A function secret sharing construction method for interval inclusion function

Abstract

The present invention provides a function secret sharing construction method for interval inclusion function, including: in the key generation stage: a trusted third party uses a DPF key generation algorithm to generate a DPF key for each server, and in the key evaluation stage: all servers call the DICF algorithm based on prefix parity query in parallel, obtain the parity query result within a given interval, and judge whether the parity query result is within the given interval. The present invention calculates the prefix parity from 0 to a specified point by calling DPF twice, and then uses an XOR operation and a correction bit τ to judge whether it is within the given interval, thereby handling possible overflow situations. Not only does it enhance the security of the interval inclusion function, it significantly reduces the memory overhead and local calculation complexity during the calculation process, it is not only suitable for resource-constrained environments, but also can improve the calculation efficiency, making the calculation of the interval inclusion function more efficient.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a function secret sharing construction method for interval inclusion functions. Background Art

[0002] The performance bottleneck of privacy-preserving computationally intensive tasks such as deep neural network reasoning through secure multi-party computing technology lies in nonlinear operations, especially interval inclusion operations. With the rise of big data and large models, users' demand for privacy protection is also increasing. It is urgent to design an efficient interval inclusion function secure calculation method that can efficiently perform nonlinear interval inclusion operations while protecting data privacy.

[0003] Secret sharing technology provides a feasible way to solve the above problems. Most existing solutions are designed based on obfuscated circuits or arithmetic secret sharing, which leads to high communication overhead and communication rounds, making it difficult to apply to actual network environments. Function secret sharing is a new cryptographic primitive first proposed by Boyle et al. at the Eurocrypt conference in 2015. Reference 1 ((BOYLE E, GILBOA N, ISHAI Y. Function secret sharing [C] / / Annual international conference on the theory and applications of cryptographic techniques. Springer, 2015: 337-367) can be applied to the field of secure multi-party computation to achieve secure computation of nonlinear functions in a single round of communication, and can effectively solve the communication bottleneck of secure multi-party nonlinear operations under a semi-honest model. At the Eurocrypt conference in 2021, Boyle et al. further improved the distributed comparison function scheme (BOYLE E, CHANDRAN) based on the above article and an improved scheme in 2016 (BOYLE E, GILBOA N, ISHAI Y. Function secret sharing: Improvements and extensions [C] / / Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. 2016: 1292-1303). N,GILBOA N,et al.Function secret sharing for mixed-modeand fixed-point secure computation[C] / / Annual International Conference on theTheory and Applications of Cryptographic Techniques.Springer,2021:871-900).

[0004] Most existing solutions are based on garbled circuits or arithmetic secret sharing techniques, which result in high communication costs and multiple communications. A small number of newer methods use functional secret sharing (FSS) techniques combined with GGM-like tree data structures, which help to significantly reduce the number of communication rounds required for nonlinear operations, but at the expense of increased space requirements and local computational complexity.

[0005] Although existing DICF technical solutions have made progress in reducing communication rounds, they result in high space overhead and local computational complexity. This increased resource demand is particularly prominent when processing large-scale datasets, which may limit its application in resource-constrained environments. In addition, the complexity of technical implementation and dependence on specific data structures further increase the difficulty of deployment and maintenance. Summary of the invention

[0006] In order to solve the above problems existing in the prior art, the present invention provides a function secret sharing construction method for interval inclusion function. The technical problem to be solved by the present invention is achieved by the following technical solutions:

[0007] The present invention provides a function secret sharing construction method for interval inclusion function, including:

[0008] During the key generation phase:

[0009] The trusted third party generates a DPF key for each server using a DPF key generation algorithm and feeds it back to each server, wherein the DPF key corresponding to each server includes a share of the input parameter; the DPF key includes a data structure of a parity check tree;

[0010] During the key evaluation phase:

[0011] All servers call the DICF algorithm based on prefix parity query in parallel, query the input data and the parity check tree in a given interval to obtain a parity query result, and determine whether the parity query result is within the given interval to obtain a determination result.

