Non-interactive multiplication privacy protection method based on summer secret sharing

Abstract

The invention relates to the technical field of privacy protection, in particular to a non-interactive multiplication privacy protection method based on summer secret sharing, which comprises the following steps: optimizing a secret polynomial coefficient and selecting a calculation modulus parameter, so that the polynomial times after secret sharing multiplication calculation are not changed; in order to solve the problem that a traditional secret sharing scheme is insufficient in security, a traditional (k, n) threshold secret sharing scheme is improved, a public key is generated by using a combined order group in an initial stage, and for the traditional scheme, the security is only increased but not reduced; the invention provides a secret sharing tree structure for completing a joint computing task among multiple users in allusion to the situation that data among multiple users are not shared and have a demand on joint computing at present. The scheme provided by the invention not only can be used for joint calculation among multiple users, but also can accelerate calculation time and complete more complex calculation tasks in any privacy protection application using secret sharing.

Description

Technical Field

[0001] The present invention relates to the technical field of privacy protection, and in particular to a privacy protection method based on non-interactive multiplication of Charmilles secret sharing. Background Art

[0002] As data grows, personal privacy is also facing new challenges. Large data sets may contain a large amount of sensitive information, such as personal identity, geographic location, and health status. The haphazard disposal of this data may lead to potential privacy risks, so people need to ensure the protection of sensitive information while pursuing data insights. Specifically, in today's medical environment, the integration of data technology and the popularization of medical informatization have led to the digital recording and storage of a large amount of medical data in various medical institutions. These data include clinical records, imaging data, laboratory results, etc. Usually, collaborative analysis and diagnosis are required between different medical entities to obtain comprehensive and accurate diagnosis results. How to complete joint computing while protecting data privacy is a hot issue in current research.

[0003] According to statistics, in 2018, Facebook caused the data leakage of 50 million users; in 2019, the First American Financial Company in the United States, due to the lack of security measures on the website, anyone could access the customer database without identity verification, resulting in the leakage of about 885 million files, including some highly sensitive data, such as bank account numbers, mortgages, bills, tax records and driver's license images. As large enterprises and companies attach importance to data security, relevant data privacy protection laws have been introduced one after another, such as the "Cybersecurity Law of the People's Republic of China" launched by my country in 2017, the "General Data Protection Regulation" launched by the European Union in 2018, and the "California Consumer Privacy Act" implemented by the United States in 2020. At the same time, domestic and foreign Internet giants, such as Tencent, Alibaba, Microsoft and Google, have made a lot of research in the field of data security, which shows the importance and urgency of protecting data privacy. The development of artificial intelligence relies on data information provided by big data, but because most of the data contains sensitive information, it is difficult to collect data from individuals or multiple institutions, so the field of artificial intelligence faces the problems of "data islands" and privacy protection. Privacy computing is currently the mainstream technology to solve such problems. In this case, secure multi-party computing (MPC) came into being.

[0004] Secure multi-party computing originated from the millionaire's problem proposed by Yao Qizhi in 1982. Secure multi-party computing uses cryptographic protocols, such as secret sharing and homomorphic encryption, to ensure that the original data is not leaked during the calculation process by dividing the data into several parts and using mathematical algorithms to distribute them to participants. The specific expression is as follows: x represents the original data, x1, x2, ..., x nRepresents the segmented part of the data, and the segmented data is assigned to participants P1, P2, …, P n , calculate F(x1,x2,…,x) without revealing x n ), where each participant only knows the data segmentation and calculation results he holds.

[0005] Insufficient and deficient existing solutions: For (k, n) threshold secret sharing on cloud analysis, the addition of secret shares is relatively easy to implement because it has additive homomorphism. Only a simple sum is needed to satisfy the share upload of k servers, thereby recovering the secret x. For the secret sharing multiplication sub-protocol on the cloud, the number of the resulting polynomial changes from k to 2k-1, requiring a large amount of server communication time or the generation of additional auxiliary tuples to complete the multiplication calculation. In practical applications, the calculation task cannot be completed within the effective time. Therefore, for the federated learning scheme based on (k, n) threshold secret sharing and other multi-party secure computing tasks, the actual calculation is quite complicated. Specifically, for multi-party user departments with joint computing needs, the high time consumption of the secret sharing scheme is unbearable. Summary of the invention

[0006] The purpose of the present invention is to provide a privacy protection method based on non-interactive multiplication of Charmilles secret sharing, aiming to solve the problem that the implementation of traditional secret sharing multiplication sub-protocol requires communication or auxiliary tuples, and to realize a secret sharing scheme that does not require communication and additional auxiliary tuples, and can meet the joint computing needs between multiple users.

