Information processing system and information processing method

Abstract

To provide an information processing system and an information processing method that enable data sharing between organizations via a network without leaking information.SOLUTION: In an information processing system in which a first system managed by a first organization and a second system managed by a second organization are communicatively connected, the second system generates a plurality of split private keys by dividing a private key of homomorphic public key cryptography, the first system generates multiple pieces of split data by dividing data to be transmitted from the first organization to the second organization and a plurality of split public keys by dividing a public key of homomorphic public key cryptography corresponding to a private key, generates each piece of ciphertext by encrypting each piece of the split data using the plurality of split public keys, and transmits each piece of generated ciphertext to the second system, and the second system receives each piece of ciphertext from the first system, generates each piece of partial decrypted ciphertext by decrypting part of each piece of ciphertext using each of the plurality of split private keys, aggregates and decrypts each piece of partial decrypted ciphertext, and outputs the data.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information processing system and an information processing method. [Background technology]

[0002] When establishing a secure communication channel between multiple organizations and exchanging confidential information, the first step is to share an encryption key for secret communication. The mainstream method for achieving this is to use public key cryptography, but when two organizations share an encryption key for the first time, if there is only one person in charge from each organization, there is no way to confirm that the sharing is officially authorized by the organizations. In this case, it is effective to prepare multiple people in charge from each organization, as is done in normal transactions, and trust the result of multiple people confirming it.

[0003] A mechanism for multi-party authorization cannot be constructed by simply applying the above-mentioned public key cryptography. As a method for achieving this, there is a technique called secret sharing or tallying, in which data is divided into multiple pieces and sent from multiple people to multiple people, and the multiple people on the receiving side cooperate to reconstruct the data (for example, see Patent Document 1). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2011-28314 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, with the technology described in Patent Document 1, when data is sent or received via the Internet or email, the divided data is stored centrally on the receiving side or on a server on the Internet, which creates a problem in that the administrator of that server can reconstruct the data even if he or she does not have the right to view the data.

[0006] The present invention has been made in consideration of the above circumstances, and has as its object to provide an information processing system and an information processing method that enable data to be shared between organizations via a network without information leakage. [Means for solving the problem]

[0007] One aspect of the present invention for solving the above-mentioned problems is an information processing system in which a first system managed by a first organization and a second system managed by a second organization are communicatively connected, the second system comprising a recording unit that stores a private key of homomorphic public key cryptography, and a private key division unit that reads out the private key from the recording unit and generates a plurality of split private keys by dividing the private key, the first system comprising a recording unit that stores data to be transmitted from the first organization to the second organization and a public key of homomorphic public key cryptography corresponding to the private key, and a plurality of split data obtained by dividing the data and a previous The information processing system includes a split data generation unit that generates multiple split public keys by dividing the public key, and a ciphertext generation unit that generates each ciphertext by encrypting the split data using the multiple split public keys and transmits each of the generated ciphertexts to the second system, wherein the second system includes a partial decryption processing unit that receives each of the ciphertexts from the first system and generates partial decrypted ciphertexts by decrypting a portion of each of the ciphertexts using each of the multiple split private keys, and a decryption processing unit that aggregates and decrypts each of the partial decrypted ciphertexts and outputs the data. Effect of the Invention

[0008] According to the present invention, data can be shared between organizations via a network without information leaks. Configurations and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0009] [Figure 1] 1 is a diagram illustrating an example of a configuration of an information processing system according to a first embodiment of the present invention. [Diagram 2]3 is a diagram illustrating an example of the configuration of a data division server in the first embodiment of the present invention. FIG. [Diagram 3] 2 is a diagram illustrating an example of the configuration of a divided data sending terminal in the first embodiment of the present invention. FIG. [Figure 4] FIG. 2 is a diagram illustrating an example of a configuration of a key management server in the first embodiment of the present invention. [Diagram 5] 2 is a diagram illustrating an example of the configuration of a divided data receiving terminal in the first embodiment of the present invention. [Figure 6] FIG. 11 is a sequence diagram illustrating an outline of encryption key generation processing performed in the information processing system. [Figure 7] 1 is a sequence diagram illustrating an overview of a private key division process performed in an information processing system. [Figure 8] 1 is a sequence diagram illustrating an overview of a data division process performed in an information processing system. [Figure 9] 11 is a sequence diagram illustrating an overview of a divided ciphertext transmission process performed in the information processing system. FIG. [Figure 10] FIG. 11 is a sequence diagram illustrating an overview of a ciphertext decryption process performed in the information processing system. [Figure 11] 11 is a diagram illustrating an example of the correspondence of divided data receiving terminals to which each divided data transmitting terminal transmits ciphertext. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. The following description and drawings are examples for explaining the present invention, and appropriate omissions and simplifications are made for clarity of explanation. The present invention can be implemented in various other forms. Unless otherwise specified, each component may be singular or plural. In order to facilitate understanding of the invention, the position, size, shape, range, etc. of each component shown in the drawings may not represent the actual position, size, shape, range, etc. Therefore, the present invention is not necessarily limited to the position, size, shape, range, etc. disclosed in the drawings. In the following explanation, various information may be explained using expressions such as "table," "list," and "queue," but the various information may be expressed in other data structures. To indicate independence of data structure, "XX table," "XX list," and the like may be referred to as "XX information." When explaining identification information, expressions such as "identification information," "identifier," "name," "ID," and "number" are used, but these are interchangeable. When there are multiple components having the same or similar functions, they may be described by using the same reference numerals with different subscripts, but when there is no need to distinguish between these multiple components, the subscripts may be omitted. In addition, in the following description, the processing performed by executing a program may be described, but the program is executed by a processor (e.g., CPU, GPU) to perform a defined process using storage resources (e.g., memory) and / or interface devices (e.g., communication ports) as appropriate, so the subject of the processing may be the processor. Similarly, the subject of the processing performed by executing a program may be a controller, device, system, computer, or node having a processor. The subject of the processing performed by executing a program may be a calculation unit, and may include a dedicated circuit (e.g., FPGA or ASIC) that performs a specific process. A program may be installed in a device such as a computer from a program source. The program source may be, for example, a program distribution server or a computer-readable storage medium. When the program source is a program distribution server, the program distribution server may include a processor and a storage resource for storing a program to be distributed, and the processor of the program distribution server may distribute the program to be distributed to other computers. In the following description, two or more programs may be realized as one program, and one program may be realized as two or more programs.

