A privacy-preserving method based on non-interactive multiplication using Charmille secret sharing

Abstract

This invention relates to the field of privacy protection technology, specifically to a privacy protection method based on non-interactive multiplication using Chamill's secret sharing. By optimizing the selection of secret polynomial coefficients and computational modulus parameters, the degree of the polynomial remains unchanged after secret-sharing multiplication. Addressing the security shortcomings of traditional secret-sharing schemes, this invention improves upon the traditional (k, n) threshold secret-sharing scheme by using a combinatorial order group to generate the public key in the initial stage, thus increasing security compared to traditional schemes. Furthermore, for situations where multiple users do not share data but require collaborative computation, a secret-sharing tree structure is proposed to accomplish collaborative computation tasks among multiple users. The proposed solution can not only be used for collaborative computation among multiple users but can also accelerate computation time and complete more complex computational tasks in any privacy-preserving application using secret sharing.

Description

Technical Field

[0001] This invention relates to the field of privacy protection technology, and specifically to a privacy protection method based on non-interactive multiplication using Charmille secret sharing. Background Technology

[0002] With the growth of data, personal privacy faces new challenges. Big data sets may contain a large amount of sensitive information, such as personal identity, geographical location, and health status. Careless handling of this data may lead to potential privacy breaches, therefore, it is necessary to ensure the protection of sensitive information while pursuing data insights. Specifically, in today's medical environment, the convergence of data technologies and the widespread adoption of medical informatics have led to the digital recording and storage of massive amounts of medical data by various medical institutions. This data includes clinical records, imaging data, laboratory results, etc. Typically, different medical entities need to collaborate on analysis and diagnosis to obtain comprehensive and accurate diagnostic results. How to achieve collaborative computing while protecting data privacy is currently a hot research topic.

[0003] Statistics show that in 2018, Facebook suffered a data breach affecting 50 million users; in 2019, First American Financial in the US, due to a lack of security measures on its website, allowed anyone to access its customer database without authentication, resulting in the leakage of approximately 885 million documents. The leaked data included highly sensitive information such as bank accounts, mortgages, bills, tax records, and driver's license images. As large enterprises and companies place greater emphasis on data security, relevant data privacy protection laws have been successively introduced, such as my country's Cybersecurity Law in 2017, the EU's General Data Protection Regulation (GDPR) in 2018, and the California Consumer Privacy Act in the US in 2020. Meanwhile, domestic and international internet giants, such as Tencent, Alibaba, Microsoft, and Google, have conducted extensive research in the field of data security, demonstrating the importance and urgency of protecting data privacy. The development of artificial intelligence relies on data information provided by big data, but because most data contains sensitive information, collecting data from individuals or multiple institutions is difficult, leading to the problems of "data silos" and privacy protection in the field of artificial intelligence. Privacy-preserving computation is currently the mainstream technology for solving these problems. In this context, secure multi-party computation (MPC) has emerged.

[0004] Secure multi-party computation originated from the Millionaire Problem proposed by Andrew Yao in 1982. Secure multi-party computation uses cryptographic protocols, such as those based on secret sharing and homomorphic encryption, to ensure that the original data is not leaked during the computation process by dividing the data into several parts and distributing them to the participants using mathematical algorithms. Specifically, x represents the original data, x1, x2, ..., x... nThis represents the partitioned portion of the data, where the partitioned data is assigned to participants P1, P2, ..., P. n Calculate F(x1,x2,…,x) without revealing x. n Each participant is only aware of the data segmentation and computation results they hold.

[0005] The shortcomings and deficiencies of existing solutions: For (k, n) threshold secret sharing in cloud analytics, the addition of secret shares is relatively easy to implement because it has additive homomorphism; a simple summation is sufficient to satisfy the upload of shares from k servers, thereby recovering the secret x. However, for the secret sharing multiplication sub-protocol in the cloud, the polynomial degree of the result changes from k to 2k-1, requiring a significant amount of server communication time or the generation of additional auxiliary tuples to complete the multiplication calculation. In practical applications, it is impossible to complete the computation task within the effective time. Therefore, for federated learning schemes based on (k, n) threshold secret sharing and other multi-party secure computation tasks, the actual computation is quite complex. Specifically, for multi-party user departments with collaborative computation needs, the high time consumption of secret sharing schemes is intolerable. Summary of the Invention

[0006] The purpose of this invention is to provide a privacy protection method based on non-interactive multiplication using Charmille secret sharing, which aims to solve the problem that the implementation of traditional secret sharing multiplication sub-protocols requires communication or auxiliary tuples, and to realize a secret sharing scheme that does not require communication or additional auxiliary tuples, and can meet the joint computing needs of multiple users.

