CN115865311A

CN115865311A - Optimization method and system for efficient constant-round secure multi-party computing protocol

Info

Publication number: CN115865311A
Application number: CN202211358995.XA
Authority: CN
Inventors: 王永军; 熊坤; 张静; 闫玺玺; 汤永利
Original assignee: Henan University of Technology
Current assignee: Henan University of Technology
Priority date: 2022-09-16
Filing date: 2022-11-02
Publication date: 2023-03-28
Anticipated expiration: 2042-11-02
Also published as: WO2024051864A1; CN115865311B

Abstract

The application relates to the technical field of computers, and provides an optimization method and system for a high-efficiency constant-round safe multi-party computing protocol. The method comprises the following steps: executing the optimized Tiny-OT protocol in parallel by all participants to generate a plurality of Beaver multiplication triples (AND triples for short); the AND triple is used for generating relevant random information for constructing the confusion circuit without identity authentication AND for performing multiplication calculation of random shares in an online evaluation phase to decrypt the circuit; each participant P _i Carrying out linear combination on the commitment values of the plurality of AND triples to obtain a commitment combination result; each participant P _i Opens the commitment combination result AND checks the correctness of multiple AND triples. By processing the correctness check of the AND triples in batches in the optimized Tiny-OT protocol, the generation of the AND triples AND the correctness check are integrated into one protocol, the commitment number of the correctness check of the AND triples is reduced, AND a hash function is calledThe number of numbers and the avoidance of using additional OT operations to decrypt the circuit optimizes communication efficiency.

Description

Optimization method and system for efficient constant round secure multi-party computing protocol

Technical Field

The application relates to the technical field of computers, in particular to an optimization method and system of an efficient constant round secure multi-party computing protocol.

Background

In secure multi-party computing (MPC), each participant has its private input and computes the function f jointly, while ensuring privacy of the input and correctness of the computation.

The safety two-party calculation protocol based on the Yao's confusion circuit (GC) realizes the safety under the semi-honest hostile model. However, secure multiparty computing protocols for n participants are of less interest, especially with respect to dishonest majority and constant rounds, and progress is relatively slow. In the safe multiparty computing protocol setting of n participants, the construction complexity of the garbled circuit is increased, each participant needs to construct the garbled circuit in a distributed mode, the method for realizing the distributed garbled is called as a BMR protocol, the BMR protocol divides an MPC protocol into a preprocessing stage and an online evaluation stage, and only one constant-depth circuit is needed.

In particular, the preprocessing stage of the BMR protocol includes the Tiny-OT protocol for generating relevant random information and the distributed obfuscation protocol for generating an unauthenticated obfuscated circuit, which structure transfers a large number of computations to the preprocessing stage, with the main cost of F2 multiplication computations per and gate. Although this structure effectively improves the computational efficiency of the online evaluation phase, there are many key building blocks in the Tiny-OT protocol that need improvement.

Therefore, there is a need to provide an improved solution to the above-mentioned deficiencies of the prior art.

Disclosure of Invention

The application aims to provide an optimization method AND system for an efficient constant-round safe multi-party computing protocol, AND the problems in the prior art are solved or alleviated by improving AND triples AND key building blocks for correctness check in a Tiny-OT protocol.

In order to achieve the above purpose, the present application provides the following technical solutions:

the application provides an optimization method of an efficient constant round safe multi-party computing protocol, wherein the safe multi-party computing protocol comprises a preprocessing stage and an online evaluation stage; the secure multiparty agreement has a plurality of participants, P _i Representing the ith participant, wherein the value of i is 1,2 and … n; n represents the total number of participants; the method comprises the following steps:

executing the optimized Tiny-OT protocol in parallel by all the participants to generate a plurality of AND triples; the AND triplets are used to generate garbled circuits for the pre-processing phase AND for the calculations of the online evaluation phase;

each participant P _i Carrying out linear combination on the commitment values of the plurality of AND triples to obtain a commitment combination result;

each participant P _i Opening the commitment combination result AND checking the correctness of the plurality of AND triples.

Preferably, each AND-triple of the plurality of AND-triples comprises a first secret share [ x ], a second secret share [ y ], a third secret share [ z ]; the step of performing the optimized Tiny-OT protocol to generate the τ -th AND-triple of the plurality of AND-triples is as follows:

step S201, each participant P _i Generating a global key delta ⁱ And is and

wherein, delta ⁱ K is a k-bit binary number, and k is a preset safety parameter; lsb (. DELTA. ⁱ ) Is expressed by taking Δ ⁱ The last bit of (a);

represents an exclusive or operation;

step S202, each participant P _i Obtaining a first secret share x by executing a coherent oblivious transport protocol COT]Second secret share [ y]Fourth secret sharing [ r ]](ii) a The first secret sharing [ x]Second secret share [ y]Fourth secret sharing r]Respectively comprise a participant P _i Held secret sharing value x _i 、y _i 、r _i And x _i 、y _i 、r _i Respectively corresponding message authentication code and x _i 、y _i 、r _i Respectively corresponding keys;

step S203, each participant P _i Locally calculating a first intermediate value

In the formula:

represents P _i Held y ^l A corresponding key; y is ^l Represents the ith participant P _l Second secret share held [ y]A value of (d); />

Represents P _i Held y ⁱ A corresponding message authentication code; y is ⁱ Is P _i Second secret share held [ y]A value of (d); delta ⁱ As a global key delta ⁱ ；

Step S204, for the participant P _i And P _j Ordered pair of constituents (P) _i ,P _j )，j≠i：

Each participant P _i Calculating a second intermediate value u _i,j ：

u _i,j ＝H(K _i [x ^j ],i||j||τ)

In the formula, H represents a hash function; k _i [x ^j ]Represents P _i Held x ^j A corresponding key; x is the number of ^j As the first participant P _j Held first secret share [ x]A value of (d);

participant P _i Calculating a third intermediate value v _i,j ：

In the formula (I), the compound is shown in the specification,

is a first intermediate value; delta of ^j As a participant p _j A held global key;

participant P _i V is to be _i,j Is sent to p _j ；

Participant P _j Calculating a fourth intermediate value w _i,j ：

Step S205, each participant P _i Calculating a fifth intermediate value U _i ：

Step S206, each participant P _i Calculate the commitment value for each AND triplet:

wherein d = { d = { d =) _i }；d _i ＝lsb(U _i )；lsb(U _i ) Express and get U _i The last bit of (a);

step S207, when i ≠ 1, let [ z ≠ 1 ⁱ ] _i ＝[r ⁱ ] _i (ii) a Otherwise, it orders

To obtain [ x ]]、[y]、[z]。

Preferably, in step S202, each participant P is _i Obtaining a first secret share x by executing a related oblivious transport protocol COT]The method specifically comprises the following steps:

step S301, each participant P _i Generating a random bit sequence of length m

As the first random bit sequence x and additionally generates a random bit sequence of length k->