[0012] Beneficial effects:

[0013] The present invention provides a function secret sharing construction method for interval inclusion function, including: in the key generation stage: a trusted third party generates a DPF key for each server using a DPF key generation algorithm, and feeds back to each server, wherein the DPF key corresponding to each server includes a share of input parameters; the DPF key is a parity check tree; in the key evaluation stage: all servers call the DICF algorithm based on prefix parity check query in parallel, obtain the parity query result by querying the input data and the parity check tree in a given interval, and judge whether the parity query result conforms to the given interval. The parameters of each server of the present invention are all distributedly hidden in the DPF key, and any single DPF key cannot be parsed out; and the prefix parity check from 0 to a specified point is calculated by calling DPF twice, and then the XOR operation and a correction bit τ are used to judge whether it is in the given interval, so as to handle possible overflow situations. The present invention not only enhances the security of the interval inclusion function, significantly reduces the memory overhead and local calculation complexity in the calculation process, is not only suitable for resource-constrained environments, but also can improve the calculation efficiency, so that the calculation of the interval inclusion function is more efficient. In practical applications, this method can significantly reduce the time and communication overhead required to execute complex secure computing protocols, thereby promoting the application of interval inclusion functions in a wider range of scenarios.

[0014] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a process schematic diagram of a function secret sharing construction method for interval inclusion function provided by the present invention;

[0016] Figure 2 It is a schematic diagram of a DPF binary tree sample provided by the present invention;

[0017] Figure 3 This is a schematic diagram of a parity check tree sample provided by the present invention. DETAILED DESCRIPTION

[0018] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0019] Before introducing the present invention, a brief introduction to the field knowledge involved in the present invention is first given.

[0020] Unless otherwise specified, the present invention and the protocols are all run on a dual-cloud distributed outsourcing computing model, with cloud servers S0 and S1. All data operations are performed in the loop In the above example, l represents the number of binary digits.

[0021] Dual-cloud distributed outsourcing computing model: The data owner encrypts the data locally and then uploads it to two independent cloud servers. The cloud servers execute a series of secure computing protocols based on the specific tasks and finally send the encrypted results to the designated users.

[0022] Semi-honest threat model: the server will faithfully perform various operations in accordance with the protocol, but will attempt to spy on or infer private information related to the original data.

[0023] The present invention relates to function secret sharing. Function secret sharing (FSS) is a function family. Function Split into two addition or XOR shares f0(x) and f1(x). Each share hides the specific content of f and ensures that for all inputs x∈G in , either f0(x)+f1(x)=f(x) or This means that the value of f(x) corresponding to any input x can be reconstructed through its two secret shares. Its formal definition is as follows:

[0024] Definition 1. The two-party functional secret sharing (FSS) scheme consists of a pair of probabilistic polynomial time algorithms, namely Gen(·), Eval(·). This pair of algorithms has the following characteristics:

[0025] ·Gen(1 λ , f) is a key generation algorithm. Given a security parameter λ and a description of a function f, the algorithm outputs a pair of functional keys (k0, k1), also known as function secret sharing shares. Each key can effectively describe f0 and f1 without revealing the specific information of f.

[0026] Eval(b,k b , x) is a polynomial time evaluation algorithm. Given the index b∈{0,1} of the participant, the key k b and input value x, it can output a secret share f b (x), such that f0(x)+f1(x)=f(x) or

[0027] The technical concept of the present invention is introduced below.

[0028] In the field of secure multi-party computation, traditional schemes are mostly designed based on obfuscated circuits or arithmetic secret sharing. These methods usually bring high communication overhead and require multiple rounds of communication, which limits their application in actual network environments. In this case, Function Secret Sharing (FSS), as an emerging cryptographic primitive, allows secure computation of nonlinear functions through single-round communication under a semi-honest model. Especially when dealing with applications that require efficient communication such as neural network dense state reasoning, FSS can effectively alleviate the communication bottleneck problem. However, it increases memory overhead and local computational complexity accordingly, which is particularly problematic in scenarios with high overall computational complexity or large data volumes. This trade-off has led to obstacles in the promotion of FSS in practical applications.

[0029] The present invention proposes a function secret sharing construction method for interval inclusion functions, that is, a distributed interval inclusion function (DICF), which can realize the calculation of interval inclusion functions in a privacy-preserving manner in a distributed scenario. Not only does it enhance the security of interval inclusion functions, but it also significantly reduces the memory overhead and local computational complexity during the calculation process compared to existing solutions. This improvement means that DICF is not only suitable for resource-constrained environments, but also can improve computing efficiency, making the calculation of interval inclusion functions more efficient. In practical applications, this method can significantly reduce the time and communication overhead required to execute complex secure computing protocols, thereby promoting the application of interval inclusion functions in a wider range of scenarios.