[0007] To achieve the above objectives, this invention provides a privacy protection method based on non-interactive multiplication using Charmille secret sharing, comprising the following steps:

[0008] Step 1: Select a (k,n) threshold secret sharing scheme;

[0009] Step 2: Perform secret distribution and reconstruction;

[0010] Step 3: Adjust the multiplication of the secret share and restore the secret;

[0011] Step 4: Perform joint computation among multiple users based on a tree structure to achieve secret sharing among n parties.

[0012] Optionally, in step 1, there is a set x = {x1, x2, ..., xn} consisting of participant identity information. n}, Distribute the public key N=p to all participants 2 ·q,[s1] i For server P1's s i Shares, where the number of shares n required for reconstruction is k.

[0013] Optionally, the execution process of step 2 includes the following steps:

[0014] Step 2.1: Given security parameter 2 λ Both p and q should be 2. n+1 Fermat prime form, N = p 2 ·q, distribute N to each participant for modular operations of secret share multiplication and addition;

[0015] Step 2.2: Construct a polynomial f(x) with degree k-1, and polynomial coefficients a1, a2, ..., a... k-1 ∈p·q·Z p ;

[0016]

[0017] N is the public key generated during the initialization phase; then, the administrator uses f(x) to generate n = 2k secret shares of secret s, specifically calculated as follows:

[0018] [s] i =f(x) i (i = 0, 1, ..., k-1);

[0019] Step 2.3: Collect [s] from k participants. i The secret s = L(0) is recovered by constructing a Lagrange polynomial L(x). The specific expression of L(x) is as follows:

[0020]

[0021] Optionally, the execution process of step 3 includes the following steps:

[0022] Step 3.1: The degree of the polynomial corresponding to the secret sharing is a polynomial of the same order. Assume t = k.

[0023]

[0024] Step 3.2: For polynomials of different orders, assume t>k

[0025]

[0026] Step 3: Reconstruct s1s2. Regardless of whether the degree of the polynomials is the same or different, the manager will collect [h(x)] from the k participants. i To recover s1 and s2, the corresponding Lagrange polynomial L(x) is constructed as follows:

[0027]

[0028] Optionally, the tree structure in step 4 is divided according to the internal organizational structure of each department of different multi-party users. The leaf nodes represent the sharing of sub-secrets. The department tree structure T is public, but the underlying secret share is kept secret.

[0029] Optionally, the joint calculation process in step 4 can be divided into the following three cases:

[0030] If both matching nodes are leaf nodes, addition or multiplication can be performed directly without communication or auxiliary tuples.

[0031] If one node is a leaf node and the other node is a non-leaf node, then the value of the leaf node can be calculated from the leaf nodes of the child nodes of the non-leaf node.

[0032] If one node is a leaf node and the other is a non-leaf node, joint computation is not possible.

[0033] This invention provides a privacy-preserving method based on non-interactive multiplication using Charmille secret sharing. By optimizing the selection of secret polynomial coefficients and computation modulus parameters, the degree of the polynomial remains unchanged after secret-sharing multiplication. Addressing the security shortcomings of traditional secret-sharing schemes, this invention improves upon the traditional (k, n)-threshold secret-sharing scheme by using a combinatorial order group to generate the public key in the initial stage, thus increasing security compared to traditional schemes. Furthermore, for situations where multiple users do not share data but require collaborative computation, a secret-sharing tree structure is proposed to accomplish collaborative computation tasks among multiple users. The proposed scheme can not only be used for collaborative computation among multiple users but can also accelerate computation time and complete more complex computational tasks in any privacy-preserving application using secret sharing. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a schematic flowchart illustrating the steps of a privacy protection method based on non-interactive multiplication using Charmille secret sharing, according to the present invention.