As an extra random bit sequence o for ensuring the global key delta ⁱ The consistency of (2); />

Step S302, for participant P _i And P _j Ordered pair of constituents (P) _i ,P _j ) J ≠ i, with participant P _i As a sender, a related oblivious transport protocol COT is executed to obtain a first secret sharing [ x ] corresponding to a first random bit sequence x and an additional random bit sequence o respectively]Fourth secret sharing o]And [ x ]]、[o]Respectively corresponding message verification codes and keys;

step S303, share [ x ] based on first secret]Fourth secret sharing o]For the global key Δ ⁱ Performing consistency verification, and if the consistency verification is passed, outputting a first secret share [ x]。

In the above technical solution, in step S303, the random share [ x ] is used as the basis]、[o]For the global key Δ ⁱ Performing consistency verification, including:

for participant P _i And P _j Ordered pair of constituents (P) _i ,P _j )，P _i 、P _j For any two of the n participants, j ≠ i, participant P _i Share [ x ] according to a first secret]Fourth secret sharing o]Locally calculating a first mapping value C ⁱ And obtaining C ⁱ Corresponding message authentication code M _j [C ⁱ ]And a secret key K _i [C ^j ]；

Each participant P _i Obtaining random zero sharing

Wherein it is present>

Each participant P _i According to the first mapping value C ⁱ And random zero-sharing rho ⁱ Calculating a second mapping value

And combining a second mapped value +>

Broadcast to various participants;

each participant P _i According to the second mapping value

Reconstructing a third mapping value c;

each participant P _i According to the first mapping value C ⁱ A third mapping value C and C ⁱ Corresponding message authentication code M _j [C ⁱ ]And a secret key K _i [C ^j ]Checking the global key delta ⁱ The consistency of (c).

In the above technical solution, after all participants execute an optimized Tiny-OT protocol in parallel to generate a plurality of AND triples, the method further includes:

grouping a plurality of AND triples;

for each packet, combining all AND triples within the packet into one to obtain a plurality of combinations;

pairing the plurality of combinations pairwise, for a first combination of the pairwise { [ x ] ₁ ],[y ₁ ],[z ₁ ]And a second combination of pairings { [ x { [ ₂ ],[y ₂ ],[z ₂ ]Executing the following steps to eliminate leakage:

each participant checks

The consistency of (2);

order to

[y]＝[y ₁ ]，/>

AND triplets [ x ], [ y ], [ z ] are output, where [ z ] = [ x ] × [ y ].

In the above technical solution, each participant P _i After opening the commitment combination result AND checking the correctness of the plurality of AND triples, the method further comprises:

acquiring a Boolean circuit;

generating relevant random information for constructing an unidentified garbled circuit based on the plurality of AND triples;

and generating the confusion circuit corresponding to the Boolean circuit according to the related random information.

In the above technical solution, the and confusion table of the confusion circuit includes a confusion square half gate and an evaluation square half gate; the AND gate of the garbled circuit comprises a first input line, a second input line and an output line;

the method further comprises the following steps:

splitting a mask value of an output line into a first sub-mask and a second sub-mask, and splitting a key of the output line into a first sub-key and a second sub-key;

calculating an obfuscator half-gate and an evaluator half-gate based on the first sub-mask, the second sub-mask, the first sub-key and the second sub-key, respectively;

and carrying out exclusive-OR operation on the confusion side half gate and the evaluation side half gate to obtain an external value of the output line.

The embodiment of the application also provides an optimization system of the efficient constant round secure multiparty computing protocolThe system, the secure multiparty computing protocol includes a preprocessing phase and an online evaluation phase; the secure multiparty agreement has a plurality of participants, P _i Representing the ith participant, wherein the value of i is 1,2 and … n; n represents the total number of participants; the method comprises the following steps:

the generating unit is configured to execute the optimized Tiny-OT protocol in parallel by all the participants so as to generate a plurality of AND triples; the AND triple is used for generating relevant random information for constructing the confusion circuit without identity authentication AND for performing multiplication calculation of random shares in an online evaluation phase to decrypt the circuit;

a combination unit configured to each participant P _i Linearly combining the commitment values of the plurality of AND triples to obtain a commitment combination result;

a checking unit configured as each participant P _i Opening the commitment combination result AND checking the correctness of the plurality of AND triples.

In the foregoing technical solution, each AND triple in the plurality of AND triples includes a first secret sharing [ x ], a second secret sharing [ y ], AND a third secret sharing [ z ]; the generating unit is further configured to:

the step of performing the optimized Tiny-OT protocol to generate the τ -th AND-triple of the plurality of AND-triples is as follows:

step S201, each participant P _i Generating a global key delta ⁱ And is and

wherein, delta ⁱ K is a k-bit binary number, and k is a preset safety parameter; lsb (. DELTA. ⁱ ) Represents taking Δ ⁱ The last bit of (a);

represents an exclusive or operation;

step S202, each participant P _i Obtaining a first secret share x by executing a related oblivious transport protocol COT]Second secret share [ y]Fourth secret sharing r](ii) a The first secret share [ x ]]Second secret sharing[y]Fourth secret sharing r]Respectively comprise a participant P _i Held secret sharing value x _i 、y _i 、r _i And x _i 、y _i 、r _i Respectively corresponding message authentication code and x _i 、y _i 、r _i Respectively corresponding keys;

step S203, each participant P _i Locally calculating a first intermediate value

In the formula:

Each participant P _i Calculating a second intermediate value u _i,j ：

u _i,j ＝H(K _i [x ^j ],i||j||τ)

