WO2023207735A1

WO2023207735A1 - Method and system for realizing secure multi-party computation by using hardware chips

Info

Publication number: WO2023207735A1
Application number: PCT/CN2023/089372
Authority: WO
Inventors: 周兴; 许保安
Original assignee: 上海紫先科技有限公司
Priority date: 2022-04-25
Filing date: 2023-04-20
Publication date: 2023-11-02
Also published as: CN115913525A

Abstract

A method and system for realizing secure multi-party computation by using hardware chips. The method comprises: a unique physical feature which is included in a physical chip of each participant and cannot be externally read is used as a private key, and an asymmetric encryption public key calculated according to the private key can be externally read, the public key also uniquely identifying any physical chip; prior to computation, one common seed is determined by means of negotiation amongst the physical chips of all the participants and is used for initializing respective pseudo-random number generators; and one party is selected from all the participants to execute the work of B and other N-1 parties execute the work of A. During a whole multiplication operation process, only participants A send data to participant B and participant B does not need to send any data to participants A. Therefore, the present invention has great significance for complex operations involving multi-step multiplication operations, one-way communication meaning that the computation of participants A and the computation of participant B can be completely asynchronous, thus being insensitive to delay of network communication, and improving the efficiency of secure multi-party computation.

Description

A method and system for implementing secure multi-party computation using hardware chips

cross reference

This application claims priority to the Chinese patent application with application number 202210437157.5 submitted on April 25, 2022. The contents of the above application are incorporated herein by reference.

Technical field

The present invention belongs to the subfield of secure multi-party computation in the field of privacy computing, and more specifically, relates to a method and system for implementing secure multi-party computation using hardware chips.

technical background

Privacy-preserving Computing, also known as Privacy Computing, aims to use original data to calculate results without exposing the original data. If privacy computing is not used, due to the reproducibility of information, handing over data to others for calculation (use) means the exposure of the data, resulting in the inseparability of the right to use and ownership of the data, thus limiting the use of sensitive or private information. Cross-domain flow of data. Privacy computing technology can separate the ownership and use rights of data, making the data available and invisible, thereby realizing safe and compliant cross-domain circulation of data and creating opportunities for multi-party collaboration to mine the value of data.

Secure Multi-Party Computation (MPC) is an important branch of privacy computing technology. The idea of secure multi-party computing is that each party participating in the calculation holds a part of the data and completes the calculation through a certain communication protocol without exposing their own data.

Secure multi-party computing is an important technology for realizing privacy-preserving computing (PPC), and the security of secure multi-party computing technology is mathematically guaranteed. In secure multi-party computation, Basic operations such as addition, subtraction, multiplication and division are all in the form of cipher-text computation, that is, all parties involved in the calculation will not leak their own data, but only exchange some encrypted data, but they can complete it collaboratively. overall operation. Secure multi-party computing technology includes technologies such as Secret Sharing and Garbled Circuit.

The additive secret-sharing scheme in secure multi-party computation is introduced as follows: Assume there are N participants (numbered 0, 1,...,N-1), then each number x participating in the calculation will be expressed as into N mutually independent random numbers [x] ₀ ,[x] ₁ ,…,[x] _N-1 , among which the i-th participant only masters [x] _i and satisfies [x] ₀ +[x ] ₁ +…+[x] _N-1 =x. These N random numbers [x] ₀ , [x] ₂ ,..., [x] _N-1 together are called the secret sharing of the original number x, written as [x].

The calculated participant i will never tell any other participant the secret share [x]i he holds. That is to say, as long as one participant does not collude with other participants, no matter which participant Neither can know any information about the original data x.

Although the participants will not reveal their share of the secret, N participants can still complete some operations together. For example, if the secret sharing of number x is [x] ₀ ,[x] ₁ ,…,[x] _N-1 , the secret sharing of number y is [y] ₀ ,[y] ₁ ,…,[y] _{N -1} , then multiple participants can calculate the secret sharing of the number z=x+y without leaking information. That is to say, participant i only needs to calculate [z] _i = [x] _i + [y] _i locally, and then the N random numbers [z] ₀ ,[z] ₁ ,…, obtained thereby [z] _N-1 naturally becomes the secret sharing of number z, which is easy to verify:
[z] ₀ +[z] ₁ +…+[z] _N-1 =([x] ₀ +[y] ₀ )+([x] ₁ +[y] ₁ )+…+([x] _{N -1} +[y] _N-1 )
=([x] ₀ +[x] ₁ +…+[x] _N-1 )+([y] ₀ +[y] ₁ +…+[y] _N-1 )＝x+y＝z

In other words: in secure multi-party computation based on secret sharing, the addition operation between calculated numbers does not require communication, and each participant can calculate locally. Similarly, subtraction between operands This is also the case, no communication is required.

