Lightweight distributed data encryption sharing and comparison function construction method

Abstract

The application discloses a lightweight distributed data encryption sharing and comparison function construction method, and the method comprises the following steps: in a key generation stage, given a security parameter 1 λ and a comparison function f(x)={x

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and relates to a lightweight distributed data encryption sharing and comparison function construction method. BACKGROUND

[0002] Secure comparison protocol is a core component in the field of secure multi-party computation, and is widely used in privacy-preserving machine learning tasks. The goal of secure comparison protocol is to compare the size of data while protecting the privacy of participants. The research in this field first introduced the method of using garbled circuits for integer comparison, laying the foundation for secure multi-party computation. Garbled circuits encode the computing task as a Boolean circuit and perform the computation layer by layer by participants, thus realizing privacy protection. However, the protocol based on garbled circuits has significant communication overhead, because each circuit gate needs to exchange one-time keys between the two parties, which is particularly evident in large-scale computation.

[0003] To overcome the limitations of garbled circuits, researchers have proposed arithmetic secret sharing technology. Arithmetic secret sharing divides data into multiple shares and distributes them to different participants, so that a single participant cannot obtain complete information, thus realizing computation while protecting privacy. In the research of secure comparison protocol, the introduction of function secret sharing (FSS) marks a major breakthrough. FSS shares the function with multiple participants, so that each participant only holds part of the function information, thus realizing efficient computation while protecting privacy. FSS becomes the basis of distributed point function (DPF) and distributed comparison function (DCF) schemes, providing a new direction for subsequent research. Based on FSS, researchers have proposed various improved schemes. For example, the distributed interval inclusion function further optimizes the computing efficiency by converting the comparison problem into an interval judgment problem. The DCF based on semi-tree and the DCF based on GGM tree reduce the computing and communication overhead by introducing tree-like structures. However, these schemes still face some challenges in practical applications, such as the need for long random number generation (RNG) keys and additional operations to solve the wrap-around problem when executed online. To further improve performance, Grotto et al. proposed a DCF scheme based on parity segment trees to reduce the use of RNG, but this scheme needs to traverse each layer of the parity segment tree in the DCF execution phase, introducing additional computing cost.

[0004] Most of the existing secure comparison schemes are designed based on garbled circuits or arithmetic secret sharing, resulting in high communication overhead and communication rounds, which is difficult to apply to actual network environment. Distributed comparison function (DCF) is a FSS primitive that can be applied to the field of secure multi-party computation, and realizes single-round communication of comparison function secure computation. However, the existing DCF usually needs to generate a large number of pseudo-random numbers when implementing secure comparison operation, resulting in high computational complexity and low running efficiency. Secondly, the existing DCF scheme needs to occupy a large amount of memory space in the key generation and execution process, which limits its application in resource-constrained environments. SUMMARY

[0005] The purpose of the present application is to provide a lightweight distributed data encryption sharing and comparison function construction method, and the technical scheme adopted is:

[0006] A lightweight distributed data encryption sharing and comparison function construction method, comprising the following steps:

[0007] S1: in the key generation stage:

[0008] Given the security parameter 1 λ and the comparison function f(x)={x<α}, the pre-processing trusted third-party server generates two keys corresponding to the comparison function using the DCF key generation algorithm Key respectively fed back to two independent servers P0 and P1;

[0009] S2: in the key execution segment:

[0010] Given the key and the input value x, based on 0 / 1 encoding and early interruption technology, the server P0 and the server P1 output the additive secret output part β0=f0(x) and β1=f1(x) of the comparison function f(x), when and only when x<α, Otherwise f(x)=0.

[0011] In an embodiment of the present application, the step S1 comprises:

[0012] Suppose the input value x is a binary string of length l, represented as x0x1…x l-1 , x l-1 is the least significant bit, x0 is the most significant bit, and the 0-encoding and 1-encoding rules of the binary string x are defined as:

[0013] In one embodiment of the present application, the step S1 comprises:

[0014] The input value x and a are divided into two parts a0,...,a v ||a v+1 ,...,a l-1 and x0,...,x v ||x v+1 ,...,x l-1 , where v∈[0,l-1], are compared respectively;

[0015] When x0...x v ≠a0...a v , only the first (v+1) bit length strings are compared;

[0016] When x0...x v =a0...a v , the remaining (l-v-1) bit length strings are compared.