In the formula, H represents a hash function; k is _i [x ^j ]Is represented by P _i Held x ^j A corresponding key; x is the number of ^j As the first participant P _j Held first secret share [ x]A value of (d);

participant P _i Calculating a third intermediate value v _i,j ：

In the formula (I), the compound is shown in the specification,

participant P _i V is to be _i,j Is sent to p _j ；

Participant P _j Calculating a fourth intermediate value w _i,j ：

To obtain [ x ]]、[y]、[z]。

Has the beneficial effects that:

in the technical scheme of the application, all participants execute optimized T in paralleliny-OT protocol to generate a plurality of AND triples; the AND triple is used for generating relevant random information for constructing the confusion circuit without identity authentication AND for performing multiplication calculation of random shares in an online evaluation phase to decrypt the circuit; each participant P _i Performing linear combination on the commitment values of the plurality of AND triples to obtain a commitment combination result; each participant P _i Opens the commitment combination result AND checks the correctness of multiple AND triplets. By processing the correctness check of the AND triples in batch in the optimized Tiny-OT protocol, the generation of the AND triples AND the correctness check are integrated into one protocol, the communication quantity of the correctness check of the AND triples AND the quantity of the called hash functions are reduced, AND the communication efficiency is optimized.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this application, illustrate embodiments of the application and, together with the description, serve to explain the application and are not intended to limit the application. Wherein:

FIG. 1 is a schematic flow diagram of a method for optimizing an efficient constant round secure multi-party computing protocol according to some embodiments of the present application;

FIG. 2 is a schematic flow diagram of generating AND triples according to the Tiny-OT protocol for performing optimization provided in accordance with some embodiments of the present application;

fig. 3 is a schematic flow diagram of obtaining a first secret share [ x ] by executing a related oblivious transport protocol COT according to some embodiments of the present application;

FIG. 4 is a block diagram of an optimization system for an efficient constant round secure multi-party computing protocol according to some embodiments of the present application.

Detailed Description

The present application will be described in detail below with reference to the embodiments with reference to the attached drawings. Various examples are provided by way of explanation of the present application and not limitation of the present application. In fact, it will be apparent to those skilled in the art that modifications and variations can be made in the present application without departing from the scope or spirit of the application. For instance, features illustrated or described as part of one embodiment, can be used with another embodiment to yield a still further embodiment. It is therefore intended that the present application cover the modifications and variations of this invention provided they come within the scope of the appended claims and their equivalents.

In the following description, references to the terms "first/second/third" merely distinguish between similar items and do not denote a particular order, but rather the terms "first/second/third" may, where permissible, be interchanged with a particular order or sequence, such that embodiments of the application described herein may be practiced in other than the order shown or described herein.

Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. The terminology used herein is for the purpose of describing embodiments of the disclosure only and is not intended to be limiting of the disclosure.

In secure multi-party computing (MPC), each participant has its private input and computes the function f jointly, while ensuring privacy of the input and correctness of the computation. The safety two-party calculation protocol based on the Yao's confusion circuit (GC) realizes the safety under the semi-honest hostile model. Later, cut-and-choose technology, proposed by Lindell and Pinkas, enabled security in a malicious adversary model. Currently, the computational efficiency of two-party protocols in malicious models is increased by several orders of magnitude. However, the n-party computing protocol is less concerned and its progress is relatively slow, particularly in terms of dishonest majority and constant rounds. In the n-party arrangement, the configuration of the garbled circuit becomes complicated. Parties need to build the garbled circuit in a distributed manner. This method of implementing distributed obfuscation, known as the BMR protocol, separates the MPC protocol into a pre-processing phase and an on-line phase and requires only one constant depth circuit. Distributed obfuscation is a core tool of the constant round MPC protocol.

Existing multi-party constant round MPC protocols can be divided into two styles, depending on the method of confusion. One is the certificate confusion proposed by Wang et al, and the other is the improved SPDZ-BMR by Hazay et al. They all construct the circuit in a distributed fashion, but the underlying protocols are different. The Wang et al protocol must generate some authenticated information and their computational protocol is asymmetric in that the authenticated circuit is constructed by one party and then evaluated by the other n-1 parties. In contrast, the SPDZ-BMR protocol of Hazay et al is symmetric and follows the BMR paradigm with the n parties together building an unauthenticated circuit and obtaining a share of the circuit.

For the SPDZ-BMR protocol, the preprocessing phase includes the Tiny-OT protocol AND the distributed confusion protocol for creating unidentified AND triples. This general architecture shifts a large number of computations to the preprocessing stage, with the main cost of multiplication being per AND gate. Although this paradigm has significantly improved the efficiency of the online phase, we have found that there are still many key building blocks that need improvement, mainly including the generation of unidentified AND triples, correctness checking. Intuitively, the Tiny-OT protocol is very practical for secure multiparty computing protocols based on secret sharing and on the BMR protocol, but its computational complexity still remains to be increased.

Therefore, the method and the system for optimizing the efficient constant round secure multi-party computing protocol are provided based on the structure of the SPDZ-BMR protocol, and can tolerate any n-1 victims by executing the active constant round secure multi-party computing (MPC) protocol. In particular, the method follows the Tiny-OT protocol AND the obfuscated scheme without identity verification, AND at a high level, an optimized Tiny-OT protocol is firstly proposed for generating unidentified AND triples, which reduces the number of consistency checks AND the number of called hash functions when generating the AND triples, AND avoids using additional OT operation to calculate the obfuscated circuit, thereby improving the communication efficiency. Specifically, with the method provided herein, approximately 50% less calls to hash functions can be made for generating shared random bits AND reducing the number of commitments used in the consistency check protocol for AND triples to 1. The communication complexity is O (Bnk) (wherein, B = O (k + s/logC; n is the total number of participants, k is a calculation safety parameter, and C represents the number of AND gates in a circuit), and the communication efficiency is greatly optimized.

In order to facilitate understanding of the technical scheme of the present application, the relevant parameters are defined as follows:

f: a function computed collectively by a plurality of participants;

k: preset calculation safety parameters;

s: preset statistical security parameters;

a.b: represents a range of values of

Multiplication or logical and calculation;

quadruplet (x, y, z.): representing a gate in the circuit, where x, y represent the input lines and z represents the output lines of the gate in the circuit. Represents the type of gate, which in a garbled circuit may be an XOR gate or an AND gate. The triplet (x, y, z) represents an AND triplet (AND triple) where x, y, z are shares shared in secret.

In a garbled circuit, W represents any one line, all W forming a set of lines, denoted W, wherein the set of input lines is denoted W _in Indicating that W is a collection of output lines _out And (4) showing.

The related art is explained in detail below:

the BMR protocol is explained first.