However, in the secret sharing secure multi-party computing scheme, multiplication secret sharing generally has a large communication cost. In the classic multiplication operation secret sharing secure multi-party computing scheme, the multiplication operation z=x*y needs to be divided into three steps.

① Randomly generate an auxiliary calculation triplet a, b, c, such that a*b=c, and secretly share it among N participants, that is, the i-th participant gets a triplet [a] _i , [b] _i and [c] _i , and, there are [a] ₀ +[a] ₁ +…+[a] _N-1 =a, [b] ₀ +[b] ₁ +…+[b] _{N -1} =b，[c] ₀ +[c] ₁ +…+[c] _N-1 =c. In the existing scheme, this step (creating triples and securely sharing them secretly among N participants) can be done through some complex cryptographic operations (such as homomorphic encryption, oblivious transmission), or by introducing a trusted third Three parties must be implemented; however, both of the above implementation methods must conduct one or more rounds of communication between participants, or between participants and a trusted third party.

②. The i-th participant calculates [d] _i = [x] _i - [a] _i , [e] _i = [y] _i - [b] _i , and sends [d] _i and [e] _i to all other N-1 participants. This step also introduces a round of many-to-many communication among N participants.

③. Each participant has received all the secret shares of d and e, so it can be calculated:

d＝[d] ₀ +[d] ₁ +…+[d] _N-1 and e＝[e] ₀ +[e] ₁ +…+[e] _N-1 .

The ith participant calculates [z] _i = [c] _i +e*[x] _i +d*[y] _i , (especially, when i=0, the 0th participant calculates [z] ₀ = [c] ₀ +e*[x] ₀ +d*[y] ₀ –e*d).

The above is easy to check z=[z] ₀ +[z] ₁ +...+[z] _N-1 =x*y, so [z] _i is the secret sharing of the product z=x*y, and during the entire calculation process, No useful data is exposed.

In the above steps, the second and third steps both include the communication process. More importantly, the communication process is on the critical path to complete the computing operation, that is, in the total computing time, the local computing time Communication delays will be superimposed.

It can be seen from the above steps that each basic multiplication operation requires a round of two-way communication, which takes at least one network delay time (usually between a few milliseconds and hundreds of milliseconds depending on the network conditions), which is much slower than plain text calculation. (plain-text computation) calculation time. If in practical applications, for example, a deep learning model contains tens of billions of multiplication operations, and the multiple parties involved in the calculation are often located in distant geographical locations, communicating through a network with limited bandwidth, that is, frequent and large-scale two-way communication, directly As a result, its performance is lower. Secure multi-party computations with multiplicative secret sharing are usually hundreds, thousands or even tens of thousands of times slower than insecure plaintext computations.

Summary of the invention

The purpose of the present invention is to provide a method for implementing secure multi-party computation using hardware chips, which can perform joint operations with high performance on the premise of protecting the privacy of all parties to achieve data sharing and collaboration across organizations, and which can Ensure the immutability of the index and the accuracy of the query data.

In order to achieve the above objects, the technical solutions of the present invention are as follows:

A method based on using hardware chips to implement secure multi-party computation, which is used to efficiently implement multiplication operations in secret sharing secure multi-party computation schemes. It is characterized by including N participants (0,1,...,N-1), each One of the participants (0,1,...,N-1) includes a physical chip, and each of the physical chips contains an externally unreadable and unique private key corresponding to the corresponding physical chip; Each physical chip has a corresponding asymmetric encryption public key calculated through its respective private key, and each of the encryption public keys is read externally as a characteristic that uniquely identifies the corresponding physical chip; wherein, the The method includes the following steps:

Step S1: Before performing multiplicative secret sharing secure multi-party computation, all participants The physical chips of (0,1,...,N-1) negotiate to determine a common pseudo-random number generator seed, which is used to initialize their respective first pseudo-random number generators and second pseudo-random number generators. , where N is greater than or equal to 2;

Step S2: When the multiplication operation z=x*y, select one of the N participants (0,1,...,N-1) to perform the work of B, and the other remaining N-1 will participate. The other performs the work of A; among them, the participants who perform the work of B own the secret sharing of x and y ([x] ₀ and [y] ₀ ), and the remaining N-1 participants who perform the work of A ( 1,2,…,N-1) have the secret sharing of x and y respectively ([x] ₁ +[y] ₁ ), ([x] ₂ +[y] ₂ )…,([x] _N-1 +[y] _N-1 ), satisfying [x] ₀ +[x] ₁ +…+[x] _N-1 ＝x, [y] ₀ +[y] ₁ +…+[y] _N-1 ＝ y;

Step S3: Both participant A and participant B use the first pseudo-random number generator of their respective physical chips to generate two random numbers r1 and r2, and use the second pseudo-random number generator of their respective physical chips. 2Generate a random number r3;

