Distributed function secret sharing key generation method

Abstract

The invention provides a distributed function secret sharing key generation method aiming at the problems that an existing secret sharing key generation scheme depends on a trusted third party and does not support limitation of arithmetic sharing operation. The invention provides a solution for efficient distributed key generation based on improved function secret sharing between two communication parties. The protocol designed by the invention supports arithmetic sharing input and output, the calculation overhead and the communication overhead in the distributed key generation process are greatly reduced by optimizing the communication process on the premise of ensuring the safety and the accuracy of calculation, and the requirement on a trusted third party is completely removed by designing an efficient two-party calculation 2PC protocol, so that the communication efficiency is improved. A participant is allowed to directly generate keys for a distributed point function (DPF) and a distributed comparison function (DCF) through a two-party calculation protocol, the security and practicability of key generation are remarkably improved, and the method is particularly suitable for a scene without a trusted third party.

Description

Technical Field

[0001] The present invention relates to information security technology, and in particular to a distributed function secret sharing key generation technology. Technical Background

[0002] Distributed Function Secret Sharing (FSS) key generation is widely used in scenarios such as privacy-preserving computing, machine learning, biometrics, and scientific computing. The core includes distributed point function (DPF) and distributed comparison function (DCF). DPF is used to collaboratively determine whether values ​​match under secret sharing, while DCF implements data comparison under secret sharing. Both form a key foundation in secure joint computing. For example, FSS can be used to implement privacy-preserving distributed computing of different entities in satellite collision prediction, or to distribute complex activation functions in machine learning, thereby ensuring data privacy.

[0003] The existing FSS key generation protocol faces three main problems: First, existing schemes usually rely on a trusted third party to generate keys in the offline phase, but it is difficult to find a universally trusted third party in reality. Second, most existing third-party-free protocols only support Boolean sharing, not arithmetic sharing, which limits their applicability in many application scenarios involving arithmetic operations. Solving the key generation scheme for this type of function will further expand the application scope of secure computing in daily service scenarios. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a solution for efficient distributed key generation based on improved function secret sharing in a scenario without a trusted third party, in view of the reliance on a trusted third party and the limitation of not supporting arithmetic sharing operations in existing secret sharing key generation schemes.

[0005] The technical solution adopted by the present invention to solve the above technical problems is a method for generating a distributed function secret sharing key, comprising the steps of:

[0006] Communication parties P b The input lengths held are Share target value The output length when the condition matches is Shared output value The communication participants are denoted as P b , where b∈{0,1} is the participant number, and P 1-b Indicates the other party participating in the communication, <α> b Represents the communication participant P b The target value α, <β> b Represents the communication participant Pb The output value β;

[0007] Communication parties P b Call the bit decomposition protocol separately Share target value Convert to Boolean Share Represents the communication participant P b Regarding the Boolean sharing of the target value α, B represents Boolean sharing;

[0008] Communication parties P b Each of them is a 0,1 string {0,1} of length λ λ Randomly sample a seed for a spanning tree And set the flag value corresponding to the seed The position of the seed in the DPF spanning tree, where the superscript i,j represents the seed of the jth node in the i-th layer, j∈[2 i ];

[0009] Communication parties P b Traverse each layer i separately and execute the outer loop steps to obtain Correction word CW i ;

[0010] Communication parties P b Setting variables By pseudo-random group elements Function and seed Calculate the lth arithmetic shared intermediate value of each

[0011] Communication parties P b Individual statistics Arithmetic sharing of median values The sum of the two is w b ,as well as The flag value corresponding to the seed The sum of the total mark value t b ;

[0012] Communication parties P b Each of them will have a total mark value t b Enter a pre-agreed restricted comparison protocol Get their shared content And send it to the other party, and receive the shared content sent by the other party Calculate the true value of shared content

[0013] Communication parties P bThen use their respective arithmetic to share the sum of the intermediate values ​​w b , share output value The two output lengths are calculated as The median value and

[0014] Communication parties P b The middle value of each and And share content Enter current Bit Arithmetic Share Multiplexing Protocol Get the intermediate value of the key And send it to another party P 1-b ; A represents arithmetic sharing; get the key value

[0015] Communication parties P b Using seeds as well as Correction word CW i and key value W CW Concatenate to construct secret sharing key k b , in, for Correction word CW i ,|| means string concatenation.

[0016] More specifically, for the distributed comparison function DCF, a specific correction word CW is designed for the distributed comparison function DCF. i Get the steps.

