Two-Server Verifiable Homomorphic Secret Sharing for High-Degree Polynomials

Abstract

Homomorphic secret sharing (HSS) allows multiple input clients to secret-share their data among multiple servers such that each server is able to locally compute a function on its shares to obtain a partial result and all partial results enable the reconstruction of the function's value on the outsourced data by an output client. The existing HSS schemes for high-degree polynomials either require a large number of servers or lack verifiability, which is essential for ensuring the correctness of the outsourced computations. In this paper, we propose a two-server verifiable HSS (VHSS) model and construct a scheme that supports the computation of high-degree polynomials. The degree of the outsourced polynomials can be as high as a polynomial in the system's security parameter. Despite of using only 2 servers, our VHSS ensures that each single server learns no information about the outsourced data and no single server is able to persuade the client to output a wrong function value. Our VHSS is significantly more efficient. When computing degree-7 polynomials, our scheme could be 3-10 times faster than the previously best construction.

Verifiable Homomorphic Secret Sharing for Machine Learning Classifiers

“…The servers may return wrong results for some economic reasons and internal or external attacks. Furthermore, we adopt the same assumption in related works [4], [6], [7], [16], [20], [21], [31], [33] that the two servers do not collude. It is feasible to consider two non-colluding servers in reality, and the servers can be rented from two different cloud server providers to ensure that the two servers do not collude.…”

“…In our scheme, two non-communicating servers perform evaluations based on the ciphertext of the data, the classifier in polynomial form and the evaluation key, respectively. Like related works [4], [6], [7], [16], [20], [21], [31], [33], we assume that the two servers are not colluding. This assumption is reasonable because the two servers do not need to interact at all, and each server performs evaluations independently.…”

“…In this section, we first benchmark each algorithm in the following PKE-NLD based schemes: the non-verifiable scheme of BKS [7], the verifiable scheme of CZ [16] and our scheme. Next, we compare the performance of these schemes for machine learning classifiers in polynomial form.…”

“…Although HSS can protect the data privacy, none of the current HSS schemes can verify the correctness of the results of machine learning classifiers. Currently, there are five works [16], [17], [36], [37], [38] that focus on verifiable HSS (VHSS) schemes. These schemes ensure both data privacy and result verification.…”

“…As the degree of the polynomial increases, more servers are required to perform the computation. The VHSS of CZ [16] is based on the HSS of BKS [7]. In order to ensure verifiability, the servers of CZ must create a tag for every computation instruction, resulting in twice the amount of computation performed by BKS's servers.…”