party. The second party holds N privacy values arranged in order. And N random numbers arranged in order, the first party holds the first serial number of the target privacy value among the N privacy values, the target random number, and its second serial number among the N random numbers. , the device is deployed on the second party. As shown in Figure 6, the device includes: a communication processing unit 61 configured to receive from the first party a third sequence number calculated based on the first sequence number and the second sequence number; a first calculation unit 63 , configured to calculate, based on the third sequence number, the N privacy values and the N random numbers, the intermediate data corresponding to each of the remaining N-1 privacy values except the sequence number being the third sequence number; the The communication processing unit 61 is also configured to send the intermediate data corresponding to each of the N-1 privacy values to the first party, so that the first party calculates the first fragment of the target privacy value; the second calculation Unit 65 is configured to calculate the second fragment of the target privacy value based on the random number whose serial number is the third serial number and the privacy value ranked first, wherein the first fragment is processed using a first preset operation rule. The result of the slice and the second slice is equal to the target privacy value.

Based on the same concept as the foregoing method embodiments, the embodiments of this specification also provide an execution device for sharing OT, involving a first party and a second party. The second party holds N privacy values arranged in order. And N random numbers arranged in order, the first party holds the first serial number of the target privacy value among the N privacy values, the target random number, and its second serial number among the N random numbers. , the device is deployed on the first party. As shown in Figure 7, the device includes: a communication processing unit 71 configured to send a third sequence number calculated based on the first sequence number and the second sequence number to the second party, so that the second party Based on the random number whose serial number is the third serial number and the privacy value ranked first, calculate the second fragment of the target privacy value, and return the remaining N-1 privacy values except the third serial number. Respectively corresponding intermediate data; the calculation processing unit 73 is configured to calculate the first fragment of the target privacy value based on at least the first sequence number and the target random number, wherein the first preset operation rule is used to process the first fragment of the target privacy value. The result obtained from one fragment and the second fragment is equal to the target privacy value.

Based on the same concept as the foregoing method, the embodiment of this specification also provides a secure multi-party computing device based on the OT protocol, involving a first party and a second party. The first party holds the first serial number that will be used as the first party. a third privacy value, the second party holds the second privacy value, and the device is deployed on the second party. As shown in Figure 8, the device includes: a calculation processing unit 81 configured to generate N privacy values arranged in order, wherein any privacy value with serial number j is processed by using a target operation rule to process serial number j and the second Obtained from the privacy value, the privacy value with the serial number of the third privacy value is equal to the result of processing the third privacy value and the second privacy value using the target operation rule; call the processing unit 83, configured to process the third privacy value The N privacy values and the third privacy value as the first serial number are jointly executed with the first party through the shared OT execution device deployed on the second party as described in the embodiment of this specification. The protocol is to obtain the second fragment with a sequence number of the target privacy value of the three privacy values, and enable the first party to correspondingly obtain the first fragment with the sequence number of the target privacy value of the third privacy value.

Based on the same concept as the foregoing method embodiments, the embodiments of this specification also provide a secure multi-party computing device based on the shared OT protocol, involving a first party and a second party. The first party holds the information that will be used as the first party. A third privacy value of the serial number, the second party holds the second privacy value, and the device is deployed on the first party. The device is configured to use the execution device of the shared OT deployed on the first party as described in the embodiment of this specification to communicate with the second privacy value as the first serial number and the third privacy value. The two parties jointly execute the sharing OT protocol to obtain the first fragment with a sequence number of the target privacy value of the three privacy values, and enable the second party to obtain the second fragment with a sequence number of the target privacy value of the third privacy value. , where any privacy value with serial number j is obtained by the second party using the target operation rule to process serial number j and the second privacy value, so that the privacy value with the serial number being the third privacy value is equal to the use of the target The operation rule processes the result of the third privacy value and the second privacy value.