[0030] The technical solution details of the present invention are described in detail below.

[0031] like Figure 1 As shown, the present invention provides a function secret sharing construction method for interval inclusion function, comprising:

[0032] During the key generation phase:

[0033] A trusted third party generates a DPF key for each server using a DPF key generation algorithm and feeds it back to each server, wherein the DPF key corresponding to each server includes a share of the input parameter; the DPF key is a parity check tree;

[0034] Distributed Point Function (DPF) is a FSS solution for point functions. A point function outputs a non-zero value at an exact index within its domain, and its specific definition is as follows:

[0035]

[0036] The function of the distributed point function can be seen as traversing a tree with a depth of A binary tree of is the bit length of the input data (usually 32 bits or 64 bits). Among all the paths in the binary tree, there is a unique path from the root node to the α-node, called the 1-path. Among the nodes in the binary tree, only the α-node has a value of 1, and the values ​​of other nodes are all 0.

[0037] refer to Figure 2 , Figure 2 Describes a binary tree where each node stores a value that is the XOR result of its child node values. The edges at level i show α i The left side represents 0 and the right side represents 1. The above 1-path is highlighted in red, which ends with a unique α-node. During the evaluation process, each evaluator receives a different initial random state (s, t) ∈ {0, 1} λ ×{0, 1}. Starting from the root node, each evaluator traverses the tree toward the root node and updates its state according to the value of x[i] at each level. This update uses the correction word CW in the function key. (i) As long as x[i] = α[i], we will continue along the special path. If a position x[i] ≠ α[i] appears, the evaluator will immediately deviate from the special path, causing the output to become 0. If we can follow this path all the way to the root node, this indicates that x = α, and the function outputs β.

[0038] The DPF keys of the servers S0 and S1 contain the data structure of a parity check tree. There are n nodes in the parity check tree. The nodes corresponding to the server S0 are respectively denoted as The node corresponding to server S1 is recorded as

[0039] Given a length of The binary bit string Suppose there exists a substring x of x a x a+1 , …, x b-1 , denoted as x[a, b), where The parity query for x[a, b) is defined as follows:

[0040]

[0041] This scheme uses a data structure called a parity tree to perform parity queries, and the computational complexity of the process is In a parity check tree, the value of each node is the parity check result of its two child nodes. The parity check tree is constructed from the bottom up. First, split x into 2 k substrings, each containing λ binary bits, assuming Next, for each substring, generate a leaf node and link the substring to that node. The parity value of the substring is stored inside the leaf node. Then, for each pair of adjacent leaf nodes, insert a parent node and store the parity values ​​of its two child nodes in it. Repeat this process for each pair of adjacent parent nodes until a single root node is formed. At this point, the parity bit held by any given node is equal to the parity of the concatenation of the substrings of x associated with all descendant leaf nodes of that node.

[0042] Figure 3 An example of a parity check tree is shown. In this example, the binary bit string is x = 00101100101110112. It can be stipulated that the traversal of the substring is always to the left. In this case, the substring can be regarded as the left child of the leaf node (in fact, this relationship does not exist, so it is represented by a dotted line). The specific steps for traversing the parity check tree are further given as follows:

[0043] Initialize the output r to 0 and set the path direction to the left;

[0044] Starting from the root node, traverse to the leaf node associated with binary bit a;

[0045] When the traversal path direction changes, the output r is updated by XORing the parity value stored on the changed node;

[0046] The XOR leaf node associates all the prefix bits in the substring and outputs r.