[0017] In one embodiment of the present application, the step S1 comprises:

[0018] For the first v bit length a0,...,a v , a virtual tree is constructed, the left child node and the right child node of each node represent 0 and 1 respectively, and each bit of the number is compared layer by layer from the top of the tree to the bottom, wherein the path matched with a is called a special path;

[0019] Each node saves a label to indicate whether it is on the special path, and if yes, the label is 1, otherwise, the label is 0;

[0020] For the remaining bit length a v+1 ,...,a l-1 , a query table is constructed The encoding is performed by using the lookup table, if , the kth element ω (k) of the encoding table ω is 1, otherwise, it is 0.

[0021] In one embodiment of the present application, in the step S1, the DCF key generation algorithm comprises the following steps:

[0022] S11: initialization:

[0023] Input security parameters 1 λ and the special path a=a0,a1,...,a l-1 , set the best layer number of early interruption as v=l-1-log2λ, where l is the bit length of a, and initialize the seed of the server PPO and the seed of the server P1 and the tag of the server P0 and the tag of the server P1

[0024] S12: generating the correction word:

[0025] For the first v+1 bit string of a, a0,...,a v , generate the first v+1 layer of the correction word CW layer by layer (0) ||...||||CW (v) ;

[0026] For the remaining string of a, a v+1 ,...,a l-1 , use the method of lookup table to encode, that is, If , set the kth element of ω (k) =1, otherwise ω (k) =0, then use the random seed and to construct the correction word of the v+1th position

[0027] S13: generating the key:

[0028] Output the key of the server P0 The key is composed of the initial random seed and v+1 correction words CW;

[0029] Output the key of the server P1 The key is composed of the initial random seed and v+1 correction words CW.

[0030] In an embodiment of the present application, the step S12 comprises:

[0031] For each layer (i∈[0,v]), use the pseudo-random generator (G:{0,1} λ →{0,1} 2(λ+1) ) to generate the seed expansion string;

[0032] Divide the expansion string into the left half (s L ||t L ) and the right half (s R ||t R ), wherein s L and s R are random seeds with a length of λ bits, t L and t Ris 1;

[0033] According to the value of α i , the Keep and Lose parts are selected: if α i =0, the left part is kept (Keep=L) and the right part is lost (Lose=R); if α i =1, the right part is kept (Keep=R) and the left part is lost (Lose=L);

[0034] The correction word CW is calculated, wherein

[0035] The seed of the next layer is calculated and the label is obtained

[0036] The loop is stopped at the v-th layer to obtain the correction word CW (0) of the first v+1 layers (v) .

[0037] In one embodiment of the present application, the step S2 comprises:

[0038] For the x0…x v of the first v bits, according to the 0 / 1 encoding rule, when x0…x v <α0…α v , the following can be obtained according to the 0 / 1 encoding rule and and

[0039] If x0…x v <α0…α v , then x0…x v only one bit x i =0 satisfies x0…x i-1 1=α0…α i , and the comparison result β of the current x0…x v <α0…α v is obtained.

[0040] For the comparison of x v+1 ,…,x l-1 <α v+1 ,…,α l-1 , a secure query is performed based on a query table, and the value in the lookup table is selected to update β, i.e. to obtain the final comparison result β of x

[0041] In one embodiment of the present application, the step S2 includes the following steps:

[0042] S21: initialization:

[0043] server P b input key and public x=x0, α1, …, α l-1 , set the initial seed from the key and the correction word CW of each layer (i) , set the optimal layer number v=l-1-log2λ of early interruption;

[0044] S22: hierarchical execution:

[0045] for the first v+1 bit string x0, …, x v of x, parse out x0, …, x v <α0, …, α v of the first v+1 layer, and the security comparison result β b , where (b∈{0,1});

[0046] for the remaining string of x, according to the random seed of the v+1 layer, the state label and the correction word , parse out the output , and then select the query table ω b the first element to update β b , that is: where

[0047] S23: return the result:

[0048] the server P0 outputs the result β0, the server P1 outputs the result β1, and the final result of the lightweight distributed data encryption sharing and comparison function is where β=1, x<α, otherwise, x≥α.