In a yao-based garbled circuit secure two-way calculation protocol, the garbled table of the AND gate can be expressed by the following formula:

C _0,0 ＝E _x,0 (E _y,0 (k _z,0 ))

C _0,1 ＝E _x,0 (E _y,1 (k _z,0 ))

C _1,0 ＝E _x,1 (E _y,0 (k _z,0 ))

C _1,1 ＝E _x,1 (E _y,1 (k _z,1 ))

wherein C represents the output value, E is the symmetric encryption algorithm, and k is the secret key.

The BMR protocol is an extension of the yao garbled circuit protocol in a multi-party setting, the basic idea being to generate the circuit in a distributed manner so that no party (or a subset of all parties) is able to know all the information generated by the circuit. In addition, the confusion table can be generated in a parallel mode based on the BMR protocol, so that the generation of the confusion circuit can be independent of the calculation circuit depth, and the generation process of the confusion circuit is completed in a preprocessing stage. After the garbled circuit is generated, each participant gets a share of the garbled circuit and associated key and then evaluates it locally at the online stage.

In the BMR confusion protocol, each participant P _i Randomly selecting a pair of keys for each line w in the garbled circuit

And &>

The key on the output line is then encrypted using the key on the input line to construct an obfuscated table of AND gates. In particular, a key using an input line>

(/>

Or->

) And &>

(

Or->

) Encrypting the key of the output line, the resulting confusion table formula is as follows:

where F is a Pseudo-Random Function (PRF), and | represents concatenation, and g is the index of the gate.

The above confusion table for the AND gate can be abbreviated as:

wherein j belongs to [ n ], a, b, c belongs to [0,1].

It can be seen from the confusion table of the AND gate that in the secure multiparty computing protocol of n participants, one AND gate needs 4n encrypted ciphertexts which are n times of the confusion circuit of the secure two-party computing protocol, AND if any participant is honest, the encryption is secure.

In a secure multiparty computing protocol with n participants, the use of Free-XOR techniques may make the evaluation of the XOR gate Free. In particular, when computing the XOR gates in the garbled circuit, the use of Free-XOR techniques eliminates the need to send the ciphertext and perform encryption and decryption operations, and also eliminates the need to deal with the scrambling code of the XOR gates. In Free-XOR techniques, each participant P of n participants _i Randomly selecting a global key delta ⁱ Is provided with

And &>

Is the key of line w, x, y are the inputs of line w, z is the output of line w, λ _w Is the mask value for the line w. In conjunction with the Free-XOR technique, the obfuscation of the AND gate is as follows:

wherein j is an element of [ n ]],a,b,λ _x ,λ _y ,λ _z ∈[0,1]。

On-line evaluation phase, each participant has private input v _w And obtained external value Λ _w Wherein

In the obfuscation phase, the key of the output line is all entered into the obfuscation table of line keys +>

Is covered. Due to the mask value λ _w Is random, so the external value Λ is _w Does not reveal the relevant true value v _w Any of (3). Finally, each participant obtains the external value Λ of the output line _z And the corresponding key, and then evaluate the garbled gate in the garbled circuit.

To achieve active security, the SPDZ-BMR protocol allows adversary-controlled corrupters to enter incorrect PRF values

Because of honest participants P _j The obfuscated gate may be evaluated in an online evaluation stage to obtain the key ≥>

Or->

If there are any incorrect PRF values, P _j The protocol will be aborted. Another benefit is evident: the SPDZ-BMR protocol shifts a large number of computations to a preprocessing stage, thereby improving on-line evaluationThe efficiency of (c). Furthermore, the main overhead of the preprocessing stage is to compute unauthenticated secret sharing of the obfuscated gates.

Exemplary method

The embodiment of the application provides an optimization method of an efficient constant round safe multi-party computing protocol, wherein the safe multi-party computing protocol comprises a preprocessing stage and an online evaluation stage; the secure multiparty agreement has a plurality of participants, P _i Representing the ith participant, wherein the value of i is 1,2 and … n; n represents the total number of participants; including, as shown in fig. 1-3, the method comprising:

s101, executing an optimized Tiny-OT protocol in parallel by all participants to generate a plurality of AND triples; the AND triplets are used to generate the relevant random information for constructing the garbled circuit without identity verification, AND to perform the multiplication of random shares in the online evaluation phase to decrypt the circuit.

In the embodiment of the application, the MPC protocol is active and in a constant turn, uses the structure of SPDZ-BMR, is executed based on the optimized Tiny-OT protocol, and can tolerate any n-1 corruption parties. The specific flow of the MPC protocol is as follows: each participant generates a correct AND triple in a preprocessing stage; then, using a distributed obfuscation protocol to create an obfuscated circuit; subsequently, each participant obtains secret sharing of the garbled circuit and the related key in an online stage; finally, each participant evaluates the garbled circuit locally to obtain an output.

Unlike the traditional SPDZ-BMR, the present embodiment optimizes the Tiny-OT protocol in two structural blocks of AND triplet generation AND correctness checking. Specifically, the conventional Tiny-OT protocol performs the correctness check of the AND triples based on the cut-AND-choose technology, AND the embodiment of the application provides a new AND triplet generation method based on the optimized Tiny-OT protocol, in the optimized Tiny-OT protocol, by integrating the generation AND the correctness check of the AND triples into one protocol, AND adopting a method of performing the correctness check of the AND triples in batch, the correctness check of a plurality of (for example, m ') AND triples only needs one commitment instead of the conventional m ' commitments, wherein m ' is the number of the AND triples, AND half of the hash function calls are reduced. The batch processing of the examination of the AND triples reduces the computational complexity of the MPC protocol from m' x k bits to k bits, AND achieves higher computational efficiency than the traditional Tiny-OT protocol.

In addition, the MPC protocol based on the optimized Tiny-OT protocol enables active security and communication complexity per participant is O (| C | Bnk). Table 1 shows the comparison result of the communication complexity of the multi-party MPC protocol provided in the embodiment of the present application and other multi-party MPC protocols, and table 1 is as follows:

table 1 comparison results of communication complexity

In the above table, O (·) represents complexity, | C | represents the number of and gates in the circuit, d represents the circuit depth, and B = O (k + s/logC). As can be seen from the table, the method provided by the embodiment of the present application greatly improves communication efficiency.

In specific implementation, the optimized Tiny-OT protocol is used for generating random secret sharing with consistency check AND AND triple with correctness check in the preprocessing stage, AND the generated AND triple is used for calculation in the online evaluation stage. The optimized Tiny-OT protocol will be described in detail below.