[0011] [First embodiment] First, an information processing system and an information processing method according to a first embodiment of the present invention will be described.

[0012] <<System configuration>> 1 is a diagram showing an example of the configuration of an information processing system 1 in this embodiment. The information processing system 1 is a distributed key distribution system that transmits data M of secret information held by a first organization to a second organization through a network 100 including the Internet without leaking it to a third party. The network 100 may include a wired or wireless network such as a local area network (LAN), a wide area network (WAN), or a dedicated line. In this embodiment, the data M shared between the first organization and the second organization is assumed to be confidential data for the first organization or the second organization, or a private key (shared key) for shared key cryptographic communication to be performed after sharing, or the like.

[0013] A first system A managed by a first organization includes a data division server 2000 (first server) and n (n is an integer equal to or greater than 2) divided data transmitting terminals 2100-1, 2100-2, ..., 2100-n (transmitting terminals). For ease of explanation, when the divided data transmitting terminals 2100-1, 2100-2, ..., 2100-n are not particularly distinguished from one another, the numbers 1 to n are omitted and they are simply referred to as "divided data transmitting terminal 2100" or "each divided data transmitting terminal 2100" for ease of explanation. The data division server 2000 and each divided data transmitting terminal 2100 are communicatively connected to one another via a first internal network 201, which is a network within the first organization.

[0014] A second system B managed by a second organization includes a key management server 3000 (second server) and m (m is an integer equal to or greater than 2) divided data receiving terminals 3100-1, 3100-2, ..., 3100-m (receiving terminals). For ease of explanation, when divided data receiving terminals 3100-1, 3100-2, ..., 3100-m are not particularly distinguished from one another, the numbers 1 to m will be omitted and they will simply be referred to as "divided data receiving terminal 3100" or "each divided data receiving terminal 3100" for ease of explanation. Key management server 3000 and each divided data receiving terminal 3100 are connected to each other for communication via second internal network 301, which is a network within the second organization.

[0015] Here, the number n of divided data transmitting terminals 2100 managed by the first organization is equal to or greater than the number m of divided data receiving terminals 3100 owned by the second organization (i.e., m≦n). However, one information processing device may operate as two or more divided data transmitting terminals 2100, for example, functioning as divided data transmitting terminal 2100-1 and divided data transmitting terminal 2100-2.

[0016] <Data partitioning server> 2 is a diagram showing an example of the configuration of a data division server 2000 in this embodiment. The data division server 2000 includes a recording unit 2020 configured with a storage device such as an HDD (Hard Disk Drive) or SSD (Solid State Drive), a control unit 2010 configured with a CPU (Central Processing Unit) and memories such as a RAM (Random Access Memory) or ROM (Read Only Memory), an input unit 2001 such as a keyboard, mouse, or touch panel, an output unit 2002 such as a display or printer, and a communication unit 2003 configured with a NIC (Network Interface Card), a wireless communication module, a USB (Universal Serial Interface) module, a serial communication module, or the like.

[0017] The input unit 2001 receives input of information. The output unit 2002 outputs information. The communication unit 2003 communicates with an external device to transmit and receive data.

[0018] The recording unit 2020 includes a data recording unit 2030 and a parameter recording unit 2040. The data recording unit 2030 stores data M to be transmitted from the first organization to the second organization. The parameter recording unit 2040 stores encryption common parameters P required when dividing and encrypting the data M, and a public key h for encrypting the data M.

[0019] The control unit 2010 includes a divided data generation unit 2011 and a random number generation unit 2012. The divided data generation unit 2011 generates divided data M1, M2,...,Mn by dividing data M into n pieces, and divided public keys h1, h2,...,hn by dividing public key h into n pieces, and transmits each divided data and each divided public key to a different divided data transmission terminal 2100. The random number generation unit 2012 generates a random number r required when each divided data transmission terminal 2100 performs encryption.

[0020] A program for realizing the functions of the divided data generation unit 2011 and the random number generation unit 2012 can be distributed, for example, by recording it on a portable or fixed recording medium.

[0021] <Divided data transmission terminal> 3 is a diagram showing a configuration example of a divided data transmission terminal 2100 in this embodiment. The divided data transmission terminal 2100 is an information processing device such as a personal computer, a tablet terminal, or a smartphone, assigned to each person in charge of the first organization. The divided data transmission terminal 2100 includes a recording unit 2120 configured from a storage device such as an HDD or SSD, a control unit 2110 configured from a CPU and memories such as a RAM or ROM, an input unit 2101 such as a keyboard, a mouse, or a touch panel, an output unit 2102 such as a display or a printer, and a communication unit 2103 configured from a NIC (Network Interface Card), a wireless communication module, a USB (Universal Serial Interface) module, a serial communication module, or the like.

[0022] The input unit 2101 accepts input of information. The output unit 2102 outputs information. The communication unit 2103 communicates with an external device to transmit and receive data.

[0023] The recording unit 2120 includes a data recording unit 2130 and a parameter recording unit 2140. The data recording unit 2130 stores the divided data Mi (i=1, 2, . . . , n) and the random number r received from the data division server 2000. The parameter recording unit 2140 stores the encryption common parameter P and the divided public key hi (i=1, 2, . . . , n).

[0024] The control unit 2110 includes a ciphertext generation unit 2111. The ciphertext generation unit 2111 generates ciphertext Ci (i=1, 2, . . . , n) by encrypting the divided data Mi using a random number r, an encryption common parameter P, and a divided public key hi.

[0025] A program for realizing the functions of the ciphertext generation unit 2111 can be distributed by recording it on, for example, a portable or fixed recording medium.

