WO2023115602A1 - 基于半可信硬件的互相关伪随机数的远程获取方法及装置 - Google Patents

基于半可信硬件的互相关伪随机数的远程获取方法及装置 Download PDF

Info

Publication number
WO2023115602A1
WO2023115602A1 PCT/CN2021/141676 CN2021141676W WO2023115602A1 WO 2023115602 A1 WO2023115602 A1 WO 2023115602A1 CN 2021141676 W CN2021141676 W CN 2021141676W WO 2023115602 A1 WO2023115602 A1 WO 2023115602A1
Authority
WO
WIPO (PCT)
Prior art keywords
commitment
cross
pseudo
random
value
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2021/141676
Other languages
English (en)
French (fr)
Inventor
张秉晟
卢益彪
刘巍然
任奎
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Zhejiang University
ZJU Hangzhou Global Scientific and Technological Innovation Center
Original Assignee
Zhejiang University
ZJU Hangzhou Global Scientific and Technological Innovation Center
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Zhejiang University, ZJU Hangzhou Global Scientific and Technological Innovation Center filed Critical Zhejiang University
Publication of WO2023115602A1 publication Critical patent/WO2023115602A1/zh
Priority to US18/536,280 priority Critical patent/US11947930B1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
    • G06F7/58—Random or pseudo-random number generators
    • G06F7/582—Pseudo-random number generators
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3218—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/30—Compression, e.g. Merkle-Damgard construction
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/065—Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
    • H04L9/0656—Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/065—Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
    • H04L9/0656—Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher
    • H04L9/0662—Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher with particular pseudorandom sequence generator