Those skilled in the art should realize that in one or more of the above examples, the functions described in this specification can be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, the computer program corresponding to these functions can be stored in a computer-readable medium or transmitted as one or more instructions/codes on the computer-readable medium, so that the computer program corresponding to these functions can be used by the computer. During execution, the method described in any embodiment of this specification is implemented through a computer.

The embodiments of this specification also provide a computer-readable storage medium on which computer programs/instructions are stored. When the computer program/instructions are executed in a computing device, the computing device executes the information provided in any embodiment of this specification. The execution method of the shared OT implemented by the first party or the second party, or the secure multi-party computing method based on the shared OT protocol implemented by the first party or the second party provided in any embodiment of this specification.

The embodiments of this specification also provide a computing device, including a memory and a processor. Computer programs/instructions are stored in the memory. When the processor executes the computer program/instructions, any embodiment of this specification is implemented. The execution method of the shared OT protocol implemented by the first party or the second party provided in the document, or the secure multi-party computing method based on the shared OT protocol implemented by the first party or the second party provided in any embodiment of this specification .

Each embodiment in this specification is described in a progressive manner. The same and similar parts in each embodiment can be referred to each other. The emphasis in each embodiment is on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple. For relevant details, please refer to the partial description of the method embodiment.

The foregoing describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve desired results. Additionally, the processes depicted in the figures do not necessarily require the specific order shown, or sequential order, to achieve desirable results. Multitasking and parallel processing are also possible or may be advantageous in certain implementations.

The above-described specific embodiments further describe the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above-mentioned are only specific embodiments of the present invention and are not intended to limit the scope of the present invention. Protection scope: Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention shall be included in the protection scope of the present invention.

Claims

An execution method for sharing the inadvertent transmission OT protocol, involving a first party and a second party. The second party holds N privacy values and N random numbers. The first party holds a target privacy value in the said The first serial number among the N privacy values, the target random number and its second serial number among the N random numbers, the method is applied to the second party, and the method includes:

Receive from the first party a third sequence number calculated based on the first sequence number and the second sequence number;

Based on the third sequence number, the N privacy values and the N random numbers, calculate the intermediate data corresponding to each of the remaining N-1 privacy values except the sequence number is the third sequence number;

Send the intermediate data corresponding to each of the N-1 privacy values to the first party, so that the first party calculates the first fragment of the target privacy value;

Based on the random number whose serial number is the third serial number and the privacy value ranked first, the second fragment of the target privacy value is calculated, wherein the first fragment and the third fragment are processed using a first preset operation rule The result of bi-sharding is equal to the target privacy value.
The method of claim 1, further comprising: receiving the N random numbers from a third party; wherein the target random number and the second sequence number are sent to the first party by the third party .
According to the method of claim 1, the third serial number is obtained by performing a modulo operation on the sum of the first serial number and the second serial number using N, and the first slice and the third serial number are The result of the summation operation of the two slices is equal to the target privacy value.
The method according to claim 1, wherein the third serial number is obtained by performing an XOR operation on the first serial number and the second serial number, and the first slice and the second slice are The result of the XOR operation is equal to the target privacy value.
According to the method of any one of claims 1-4, based on the third serial number, the N privacy values and the N random numbers, calculate the remaining N- numbers except the third serial number. The intermediate data corresponding to each privacy value includes: for any privacy value with serial number j other than the third serial number, processing the random number with serial number j according to the second preset operation rule to obtain its corresponding The first data item, based on the first data item, the second data item, the third data item and the privacy value ranked first, calculates the intermediate data with serial number j corresponding to the privacy value with serial number j, wherein said The second data item is obtained by using the second preset operation rule to process the random number whose serial number is the third serial number. The third data item is a private value with the serial number y, and the value of y is the same as using N The result is obtained by performing a modulo operation on the difference between the third serial number and j.
The method according to claim 5, calculating the second fragment of the target privacy value based on the random number whose sequence number is the third sequence number and the privacy value ranked first, including: according to the second data item and The first ranked privacy value calculates the second shard of the target privacy value.
The method according to claim 5, the lengths of the N privacy values are all t bits; processing the random number with serial number j according to the second preset operation rule to obtain its corresponding first data item includes: Calculate the hash value of the random number j with length t bits as its corresponding first data item; or, for the random number j with length greater than t bits, extract the length t bits starting from the predetermined position bit sequence, and use the data represented by this bit sequence as the first data item corresponding to the random number with serial number j.
An execution method for sharing the inadvertent transmission OT protocol, involving a first party and a second party. The second party holds N privacy values and N random numbers. The first party holds a target privacy value in the N The first serial number among the private values, the target random number and its second serial number among the N random numbers, the method is applied to the first party, and the method includes: sending to the second party The third serial number calculated based on the first serial number and the second serial number enables the second party to calculate the target privacy value based on the random number whose serial number is the third serial number and the privacy value ranked first. The second fragment, and return the intermediate data corresponding to each of the N-1 privacy values except the sequence number that is the third sequence number;

