Homomorphic secret sharing method

Abstract

The invention discloses a homomorphic secret sharing method, which adopts a Shamir threshold secret sharing scheme, and can provide threshold security for the homomorphic secret sharing method, so that a server set or an access structure which does not meet a certain condition cannot recover a specific secret value from a given secret share; meanwhile, a Shamir threshold secret sharing scheme is combined with a homomorphic encryption algorithm, so that the degree of a polynomial of the homomorphic secret sharing scheme can be improved; a homomorphic encryption algorithm is adopted to perform encryption calculation on secret input, so that after the secret input is calculated by an unauthorized server, a calculation result can be decrypted by an output server to obtain a function value of the secret input under a given function.

Description

Technical Field

[0001] This invention belongs to the field of information security technology and relates to a homomorphic secret sharing method. Background Technology

[0002] In 1979, Adi Shamir and George Blakley independently proposed the concept of secret sharing. The core idea is to divide a secret into several secret shares, and the secret can only be recovered when a certain number of users possess these shares. Shamir's secret sharing scheme is the most widely used. It is based on polynomial interpolation, constructing a polynomial over a finite field and setting the secret as its zero-point value. Only when a certain number of point value pairs are known can the polynomial be reconstructed using Lagrange interpolation, and then the zero-point value calculated to recover the secret.

[0003] Homomorphic encryption was proposed by Rivest et al. in 1978, but it wasn't until 2009 that Gentry et al. first implemented fully homomorphic encryption. Its core idea is that performing addition or multiplication on two ciphertexts results in a decrypted version of the same operation on the plaintexts. Based on whether it supports additive or multiplicative homomorphism and the number of operations allowed, homomorphic encryption can be divided into partially homomorphic (supporting only additive or multiplicative homomorphism), slightly homomorphic (supporting both additive and multiplicative homomorphism, but only a finite number of homomorphic operations), and fully homomorphic (supporting any number of additive and multiplicative homomorphic operations).

[0004] In 2016, Boyle proposed the concept of homomorphic secret sharing, which combines the advantages of secret sharing and homomorphic encryption. Homomorphic secret sharing technology can guarantee data privacy and is also more efficient in computation. It can outsource part of the computation to external servers, while preventing some of these servers from learning the secret input information. It can be widely used in secure computing in distributed environments.

[0005] Currently, the design and use of homomorphic secret sharing schemes are relatively limited. Jiang Lin et al. designed a privacy-preserving database JOIN type query method based on homomorphic secret sharing, but did not propose a homomorphic secret sharing method (Reference: Jiang Lin, Zhuang Jiehang, Yang Peng, Chen Yuyue, Fang Junbin, "Privacy-Preserving Database JOIN Type Query Method, System and Device Based on Homomorphic Secret Sharing"). Summary of the Invention

[0006] To address the problems existing in the prior art, the purpose of this invention is to provide a homomorphic secret sharing method, which enables an output server, with the help of the computing power of several unauthorized servers, to obtain the values ​​of some secret inputs under a certain polynomial function, and ensures that some of the unauthorized servers cannot jointly recover the secret inputs.

[0007] First, this invention employs Shamir's threshold secret sharing scheme. Using this scheme provides threshold security, ensuring that a set of servers or access structures that do not meet certain conditions cannot recover a specific secret value from a given share of secrets. Furthermore, combining the Shamir threshold secret sharing scheme with a homomorphic encryption algorithm improves the polynomial degree of this homomorphic secret sharing scheme.

[0008] Secondly, this scheme uses a homomorphic encryption algorithm to encrypt the secret input for computation, so that after the secret input is computed by an unauthorized server, the result can be decrypted by the output server to obtain the function value of the secret input under the given objective function.

[0009] The technical solution of this invention is a homomorphic secret sharing method, the steps of which include: 1) Output server running speed is The key generation function for the homomorphic encryption algorithm is used to obtain the public key of the homomorphic encryption algorithm. and private key ; 2) For One unauthorized server, the output server size is selected as [size missing]. Maximum Unauthorized Structure , as a set of all servers that cannot jointly recover the secret; 3) For Each input server has a corresponding secret input. Among them, those possessing secret input The input server is a maximum unauthorized structure. Each server subset Randomly generate a share , making ; Possessing secret input The input server randomly generates an additive share for each unauthorized server j. To satisfy ; 4) For each unauthorized server j and the maximum unauthorized structure Each server subset ,like Then use homomorphic encryption algorithm to... Encryption yields homomorphic encrypted ciphertext. Otherwise Unauthorized server j obtains information about the secret input. full share When all unauthorized servers have obtained access to the secret input After obtaining the complete share, proceed to step 5) for function calculation; i = 1~n; 5) The objective function Split into and the j-th function Assigned to unauthorized server j; each unauthorized server independently calculates its portion of the function. And send it to the output server, which obtains the homomorphic ciphertext of the expected result based on the calculation results of each unauthorized server; 6) The output server uses its own private key. Decrypting the homomorphic ciphertext of the expected result yields the result. A secret input In the objective function The expected value is used to achieve homomorphic secret sharing computation.

[0010] Preferably, the specific calculation method for the function calculation stage in step 5) is as follows: 51) The degree is objective function Split into Linear combination of monomials: ; where each monomial The degree is and not exceeding Define a polynomial ; ; 52) According to , = Determine the calculation Unauthorized server j, unauthorized server j usage is Homomorphic encryption of this item Perform calculations; 53) Define the sum of all computed results for non-authoritative server j as... And define the sub-function of the unauthorized server j as The subfunction is computed using homomorphic encryption. Record the result as Send it to the output server.

[0011] Preferably, this item of Among the variables, the most The one is encrypted.

[0012] Preferably, the expected result is .