[0047] Furthermore, to obtain x[a, b), we only need to traverse the parity check tree in order to obtain parity(x[0, a)) and parity(x[0, b)) respectively. Then, we can further obtain the parity check value of x[a, b) by the equivalent conversion of the following formula:

[0048]

[0049]

[0050] The correctness of the above formula stems from the idempotence of the XOR operation. Therefore, calculating the prefix parity of the binary bits a and b can obtain the correct parity of x[a, b). Figure 2 The green arrow in indicates the traversal process of parity(x[0, a)). The green dots are used to mark the nodes where the direction changes. Based on this traversal process, we can get:

[0051]

[0052] Through similar traversal, we can get parity(x[0,b))=1 (marked with blue arrows and nodes). According to the defined formula, the parity query of x[a,b) can be obtained by the following calculation:

[0053]

[0054] In a specific implementation of the present invention, the use of the DPF key generation algorithm to generate the DPF key corresponding to each server includes:

[0055] S11, receiving security parameters 1 λ , parameter α, parameter β, parameter

[0056] S12, using its own pseudo-random number generator, using a binary string of length λ as a pseudo-random number generation seed to generate a 2(λ+1)-bit pseudo-random binary string {0, 1} 2(λ+1) ;

[0057] S13, decompose the parameter α into binary strings α1,…,α n ∈{0, 1} n ;

[0058] S14, generate a 1-bit random number and record it as and will The result is recorded as

[0059] S15, use the loop block to loop from i=1 to n multiple times to obtain the parameters and

[0060] S16, using the definition in the Abelian group Addition calculation on The result is recorded as CW (n+1) ;

[0061] S17, for b = 0, 1, combination CW (1) , …, CW (n+1) , denoted as k b A key pair (k0, k1) is obtained; wherein k0 is the DPF key of server S0, and k1 is the DPF key of server S1.

[0062] In a specific embodiment of the present invention, S15 includes:

[0063] S151, setting the number of cycles i=1 to n;

[0064] S152, Set as the seed of the pseudo-random number generator G, generate a 2(λ+1)-bit pseudo-random number, and parse the pseudo-random number into four parts with lengths of λ, 1, λ, and 1, respectively, denoted as Where b = 0, 1;

[0065] S153, execute the first judgment process of the branch block in the loop block, if α i = 0, then the variable superscripted with L in S152 Recorded as Variables with superscript R Recorded as If α i ≠0, the variable in S152 Recorded as variable Recorded as

[0066] S154, calculation Let the result be s CW ;

[0067] S155, calculation Record the result as Synchronous calculation Record the result as

[0068] S156, Combination S CW , CW (i) ;

[0069] S157, for b = 0, 1, calculate Record the result as

[0070] S158, for b=0,1, calculate Record the result as

[0071] In the key generation phase, the key generation algorithm of the distributed point function used in this scheme is shown in Algorithm 1:

[0072]

[0073]

[0074] The detailed analysis of Algorithm 1 is as follows:

[0075] Algorithm parameters: 1 λ:Safety parameters, α, β: Meaning reference point function definition, Abelian group to which β belongs

[0076] It is worth noting that the random number generation, pseudo-random number generation and The process input and output string length is related to λ and is of the form 1 λ It is a common way to express the length of a string in cryptography, {0, 1} n Represents a binary string of 0s and 1s of length n. Note the distinction between superscripts and letter variables.

[0077] The algorithm executor holds a pseudo-random number generator G, which accepts a binary string of length λ as a pseudo-random number generation seed and generates a 2(λ+1)-bit pseudo-random binary string.

[0078] is any binary string of length λ that can be converted to an Abelian group The mapping method on .

[0079] Algorithm process:

[0080] 1. Decompose the input α into its binary string representation α1,…,α n ∈{0, 1} n

[0081] 2. Generate two random numbers with a binary bit length of λ and denote them as

[0082] 3. Generate a random number and record it as Will The result is recorded as

[0083] 4. Loop block starts: for i=1 to n:

[0084] 5. Set as the seed of the pseudo-random number generator G, generate a 2(λ+1)-bit pseudo-random number, and parse it into four parts of length λ, 1, λ, 1, respectively, denoted as Where b=0,1.

[0085] 6. Branch block starts: If α i = 0, then the variable with superscript L generated in 5 Recorded as Variables with superscript R Recorded as Where b=0,1.

[0086] 7. Otherwise: Contrary to 6, change the variable Recorded as variable Recorded as Where b=0,1.

