Comparison function-oriented function secret sharing construction method

Abstract

The invention provides a comparison function-oriented function secret sharing construction method. The method comprises the following steps: in a secret key generation stage, a trusted third party generates DPF secret keys corresponding to two servers by using a DPF secret key generation algorithm; in the secret key evaluation stage, the two servers S0 and S1 use the DPF secret keys held by the two servers S0 and S1 and a prefix parity query algorithm to query the input data, and a query result is obtained and fed back to a system user; and the system user performs XOR operation on the two query results to obtain a DCF result. The parameters of the function are hidden in the key in a distributed manner, so that any single key cannot be analyzed; in the secret state calculation process, the server cannot pry a plaintext value of the DCF result, and only a secret state query result is obtained; meanwhile, an algorithm which is lighter than an existing distributed comparison function scheme is further designed, and the calculation complexity is effectively reduced. Therefore, the data privacy of the user can be protected, and meanwhile high calculation efficiency can be provided.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to a function secret sharing construction method oriented to a comparison function. Background Art

[0002] The performance bottleneck of privacy-preserving computationally intensive tasks such as deep neural network reasoning through secure multi-party computing technology lies in nonlinear operations, especially comparison operations. With the rise of big data and large models, users' demand for privacy protection is also increasing. It is urgent to design an efficient comparison function secure calculation method that can efficiently perform nonlinear comparison operations while protecting data privacy.

[0003] Secret sharing technology provides a feasible way to solve the above problems. Most existing solutions are designed based on obfuscated circuits or arithmetic secret sharing, which leads to high communication overhead and communication rounds, and is difficult to apply in actual network environments. Function secret sharing is a new cryptographic primitive first proposed by Boyle et al. at the Eurocrypt conference in 2015. Reference 1 ((BOYLE E, GILBOA N, ISHAI Y. Function secret sharing [C] / / Annual international conference on the theory and applications of cryptographic techniques. Springer, 2015: 337-367) can be applied to the field of secure multi-party computation to achieve secure computation of nonlinear functions in a single round of communication, and can effectively solve the communication bottleneck of secure multi-party nonlinear operations under a semi-honest model. At the Eurocrypt conference in 2021, Boyle et al. further improved the distributed comparison function scheme (BOYLE E, CHANDRAN) based on the above article and an improved scheme in 2016 (BOYLE E, GILBOA N, ISHAI Y. Function secret sharing: Improvements and extensions [C] / / Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. 2016: 1292-1303). N,GILBOA N,et al.Function secret sharing for mixed-modeand fixed-point secure computation[C] / / Annual International Conference on theTheory and Applications of Cryptographic Techniques.Springer,2021:871-900).

[0004] Most existing privacy protection comparison schemes are designed based on obfuscated circuits or arithmetic secret sharing, which leads to high communication overhead and communication rounds, making it difficult to apply to actual network environments. Function Secret Sharing (FSS) by Boyle et al. is a new cryptographic primitive that can be applied to the field of secure multi-party computing to achieve secure computation of nonlinear functions in a single round of communication. It can effectively solve the nonlinear computational communication bottleneck of secure multi-party computing tasks under a semi-honest model. However, the corresponding memory overhead and local computational complexity have increased compared to previous schemes, making it difficult to apply in scenarios with high overall computational complexity and large data volumes. Summary of the invention

[0005] In order to solve the above problems existing in the prior art, the present invention provides a function secret sharing construction method for comparison functions. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0006] The present invention provides a function secret sharing construction method for comparison function, comprising:

[0007] During the key generation phase:

[0008] The trusted third party generates DPF keys corresponding to the server S0 and the server S1 using the DPF key generation algorithm, wherein the DPF key corresponding to each server includes a share of the input parameters; and feeds the DPF keys back to the server S0 and the server S1;

[0009] During the key evaluation phase:

[0010] The user of the dual-cloud distributed computing system sends input data to the server S0 and the server S1;

[0011] The server S0 and the server S1 both obtain the parity check tree from their respective corresponding DPF keys, and then use the prefix parity query algorithm to query the input data and the parity check tree to obtain the query result, and feed back the query result to the system user;

[0012] The dual-cloud distributed computing system user performs an XOR operation on the query results fed back by the server S0 and the server S1 to obtain a DCF result.