[0049] In one embodiment of the present application, the step S22 includes:

[0050] for the first v+1 bit string x0, …, x v of x, for each layer (i∈[0,v]), use the pseudo-random generator (G:{0,1} λ →{0,1} 2(λ+1) ) and the seed to generate the extended string (τ b), and parsing the extended string as s' L ||t' L ||s' R ||t' R , wherein s' L is the seed of the pseudo-random generator of each layer for the current left random temporary seed, s' R is the seed of the pseudo-random generator of each layer for the current right random temporary seed, t' L represents the state of selecting the left half, t' R represents the state of selecting the right half.

[0051] updating the seed and the label according to the value of x i , if x i = 0, updating and updating the right sibling node state if x i = 1, updating stopping until the loop reaches the v-th layer, obtaining x0,..., x v v of the first v+1 layers, and the secure comparison result β b of a0,..., a T .

[0052] In an embodiment of the present application, the lightweight distributed data encryption sharing and comparison function is deployed in a preprocessing model based on two-party secure computation, the preprocessing model comprising two independent non-colluding servers P0 and P1 and a preprocessing trusted third-party server P T , the preprocessing trusted third-party server P T pre-generates and caches keys for the server P0 and the server P1.

[0053] Advantages of the present application:

[0054] The lightweight distributed data encryption sharing and comparison function construction method of the present application, based on the optimized key generation algorithm of 0 / 1 encoding and early interruption technology, introduces early interruption technology to divide the comparison process into two parts, according to the first part, the first v+1 correction words CW (0) ||...|||CW (v) of the key are constructed based on the 0 / 1 encoding technology, and in the second part, the last correction word of the key is constructed by constructing a confused lookup table, then combined with the initialization seed, the correction words of two layers are combined to form the key, finally, the keys of the two servers are output, which significantly reduces the key length, reduces the space overhead, optimizes the key generation and execution process, and reduces the online execution calculation complexity. In the execution process, combined with the early interruption technology, the secure comparison result x0,..., xv <α0,..., α v Then the remaining part is compared based on the confused lookup table, and finally the comparison result of the remaining layer is used to update the comparison result of the previous v+1 layer, and the final secure comparison result is obtained and output. In the multi-layer structure, the calculation cost is significantly reduced. BRIEF DESCRIPTION OF DRAWINGS

[0055] Figure 1 is a process schematic diagram of a lightweight distributed data encryption sharing and comparison function construction method provided by an embodiment of the application;

[0056] Figure 2 is a virtual tree construction schematic diagram of a lightweight distributed data encryption sharing and comparison function provided by an embodiment of the application. DETAILED DESCRIPTION

[0057] The application will be described in detail below with reference to the drawings and specific embodiments.

[0058] The application provides a lightweight distributed data encryption sharing and comparison function construction method, which combines 0 / 1 coding and early interruption technology, significantly reduces the key length, reduces the space overhead, optimizes the key generation and execution process, reduces the calculation complexity of online execution, and significantly reduces the calculation cost, especially in a multi-layer structure.

[0059] Unless otherwise specified, the lightweight distributed data encryption sharing and comparison function proposed in the application is deployed in a preprocessing model based on two-party secure computation. The preprocessing model includes two independent servers P0 and P1 that do not collude with each other and a preprocessing trusted third-party server P T , wherein the preprocessing trusted third-party server P T can pre-generate and cache keys for the servers P0 and P1.

[0060] The protocol of the application follows the standard simulation paradigm for semi-honest probabilistic polynomial time (PPT) secure threat opponents. In this paradigm, the threat opponent can only destroy one of P0 and P1, and it will perform according to the protocol and try to obtain the privacy information of P0 or P1 by analyzing the protocol.