Before generating random secret sharing with consistency check AND triple with correctness check, the optimized Tiny-OT protocol further includes initialization that performs the following steps:

step S2011, for i ∈ [ n ]],P _i Randomly selecting a global key delta ⁱ ←{0,1} ^k 。

Step S2012, for each ordered pair (P) _i ,P _j ) Where j ≠ i, P _i And P _j Send (init, Δ) separately ^j ) And (init) to

To obtain an AND-triple with correctness check, in some embodiments, each AND-triple of the plurality of AND-triples includes a first secret share [ x ], a second secret share [ y ], a third secret share [ z ]; executing the optimized Tiny-OT protocol to generate the τ -th AND triple of the plurality of AND triples comprises the following steps:

step S201, each participant P _i Generating a global key delta ⁱ ←{0,1} ^k And is made of

indicating an exclusive or operation.

Step S202, each participant P _i Obtaining a first secret share x by executing a related oblivious transport protocol COT]Second secret share [ y]Fourth secret sharing r](ii) a The first secret share [ x ]]Second secret share [ y]Fourth secret sharing r]Respectively comprise a participant P _i Held secret sharing value x _i 、y _i 、r _i And x _i 、y _i 、r _i Respectively corresponding message verification code and x _i 、y _i 、r _i Respectively corresponding keys.

Step S203, each participant P _i Locally calculating a first intermediate value

In the formula:

Is represented by P _i Held y ⁱ A corresponding message authentication code; y is ⁱ Is P _i Second secret share held [ y]A value of (d); delta ⁱ As a global key delta ⁱ 。

Each participant P _i Calculating a second intermediate value u _i,j ：

u _i,j ＝H(K _i [x ^j ],i||j||τ)

participant P _i Calculating a third intermediate value v _i,j ：

In the formula (I), the compound is shown in the specification,

is a first intermediate value; delta ^j As a participant p _j A held global key;

participant P _i V is to be _i,j Is sent to p _j ；

Participant P _j Calculating a fourth intermediate value w _i,j ：

wherein d = { d = { d =) _i }；d _i ＝lsb(U _i )；lsb(U _i ) Express and get U _i The last bit of (c).

To obtain [ x ]]、[y]、[z]。

In the embodiment of the present application, creating an AND triplet includes two steps: AND-triplet generation AND correctness checking of AND triplets. Malicious adversaries may guess information about random secret sharing, such as queries and global keys and x ⁱ Because a malicious adversary cannot acquire the relevant x ⁱ ，y ⁱ And z ⁱ Therefore, the above guessing behavior has no effect on the optimized Tiny-OT protocol of the embodiment of the present application. The conventional Tiny-OT protocol uses cut-AND-choose technology to ensure the correctness of AND triples, which results in great waste of AND triples AND low efficiency. The optimized Tiny-OT protocol does not use cut-AND-choose, but rather combines AND triplet generation AND correctness checking together, effectively reducing the number of hash functions used for correctness checking. The execution of the optimized Tiny-OT protocol is analyzed in detail as follows:

in the above step S203, the first intermediate value

Comprises the following steps:

that is to say:

when an AND triple is created in step S204, there are:

then, the following equation can be calculated:

in step S206, there are:

thus, it is possible to obtain:

finally, in step S207 there are:

therefore, [ z ] = [ x ] · [ y ], AND an AND triplet ([ x ], [ y ], [ z ]) is obtained.

To generate random secret sharing with consistency checks, in some embodiments, each participant P is provided with a consistency check in step S202 _i Obtaining a first secret share x by executing a coherent oblivious transport protocol COT]The method specifically comprises the following steps:

step S301, each participant P _i Generating a random bit sequence of length m

As an extra random bit sequence o for ensuring the global key delta ⁱ The consistency of (2);

step S302, for participant P _i And P _j Ordered pair of constituents (P) _i ,P _j ) J ≠ i, for participant P _i As a sender, a related oblivious transport protocol COT is executed to obtain a first secret sharing [ x ] corresponding to a first random bit sequence x and an additional random bit sequence o respectively]Fourth secret sharing o]And [ x ]]、[o]Respectively corresponding message verification codes and keys;

And repeating the steps S301 to S303 to obtain a second secret share [ y ] and a third secret share [ z ].

In the embodiment of the application, each pair of participants (P) _i ，P _j ) Can be transmitted by executing a related careless transmission protocol

However, a malicious party may input an inconsistent global key in each execution, so that a plurality of different random secret shares are verified by a plurality of global keys, and in order to ensure the consistency of the global keys, the implementation of the present application introduces a re-random skillAnd (4) performing the operation.

Specifically, each P is mapped linearly _i Random secret sharing mapping to

Random value C in _i Then, each party P _i All through random zero-sharing re-randomization C _i To generate m random secret shares, in the optimized Tiny-OT protocol, each party generates an additional k random bits, which are then turned on to check the global key Δ ⁱ The consistency of (c).

To verify the global key delta ⁱ In some embodiments, step S303 is based on random shares [ x [ ]]、[o]For the global key Δ ⁱ Performing consistency verification, including:

Each participant P _i Obtaining random zero sharing

Wherein it is present>

And to £ the second mapping value>

Broadcast to the various participants;

each participant P _i According to the second mapping value

Reconstructing a third mapping value c;

each participant P _i According to the first mapping value C ⁱ A third mapping value C and C ⁱ Corresponding message authentication code M _j [V ⁱ ]And a secret key K _i [C ^j ]Checking the global key delta ⁱ The consistency of (c). The method specifically comprises the following steps:

each P _i Is provided with

Then call->

And promise of

The parties open their commitments and check

If the check fails, the parties abort the protocol.

The above global key Δ ⁱ In the consistency verification process, the global key delta can be verified only by making a commitment by each participant ⁱ The consistency of the global key is ensured to prevent the malicious participants from communicating with each other.

Wherein:

thus, the parties only need to commit and check

The consistency of the global key can be ensured.

In one example, the optimized Tiny-OT protocol is as follows:

/>

wherein the associated inadvertent transmission protocol

The execution process of (2) is as follows:

called function

Including the commitment command and the opening command, the execution process is as follows: />

It should be noted that during the process of checking the correctness of the AND triplets, a malicious adversary may find some leaks, AND for this reason, in some embodiments, after all the participants execute the optimized Tiny-OT protocol in parallel to generate a plurality of AND triplets, the method further includes:

grouping a plurality of AND triples; for each packet, combining all AND triples within the packet into one to obtain a plurality of combinations; pairwise pairing the plurality of combinations, for a first combination { [ x ] of the pairings ₁ ],[y ₁ ],[z ₁ ]And arrangements ofSecond combination of pairs { [ x ] ₂ ],[y ₂ ],[z ₂ ]Executing the following steps to eliminate leakage:

each participant checks

The consistency of (2);

order to

[y]＝[y ₁ ]，/>

AND triplets [ x ], [ y ], [ z ] are output, where [ z ] = [ x ] × [ y ].