[0013] Beneficial effects:

[0014] The present invention provides a function secret sharing construction method for comparison function, including: in the key generation stage: a trusted third party generates DPF keys corresponding to two servers using a DPF key generation algorithm; and feeds back the DPF keys to the two servers S0 and S1; in the key evaluation stage: a system user sends input data to the server S0 and the server S1, and the server S0 and the server S1 both obtain parity check trees from their respective corresponding DPF keys, and then use a prefix parity query algorithm to query the input data and the parity check tree to obtain a query result, and feeds back the query result to the system user; the dual-cloud distributed computing system user performs an XOR operation on the query results fed back by the server S0 and the server S1 to obtain a DCF result. Since the input parameters in the key generation stage are all distributedly hidden in the DPF key, any single DPF key cannot be parsed out; and the server uses the secret state share of the parameters in the DPF key to perform secret state calculations, and cannot spy on the plain text values ​​of the parameters and the DCF results, and finally outputs a result of performing a prefix parity query on the input data using a parity check tree constructed by the DPF key. At the same time, the present invention designs a more lightweight algorithm than the existing solution, effectively reducing the computational complexity and memory usage. Therefore, the present invention can provide higher computational efficiency while protecting user data privacy.

[0015] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a process schematic diagram of a function secret sharing construction method for comparison function provided by the present invention;

[0017] Figure 2 It is a schematic diagram of a DPF binary tree sample provided by the present invention;

[0018] Figure 3 It is a schematic diagram of the tree structure actually contained in the DPF key provided by the present invention;

[0019] Figure 4 This is a schematic diagram of a parity check tree sample provided by the present invention. DETAILED DESCRIPTION

[0020] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0021] Before introducing the present invention, a brief introduction to the field knowledge involved in the present invention is first given.

[0022] Unless otherwise specified, the present invention and the protocols are all run on a dual-cloud distributed outsourcing computing model, with cloud servers S0 and S1. All data operations are performed in the loop In the above example, l represents the number of binary digits.

[0023] Dual-cloud distributed outsourcing computing model: The data owner encrypts the data locally and then uploads it to two independent cloud servers. The cloud servers execute a series of secure computing protocols based on the specific tasks and finally send the encrypted results to the designated users.

[0024] Semi-honest threat model: the server will faithfully perform various operations in accordance with the protocol, but will attempt to spy on or infer private information related to the original data.

[0025] The present invention relates to function secret sharing. Function secret sharing (FSS) is a function family. Function Split into two addition or XOR shares f0(x) and f1(x). Each share hides the specific content of f and ensures that for all inputs x∈G in , either f0(x)+f1(x)=f(x) or This means that the value of f(x) corresponding to any input x can be reconstructed through its two secret shares. Its formal definition is as follows:

[0026] Definition 1. The two-party functional secret sharing (FSS) scheme consists of a pair of probabilistic polynomial time algorithms, namely Gen(·), Eval(·). This pair of algorithms has the following characteristics:

[0027] ·Gen(1 λ , f) is a key generation algorithm. Given a security parameter λ and a description of a function f, the algorithm outputs a pair of functional keys (k0, k1), also known as function secret sharing shares. Each key can effectively describe f0 and f1 without revealing the specific information of f.

[0028] Eval(b,k b , x) is a polynomial time evaluation algorithm. Given the index b∈{0,1} of the participant, the key k b and input value x, it can output a secret share f b (x), such that f0(x)+f1(x)=f(x) or

[0029] The technical concept of the present invention is briefly introduced below.

[0030] Most of the existing privacy protection comparison schemes are designed based on obfuscated circuits or arithmetic secret sharing, which leads to high communication overhead and communication rounds, making it difficult to apply them in actual network environments. Function Secret Sharing (FSS) is a new cryptographic primitive that can be applied to the field of secure multi-party computing to achieve secure computation of nonlinear functions in a single round of communication. It can effectively solve the nonlinear computational communication bottleneck of secure multi-party computing tasks under a semi-honest model. However, the corresponding memory overhead and local computational complexity have increased compared to previous schemes, making it difficult to apply them in scenarios with high overall computational complexity and large data volumes.