[0013] The advantages of this invention are as follows: 1. By using secret sharing and non-accessible structures, arbitrary... The server could not recover any secret input; 2. By leveraging the characteristics of homomorphic encryption, it avoids the complex key exchange and communication overhead found in other non-homomorphic encryption schemes; 3. By decomposing and distributing the polynomial, the computation can be processed in parallel. Attached Figure Description

[0014] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0015] The present invention will now be described in further detail with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0016] To enable an output server in With the help of the computing power of an unauthorized server, it is possible to obtain Each input server possesses its own secret input. In polynomial functions The value below ), and ensure that any unauthorized server The servers cannot jointly recover the secret input; the specific process is as follows.

[0017] The specific key generation stage is as follows: Output server running speed is Key generation function for homomorphic encryption algorithms To obtain the public key of the homomorphic encryption algorithm. and private key .

[0018] The specific stages of secret sharing are as follows: 1) Forming an unauthorized structure Use the maximum unauthorized structure Size is , represents the set of all subsets of servers that cannot jointly recover the secret, including From a group of unauthorized servers, select any one server to form a... A subset of servers, selected from any two servers to form... A subset of servers, and so on, and selecting any... Formed by a server There are several subsets of servers, and the intersection of these subsets constitutes the non-authoritative structure. There are a total of A subset, that is, a subset of size The servers in any subset cannot jointly recover the secret input.

[0019] 2) Input Perform secret split For any subset of servers Having secret input The input server randomly generates a share. , making ; 3) Generate additional zero shares For each secret input The input server randomly generates an additive share. To satisfy ; 4) Construct the input share for each unauthorized server For the Unauthorized servers and all ,like Then, a homomorphic encryption algorithm is used to calculate the homomorphic encrypted ciphertext. Otherwise, it is calculated as At this time, the first The server obtained the secret input The full share is .

[0020] When all servers have obtained the secret input full share Then, the function calculation stage begins; in this stage, the objective function... Split into and the function Assigned to the Each server will independently compute a portion of the function. This ensures that the output server can obtain the expected result after receiving the calculation results from each server. The objective function is a given function, which is also the target to be calculated by the entire algorithm. The split function is distributed to each unauthorized server, so that it can calculate the result of the split function without having the secret input, but with its share of the input. At the same time, all unauthorized servers send their calculation results to the output server, and the output server can obtain the value of the objective function based on these results.

[0021] The specific function calculation stages are as follows: 1) Polynomial function Split into multiple sub-functions Degree is polynomial function It can be represented as A linear combination of monomials: Each monomial The degree is and not exceeding Define a polynomial ,in .

[0022] 2) Expand variables using secret sharing and assign monomial functions to unauthorized servers. because It can be known that = In all There must exist a certain first in the server. The server can calculate And this item of Among the variables, the most The first one is encrypted, therefore the second one... The server availability is The homomorphic encryption is used to compute it, thereby enabling the item to be... Assigned to the first The server performs the calculations.

[0023] 3) Calculate the sub-function for each server. Each server will be assigned several items to perform calculations, and the sum of the results of all its calculations is defined as... And define the sub-function of the server as The subfunction is computed using homomorphic encryption, and its result is denoted as... It is sent to the output server.

[0024] The specific decoding stages are as follows: The output server calculates the sum of the results from all servers. The final result uses the output server's own private key. Decryption That is, the output server uses its own private key. Decrypting the homomorphic ciphertext of the expected result yields the result. A secret input In the objective function The expected value is y; y is the expected result. The homomorphically encrypted ciphertext, after decryption, yields the expected result. .

[0025] When the output server has the correct private key, it can correctly decrypt to obtain the expected value. This enables homomorphic secret-sharing computation.

[0026] Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A homomorphic secret sharing method, the steps of which comprise: 1) outputting a key generation function of a homomorphic encryption algorithm with a server running degree of to obtain a public key and a private key of the homomorphic encryption algorithm; 2) For each unlicensed server, output the set of all servers that cannot jointly recover the secret. , as the set of all server subsets that cannot jointly recover the secret.​​ 3) For an input server with a corresponding secret input ; where the input server with the secret input is the largest un-authorized structure of each server subset randomly generates a share such that ; the input server with the secret input randomly generates an additive share for each un-authorized server j such that ; 4) For each unauthorized server j and the maximum unauthorized structure Each server subset ,like Then use homomorphic encryption algorithm to... Encryption yields homomorphic encrypted ciphertext. Otherwise Unauthorized server j obtains information about the secret input. full share When all unauthorized servers have obtained access to the secret input After obtaining the complete share, proceed to step 5) for function calculation; i = 1~n; 5) splitting the objective function into and assigning the j-th function to the unlicensed server j; each unlicensed server independently computes the partial function and sends it to the output server, which obtains the homomorphic ciphertext of the expected result from the computation results of each unlicensed server; 6) The output server uses its own private key The homomorphic ciphertext of the expected result is decrypted to get the secret input The expected value under the objective function Homomorphic secret sharing calculation is realized.

2. The method of claim 1, wherein, The specific calculation method of the function calculation phase of step 5) is: 51) splitting the objective function of degree into a linear combination of monomials of degree ; where each monomial has degree and is not more than ; define the polynomial ; ;​​ 52) According to , = , determine the unlicensed server j for calculating , the unlicensed server j uses homomorphic encryption with degree to calculate the item ; 53) define the sum of all the computation results of the unlicensed server j as and define the sub-function of this unlicensed server j as , compute this sub-function using the homomorphic encryption operation , and record its result as and send it to the output server.

3. The method of claim 2, wherein, The item of the most variables are encrypted.

4. The method according to claim 1 or 2 or 3, characterized in that, The expected results are .

Images