[0026] <Key management server> 4 is a diagram showing an example of the configuration of a key management server 3000 in this embodiment. The key management server 3000 includes a recording unit 3020 configured from a storage device such as an HDD or SSD, a control unit 3010 configured from a CPU and memories such as a RAM or ROM, an input unit 3001 such as a keyboard, mouse, or touch panel, an output unit 3002 such as a display or printer, and a communication unit 3003 configured from a NIC (Network Interface Card), a wireless communication module, a USB (Universal Serial Interface) module, a serial communication module, or the like.

[0027] The input unit 3001 accepts input of information. The output unit 3002 outputs information. The communication unit 3003 communicates with an external device to transmit and receive data.

[0028] The recording unit 3020 includes a data recording unit 3030 for storing the decrypted data M, and a parameter recording unit 3040. The parameter recording unit 3040 stores the encryption common parameter P, the public key h, and the private key s.

[0029] The control unit 3010 includes a key pair generation unit 3011, a private key division unit 3012, and a decryption processing unit 3013. The key pair generation unit 3011 generates a key pair (public key h and private key s) of homomorphic public key cryptography used when transmitting data M from the first organization. The homomorphic public key cryptography is a public key cryptosystem that has homomorphism. The private key division unit 3012 generates divided private keys s1, s2,...,sm by dividing the private key s into m pieces, and transmits each divided private key to a different divided data receiving terminal 3100. The decryption processing unit 3013 aggregates and decrypts the partially decrypted ciphertexts C'1, C'2,...,C'n received from each divided data transmitting terminal 2100, and outputs data M. The partially decrypted ciphertext C'i (i=1, 2,...,n) is data obtained by decrypting a part of the ciphertext Ci.

[0030] A program for implementing the functions of the key pair generation unit 3011, the private key division unit 3012, and the decryption processing unit 3013 can be distributed by recording it on, for example, a portable or fixed recording medium.

[0031] <Divided data receiving device> 5 is a diagram showing a configuration example of a divided data receiving terminal 3100 in this embodiment. The divided data receiving terminal 3100 is an information processing device such as a personal computer, a tablet terminal, or a smartphone, assigned to each person in charge of the second organization. The divided data receiving terminal 3100 includes a recording unit 3120 configured from a storage device such as an HDD or SSD, a control unit 3110 configured from a CPU and memories such as a RAM or ROM, an input unit 3101 such as a keyboard, a mouse, or a touch panel, an output unit 3102 such as a display or a printer, and a communication unit 3103 configured from a NIC (Network Interface Card), a wireless communication module, a USB (Universal Serial Interface) module, a serial communication module, or the like.

[0032] The input unit 3101 accepts input of information. The output unit 3102 outputs information. The communication unit 3103 communicates with an external device to transmit and receive data.

[0033] The recording unit 3120 includes a data recording unit 3130 for storing the ciphertext Ci received from the divided data sending terminal 2100 or the partially decrypted ciphertext C'i obtained by decrypting a part of the ciphertext Ci, and a parameter recording unit 3140. The parameter recording unit 3140 stores the encryption common parameter P and the divided private keys hi (i=1, 2, . . . , m).

[0034] The control unit 3110 includes a partial decryption processing unit 3111. The partial decryption processing unit 3111 receives a ciphertext Ci from the divided data sending terminal 2100, generates a partially decrypted ciphertext C′i by decrypting a part of the received ciphertext Ci, and sends the partially decrypted ciphertext C′i to the key management server 3000.

[0035] A program that realizes the functions of the partial decoding processor 3111 can be distributed, for example, by recording it on a portable or fixed recording medium.

[0036] Next, a description will be given of the processing performed in the information processing system 1. In this embodiment, an encryption method based on the discrete logarithm problem as the basis of security will be described as an example, but a similar implementation is also possible for an encryption method based on the discrete logarithm problem of an elliptic curve as the basis of security.

[0037] <Encryption key generation process> 6 is a sequence diagram for explaining an outline of encryption key generation processing performed in the information processing system 1. The encryption key generation processing is processing for transmitting the public key h of the encryption communication key pair generated in the second organization to the first organization via the network 100. The processing shown in this figure is executed, for example, when a predetermined input is made by a user to the key management server 3000 of the second organization, or at a predetermined timing (for example, at a predetermined time, at a predetermined time interval).

[0038] As shown in the figure, first, the key pair generation unit 3011 of the key management server 3000 generates a common encryption parameter P (S601). For example, the key pair generation unit 3011 generates a large prime number p, a large prime factor q of p-1, and a generator g (system parameter) of a subgroup of order q of a multiplicative group of a prime field Zp, and sets the common encryption parameter P(p, q, g).

[0039] Next, the key pair generation unit 3011 of the key management server 3000 generates a private key s (S602). For example, the key pair generation unit 3011 randomly generates an integer s between 1 and q, and sets it as the private key s (S602).

[0040] Next, the key pair generation unit 3011 of the key management server 3000 generates a public key h (S603). For example, the key pair generation unit 3011 generates a remainder h (h=g s mod p) is calculated as the public key h. In this embodiment, "mod t" represents the remainder when dividing (dividing) by t.

[0041] Next, the key pair generation unit 3011 of the key management server 3000 transmits the common encryption parameters P(p, q, g) and the public key h to the data division server 2000 (S604).

[0042] The data division server 2000 receives the common encryption parameters P(p, q, g) and the public key h from the key management server 3000, and records and stores them in the parameter recording unit 2040 (S605). Then, this encryption key generation process ends.

[0043] In this embodiment, the common encryption parameter P is generated within the second organization, but the common encryption parameter P may be generated by the first organization and transmitted to the second organization, or may be generated by a third party other than the first organization or the second organization and used with the consent of each organization.

[0044] <Private key division process> 7 is a sequence diagram for explaining an outline of the private key division process performed in the information processing system 1. The private key division process is a process in which the key management server 3000 in the second organization transmits divided private keys s1, s2, ... sm, which are obtained by dividing the private key s into m, to each of the divided data receiving terminals 3100 via the second organization internal network 301. The process shown in this figure is executed, for example, following the encryption key generation process.