[0061] In the lightweight distributed data encryption sharing and comparison function construction method of the application, the DCF protocol based on 0 / 1 coding is a function secret sharing (FSS) instance. Given a comparison function cluster and a public input x∈G in , the DCF protocol will share a function The split into two arithmetic shares f0(x) and f1(x). Each share hides the specifics of the function f(x), ensuring that for an input x, f0(x) + f1(x) = f(x). This means that the function value f(x) can be reconstructed by the sum of its two arithmetic shares. DCF includes a pair of algorithms: a key generation algorithm Gen(1 λ , α) and an execution algorithm

[0062] With reference to the accompanying Figure 1 , the lightweight distributed data encryption sharing and comparison function construction method of the present application comprises the following steps:

[0063] S1: In the key generation phase:

[0064] Given a security parameter 1 λ and a comparison function f(x) = {x < α}, the pre-processed trusted third-party server generates two pairs of keys corresponding to the comparison function using the DCF key generation algorithm Key respectively fed back to two independent servers P0 and P1;

[0065] S2: In the key execution segment:

[0066] Given the key and the input value x, based on 0 / 1 encoding and early termination techniques, the servers P0 and P1 output the additive secret output parts β0 = f0(x) and β1 = f1(x) of the comparison function f(x), if and only if x < α, Otherwise f(x) = 0.

[0067] The present application uses the 0 / 1 encoding method to convert the comparison problem into an equality problem, assuming that the input value x is a binary string of length l, represented as x0x1...x l-1 , x l-1 is the least significant bit, and x0 is the most significant bit. The 0-encoding and 1-encoding rules for the binary string x are defined as: The present application uses 0 / 1 encoding technology to convert the secure comparison problem into a string equality matching problem, thereby reducing the size and complexity of the key construction.

[0068] Assuming there is a guess z > y, to verify whether this guess is correct, the present application respectively 1-encodes and 0-encodes the larger value z and the smaller value y, i.e. and Then check If it is true, then z > y is true; otherwise, Then z≤y. On the contrary, assuming there is a guess y>z, encode y and z respectively as and Then check Is it true? For example: Assume z = 10 = 10102, y = 3 = 00112, l = 4. According to the 0 / 1 encoding method rule, we can get and because So z>y.

[0069] In order to optimize the existing solution, the present invention also adopts early termination technology. The input value x and α are divided into two parts α0, ..., α v ||α v+1 ,...,α l-1 and x0,...,x v ||x v+1 ,...,x l-1 , where v∈[0, l-1], are compared respectively; when x0…x v ≠α0…α v When x0…x v =α0…α v , continue to compare the remaining (lv-1) bits of string length.

[0070] In the key generation phase, for the first v bits of length α0,...,α v Build a virtual tree, refer to the attached Figure 2 , the left and right child nodes of each node represent 0 and 1 respectively, and the node value is compared with each bit of the number from the top to the bottom of the tree layer by layer, where the path that matches α is called a special path. Each node saves a label to indicate whether it is on the special path, if so, the label is 1, otherwise it is 0; for the remaining bit length α v+1 ,...,α l-1 , encoded using the lookup table method, which is if Then the kth element ω of the encoding table ω is (k) is 1 if the value is set, otherwise it is 0.

[0071] Referring to Table 1, the DCF key generation algorithm includes the following steps:

[0072] S11: Initialization:

[0073] Enter security parameter 1 λ and special paths α=α0,α1,…,α l-1 , set the optimal layer number of early interruption to v = l-1-log2λ, where l is the bit length of α, and initialize the seed of the server P0 and the seed of the server P1 and the label of the server P0 and the label of the server P1

[0074] S12: generate the correction word:

[0075] For the first v+1 bits string of a, a0,...,av v , generate the correction word CW of the first v+1 layers layer by layer (0) ||...||||CW (v) . For each layer (i∈[0,v]), generate the seed expansion string using pseudo-random generator (G:{0,1} λ →{0,1} 2(λ+1) ). Divide the expansion string into left half (s L ||t L ) and right half (s R ||t R ), where s L and s R are random seeds of λ bits, t L and t R are 1 labels. According to the value of a i , select the keep part (Keep) and the lose part (Lose): if a i =0, keep the left part (Keep=L), lose the right part (Lose=R); if a i =1, keep the right part (Keep=R), lose the right part (Lose=L). Calculate the correction word where Next, calculate the next layer seed and label Loop to v layers stop, get the correction word CW of the first v+1 layers (0) ||...||||CW (v) .