[0031] The present invention proposes a function secret sharing construction method for comparison functions, namely a distributed comparison function (DCF) based on prefix parity query (PPQ), which can implement privacy-preserving comparison operations in a distributed system. Based on the distributed comparison function implementation method of the present invention, provable security under a semi-honest threat model can be achieved, that is, it is ensured that the comparison operation protocol can be correctly performed on the distributed cloud server, and the plaintext information of the data involved in the comparison will not be leaked to any cloud server. At the same time, compared with the existing scheme, the memory overhead and local calculation complexity during calculation are also greatly improved.

[0032] The technical solution details of the present invention are described in detail below.

[0033] like Figure 1 As shown, the present invention provides a function secret sharing construction method for comparison function, comprising:

[0034] During the key generation phase:

[0035] The trusted third party generates DPF keys corresponding to server S0 and server S1 using the DPF key generation algorithm, where the DPF key corresponding to each server includes a share of the input parameters; and feeds the DPF key back to the server S0 and server S1;

[0036] Distributed Point Function (DPF) is a FSS solution for point functions. A point function outputs a non-zero value at an exact index within its domain, and its specific definition is as follows:

[0037]

[0038] The function of the distributed point function can be viewed as traversing a binary tree of depth l, where l is the bit length of the input data (usually 32 or 64 bits). Among all the paths in the binary tree, there is a unique path from the root node to the α-node, called the 1-path. Among the nodes in the binary tree, only the α-node has a value of 1, and the values ​​of other nodes are all 0.

[0039] refer to Figure 2 , describes a binary tree where each node stores a value that is the XOR result of its child node values. The edges at level i show α i The left side represents 0 and the right side represents 1. The above 1-path is highlighted in red, which ends with a unique α-node. During the evaluation process, each evaluator receives a different initial random state (s, t) ∈ {0, 1} λ ×{0, 1}. Starting from the root node, each evaluator traverses the tree toward the root node and updates its state according to the value of x[i] at each level. This update uses the correction word CW in the function key. (i) As long as x[i] = α[i], we will continue along the special path. If a position x[i] ≠ α[i] appears, the evaluator will immediately deviate from the special path, causing the output to become 0. If we can follow this path all the way to the root node, this indicates that x = α, and the function outputs β.

[0040] The DPF keys held by the servers S0 and S1 contain the data structure of a parity check tree. There are n nodes in the parity check tree. The nodes corresponding to the server S0 are respectively denoted as The node corresponding to server S1 is recorded as refer to Figure 3 , Figure 3 The DPF key actually contains the tree structure, such as Figure 3 Shown in the shaded area.

[0041] In a specific implementation of the present invention, the generation of the DPF keys corresponding to the server S0 and the server S1 by using the DPF key generation algorithm includes:

[0042] S11, receiving security parameters 1λ, parameter α, parameter β, parameter

[0043] S12, using its own pseudo-random number generator, using a binary string of length λ as a pseudo-random number generation seed to generate a 2(λ+1)-bit pseudo-random binary string {0, 1} 2(λ+1) ;

[0044] S13, decompose the parameter α into binary strings α1,…,α n ∈{0, 1}n ;

[0045] S14, generate a 1-bit random number and record it as and will The result is recorded as

[0046] S15, use the loop block to loop from i=1 to n multiple times to obtain the parameters and

[0047] S16, using the definition in the Abelian group Addition calculation on The result is recorded as CW (n+1) ;

[0048] S17, for b = 0, 1, combination CW (1) , …, CW (n+1) , denoted as k b A key pair (k0, k1) is obtained; wherein k0 is the DPF key of server S0, and k1 is the DPF key of server S1.