[0045] First, the private key division unit 3012 of the key management server 3000 additively and randomly divides the private key s for encryption communication into m split private keys s1, s2, ..., sm (S701). The private key division unit 3012 generates m split private keys such that the remainder obtained by dividing the sum of all the split private keys (total value of the split private keys) by p is the private key s (s=s1+s2+···+sm mod q). Specifically, the private key division unit 3012 randomly generates integers s1, s2, ..., s(m-1) between 1 and q, and sets the value obtained by subtracting the remainder obtained by dividing the sum (total value) of s1, s2, ..., s(m-1) by q from s to sm (sm=s-(s1+s2+···+s(m-1)) mod q).

[0046] Next, the private key division unit 3012 of the key management server 3000 transmits each of the divided private keys s1, s2, ..., s(m-1) to each of the different divided data receiving terminals 3100 via the second internal network 301 (S702). For example, the private key division unit 3012 transmits the j-th (j=1, 2, ..., m)-th divided private key sj to the j-th divided data receiving terminal 3100-j (S702).

[0047] Each divided data receiving terminal 3100-j receives the respective divided private key sj transmitted from key management server 3000, and records and stores them in parameter recording section 3140 of recording section 3120. For example, divided data receiving terminal 3100-1 receives and stores divided private key s1 (S703), and divided data receiving terminal 3100-2 receives and stores divided private key s2 (S704). Thereafter, this private key division process ends.

[0048] <Data division processing> 8 is a sequence diagram for explaining an outline of the data division process performed in the information processing system 1. The data division process is a process in which the data division server 2000 divides the data M to be transmitted from the first organization to the second organization and the public key h for communication encryption, and transmits the divided data to each divided data transmitting terminal 2100 via the first organization's network 201. The process shown in this figure is executed, for example, after the encryption key generation process, when a predetermined input is made by a user to the data division server 2000 of the first organization, or at a predetermined timing (for example, a predetermined time, a predetermined time interval).

[0049] As shown in the figure, first, the divided data generation unit 2011 of the data division server 2000 multiplicatively and randomly divides data M to be transmitted to the second organization into n, and generates divided data M1, M2,...,Mn (S801). The divided data generation unit 2011 generates n pieces of divided data such that the remainder obtained by dividing the product of all divided data by p becomes data M (M=M1×M2×...×Mn mod p). Specifically, the divided data generation unit 2011 randomly generates integers M1, M2,...,M(n-1) between 1 and p using p included in the common encryption parameter P, and sets the remainder obtained by dividing the product (multiplied value) of M1, M2,...,M(n-1) by p to Mn (Mn=1 / (M1×M2×...×M(n-1)) mod p).

[0050] Next, the divided data generation unit 2011 multiplicatively and randomly divides the public key h received in S605 to generate divided public keys h1, h2,...,hn (S802). The divided data generation unit 2011 generates n divided public keys such that the remainder obtained by dividing the product of all divided public keys by p becomes the public key h (h=h1×h2×...×hn mod p). Specifically, the divided data generation unit 2011 randomly generates integers h1, h2,...,h(n-1) between 1 and p using p included in the common encryption parameter P, and determines the remainder obtained by dividing 1 by the product (multiplied value) of h1, h2,...,h(n-1) by p as hn (hn=1 / (h1×h2×...×h(n-1)) mod p).

[0051] Next, the divided data generation unit 2011 randomly generates an integer r between 1 and q, and sets the integer r as a random number r (S803).

[0052] Next, the divided data generation unit 2011 transmits each divided data Mi (i=1, 2,..., n) and each divided public key hi (i=1, 2,..., n) together with the random number r to each different divided data transmitting terminal 2100 via the first internal network 201 (S804). For example, the divided data generation unit 2011 transmits the i-th divided data Mi, the i-th divided public key hi, and the random number r to the i-th divided data transmitting terminal 2100-i.

[0053] Each divided data sending terminal 2100-i receives the divided data Mi, divided public key hi, and random number r sent from the data division server 2000, and records and stores the divided data Mi and random number r in the data recording unit 2130 and the divided public key hi in the parameter recording unit 2140. For example, the divided data sending terminal 2100-1 receives and stores the divided data M1, divided public key h1, and random number r (S805), and the divided data receiving terminal 3100-2 receives and stores the divided data M2, divided public key h2, and random number r (S806). After that, this data division process ends.

[0054] <Split ciphertext transmission process> 9 is a sequence diagram for explaining an outline of the divided ciphertext transmission process performed in the information processing system 1. The divided ciphertext transmission process is a process for transmitting the ciphertext Ci of the divided data Mi from each divided data transmitting terminal 2100-i of the first organization to each divided data receiving terminal 3100 of the second organization. The process shown in this figure is executed, for example, following the data division process. Note that this figure illustrates an example of a process for transmitting the ciphertext C1 from the divided data transmitting terminal 2100-1 to the divided data receiving terminal 3100-1, but the same procedure is also used when transmitting a ciphertext from each of the other divided data transmitting terminals 2100 to each of the other divided data receiving terminals 3100.

[0055] As shown in the figure, first, the divided data sending terminal 2100-1 generates a ciphertext C1=(g r ,h1 r ×M1) is calculated (S901). The ciphertext C1 is the rth power of g (g r ) is the first component, and the value obtained by multiplying hi to the rth power by M1 (h1 r ×M1) is set as the second component. For example, in the case of discrete logarithm-based encryption, the divided data sending terminal 2100-1 calculates the ciphertext C1 by modular multiplication and modular exponentiation of a modulus p. The modulus is the value to be divided in a modular calculation (calculation to obtain the remainder of a division). Modular multiplication is performing a modular calculation on a multiplication result. Modular exponentiation is performing a modular calculation on an exponentiation result.

[0056] Next, the divided data sending terminal 2100-1 sends the generated ciphertext C1 to the divided data receiving terminal 3100-1 corresponding to the divided data sending terminal 2100-1 (S902).

[0057] The divided data receiving terminal 3100-1 receives the ciphertext C1 from the divided data sending terminal 2100-1 (S903), and then ends this divided ciphertext sending process.