Definitions

  • the present application relates to the field of privacy protection data processing, in particular to a method and device for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware.
  • Secure Multi-party Computation (MPC) technology allows multiple distrusting parties to collaboratively calculate a pre-agreed function without disclosing any information other than the function output, such as the private input of the parties.
  • correlated randomness is often used as an integral part of the protocol. For example, both Random Oblivious Transfer (ROT) and multiplicative triples (Beaver triples) can be viewed as cross-correlated pseudorandom numbers.
  • ROT Random Oblivious Transfer
  • Beaver triples can be viewed as cross-correlated pseudorandom numbers.
  • the purpose of the embodiment of the present application is to provide a method and device for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware, so as to solve the problem in the related art that it cannot transmit polynomial quantities to remote participants under low communication overhead.
  • Technical issues of cross-correlated pseudorandom numbers are to provide a method and device for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware, so as to solve the problem in the related art that it cannot transmit polynomial quantities to remote participants under low communication overhead.
  • a method for remotely obtaining a cross-correlated pseudo-random number based on semi-trusted hardware is provided, which is applied to semi-trusted hardware, including:
  • the Merkle proof verifies the first commitment value and verifies the cross-correlation pseudo-random number corresponding to the selection number according to the first commitment value and the first opening value after verification.
  • obtain the random seed of the sender and the selection number of the receiver including:
  • first cross-correlation pseudo-random numbers and first commitment seeds including:
  • the second pseudo-random seed generate several first commitment seeds, wherein the quantity of the first commitment seeds is the same as the quantity of the first cross-correlation pseudo-random number.
  • a device for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware which is applied to semi-trusted hardware, including:
  • the first obtaining module is used to obtain the random seed of the sender and the selection number of the receiver;
  • the first generation module is used to generate several first cross-correlation pseudo-random numbers and first commitment seeds according to the random seed and a predetermined cross-correlation pseudo-random number type;
  • the second generation module is used to generate a first commitment value and a first opening value by using a commitment mechanism according to the plurality of first cross-correlation pseudo-random numbers and the first commitment seed;
  • the third generation module is used to generate Merkle proof according to the first commitment value and selection number
  • the first sending module is used to send the first cross-correlation pseudo-random number corresponding to the selected number, the first commitment value, the first opening value and the Merkle proof to the receiver, so that The Merkle root hash and the Merkle proof verify the first commitment value and pair the cross-correlation pseudo-random number corresponding to the selected number according to the first commitment value and the first opening value after the verification is passed. number to verify.
  • a method for remotely obtaining a cross-correlated pseudo-random number based on semi-trusted hardware is provided, which is applied to the sender, including:
  • the random seed is encrypted and sent to the receiver, so that the receiver sends the sender's encrypted random seed and the receiver's selection number to the semi-trusted hardware, so that the semi-trusted hardware
  • the relevant pseudo-random number, first commitment value, first opening value and Merkle proof are sent to the receiver;
  • a device for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware which is applied to the sender, including:
  • a first verification module configured to verify the semi-trusted hardware and obtain a symmetric key shared with the semi-trusted hardware
  • the second sending module is used to encrypt the random seed and send it to the receiver according to the symmetric key, so that the receiver sends the encrypted random seed of the sender and the selection number of the receiver to the semi-trusted hardware, thereby Make the semi-trusted hardware obtain the random seed of the sender and the selection number of the receiver; generate several first cross-correlation pseudo-random numbers and first commitment seeds according to the random seed and predetermined cross-correlation pseudo-random number types; The plurality of first cross-correlation pseudo-random numbers and the first commitment seed use the commitment mechanism to generate the first commitment value and the first opening value; according to the first commitment value and the selection number, a Merkle proof is generated; the The first cross-correlation pseudo-random number corresponding to the selection number, the first commitment value, the first opening value and the Merkle proof are sent to the receiver;
  • the fourth generation module is used to generate several second cross-correlation pseudo-random numbers and second commitment seeds according to the random seed and the predetermined cross-correlation pseudo-random number type;
  • a fifth generation module configured to generate a second commitment value according to the plurality of second cross-correlated pseudo-random numbers and the second commitment seed
  • a sixth generating module configured to generate a Merkle root hash according to the second commitment value
  • the third sending module is configured to send the Merkle root hash to the recipient, so that the recipient verifies the first commitment value according to the Merkle root hash and the Merkle proof and The cross-correlation pseudo-random number corresponding to the selection number is verified by the first commitment value and the first opening value after verification.
  • a method for remotely obtaining a cross-correlated pseudo-random number based on semi-trusted hardware is provided, which is applied to the receiver, including:
  • a device for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware which is applied to the receiver, including:
  • the receiving module is used to receive the encrypted random seed sent by the sender
  • the fourth sending module is used to send the encrypted random seed and selection number to the semi-trusted hardware, so that the semi-trusted hardware obtains the random seed of the sender and the selection number of the receiver;
  • Related pseudo-random number types generate several first cross-correlation pseudo-random numbers and first commitment seeds; use commitment mechanism to generate first commitment value and first open value; according to the first commitment value and selection number, generate a Merkle proof; send the first cross-correlation pseudo-random number, the first commitment value, the first opening value and the Merkle proof corresponding to the selection number to receiver;
  • the second verification module is configured to verify the first commitment value according to the Merkle root hash sent by the sender and the Merkle proof, and to verify the first commitment value and the first open The value is verified against the cross-correlated pseudo-random number corresponding to the selected number.
  • an electronic device including:
  • processors one or more processors
  • memory for storing one or more programs
  • the one or more processors When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of the first aspect, the third aspect, or the fifth aspect.
  • a computer-readable storage medium on which computer instructions are stored, which is characterized in that, when the instructions are executed by a processor, the first aspect, the third aspect, or the fifth aspect are implemented. The steps of any one of the methods.
  • the application reduces the communication traffic of long-distance transmission of cross-correlation pseudo-random numbers by using semi-trusted hardware, allowing the sender to transmit polynomial-level cross-correlation pseudo-random numbers to the remote receiver with a constant level of traffic.
  • the commitment mechanism is used to generate the first commitment value and the first opening value, and the commitment mechanism is used to ensure the correctness of the output of the semi-trusted hardware, and at the same time prevent the receiving
  • the party obtains the private information that should not be obtained from the output of the semi-trusted hardware; according to the first commitment value and the selected number, a Merkle proof is generated and the receiver makes the Merkle root hash sent by the sender and the The above-mentioned Merkle proof verifies the first commitment value, and through the Merkle tree technology, while ensuring the security of information transmission, the sender only needs a constant level of traffic to send verification information to the remote receiver , and the receiver only needs logarithmic calculation and storage space to verify the output results of the trusted hardware.
  • Fig. 1 is a flow chart of a method for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware (applied to semi-trusted hardware) according to an exemplary embodiment.
  • Fig. 2 is a flowchart of step S11 shown according to an exemplary embodiment.
  • Fig. 3 is a flow chart of step S12 according to an exemplary embodiment.
  • Fig. 4 is a block diagram of a device for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware (applied to semi-trusted hardware) according to an exemplary embodiment.
  • Fig. 5 is a flow chart of a method for remotely obtaining a cross-correlated pseudo-random number based on semi-trusted hardware (applied to a sender) according to an exemplary embodiment.
  • Fig. 6 is a block diagram of a device for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware (applied to a sender) according to an exemplary embodiment.
  • Fig. 7 is a flow chart of a method for remotely acquiring cross-correlated pseudo-random numbers based on semi-trusted hardware (applied to a receiver) according to an exemplary embodiment.
  • Fig. 8 is a block diagram of a device (applied to a receiver) for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware according to an exemplary embodiment.
  • first, second, third, etc. may be used in this application to describe various information, the information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of the present application, first information may also be called second information, and similarly, second information may also be called first information. Depending on the context, the word “if” as used herein may be interpreted as “at” or “when” or “in response to a determination.”
  • trusted hardware can directly obtain the privacy input of all users, and when the hardware manufacturer is not trusted, it can steal the user's private information and change the calculation process by embedding a backdoor.
  • hardware manufacturers can embed information in cryptographic measures generated by trusted hardware by means of electronic steganography. When a remote participant forwards the cryptographic measures to a third-party authentication server provided by the hardware manufacturer, the hardware manufacturer The manufacturer can obtain private information from it; and when the user invokes trusted hardware for calculation, the hardware manufacturer can specify its running results at will.
  • trusted hardware still plays a protective role for the protocol participants: the local participant cannot obtain the private input of the remote participant by attacking the trusted hardware, and cannot control the computing process of the trusted hardware, tamper with the
  • hardware manufacturers have the ability to obtain the private input sent by users to trusted hardware and change the output results of trusted hardware, so we call such hardware semi-trusted hardware.