[0087] 8. End of branch block

[0088] 9. Calculation Let the result be s CW

[0089] 10. Calculation Record the result as calculate Record the result as

[0090] 11. Combinations CW , CW (i)

[0091] 12. For b = 0, 1, calculate Record the result as

[0092] 13. For b = 0, 1, calculate Record the result as

[0093] 14. End of loop block

[0094] 15. Use defined in Addition calculation on The result is recorded as CW (n+1)

[0095] 16. For b = 0, 1, the combination CW (1) , …, CW (n+1) , denoted as k b

[0096] 17. Return the key pair (k0, k1)

[0097] In the above algorithm process, the information of α and β is distributed and hidden in the two keys k0 and k1, and the plaintext values ​​of α and β cannot be parsed and restored from any single key.

[0098] During the key evaluation phase:

[0099] All servers call the DICF algorithm based on prefix parity query in parallel, query the input data and the parity check tree in a given interval to obtain a parity query result, and determine whether the parity query result is within the given interval to obtain a determination result.

[0100] As an optional implementation manner of the present invention, all the servers call the DICF algorithm based on prefix parity query in parallel, query the input data and the parity check tree in a given interval to obtain a parity query result, and determine whether the parity query result is within the given interval. The determination result includes: all the servers execute in parallel:

[0101] S21, receiving security parameters 1 λ , given an interval [p, q) and a public value φ-x, the point function The DPF key k b ; where x is the input data and φ is a random offset value used to hide the input data

[0102] S22, for b∈{0,1}, use the prefix parity query algorithm to calculate the position from the beginning of the sequence to The first parity check of all values ​​is calculated from the beginning of the sequence to position The second parity check of all values ​​of ; b is the subscript of the server;

[0103] If there are two servers, the present invention calls the prefix parity query algorithm DPF algorithm twice in parallel.

[0104] As an optional implementation manner of the present invention, S22 includes:

[0105] S221, set the safety parameter 1 λ , input data x, point function The DPF key k b As input;

[0106] S222, for b∈{0,1}, decompose the input data x into a binary string, represented as

[0107] S223, parse DPF key k b Get (0) ,t (0) , CW (1) , …,

[0108] S224, initialize variable pv b =0, d=0;

[0109] S225, using the loop block from i = 1 to Repeat multiple times to update or Get the prefix parity query result pv b ;

[0110] Among them, pvb Is a prefix parity query result.

[0111] As an optional implementation manner of the present invention, S225 includes:

[0112] S2251, for Parsing CW using loop blocks (i) Get CW ,

[0113] S2252, calculation Let τ be the result. (i) ;

[0114] S2253, Analytical τ (i) Get L ,t L 、s R ,t R ∈{0, 1} 2(λ+1)

[0115] S2254, execute the second judgment process of the branch block in the loop block to convert s L ,t L Denoted as s (i) ,t (i) Or R ,t R Denoted as s (i) ,t (i) ;

[0116] This step executes the second judgment process of the branch block in the loop block. If x i = 0, then s L Note: s (i) , t L Denoted as t (i) ; if x i ≠0, then s R Note: s (i) , t R Denoted as t (i) .

[0117] S2255, execute the third judgment process of the branch block in the loop block to update or Get the prefix parity query result pv b .

[0118] This step executes the third judgment process of the branch block in the loop block. If d≠x i , then update d = x i , If d = 1, update Get the prefix parity query result pv b .

[0119] The specific details of the DPF algorithm are introduced below.

[0120] Distributed Comparison Function (DCF) is an FSS scheme for comparison functions. The comparison function is demarcated at an exact index within its domain. The distributed comparison function defined in this scheme outputs 0 when the input is less than or equal to the value, and outputs a non-zero value β when it is greater than the value. The specific definition is as follows:

[0121]

[0122] In the key evaluation execution phase, the distributed comparison function evaluation algorithm based on prefix parity query designed in this scheme performs prefix parity query on the distributed point function key generated by Algorithm 1, as shown in Algorithm 2. In this algorithm, pv b and d represent the continuously updated parity check value and the current tree traversal direction respectively. The final parity check result pv b The execution result of the distributed comparison function can be obtained by performing the difference or.

[0123]

[0124]

[0125] The following is a detailed analysis of the above algorithm 2:

[0126] Algorithm parameters: Security parameter 1 λ , input x, point function The DPF key k b

[0127] Note: The following random number generation, pseudo-random number generation and The process input and output string length is related to λ and is of the form 1 λ It is a common way of expressing the length of a string in cryptography. Indicates the length is Note the difference between the superscript and letter variables.