[0076] For the remaining string of a, a v+1 ,...,av l-1 , construct a query table If , set the kth element of ω ω (k) =1 otherwise ω (k) =0, then use the random seed and to construct the correction word of the v+1th position That is a confused query table, the purpose is to server execution when a query is made, the query result is prevented from being leaked.

[0077] S13: generate a key:

[0078] The key of the output server P0 The key is composed of an initial random seed and v+1 correction words CW; the key of the output server P1 The key is composed of an initial random seed and v+1 correction words CW.

[0079] Table 1

[0080]

[0081] The lightweight distributed data encryption sharing and comparison function construction method of the application, based on the optimized key generation algorithm of 0 / 1 encoding and early interruption technology, introduces early interruption technology, divides the comparison process into two parts, and constructs the first v+1 correction words CW of the key based on 0 / 1 encoding technology according to the first half part (0) ||…||||CW (v) , the second half part, constructs a confused lookup table to generate the last correction layer of the key, then combines the initialization seed, combines the correction words of the two layers to form the key, and finally outputs the keys of the two servers. Significantly reduce the key length, reduce the space overhead, optimize the key generation and execution process, and reduce the online execution calculation complexity.

[0082] In the key execution segment, for x0...x v of the first v-bit length, according to the 0 / 1 encoding rule test comparison, when x0...x v <α0...α v , according to the 0 / 1 encoding rule, can get and and If x0...x v <α0...α v , then x0...x v Only one x i = 0 bit satisfies x0...x i-1 1 = α0...α i . This means that in the structure of the tree, there is a path matching x (the blue path of the graph) so that x0...x i-1 1 = α0...α i means that the first i-1 bits of x are on the special path, and x i= 0 is on a special path. Therefore, in the key execution of the function, we only need to check which bits of x are 0, get the labels of its right sibling nodes, and check whether their sum is 1. Figure 2 As shown, assume x = 5 = 01012 and α = 10 = 10102. It is known that x0 = x2 = 0, but only x0's right sibling node Node2 is on the special path. Due to the structure of the tree, for any x, there is at most one x i = 0, its right sibling node is on a special path. Therefore, we can get the current x0…x v <α0…α v The comparison result β. For x v+1 ,...,x l-1 <α v+1 ,...,α l-1 Comparison, based on the encoded query table for security query, select the first Value Update β, which is Obtain the final comparison result β of x<α.

[0083] Referring to Table 2, key execution includes the following steps:

[0084] S21: Initialization:

[0085] The key entered by server P0 and server P1 and the public x=x0,x1,...,x l-1 , from the key Initial seed analysis And the correction word CW of each layer (i) , set the optimal layer number of early interruption v = l-1-log2λ.

[0086] S22: Layered execution:

[0087] For the first v+1 bits of x, the string x0,...,x v , analyze layer by layer Get x0,...,x of the first v+1 layers v <α0, ..., α v Safety comparison results of β b , where (b∈{0,1});

[0088] For each layer (i∈[0,v]), a pseudo-random generator (G: {0,1} λ →{0,1} 2(λ+1) ) and seeds Generate extended string (τ b ), and analyze τ b s′L ||t′ L ||s′ R ||t′ R , where s′ L The pseudo-random generator seed of each layer is used as the temporary seed for the current left random, s′ R The seed of the pseudo-random generator of each layer is used as the current right random temporary seed, t′ L Indicates the state of selecting the left half, t′ R Indicates the state of selecting the right half. i Update the seed and label if x i =0, then update And update the right sibling node status If x i =1, then update Until the loop stops at the v layer, obtain x0,…,x of the previous v+1 layer v <α0,…,α v Safety comparison results of β b .

[0089] For the remaining strings of x According to the random seed of layer v+1 Status Label and correction words Parsing output Then select the query table ω b No. element update β b , which is: in

[0090] S23: Return result:

[0091] Server P0 outputs the result β0, and server P1 outputs the result β1. The final result of the lightweight distributed data encryption sharing and comparison function is Where β=1, then x<α, otherwise, x≥α.