[0049] In a specific embodiment of the present invention, S15 includes:

[0050] S151, setting the number of cycles i=1 to n;

[0051] S152, will Set as the seed of the pseudo-random number generator G, generate a 2(λ+1)-bit pseudo-random number, and parse the pseudo-random number into four parts with lengths of λ, 1, λ, and 1, respectively, denoted as Where b = 0, 1;

[0052] S153, executing the first judgment process of the branch block in the loop block to Re-labeled as or

[0053] This step executes the first judgment process of the branch block in the loop block. i = 0, then the variable superscripted with L in S152 Recorded as Variables with superscript R Recorded as If α i ≠0, the variable in S152 Recorded as variable Recorded as

[0054] S154, calculation Let the result be s CW ;

[0055] S155, calculation Record the result as Synchronous calculation Record the result as

[0056] S156, Combination S CW , CW (i) ;

[0057] S157, for b = 0, 1, calculate Record the result as

[0058] S158, for b = 0, 1, calculate Record the result as

[0059] In the key generation phase, the key generation algorithm of the distributed point function used in this scheme is shown in Algorithm 1:

[0060]

[0061]

[0062] The algorithm is analyzed in detail as follows:

[0063] Algorithm parameters: 1 λ : Safety parameters, α, β: meaning reference point function definition, Abelian group to which β belongs

[0064] It is worth noting that the random number generation, pseudo-random number generation and The process input and output string length is related to λ and is of the form 1 λ It is a common way to express the length of a string in cryptography, {0,1} n Represents a binary string of 0s and 1s of length n. Note the distinction between superscripts and letter variables.

[0065] The algorithm executor holds a pseudo-random number generator G, which accepts a binary string of length λ as a pseudo-random number generation seed and generates a 2(λ+1)-bit pseudo-random binary string.

[0066] is any binary string of length λ that can be converted to an Abelian group The mapping method on .

[0067] Algorithm process:

[0068] 1. Decompose the input α into its binary string representation α1,…,α n ∈{0,1} n

[0069] 2. Generate two random numbers with a binary bit length of λ and denote them as

[0070] 3. Generate a random number and record it as Will The result is recorded as

[0071] 4. Loop block starts: for i=1 to n:

[0072] 5. Set as the seed of the pseudo-random number generator G, generate a 2(λ+1)-bit pseudo-random number, and parse it into four parts of length λ, 1, λ, 1, respectively, denoted as Where b=0,1.

[0073] 6. Branch block starts: If α i = 0, then the variable with superscript L generated in 5 Recorded as Variables with superscript R Recorded as Where b=0,1.

[0074] 7. Otherwise: Contrary to 6, change the variable Recorded as variable Recorded as Where b=0,1.

[0075] 8. End of branch block

[0076] 9. Calculation Let the result be s CW

[0077] 10. Calculation Record the result as calculate Record the result as

[0078] 11. Combinations CW , CW (i)

[0079] 12. For b = 0, 1, calculate Record the result as

[0080] 13. For b = 0, 1, calculate Record the result as

[0081] 14. End of loop block

[0082] 15. Use the addition defined in to calculate and record the result as CW (n+1)

[0083] 16. For b = 0, 1, combine CW (1) ,..., CW (n+1) and record it as k b

[0084] 17. Return the key pair (k0, k1)

[0085] In the above algorithm process, the information of α and β is distributed and hidden in the two keys k0 and k1, and the plaintext values of α and β cannot be parsed and restored from any single key.

[0086] In the key evaluation stage:

[0087] The users of the dual-cloud distributed computing system send the input data to the server S0 and the server S1;

[0088] Both the server S0 and the server S1 obtain the parity check tree from their respective DPF keys, then use the prefix parity query algorithm to query the input data and the parity check tree to obtain the query results, and feedback the query results to the system users;

[0089] The users of the dual-cloud distributed computing system perform an exclusive OR operation on the query results respectively feedback by the server S0 and the server S1 to obtain the DCF result.

[0090] Given a binary bit string x = x0x1,..., x l-1 , assuming there is a substring x a x a+1 ,..., x b-1 , denoted as x[a, b), where 0 ≤ a < b ≤ l. The parity check query for x[a, b) is defined as follows:

[0091]

[0092] This scheme uses a data structure called a parity check tree to perform parity check queries, and the computational complexity of this process is O(l). In the parity check tree, the value of each node is the parity check result of its two child nodes. The construction of the parity check tree is carried out from bottom to top. First, x is divided into 2 k substrings, each substring contains λ binary bits, and here it is assumed that l / λ = 2k . Next, for each substring, generate a leaf node and link the substring to that node. The parity value of the substring is stored inside the leaf node. Then, for each pair of adjacent leaf nodes, insert a parent node and store the parity values ​​of its two child nodes in it. Repeat this process for each pair of adjacent parent nodes until a single root node is formed. At this point, the parity bit held by any given node is equal to the parity of the concatenation of the substrings of x associated with all of that node's descendant leaf nodes.