Step S4: The N-1 participants (1,...,N-1) who perform work A respectively calculate d ₁ =[x] ₁ -r1,e ₁ =[y] ₁ -r2,...,d _N =[x] _N -r1,e _N =[y] _N -r2, and the values of d _1, d ₂ ..., d _N and e _1, e ₂ ..., d _N cannot be passed to a computer outside the physical chip The letter memory space is sent to the participant B;

Step S5: The participant B receives d _1, d ₂ ..., d _N and e _1, e ₂ ..., d _N from the participant A, and calculates u ₁ = [x] ₁ + d ₁ and v respectively. ₁ =[y] ₁ +e ₁ ,…,u _N =[x] _N +d _N and v _N =[y] _N +e _N , thus respectively obtaining:
[z] ₁ ＝u ₁ *v ₁ +u*r2+v ₁ *r1-r3＝[x] ₁ +[x] ₀ )*([y] ₁ +[y] ₀ )–r1*r2–r3 ;
[z] ₂ ＝u ₂ *v ₂ +u*r2+v ₂ *r1-r3＝[x ₂ +[x] ₀ )*([y] ₂ +[y] ₀ )–r1*r2–r3;
…
[z] _N ＝u _N *v _N +u*r2+v _N *r1-r3＝[x] _N +[x] ₀ )*([y] _N +[y] ₀ )–r1*r2–r3 ;

And output [z] ₁ , [z] ₂ ,...[z] _N to the computer's untrusted memory space outside the physical chip, And get: [z] _B = [z] ₁ + [z] ₂ +…+[z] _N ;

Step S6: [z] _A =r1*r2+r3 is calculated separately within the N-1 participants (1,...,N-1) performing work A, and cannot be output to a computer outside the physical chip. By lettering the memory space, you can get:
[z] _B + (N-1)*[z] _A =x*y.

Further, the key is written once by the manufacturer of the physical chip, or is implemented by using the process noise of the physical chip during the manufacturing process of the chip as a feature.

Further, in step S1, the generation of the pseudo-random number generator seed includes:

First, the participant A uses the true random number generator inside the local physical chip to generate a true random number _SA , and encrypts it with the public key of the participant B's chip to become Enc _B ( _SA );

Second, the participant A sends Enc _B ( _SA ) to the participant B; after the physical chip of the participant B receives the Enc _B ( _SA ), it uses the local truth inside the physical chip to The random number generator generates a true random number SB, and decrypts Enc _B (S _A ) with the local private key to obtain SA, and splices SA and SB into the pseudo-random number generator seed of the pseudo-random number generator, Moreover, the participant B also encrypts S _B using the public key of the physical chip of the participant A to become Enc _A ( _SB ), and then sends Enc _A ( _SB ) to A;

Third, the participant A decrypts Enc _A ( _SB ) with the local private key to obtain _SB , and uses S _A and _SB to splice into the same pseudo-random number generator seed to allow secure multi-party calculation for all participants The same pseudo-random number generator seed is determined between the physical chips.

Further, the N is 2.

In order to achieve the above object, another technical solution of the present invention is as follows:

A system that uses hardware chips to implement secure multi-party computation to efficiently achieve secret sharing security Multiplication operation in multi-party computing scheme, which includes N participants (0,1,...,N-1) and computer untrusted memory space: where, the N participants (0,1,...,N-1 ) is divided into participant A and participant B, and one of the N participants (0,1,...,N-1) is selected to perform the work of B, and the other remaining N-1 Participants perform work A; the participants who perform work B own the secret shares of x and y ([x] ₀ and [y] ₀ ), and the remaining N-1 participants who perform work A (1 ,2,…,N-1) have the secret sharing of x and y respectively ([x] ₁ +[y] ₁ ),([x] ₂ +[y] ₂ )…,([x] _N-1 + [y] _N-1 ); and satisfy [x] ₀ +[x] ₁ +…+[x] _N-1 ＝x, [y] ₀ +[y] ₁ +…+[y] _N-1 ＝ y;

Each of the participants (0,1,…,N-1) includes:

A physical chip. Each physical chip contains an externally unreadable and unique private key corresponding to the corresponding physical chip; each physical chip calculates the corresponding private key through its respective private key. Asymmetric encryption public keys, each of which is externally read as a unique identifier of the corresponding physical chip;

The first pseudo-random number generator and the second pseudo-random number generator are used to generate a common pseudo-random number negotiated between the physical chips of all the participants (0,1,...,N-1) Number generator seed; both participant A and participant B use the first pseudo-random number generator of their respective physical chips to generate two random numbers r1 and r2, and use the second pseudo-random number of their respective physical chips. Generator 2 generates a random number r3;

The multiplication unit obtains the value z of the multiplication operation x*y in the untrusted memory space of the computer outside the physical chip by executing steps S3 to S6 in claim 1.