[0036] Figure 2 This is a schematic diagram of the access tree structure of a specific embodiment of the present invention. Detailed Implementation

[0037] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0038] Please see Figure 1 This invention provides a privacy protection method based on non-interactive multiplication using Charmille secret sharing, comprising the following steps:

[0039] S1: Select a (k,n) threshold secret sharing scheme;

[0040] S2: Perform secret distribution and reconstruction;

[0041] S3: Adjust the multiplication of secret shares and restore the secret;

[0042] S4: Based on a tree structure, perform joint computation among multiple users to achieve secret sharing among n parties.

[0043] The following provides further explanation in conjunction with the specific implementation steps:

[0044] In step S1, there is a set x = {x1, x2, ..., xn} consisting of the identity information of the participants. n}, Distribute the public key N=p to all participants 2 ·q,[s1] i For server P1's s i Shares, where the number of shares n required for reconstruction is k.

[0045] Specifically, the distribution and reconstruction of secrets in step S2 includes the following steps:

[0046] Step 2.1: Given security parameter 2 λ Both p and q should be 2. n+1 Fermat prime form, N = p 2 ·q, distribute N to each participant for modular operations of secret share multiplication and addition;

[0047] Step 2.2: Construct a polynomial f(x) with degree k-1, and polynomial coefficients a1, a2, ..., a... k-1 ∈p·q·Z p ;

[0048]

[0049] N is the public key generated during the initialization phase; then, the administrator uses f(x) to generate n = 2k secret shares of secret s, specifically calculated as follows:

[0050] [s] i =f(x) i (i = 0, 1, ..., k-1);

[0051] Step 2.3: Collect [s] from k participants. i The secret s = L(0) is recovered by constructing a Lagrange polynomial L(x). The specific expression of L(x) is as follows:

[0052]

[0053] The multiplication of the secret share in step S3 is specifically as follows:

[0054] Suppose that secret value s1 corresponds to polynomial f(x), and secret value s2 corresponds to polynomial g(x). Each participant P i (i = 0, 1, ..., k-1) Using secret sharing [s] i Local computation is performed directly without the need for intermediate data exchange via communication rounds. It's worth noting that this invention provides different calculation methods for the two cases: when the polynomial degree corresponding to the secret sharing is the same and when it is different. However, regardless of the case, the polynomial degree of the result is always the higher number, and the number of servers corresponding to the recovered secret remains unchanged. Below are the specific methods for the two multiplication cases and the method for recovering the secret:

[0055] 1. Given polynomials of the same order, assume t = k

[0056]

[0057]

[0058] 2. For polynomials of different orders, assume t>k

[0059]

[0060] 3. Reconstruct s1 and s2

[0061] Regardless of whether the degree of the polynomials is the same or different, the administrator will collect [h(x)] from the k participants. i To recover s1 and s2, the Lagrange polynomial L(x) is constructed as follows:

[0062]

[0063] Step S4 is specifically a joint computation process among multiple users:

[0064] In today's healthcare environment, the convergence of data technologies and the widespread adoption of medical informatics have led to the digitization and storage of massive amounts of medical data across various medical institutions. This data includes clinical records, imaging data, and laboratory results. Typically, different healthcare entities need to collaborate on analysis and diagnosis to obtain comprehensive and accurate diagnostic results. Therefore, achieving collaborative diagnosis of medical data has become a pressing issue in contemporary healthcare. In this context, this invention proposes a tree-structured access method to segment secret sharing and facilitate collaborative computation without the need for communication. This invention is illustrated using collaborative computation between two departments as an example; however, in practical applications, the framework of this invention can support collaborative computation between n parties.

[0065] In this invention, each department is divided into a tree structure based on its internal organizational structure, and secret sharing calculations are repeatedly performed according to the assigned tree structure. This process ultimately forms a tree structure, where leaf nodes represent sub-secret shares. It is worth noting that the department tree structure T is public, but the underlying secret shares remain confidential.