[0007] To achieve the above object, the present invention provides a privacy protection method based on non-interactive multiplication of Charmilles secret sharing, comprising the following steps:

[0008] Step 1: Select a (k,n) threshold secret sharing scheme;

[0009] Step 2: Distribute and reconstruct secrets;

[0010] Step 3: Adjust the multiplication of the secret shares and recover the secret;

[0011] Step 4: Perform joint calculations among multiple users based on the tree structure to achieve n-party secret sharing.

[0012] Optionally, in step 1, there is a set x consisting of participant identity information = {x1, x2, ..., x n}, distribute the public key N = p to all participants 2 q, [s1] i is the server P1's i shares, where the number of shares n required for reconstruction is k.

[0013] Optionally, the execution process of step 2 includes the following steps:

[0014] Step 2.1: Given security parameter 2 λ .p and q both select 2 n+1 Fermat prime form, N = p 2 q, which distributes N to each participant for modular operations of secret share multiplication and addition;

[0015] Step 2.2: Construct a polynomial f(x) of degree k-1, with polynomial coefficients a1, a2, …, a k-1 ∈p·q·Z p ;

[0016]

[0017] N is the public key generated in the initialization phase; then, the administrator uses f(x) to generate n = 2k secret shares of the secret s, which are calculated as follows:

[0018] [s] i =f(x i )(i=0,1,...,k-1);

[0019] Step 2.3: Collect [s] from k participants i , recover the secret s=L(0) by constructing the Lagrange polynomial L(x), the specific expression of L(x) is as follows:

[0020]

[0021] Optionally, the execution process of step 3 includes the following steps:

[0022] Step 3.1: The degree of the polynomial corresponding to the secret sharing is a polynomial of the same order, assuming t = k

[0023]

[0024] Step 3.2: For polynomials of different orders, assume t>k

[0025]

[0026] Step 3: Reconstruct s1s2. Regardless of whether the degree of the polynomials is the same or different, the manager collects [h(x)] from k participants. i To recover s1 s2, the corresponding Lagrange polynomial L(x) is constructed as follows:

[0027]

[0028] Optionally, the tree structure in step 4 is divided according to the internal organizational structure of each department of different multi-party users, and the leaf nodes represent child secret shares. The department tree structure T is public, but the underlying secret shares are kept confidential.

[0029] Optionally, the joint calculation process in step 4 is divided into the following three cases:

[0030] If both matching nodes are leaf nodes, addition or multiplication can be performed directly without communication and auxiliary tuples;

[0031] If one node is a leaf node and the other node is a non-leaf node, the value of the leaf node can be calculated from the leaf nodes of the child nodes of the non-leaf node;

[0032] If one node is a leaf node and the other is a non-leaf node, joint computation cannot be performed.

[0033] The present invention provides a privacy protection method based on non-interactive multiplication of Chamier secret sharing, by optimizing the secret polynomial coefficients and the selection of calculation modulus parameters, the polynomial degree does not change after the secret sharing multiplication calculation; in view of the problem of insufficient security of the traditional secret sharing scheme, the traditional (k, n) threshold secret sharing scheme is improved, and the combination order group is used to generate the public key in the initial stage, and the security of the traditional scheme is only increased and not decreased; in view of the current situation that data is not shared between multiple users but there is a demand for joint calculation, a secret sharing tree structure is proposed to complete the joint calculation task between multiple users. The scheme proposed by the present invention can not only be used for joint calculation between multiple users, but also can accelerate the calculation time and complete more complex calculation tasks in any privacy protection application using secret sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0035] Figure 1 It is a schematic flow chart of the steps of a privacy protection method based on non-interactive multiplication of Charmilles secret sharing of the present invention.