[0128] The algorithm executor holds a pseudo-random number generator G, which accepts a binary string of length λ as a seed and generates a 2(λ+1)-bit pseudo-random binary string. G(x) represents the pseudo-random number generated by setting x as the seed.

[0129] is any binary string of length λ that can be converted to an Abelian group A mapping method on . a||b||c||d represents the combination of a, b, c, d.

[0130] Algorithm process:

[0131] 1. For b∈{0,1}, do the following:

[0132] 2. Decompose x into its binary string representation

[0133] 3. Analyze k b Get (0) ,t (0) , CW (1) , …, CW (l+1)

[0134] 4. Initialize variable pv b =0, d=0

[0135] 5. Loop block starts: For

[0136] 6. Analyze CW (i) Get CW ,

[0137] 7. Calculation Let τ be the result. (i)

[0138] 8. Parsing τ (i) Get L ,t L 、s R ,t R ∈{0, 1} 2(λ+1)

[0139] 9. Branch block starts: if x i =0 then:

[0140] 10. L Note: s (i) , t L Denoted as t (i)

[0141] 11. Otherwise:

[0142] 12. R Note: s (i) , t R Denoted as t (i)

[0143] 13. End of branch block

[0144] 14. Branch block starts: if d≠x i but:

[0145] 15. Update d = x i

[0146] 16. Update

[0147] 17. End of branch block

[0148] 18. End of loop block

[0149] 19. Branch block starts: If d = 1 then:

[0150] 20. Update

[0151] 21. End of branch block

[0152] 22. Return the prefix parity query result pv b

[0153] In the above algorithm 3 process, the algorithm 3 executor uses the secret share of α in the DPF key to perform secret calculations. During the calculation process, the algorithm executor is unable to spy on the plaintext value of α and finally outputs a value using the key k. b The constructed parity check tree performs a prefix parity query on the input x, which is the distributed comparison function The result of the XOR sharing form.

[0154] S23, determining whether the first parity check and the second parity check are within a given interval, and obtaining a determination result.

[0155] As an optional implementation manner of the present invention, S23 includes:

[0156] S231, setting the initial value of the correction bit τ to 0;

[0157] S232, execute the first judgment process of the branch block. If Then set τ to the identifier b of the current server;

[0158] S233, calculate the XOR result of the first parity check and the second parity check, and XOR them with the correction bit τ to obtain the output of the current server

[0159] in, Indicates whether the query result of the current server is within the given interval [p, q). 0 means it is within, and 1 means it is not.

[0160] The DICF algorithm based on prefix parity query aims to calculate the offset function when Output 1 when φ is 0, otherwise output 0, where φ is a random offset value used to hide the input

[0161] First, we outline the basic concepts of using DPF.PPQ to build a DICF solution. First, we propose a key proposition:

[0162] Proposition 1: Given α, the one-hot encoding is represented as and two indices p and q satisfy So

[0163] The proof of the above proposition is obvious. exist In the one-hot encoding of , only one position (corresponding to α) is set to 1. Since α falls between p and q, there is exactly one 1 in the interval α[p,q). Therefore, the parity of this interval is 1 (because the count of 1 is odd).

[0164] From the above proposition, we can see that DICF can be transformed into parity query In addition, from Eq. It can be seen that the parity query can be transformed into the prefix parity query described in the above section. Therefore, for a given public point and a public interval [p, q), parity query can be implemented by calling DPF.PPQ twice (which can be run in parallel) and XORing their results.

[0165] It is worth noting that the input of the DICF scheme is Used to hide private values Therefore, the following conversion is also required:

[0166]

[0167] However, the above equation is For example, when No overflow but In case of overflow, the right half of the equation results in Therefore, a correction bit τ needs to be added to handle the overflow situation. Algorithm 3 shows the details of the DICF scheme.

[0168]

[0169]

[0170] The detailed analysis of Algorithm 3 is as follows:

[0171] Algorithm parameters: Security parameter 1 λ, input: public interval [p, q) and public value Point Function The DPF key k b

[0172] Note: The following random number generation, pseudo-random number generation and The process input and output string length is related to λ and is of the form 1 λ It is a common way of expressing the length of a string in cryptography. Indicates the length is Note the difference between the superscript and letter variables.