[0092] Table 2

[0093]

[0094] The lightweight distributed data encryption sharing and comparison function construction method of the present invention combines the early interruption technology during execution to obtain the security comparison results x0,…,x0 of the first v+1 layer based on the 0 / 1 encoding principle in the first half. v <α0,…,α vThen, the remaining part is compared based on the confused lookup table, and finally the comparison result of the remaining layer is used to update the comparison result of the previous v+1 layer, and the final comparison result is obtained and output. In the multi-layer structure, the calculation cost is significantly reduced.

[0095] The application significantly reduces the occupation of system resources while ensuring data privacy and security, and realizes more efficient distributed comparison function calculation. Compared with the prior art, the memory usage is greatly reduced, and since the number of pseudo-random numbers generated in the algorithm process is reduced by nearly half compared with the traditional DCF scheme, the calculation efficiency is significantly improved.

[0096] To verify the technical advantages of the application, key technologies are experimentally evaluated. The element bit width of the input vector is 64 bits, the test environment is CPU i7-11800H and GPU NVIDIA GeForce RTX 3060Laptop, and the test code is written in Python language. The specific experimental data is as shown in Table 3:

[0097] Table 3

[0098]

[0099] The lightweight distributed data encryption sharing and comparison function construction method of the application significantly reduces the number of pseudo-random numbers generated by optimizing the algorithm, thereby improving the calculation efficiency. Secondly, the existing DCF scheme needs to occupy a large amount of memory space in the key generation and execution process, which limits its application in resource-limited environments. The application greatly reduces the memory occupation by introducing the 0 / 1 coding principle and early interruption technology, so that the algorithm can also run efficiently in a resource-limited environment, and can efficiently and flexibly realize secure comparison operations in a distributed system. Moreover, the application can improve the efficiency of secure comparison operations while ensuring security, and is suitable for privacy protection decision tree training, reasoning, secure multi-party computation and other privacy computing tasks involving comparison operations.

[0100] The above is only a specific embodiment of the application, but the protection scope of the application is not limited thereto, and any modification, equivalent replacement and improvement made by any person skilled in the art within the technical scope disclosed by the application shall be covered within the protection scope of the application.