[0036] Figure 2 It is a schematic diagram of the access tree structure of a specific embodiment of the present invention. DETAILED DESCRIPTION

[0037] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0038] See also Figure 1 The present invention provides a privacy protection method based on non-interactive multiplication of Charmilles secret sharing, comprising the following steps:

[0039] S1: Select the (k,n) threshold secret sharing scheme;

[0040] S2: distribute and reconstruct secrets;

[0041] S3: adjust the multiplication of secret shares and recover the secret;

[0042] S4: Joint computing among multiple users based on a tree structure to achieve n-party secret sharing.

[0043] The following is a further explanation based on the specific implementation steps:

[0044] In step S1, there is a set x consisting of participant identity information = {x1, x2, ..., x n}, distribute the public key N = p to all participants 2 q, [s1] i is the server P1's i shares, where the number of shares n required for reconstruction is k.

[0045] Specifically, the distribution and reconstruction of the secret in step S2 includes the following steps:

[0046] Step 2.1: Given security parameter 2 λ .p and q both select 2 n+1 Fermat prime form, N = p 2 q, which distributes N to each participant for modular operations of secret share multiplication and addition;

[0047] Step 2.2: Construct a polynomial f(x) of degree k-1, with polynomial coefficients a1, a2, …, a k-1 ∈p·q·Z p ;

[0048]

[0049] N is the public key generated in the initialization phase; then, the administrator uses f(x) to generate n = 2k secret shares of the secret s, which are calculated as follows:

[0050] [s] i =f(x i )(i=0,1,...,k-1);

[0051] Step 2.3: Collect [s] from k participants i , recover the secret s=L(0) by constructing the Lagrange polynomial L(x), the specific expression of L(x) is as follows:

[0052]

[0053] For the multiplication of the secret share in step S3, specifically:

[0054] Assume that the secret value s1 corresponds to the polynomial f(x), and the secret value s2 corresponds to the polynomial g(x). Each participant P i (i=0,1,...,k-1) using secret sharing [s] i Directly perform local calculations without exchanging intermediate data through communication rounds. It is worth mentioning that for the two cases where the polynomial degrees corresponding to the secret sharing are the same and different, the present invention provides different calculation methods respectively. But in either case, the polynomial degree of the result is the higher number, and the number of servers corresponding to the recovered secret remains unchanged. The following are two multiplication cases and specific methods for recovering the secret:

[0055] 1. For polynomials of the same order, assume t = k

[0056] h(x)=f(x)·g(x)

[0057]

[0058] 2. For polynomials of different orders, assuming t>k

[0059]

[0060] 3. Reconstruct s1s2

[0061] Regardless of whether the degree of the polynomials is the same or different, the manager collects [h(x)] from k participants. i To recover s1 s2, the method is to construct the Lagrange polynomial L(x) as follows:

[0062]

[0063] The process of step S4 is specifically a joint calculation process between multiple users:

[0064] In today's medical environment, the integration of data technology and the popularization of medical informatization have led to the digital recording and storage of a large amount of medical data in various medical institutions. These data include clinical records, imaging data, laboratory results, etc. Usually, collaborative analysis and diagnosis are required between different medical entities to obtain comprehensive and accurate diagnosis results. Therefore, achieving joint diagnosis of medical data has become a top priority in contemporary medical care. In this case, the present invention proposes a tree access structure to split secret sharing and promote joint computing without communication. The present invention takes the joint computing between two departments as an example, but in practical applications, the framework of the present invention can support joint computing between n parties.

[0065] In the solution of the present invention, each department divides the tree structure according to its internal organizational structure, and repeatedly performs secret sharing calculations according to the assigned tree structure. This process eventually forms a tree structure whose leaf nodes represent child secret shares. It is worth noting that the department tree structure T is public, but the underlying secret shares are kept confidential.

[0066] Specifically, the method of the present invention is based on a hierarchical access control framework similar to a tree structure. At the top of this structure is a root node representing a secret value. Using a secret sharing algorithm, the secret value is split and distributed among the child nodes of the root node. These child nodes then become new secret values ​​and the secret sharing algorithm is recursively applied again. This process extends downward through the tree structure, ultimately resulting in a configuration where the root node retains the original secret value and the child nodes contain the allocated secret shares. Figure 2 .a and Figure 2 .b shows two different tree structures, corresponding to the secret sharing between different departments. The leaf nodes are the secret sharing, and the content of the root node is the number of its child nodes and the threshold for recovering the secret.