[0066] Specifically, the method of this invention is built upon a hierarchical access control framework resembling a tree structure. The apex of this structure is the root node, representing the secret value. Using a secret-sharing algorithm, the secret value is split and distributed among the child nodes of the root node. Subsequently, these child nodes become the new secret values, and the secret-sharing algorithm is recursively applied again. This process extends downwards through the tree structure, ultimately forming a configuration where the root node retains the original secret value, while the child nodes contain the allocated secret shares. Figure 2 .a and Figure 2 The .b file shows two distinct tree structures corresponding to secret sharing between different departments. Leaf nodes represent secret sharing, while the root node contains the number of its child nodes and the threshold for recovering the secret.

[0067] The following is a detailed description of the program:

[0068] - Each participant can access the public tree structure of each department, but does not know the secret values ​​of the leaf nodes.

[0069] Matching is performed based on the subtree partitioning of the root node. For example, if the root node of tree structure A has m child nodes, and the root node of tree structure B has n child nodes, then matching will be performed sequentially among the child nodes. Subsequently, the child nodes are treated as root nodes, and matching continues repeatedly until the leaf nodes of the tree structure are reached.

[0070] Each matching node is computed independently. If both matching nodes are leaf nodes, addition or multiplication can be performed directly without communication or auxiliary tuples. If one node is a leaf node and the other is a non-leaf node, the value of the leaf node can be computed using the leaf nodes of the non-leaf node's children. However, if one node is a leaf node and the other is a non-leaf node, joint computation is not possible.

[0071] The following is the specific execution process:

[0072] 1. Input: The public tree structure T of each department, and the local data share of each user.

[0073] 2. Matching: Matching is performed based on the subtree partitioning of the root node. For example, if the root node of tree structure A has m child nodes, and the root node of tree structure B has n child nodes, then matching will be performed sequentially among the child nodes. Subsequently, the child nodes are treated as root nodes, and the matching continues repeatedly until the leaf nodes of the tree structure are reached.

[0074] 3. Calculation: The calculation is divided into three different cases, and the explanation of each case is based on the matching results.

[0075] (1) If both matching nodes are leaf nodes, addition or multiplication can be performed directly without communication or auxiliary tuples. That is, for user P i The secret sharing scheme of this invention can be used directly for calculation. Assuming a two-party calculation, the secret values ​​of the two users correspond to polynomials f(x) and g(x). The secret shares are directly multiplied, and the calculation result is directly uploaded to the central server to restore the joint calculation result.

[0076] Secret share calculation

[0077]

[0078] Settlement result reconstruction

[0079]

[0080] (2) If one node is a leaf node and the other is a non-leaf node, the value of the leaf node can be calculated from the leaf nodes of the non-leaf node's children. Specifically, assume the polynomial corresponding to the secret value of the leaf node is f(x), and the polynomial corresponding to the non-leaf node is g(x). First, traverse all the child nodes of the non-leaf node g(x) until a leaf node is reached. The non-leaf nodes are also partitioned according to the secret sharing scheme proposed above. (Construct a polynomial f(x) with degree k-1, and the polynomial coefficients are a1, a2, ..., a...)k-1 ∈p·q·Z p The polynomial g(x) is as follows: Starting from the leaf nodes of g(x), f(x) is calculated for each node at the leaf node level, and the nodes after calculation are reconstructed. The calculated result is iterated through the above operations until it reaches the same level as f(x). Then, the process continues as in step (1) to complete the joint calculation.

[0081] (3) If one node is a leaf node and the other node is a non-leaf node, joint computation cannot be performed.

[0082] Furthermore, to illustrate the effectiveness of the privacy protection method based on non-interactive multiplication using Charmille secret sharing, this invention conducted experiments using Python and demonstrated the experimental results.

[0083] In the experiments, this invention specified the number of servers N=2 and the confidentiality recovery threshold k=2. Furthermore, the fields used in all experiments were 1000-bit fields, which can approximately guarantee 1000-bit security. This invention used a single computer to complete the experiments, where the virtual machine represented the user and the local machine represented the server distributing the secret, resulting in a computational cost twice the actual time. This invention ran its protocol on different depth multiplication gates. Table 1 shows the time required to complete each process m times.

[0084] Realization Environment

[0085] Operating System: Windows 11 Professional 64-bit

[0086] CPU: Intel® Core™ i5-10400 processor, 2.90GHz

[0087] - 32.00GB of memory

[0088] Platform: PyCharm 2021

[0089] Specifically, Table 3 shows that it takes less than 1 second for each participant to distribute 100,000 secrets to the server. According to Table 3, it takes less than 0.1 seconds to perform 1,000,000 multiplications. Therefore, it can be said that the multiplication method proposed in this invention is highly efficient in terms of computation time.