In the embodiment of the present application, a bucket (bucket) technique is adopted in the subprotocol, AND several AND triples are combined in each bucket to eliminate the leakage of the AND triples.

Specifically, in one example, a sub-protocol employing bucket (bucket) technology is as follows:

step S102, each participant P _i AND carrying out linear combination on the commitment values of the plurality of AND triples to obtain a commitment combination result.

The optimized Tiny-OT protocol can generate an AND triple, AND in practical application, the MPC protocol execution process consumes a large number of AND triples, so the AND triples are usually generated in batch mode. In specific implementation, a plurality of AND triples may be generated by executing the optimized Tiny-OT protocol in parallel, for example, m' AND triples may be generated in parallel, AND a commitment value of each AND triplet may be calculated. After parallel execution of m 'suboptimal Tiny Tiny-OT protocols, proceed with m' AND triplesFor correctness checking, each participant P _i All by the following formula:

calculating to obtain a linear combination of the commitment values of the plurality of AND triples;

in the formula, σ _τ To pass through a random function

The generated random number.

Then, a function is called

Commitment command commitment Z _i 。

The above random function

The specific process is as follows:

step S103, each participant P _i Opening the commitment combination result AND checking the correctness of the plurality of AND triples.

Each participant calls a function

Open command of (2), open promise Z _i And checking whether or not +>

When equal to 0, the parties terminate the protocol.

In some embodiments, at each participant P _i After opening the commitment combination result AND checking the correctness of the plurality of AND triples, the method further comprises: acquiring a Boolean circuit;

generating, based on the plurality of AND triples, associated random information for generating a non-authenticated obfuscated circuit;

The Boolean circuit is constructed based on the operation logic of the function f.

In the embodiment of the application, each participant generates a correct AND triple in a preprocessing stage; then, creating an obfuscation circuit of the boolean circuit using a distributed obfuscation protocol based on the AND triplets;

the garbled circuits are generated by a multi-party garbled protocol. In the multi-party confusion protocol, confusion circuits are generated by all the parties together through distributed confusion. Specifically, each P _i First, a key for a circuit gate in a garbled circuit and a global key are generated, wherein

Then the mask value on each line of the random selection circuit gate is secretly shared by lambda _w Then, each party calculates the product λ of secret sharing _w ·Δ ⁱ And defines the garbled circuit and finally calculates the mask value of the output line to each party.

The following is an example of a distributed obfuscation protocol:

wherein the opening sub-protocol Π _open The method comprises the following steps:

/>

in the process of generating the confusion circuit, tiny-OT generates secret sharing, and unverified garbled circuits are constructed based on optimized Tiny-OT protocol distributed garbled, and no extra overhead is needed to obtain verified information. In the preprocessing stage, an optimized Tiny-OT protocol with MACs is used to obtain unverified AND triples that are used to compute the mask-value-shared product λ _x ·λ _y And each participant P _j Separately calculate lambda _x ，λ _y ，λ _x ·λ _y And delta ^j The product of (a) and (b). The online phase is aborted if the garbled circuit checks incorrectly by opening the circuit based on a checking mechanism and checking the correctness of the garbled circuit to prevent corrupt parties from changing their secret sharing resulting in the generation of incorrect garbled gates.

In the on-line evaluation phase, each P _i Calculating the external value Λ on its input line _w Then broadcast Λ _w And a value Λ from the external value _w Corresponding key

Then, each P _i These values are used to evaluate the garbled circuit to obtain the key ≥ for the output line>

And an external value Λ _z (ii) a Finally, each P _i Calculating an output true value based on the mask value>

One specific MPC protocol implementation is as follows:

wherein the confusion protocol Π is opened _Open _garbling For reconstructing a garbled table in a garbled circuit to detect the garbled circuit and ensure the circuit is correct, the protocol is executed according to the following steps:

since during the preprocessing phase, parties generate secret sharing of the garbled circuit without identity verification, which means that malicious parties may introduce errors into the garbled circuit, in this embodiment, a simple confusion protocol pi is opened during the online evaluation phase _Open _garbling To check to ensure the circuit is correct. In contrast, authenticated garbled circuits are more expensive than non-authenticated garbled circuits.

In order to reduce the amount of data transfer between circuit gates and the size of the obfuscation table during the construction of the obfuscation circuit, in some embodiments the and-gate obfuscation table of the obfuscation circuit comprises an obfuscating-side half-gate and an evaluator-side half-gate; the AND gate of the garbled circuit comprises a first input line, a second input line and an output line; the method further comprises the following steps: splitting a mask value of an output line into a first sub-mask and a second sub-mask, and splitting a key of the output line into a first sub-key and a second sub-key; calculating an obfuscator half-gate and an evaluator half-gate based on the first sub-mask, the second sub-mask, the first sub-key and the second sub-key, respectively; and carrying out exclusive-OR operation on the confusion side half gate and the evaluation side half gate to obtain an external value of the output line.

In the embodiment of the application, the Half-Gate technology is introduced into the multi-party distributed confusion protocol, AND the Half-Gate technology is optimally compatible with the free-XOR technology, so that the confusion table of each AND Gate in the confusion circuit only consumes 2n bits of data transmission quantity, the size of the confusion table is reduced, AND the efficiency of the MPC protocol is improved.

The method optimizes the Half-Gate technology, so that an AND Gate in the multi-party distributed confusion circuit only needs to consume two ciphertexts AND is compatible with Free-XOR. The following details the optimization of the Half-Gate technique:

in the embodiment of the application, two Half-gates are respectively expressed as a confusion side Half-Gate and an evaluation side Half-Gate. Is provided with

Is an external value, v _w Are true values.