[0067] Here is a detailed description of the procedure:

[0068] -Each participant can obtain the public tree structure of each department, but does not know the secret value of the leaf node.

[0069] -Matching is performed based on the subtree division of the root node. For example, if the root node of tree structure A has m child nodes, and the root node of tree structure B has n child nodes, then matching will be performed sequentially between the child nodes. Subsequently, the child nodes are treated as root nodes, and matching continues repeatedly until the leaf nodes of the tree structure are reached.

[0070] -Each matching node is calculated separately. If both matching nodes are leaf nodes, addition or multiplication can be performed directly, and no communication and auxiliary tuples are required. If one node is a leaf node and the other is a non-leaf node, the value of the leaf node can be calculated by the leaf nodes of the children of the non-leaf node. However, if one node is a leaf node and the other is a non-leaf node, joint calculation cannot be performed.

[0071] The following is the specific implementation process:

[0072] 1. Input: the public tree structure T of each department and the local data share owned by each user.

[0073] 2. Matching: Matching is performed based on the subtree division of the root node. For example, if the root node of tree structure A has m child nodes, and the root node of tree structure B has n child nodes, then matching will be performed sequentially between the child nodes. Subsequently, the child nodes are regarded as root nodes, and repeated matching continues until the leaf nodes of the tree structure are reached.

[0074] 3. Calculation: The calculation is divided into three different situations, and different situations are explained according to the matching results.

[0075] (1) If both matching nodes are leaf nodes, addition or multiplication can be performed directly without communication and auxiliary tuples. That is, for user P i For example, the secret sharing scheme of the present invention is directly used for calculation. Assuming two-party calculation, the corresponding polynomials of the secret values ​​of the two users are f(x) and g(x). The multiplication calculation of the secret shares is directly performed, and the calculation result is directly uploaded to the central server to restore the result of the joint calculation.

[0076] Secret share calculation

[0077]

[0078] Settlement result reconstruction

[0079]

[0080] (2) If one node is a leaf node and the other node is a non-leaf node, then the value of the leaf node can be calculated through the leaf nodes of the child nodes of the non-leaf node. Specifically, assume that the polynomial corresponding to the secret value of the leaf node is f(x), and the polynomial corresponding to the non-leaf node is g(x). First, traverse all the child nodes of the non-leaf node g(x) until the leaf node is traversed. The non-leaf nodes are also divided according to the secret sharing scheme proposed above. (Construct a polynomial f(x) of degree k-1, and the polynomial coefficients are a1, a2, ..., ak-1 ∈p·q·Z p The polynomial g(x) is as follows The calculation starts from the leaf node of g(x), and f(x) is calculated for all nodes in the leaf node layer. After the calculation is completed, the nodes are reconstructed The result of the calculation continues to iterate the above operation until it ends at the same layer as f(x). Then continue to follow the method in step (1) to complete the joint calculation

[0081] (3) If one node is a leaf node and the other is a non-leaf node, joint computation cannot be performed.

[0082] Furthermore, in order to illustrate the effect of the privacy protection method based on non-interactive multiplication of Charmilles secret sharing, the present invention uses Python to conduct experiments and displays the experimental results.

[0083] In the experiment, the present invention specifies the number of servers N=2, and the threshold k for recovering secrets is 2. In addition, the fields used in all experiments are 1000-bit fields, which can approximately guarantee 1000 bits of security. The present invention uses a computer to complete the experiment, where the virtual machine represents the user and the local represents the server that distributes the secret, which results in the computational cost being twice the actual time. The present invention runs the protocol of the present invention on different depth multiplication gates. Table 1 shows the time required to complete each process m times.

[0084] Implementation Environment

[0085] - Operating system Windows 11 Professional 64-bit

[0086] -CPU: Intel(R) Core(TM) i5-10400 processor, main frequency 2.90GHz

[0087] -Memory 32.00GB

[0088] - Platform: PyCharm 2021

[0089] Specifically, Table 3 shows that it takes less than 1 second for each participant to distribute 100,000 secrets to the server. According to Table 3, it takes less than 0.1 second to calculate 1,000,000 multiplications. Therefore, it can be said that the multiplication method proposed by the present invention is very efficient in terms of calculation time.