  • user B wants to obtain a certain pseudo-random number at a specific position in a series of cross-correlated pseudo-random numbers from user A.
  • User B holds a semi-trusted hardware device, and the output of the semi-trusted hardware device needs to be verified.
  • user A and user B can obtain a certain cross-correlation pseudo-random number at a specific location through the remote acquisition method of cross-correlation pseudo-random number based on semi-trusted hardware shown below.
  • User A is the sender and User B is the receiver.
  • the semi-trusted hardware can be placed inside the receiver, or a high-speed connection can be established with the receiver.
  • placing semi-trusted hardware inside the receiver, or establishing a high-speed connection between the semi-trusted hardware and the receiver can make the semi-trusted hardware and the receiver operate at low latency. It communicates and transmits data in a high-bandwidth channel, thereby improving the overall performance of the protocol.
  • Fig. 1 is a flow chart of a method for remotely obtaining a cross-correlated pseudo-random number based on semi-trusted hardware according to an exemplary embodiment. As shown in Fig. 1, the method is applied to semi-trusted hardware and may include The following steps:
  • Step S11 Obtain the random seed of the sender and the selection number of the receiver
  • Step S12 Generate a number of first cross-correlation pseudo-random numbers and first commitment seeds according to the random seed and the predetermined type of cross-correlation pseudo-random numbers;
  • Step S13 Using the commitment mechanism to generate a first commitment value and a first opening value according to the plurality of first cross-correlated pseudo-random numbers and the first commitment seed;
  • Step S14 Generate a Merkle proof according to the first commitment value and selection number
  • Step S15 Send the first cross-correlation pseudo-random number corresponding to the selected number, the first commitment value, the first opening value and the Merkle proof to the recipient, so that the recipient can
  • the hash and the Merkle proof verify the first commitment value and verify the cross-correlation pseudo-random number corresponding to the selected number according to the first commitment value and the first opening value after verification.
  • the application reduces the communication traffic of long-distance transmission of cross-correlation pseudo-random numbers by using semi-trusted hardware, allowing the sender to transmit polynomial-level cross-correlation pseudo-random numbers to the remote receiver with a constant level of traffic.
  • the commitment mechanism is used to generate the first commitment value and the first opening value, and the commitment mechanism is used to ensure the correctness of the output of the semi-trusted hardware, and at the same time prevent the receiving
  • the party obtains the private information that should not be obtained from the output of the semi-trusted hardware; according to the first commitment value and the selected number, a Merkle proof is generated and the receiver makes the Merkle root hash sent by the sender and the The above-mentioned Merkle proof verifies the first commitment value, and through the Merkle tree technology, while ensuring the security of information transmission, the sender only needs a constant level of traffic to send verification information to the remote receiver , and the receiver only needs logarithmic calculation and storage space to verify the output results of the trusted hardware.
  • step S11 the random seed of the sender and the selection number of the receiver are obtained
  • this step includes the following sub-steps:
  • Step S21 Receive the encrypted random seed of the sender and the random number of the receiver
  • the semi-trusted hardware receives the sender's encrypted random seed and the receiver's random number sent by the receiver, where the sender's encrypted random seed is sent by the sender to the receiver.
  • the function of this step is to let user A
  • the semi-trusted hardware of user B can communicate indirectly, while preventing user B from stealing user A's random seed.
  • Step S22 Decrypt the encrypted random seed according to the symmetric key of the sender and the semi-trusted hardware
  • Step S23 verifying the decrypted result
  • Step S24 If the verification is passed, the random seed of the sender is obtained.
  • the semi-trusted hardware uses the symmetric key of the sender and the semi-trusted hardware as the decryption key, and uses the encrypted random seed as the ciphertext to call the message authentication code used by the sender.
  • the decryption algorithm corresponding to the symmetric encryption algorithm is used for decryption.
  • the decryption algorithm will verify the integrity of the message. If the verification is passed, the random seed of the plaintext will be output.
  • the function of this step is to allow user B's semi-trusted hardware to receive the random seed sent by user A, and at the same time prevent user B from tampering with the random seed.
  • step S12 several first cross-correlation pseudo-random numbers and first commitment seeds are generated according to the random seed and the predetermined type of cross-correlation pseudo-random numbers;
  • this step includes the following sub-steps:
  • Step S31 expanding the random seed into a first pseudo-random seed and a second pseudo-random seed
  • a pseudorandom function (pseudorandom function, PRF) is used as a pseudorandom number generator.
  • PRF pseudorandom function
  • a pseudorandom function is a deterministic function PRF defined on (K,X,Y) that can be calculated in polynomial time based on c:K ⁇ X ⁇ Y, where K is the key space, That is, the space composed of all strings with a length of c bits, X is the input space, and Y is the output space.
  • the pseudo-random function is indistinguishable from the real random function.
  • the function space composed of all functions defined on the input space X and the output space Y is denoted as F.
  • the pseudorandom function PRF(k, ⁇ ) and f( ⁇ ) cannot be distinguished in polynomial time.
  • Step S32 Generate several first cross-correlation pseudo-random numbers according to the predetermined type of cross-correlation pseudo-random numbers and the first pseudo-random seed;
  • the first pseudo-random seed s1 is used to generate the first cross-correlation pseudo-random number, denoted as m 1 ,...,m n .
  • the first pseudo-random seed s1 can be used to generate the line label and the confusion seed respectively according to the different optimization forms required, and then the confusion seed can be used according to the circuit
  • the definition encrypts the line labels one by one to generate an obfuscation table for each gate. Since the first pseudo-random seed s1 is indistinguishable from the real random number, even if the receiver knows how the cross-correlation pseudo-random number is generated, it cannot know any information about the generated cross-correlation pseudo-random number.
  • Step S33 Generate several first commitment seeds according to the second pseudo-random seeds, wherein the number of the first commitment seeds is the same as the number of the first cross-correlation pseudo-random numbers;
  • step S13 according to the plurality of first cross-correlated pseudo-random numbers and the first commitment seed, a commitment mechanism is used to generate a first commitment value and a first opening value;
  • commitment mechanism multiple implementations of the commitment mechanism can be used, and all commitment values and open values can be generated by traversing i from 1 to n, where n is the number of the first cross-correlation pseudo-random numbers.
  • r i ), and the first opening value is d i m i
  • the Pederson commitment mechanism based on the discrete logarithm assumption can be adopted, and the multiplicative group G whose order is a large prime number q is pre-agreed.
  • the receiver cannot obtain any information about the cross-correlated pseudo-random number from the committed value, and due to the discrete logarithm assumption, once the semi-trusted hardware gives the committed value, it cannot Find other m i ′ and ri ′ such that Therefore, it can be guaranteed that the semi-trusted hardware cannot forge false cross-correlated pseudo-random numbers that can be verified by the commitment mechanism.
  • step S14 a Merkle proof is generated according to the first commitment value and the selection number
  • a Merkle tree is generated by using all the first commitment values, and a corresponding Merkle proof is generated according to the selection number.
  • the number of the first cross-correlation pseudo-random numbers is 2 d , and if the number is not an exponent of 2, fill up to an exponent of 2 with empty messages.
  • the Merkle proof is that, on the path from the first-level Merkle tree node corresponding to the selected number to the root node of the Merkle tree on the d+1 layer, the values of all sibling nodes, for example, if the selected number is 1, then the corresponding Merkle proof is The value of these nodes.
  • step S15 the first cross-correlation pseudo-random number corresponding to the selected number, the first commitment value, the first opening value and the Merkle proof are sent to the receiver, so that the receiver sends
  • the Merkle root hash and the Merkle proof are used to verify the first commitment value and the cross-correlation pseudo-correlation corresponding to the selected number according to the first commitment value and the first opening value after the verification is passed. Random number for verification.
  • the Merkle root hash is generated by the sender according to the second commitment value
  • the second commitment value is generated according to a number of second cross-correlation pseudo-random numbers and a second commitment seed
  • the related pseudo-random number and the second commitment seed are generated according to the random seed and a predetermined type of cross-correlation pseudo-random number
  • the second cross-correlation pseudo-random number is the same as the first cross-correlation pseudo-random number
  • the second commitment seed The same as the first commitment seed
  • the second commitment value is the same as the first commitment value.
  • the recipient first uses the Merkle root hash and the Merkle proof to verify the first commitment value.
  • the receiver invokes the hash function H on the first commitment value as the first layer of Merkle tree nodes corresponding to the number of selections, and then the receiver reads the Merkle tree nodes in the Merkle proof one by one.
  • the currently held Merkle tree node and the Merkle tree node read from the Merkle proof call the hash function H to get the Merkle tree node of the next layer, so as to get the root node of the Merkle tree value, and compare it with the Merkle root hash, and if they are the same, the verification is passed.
  • the hash function is invoked on the first commitment value to obtain the first layer of Merkle tree nodes Then traverse i from 1 to d, and read one by one from the Merkle proof and with Call the hash function together to get Finally will Compare with the Merkle root hash, if they are the same, the verification is passed.
  • the receiver uses the first commitment value and the first opening value to verify the cross-correlation pseudo-random number corresponding to the selected number, and the specific verification method needs to correspond to the aforementioned commitment implementation method .
  • the first open value contains the cross-correlation pseudo-random number corresponding to the selected number and the commitment seed corresponding to the selected number
  • the receiver verifies the value contained in the first open value Whether the cross-correlation pseudo-random number is the same as the cross-correlation pseudo-random number received by oneself, after the verification is passed, call the hash function H on the first open value, and verify whether the output result is the same as the first commitment value, if they are the same, the whole verification process Pass; for the Pederson commitment mechanism, the receiver computes And verify whether c i is the same as the first commitment value, and if they are the same, all verification processes pass.