[0093] Figure 4 An example of a parity check tree is shown. In this example, the binary bit string is x = 00101100101110112. It can be stipulated that the traversal of the substring is always to the left. In this case, the substring can be regarded as the left child of the leaf node (in fact, this relationship does not exist, so it is represented by a dotted line). The specific steps for traversing the parity check tree are further given as follows:

[0094] Initialize the output r to 0 and set the path direction to the left;

[0095] Starting from the root node, traverse to the leaf node associated with binary bit a;

[0096] When the traversal path direction changes, the output r is updated by XORing the parity value stored on the changed node;

[0097] The XOR leaf node associates all the prefix bits in the substring and outputs r.

[0098] Furthermore, to obtain x[a,b), we only need to traverse the parity tree sequentially to obtain parity(x[0,a)) and parity(x[0,b)) respectively. Then, we can further obtain the parity value of x[a,b) through the equivalent conversion of the following formula:

[0099]

[0100] The correctness of the above formula comes from the idempotence of the XOR operation. Therefore, calculating the prefix parity of the binary bits a and b can get the correct parity of x[a,b). Figure 2 The green arrow in indicates the traversal process of parity(x[0,a)). The green dots are used to mark the nodes where the direction changes. Based on this traversal process, we can get:

[0101]

[0102] Through similar traversal, we can get parity(x[0,b)) = 1 (marked with blue arrows and nodes). According to the defined formula, the parity query of x[a,b) can be obtained by the following calculation:

[0103]

[0104] In a specific implementation manner of the present invention, the step of querying the input data and the parity check tree using a prefix parity query algorithm to obtain a query result includes:

[0105] S21, set the safety parameter 1 λ , input data x, point function The DPF key k b As input;

[0106] S22, for b∈{0,1}, decompose the input data x into binary strings, represented as x1,…,x l ∈{0, 1} l ;

[0107] S23, parse DPF key k b Get (0) ,t (0) , CW (1) , …, CW (l+1) ;

[0108] S24, initialize variable pv b =0, d=0;

[0109] S25, use the loop block to loop from i=1 to l multiple times to update or Get the prefix parity query result pv b .

[0110] In a specific embodiment of the present invention, S25 includes:

[0111] S251, for i∈[1, l], use the loop block to parse CW (i) Get CW ,

[0112] S252, calculation Let τ be the result. (i) ;

[0113] S253, Analytical τ (i) Get L ,t L 、s R ,t R ∈{0, 1} 2(λ+1) ;

[0114] S254, executing the second judgment process of the branch block in the loop block to convert s L ,t L Denoted as s (i) ,t (i) Or R ,t R Denoted as s (i) ,t (i) ;

[0115] This step executes the second judgment process of the branch block in the loop block. If x i = 0, then s L Note: s (i) , t L Denoted as t (i) ; if x i ≠0, then s R Note: s (i) , t R Denoted as t (i) .

[0116] S255, executing the third judgment process of the branch block in the loop block to update or Get the prefix parity query result pv b .

[0117] This step executes the third judgment process of the branch block in the loop block. If d≠x i , then update d = x i , If d = 1, update Get the prefix parity query result pv b .

[0118] Distributed Comparison Function (DCF) is an FSS scheme for comparison functions. The comparison function is demarcated at an exact index within its domain. The distributed comparison function defined in this scheme outputs 0 when the input is less than or equal to the value, and outputs a non-zero value β when it is greater than the value. The specific definition is as follows:

[0119]

[0120] In the key evaluation execution phase, the distributed comparison function evaluation algorithm based on prefix parity query designed in this scheme performs prefix parity query on the distributed point function key generated by Algorithm 1, as shown in Algorithm 2. In this algorithm, pv b and d represent the continuously updated parity check value and the current tree traversal direction respectively. The final parity check result pvb The execution result of the distributed comparison function can be obtained by performing the difference or.