Calculate the first fragment of the target privacy value based on at least the first sequence number and the target random number, wherein the first fragment and the second fragment are processed using a first preset operation rule. The result is equal to the target privacy value.
According to the method of claim 8, the N random numbers are sent to the second party by a third party; the method further includes: receiving the target random number and the second sequence number from the third party.
According to the method of claim 8, the third serial number is obtained by performing a modulo operation on the sum of the first serial number and the second serial number using N, and the first slice and the third serial number are The result of the summation operation of the two slices is equal to the target privacy value.
The method according to claim 1, wherein the third serial number is a result obtained by performing an XOR operation on the first serial number and the second serial number, and the first slice and the second slice are The result obtained by performing an XOR operation is equal to the target privacy value.
The method according to any one of claims 8-11, calculating the first fragment of the target privacy value based on at least the first serial number and the target random number, including: processing using a second preset operation rule The target random number is used to obtain a fourth data item; based on the first serial number, it is determined whether the target privacy value is the first privacy value, and if so, the fourth data item is used as the target privacy value. the first fragment, otherwise the first fragment of the target privacy value is calculated based on the fourth data item and the intermediate data corresponding to the privacy value whose serial number is the second serial number.
The method according to claim 12, the lengths of the N privacy values are all t bits; and using the second preset operation rule to process the target random number to obtain the fourth data item includes: calculating the target The length of the random number is a hash value of t bits as the fourth data item; or, for the target random number whose length is greater than t bits, a bit sequence of length t bits is extracted starting from a predetermined position, and the length is The data represented by the bit sequence of t bits is used as the fourth data item.
A secure multi-party computing method based on sharing the unintentional transmission OT protocol, involving a first party and a second party. The first party holds a third privacy value that will be used as the first serial number, and the second party holds a second Privacy value, the method is applied to the second party, the method includes:

Generate N privacy values arranged in order, wherein any privacy value with serial number j is obtained by processing serial number j and the second privacy value using the target operation rule, so that the serial number is the privacy value of the third privacy value Equivalent to the result of processing the third privacy value and the second privacy value using a target operation rule;