  • the present application also provides embodiments of a device for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware.
  • Fig. 4 is a block diagram of a device for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware according to an exemplary embodiment. Referring to Figure 4, the device is applied to semi-trusted hardware, including
  • the first obtaining module 21 is used to obtain the random seed of the sender and the selection number of the receiver;
  • the first generation module 22 is used to generate several first cross-correlation pseudo-random numbers and first commitment seeds according to the random seed and a predetermined cross-correlation pseudo-random number type;
  • the second generating module 23 is configured to generate a first committed value and a first open value by using a committed mechanism according to the plurality of first cross-correlated pseudo-random numbers and the first committed seed;
  • the third generating module 24 is configured to generate a Merkle proof according to the first commitment value and the selection number;
  • the first sending module 25 is configured to send the first cross-correlation pseudo-random number corresponding to the selected number, the first commitment value, the first opening value, and the Merkle proof to the receiver, so that the receiver sends
  • the Merkle root hash and the Merkle proof are used to verify the first commitment value and the cross-correlation pseudo-correlation corresponding to the selected number according to the first commitment value and the first opening value after the verification is passed. Random number for verification.
  • Fig. 5 is a flow chart of a method for remotely obtaining a cross-correlated pseudo-random number based on semi-trusted hardware according to an exemplary embodiment. As shown in Fig. 5, the method is applied to the sender and may include the following steps:
  • Step S41 Verifying the semi-trusted hardware and obtaining a symmetric key shared with the semi-trusted hardware
  • user A initiates multiple rounds of challenge and challenge requests to user B, and user B forwards these challenge and challenge requests to semi-trusted hardware, and the semi-trusted hardware responds to these requests , User B forwards the response information to User A, and User A verifies the authenticity and usability of the semi-trusted hardware by communicating with the third-party trusted server provided by the hardware manufacturer.
  • Step S42 According to the symmetric key, encrypt the random seed and send it to the receiver, so that the receiver sends the sender's encrypted random seed and the receiver's selection number to the semi-trusted hardware, so that the semi-trusted hardware
  • the trusted hardware obtains the random seed of the sender and the selection number of the receiver; generates several first cross-correlation pseudo-random numbers and first commitment seeds according to the random seed and predetermined types of cross-correlation pseudo-random numbers; A cross-correlated pseudo-random number and the first commitment seed, using the commitment mechanism to generate the first commitment value and the first opening value; according to the first commitment value and the selection number, generate a Merkle proof; The first cross-correlation pseudo-random number, the first commitment value, the first opening value and the Merkle proof are sent to the receiver;
  • a symmetric encryption algorithm with a message authentication code is used to encrypt the random seed, such as the AES-GCM algorithm. Then the encrypted random seed is sent to the receiver, so that the receiver sends the encrypted random seed of the sender and the selection number of the receiver to the semi-trusted hardware, so that the semi-trusted hardware executes the process of steps S11-S15.
  • Step S43 Generate several second cross-correlation pseudo-random numbers and second commitment seeds according to the random seed and the predetermined type of cross-correlation pseudo-random numbers;
  • step S12 the generating process is the same as step S12, and will not be repeated here.
  • Step S44 Generate a second commitment value according to the plurality of second cross-correlated pseudo-random numbers and the second commitment seed;
  • the generation process of the second commitment value is the same as the generation process of the first commitment value in step S13, which will not be repeated here.
  • Step S45 Generate a Merkle root hash according to the second commitment value
  • a Merkle tree is generated by using all the second commitment values, and a Merkle root hash is generated according to the Merkle tree.
  • Step S46 Send the Merkle root hash to the receiver, so that the receiver verifies the first commitment value according to the Merkle root hash sent by the sender and the Merkle proof, and according to The cross-correlation pseudo-random number corresponding to the selection number is verified by the first commitment value and the first opening value after verification.
  • step S15 the verification process by the recipient has been explained in step S15, and will not be repeated here.
  • the present application also provides embodiments of a device for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware.
  • Fig. 6 is a block diagram of a device for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware according to an exemplary embodiment.
  • the device is applied to the sender, including:
  • the first verification module 31 is configured to verify the semi-trusted hardware and obtain a symmetric key shared with the semi-trusted hardware;
  • the second sending module 32 is used to encrypt the random seed and send it to the receiver according to the symmetric key, so that the receiver sends the encrypted random seed of the sender and the selection number of the receiver to the semi-trusted hardware, Therefore, the semi-trusted hardware obtains the random seed of the sender and the selection number of the receiver; according to the random seed and the predetermined type of cross-correlation pseudo-random numbers, generate several first cross-correlation pseudo-random numbers and first commitment seeds; According to the plurality of first cross-correlation pseudo-random numbers and the first commitment seed, use the commitment mechanism to generate the first commitment value and the first opening value; according to the first commitment value and the selection number, generate a Merkle proof; The first cross-correlation pseudo-random number, first commitment value, first opening value and Merkle proof corresponding to the selected number are sent to the receiver;
  • the fourth generation module 33 is used to generate several second cross-correlation pseudo-random numbers and second commitment seeds according to the random seed and the predetermined cross-correlation pseudo-random number type;
  • a fifth generating module 34 configured to generate a second commitment value according to the plurality of second cross-correlated pseudo-random numbers and the second commitment seed;
  • a sixth generation module 35 configured to generate a Merkle root hash according to the second commitment value
  • the third sending module 36 is configured to send the Merkle root hash to the recipient, so that the recipient verifies the first commitment value according to the Merkle root hash and the Merkle proof and The cross-correlation pseudo-random number corresponding to the selection number is verified according to the first commitment value and the first opening value after verification.
  • Fig. 7 is a flow chart of a method for remotely obtaining a cross-correlated pseudo-random number based on semi-trusted hardware according to an exemplary embodiment. As shown in Fig. 7, the method is applied to the receiver and may include the following steps:
  • Step S51 Receive the encrypted random seed sent by the sender
  • Step S52 Send the encrypted random seed and selection number to the semi-trusted hardware, so that the semi-trusted hardware obtains the random seed of the sender and the selection number of the receiver; type, generate several first cross-correlation pseudo-random numbers and first commitment seeds; according to the first cross-correlation pseudo-random numbers and first commitment seeds, use the commitment mechanism to generate the first commitment value and the first opening value; according to the The first commitment value and selection number are used to generate a Merkle proof; the first cross-correlation pseudo-random number corresponding to the selection number, the first commitment value, the first opening value and the Merkle proof are sent to the receiver;
  • Step S53 Verify the first commitment value according to the Merkle root hash sent by the sender and the Merkle proof, and verify the first commitment value and the first opening value after verification. The cross-correlation pseudo-random number corresponding to the selected number is verified.
  • steps S51-S53 has been explained above and will not be repeated here.
  • the present application also provides embodiments of a device for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware.
  • Fig. 8 is a block diagram of a device for remotely obtaining cross-correlated pseudo-random numbers based on semi-trusted hardware according to an exemplary embodiment. Referring to Figure 8, the device is applied to the receiver, including:
  • the receiving module 41 is used to receive the encrypted random seed sent by the sender
  • the fourth sending module 42 is used to send the encrypted random seed and selection number to the semi-trusted hardware, so that the semi-trusted hardware obtains the random seed of the sender and the selection number of the receiver; Types of cross-correlation pseudo-random numbers, generate several first cross-correlation pseudo-random numbers and first commitment seeds; use the commitment mechanism to generate first commitment values and first Open the value; generate a Merkle proof according to the first commitment value and the selection number; send the first cross-correlation pseudo-random number, the first commitment value, the first opening value and the Merkle proof corresponding to the selection number to the recipient;
  • the second verification module 43 is configured to verify the first commitment value according to the Merkle root hash sent by the sender and the Merkle proof, and to verify the first commitment value and the first The open value verifies the cross-correlation pseudo-random number corresponding to the selected number.
  • the device embodiment since it basically corresponds to the method embodiment, for related parts, please refer to the part description of the method embodiment.
  • the device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to realize the purpose of the scheme of this application. It can be understood and implemented by those skilled in the art without creative effort.
  • the present application also provides an electronic device, including: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors , so that the one or more processors implement the method for remotely acquiring interrelated pseudo-random numbers based on semi-trusted hardware as described above.
  • the present application also provides a computer-readable storage medium on which computer instructions are stored, which is characterized in that, when the instructions are executed by a processor, remote Get method.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Pure & Applied Mathematics (AREA)
  • Computational Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种基于半可信硬件的互相关伪随机数的远程获取方法及装置，该方法应用于半可信硬件时包括：获取发送方的随机种子和接收方的选择数（S11）；根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子（S12）；根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值（S13）；根据所述第一承诺值和选择数，生成梅克尔证明（S14）；将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方，以使得接收方根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证（S15）。