Further, the multiplication unit includes a secret shared bit operator, a random number register group and a secret shared multiplier; the pseudo-random number sequence generated by the first pseudo-random number generator and the second pseudo-random number generator, Some or all of them are cached in the random number register bank to provide the secret Secret shared bit operators and secret shared multipliers perform calculations.

Further, the secret sharing multiplier includes an input terminal and an output terminal. The input terminal receives the secret sharing of input operands of the untrusted memory space of the computer, and the output terminal is used to output to the untrusted memory space. The multiplication result of the memory space is output through secret sharing.

Further, the output terminal performs a masking operation on the regenerated random numbers in a secret sharing manner to ensure that the output data does not contain an amount of information exceeding any random number.

Further, the mask operation performed on the regenerated random numbers includes one of adding points or and bitwise XOR.

Further, the physical chips used by the N participants (0,1,...,N-1) are FPGAs.

It can be seen from the above technical solutions that the method proposed by the present invention to use hardware chips to implement secure multi-party computation is by changing the communication modes of the participants. Different from the classic scheme that requires two-way communication between all participants, in the embodiment of the present invention Communication is one-way. That is, only participant A sends data to participant B, and participant B does not need to send any data to participant A during the entire multiplication operation. In other words, the above secure multi-party computation of multiplication secret sharing is of great significance to complex operations involving multi-step multiplication operations. One-way communication means that the calculations of participant A and participant B can be completely asynchronous, that is, there is no need to wait for the other party Once the corresponding pre-steps are completely completed, subsequent calculation steps can be carried out directly, thus achieving insensitivity to network communication delays and improving the efficiency of secure multi-party calculations.

Description of drawings

Figure 1 shows a system block diagram of a database index based on a polynomial commitment mechanism in an embodiment of the present invention.

Figure 2 shows a schematic flow chart of a database indexing method based on a polynomial commitment mechanism in an embodiment of the present invention.

Contents of the invention

The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings 1-2.

It should be noted that in the secure multi-party computation scheme of the present invention, the secret-sharing (additive secret-sharing) scheme in secure multi-party computation is based on the classic additive secret-sharing (additive secret-sharing) secure multi-party computation scheme, addition, subtraction, multiplication and division, etc. Basic operations are all in the form of cipher-text computation, that is, all parties involved in the calculation will not leak their own data, but only exchange some encrypted data, but can collaborate to complete the overall operation.

The key is that the basic operations such as multiplication and division of the present invention can eliminate two-way communication and replace it with one-way communication. That is to say, the communication is not on the critical path of the calculation, eliminating the performance bottleneck of secure multi-party calculation, which is performed by participant A and participating The completely asynchronous calculation improves the efficiency of secure multi-party calculation.

Please refer to FIG. 1 , which is a block diagram of a database indexing system based on a polynomial commitment mechanism in an embodiment of the present invention. As shown in Figure 1, the system includes N participants (0,1,...,N-1) and the computer's untrusted memory space.

In the embodiment of the present invention, each participant (0,1,...,N-1) includes a physical chip, a first pseudo-random number generator, a second pseudo-random number generator and a multiplication unit . The area inside the physical chip is a trusted area, that is, the logic in this area cannot be tampered with, and the data in this area cannot be read (except for data that can be read by the API interface design of the physical chip).

Each of the physical chips contains an externally unreadable and unique The private key HK1 corresponding to the processing chip can be used to decrypt externally input encrypted messages. Each physical chip has a corresponding asymmetric encryption public key calculated through its respective private key, and each of the encryption public keys is externally read as a characteristic that uniquely identifies the corresponding physical chip.

The private key can be written into the chip once by the manufacturer during the chip manufacturing process, or it can be implemented by using the process noise during the chip manufacturing process as a feature. The implementation method of the unique private key is a mature technology in the industry and will not be discussed here. Again.

Since the design of the physical chip ensures that the private key cannot be read externally, the asymmetric encryption public key calculated using the private key as the private key can be read externally; thus, the public key can also be unique Identify any physical chip.

In the embodiment of the present invention, the physical chip used by the N participants (0, 1,..., N-1) is FPGA.

Based on the above characteristics, secure multi-party computing participants holding the physical chip can confirm whether the other party's chip is trustworthy by requiring the other party to use the chip's internal key signature. Even if the participants are geographically far apart, they can also communicate through the network to build trust. The above is the remote authentication (Remote Attestation) process.

Please refer to FIG. 2 , which is a schematic flowchart of a database indexing method based on a polynomial commitment mechanism in an embodiment of the present invention. As shown in Figure 2, this method is used for multiplication secret sharing secure multi-party computation, including the following steps:

Step S1: Before performing the multiplication secret sharing secure multi-party calculation, the physical chips of all participants (0,1,...,N-1) negotiate to determine a common pseudo-random number generator seed for initializing their respective The first pseudo-random number generator and the second pseudo-random number generator, wherein N is greater than or equal to 2.