[0058] The user decides in advance which divided data receiving terminal 3100 in the second organization each divided data transmitting terminal 2100 in the first organization will send the ciphertext to, and this is set in advance in each divided data transmitting terminal 2100. At this time, the user sets the destination divided data receiving terminal 3100 to which each divided data transmitting terminal 2100 will send the ciphertext, so that the ciphertext is sent from at least one divided data transmitting terminal 2100 to all divided data receiving terminals 3100 in the second organization.

[0059] <Ciphertext decryption process> Fig. 10 is a sequence diagram for explaining an outline of the ciphertext decryption process performed in the information processing system 1. The ciphertext decryption process is a process in which the key management server 3000 aggregates and decrypts the ciphertexts C1, C2, ..., Cn received by each divided data receiving terminal 3100 in the second organization, and outputs the data M. The process shown in this figure is executed following the divided ciphertext transmission process.

[0060] As shown in the figure, first, the partial decryption processing unit 3111 of each divided data receiving terminal 3100-j receives the ciphertext Ci, and decrypts the first component g r For g, use the split private key sj. r The remainder when the si power of is divided by p ((g r ) sj mod p) to generate a partially decrypted ciphertext C′i. For example, the divided data receiving terminal 3100-1 receives the ciphertext C1=(g r ,h1 r ×M1), the first component g r For (g r ) s1 mod p is calculated (S1001). In addition, the divided data receiving terminal 3100-2 receives the ciphertext C2=(g r ,h2 r ×M2), the first component g r Using the split private key s2, r ) s2 The mod p is calculated (S1002).

[0061] Next, the partial decryption processing unit 3111 of each divided data receiving terminal 3100-j generates the partially decrypted ciphertext C'i((g r ) sj mod p), and the second component of the ciphertext Ci (hi r ×Mi) to the key management server 3000. For example, the divided data receiving terminal 3100-1 transmits the partially decrypted ciphertext C′1=(g r ) s1 mod p, and the second component of the ciphertext C1 (h1 r×M1) to the key management server 3000 (S1003). r ) s2 mod p, and the second component of the ciphertext C2 (h2 r ×M2) to the key management server 3000 (S1004).

[0062] The decryption processing unit 3013 of the key management server 3000 receives the partially decrypted ciphertexts C'1, C'2, . . . , C'n and the second component h1 of the ciphertext from each divided data receiving terminal 3100. r ×M1,h2 r ×M2,...,hn r ×Mn, and receive the partially decrypted ciphertexts C'1, C'2, . . . , C'n and the second component h1 of the ciphertext. r ×M1,h2 r ×M2,...,hn r ×Mn, the decryption processing unit 3013 executes an aggregate decryption process for decrypting the data M by calculating M1 ×M2 × . . . ×Mn (S1005). Specifically, the decryption processing unit 3013 first calculates α by the following formula (1).

[0063] α = (g r ) s1 ×(g r ) s2 × ×(g r ) sm mod p (1)

[0064] Next, the decoding unit 3013 calculates β according to the following equation (2).

[0065] β = (h1 r ×M1)×(h2 r ×M2)×···×(hn r ×Mn) mod p (2)

[0066] Next, the decoding unit 3013 performs decoding by calculating the remainder obtained by dividing β by α and then dividing the result by p. That is, the decoding unit 3013 calculates data M by the following equation (3).

[0067] M = β / α mod p (3)

[0068] Then, the decryption processing unit 3013 outputs the calculated data M (S1006), after which the ciphertext decryption process ends.

[0069] In addition, in order to enable the second organization, which is the receiving side, to determine whether the data M has been decoded correctly when it is decoded, the divided data generation unit 2011 of the data division server 2000 of the first organization may, when dividing the data M, add a predetermined number of predetermined bit data to a predetermined bit of the data M in the bit representation of the data M, and divide the data M to which the predetermined bit data has been added. For example, the divided data generation unit 2011 may concatenate a predetermined number (e.g., 128) of bit data 0 to the most significant bit of the data M, as shown in the following formula (4), and then divide the data.

[0070] M←00···0||M···(4)

[0071] After decrypting the data M, the decryption processing unit 3013 of the key management server 3000 of the second organization determines that the data M has been successfully decrypted if a predetermined number of predetermined bit data (in the above example, bit data 0) is added to a predetermined bit (in the above example, the most significant bit) before the process of S1006, and determines that the data M has not been successfully decrypted (decryption has failed) if a predetermined number of predetermined bit data is not added. If the data M has been successfully decrypted, the decryption processing unit 3013 outputs the data M, and if the data M has not been successfully decrypted, it does not output the data M but outputs an error or the like. In this way, by having the first organization add a predetermined number of predetermined bit data to a predetermined bit of the data M in advance, it is possible to determine whether the data M has been successfully decrypted in the second organization, and therefore it is possible to prevent erroneous data from being shared. That is, the data M can be shared more reliably and safely.

[0072] The predetermined bit of the data M to which the predetermined bit data is added is not limited to the most significant bit, but may be, for example, the least significant bit, or the like, as long as its position can be specified in the decoding unit 3013. The predetermined bit data is not limited to bit data 0, but may be any bit data that allows the decoding unit 3013 to determine whether decoding has been successful.

[0073] Note that, even when determining the success or failure (success or failure) of the decryption using another method, a predetermined determination procedure is executed before outputting the data M in the process of S1006.