[0173] The algorithm executor holds a pseudo-random number generator G, which accepts a binary string of length λ as a seed and generates a 2(λ+1)-bit pseudo-random binary string. G(x) represents the pseudo-random number generated by setting x as the seed.

[0174] is any binary string of length λ that can be converted to an Abelian group The mapping method on .

[0175] Algorithm process:

[0176] 1. For b∈{0,1}, do the following:

[0177] 2. Use DPF to calculate from the beginning of the sequence to the position Parity check of all values ​​of ;

[0178] 3. Use DPF to calculate from the beginning of the sequence to the position Parity check of all values ​​of ;

[0179] 4. Set the initial value of the correction bit τ to 0;

[0180] 5. Branch block starts: If but:

[0181] 6. Set τ to the identifier b of the current participant;

[0182] 7. Calculate the XOR result of the two parity checks and XOR it with the correction bit τ to get the output of the current participant Displays whether the query result of the input data x is within the given interval.

[0183] 8. Return

[0184] Algorithm 3 of the present invention calculates the prefix parity from 0 to the specified point by calling DPF.PPQ twice. In this process, an XOR operation and a correction bit τ are used to handle possible overflow situations. The algorithm ensures that during the calculation process, the executor cannot know the plaintext value of the input x, thereby ensuring the privacy of the input. In this way, the algorithm outputs the judgment result of the input data in the public interval, that is, the XOR form of the result shared by the two participants, realizing a distributed input confidentiality function (DICF).

[0185] The effect of the present invention is explained below through simulation experiments.

[0186] Compared with the existing scheme, the distributed interval inclusion function calculation method based on prefix parity query of the present invention provides higher computing efficiency, stronger data privacy protection, simpler algorithm implementation, and better data overflow processing capability, thereby showing better performance in the field of multi-party secure computing and privacy protection data analysis. A simple experimental evaluation was carried out on the key technologies involved in the present invention, in which the element bit width of the input vector was l=64, the CPU of the test machine was i7-11800H, and the GPU was NVIDIA GeForce RTX3060 Laptop. The test code was written in Python.

[0187] The running time of the DICF scheme of the present invention and other DICF schemes under different input sizes are compared in CPU and GPU environments respectively. The specific experimental data are as follows:

[0188]

[0189] As can be seen from the table, when executed on the CPU, the DICF scheme of the present invention is twice as fast as other schemes. In the GPU environment, as the input size increases, the scheme of the present invention has a significant improvement in speed, greatly exceeding the previous scheme. [5] represents the DICF scheme described in E. Boyle, N. Chandran, N. Gilboa, D. Gupta, Y. Ishai, N. Kumar, and M. Rathee, "Function secret sharing for mixed-mode and fixed-point secure computation," in Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 2021, pp. 871-900.

[0190] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0191] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other variations of the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality of components or steps.

[0192] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A method for constructing a function secret sharing for interval inclusion functions, characterized in that: include: During the key generation phase: The trusted third party generates a DPF key for each server using a DPF key generation algorithm and feeds it back to each server, wherein the DPF key corresponding to each server includes a share of the input parameter; the DPF key includes a data structure of a parity check tree; During the key evaluation phase: All servers call the DICF algorithm based on prefix parity query in parallel, query the input data and the parity check tree in a given interval to obtain a parity query result, and determine whether the parity query result is within the given interval to obtain a determination result; All the servers call the DICF algorithm based on prefix parity query in parallel, query the input data and the parity check tree in a given interval to obtain a parity query result, and determine whether the parity query result is within the given interval. The determination result includes: all the servers execute in parallel: S21, receiving security parameters 1 λ , given an interval [p,q) and a public value φ-x, the point function The DPF key k b ; Where x is the input data, φ is a random offset value used to hide the input data x; S22, for b∈{0,1}, use the prefix parity query algorithm to calculate the first parity check of all values ​​from the beginning of the sequence to the position p+φ-x and calculate the second parity check of all values ​​from the beginning of the sequence to the position q+φ-x; b is the subscript of the server; S23, judging whether the first parity check and the second parity check are within a given interval, and obtaining a judgment result.