Description

基于半可信硬件的互相关伪随机数的远程获取方法及装置 技术领域
本申请涉及隐私保护数据处理领域，尤其涉及基于半可信硬件的互相关伪随机数的远程获取方法及装置。
背景技术
安全多方计算(Secure Multi-party Computation，MPC)技术可以让多个互不信任的参与方协同计算一个预先商定好的函数，同时不泄露除了函数输出以外的任何信息，如参与方的隐私输入。在安全多方计算协议中，常会使用互相关伪随机数(correlated randomness)作为协议的组成部分。例如，随机不经意传输(Random Oblivious Transfer，ROT)和乘法三元组(Beaver triple)都可以被视为互相关伪随机数。
由于协议的参与方互不信任，且往往都是通过远程信道进行连接，如何生成互相关伪随机数并让参与方获取适当的互相关伪随机数需要经过仔细考虑。目前，一种普遍的做法是让协议的各个参与方运行一个简单的安全多方计算协议，这个协议的作用就是让各个参与方得到相应的互相关伪随机数，而在这个协议中，各个参与方的输入与计算函数时的输入无关，因此这个协议的运行可以在参与方得到函数输入之前，也就是计算的离线阶段(offline phase)。另一种做法是使用半可信硬件，通过向可信硬件输入互相关伪随机数的生成种子和各个参与方需要获取的互相关伪随机数，可以使得半可信硬件直接向各个参与方输出相应的互相关伪随机数。
然而，在实现本发明的过程中，发明人发现现有技术中至少存在如下问题：
对于使用安全多方计算协议生成互相关伪随机数的技术，这一方法需要的通讯量大、通讯轮次多，在实际运行过程中耗时长，导致参与方需要在正式计算前运行协议生成互相关伪随机数，而无法做到在需要进行计算时直接执行用于计算的安全多方计算协议，并且，生成的互相关伪随机数需要在存储介质中长期保存，造成较大的开销；对于使用半可信硬件生成互相关伪随机数的技术，这一方法引入了额外的可信根，依赖于半可信硬件会正确生成互相关伪随机数并输出结果的假设，但如果这一假设不成立，就会影响整体安全多方计算协议 的正确性。总的来说，现有技术或是存在通讯量大、通讯轮次多、耗时长的问题，或是存在获取的互相关伪随机数正确性无法保证的问题，难以兼顾效率和正确性。
发明内容
本申请实施例的目的是提供基于半可信硬件的互相关伪随机数的远程获取方法及装置，以解决相关技术中存在的无法在低通讯量开销下向远程的参与方传输多项式数量级别的互相关伪随机数的技术问题。
根据本申请实施例的第一方面，提供一种基于半可信硬件的互相关伪随机数的远程获取方法，应用于半可信硬件，包括：
获取发送方的随机种子和接收方的选择数；
根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；
根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；
根据所述第一承诺值和选择数，生成梅克尔证明；
将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方，以使得接收方根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
进一步地，获取发送方的随机种子和接收方的选择数，包括：
接收发送方的加密随机种子和接收方的随机数；
根据发送方和半可信硬件的对称密钥，对所述加密随机种子进行解密；
对解密得到的结果进行验证；
若验证通过，则获得发送方的随机种子。
进一步地，根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子，包括：
将所述随机种子扩展为第一伪随机种子和第二伪随机种子；
根据所述预定互相关伪随机数种类和第一伪随机种子，生成若干第一互相关伪随机数；
根据所述第二伪随机种子，生成若干第一承诺种子，其中所述第一承诺种 子的数量与所述第一互相关伪随机数的数量相同。
根据本申请实施例的第二方面，提供一种基于半可信硬件的互相关伪随机数的远程获取装置，应用于半可信硬件，包括：
第一获取模块，用于获取发送方的随机种子和接收方的选择数；
第一生成模块，用于根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；
第二生成模块，用于根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；
第三生成模块，用于根据所述第一承诺值和选择数，生成梅克尔证明；
第一发送模块，用于将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方，以使得接收方根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
根据本申请实施例的第三方面，提供一种基于半可信硬件的互相关伪随机数的远程获取方法，应用于发送方，包括：
对所述半可信硬件进行验证并得到与所述半可信硬件共享的对称密钥；
根据所述对称密钥，对随机种子进行加密并发送至接收方，以使得接收方将发送方的加密随机种子和接收方的选择数发送至半可信硬件，从而使得所述半可信硬件获取发送方的随机种子和接收方的选择数；根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；根据所述第一承诺值和选择数，生成梅克尔证明；将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方；
根据所述随机种子和预定互相关伪随机数种类，生成若干第二互相关伪随机数和第二承诺种子；
根据所述若干第二互相关伪随机数和第二承诺种子，生成第二承诺值；
根据所述第二承诺值，生成梅克尔根哈希；
将所述梅克尔根哈希发送至接收方，以使得接收方根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
根据本申请实施例的第四方面，提供一种基于半可信硬件的互相关伪随机数的远程获取装置，应用于发送方，包括：
第一验证模块，用于对所述半可信硬件进行验证并得到与所述半可信硬件共享的对称密钥；
第二发送模块，用于根据所述对称密钥，对随机种子进行加密并发送至接收方，以使得接收方将发送方的加密随机种子和接收方的选择数发送至半可信硬件，从而使得所述半可信硬件获取发送方的随机种子和接收方的选择数；根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；根据所述第一承诺值和选择数，生成梅克尔证明；将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方；
第四生成模块，用于根据所述随机种子和预定互相关伪随机数种类，生成若干第二互相关伪随机数和第二承诺种子；
第五生成模块，用于根据所述若干第二互相关伪随机数和第二承诺种子，生成第二承诺值；
第六生成模块，用于根据所述第二承诺值，生成梅克尔根哈希；
第三发送模块，用于将所述梅克尔根哈希发送至接收方，以使得接收方根据所述梅克尔根哈希和梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
根据本申请实施例的第五方面，提供一种基于半可信硬件的互相关伪随机数的远程获取方法，应用于接收方，包括：
接收发送方发送的加密随机种子；
将所述加密随机种子和选择数发送至半可信硬件，以使得半可信硬件获取发送方的随机种子和接收方的选择数；根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；根据所述第一承诺值和选择数，生成梅克尔证明；将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方；
根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行 验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
根据本申请实施例的第六方面，提供一种基于半可信硬件的互相关伪随机数的远程获取装置，应用于接收方，包括：
接收模块，用于接收发送方发送的加密随机种子；
第四发送模块，用于将所述加密随机种子和选择数发送至半可信硬件，以使得半可信硬件获取发送方的随机种子和接收方的选择数；根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；根据所述第一承诺值和选择数，生成梅克尔证明；将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方；
第二验证模块，用于根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
根据本申请实施例的第七方面，提供一种电子设备，包括：
一个或多个处理器；
存储器，用于存储一个或多个程序；
当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现如第一方面或第三方面或第五方面任一项所述的方法。
根据本申请实施例的第八方面，提供一种计算机可读存储介质，其上存储有计算机指令，其特征在于，该指令被处理器执行时实现如第一方面或第三方面或第五方面中任一项所述方法的步骤。
本申请的实施例提供的技术方案可以包括以下有益效果：
由上述实施例可知，本申请通过使用半可信硬件，降低了远程传输互相关伪随机数的通讯量，允许发送方以常数级别的通讯量向远程的接收方传输多项式级别数量的互相关伪随机数；根据若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值，通过承诺机制保证半可信硬件输出的正确性，同时也防止了接收方从半可信硬件的输出中获取不应该获得的隐私信息；根据所述第一承诺值和选择数，生成梅克尔证明并使得接收方根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证，通过 梅克尔树技术，在确保信息传输安全性的同时使得发送方只需要常数级别的通讯量就可以向远程的接收方发送验证信息，而接收方只需要对数级别的计算量和存储空间就可以对可信硬件的输出结果进行验证。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本申请。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本申请的实施例，并与说明书一起用于解释本申请的原理。
图1是根据一示例性实施例示出的一种基于半可信硬件的互相关伪随机数的远程获取方法(应用于半可信硬件)的流程图。
图2是根据一示例性实施例示出的步骤S11的流程图。
图3是根据一示例性实施例示出的步骤S12的流程图。
图4是根据一示例性实施例示出的一种基于半可信硬件的互相关伪随机数的远程获取装置(应用于半可信硬件)的框图。
图5是根据一示例性实施例示出的一种基于半可信硬件的互相关伪随机数的远程获取方法(应用于发送方)的流程图。
图6是根据一示例性实施例示出的一种基于半可信硬件的互相关伪随机数的远程获取装置(应用于发送方)的框图。
图7是根据一示例性实施例示出的一种基于半可信硬件的互相关伪随机数的远程获取方法(应用于接收方)的流程图。
图8是根据一示例性实施例示出的一种基于半可信硬件的互相关伪随机数的远程获取装置(应用于接收方)的框图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本申请的一些方面相一致的装置和方法的例子。
在本申请使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本 申请。在本申请和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本申请可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本申请范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
首先对半可信硬件进行解释说明：
在现有技术中，可信硬件可以直接得到所有用户的隐私输入，而当硬件制造商并不可信时，它可以通过嵌入后门的方式窃取用户的隐私信息、更改计算流程。例如，硬件制造商可以在可信硬件生成的密码学测度中以电子隐写术的方法嵌入信息，当远程参与方将该密码学测度转发至硬件制造商提供的第三方认证服务器时，硬件制造商就可以从中获取隐私信息；而当用户调用可信硬件进行计算时，硬件制造商可以随意指定其运行结果。在这样的场景下，可信硬件对于协议参与方仍然起到了保护作用：本地参与方无法通过攻击可信硬件的方式得到远程参与方的隐私输入，也无法控制可信硬件的计算流程、篡改可信硬件的计算结果；但是，硬件制造商具备了获取用户向可信硬件发送的隐私输入和更改可信硬件输出结果的能力，因此，我们将这样的硬件称为半可信硬件。
假设用户B想要从用户A处获取一系列互相关伪随机数中位于特定位置的某个伪随机数。用户B持有一个半可信硬件设备，半可信硬件设备的输出需要经过验证。为实现以上要求，用户A和用户B可以通过下面展示的基于半可信硬件的互相关伪随机数的远程获取方法来获取特定位置的某个互相关伪随机数。用户A作为发送方，用户B作为接收方。
在本发明的具体实施过程中，所述半可信硬件可以置于接收方内部，也可与接收方建立高速连接。相对于网络传输高延时、低带宽的特性，将半可信硬件置于接收方内部，或是在半可信硬件与接收方之间建立高速连接，可以让半可信硬件与接收方在低延时、高带宽的信道中进行通信、传输数据，进而提升协议的整体性能。
实施例1：
图1是根据一示例性实施例示出的一种基于半可信硬件的互相关伪随机数的远程获取方法的流程图，如图1所示，该方法应用于半可信硬件中，可以包括以下步骤：
步骤S11：获取发送方的随机种子和接收方的选择数；
步骤S12：根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；
步骤S13：根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；
步骤S14：根据所述第一承诺值和选择数，生成梅克尔证明；
步骤S15：将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方，以使得接收方根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
由上述实施例可知，本申请通过使用半可信硬件，降低了远程传输互相关伪随机数的通讯量，允许发送方以常数级别的通讯量向远程的接收方传输多项式级别数量的互相关伪随机数；根据若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值，通过承诺机制保证半可信硬件输出的正确性，同时也防止了接收方从半可信硬件的输出中获取不应该获得的隐私信息；根据所述第一承诺值和选择数，生成梅克尔证明并使得接收方根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证，通过梅克尔树技术，在确保信息传输安全性的同时使得发送方只需要常数级别的通讯量就可以向远程的接收方发送验证信息，而接收方只需要对数级别的计算量和存储空间就可以对可信硬件的输出结果进行验证。
在步骤S11的具体实施中，获取发送方的随机种子和接收方的选择数；
具体地，如图2所示，此步骤包括以下子步骤：
步骤S21：接收发送方的加密随机种子和接收方的随机数；
具体地，半可信硬件接收由接收方发送的发送方的加密随机种子和接收方的随机数，其中发送方的加密随机种子由发送方发送给接收方，这一步骤的作用是让用户A与用户B的半可信硬件能够以间接的方式进行通讯，同时防止用户B窃取用户A的随机种子。
步骤S22：根据发送方和半可信硬件的对称密钥，对所述加密随机种子进行 解密；
步骤S23：对解密得到的结果进行验证；
步骤S24：若验证通过，则获得发送方的随机种子。
在步骤S22-S24的具体实施中，半可信硬件以发送方和半可信硬件的对称密钥为解密密钥，以加密随机种子作为密文，调用发送方使用的带有消息验证码的对称加密算法对应的解密算法进行解密，该解密算法会对消息的完整性进行校验，如果校验通过则输出明文的随机种子。这一步骤的作用是让用户B的半可信硬件接收用户A发送的随机种子，同时防止用户B对随机种子进行篡改。