[0017] The present invention completely eliminates the need for a trusted third party by designing an efficient two-party computing 2PC protocol, allowing the participants to directly generate keys for the distributed point function DPF and the distributed comparison function DCF through the two-party computing protocol. It has significant advantages in applications such as privacy-preserving computing, machine learning training and reasoning, and biometric recognition, ensuring that in collaborative computing, the participants can safely and efficiently share computing results without trusting a third party, while protecting the privacy of their respective data.

[0018] The beneficial effect of the present invention is that it significantly improves the security and practicality of key generation, and is particularly suitable for scenarios where there is no trusted third party. Compared with the most advanced existing solutions, the protocol supports arithmetic sharing of input and output, and by optimizing the communication process, it significantly reduces the computational and communication overhead in the distributed key generation process while ensuring the security and accuracy of the calculation. DETAILED DESCRIPTION

[0019] The cryptographic protocols and specific implementation methods involved in the present invention are implemented based on the following existing basic algorithms:

[0020] 1) Secret sharing: Secret sharing includes two schemes: arithmetic secret sharing and Boolean secret sharing.

[0021] For arithmetic sharing, if you want to Share content x, one party randomly selects one The value r in Sent to the other party. Usually, the arithmetic share of x is expressed as and Where p is a large prime number, represents a remainder class ring modulo p, the superscript A represents arithmetic share, the subscript represents the owner number, and the numbers of the two communicating parties are identified by 0 and 1. In the embodiment, represents a certain share value of A, and A is the target value of sharing.

[0022] For Boolean sharing, if the shared content x is in the loop In the case of and And meet ⊕ represents XOR. The superscript B represents Boolean share, and the subscript represents the owner number.

[0023] In the embodiment, the participant is denoted as P b , where b∈{0,1} is the participant number, and P 1-b Indicates the other party involved.

[0024] 2) Function Secret Sharing: Function Secret Sharing (FSS) is a secure computing scheme that can secretly split a function into two parts. Participants can obtain the secret sharing value of the function based on public input. This scheme is implemented through the algorithm pair (Gen; Eval), where Gen is the key generation algorithm and Eval is the evaluation algorithm.

[0025] Key generation algorithm Gen(1 λ ,f)→k 0 ,k 1 Receives the security parameter λ and the target function f as input, is called by a trusted third party and generates two keys k 0 ,k 1 , respectively distributed to P 0 and P 1 .

[0026] Evaluation algorithm Eval(b,k b ,x)→f b (x) is called by the computing party, the participating party P bGet the result f b (x), satisfying f 0 (x)+f 1 (x) = f(x).

[0027] 3) GGM tree: GGM tree is a binary tree structure based on pseudo-random generator PRG, which is used to construct pseudo-random functions and implement secure computing protocols, such as distributed point function DPF and distributed comparison function DCF. DPF compares the function input value x with the target value α for equality. DCF compares the function input value x with the target value α for size. GGM tree starts from the root node s 0 At the beginning, the pseudo-random generator G(·) is gradually expanded to a binary string G(s) of twice the length. 0 ). Each node generates two child nodes, where the left node is G(s 0 ), the first half of the right node is G(s 0 ), where G represents PRG. The expansion of each layer gradually generates a complete binary tree based on the path bits of 0 or 1. Each node contains a label and a control bit to ensure that the participants have consistent judgments on the path nodes. For the "special path" where the target value α is located, the control bit of each node is set to 1, and the control bits of the remaining paths are 0. In DPF and DCF, the GGM tree uses these labels and control bits to encode the target value, allowing the participants to independently calculate the pseudo-random function f 0 (x)+f 1 (x) = f(x). The correction of the control bit ensures that all parties have consistent judgments on the input, thereby optimizing security and communication efficiency. Correction Word: The correction word is used to adjust the labels and control bits of the nodes in the GGM tree to ensure that the generated tree structure meets the invariant properties of DPF or DCF. The correction word usually includes correction items at each layer and the final correction word, which is used to correct nodes that deviate from the target path to ensure that the output meets the calculation requirements of the distributed function.

[0028] 4) Black box protocol: The following black box protocol can safely and correctly obtain the corresponding output under the given input. In the subsequent algorithm, use The subscript XXX is used to indicate the protocol name, and the superscript Y is determined according to the actual function.