For the N privacy values and the third privacy value as the first serial number, the method described in any one of claims 1-7 is used to jointly execute the sharing OT protocol with the first party, and the serial number is obtained. The second fragment of the target privacy value of the third privacy value is obtained, and the first party correspondingly obtains the first fragment of the target privacy value whose sequence number is the third privacy value.
According to the method of claim 14, the second privacy value and the third privacy value are two slices of the fourth privacy value in modulo 2 space, and the first slice and the second slice are The length of each slice is t bits greater than 1; the result of performing an XOR operation on the second privacy value and the third privacy value is equivalent to performing a summation operation on the first fragment and the second fragment. the result of.
According to the method of claim 14, the target operation rule includes a summation operation, a product operation, a bitwise AND operation, a bitwise OR operation or a bitwise XOR operation.
According to the method of claim 14, the first party also holds a fourth privacy value, and the sum of the second privacy value and the fourth privacy value is equal to a fifth privacy value; the second shard The sum of the third fragment is equal to the product of the third privacy value and the fifth privacy value, wherein the third fragment is generated by the first party based on the third privacy value, the fourth privacy value The privacy value is calculated with the first shard.
According to the method of claim 14, the first party also holds a fourth privacy value, the second party also holds a sixth privacy value and a seventh privacy value, the third privacy value and the third privacy value. The six privacy values are two XOR slices of the eighth privacy value located in the modulo 2 space in the modulo 2 space, and the sum of the fourth privacy value and the seventh privacy value is equal to the fifth privacy value; so The second privacy value is calculated by the second party based on the sixth privacy value and the seventh privacy value, and the second fragment is used to calculate the fifth privacy value and the eighth privacy value. product of .
A secure multi-party computing method based on sharing the unintentional transmission OT protocol, involving a first party and a second party. The first party holds a third privacy value that will be used as the first serial number, and the second party holds a second Privacy value, the method is applied to the first party, and the method includes: using the method described in any one of claims 8-13 for the third privacy value as the first serial number and the N privacy values. The method jointly executes the sharing OT protocol with the second party, obtains the first fragment of the target privacy value with the serial number of the three privacy values, and enables the second party to obtain the target privacy with the serial number of the third privacy value. The second fragment of the value, in which any privacy value with sequence number j is obtained by the second party using the target operation rule to process sequence number j and the second privacy value, so that the sequence number is the third privacy value The privacy value is equal to the result of processing the third privacy value and the second privacy value using a target operation rule.
According to the method of claim 19, the second privacy value and the third privacy value are two slices of the fourth privacy value in modulo 2 space, and the first slice and the second slice are The length of each slice is t bits greater than 1; the result of performing an XOR operation on the second privacy value and the third privacy value is equivalent to performing a summation operation on the first fragment and the second fragment. the result of.
The method according to claim 19, the target operation rule includes a summation operation, a product operation, a bitwise AND operation, a bitwise OR operation or a bitwise XOR operation.
According to the method of claim 19, the sum of the second privacy value and the fourth privacy value held by the first party is equal to a fifth privacy value; the method further includes: based on the third privacy value value, the fourth privacy value and the first fragment to calculate a third fragment such that the sum of the second fragment and the third fragment is equal to the third privacy value and the fifth fragment. The product of privacy values.
According to the method of claim 19, the first party also holds a fourth privacy value, the second party also holds a sixth privacy value and a seventh privacy value, the third privacy value and the third privacy value. The six privacy values are two XOR slices of the eighth privacy value located in the modulo 2 space in the modulo 2 space, and the sum of the fourth privacy value and the seventh privacy value is equal to the fifth privacy value; so The second privacy value is calculated by the second party based on the sixth privacy value and the seventh privacy value, and the first fragment is used to calculate the fifth privacy value and the eighth privacy value. product of .
A secure multi-party computing method based on sharing the unintentional transmission OT protocol, involving a first party and a second party. The first party holds a third privacy value that will be used as the first serial number, and the second party holds a fifth The privacy value and the sixth privacy value. The third privacy value and the sixth privacy value are two XOR slices of the eighth privacy value located in the modulo 2 space in the modulo 2 space. The method is applied to The first party, the method includes: the second party generates N privacy values arranged in order, wherein any privacy value with serial number j is equal to the sum of the XOR result of processing serial number j using the target operation rule. Obtained from the fifth privacy value, the XOR result with serial number j is obtained by performing an XOR operation on serial number j and the sixth privacy value, so that the target privacy value with serial number j is equal to the third privacy value using The target operation rule processes the result of the fifth privacy value and the eighth privacy value;