[0074] As described above, in the information processing system 1 of this embodiment, the data division server 2000 and multiple divided data sending terminals 2100 managed by the first organization, and the key management server 3000 and divided data receiving terminal 3100 managed by the second organization are communicatively connected via the network 100. The key management server 3000 includes a recording unit 3020 that stores a private key s of the homomorphic public key cryptography, and a private key division unit 3012 that reads the private key s from the recording unit 3020, generates multiple divided private keys by dividing the private key s, and transmits each divided private key to each of the multiple divided data receiving terminals 31000. The data division server 2000 includes a recording unit 2020 that stores data M to be transmitted from the first organization to the second organization and a public key h of homomorphic public key cryptography corresponding to the private key, and a divided data generation unit 2011 that generates a plurality of divided data obtained by dividing the data M and a plurality of divided public keys obtained by dividing the public key h, and transmits each of the divided data and each of the divided public keys to each of the divided data transmitting terminals 2100. The divided data transmitting terminal 2100 receives the divided data and the divided public key from the data division server 2000, generates a ciphertext by encrypting the divided data using the divided public key, and transmits the generated ciphertext to the divided data receiving terminal 3100 corresponding to the divided data transmitting terminal 2100. The divided data receiving terminal 3100 receives the ciphertext from the divided data transmitting terminal 2100, generates a partial decrypted ciphertext by decrypting a part of the ciphertext using the divided private key, and transmits the generated partial decrypted ciphertext to the key management server 3000. The key management server 3000 includes a decryption processing unit 3013 that aggregates and decrypts the partially decrypted ciphertexts received from the multiple divided data sending terminals 2100, and outputs the data M.

[0075] That is, in the information processing system 1 of this embodiment, when dividing data M and transmitting it from a plurality of people (a plurality of divided data transmitting terminals 2100) in a first organization to a plurality of people (a plurality of divided data receiving terminals 3100) in a second organization, the divided data is encrypted with a divided public key obtained by dividing a public key, and the ciphertext is partially decrypted by using a divided private key corresponding to the divided data, and then the partially decrypted plurality of ciphertexts are aggregated and decrypted to obtain data M. As a result, data M cannot be restored unless multiple people in charge (those who have the divided private key) in the second organization, which is the receiving side, cooperate with each other. That is, secret communication can be performed through multiple people in each organization, and the reliability of data sharing between organizations is improved. In addition, even if the divided data (ciphertext) is stored in a centralized manner on the receiving side or in a server (for example, a mail server or a file server, etc.) on the network 100, since each distributed data is encrypted with a different divided public key, data M cannot be restored unless a regular person in charge (person who has the divided private key) on the receiving side decrypts a part of it with the divided private key. Therefore, it is possible to prevent the administrator of the server from reconstructing and viewing the data M. In other words, it is possible to prevent information leakage during communication (including mail servers, etc.). Therefore, according to the information processing system 1 of this embodiment, data can be shared between organizations via a network without information leakage.

[0076] In the information processing system 1 of this embodiment, the key management server 3000 stores a prime number p, a prime factor q of p-1, and g as a common encryption parameter P, and stores a secret key s generated by randomly generating an integer between 1 and q. The data division server 2000 stores data M, a common encryption parameter P, and the public key h=g. smod p. Key management server 3000 generates m split private keys sj (j=1, 2, . . . , m) such that s=s1+s2+···+sm mod, and transmits split private keys sj to divided data receiving terminal 3100-j. The data division server 2000 generates n pieces of divided data Mi (i = 1, 2,..., n) so that M = M1 x M2 x... x Mn mod p, generates n pieces of divided public keys hi (i = 1, 2,..., n) so that h = h1 x h2 x... x hn mod p, and transmits the divided data Mi and divided public key hi to the divided data transmitting terminal 2100-i, which encrypts the divided data Mi based on the divided public key hi to generate ciphertext Ci and transmits the generated ciphertext Ci to the divided data receiving terminal 3100-j corresponding to the divided data transmitting terminal 2100-i. The divided data receiving terminal 3100-j receives the ciphertext Ci from the divided data transmitting terminal 2100-i, decrypts a part of the ciphertext Ci based on the divided private key sj to generate a partially decrypted ciphertext, and transmits the generated partially decrypted ciphertext to the key management server 3000. The key management server 3000 decrypts the data M by calculating M1×M2×. . . ×Mn based on the partially decrypted ciphertexts received from each of the multiple divided data receiving terminals 3100, and outputs the data M.

[0077] That is, the information processing system 1 of this embodiment divides the secret key s of the homomorphic public key cryptography additively into m pieces, and divides the data M and the public key h of the homomorphic public key cryptography multiplicatively into n pieces, thereby making it possible to decrypt a part of the ciphertext with the split private keys. This makes it possible to aggregate the distributed data encrypted with the split public keys and accurately decrypt the data M. That is, it is possible to prevent erroneous data from being shared between the first organization and the second organization, thereby improving the reliability of data sharing.

[0078] In the information processing system 1 of this embodiment, the key management server 3000 stores, as a common encryption parameter P, a prime number p, a prime factor q of p-1, and a generator g of a subgroup of the order q of the multiplicative group of the prime field Zp, and stores a private key s that is a randomly generated integer between 1 and q. The data division server 2000 stores data M, a common encryption parameter P, and a public key h=g s mod p. The key management server 3000 stores s=s1+s2+···+sm mod q The data division server 2000 generates m pieces of divided private keys sj (j=1, 2,...,m) so that M=M1×M2×...×Mn mod p, and generates n pieces of divided public keys hi (i=1, 2,...,n) so that h=h1×h2×...×hn mod p, and transmits the divided data Mi and divided public keys hi to the divided data transmitting terminal 2100-i together with a common encryption parameter and a random number r, an integer between 1 and q. The divided data transmitting terminal 2100-i receives the ciphertext Ci=(g r ,hi r ×Mi) and transmits the generated ciphertext Ci to the divided data receiving terminal 3100-j corresponding to the divided data sending terminal 2100-i. r ) sj mod p and transmit it to the key management server 3000 together with the second component of the ciphertext. The key management server 3000 r ) s1 ×(g r ) s2 × ×(g r ) sm Calculate mod p and β = (h1 r ×M1)×(h2 r ×M2)×···×(hn r ×Mn) mod p, and then calculates M=β / α mod p to decode data M, and outputs data M.