[0090] Table 1 Calculation Time

[0091]

[0092] Furthermore, this invention compares with other secret-sharing schemes [11-13] and finds that the proposed method is superior to the above schemes in terms of computational and communication overhead, and also in terms of scalability. For scheme

[11] , although it does not require communication, it requires 2k-1 copies to recover the secret. In addition, scheme

[11] also achieves a result that reduces the polynomial degree, but its calculation process is very complex and requires a lot of communication, while the scheme of this invention does not require any communication and is much simpler to calculate.

[0093] For schemes [12-13], although they only require k secret shares to recover the secret, they all require additional communication and need to encrypt and distribute the secret shares during the secret distribution phase. For scheme

[12] , it does not support deeper computation, that is, it only supports one-time computation, and has low scalability. In contrast, the scheme of the present invention does not require communication, can support computation at any depth, and is scalable. Table 2 shows a comparison with the following schemes.

[0094] Table 2 Comparison Results of Other Secret Sharing Schemes

[0095] process This plan

[11]

[12]

[13] Number of shares ≥2k-1 2k-1 2k-1 2k Number of servers ≥k ≥k ≥k ≥k Is interaction required? No No Yes Yes Share required for reconstruction k 2k-1 k k

[0096] The corresponding scheme names and sources are as follows:

[0097]

[11] Shingu, Takeshi, Keiichi Iwaumura, and Kitahiro Kaneda. "Secrecycomputation without changing polynomial degree in Shamir's(k,n)secret sharingscheme."International Conference on Data CommunicationNetworking.Vol.2.SciTePress,2016.

[0098]

[12] Kamal, Ahmad Akmal Aminuddin Mohd, and Keiichi Iwamura. "(Server-Aided)Two-Party Multiplication of Encrypted Shares Using(k,n)Threshold SecretSharing With N≥k Servers." IEEE Access 9(2021):113117-113129.

[0099]

[13] Kamal, Ahmad Akmal Aminuddin Mohd, and Keiichi Iwamura. "Privacypreserving multi-party multiplication ofpolynomials based on (k,n)thresholdsecret sharing." ICT Express 9.5(2023):875-881.

[0100] Tables 3 and 4 compare the computational cost, communication cost, and number of rounds of the method proposed in this invention with the existing solutions proposed in [11-13]. Table 3 shows that the computational cost of the method of this invention (when N=k) in terms of the distribution of a and b and the reconstruction of ab is significantly lower than that of the method in [11-13]. Table 4 compares the communication cost with the conventional methods. These tables demonstrate that the solution of this invention is superior to other solutions in terms of both computational and communication complexity.

[0101] Table 3. Comparison with traditional methods (computational cost)

[0102] process This plan

[11]

[12]

[13] Distribution of secret shares <![CDATA[2c1]]> <![CDATA[2c1+2c2]]> <![CDATA[2(c1+2kc2)]]> <![CDATA[3c1]]> Secret share multiplication <![CDATA[2kc1]]> 2nM <![CDATA[2kc2]]> <![CDATA[4kc1]]> Secret share reconstruction <![CDATA[c2]]> <![CDATA[c1+2c2]]> <![CDATA[c2]]> <![CDATA[c2]]>

[0103] Table 4. Comparison with traditional methods (communication cost)

[0104] process This plan

[11]

[12]

[13] Secret share distribution <![CDATA[kd1]]> <![CDATA[6nd1]]> <![CDATA[8kd1]]> <![CDATA[12d1]]> Secret share multiplication 0 0 <![CDATA[4kd1+2k 2 d1]]> <![CDATA[(2+k)8kd1]]> Secret share reconstruction <![CDATA[2kd1]]> <![CDATA[4kd1]]> <![CDATA[2kd1]]> <![CDATA[2kd1]]>

[0105] In summary, compared with the prior art, the beneficial effects of the present invention are:

[0106] (1) Compared with existing solutions, this invention can realize a privacy protection scheme for n-power multiplication based on secret sharing without communication. In all current privacy protection schemes based on secret sharing, the multiplication sub-protocol requires extensive communication between users, which is the main time-consuming aspect of privacy protection. By setting a public key generation scheme, the need for communication to recover the secret during computation is effectively avoided. This greatly improves the speed and efficiency of scheme implementation. It provides a computational foundation for computational exponents and complex operations in multi-party secure computation such as federated learning.