[0121]

[0122]

[0123] The following is a detailed analysis of the above algorithm 2:

[0124] Algorithm parameters: Security parameter 1 λ , input x, point function The DPF key k b

[0125] Note: The following random number generation, pseudo-random number generation and The process input and output string length is related to λ and is of the form 1 λ It is a common way to express the length of a string in cryptography, {0, 1} l Represents a binary string of 0s and 1s of length l. Note the distinction between superscripts and letter variables.

[0126] The algorithm executor holds a pseudo-random number generator G, which accepts a binary string of length λ as a seed and generates a 2(λ+1)-bit pseudo-random binary string. G(x) represents the pseudo-random number generated by setting x as the seed.

[0127] is any binary string of length λ that can be converted to an Abelian group A mapping method on . a||b||c||d represents the combination of a, b, c, d.

[0128] Algorithm process:

[0129] 1. For b∈{0,1}, do the following:

[0130] 2. Decompose x into its binary string representation x1,…,x l ∈{0, 1} l

[0131] 3. Analyze k b Get (0) ,t (0) , CW (1) , …, CW (l+1)

[0132] 4. Initialize variable pv b =0, d=0

[0133] 5. Loop block starts: for i∈[1,l]:

[0134] 6. Analyze CW (i)Get S CW ,

[0135] 7. Calculation Let τ be the result. (i)

[0136] 8. Analyzing τ (i) Get L ,t L 、s R ,t R ∈{0, 1} 2(λ+1)

[0137] 9. Branch block starts: if x i =0 then:

[0138] 10. L Note: s (i) , t L Denoted as t (i)

[0139] 11. Otherwise:

[0140] 12. R Note: s (i) , t R Denoted as t (i)

[0141] 13. End of branch block

[0142] 14. Branch block starts: if d≠x i but:

[0143] 15. Update d = x i

[0144] 16. Update

[0145] 17. End of branch block

[0146] 18. End of loop block

[0147] 19. Branch block starts: If d = 1 then:

[0148] 20. Update

[0149] 21. End of branch block

[0150] 22. Return the prefix parity query result pv b

[0151] In the above algorithm process, the algorithm executor uses the secret share of α in the DPF key to perform secret calculations. During the calculation process, the algorithm executor is unable to spy on the plaintext value of α, and finally outputs a value that uses the key k. b The constructed parity check tree performs a prefix parity query on the input x, which is the distributed comparison function The result of the XOR sharing form.

[0152] The present invention realizes distributed comparison function calculation with less system resources and more efficient operation under the premise of protecting data privacy. Compared with existing work, this scheme occupies less memory space, and because the number of pseudo-random numbers generated in the algorithm process is nearly halved compared with the original DCF scheme, it has higher computing efficiency. A simple experimental evaluation was carried out on the key technologies involved in the present invention, in which the element bit width of the input vector is l=64, the CPU of the test machine is i7-11800H, and the GPU is NVIDIA GeForce RTX3060Laptop. The test code is written in Python, and the specific experimental data is as follows:

[0153]

[0154]

[0155] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0156] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other variations of the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality of components or steps.

[0157] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A method for constructing a function secret sharing for comparison functions, characterized in that: include: During the key generation phase: The trusted third party generates DPF keys corresponding to server S0 and server S1 using the DPF key generation algorithm. The DPF key corresponding to each server includes a share of the input parameters. And feed back the DPF key to the server S0 and server S1; During the key evaluation phase: The user of the dual-cloud distributed computing system sends input data to the server S0 and the server S1; The server S0 and the server S1 both obtain the parity check tree from their respective corresponding DPF keys, and then use the prefix parity query algorithm to query the input data and the parity check tree to obtain the query result, and feed back the query result to the system user; The dual-cloud distributed computing system user performs an XOR operation on the query results fed back by the server S0 and the server S1 to obtain a DCF result.