[0029] a) B2A: B2A (Arithmetic to Boolean) agreement Convert Boolean shares to Bit arithmetic sharing. Protocol input is Boolean sharing The output is the corresponding arithmetic share

[0030] b) Multiplexer protocol MUX: MUX (Multiplexer) protocol accomplish Bit Boolean sharing multiplexing function; accomplish Bit arithmetic shares multiplexing capabilities. The input is Bit Boolean Share and a select bit <c> B ∈{0,1}. The output is Bit Boolean Share Satisfies: If c = 0, then z i =x i , otherwise the result is z i =y i This function is implemented through two parallel conditional oblivious transfers (COT).

[0031] The input is Bit Arithmetic Share <x> l ,<y> l }, and a select bit

[0032] <c> B ∈{0,1}. The output is Bit Arithmetic Share <z> l }, satisfying: If c = 0, then z i =x i , otherwise the result is z i =y i This function is implemented through two parallel conditional oblivious transfers (COT).

[0033] c) AND Agreement: AND Agreement Π AND Boolean shared values ​​of x and x held by both communicating parties

[0034] <x> B and <y> B , after protocol calculation, the result is <z> B , satisfying z=x∧y, ∧ represents the AND operation.

[0035] d) Bit Decomposition Protocol: Bit Decomposition Protocol The bit decomposition function is implemented, that is, the input share value is decomposed into its corresponding Boolean bit share. b Holds a length of Share value After the protocol calculation, P b get So that y[i] = x[i], x[i] represents The i position in .

[0036] e) function is a random 01 string {0,1} * Mapping to pseudorandom group elements The function is abbreviated as Specifically, Generate a group using a pseudo-random generator (PRG) The elements in .

[0037] Based on the above protocol, the present invention proposes a distributed function secret sharing key generation method. The present invention constructs an efficient and secure multi-party computing framework through the following protocol process, while protecting data privacy, ensuring the accuracy of distributed computing.

[0038] Restricted Comparison Π CCMP

[0039] Input: P b Hold x b , where x 0 and x 1 The difference between them is 1;

[0040] Output: P b get Among them, if x 0 <x 1 ,but Otherwise y represents the true value of the shared content.

[0041] 1. Each participant P b x b Decompose into high position h b and low position b ;

[0042] 2. Each participant P b set up and

[0043] 3. Each participant P b Computes intermediate results of Boolean sharing

[0044] 4. Each participant P b Final Output Distributed Point Function DPF key generation Input: P b The input length held is Share target value The output length when the condition matches is Shared output value Output: P b Get DPF key k b .

[0045] 1.P b Call enter Get Boolean Share

[0046] 2.P b From {0,1} λ Sampling a random seed And set its flag value Indicates the position of the seed in the spanning tree, where the superscript (0,0) represents the seed of the 0th node in the 0th layer;

[0047] 3. For Execute outer loop steps 3-16:

[0048] 4.P b Will seed Input the pseudo-random generator G to get Reuse Assign the following four values ​​to the connection, namely where j∈[2 i ];

[0049] 5.P b Compute the value and correct word for each layer:

[0050] 6. For p∈{0,1}, traverse j∈[2 i ], P b Set the middle value Indicates that for set j Perform XOR;

[0051] 7. For p∈{0,1},P b Set the middle value

[0052] 8.P b Call enter Get the middle value

[0053] 9.P b Set the middle value And the median value

[0054] 10.P b send To P 1-b To reconstruct σ i ,τ i,0 ,τ i,1 ;

[0055] 11. For j∈[2 i ], execute inner loop steps 11-14:

[0056] 12.P b set up A←B means assigning value to A with B;

[0057] 13.P b set up and

[0058] 14. Complete the traversal of j and end the inner loop step;

[0059] 15.P b Set correction word CW i =σ i ||τ i,0 ||τ i,1 , correct word CW i The purpose is to make the last bit of the random string obtained by each node follow the path of the target control bit, that is, the values ​​of the control bits on the correct path are all 1;

[0060] 16. Complete the traversal of i and get Correction word CW i , end the outer loop step;

[0061] 17. For P b Calculate the median value of an arithmetic share

[0062] 18.P b set up

[0063] 19.P b Call Input t b ,get

[0064] 20.P b set up

[0065] 21.P b set up

[0066] 22.P b Call enter get Right now It can make P b By sharing the real value of content Select one as output Then Send it to the other party and finally construct the key value

[0067] 23.P b set up

[0068] 24. Return to k b .

[0069] Distributed comparison function DCF key generation

[0070] Input: P b The input length held is Share target value The output length when the condition matches is Shared output value

[0071] Output: P b Get the DCF key k b .