在步骤S12的具体实施中，根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；
具体地，如图3所示，此步骤包括以下子步骤：
步骤S31：将所述随机种子扩展为第一伪随机种子和第二伪随机种子；
具体地，以伪随机函数(pseudorandom function，PRF)作为伪随机数生成器。给定安全参数c，伪随机函数是定义在(K,X,Y)上的能在基于c的多项式时间内被计算的确定性函数PRF:K×X→Y，其中K为密钥空间，即所有长度为c位的字符串组成的空间，X为输入空间，Y为输出空间。伪随机函数与真正的随机函数无法区分，具体地，记所有定义在输入空间X和输出空间Y上的函数构成的函数空间为F，对于K中任选的一个密钥k和F中任选的一个函数f，伪随机函数PRF(k,·)与f(·)无法在多项式时间内被区分。
以随机种子s作为密钥，分别以0和1作为输入调用伪随机函数，得到s1＝PRF(s,0)，s2＝PRF(s,1)，分别作为互相关伪随机数的种子和承诺种子的种子，由伪随机函数的定义可知，s1和s2能够快速被计算得到，且在不知道密钥s的情况下，s1和s2与真正的随机数无法区分，因此接收方无法得到s1和s2。
步骤S32：根据所述预定互相关伪随机数种类和第一伪随机种子，生成若干第一互相关伪随机数；
具体地，根据指定的互相关伪随机数种类，使用第一伪随机种子s1生成第一互相关伪随机数，记作m 1,…,m n。例如，对随机不经意传输，计算PRF(s1,i||0)和PRF(s1,i||1)作为第i组随机不经意传输，其中“||”表示拼接，通过将i从1递增至预先指定的数量，即可生成所需的随机不经意传输；对混淆电路，则可以根据所需的不同优化形式，用第一伪随机种子s1分别产生线路标签和混淆种子，再利用混淆种子根据电路定义逐个对线路标签进行加密，产生各个门的混 淆表。由于第一伪随机种子s1与真正的随机数无法区分，即使接收方知道互相关伪随机数的生成方式，也无法得知生成的互相关伪随机数的任何信息。
步骤S33：根据所述第二伪随机种子，生成若干第一承诺种子，其中所述第一承诺种子的数量与所述第一互相关伪随机数的数量相同；
具体地，使用第二伪随机种子s2生成与第一互相关伪随机数数量相对应的第一承诺种子，记作r 1,…,r n，其中r i＝PRF(s2,i)。由于第二伪随机种子s2与真正的随机数无法区分，r i是以s2为密钥调用PRF生成，因此得到的这些承诺种子与真正的随机数无法区分，接收方无法得知承诺种子的任何信息。
在步骤S13的具体实施中，根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；
具体地，可以使用多种承诺机制的实现方式，将i从1到n遍历即可生成所有的承诺值和打开值，其中n为所述第一互相关伪随机数的数量。
在一实施例中，可以采用具备碰撞抵抗性质的哈希函数H来实现承诺机制，第一承诺值为c i＝H(m i||r i)，第一打开值为d i＝m i||r i。由于H具备碰撞抵抗性质，一旦半可信硬件给出了承诺值，它就无法找到其他的m i′和r i′，使得c i＝H(m i′||r i′)，因此可以保证半可信硬件无法伪造能够通过承诺机制验证的错误互相关伪随机数；由于H是单向函数，即使接收方获得了所有互相关伪随机数的承诺值，也无法从承诺值中获取关于互相关伪随机数的任何信息。进一步的，具备碰撞抵抗性质的哈希函数在现实中有着广泛的高效实现，因此这样设计的效率较高。
在另一实施例中，可以采用基于离散对数假设的Pederson承诺机制，预先商定阶数为大素数q的乘法群G，G有生成元g，h，元组(g，h，q)都是公开的，第一承诺值为
Figure PCTCN2021141676-appb-000001
第一打开值为d i＝r i。由于r i与真正的随机数无法区分，接收方无法从承诺值中获取关于互相关伪随机数的任何信息，又由于离散对数假设，一旦半可信硬件给出了承诺值，它就无法找到其他的m i′和r i′，使得
Figure PCTCN2021141676-appb-000002
因此可以保证半可信硬件无法伪造能够通过承诺机制验证的错误互相关伪随机数。
在步骤S14的具体实施中，根据所述第一承诺值和选择数，生成梅克尔证明；
具体地，根据梅克尔树的定义，使用所有的第一承诺值生成一棵梅克尔树，根据所述选择数生成相应的梅克尔证明。为了方便起见，我们假设所述第一互 相关伪随机数的数量为2 d，如果数量不为2的指数个，则用空消息填充至2的指数个。对于按生成顺序排列的2 d个第一承诺值，将i从1到2 d进行遍历，对第i个承诺值调用哈希函数H，得到第一层梅克尔树节点
Figure PCTCN2021141676-appb-000003
对j从1到d进行遍历，对于按生成顺序排列的2 d-j+1个第j层梅克尔树节点，将i从1到2 d-j进行遍历，对第2*i-1个和第2*i个第一承诺值调用哈希函数H，得到第j+1层梅克尔树节点
Figure PCTCN2021141676-appb-000004
如此形成一棵深度为d、层数为d+1的二叉树，称为梅克尔树，第d+1层的节点
Figure PCTCN2021141676-appb-000005
被称为梅克尔根哈希。梅克尔证明即为，从选择数对应的第一层梅克尔树节点一直到第d+1层的梅克尔树根节点这一条路径上，所有兄弟节点的值，例如，如果选择数为1，则相应的梅克尔证明为
Figure PCTCN2021141676-appb-000006
这些节点的值。
在步骤S15的具体实施中，将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方，以使得接收方根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
具体地，所述梅克尔根哈希由发送方根据第二承诺值生成，所述第二承诺值由根据若干第二互相关伪随机数和第二承诺种子生成，所述若干第二互相关伪随机数和第二承诺种子由根据所述随机种子和预定互相关伪随机数种类生成，所述第二互相关伪随机数与第一互相关伪随机数相同，所述第二承诺种子与所述第一承诺种子相同，所述第二承诺值与所述第一承诺值相同。
具体地，接收方首先使用所述梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证。接收方对所述第一承诺值调用哈希函数H，作为选择数对应的第一层梅克尔树节点，随后接收方逐个读取所述梅克尔证明中的梅克尔树节点，对目前持有的梅克尔树节点和从梅克尔证明中读取得到的梅克尔树节点调用哈希函数H，得到下一层的梅克尔树节点，如此得到梅克尔树根节点值，并与所述梅克尔根哈希进行对比，如果相同则验证通过。例如，如果选择数为1，则对所述第一承诺值调用哈希函数，得到的为第一层梅克尔树节点
Figure PCTCN2021141676-appb-000007
随后对i从1到d进行遍历，从梅克尔证明中逐个读取
Figure PCTCN2021141676-appb-000008
并与
Figure PCTCN2021141676-appb-000009
一起调用哈希函数，得到
Figure PCTCN2021141676-appb-000010
最后将
Figure PCTCN2021141676-appb-000011
与所述梅克尔根哈希进行对比，相同则验证通过。在梅克尔树验证通过后，接收方使用所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证，具体验证方法需要与前述的承诺实现方式相对应。 对于基于碰撞抵抗的哈希函数H的实现方式，第一打开值中包含所述选择数对应的互相关伪随机数和所述选择数对应的承诺种子，接收方验证第一打开值中包含的互相关伪随机数与自己收到的互相关伪随机数是否相同，验证通过后对第一打开值调用哈希函数H，并验证输出结果与第一承诺值是否相同，如果相同则全部验证过程通过；对于Pederson承诺机制，接收方计算
Figure PCTCN2021141676-appb-000012
并验证c i与第一承诺值是否相同，如果相同则全部验证过程通过。
与前述的基于半可信硬件的互相关伪随机数的远程获取方法的实施例相对应，本申请还提供了基于半可信硬件的互相关伪随机数的远程获取装置的实施例。
图4是根据一示例性实施例示出的一种基于半可信硬件的互相关伪随机数的远程获取装置框图。参照图4，该装置应用于半可信硬件，包括
第一获取模块21，用于获取发送方的随机种子和接收方的选择数；
第一生成模块22，用于根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；
第二生成模块23，用于根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；
第三生成模块24，用于根据所述第一承诺值和选择数，生成梅克尔证明；
第一发送模块25，用于将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方，以使得接收方根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
实施例2：
图5是根据一示例性实施例示出的一种基于半可信硬件的互相关伪随机数的远程获取方法的流程图，如图5所示，该方法应用于发送方，可以包括以下步骤：
步骤S41：对所述半可信硬件进行验证并得到与所述半可信硬件共享的对称密钥；
具体地，按照硬件制造商制定的远程认证规则，用户A向用户B发起多轮质询挑战请求，用户B将这些质询挑战请求转发给半可信硬件，由半可信硬件对这些请求做出回应，用户B将这些回应信息转发给用户A，用户A通过与硬 件制造商提供的第三方可信服务器通讯，对半可信硬件的真实性和可用性进行验证。
步骤S42：根据所述对称密钥，对随机种子进行加密并发送至接收方，以使得接收方将发送方的加密随机种子和接收方的选择数发送至半可信硬件，从而使得所述半可信硬件获取发送方的随机种子和接收方的选择数；根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；根据所述第一承诺值和选择数，生成梅克尔证明；将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方；
具体地，根据所述对称密钥，使用带有消息认证码的对称加密算法对随机种子进行加密，例如AES-GCM算法。随后将加密随机种子发送至接收方，以使得接收方将发送方的加密随机种子和接收方的选择数发送至半可信硬件，从而使得半可信硬件执行步骤S11-S15的过程。
步骤S43：根据所述随机种子和预定互相关伪随机数种类，生成若干第二互相关伪随机数和第二承诺种子；
具体地，生成过程与步骤S12相同，此处不作赘述。
步骤S44：根据所述若干第二互相关伪随机数和第二承诺种子，生成第二承诺值；
具体地，所述第二承诺值的生成过程与步骤S13中第一承诺值的生成过程相同，此处不作赘述。
步骤S45：根据所述第二承诺值，生成梅克尔根哈希；
具体地，根据梅克尔树的定义，使用所有的第二承诺值生成一棵梅克尔树，并根据所述梅克尔树生成梅克尔根哈希。
步骤S46：将所述梅克尔根哈希发送至接收方，以使得接收方根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
具体地，接收方进行验证的过程已在步骤S15中进行解释说明，此处不作赘述。
与前述的基于半可信硬件的互相关伪随机数的远程获取方法的实施例相对 应，本申请还提供了基于半可信硬件的互相关伪随机数的远程获取装置的实施例。
图6是根据一示例性实施例示出的一种基于半可信硬件的互相关伪随机数的远程获取装置框图。参照图6，该装置应用于发送方，包括：
第一验证模块31，用于对所述半可信硬件进行验证并得到与所述半可信硬件共享的对称密钥；
第二发送模块32，用于根据所述对称密钥，对随机种子进行加密并发送至接收方，以使得接收方将发送方的加密随机种子和接收方的选择数发送至半可信硬件，从而使得所述半可信硬件获取发送方的随机种子和接收方的选择数；根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；根据所述第一承诺值和选择数，生成梅克尔证明；将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方；
第四生成模块33，用于根据所述随机种子和预定互相关伪随机数种类，生成若干第二互相关伪随机数和第二承诺种子；
第五生成模块34，用于根据所述若干第二互相关伪随机数和第二承诺种子，生成第二承诺值；
第六生成模块35，用于根据所述第二承诺值，生成梅克尔根哈希；
第三发送模块36，用于将所述梅克尔根哈希发送至接收方，以使得接收方根据所述梅克尔根哈希和梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
实施例3：
图7是根据一示例性实施例示出的一种基于半可信硬件的互相关伪随机数的远程获取方法的流程图，如图7所示，该方法应用于接收方，可以包括以下步骤：
步骤S51：接收发送方发送的加密随机种子；
步骤S52：将所述加密随机种子和选择数发送至半可信硬件，以使得半可信硬件获取发送方的随机种子和接收方的选择数；根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；根据所述若 干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；根据所述第一承诺值和选择数，生成梅克尔证明；将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方；
步骤S53：根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
具体地，步骤S51-S53的具体实施已在上文中作出解释说明，此处不再赘述。
与前述的基于半可信硬件的互相关伪随机数的远程获取方法的实施例相对应，本申请还提供了基于半可信硬件的互相关伪随机数的远程获取装置的实施例。
图8是根据一示例性实施例示出的一种基于半可信硬件的互相关伪随机数的远程获取装置框图。参照图8，该装置应用于接收方，包括：
接收模块41，用于接收发送方发送的加密随机种子；
第四发送模块42，用于将所述加密随机种子和选择数发送至半可信硬件，以使得半可信硬件获取发送方的随机种子和接收方的选择数；根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；根据所述第一承诺值和选择数，生成梅克尔证明；将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方；
第二验证模块43，用于根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
关于上述实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
对于装置实施例而言，由于其基本对应于方法实施例，所以相关之处参见方法实施例的部分说明即可。以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块 来实现本申请方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
实施例4：
相应的，本申请还提供一种电子设备，包括：一个或多个处理器；存储器，用于存储一个或多个程序；当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现如上述的基于半可信硬件的互相关伪随机数的远程获取方法。
实施例5：
相应的，本申请还提供一种计算机可读存储介质，其上存储有计算机指令，其特征在于，该指令被处理器执行时实现如上述的基于半可信硬件的互相关伪随机数的远程获取方法。
本领域技术人员在考虑说明书及实践这里公开的内容后，将容易想到本申请的其它实施方案。本申请旨在涵盖本申请的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本申请的一般性原理并包括本申请未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本申请的真正范围和精神由下面的权利要求指出。
应当理解的是，本申请并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本申请的范围仅由所附的权利要求来限制。