Specifically, before performing secure multi-party computation, the physical chips of all participants (0,1,...,N-1) need to negotiate to determine a common seed for initializing their respective pseudo-random number generators, but this seed cannot be leaked. Further, the true random number generator inside the participant's physical chip is able to generate true random numbers generated by the physical thermal noise of the chip as part of the seed of the pseudo-random number generator (the other part of the seed is encrypted by other participants) The message is decrypted).

The following takes N=2 as an example for explanation.

The generation of the pseudo-random number generator seed may include the following steps:

Second, the participant A sends Enc _B ( _SA ) to the participant B; after the physical chip of the participant B receives the Enc _B ( _SA ), it uses the local truth inside the physical chip to The random number generator generates a true random number S _B , and decrypts Enc _B ( _SA ) with the local private key to obtain S _A , and uses S _A and _SB to splice it into a pseudo-random number of the pseudo-random number generator. Generator seed, and the participant B also encrypts _SB with the public key of the physical chip of the participant A to become Enc _A ( _SB ), and then sends Enc _A ( _SB ) to A;

Third, the participant A decrypts Enc _A ( _SB ) with the local private key to obtain _SB , and uses SA and SB to splice it into the same pseudo-random number generator seed to allow secure multi-party calculation of all participants. The same pseudo-random number generator seed is determined between the above physical chips.

In the embodiment of the present invention, after a pseudo-random number generator initialized by a common random number seed is established among the secure multi-party computing participants (0, 1,..., N-1), it can be executed through the multiplication unit The multiplication operation z=x*y is done.

Please refer to Figure 1 again. The multiplication unit may include a secret shared bit operator, a random number register register group and secret sharing multiplier; the pseudo-random number sequence generated by the first pseudo-random number generator and the second pseudo-random number generator is partially or fully cached in the random number register group to provide the The secret shared bit operator and the secret shared multiplier perform calculations, and output the multiplication operation to the untrusted memory space of the computer outside the physical chip, and finally obtain the value of x*y.

The secret sharing multiplier includes an input terminal and an output terminal. The input terminal receives the secret sharing of the input operands of the untrusted memory space of the computer. The output terminal is used to output the operands to the untrusted memory space. The result of the multiplication operation is output through secret sharing.

Preferably, the output terminal outputs a mask operation using a regenerated random number in a secret sharing manner (the mask operation performed on the regenerated random number includes one of addition points or bitwise XOR). ) to ensure that the output data does not contain more information than any random number.

Specifically, this can be achieved by performing the following steps:

Step S2: When the multiplication operation z=x*y, select one of the N participants (0,1,...,N-1) to perform the work of B, and the other remaining N-1 will participate. The other performs the work of A. Each number x participating in the calculation will be represented as N independent random numbers [x] ₀ , [x] ₁ ,..., [x] _N-1 , and the i-th participant only knows [x] _i , It satisfies [x] ₀ +[x] ₁ +…+[x] _N-1 =x.

N random numbers [x] ₀ ,[x] ₁ ,…,[x] _N-1 together are called the secret sharing of the original number x, written as [x]; the participant i of the calculation will never put himself Share the secret share [x]i you have with any other participant. In the same way, each number y participating in the calculation will be represented as N independent random numbers y] ₀ , [y] ₁ ,..., [y] _N-1 , and the i-th participant only masters [y] _i , satisfying [y] ₀ +[y] ₁ +…+[y] _N-1 =y.

In other words, as long as one participant does not collude with other participants, no one can know any information about the original data x and y.

Among them, the participant performing work B owns the secret shares of x and y ([x] ₀ and [y] ₀ ), leaving The N-1 participants (1, 2,...,N-1) who perform work A have secret shares of x and y respectively ([x] ₁ + [y] ₁ ), ([x] ₂ + [y] ₂ )…,([x] _N-1 +[y] _N-1 ), satisfying [x] ₀ +[x] ₁ +…+[x] _N-1 =x,[y] ₀ + [y] ₁ +…+[y] _N-1 =y.

Step S3: Both participant A and participant B use the first pseudo-random number generator of their respective physical chips to generate two random numbers r1 and r2, and use the second pseudo-random number generator of their respective physical chips. 2Generate a random number r3.

Step S4: The N-1 participants (1,...,N-1) who perform work A respectively calculate d ₁ =[x] ₁ -r ₁ , e ₁ =[y] ₁ -r2,...,d _N = [x] _N -r1,e _N = [y] _N -r2, and the values of d _1, d ₂ ..., d _N and e _1, e ₂ ..., d _N are passed to the computer outside the physical chip Untrusted memory space is sent to the participant B.

