Distributed secure multi party computation

A system for providing a distributed data processing service for performing a secure multiparty computation of a function on at least first and second items of private input data, comprising:

• at least first and second client terminals;
• at least first and second computing engines;
• and
• a communication network configured to communicatively couple the at least first and second client terminals and the at least first and second computing engines;
• wherein the at least first and second computing engines are configured to establish a binding to provide the distributed data processing service;
• wherein the at least first and second computing engines include first, and second cryptographic engines configured to provide a distributed cryptographic generation service configured to provide a plurality of cryptographic primitives required during an online phase of the secure multiparty computation;
• wherein a proportion of the cryptographic primitives are generated during an offline phase prior to the secure multiparty computation, and the plurality of cryptographic primitives are stored by a distributed cryptographic data store service provided by corresponding at least first and second cryptographic data stores managed by the first and second computing engines, respectively;
• wherein the distributed data processing service is configured to obtain service invocations of a secure multiparty computation and at least first and second items of private input data;
• wherein the first and second computing engines are configured to store the at least first and second items of private input data using a distributed object store service of the distributed data processing service provided by at least first and second object store engines managed by the first and second computing engines, respectively;
• wherein the first and second computing engines (are configured to perform, during the online phase, a distributed secure multiparty computation on at least the first and second items of private input data using a distributed multiparty computation service of the distributed data processing service provided by first and second multiparty computing engines managed by the first and second computing engines, respectively, wherein the first multiparty computing engine performs the secure multiparty computation together with at least the second multiparty computing engine;
• and
• wherein at least one result of the secure multiparty computation is stored via the distributed object store service, and/or output to at least the first or the second client terminals;
• wherein the system is configured to use the cryptographic primitives by:
• transmitting, from the first computing engine to at least the second computing engine, a cryptographic primitive reservation request;
• marking the cryptographic primitives in the cryptographic data store of the second computing engine referenced by the cryptographic primitive reservation as reserved;
• activating, in the first and second computing engines, the cryptographic primitives referenced by the cryptographic primitive reservation when the first computing engine determines that the cryptographic primitive reservation has been successfully shared with at least the second computing engine;
• once the requested cryptographic primitives have been sent to the first computing engine, marking the corresponding cryptographic primitives in the second computing engine as consumed.

A computer-implemented method of a first computing engine for participating in a distributed data processing service for performing a secure multiparty computation of a function on at least first and second items of private input data using at least the first and second computing engines in communicatively coupled via a communication network, the method comprising the following steps:

• initiating, by communicating with at least the second computing engine, the distributed data processing service by binding at least the second computing engine to the first computing engine;
• generating, using a first cryptographic engine managed by the first computing engine, a first plurality of cryptographic primitives required by the first computing engine during an online phase of the secure multiparty computation, wherein a proportion of the cryptographic primitives are generated during an offline phase prior to the secure multiparty computation, and the plurality of cryptographic primitives generated by the first computing engine are stored by a first cryptographic data store managed by the first computing engine;
• obtaining, by the distributed data processing service, a service invocation of a secure multiparty computation, and an item of private input data from at least a first client;
• storing the item of private input data in a first object store engine managed by the first computing engine;
• performing, during an online phase, a distributed secure multiparty computation on at least the first and second items of private input data using a distributed multiparty computation service of the distributed data processing service provided by the first and second multiparty computing engines managed by the first and second computing engines, respectively, wherein the first multiparty computing engine performs a first portion of the secure multiparty computation;
• and
• storing a first result of the secure multiparty computation via the distributed object store service, and/or outputting the at least a first result to a first client;
• using the cryptographic primitives by:
• transmitting, from the first computing engine to at least the second computing engine, a cryptographic primitive reservation request;
• marking the cryptographic primitives in the cryptographic data store of the second computing engine referenced by the cryptographic primitive reservation as reserved;
• activating, in the first and second computing engines, the cryptographic primitives referenced by the cryptographic primitive reservation when the first computing engine determines that the cryptographic primitive reservation has been successfully shared with at least the second computing engine;
• once the requested cryptographic primitives have been sent to the first computing engine, marking the corresponding cryptographic primitives in the second computing engine as consumed.