Claims (10)

  1. 一种基于半可信硬件的互相关伪随机数的远程获取方法，其特征在于，应用于半可信硬件，包括：
    获取发送方的随机种子和接收方的选择数；
    根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；
    根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；
    根据所述第一承诺值和选择数，生成梅克尔证明；
    将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方，以使得接收方根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
  2. 根据权利要求1所述的方法，其特征在于，获取发送方的随机种子和接收方的选择数，包括：
    接收发送方的加密随机种子和接收方的随机数；
    根据发送方和半可信硬件的对称密钥，对所述加密随机种子进行解密；
    对解密得到的结果进行验证；
    若验证通过，则获得发送方的随机种子。
  3. 根据权利要求1所述的方法，其特征在于，根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子，包括：
    将所述随机种子扩展为第一伪随机种子和第二伪随机种子；
    根据所述预定互相关伪随机数种类和第一伪随机种子，生成若干第一互相关伪随机数；
    根据所述第二伪随机种子，生成若干第一承诺种子，其中所述第一承诺种子的数量与所述第一互相关伪随机数的数量相同。
  4. 一种基于半可信硬件的互相关伪随机数的远程获取装置，其特征在于，应用于半可信硬件，包括：
    第一获取模块，用于获取发送方的随机种子和接收方的选择数；
    第一生成模块，用于根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；
    第二生成模块，用于根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；
    第三生成模块，用于根据所述第一承诺值和选择数，生成梅克尔证明；
    第一发送模块，用于将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方，以使得接收方根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
  5. 一种基于半可信硬件的互相关伪随机数的远程获取方法，其特征在于，应用于发送方，包括：
    对所述半可信硬件进行验证并得到与所述半可信硬件共享的对称密钥；
    根据所述对称密钥，对随机种子进行加密并发送至接收方，以使得接收方将发送方的加密随机种子和接收方的选择数发送至半可信硬件，从而使得所述半可信硬件获取发送方的随机种子和接收方的选择数；根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；根据所述第一承诺值和选择数，生成梅克尔证明；将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方；
    根据所述随机种子和预定互相关伪随机数种类，生成若干第二互相关伪随机数和第二承诺种子；
    根据所述若干第二互相关伪随机数和第二承诺种子，生成第二承诺值；
    根据所述第二承诺值，生成梅克尔根哈希；
    将所述梅克尔根哈希发送至接收方，以使得接收方根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
  6. 一种基于半可信硬件的互相关伪随机数的远程获取装置，其特征在于，应用于发送方，包括：
    第一验证模块，用于对所述半可信硬件进行验证并得到与所述半可信硬件共享的对称密钥；
    第二发送模块，用于根据所述对称密钥，对随机种子进行加密并发送至接 收方，以使得接收方将发送方的加密随机种子和接收方的选择数发送至半可信硬件，从而使得所述半可信硬件获取发送方的随机种子和接收方的选择数；根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；根据所述第一承诺值和选择数，生成梅克尔证明；将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方；
    第四生成模块，用于根据所述随机种子和预定互相关伪随机数种类，生成若干第二互相关伪随机数和第二承诺种子；
    第五生成模块，用于根据所述若干第二互相关伪随机数和第二承诺种子，生成第二承诺值；
    第六生成模块，用于根据所述第二承诺值，生成梅克尔根哈希；
    第三发送模块，用于将所述梅克尔根哈希发送至接收方，以使得接收方根据所述梅克尔根哈希和梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
  7. 一种基于半可信硬件的互相关伪随机数的远程获取方法，其特征在于，应用于接收方，包括：
    接收发送方发送的加密随机种子；
    将所述加密随机种子和选择数发送至半可信硬件，以使得半可信硬件获取发送方的随机种子和接收方的选择数；根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；根据所述第一承诺值和选择数，生成梅克尔证明；将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方；
    根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
  8. 一种基于半可信硬件的互相关伪随机数的远程获取装置，其特征在于，应用于接收方，包括：
    接收模块，用于接收发送方发送的加密随机种子；
    第四发送模块，用于将所述加密随机种子和选择数发送至半可信硬件，以使得半可信硬件获取发送方的随机种子和接收方的选择数；根据所述随机种子和预定互相关伪随机数种类，生成若干第一互相关伪随机数和第一承诺种子；根据所述若干第一互相关伪随机数和第一承诺种子，利用承诺机制生成第一承诺值和第一打开值；根据所述第一承诺值和选择数，生成梅克尔证明；将所述选择数对应的第一互相关伪随机数、第一承诺值、第一打开值和梅克尔证明发送至接收方；
    第二验证模块，用于根据发送方发送的梅克尔根哈希和所述梅克尔证明对所述第一承诺值进行验证并根据验证通过后的所述第一承诺值和第一打开值对所述选择数对应的互相关伪随机数进行验证。
  9. 一种电子设备，其特征在于，包括：
    一个或多个处理器；
    存储器，用于存储一个或多个程序；
    当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现如权利要求1-3或权利要求5或权利要求7任一项所述的方法。
  10. 一种计算机可读存储介质，其上存储有计算机指令，其特征在于，该指令被处理器执行时实现如权利要求1-3或权利要求5或权利要求7中任一项所述方法的步骤。
PCT/CN2021/141676 2021-12-24 2021-12-27 基于半可信硬件的互相关伪随机数的远程获取方法及装置 Ceased WO2023115602A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/536,280 US11947930B1 (en) 2021-12-24 2023-12-12 Method and device for remote acquisition of correlated pseudo-random numbers based on semi-trusted hardware