Step S5: The participant B receives d1, d2...dN and e1, e2...dN from the participant A, and calculates u ₁ =[x] ₁ +d ₁ and v ₁ =[y] ₁ +e respectively. ₁ ,…,u _N =[x] _N +d _N and v _N =[y] _N +e _N , thus respectively obtaining:
[z] ₁ ＝u ₁ *v ₁ +u*r2+v ₁ *r1-r3＝[x] ₁ +[x] ₀ )*([y] ₁ +[y] ₀ )–r1*r2–r3 ;
[z] ₂ ＝u ₂ *v ₂ +u*r2+v ₂ *r1-r3＝[x ₂ +[x] ₀ )*([y] ₂ +[y] ₀ )–r1*r2–r3;
…
[z] _N ＝u _N *v _N +u*r2+v _N *r1-r3＝[x] _N +[x] ₀ )*([y] _N +[y] ₀ )–r ₁ *r ₂ -r ₃ ;

And output [z] ₁ , [z] ₂ ,...[z] _N to the computer's untrusted memory space outside the physical chip, and get: [z] _B = [z] ₁ + [z] ₂ +... +[z] _N ;

It can be seen from the above that the present invention uses specially designed chip hardware to improve the classic addition Secret sharing of secure multi-party computation schemes greatly reduces the communication cost of multiplication operations by several orders of magnitude, thus greatly improving the performance of secure multi-party computation schemes in practical applications.

Example 1

For ease of understanding, the method of using hardware chips to implement secure multi-party computation will be described in detail below, taking two participants as an example.

After the secure multi-party computation participants (Participant A and Participant B) confirm that the chip used by the other party is trustworthy, the participants can jointly decide on a common random number seed, which is determined by the number of chips held by the participants. The true random numbers generated by the internal true random number generator that reflect the random thermal noise of the physical hardware are calculated together, and the communication process of the calculation is protected by asymmetric encryption using the key inside the physical chip, and the calculation results are only retained inside the physical chip. This random number seed cannot be read by any participant outside the physical chip.

The physical chips of all participants use this common random number seed to initialize two independent pseudo-random number generators (the first pseudo-random number generator and the second pseudo-random number generator) inside their respective chips. Of course, they can also be generated by random numbers. Different parts of the number seed are used as initialization seeds for the two pseudo-random number generators to achieve complete independence of the two pseudo-random number generators.

Preferably, the random number generation algorithm of the pseudo-random number generator must be cryptographically strong, that is, without knowing the initialization seed of the pseudo-random number generator, the next random number cannot be inferred from the current random number. any information.

After the above-mentioned secure multi-party computation participants establish a pseudo-random number generator initialized by a common random number seed, the multiplication operation process in the secure multi-party computation scheme can be performed:

Step 1: Party A owns the secret sharing [x] ₀ and [y] ₀ of x and y, while Party B owns x and y's secret shares [x] ₁ and [y] ₁ . Both participant A and participant B use the first pseudo-random number generator of their respective chips to generate two random numbers r1 and r2, and the second pseudo-random number generator generates a random number r3. Party A calculates d=[x] ₀ -r1, e=[y] ₀ -r2, and sends the values of d and e (for example, via the network) to Party B.

Step 2: Participant B receives d and e sent by participant A, and calculates u=[x] ₁ +d and v=[y] ₁ +e. It should be noted that Participant B receives the information sent by Participant A. Participant B does not need to send any information to Participant A, so it is a one-way communication.

Step 3: Because the pseudo-random number generators of A and B's chips use the same initialization seed, B's chip internally generates the same random numbers r1, r2, and r3. B’s chip internal calculation:
[z] ₁ =u*v+u*r2+v*r1-r3＝([x] ₁ +d)*([y] ₁ +e)+([x] ₁ +d)*r2+([y] ] ₁ +e)*r1
=([x] ₁ +[x] ₀ –r1)*([y] ₁ +[y] ₀ –r2)+([x] ₁ +[x] ₀ –r1)*r2+([y] ₁ + [y] ₀ –r2)*r1–r3
=([x] ₁ +[x] ₀ )*([y] ₁ +[y] ₀ )–r1*([y] ₁ +[y] ₀ )–r2*([x] ₁ +[x] ₀ )+r1*r2+([x] ₁ +[x] ₀ )*r2–
r1*r2+([y] ₁ +[y] ₀ )*r1–r2*r1–r3
=([x] ₁ +[x] ₀ )*([y] ₁ +[y] ₀ )–r1*r2–r3

That is, ([x] ₁ +[x] ₀ )*([y] ₁ +[y] ₀ )–r1*r2–r3 is the multiplication result on B’s side.

At this time, participant A calculates [z] ₀ =r1*r2+r3.