[0090] Table 1 Calculation time

[0091]

[0092] Furthermore, the present invention is compared with other secret sharing schemes [11-13] and it is found that the proposed method is superior to the above schemes in terms of computational overhead and communication overhead, and is also superior to the above schemes in terms of scalability. For scheme

[11] , although it does not require communication, it requires 2k-1 copies to recover the secret. In addition, scheme

[11] also achieves the result of reducing the number of polynomials, but its calculation process is very complicated and requires a lot of communication, while the scheme of the present invention does not require any communication and the calculation is much simpler.

[0093] For schemes [12-13], although they only need k secret shares to recover the secret, they all require additional communication and need to encrypt and distribute the secret shares in the secret distribution phase. For scheme

[12] , it does not support deeper calculations, that is, it only supports one-time calculations and has low scalability. The scheme of the present invention does not require communication, can support calculations of arbitrary depth, and has scalable calculations. Table 2 shows the comparison with the following schemes.

[0094] Table 2 Comparison results of other secret sharing schemes

[0095] process This program

[11]

[12]

[13] Number of shares ≥2k-1 2k-1 2k-1 2k Number of servers ≥k ≥k ≥k ≥k Is interaction required? No No Yes Yes Reconstruction required share k 2k-1 k k

[0096] The corresponding scheme names and sources are as follows:

[0097]

[11] Shingu, Takeshi, Keiichi Iwaumura, and Kitahiro Kaneda. "Secrecycomputation without changing polynomial degree in Shamir's(k,n)secret sharingscheme."International Conference on Data CommunicationNetworking.Vol.2.SciTePress,2016.

[0098]

[12] Kamal, Ahmad Akmal Aminuddin Mohd, and Keiichi Iwamura. "(Server-Aided)Two-Party Multiplication of Encrypted Shares Using(k,n)Threshold SecretSharing With N≥k Servers." IEEE Access 9(2021):113117-113129.

[0099]

[13] Kamal, Ahmad Akmal Aminuddin Mohd, and Keiichi Iwamura. "Privacypreserving multi-party multiplication ofpolynomials based on (k,n)thresholdsecret sharing." ICT Express 9.5(2023):875-881.

[0100] Tables 3 and 4 compare the computational cost, communication cost, and number of rounds of the proposed method with the existing solutions proposed in [11-13]. Table 3 shows that the computational cost of the proposed method (when N=k) in the distribution of a, b and the reconstruction of ab is significantly lower than that of the methods in [11-13]. Table 4 compares the communication cost with the traditional method. These tables show that the proposed solution is superior to other solutions in terms of both computational complexity and communication complexity.

[0101] Table 3. Comparison with traditional methods (computational cost)

[0102] process This program

[11]

[12]

[13] Distribution of secret shares <![CDATA[2c1]]> <![CDATA[2c1+2c2]]> <![CDATA[2(c1+2kc2)]]> <![CDATA[3c1]]> Multiplying secret shares <![CDATA[2kc1]]> 2nM <![CDATA[2kc2]]> <![CDATA[4kc1]]> Secret Share Reconstruction <![CDATA[c2]]> <![CDATA[c1+2c2]]> <![CDATA[c2]]> <![CDATA[c2]]>

[0103] Table 4. Comparison with traditional methods (communication cost)

[0104] process This program

[11]

[12]

[13] Secret Share Distribution <![CDATA[kd1]]> <![CDATA[6nd1]]> <![CDATA[8kd1]]> <![CDATA[12d1]]> Multiplying secret shares 0 0 <![CDATA[4kd1+2k 2 d1]]> <![CDATA[2+k8kd1]]> Secret Share Reconstruction <![CDATA[2kd1]]> <![CDATA[4kd1]]> <![CDATA[2kd1]]> <![CDATA[2kd1]]>

[0105] In summary, compared with the prior art, the present invention has the following beneficial effects:

[0106] (1) Compared with the existing schemes, the present invention can realize the privacy protection scheme of n-party multiplication based on secret sharing without communication. Among all the privacy protection schemes based on secret sharing, the multiplication sub-protocol of secret sharing requires a lot of communication between users, and user communication is the main time-consuming part of privacy protection. By setting the public key generation scheme, the need to communicate in the calculation to recover the secret is effectively avoided. The speed and efficiency of the implementation of the scheme are greatly improved. It provides an operational basis for the calculation of exponential and complex operations in multi-party secure computing such as federated learning.