A computer-implemented method of a second computing engine for participating in a distributed data processing service for performing a secure multiparty computation of a function on at least first and second items of private input data using at least a first and the second computing engine in communicatively coupled via a communication network, the method comprising the following steps:

• acknowledging, from the first computing engine, a request to bind to the first computing engine, and binding at least the second computing engine to the first computing engine to initialize the distributed data processing service;
• generating, at a command of the first computing engine and using a second cryptographic engine of the second computing engine, a plurality of cryptographic primitives required by the second computing engine during an online phase of the secure multiparty computation, wherein a proportion of the cryptographic primitives are generated during an offline phase prior to the secure multiparty computation, and the second plurality of cryptographic primitives generated by the second computing engine are stored by a second cryptographic data store managed by the second computing engine;
• obtaining, by the distributed data processing service, a further item of private input data from a second client;
• storing the further item of private input data in a second object store engine managed by the second computing engine;
• performing, during an online phase, a distributed secure multiparty computation on at least the first and second items of private input data using a distributed multiparty computation service of the distributed data processing service provided by first and second multiparty computing engines managed by the first and second computing engines, respectively, wherein the second multiparty computing engine performs a second portion of the secure multiparty computation;
• and
• storing a second result of the secure multiparty computation via the distributed object store service, and/or outputting the second result to the second client;
• using the cryptographic primitives by:
• receiving, from the first computing engine from at least the second computing engine, a cryptographic primitive reservation request;
• marking the cryptographic primitives in the cryptographic data store of the second computing engine referenced by the cryptographic primitive reservation as reserved;
• activating, in the first and second computing engines, the cryptographic primitives referenced by the cryptographic primitive reservation when the first computing engine determines that the cryptographic primitive reservation has been successfully shared with at least the second computing engine;
• once the requested cryptographic primitives have been sent to the first computing engine, marking the corresponding cryptographic primitives in the second computing engine as consumed.

A non-transitory computer readable medium on which is stored a computer program for providing a distributed data processing service for performing a secure multiparty computation of a function on at least first and second items of private input data using at least a first and a second computing engine communicatively coupled via a communication network, the computer program, when executed by a computer processor, causing the computer processor to perform the following steps:

• establishing, using the first computing engine, the distributed data processing service by binding at least the second computing engine to the first computing engine;
• generating, using a distributed cryptographic generation service provided by first and second cryptographic engines managed by the first and second computing engines, respectively, a plurality of cryptographic primitives required during an online phase of the secure multiparty computation, wherein a proportion of the cryptographic primitives are generated during an offline phase prior to the secure multiparty computation, and the plurality of cryptographic primitives are stored by a distributed cryptographic data store service provided by corresponding at least first and second cryptographic data stores managed by the first and second computing engines, respectively;
• obtaining, by the distributed data processing service, service invocations of a secure multiparty computation and at least first and second items of private input data;
• storing the at least first and second items of private input data in a distributed object store service of the distributed data processing service provided by at least first and second object store engines managed by the first and second computing engines, respectively;
• performing, during an online phase, a distributed secure multiparty computation on at least the first and second items of private input data using a distributed multiparty computation service of the distributed data processing service provided by first and second multiparty computing engines managed by the respective first and second computing engines, wherein the first multiparty computing engine performs the secure multiparty computation together with at least the second multiparty computing engine;
• and
• storing at least one result of the secure multiparty computation via the distributed object store service, and/or outputting the at least one result to at least a first or second client;
• using the cryptographic primitives by:
• transmitting, from the first computing engine to at least the second computing engine, a cryptographic primitive reservation request;
• marking the cryptographic primitives in the cryptographic data store of the second computing engine referenced by the cryptographic primitive reservation as reserved;
• activating, in the first and second computing engines, the cryptographic primitives referenced by the cryptographic primitive reservation when the first computing engine determines that the cryptographic primitive reservation has been successfully shared with at least the second computing engine;
• once the requested cryptographic primitives have been sent to the first computing engine, marking the corresponding cryptographic primitives in the second computing engine as consumed.