[0079] That is, the information processing system 1 of this embodiment additively divides the secret key s of the homomorphic public key cryptography into m pieces, multiplicatively divides the data M and the public key h of the homomorphic public key cryptography into n pieces, and decrypts the data M by multiplying a partially decrypted ciphertext obtained by decrypting a part of the ciphertext obtained by encrypting the divided data with the divided public keys using the divided private keys. This makes it possible to aggregate the distributed data encrypted with the divided public keys and more reliably decrypt the accurate data M. That is, it is possible to prevent erroneous data from being shared between the first organization and the second organization, thereby improving the reliability of data sharing.

[0080] Furthermore, in the information processing system 1 of this embodiment, the data division server 2000 adds a predetermined number of predetermined bit data to the most significant bit of the data M, and then divides the data M to which the predetermined bit data has been added to generate a plurality of divided data, and transmits each divided data and each divided public key to each of the multiple divided data transmitting terminals 2100. The key management server 3000 determines whether the data M has been successfully decrypted based on whether the predetermined bits of the decrypted data M are a predetermined number of predetermined bit data.

[0081] With this configuration, it is possible to check whether the data M has been correctly decrypted in the second organization, thereby further improving the reliability of data sharing.

[0082] Furthermore, in the information processing system 1 of this embodiment, the data division server 2000 concatenates a predetermined number of bit data 0s to the most significant bit of data M, and then generates a plurality of divided data by dividing the data M to which the bit data 0s are concatenated, and transmits each divided data and each divided public key to each of the multiple divided data transmitting terminals 2100. The key management server 3000 judges whether the data M has been successfully decrypted based on whether the most significant bit of the decrypted data M is a predetermined number of bit data 0s.

[0083] With this configuration, it is possible to check whether the data M has been correctly decrypted in the second organization through simpler processing without complex calculations.

[0084] [Second embodiment] Next, an information processing system and an information processing method according to a second embodiment of the present invention will be described.

[0085] In the first embodiment, the first organization and the second organization share common data M. However, in this embodiment, a plurality of numerical data held by the first organization is encrypted and transmitted to the second organization, and is then aggregated and decrypted in the second organization to obtain the multiplication or addition results of the plurality of numerical data, which is different.

[0086] For example, when data is entrusted to a first data trustee, the data is encrypted to keep its contents secret. When the encrypted data is transferred to another data trustee, the encryption key is changed to another key to ensure high security.

[0087] The configuration of the information processing system 1 (numeric concealment aggregation system) in this embodiment is the same as that in the first embodiment, and therefore the description thereof will be omitted. In addition, the encryption key generation process, the secret key division process, the divided ciphertext transmission process, and the ciphertext decryption process are the same as those in the first embodiment, and therefore the detailed description thereof will be omitted.

[0088] In this embodiment, the first organization holds n pieces of numerical data M1, M2, ... Mn. In the data division process, the data division server 2000 of the first organization transmits the held numerical data Mi together with a common encryption parameter P, a random number r, and a divided public key hi to each divided data transmitting terminal 2100-i, instead of dividing the data M. The method of generating the divided public keys h1, h2, ..., hn, and the random number r is the same as in the first embodiment.

[0089] The decryption processing unit 3013 of the key management server 3000 of the second organization obtains and outputs the multiplication result M1×M2×···×Mn of n pieces of numerical data M1, M2, . . . Mn by ciphertext decryption processing.

[0090] On the other hand, when the addition result of the numerical data M1, M2, . . . Mn is transmitted from the first organization to the second organization, the key management server 3000 of the second organization generates the common encryption parameter P1 by dividing the remainder ring Z p The key management server 3000 then transmits the common encryption parameter P1(p,q,g,u) to the data division server 2000.

[0091] In addition, the data division server 2000 transmits the held numerical value Mi together with the common encryption parameter P1, the random number r, and the divided public key hi to each of the divided data transmission terminals 2100-i. In S902 of the above-mentioned divided ciphertext transmission process, each divided data transmission terminal 2100 transmits the ciphertext C1=(g r ,h1 r ×u M1 ) and transmits them to the corresponding divided data receiving terminals 3100.

[0092] In the ciphertext decryption process, each divided data receiving terminal 3100 partially decrypts the ciphertext Ci in the same procedure as in the first embodiment and transmits it to the key management server 3000. In the ciphertext decryption process, the key management server 3000 executes the aggregate decryption process in S1005 in the same procedure as in the first embodiment, but the obtained value is u M1+M2+···+Mn Therefore, the key management server 3000 solves the discrete logarithm problem with u as the base to obtain M1+M2+···+Mn. Therefore, the numerical data M1, M2,···Mn are relatively small values ​​(for example, 2 64 We must restrict the number of iterations to the number of iterations (e.g., 1000, 150 ...500, 15

[0093] As described above, in the information processing system 1 of this embodiment, the data division server 2000 and multiple divided data sending terminals 2100 managed by the first organization, and the key management server 3000 and divided data receiving terminal 3100 managed by the second organization are communicatively connected via the network 100. The key management server 3000 includes a recording unit 3020 that stores a private key s of the homomorphic public key cryptography, and a private key division unit 3012 that reads the private key s from the recording unit 3020, generates multiple divided private keys by dividing the private key s, and transmits each divided private key to each of the multiple divided data receiving terminals 31000. The data division server 2000 includes a recording unit 2020 that stores multiple pieces of numerical data and a public key h of homomorphic public key cryptography corresponding to the private key s, and a divided data generation unit 2011 that divides the public key h to generate divided public keys in the same number as the multiple pieces of numerical data, and transmits each piece of numerical data and each divided public key to each of the multiple divided data transmitting terminals 2100. The divided data transmitting terminal 2100 receives the numerical data and the divided public key from the data division server 2000, generates a ciphertext by encrypting the numerical data using the divided public key, and transmits the generated ciphertext to the divided data receiving terminal 3100 corresponding to the divided data transmitting terminal 2100. The divided data receiving terminal 3100 receives the ciphertext from the divided data transmitting terminal 2100, generates a partial decrypted ciphertext by decrypting a part of the ciphertext using the divided private key, and transmits the generated partial decrypted ciphertext to the key management server 3000. The key management server 3000 includes a decryption processing unit 3013 that aggregates and decrypts the partially decrypted ciphertexts received from the multiple divided data sending terminals 2100, and outputs the multiplication result or addition result of multiple numerical data.