2. The method for constructing a function secret sharing for interval inclusion function according to claim 1, characterized in that: There are n nodes in the parity check tree, and the nodes corresponding to server S0 are respectively denoted as The node corresponding to server S1 is recorded as 3. The method for constructing a function secret sharing for interval inclusion function according to claim 2, characterized in that: The method of generating a DPF key corresponding to each server by using a DPF key generation algorithm includes: S11, receiving security parameters 1 λ , parameter a, parameter β, parameter S12, using its own pseudo-random number generator, uses a binary string of length λ as a pseudo-random number generation seed to generate a 2(λ+1)-bit pseudo-random binary string {0,1} 2(λ+1) ; S13, decompose the parameter α into binary strings α1,…,α n ∈{0,1} n ; S14, generate a 1-bit random number and record it as and will The result is recorded as S15, use the loop block to loop from i=1 to n multiple times to obtain the parameters and S16, using the definition in the Abelian group Addition calculation on The result is recorded as CW (n+1) ; S17, for b = 0, 1, combination Denoted as k b A key pair (k0, k1) is obtained; wherein k0 is the DPF key of server S0, and k1 is the DPF key of server S1.

4. The method for constructing a function secret sharing for interval inclusion function according to claim 3, characterized in that: S15 includes: S151, setting the number of cycles i=1 to n; S152, will Set as the seed of the pseudo-random number generator G, generate a 2(λ+1)-bit pseudo-random number, and parse the pseudo-random number into four parts with lengths of λ, 1, λ, and 1, respectively, denoted as Where b = 0, 1; S153, execute the first judgment process of the branch block in the loop block, if α i = 0, then the variable superscripted with L in S152 Recorded as Variables with superscript R Recorded as If α i ≠0, the variable in S152 Recorded as variable Recorded as S154, calculation Let the result be s CW ; S155, calculation Record the result as Synchronous calculation Record the result as S156, Combination S CW , CW (i) ; S157, for b = 0, 1, calculate Record the result as S158, for b = 0, 1, calculate Record the result as 5. The method for constructing a function secret sharing for interval inclusion function according to claim 1, characterized in that: The S22 includes: S221, set the safety parameter 1 λ , input data x, point function The DPF key k b As input; S222, for b∈{0,1}, decompose the input data x into binary strings, represented as x1,…,x l ∈{0,1} l ; S223, parse DPF key k b Get (0) ,t (0) , CW (1) , …, CW (l+1) ; S224, initialize variable pv b =0,d=0; S225, use the loop block to loop from i=1 to l multiple times to update or Get the prefix parity query result pv b ; Among them, pv b Is a prefix parity query result.

6. The method for constructing a function secret sharing for interval inclusion function according to claim 5, characterized in that: S225 includes: S2251, for i∈[1,l], use the loop block to parse CW (i) Get CW , S2252, calculation Let τ be the result. (i) ; S2253, Analytical τ (i) Get L ,t L 、s R ,t R ∈{0,1} 2(λ+1) S2254, execute the second judgment process of the branch block in the loop block to convert s L ,t L Denoted as s (i) ,t (i) Or R ,t R Denoted as s (i) ,t (i) ; S2255, execute the third judgment process of the branch block in the loop block to update or Get the prefix parity query result pv b .

7. The method for constructing a function secret sharing for interval inclusion function according to claim 6, characterized in that: S2254 includes: Execute the second judgment process of the branch block in the loop block. If x i = 0, then s L Note: s (i) , t L Denoted as t (i) ; if x i ≠0, then s R Note: s (i) , t R Denoted as t (i) .

8. The method for constructing a function secret sharing for interval inclusion function according to claim 6, characterized in that: S2255 includes: executing the third judgment process of the branch block in the loop block, if d≠x i , then update d = x i , If d = 1, update Get the prefix parity query result pv b .

9. The method for constructing a function secret sharing for interval inclusion function according to claim 1, characterized in that: S23 includes: S231, setting the initial value of the correction bit τ to 0; S232, executing the first judgment process of the branch block, if p+Φ-x>q+Φ-x, then setting τ as the identifier b of the current server; S233, calculate the XOR result of the first parity check and the second parity check, and XOR them with the correction bit τ to obtain the output ic of the current server b , Among them, ic b Indicates whether the query result of the current server is within the given interval [p,q). 0 means it is within, and 1 means it is not.

Images