[0072] 1.P b Call enter Get Boolean Share

[0073] 2.P b From {0,1} λ Sampling a random seed And set V α =0;

[0074] 3. For Execute outer loop steps 3-17:

[0075] 4.P b set up where j∈[2 i ], and for p∈0,1,

[0076]

[0077] 5. For p∈0,1,P b set up

[0078] 6. For p∈0,1,P b set up

[0079] 7.P b Call enter get

[0080] 8.P b set up and

[0081] 9.P b send To P 1-b To reconstruct σ i ,τ i,0 ,τ i,1 ;

[0082] 10. For j∈[2 i+1 ], P b set up

[0083] 11.P b Call Get (V CW ,V α );

[0084] 12.P b Setting CW i =σ i ||V CW ||τ i,0 ||τ i,1 ;

[0085] 13. For j∈[2 i ], execute inner loop steps 13-16:

[0086] 14.P b set up

[0087] 15.P b set up and

[0088] 16. Complete the traversal of j and end the inner loop step;

[0089] 25. Complete the traversal of i and end the outer loop step;

[0090] 26. For P b Calculate the median value of an arithmetic share

[0091] 27.P b set up

[0092] 28.P b Call Input t b ,get

[0093] 29.P b set up

[0094] 30.P b set up

[0095] 31.P b Call enter Right now It can make P b By sharing the real value of content Select one as output Then Send it to the other party and finally construct the key value

[0096]

[0097] 32.P b send To P 1-b To reconstruct W CW ;

[0098] 33.P b set up

[0099] 17. Return to k b .

[0100] Public correction word generation Input: P b Holds the tree level i to which the correction word is applied, the input vector v for the pseudo-random generator, the control vector t for indicating the branch direction or state vector for each layer or node, the Boolean share of the input value at the i-th position Output sharing when matching position Refers to the bit length output of β: P b Get the public correction word V of the i-th layer CW , and the updated V α ;

[0101] 1.P b calculate The left and right children p∈0,1;

[0102] 2.P b set up And call Input t b To obtain

[0103] 3.P b Call enter Get the CW intermediate value used to calculate the additional correction word for each layer

[0104] 4.P b set up

[0105] 5.P b Call enter Get

[0106] α[i] represents the i-th bit of α, express Arithmetic sharing of 0 under bits;

[0107] 6.P b set up

[0108] 7.P b Call enter Get Among them; namely It can make P b By sharing the real value of content Select one as output Then Send to the other party P 1-b , and finally construct the intermediate value

[0109]

[0110] 9.P b Call enter To obtain

[0111] 10.P b set up

[0112] 11.P b Will Send to P 1-b , to reconstruct V α ;

[0113] 12. Return (V CW ,V α ).< / z> < / z> < / c> < / c>

Claims

1. A method for generating a distributed function secret sharing key, characterized in that: The following steps are involved: Communication parties P b The input length held is l in Share target value The output length when the condition matches is l out Shared output value The communication participants are denoted as P b , where b∈{0,1} is the participant number, and P 1-b Indicates the other party participating in the communication, <α> b Represents the communication participant P b The target value α, <β> b Represents the communication participant P b The output value β; Communication parties P b Call the bit decomposition protocol separately Share target value Convert to Boolean Share Represents the communication participant P b Regarding the Boolean sharing of the target value α, B represents Boolean sharing; Communication parties P b Each is a 0, 1 string {0, 1} of length λ λ Randomly sample a seed for a spanning tree And set the flag value corresponding to the seed The position of the seed in the DPF spanning tree, where the superscript i, j represents the seed of the jth node in the i-th layer, i∈[l in ],j∈[2 i ]; Communication parties P b Traverse each layer i separately and execute the outer loop step to obtain l in Correction word CW i ; Communication parties P b Setting variables By pseudo-random group elements Function and seed Calculate the lth arithmetic shared intermediate value of each Communication parties P b Individual statistics Arithmetic sharing of median values The sum of the two is w b ,as well as The flag value corresponding to the seed The sum of the total mark value t b ; Communication parties P b Each of them will have a total mark value t b Enter a pre-agreed restricted comparison protocol Get their shared content And send it to the other party, and receive the shared content sent by the other party Calculate the true value of shared content Communication parties P b Then use their respective arithmetic to share the sum of the intermediate values ​​w b , share output value Calculate the two output lengths to be l out The median value and Communication parties P b The middle value of each and And share content Input l out Bit Arithmetic Share Multiplexing Protocol Get the intermediate value of the key And send it to another party P 1-b ; A represents arithmetic sharing; get the key value Communication parties P b Using seeds and in Correction word CW i and key value W CW Concatenate to construct secret sharing key k b , in, for l in Correction word CW i ,|| means string concatenation.