For an AND gate v _z ＝v _x ∧v _y Wherein, x, y are input lines of the AND gate, AND z is an output line of the AND gate, AND the output line comprises:

in the two-party based Half-Gate technique, the calculation involves two Half-gates, the first Half-Gate being used to calculate λ _y ·v _x The second half being used for calculation

Finally, the result v obtained by two computations through XOR _z ＝v _x ·v _y The following were used: />

In the embodiment of the application, the Half-Gate technology is introduced into the process of the multi-party distributed confusion protocol, and the following adjustment is carried out: first, the mask value of the output line is divided into first sub-masks λ' _z And a second sub-mask λ ″) _z Wherein, in the step (A),

by splitting the mask value of the output line into a first sub-mask λ' _z And a second sub-mask λ ″) _z The outputs of the two half gates can be prevented from being leaked. Then, the key of the output line is ≥ v>

Split into a first sub-key->

And a second subkey +>

Wherein the content of the first and second substances,

zero key by splitting output line->

For the first and second subkeys, it can be ensured that the keys of the output lines of the two half-gates do not reveal the global key Δ of each party _i 。

For AND gates in the garbled circuit, there are:

the detailed description of the confusion party half gate and the evaluation party half gate is described below.

Confusion square half door:

since the mask values are random and shared in secret, the fact that an obfuscating party knows its mask value can be exploited to compute obfuscated half-gates in a multi-party security computing scenario. In the online evaluation phase, the obfuscator obtains an external value of the line x

From the above analysis, the confusing square half-gate is used to calculate:

note that the external value Λ is _x Calculated at the online stage, then the confuser half-gate is as follows:

wherein->

i∈[n]

By decryption

To verify the correctness of the equation to obtain the key for the output line, as follows:

evaluation of the square and half door:

in the on-line evaluation phase, the evaluator obtains the external value of the conductor

Similar to the confusing square half gate, the evaluating square half gate is used to calculate: />

Wherein the content of the first and second substances,

calculated in a manner similar to that of a confusing square half gate.

The emphasis of the above formula is: calculating Lambda _x ·Λ _y I.e. by

Because in the on-line evaluation phase,

and &>

Both are disclosed, therefore, Λ _x ·Λ _y Can be directly calculated in the online evaluation stage.

In addition, the calculation of Λ is also required _x ·Λ _y The corresponding key. Secure computing protocol at two participants, input line xNeed to be transferred to the key of the output line z when

The xor value of the key of the input line x and the key of the output line z needs to be calculated. In a multi-party secure computing scenario with n participants, the evaluator multiplies the number of keys of the input line x by the external value Λ during the online evaluation _y And then XOR the result with the key of output line z, then the half-gate of the evaluator is as follows:

wherein->

i∈[n]

By decryption

Obtain the requested value->

Corresponding key to verify the correctness of the above equation:

then, will

Key and external value a with input line x _y The XOR calculation is performed on the product of (a), the result of which is indeed the requested value @>

The corresponding key is:

after the confusion square half gate and the evaluation square half gate are calculated through the steps, the external value Lambda of the output line z can be obtained only by carrying out XOR on the confusion square half gate and the evaluation square half gate _z 。

To sum up, in the present application, all participants execute an optimized Tiny-OT protocol in parallel to generate a plurality of AND triples; the AND triple is used for generating relevant random information for constructing the confusion circuit without identity authentication AND for performing multiplication calculation of random shares in an online evaluation phase to decrypt the circuit; each participant P _i Carrying out linear combination on the commitment values of the plurality of AND triples to obtain a commitment combination result; each participant P _i Opens the commitment combination result AND checks the correctness of multiple AND triples. By processing the correctness check of the AND triples in batch in the optimized Tiny-OT protocol, the generation of the AND triples AND the correctness check are integrated into one protocol, the promised number of the correctness check of the AND triples AND the number of the called hash functions are reduced, AND the communication efficiency is optimized.

In the embodiment of the application, the MPC protocol is active and in a constant turn, uses the structure of SPDZ-BMR, is executed based on the optimized Tiny-OT protocol, and can tolerate any n-1 corruption parties. In the process of generating the confusion circuit, the secret sharing is generated by using the Tiny-OT with the message verification codes MACs, and the unverified confusion circuit is constructed based on the optimized Tiny-OT protocol distributed confusion, so that the verified information can be acquired without extra overhead.

In the embodiment of the application, the Half-Gate technology is introduced into the multi-party distributed confusion protocol, AND the Half-Gate technology is optimized AND compatible with the free-XOR technology, so that the confusion table of each AND Gate in the confusion circuit only consumes 2n bits of data transmission quantity, the size of the confusion table is reduced, AND the efficiency of the MPC protocol is improved.

Exemplary System

The embodiment of the application provides an optimization system of an efficient constant round secure multi-party computing protocol, wherein the secure multi-party computing protocol comprises a preprocessing stage and an online evaluation stage; the secure multiparty agreement has a plurality of participants, P _i Represents the ithThe value of i is 1,2 and … n; n represents the total number of participants; the system comprises: a generating unit 401, a combining unit 402 and an examining unit 403, wherein:

a generating unit 401 configured to execute the optimized Tiny-OT protocol in parallel by all participants to generate a plurality of AND triples; the AND triple is used for generating relevant random information for constructing the confusion circuit without identity authentication AND for performing multiplication calculation of random shares in an online evaluation phase to decrypt the circuit;

a combination unit 402 configured as each participant P _i Carrying out linear combination on the commitment values of the plurality of AND triples to obtain a commitment combination result;

a checking unit 403 configured to each participant P _i Opening the commitment combination result AND checking the correctness of the plurality of AND triples.

Each AND triple in the plurality of AND triples comprises a first secret share [ x ], a second secret share [ y ], AND a third secret share [ z ]; the generating unit 401 is further configured to:

first, each participant P _i Generating a global key delta ⁱ And is and

represents an exclusive or operation;

step S202, each participant P _i Obtaining a first secret share x by executing a related oblivious transport protocol COT]Second secret share [ y]Fourth secret sharing r](ii) a The first secret share [ x ]]Second secret share [ y]Fourth secret sharing r]Respectively comprise a participant P _i Held secret sharing value x _i 、y _i 、r _i And x _i 、y _i 、r _i Respectively corresponding message authentication code and x _i 、y _i 、r _i Respectively corresponding keys;

step S203, each participant P _i Locally calculating a first intermediate value

In the formula:

Each participant P _i Calculating a second intermediate value u _i,j ：

u _i,j ＝H(K _i [x ^j ],i||j||τ)

participant P _i Calculating a third intermediate value v _i,j ：

In the formula (I), the compound is shown in the specification,

participant P _i V is to be _i,j Is sent to p _j ；

Participant P _j Calculating a fourth intermediate value w _i,j ：

To obtain [ x ]]、[y]、[z]。

The optimization system for the efficient constant round secure multi-party computing protocol provided in the embodiment of the present application can implement the steps and flows of the optimization method for the efficient constant round secure multi-party computing protocol of any embodiment described above, and achieve the same technical effects, which are not described in detail herein.