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111598444.6A CN114338006B (zh) 2021-12-24 2021-12-24 基于半可信硬件的互相关伪随机数的远程获取方法及装置
CN202111598444.6 2021-12-24

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/536,280 Continuation US11947930B1 (en) 2021-12-24 2023-12-12 Method and device for remote acquisition of correlated pseudo-random numbers based on semi-trusted hardware

Publications (1)

Publication Number Publication Date
WO2023115602A1 true WO2023115602A1 (zh) 2023-06-29

Family

ID=81012685

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/141676 Ceased WO2023115602A1 (zh) 2021-12-24 2021-12-27 基于半可信硬件的互相关伪随机数的远程获取方法及装置

Country Status (3)

Country Link
US (1) US11947930B1 (zh)
CN (1) CN114338006B (zh)
WO (1) WO2023115602A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20250245366A1 (en) * 2024-01-26 2025-07-31 Beijing Zitiao Network Technology Co., Ltd. Method, apparatus, medium and device for generating data tuple for secure computation

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102021110768B3 (de) * 2021-04-27 2022-06-23 Wincor Nixdorf International Gmbh Forensik-Modul und eingebettetes System

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016204970A1 (en) * 2015-06-16 2016-12-22 Intel Corporation System, apparatus and method for providing randomly generated codes in a user anonymous manner
CN108334553A (zh) * 2017-12-29 2018-07-27 北京欧链科技有限公司 基于区块链的数据筛选方法和装置
CN112631549A (zh) * 2019-10-08 2021-04-09 橙载(上海)信息技术有限公司 一种对fts随机算法中伪随机数生成器的跨平台改造方法
US20210192498A1 (en) * 2017-08-15 2021-06-24 nChain Holdings Limited Random number generation in a blockchain
CN113489584A (zh) * 2021-07-02 2021-10-08 北京泛融科技有限公司 一种区块链中随机数的处理方法、装置和电子设备
CN113569294A (zh) * 2021-09-22 2021-10-29 浙江大学 一种零知识证明方法及装置、电子设备、存储介质

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017079652A1 (en) * 2015-11-05 2017-05-11 Pulsifer Allen Cryptographic transactions system
US20190205898A1 (en) * 2017-07-31 2019-07-04 Chronicled, Inc Decentralized confidential transfer system, method and device
EP3692699A4 (en) * 2017-10-04 2021-08-25 Algorand Inc. DECLARATIVE INTELLIGENT CONTRACTS
GB201720946D0 (en) * 2017-12-15 2018-01-31 Nchain Holdings Ltd Computer-implemented system and method
US20200126075A1 (en) * 2018-10-18 2020-04-23 Temujin Labs, Inc. Confidential transaction auditing using an authenticated data structure
US10846372B1 (en) * 2019-12-31 2020-11-24 Onu Technology Inc. Systems and methods for trustless proof of possession and transmission of secured data

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016204970A1 (en) * 2015-06-16 2016-12-22 Intel Corporation System, apparatus and method for providing randomly generated codes in a user anonymous manner
US20210192498A1 (en) * 2017-08-15 2021-06-24 nChain Holdings Limited Random number generation in a blockchain
CN108334553A (zh) * 2017-12-29 2018-07-27 北京欧链科技有限公司 基于区块链的数据筛选方法和装置
CN112631549A (zh) * 2019-10-08 2021-04-09 橙载(上海)信息技术有限公司 一种对fts随机算法中伪随机数生成器的跨平台改造方法
CN113489584A (zh) * 2021-07-02 2021-10-08 北京泛融科技有限公司 一种区块链中随机数的处理方法、装置和电子设备
CN113569294A (zh) * 2021-09-22 2021-10-29 浙江大学 一种零知识证明方法及装置、电子设备、存储介质

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20250245366A1 (en) * 2024-01-26 2025-07-31 Beijing Zitiao Network Technology Co., Ltd. Method, apparatus, medium and device for generating data tuple for secure computation

Also Published As

Publication number Publication date
US20240111493A1 (en) 2024-04-04
US11947930B1 (en) 2024-04-02
CN114338006B (zh) 2023-01-24
CN114338006A (zh) 2022-04-12

Similar Documents

Publication Publication Date Title
US12010216B2 (en) Computer-implemented system and method for highly secure, high speed encryption and transmission of data
US20220376894A1 (en) Adaptive attack resistant distributed symmetric encryption
US11374910B2 (en) Method and apparatus for effecting a data-based activity
CN104168108B (zh) 一种泄露密钥可追踪的属性基混合加密方法
CN115333857B (zh) 基于智慧城市系统云平台数据防篡改的检测方法
EP0661845B1 (en) System and method for message authentication in a non-malleable public-key cryptosystem
US11528127B2 (en) Computer-implemented system and method for highly secure, high speed encryption and transmission of data
US11637817B2 (en) Method and apparatus for effecting a data-based activity
JP7229778B2 (ja) 鍵管理システム及び方法
US12069170B2 (en) Multi-party privacy computing method and device based on semi-trusted hardware
WO2023134576A1 (zh) 数据加密方法、属性授权中心及存储介质
CN114338006B (zh) 基于半可信硬件的互相关伪随机数的远程获取方法及装置
CN106534077B (zh) 一种基于对称密码的可认证的代理重加密系统及方法
CN111835516A (zh) 一种公钥可否认加密方法及系统
US8954728B1 (en) Generation of exfiltration-resilient cryptographic keys
KR20010099760A (ko) 공유 무작위도를 분산 암호 기법에 통합하는 방법
CN120979720B (zh) 一种面向模型异构联邦学习的模型下发系统、方法、终端及介质
CN115442103B (zh) 一种群体学习抗毒化攻击方法、系统、设备及存储介质
HK40095834A (zh) 用於对数据进行高度安全、高速加密和传输的计算机实现的系统和方法
HK40020610B (zh) 用於对数据进行高度安全、高速加密和传输的计算机实现的系统和方法
HK40020610A (zh) 用於对数据进行高度安全、高速加密和传输的计算机实现的系统和方法
JP2010011478A (ja) 内在的署名を用いた鍵一致及び搬送方法
Kshirsagar et al. Result Paper on Public Auditing by using KERBEROS to Secure Cloud Storage

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21968731

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21968731

Country of ref document: EP

Kind code of ref document: A1