[0107] (2) The public key is generated by using the combinatorial order group problem, which strengthens the security of the privacy protection scheme based on secret sharing. Compared with the traditional scheme, the security is only improved. At the same time, Fermat primes are used for fast modular reduction calculation, which greatly speeds up the calculation speed. Under the 1000-bit security background, the calculation time is less than 0.1s. This plays a key role in privacy protection applications involving multiple parties. As the number of participants increases, the advantages of the scheme become more obvious.

[0108] (3) In the joint computing algorithm of multiple users, it can effectively improve the current data island problem among multiple users, and solve the problem of computing between departments because the data is distributed in the hands of different people. It can use data for secure computing under the premise of protecting data privacy, and there is no need for any computing communication between multiple users. They only need to receive instructions issued by the administrator to perform computing.

[0109] What is disclosed above is only a preferred embodiment of the present invention, and it certainly cannot be used to limit the scope of rights of the present invention. Ordinary technicians in this field can understand that all or part of the processes of the above embodiment and equivalent changes made according to the claims of the present invention still fall within the scope of the invention.

Claims

1. A privacy protection method based on non-interactive multiplication of Charmilles secret sharing, characterized in that: The following steps are involved: Step 1: Select a (k,n) threshold secret sharing scheme; Step 2: Distribute and reconstruct secrets; Step 3: Adjust the multiplication of the secret shares and recover the secret; Step 4: Perform privacy calculation among multiple users based on the tree structure to achieve n-party secret sharing.

2. The privacy protection method based on non-interactive multiplication of Charmilles secret sharing as claimed in claim 1, characterized in that: In step 1, there is a set x consisting of participant identity information = {x1, x2, ..., x n }, distribute the public key N = p to all participants 2 q, [s1] i is the server P1's i shares, where the number of shares n required for reconstruction is k.

3. The privacy protection method based on non-interactive multiplication of Charmilles secret sharing as claimed in claim 2, characterized in that: The execution process of step 2 includes the following steps: Step 2.1: Given security parameter 2 λ .p and q both select 2 n+1 Fermat prime form, N = p 2 q, which distributes N to each participant for modular operations of secret share multiplication and addition; Step 2.2: Construct a polynomial f(x) of degree k-1, with polynomial coefficients a1, a2, …, a k-1 ∈p·q·Z p ; N is the public key generated in the initialization phase; then, the administrator uses f(x) to generate n = 2k secret shares of the secret s, which are calculated as follows: [s] i =f(x i )(i=0,1,...,k-1); Step 2.3: Collect [s] from k participants i , recover the secret s=L(0) by constructing the Lagrange polynomial L(x), the specific expression of L(x) is as follows:

4. The privacy protection method based on non-interactive multiplication of Charmilles secret sharing as claimed in claim 3, characterized in that: The execution process of step 3 includes the following steps: Step 3.1: The degree of the polynomial corresponding to the secret sharing is a polynomial of the same order, assuming t = k Step 3.2: For polynomials of different orders, assume t>k Step 3: Reconstruct s1 s2. Regardless of whether the degree of the polynomials is the same or different, the manager collects [h(x)] from k participants. i To recover s1 s2, the corresponding Lagrange polynomial L(x) is constructed as follows:

5. The privacy protection method based on non-interactive multiplication of Charmilles secret sharing as claimed in claim 4, characterized in that: The tree structure in step 4 is divided according to the internal organizational structure of each department of different multi-party users. The leaf nodes represent sub-secret shares. The department tree structure T is public, but the underlying secret shares are kept confidential.

6. The privacy protection method based on non-interactive multiplication of Charmilles secret sharing as claimed in claim 5, characterized in that: The joint calculation process in step 4 is divided into the following three cases: If both matching nodes are leaf nodes, addition or multiplication can be performed directly without communication and auxiliary tuples; If one node is a leaf node and the other node is a non-leaf node, the value of the leaf node can be calculated from the leaf nodes of the child nodes of the non-leaf node; If one node is a leaf node and the other is a non-leaf node, joint computation cannot be performed.

Images