2. The method according to claim 1, characterized in that: Restricted Comparison Protocol for: Communication parties P b Each will x b Decompose into high position h b and low position b ;x b Represents the participant P b Input to the restricted comparison protocol data; Communication parties P b Boolean sharing of two intermediate values ​​z0 and z1 respectively and Compute the respective Boolean shared intermediate results Communication parties P b Restricted Comparison Protocol Output sharing content 3. The method according to claim 1, characterized in that: For the distributed point function DPF, the communicating parties P b Traverse each layer i separately and execute the outer loop step to obtain l in Correction word CW i The specific steps are: For i∈[l in ], the communicating parties P b Each seed Input the pseudo-random generator G to get the intermediate value Then use the middle value Seeds and And the corresponding flag value and The connection is assigned, Traverse j∈[2 i ]; P b Compute the value and correct word for each layer: For the left and right child labels p∈{0,1}, P b Set the middle value in, Indicates that under set j XOR; set the middle value P b enter and to lambda-bit Boolean share multiplexing function Enter the intermediate value in represents the Boolean share of the i-th bit of the target value α; P b Using the median value Calculate the median value and the median P b Sending intermediate values To P 1-b , accept the supervisor sent by the other party Reconstruct the intermediate value σ i , τ i，0 , τ i，1 ; For j∈[2 i ], start executing the inner loop steps to update the seed and And the corresponding flag value and P b calculate To update calculate Complete the traversal of j and end the inner loop step; P b Calculate the correction word CW i =σ i ||τ i，0 ||τ i，1 ; Complete the traversal of i and get l in Correction word CW i , ending the outer loop step.

4. The method according to claim 1, characterized in that: For the distributed comparison function DCF, the communicating parties P b Traverse each layer i separately and execute the outer loop step to obtain l in Correction word CW i The specific steps are: For i∈[l in ], the communicating parties P b Each seed Input the pseudo-random generator G to get the intermediate value Then use the middle value Q i+1，2j ||Q i+1，2j+1 Assignment, where j∈[2 i ]; then use the obtained Q i+1，2j+p right Assignment, where is a 0, 1 string of length λ, p∈{0,1}, × represents the concatenation of the string length; P b The two communicating parties each calculate the XOR under set j to obtain the intermediate value and the median P b The communicating parties each send the intermediate value and the median value Input to λ-bit Boolean share multiplexing function Get the middle value P b Using the median value Calculate the median value and the median P b Sending intermediate values To P 1-b , accept the supervisor sent by the other party Reconstruct the intermediate value σ i , τ i，0 , τ i，1 ; For j∈[2 i+1 ], P b Set the input vector v for the pseudo-random generator and the control vector t for indicating the branch direction or state vector, where Will V α Input common correction word generation protocol ComputeCW, ComputeCW output (V CW , V α ), where V CW For public correction words, V α For the intermediate value, enter the intermediate value V of ComputeCW α The initial setting is 0; P b Set correction word CW i =σ i ||V CW ||τ i，0 ||τ i，1 ; For j∈[2 i ], start executing the inner loop steps to update the seed and And the corresponding flag value and P b calculate To update calculate Complete the traversal of j and end the inner loop step; Complete the traversal of i and end the outer loop step.

5. The method according to claim 4, characterized in that: Will V α Input common correction word generation protocol ComputeCW, ComputeCW output (V CW , V α ) is as follows: For the left and right child labels p∈{0,1}, P b For set j, pass pseudo-random group elements The function and input vector v calculate the intermediate value P b Calculate the median by summing the values ​​of set j The middle value t b Input-constrained comparison protocol middle, Output shared content P b Will and Input l out Bit Arithmetic Share Multiplexing Protocol Get the middle value P b Update the intermediate value P b Will <α[i]> b Input l out Bit Arithmetic Share Multiplexing Protocol Get the middle value Indicates l out Arithmetic sharing of 0 under bits; P b Using the median value V α and Calculate the median value and P b The middle value and And share content Input l out Bit Arithmetic Share Multiplexing Protocol Get the middle value And send it to another party P 1-b , and then according to the received Constructing the intermediate value P b Share content Input l out Bitwise Boolean Conversion Arithmetic Sharing Protocol Get shared content P b Calculate the median value And send it to another party P 1-b , and then according to the received Constructing the intermediate value P b ComputeCW output (V CW , V α ).

Images