2. The method for constructing a function secret sharing for comparison functions according to claim 1, characterized in that: The DPF keys of the servers S0 and S1 contain the data structure of a parity check tree. There are n nodes in the parity check tree. The nodes corresponding to the server S0 are respectively denoted as The node corresponding to server S1 is recorded as 3. The method for constructing a function secret sharing for comparison functions according to claim 2, characterized in that: The method of using the DPF key generation algorithm to generate the DPF keys corresponding to the server S0 and the server S1 includes: S11, receiving security parameters 1 λ , parameter α, parameter β, parameter S12, using its own pseudo-random number generator, uses a binary string of length λ as a pseudo-random number generation seed to generate a 2(λ+1)-bit pseudo-random binary string {0,1} 2(λ+1) ; S13, decompose the parameter α into binary strings α1,…,α n ∈{0,1} n ; S14, generate a 1-bit random number and record it as and will The result is recorded as S15, use the loop block to loop from i=1 to n multiple times to obtain the parameters and S16, using the definition in the Abelian group Addition calculation on The result is recorded as CW (n+1) ; S17, for b = 0, 1, combination CW (1) , …, CW (n+1) , denoted as k b A key pair (k0, k1) is obtained; wherein k0 is the DPF key of server S0, and k1 is the DPF key of server S1.

4. The method for constructing a function secret sharing for comparison functions according to claim 3, characterized in that: S15 includes: S151, setting the number of cycles i=1 to n; S152, Set as the seed of the pseudo-random number generator G, generate a 2(λ+1)-bit pseudo-random number, and parse the pseudo-random number into four parts with lengths of λ, 1, λ, and 1, respectively, denoted as Where b = 0, 1; S153, executing the first judgment process of the branch block in the loop block to Re-labeled as or S154, calculation Let the result be s CW ; S155, calculation Record the result as Synchronous calculation Record the result as S156, Combination S CW , CW (i) ; S157, for b = 0, 1, calculate Record the result as S158, for b = 0, 1, calculate Record the result as 5. The method for constructing a function secret sharing for comparison functions according to claim 4, characterized in that: S153 includes: Execute the first judgment process of the branch block in the loop block. If α i = 0, then the variable superscripted with L in S152 Recorded as Variables with superscript R Recorded as If α i ≠0, the variable in S152 Recorded as variable Recorded as 6. The method for constructing a function secret sharing for comparison functions according to claim 1, characterized in that: The step of querying the input data and the parity check tree using the prefix parity query algorithm to obtain the query result comprises: S21, set the safety parameter 1 λ , input data x, point function The DPF key k b As input; S22, for b∈{0,1}, decompose the input data x into binary strings, represented as x1,···,x l ∈{0,1} l ; S23, parse DPF key k b Get (0) ,t (0) , CW (1) 、···、CW (l+1) ; S24, initialize variable pv b =0,d=0; S25, use the loop block to loop from i=1 to l multiple times to update pv b =pv b ⊕t (i-1) or pv b =pv b ⊕t (l) , get the prefix parity query result pv b .

7. The method for constructing a function secret sharing for comparison functions according to claim 6, characterized in that: S25 includes: S251, for i∈[1,l], use the loop block to parse CW (i) Get CW , S252, calculation Let τ be the result. (i) ; S253, Analytical τ (i) Get L ,t L 、s R ,t R ∈{0,1} 2(λ+1) S254, executing the second judgment process of the branch block in the loop block to convert s L ,t L Denoted as s (i) ,t (i) Or R ,t R Denoted as s (i) ,t (i) ; S255, executing the third judgment process of the branch block in the loop block to update pv b =pv b ⊕t (i-1) or v b =pv b ⊕t (l) Get the prefix parity query result pv b .

8. The method for constructing a function secret sharing for comparison functions according to claim 7, characterized in that: S254 includes: Execute the second judgment process of the branch block in the loop block. If x i = 0, then s L Note: s (i) , t L Denoted as t (i) ; if x i ≠0, then s R Note: s (i) , t R Denoted as t (i) .

9. The method for constructing a function secret sharing for comparison functions according to claim 7, characterized in that: S255 includes: executing the third judgment process of the branch block in the loop block, if d≠x i , then update d = x i , pv b =pv b ⊕t (i-1) ; If d = 1, update pv b =pv b ⊕t (l) , get the prefix parity query result pv b .

Images