[0107] (2) By utilizing the combinatorial order group problem to generate public keys, the security of the privacy protection scheme based on secret sharing is enhanced, and its security is only increased compared to traditional schemes. Simultaneously, Fermat primes are used for fast modular reduction calculations, significantly accelerating the computation time to less than 0.1 seconds under a 1000-bit security context. This plays a crucial role in privacy protection applications involving multiple parties, and the advantages of the scheme become more apparent as the number of participants increases.

[0108] (3) In the joint computing algorithm of multiple users, it can effectively improve the data silo problem among multiple users and solve the problem of needing to calculate due to the data being distributed among different people in different departments. It can use data to perform secure calculations while protecting data privacy. Furthermore, multiple users do not need any computing communication; they only need to receive instructions from the manager to perform calculations.

[0109] The above description discloses only one preferred embodiment of the present invention, and should not be construed as limiting the scope of the present invention. Those skilled in the art will understand that all or part of the processes of the above embodiments can be implemented, and equivalent changes made in accordance with the claims of the present invention are still within the scope of the invention.

Claims

1. A privacy protection method based on non-interactive multiplication using Charmille secret sharing, characterized in that, Includes the following steps: Step 1: Select a (k,n) threshold secret sharing scheme; In step 1, there is a set x = {x1, x2, ..., xn} consisting of the identity information of the participants. n }, Distribute the public key N=p to all participants 2 ·q,[s1] i For server P1's s i Shares, where the number of shares n required for reconstruction is k; Step 2: Perform secret distribution and reconstruction; The execution process of step 2 includes the following steps: Step 2.1: Given security parameter 2 λ Both p and q should be 2. n+1 Fermat prime form, N = p 2 ·q, distribute N to each participant for modular operations of secret share multiplication and addition; Step 2.2: Construct a polynomial f(x) with degree k-1, and polynomial coefficients a1, a2, ..., a... k-1 ∈p·q·Z p ; N is the public key generated during the initialization phase; then, the administrator uses f(x) to generate n = 2k secret shares of secret s, specifically calculated as follows: [s] i =f(x i ) Where i = 0, 1, ..., k-1; Step 2.3: Collect [s] from k participants. i The secret s = L(0) is recovered by constructing a Lagrange polynomial L(x). The specific expression of L(x) is as follows: Step 3: Adjust the multiplication of the secret share and restore the secret; Step 4: Perform privacy calculations among multiple users based on a tree structure to achieve secret sharing among n parties.

2. The privacy protection method based on non-interactive multiplication using Charmille secret sharing as described in claim 1, characterized in that, The execution process of step 3 includes the following steps: Step 3.1: The degree of the polynomial corresponding to the secret sharing is a polynomial of the same order. Assume t = k. Step 3.2: For polynomials of different orders, assume t>k Step 3: Reconstruct s1 and s2. Regardless of whether the degree of the polynomials is the same or different, the manager will collect [h(x)] from the k participants. i To recover s1 and s2, the corresponding Lagrange polynomial L(x) is constructed as follows:

3. The privacy protection method based on non-interactive multiplication using Charmille secret sharing as described in claim 2, characterized in that, The tree structure in step 4 is divided according to the internal organizational structure of each department of different multi-party users. The leaf nodes represent the sharing of sub-secrets. The department tree structure T is public, but the underlying secret share is kept secret.

4. The privacy protection method based on non-interactive multiplication using Charmille secret sharing as described in claim 3, characterized in that, The joint calculation process in step 4 is divided into the following three cases: If both matching nodes are leaf nodes, addition or multiplication can be performed directly without communication or auxiliary tuples. If one node is a leaf node and the other node is a non-leaf node, then the value of the leaf node can be calculated from the leaf nodes of the child nodes of the non-leaf node. If one node is a leaf node and the other is a non-leaf node, joint computation is not possible.

Images