Claims

1. A lightweight distributed data encryption sharing and comparison function construction method, characterized in that, Comprising the steps of: S1: In the key generation phase: Given security parameters 1 λ and a comparison function f(x) = {x < a}, the pre-trusted third party server generates two pairs of keys corresponding to the comparison function using the DCF key generation algorithm key are fed back to two independent servers P0 and P1 respectively; In the step S1, the DCF key generation algorithm comprises the steps of: S11: Initialization: Input the security parameter 1 λ and a special path α = α0, α1, …, α l-1 , set the optimal layer number of early interruption as v = l - 1 - log2λ, wherein l is the bit length of α, initialize the seed of the server P0 and the seed of the server P1 and the label of the server P0 and the label of the server P1 S12: Generating a correction word: For the first v+1 bits string of a, a0,..., av v , the correction word CW of the first v+1 layers is generated layer by layer (0) ||...|||CW (v) ; for the remaining string of a The method of using a look-up table is encoded as if then set the kth element of ω, ω (k) = 1, otherwise ω (k) = 0, then using a random seed and construct the correction word at position v+1 S13: Generating a key: Output the key of the server P0 Key is composed of an initial random seed and v+1 correction words CW; Output the key of the server P1 Key is composed of an initial random seed and v+1 correction words CW; The step S12 comprises: For each layer (i e [0, v]), a seed expansion string is generated using a pseudo-random generator (G : {0, 1} λ → {0, 1} 2(λ+1) ) The extended string is divided into a left half (s L ||t L ) and a right half (s R ||t R ), where s L and s R are random seeds of λ bits long, and t L and t R are 1 tags; According to the value of a i , the Keep and Lose parts are selected: if a i = 0, the left part is kept (Keep = L) and the right part is lost (Lose = R); if a i = 1, the right part is kept (Keep = R) and the left part is lost (Lose = L). Computing corrections wherein Computing next layer seeds and tags Loop to v-th layer stop, get the correction word CW of the previous v+1-th layer (0) ||…||||CW (v) ; S2: In the key execution phase: Given the key and an input value x, based on 0 / 1 encoding and early abort techniques, the server P0 and the server P1 output respectively one additive secret output share β0= f0(x) and β1= f1(x) of the comparison function f(x), if and only if x < α, Otherwise The step S2 comprises: For the previous v-bit long x0...x v , according to the 0 / 1 encoding rule test comparison, when x0...x v <α0...α v , according to the 0 / 1 encoding rule, can get and and If x0…x v <α0…α v , then x0…x v There is only one x i =0 satisfies x0…x i-1 1=α0…α i , get the current x0…x v <α0…α v The comparison result β; For x v+1 ,…,x l-1 <α v+1 ,…,α l-1 Comparison, based on the query table for security query, select the first Value Update β, that is Get the final x <α comparison results β; In the step S2, the key execution comprises the steps of: S21: Initialization: The server P0 and server P1 input the key and the disclosed x=x0, x1, …, x l-1 , the initial seed is parsed from the key and the correction word CW of each layer (i) , the optimal layer number v=l-1-log2λ of early interruption is set​ S22: Hierarchical execution: For the first v+1 bits string x0,...,x v of x, layer by layer, we obtain x0,...,x v v the secure comparison result β b of (α0,...,α v , where (b∈{0,1}). for the remaining string of x random seed according to the v+1 layer state label and correction word parse output then select the query table first element to update β b i.e. where S23: Returning a result: The server P0 outputs a result β0, the server P1 outputs a result β1, and the final result of the lightweight distributed data-encryption shared and comparison function is where β = 1, then x < a, otherwise, x > a; The step S22 comprises: For the first v + 1 bits string x0,...,x v For each layer (i e [0, v]), use a pseudo-random generator (G : {0, 1} λ → {0, 1} 2(λ+1) ) and a seed Generate an extended string (τ b ) and parse it into s ′L || t ′L || s ′R || t ′R where s ′L is the current left random temporary seed with the seed of the pseudo-random generator of each layer, s ′R is the current right random temporary seed with the seed of the pseudo-random generator of each layer, t ′L denotes the state of choosing the left half, t ′R denotes the state of choosing the right half; According to x i Update the seed and label if x i =0, then update And update the right sibling node status If x i =1, then update Until the loop stops at the v layer, obtain x0,…,x of the previous v+1 layer v <α0,…,α v Safety comparison results of β b .

2. The lightweight distributed data-encryption sharing and comparison function construction method according to claim 1, characterized in that, The step S1 comprises: Let the input value x be a binary string of length / , denoted as x0x1...x l-1 , x l-1 is the least significant bit, x0is the most significant bit, and the 0-encoding and 1-encoding rules for the binary string x are defined as:

3. The lightweight distributed data-encryption sharing and comparison function construction method according to claim 2, characterized in that, The step S1 comprises: The input values x and a are divided into two parts a0,...,a v ||a v+1 ,...,a l-1 and x0,...,x v ||x v+1 ,...,x l-1 where v e [0, 1-1], respectively, are compared; When x0...x v ≠ α0...α v Only the first (v+1) -bit long strings need to be compared. When x0...x v = a0...a v the comparison of the remaining (l-v-1) bit long strings continues.

4. The lightweight distributed data-encryption sharing and comparison function construction method according to claim 3, characterized in that, The step S1 comprises: For the first v-bit length of a0,..., a v A virtual tree is constructed, with each node having a left child and a right child representing 0 and 1 respectively. The values of the nodes are compared with each bit of the number from the top to the bottom of the tree, and the path that matches a is called a special path. Each node saves a label to indicate whether on a special path, if yes, the label is 1, otherwise 0; for the remaining bit length a look-up table is constructed for it The method of encoding using the look-up table is such that if the kth element of the encoding table ω (k) is 1, otherwise 0.

5. A lightweight distributed data-encryption sharing and comparison function construction method according to any one of claims 1 to 4, characterized in that, The lightweight distributed data encryption sharing and comparison function is arranged in a preprocessing model based on two-party secure calculation, and the preprocessing model comprises two independent non-collusion servers P0 and P1 and a preprocessing trusted third-party server P T The preprocessing trusted third-party server P T generates and caches keys for the server P0 and the server P1 in advance.

Images