The first party and the second party jointly execute the shared OT protocol using the method described in any one of claims 1-13 for the third privacy value and the N privacy values as the first serial number. , respectively obtain the first fragment and the second fragment whose sequence numbers are the target privacy values of the three privacy values.
An execution device for sharing an oblivious transmission protocol OT, involving a first party and a second party. The second party holds N privacy values and N random numbers. The first party holds a target privacy value in the The first serial number among the N privacy values, the target random number and its second serial number among the N random numbers, the device is deployed on the second party, and the device includes:

a communication processing unit configured to receive from the first party a third sequence number calculated based on the first sequence number and the second sequence number;

A first calculation unit configured to calculate, based on the third serial number, the N privacy values and the N random numbers, the corresponding intermediate values of the remaining N-1 privacy values except for the third serial number. data;

The communication processing unit is further configured to send intermediate data corresponding to each of the N-1 privacy values to the first party, so that the first party calculates the first fragment of the target privacy value;

The second calculation unit is configured to calculate the second fragment of the target privacy value based on the random number whose serial number is the third serial number and the privacy value ranked first, wherein the first preset operation rule is used to process the second fragment of the target privacy value. The results of one fragment and the second fragment are equal to the target privacy value.
An execution device for sharing an oblivious transmission protocol OT, involving a first party and a second party. The second party holds N privacy values and N random numbers. The first party holds a target privacy value in the The first serial number among the N privacy values, the target random number and its second serial number among the N random numbers, the device is deployed on the first party, and the device includes:

A communication processing unit configured to send a third serial number calculated based on the first serial number and the second serial number to the second party, so that the second party can generate a random number based on the serial number being the third serial number and For the privacy value ranked first, calculate the second fragment of the target privacy value, and return the intermediate data corresponding to each of the remaining N-1 privacy values except for the third sequence number;

A calculation processing unit configured to calculate the first fragment of the target privacy value based on at least the first sequence number and the target random number, wherein the first fragment and the third fragment are processed using a first preset operation rule. The result of bi-sharding is equal to the target privacy value.
A secure multi-party computing device based on the shared unintentional transmission OT protocol, involving a first party and a second party. The first party holds a third privacy value to be used as a first serial number, and the second party holds a second Privacy value, the device is deployed on the second party, and the device includes:

The calculation processing unit is configured to generate N privacy values arranged in order, wherein any privacy value with serial number j is obtained by processing serial number j and the second privacy value using the target operation rule, so that the serial number is the third privacy value. The privacy value of the three privacy values is equal to the result of processing the third privacy value and the second privacy value using a target operation rule;

Calling a processing unit configured to jointly execute the shared OT protocol with the first party through the shared OT execution device described in claim 26 for the N privacy values and the third privacy value as the first serial number. , obtain the second fragment whose sequence number is the target privacy value of the three privacy values, and enable the first party to correspondingly obtain the first fragment whose sequence number is the target privacy value of the third privacy value.
A secure multi-party computing device based on the shared unintentional transmission OT protocol, involving a first party and a second party. The first party holds a third privacy value to be used as a first serial number, and the second party holds a second Privacy value, the device is deployed on the first party, and the device is used to process the third privacy value as the first serial number and the N privacy values through the execution device for sharing OT described in claim 27 Jointly execute the sharing OT protocol with the second party to obtain the first fragment with a sequence number of the target privacy value of the three privacy values, and enable the second party to obtain the target privacy value with a sequence number of the third privacy value. The second fragment of , in which any privacy value with serial number j is obtained by the second party using the target operation rule to process serial number j and the second privacy value, so that the serial number is the privacy value of the third privacy value The numerical value is equal to the result of processing the third privacy value and the second privacy value using a target operation rule.
A computer-readable storage medium having a computer program stored thereon. When the computer program is executed in a computing device, the computing device performs the method of any one of claims 1-23.
A computing device includes a memory and a processor. A computer program is stored in the memory. When the processor executes the computer program, the method of any one of claims 1-23 is implemented.