From this, it can be easily verified that [z] ₀ +[z] ₁ =([x] ₀ +[x] ₁ )*([y] ₀ +[y] ₁ )=x*y, that is to say, participant A and participant B each hold the secret sharing of the multiplication result.

It is clear to those skilled in the art that the above example is for 2 participants, but its calculation scheme can be easily extended to N participants: only one of the N participants needs to be selected to perform the work of participant B, and the other The N-1 party performs the work of participant A, so that the communication between N participants is still one-way, and N-1 participant A sends a single message to the other party that performs the work of participant B. Send data to.

To summarize, comparing the above-mentioned computing scheme of the present invention and the classic scheme, the main advantage of the above-mentioned scheme is that it changes the communication mode of the participants. Unlike the classic scheme that requires two-way communication between all participants, the communication in the above scheme is one-way, that is, only participant A sends data to participant B, and participant B does not need to send data to participant during the entire multiplication operation. A sends any data.

It is of great significance to complex operations involving multi-step multiplication operations. One-way communication means that the calculations of participant A and participant B can be completely asynchronous, that is, they can proceed directly without waiting for the corresponding previous steps of the other party to be completely completed. The subsequent calculation steps are therefore not sensitive to the delay of network communication; if the communication is bidirectional, participant A or participant B must wait for the corresponding step of the other party to complete and receive the intermediate results through the network before proceeding to subsequent calculation steps. , so that the network delay will be included on the critical path, thus becoming the performance bottleneck of the entire computing process.

Experimental results show that the present invention can improve the performance of secure multi-party computation by 100-1000 times compared with traditional solutions, especially when the participants of secure multi-party computation are in a continuously high network environment. The following is a performance comparison of the CPU and GPU between the solution of the present invention (implemented based on FPGA hardware) and the traditional solution (network communication delay is 200 milliseconds):

The above are only preferred embodiments of the present invention. The embodiments are not intended to limit the scope of patent protection of the present invention. Therefore, any equivalent structural changes made using the description and drawings of the present invention will , should be included in the protection scope of the appended claims of the present invention.

Claims

A method of implementing secure multi-party computation using hardware chips, which is used to implement multiplication operations in a secret-sharing secure multi-party computation scheme. It is characterized by including N participants (0,1,...,N-1), each of which The above-mentioned participants (0,1,...,N-1) include a physical chip, and each physical chip contains an externally unreadable and unique private key corresponding to the corresponding physical chip; each The physical chip calculates the corresponding asymmetric encryption public key through its respective private key, and each of the encryption public keys is read externally as a characteristic that uniquely identifies the corresponding physical chip; wherein the method includes Follow these steps:

Step S1: Before performing secret sharing secure multi-party computation, the physical chips of all participants (0,1,...,N-1) negotiate to determine a common pseudo-random number generator seed for initializing their respective A first pseudo-random number generator and a second pseudo-random number generator, where N is greater than or equal to 2;

Step S2: When the multiplication operation z=x*y, select one of the N participants (0,1,...,N-1) to perform the work of B, and the other remaining N-1 will participate. The other performs the work of A; among them, the participants who perform the work of B own the secret sharing of x and y ([x] 0 and [y] 0 ), and the remaining N-1 participants who perform the work of A ( 1,2,…,N-1) have the secret sharing of x and y respectively ([x] 1 +[y] 1 ), ([x] 2 +[y] 2 )…,([x] N-1 +[y] N-1 ), satisfying [x] 0 +[x] 1 +…+[x] N-1 ＝x, [y] 0 +[y] 1 +…+[y] N-1 ＝ y;

Step S3: Both participant A and participant B use the first pseudo-random number generator of their respective physical chips to generate two random numbers r1 and r2, and use the second pseudo-random number generator of their respective physical chips. 2Generate a random number r3;

Step S4: The N-1 participants (1,...,N-1) who perform work A respectively calculate d 1 =[x] 1 -r1,e 1 =[y] 1 -r2,...,d N =[x] N -r1,e N =[y] N -r2, and put d 1, d 2 …, d N and e 1, e 2 …, d N The value of is sent to the participant B through the computer's untrusted memory space outside the physical chip;

Step S5: The participant B receives d1, d2...dN and e1, e2...dN from the participant A, and calculates u 1 =[x] 1 +d 1 and v 1 =[y] 1 +e respectively. 1 ,…,u N =[x] N +d N and v N =[y] N +e N , thus respectively obtaining:
[z] 1 ＝u 1 *v 1 +u*r2+v 1 *r1-r3＝[x] 1 +[x] 0 )*([y] 1 +[y] 0 )–r1*r2–r3 ;
[z] 2 ＝u 2 *v 2 +u*r2+v 2 *r1-r3＝[x 2 +[x] 0 )*([y] 2 +[y] 0 )–r1*r2–r3;
…
[z] N ＝u N *v N +u*r2+v N *r1-r3＝[x] N +[x] 0 )*([y] N +[y] 0 )–r1*r2–r3 ;