The above description is only a preferred embodiment of the present application and is not intended to limit the present application, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An optimization method of an efficient constant round secure multi-party computing protocol is characterized in that the secure multi-party computing protocol comprises a preprocessing stage and an online evaluation stage; the secure multiparty agreement has a plurality of participants, P _i Representing the ith participant, wherein the value of i is 1,2 and … n; n represents the total number of participants; the method comprises the following steps:

executing the optimized Tiny-OT protocol in parallel by all the participants to generate a plurality of AND triples; the AND triple is used for generating relevant random information for constructing the confusion circuit without identity authentication AND for performing multiplication calculation of random shares in an online evaluation phase to decrypt the circuit;

2. The method for optimizing an efficient constant round secure multi-party computing protocol according to claim 1, wherein each AND-triple of the plurality of AND-triples comprises a first secret share [ x ], a second secret share [ y ], a third secret share [ z ]; executing the optimized Tiny-OT protocol to generate the τ -th AND-triple of the plurality of AND-triples comprises the following steps:

step S201, each participant P _i Generating a global key delta ⁱ And is and

wherein, delta ⁱ K is a k-bit binary number, and k is a preset safety parameter; lsb (. DELTA.s) ⁱ ) Is expressed by taking Δ ⁱ The last bit of (a);

represents an exclusive or operation;

step S203, each participant P _i Locally calculating a first intermediate value

In the formula:

represents P _i Held by y ^l A corresponding key; y is ^l Represents the ith participant P _l Second secret share held [ y]A value of (d); />

Represents P _i Held by y ⁱ A corresponding message authentication code; y is ⁱ Is P _i Second secret share held [ y]A value of (d); delta ⁱ As a global key delta ⁱ ；

Each participant P _i Calculating a second intermediate value u _i,j ：

u _i,j ＝H(K _i [x ^j ],i||j||τ)

participant P _i Calculating a third intermediate value v _i,j ：

In the formula (I), the compound is shown in the specification,

participant P _i V is to be _i,j Is sent to p _j ；

Participant P _j Calculating a fourth intermediate value w _i,j ：

wherein d = { d = _i }；d _i ＝lsb(U _i )；lsb(U _i ) Express and get U _i The last bit of (a);

step S207, when i ≠ 1, let [ z ≠ 1 ⁱ ] _i ＝[r ⁱ ] _i (ii) a Otherwise, make it

To obtain [ x ]]、[y]、[z]。

3. The method for optimizing an efficient constant round secure multiparty computing protocol according to claim 2, wherein in step S202, each of said participants P _i Obtaining a first secret share x by executing a related oblivious transport protocol COT]The method specifically comprises the following steps:

step S301, each participant P _i Generating a random bit sequence of length m

step S303, share [ x ] based on first secret]Fourth secret sharing o]For the global key Δ ⁱ Performing consistency verification, and if the consistency verification is passed, outputting a first outputSecret sharing x]。

4. The method for optimizing an efficient constant round secure multiparty computing protocol according to claim 3, wherein in step S303, the random share [ x ] is used as a basis]、[o]For the global key Δ ⁱ Performing consistency verification, including:

Each participant P _i Obtaining random zero sharing

Wherein +>

And the second mapping value

Broadcast to various participants;

each participant P _i According to the second mapping value

Reconstructing a third mapping value c;

5. The method for optimizing an efficient constant round secure multi-party computing protocol according to claim 1, wherein after all participants perform the optimized Tiny-OT protocol in parallel to generate a plurality of AND triples, the method further comprises:

grouping a plurality of AND triples;

pairing the plurality of combinations pairwise, for a first combination of the pairwise { [ x ] ₁ ],[y ₁ ],[z ₁ ]A second combination of { [ x ] and a pair ₂ ],[y ₂ ],[z ₂ ]Executing the following steps to eliminate leakage:

each participant P _i Examination of

The consistency of (2);

order to

[y]＝[y ₁ ]，/>

/>

AND triplets [ x ], [ y ], [ z ] are output, where [ z ] = [ x ] × [ y ].

6. The method for optimizing an efficient constant round secure multiparty computing protocol according to claim 1, wherein P is a policy for each participant _i After opening the commitment combination result AND checking the correctness of the plurality of AND triples, the method further comprises:

acquiring a Boolean circuit;

7. The method for optimizing an efficient constant round secure multiparty computation protocol according to claim 6, wherein the AND gate obfuscation table of the obfuscation circuit comprises an obfuscating half-gate and an evaluating half-gate; the AND gate of the garbled circuit comprises a first input line, a second input line and an output line;

the method further comprises the following steps:

calculating an obfuscating party half-gate and an evaluator half-gate based on the first sub-mask, the second sub-mask, the first sub-key and the second sub-key, respectively;

8. An optimization system of an efficient constant round secure multi-party computing protocol is characterized in that the secure multi-party computing protocol comprises a preprocessing stage and an online evaluation stage; the secure multiparty agreement has a plurality of participants, P _i Representing the ith participant, wherein the value of i is 1,2 and … n; n represents the total number of participants; the method comprises the following steps:

a combination unit configured to each participant P _i Carrying out linear combination on the commitment values of the plurality of AND triples to obtain a commitment combination result;

9. The system for efficient constant round secure multiparty computation protocol optimization according to claim 8,

each AND triple of the plurality of AND triples comprises a first secret share [ x ], a second secret share [ y ], AND a third secret share [ z ]; the generating unit is further configured to:

executing the optimized Tiny-OT protocol to generate the τ -th AND-triple of the plurality of AND-triples comprises the following steps:

step S201, each participant P _i Generating a global key delta ⁱ And is and

represents an exclusive or operation;

step S202, each participant P _i Obtaining a first secret share x by executing a related oblivious transport protocol COT]Second secret share [ y]Fourth secret sharing [ r ]](ii) a The first secret share [ x ]]Second secret share [ y]Fourth secret sharing r]Respectively comprise a participant P _i Held secret sharing value x _i 、y _i 、r _i And x _i 、y _i 、r _i Respectively corresponding message authentication code and x _i 、y _i 、r _i Respectively corresponding keys;

step S203, each participant P _i Locally calculating a first intermediate value