And output [z] 1 , [z] 2 ,...[z] N to the computer's untrusted memory space outside the physical chip, and get: [z] B = [z] 1 + [z] 2 +... +[z] N ;

Step S6: [z] A =r1*r2+r3 is calculated separately within the N-1 participants (1,...,N-1) performing work A, and cannot be output to a computer outside the physical chip. By lettering the memory space, you can get:
[z] B + (N-1)*[z] A =x*y.
The method for implementing secure multi-party computation using hardware chips according to claim 1, characterized in that the key is written once by the manufacturer of the physical chip, or the physical chip is used during the manufacturing process. Process noise is implemented as a feature.
The method for implementing secure multi-party computation using hardware chips according to claim 1, characterized in that, in step S1, the generation of the pseudo-random number generator seed includes the following steps:

First, the participant A uses the true random number generator inside the local physical chip to generate a true random number SA , and encrypts it with the public key of the participant B's chip to become Enc B ( SA );

Second, the participant A sends Enc B (S A ) to the participant B; the participant After B's physical chip receives Enc B (S A ), it uses the true random number generator inside the local physical chip to generate a true random number SB, and uses Enc B (S A ) with the local private key. Decrypt to obtain S A , use S A and SB to splice into the pseudo-random number generator seed of the pseudo-random number generator, and the participant B also encrypts SB with the public key of the physical chip of the participant A After becoming Enc A ( SB ), send Enc A ( SB ) to A;

Third, the participant A decrypts Enc A ( SB ) with the local private key to obtain SB, and uses SA and SB to splice them into the same pseudo-random number generator seed, so as to allow secure multi-party calculation of the said The same pseudo-random number generator seed is determined between physical chips.
The method for implementing secure multi-party computation using hardware chips according to claim 1, wherein N is 2.
A system that uses hardware chips to implement secure multi-party computation and is used to implement multiplication secret sharing secure multi-party computation. It is characterized by including N participants (0,1,...,N-1) and an untrusted memory space of the computer: where , the N participants (0,1,...,N-1) are divided into participant A and participant B, and, among the N participants (0,1,...,N-1) One participant is chosen to perform work B, while the remaining N-1 participants perform work A; the participant performing work B owns the secret shares of x and y ([x] 0 and [y] 0 , the remaining N-1 participants (1, 2,...,N-1) who perform work A respectively own the secret sharing of x and y ([x] 1 + [y] 1 ), ([x] 2 +[y] 2 )…,([x] N-1 +[y] N-1 ); and satisfy [x] 0 +[x] 1 +…+[x] N-1 =x,[y] 0 +[y] 1 +…+[y] N-1 =y;

Each of the participants (0,1,…,N-1) includes:

A physical chip. Each physical chip contains an externally unreadable and unique private key corresponding to the corresponding physical chip; each physical chip calculates the corresponding private key through its respective private key. Asymmetric encryption public keys, each of which is read externally as A characteristic that uniquely identifies the corresponding physical chip;

The first pseudo-random number generator and the second pseudo-random number generator are used to generate a common pseudo-random number negotiated between the physical chips of all the participants (0,1,...,N-1) Number generator seed; both participant A and participant B use the first pseudo-random number generator of their respective physical chips to generate two random numbers r1 and r2, and use the second pseudo-random number of their respective physical chips. Generator 2 generates a random number r3;

The multiplication unit obtains the value z of the multiplication operation x*y in the untrusted memory space of the computer outside the physical chip by executing steps S3 to S6 in claim 1.
According to the system of database indexing based on polynomial commitment mechanism according to claim 5, the multiplication unit includes a secret shared bit operator, a random number register group and a secret shared multiplier; the first pseudo-random number generator and A part or all of the pseudo-random number sequence generated by the second pseudo-random number generator is cached in the random number register group to provide the secret shared bit operator and the secret shared multiplier operator for calculation.
The system of database indexing based on polynomial commitment mechanism according to claim 6, characterized in that the secret sharing multiplier includes an input terminal and an output terminal, and the input terminal receives input operations of the untrusted memory space of the computer. Secret sharing of numbers, the output terminal is used to output the multiplication result output to the untrusted memory space in a secret sharing manner.
The database indexing system based on polynomial commitment mechanism according to claim 7, characterized in that the output terminal outputs a regenerated random number in a secret sharing manner to perform a masking operation to ensure that the output data will not Contains more information than any random number.
The database indexing system based on polynomial commitment mechanism according to claim 5, characterized in that, the regenerated random numbers are masked including adding points or and bitwise XOR. kind of.
The database indexing system based on polynomial commitment mechanism according to claim 5, characterized in that the physical chip used by the N participants (0, 1,..., N-1) is an FPGA.