[0094] That is, since the information processing system 1 of this embodiment applies homomorphic public key cryptography, the data encrypted by each person in charge (divided data transmitting terminal 2100) on the transmitting side (first organization) may be certain numerical data. In this case, the decryption result obtained on the receiving side (second organization) is the multiplied value or the sum of the numerical data. Therefore, by modifying and applying homomorphic public key cryptography, it can also be used as a method for obtaining the multiplied value or the sum of multiple numerical data.

[0095] The present invention is not limited to the above-described embodiment, and can be implemented using any components without departing from the scope of the present invention. The above-described embodiments and modifications are merely examples, and the present invention is not limited to these contents as long as the features of the invention are not impaired. In addition, although various embodiments and modifications have been described above, the present invention is not limited to these contents. Other aspects conceivable within the scope of the technical idea of ​​the present invention are also included in the scope of the present invention.

[0096] For example, part of the hardware included in each device of this embodiment may be provided in another device.

[0097] In addition, each program of the data division server 2000, the divided data sending terminal 2100, the key management server 3000, or the divided data receiving terminal 3100 may be provided in another device, a program may consist of multiple programs, or multiple programs may be integrated into one program.

[0098] In the above embodiment, the case where the divided data transmitting terminal 2100 and the divided data receiving terminal 3100 are assigned to each person in charge has been described, but it is also possible to configure multiple divided data transmitting terminals 2100 or multiple divided data receiving terminals 3100 in one information processing device and set exclusive access rights to each person in that information processing device (for example, by providing multiple ciphertext generating units 2111 and multiple partial decryption processing units 3111), thereby isolating the operations of each person in a software manner. This makes it possible to realize functions similar to those in the case where each person in charge is assigned to each divided data transmitting terminal 2100 and divided data receiving terminal 3100.

[0099] In addition, in the above-mentioned embodiment, an example was described in which the divided data transmitting terminals 2100 and the divided data receiving terminals 3100 correspond one-to-one (one ciphertext C is transmitted from one divided data transmitting terminal 2100 to one divided data receiving terminal 3100), but this is not limited to the above, and ciphertext C may be transmitted from two or more divided data transmitting terminals 2100 to one divided data receiving terminal 3100.

[0100] 11, the divided data transmitting terminal 2100-1 and the divided data transmitting terminal 2100-2 transmit the ciphertext C1 and the ciphertext C2 to the divided data receiving terminal 3100-1, respectively, and the divided data transmitting terminal 2100-3 and the divided data transmitting terminal 2100-4 transmit the ciphertext C3 and the ciphertext C4 to the divided data receiving terminal 3100-2, respectively. The divided data receiving terminal 3100-1 generates the partially decrypted ciphertext C'1 and the partially decrypted ciphertext C'2 by partially decrypting the ciphertext C1 and the ciphertext C2 with the divided private key s1, respectively, and transmits them to the key management server 3000. In addition, the divided data receiving terminal 3100-2 generates the partially decrypted ciphertext C'3 and the partially decrypted ciphertext C'4 by partially decrypting the ciphertext C3 and the ciphertext C4 with the divided private key s2, respectively, and transmits them to the key management server 3000.

[0101] Furthermore, the algorithm for generating the (split) private key and the (split) public key described in this embodiment is just an example, and various calculation methods can be envisioned as long as they at least satisfy the requirements of homomorphic public key cryptography. [Explanation of symbols]

[0102] A: First system B: Second system 100: Network 201: First Institutional Network 301: Second internal network 2000: Data partitioning server 2001: Input section 2002: Output section 2003: Communications Department 2010: Control unit 2011: Split data generation section 2012: Random number generator 2020: Records Department 2030: Data recording section 2040: Parameter recording section 2100: Divided data transmission terminal 2101: Input section 2102: Output section 2103: Communications Department 2110: Control unit 2111:Ciphertext generation section 2120: Recording Department 2130: Data recording section 2140: Parameter recording section 3000: Key management server 3001: Input section 3002: Output section 3003: Communications Department 3010: Control unit 3011: Key pair generation unit 3012: Secret key division part 3013: Decryption processing unit 3020: Recording Department 3030: Data recording unit 3040: Parameter recording section 3100: Divided data receiving terminal 3101: Input section 3102: Output section 3103: Communications Department 3110: Control unit 3111: Partial decoding processing unit 3120: Recording department 3130: Data recording unit

Claims

1. An information processing system in which a first system managed by a first organization and a second system managed by a second organization are communicatively connected, The second system is A recording unit that stores a private key of the homomorphic public key cryptography; a private key division unit that reads the private key from the recording unit and generates a plurality of split private keys by dividing the private key; Equipped with The first system comprises: a recording unit that stores data to be transmitted from the first organization to the second organization and a public key of a homomorphic public key cryptography corresponding to the private key; a divided data generation unit that generates a plurality of divided data pieces obtained by dividing the data and a plurality of divided public keys obtained by dividing the public key; a ciphertext generation unit that generates ciphertexts by encrypting the divided data using the divided public keys, and transmits the generated ciphertexts to the second system; Equipped with The second system is a partial decryption processing unit that receives each of the ciphertexts from the first system and generates partially decrypted ciphertexts by decrypting a part of each of the ciphertexts using each of the plurality of split private keys; a decryption processing unit that aggregates and decrypts each of the partially decrypted ciphertexts and outputs the data; Equipped with Information processing system.

2. The recording unit of the second system stores a prime number p, a prime factor q of p-1, and a parameter g as common parameters for encryption, and stores the secret key s obtained by randomly generating an integer between 1 and q; The recording unit of the first system stores the data M, the common encryption parameters, and the public key h=g ｓ Store mod p, The private key division unit of the second system s=s1+s2+...+sm mod q m split secret keys sj (j=1, 2, ..., m) are generated so that The divided data generation unit of the first system M=M1×M2×...×Mn mod p n pieces of divided data Mi (i=1, 2, . . . , n) are generated so that h=h1×h2×...×hn mod p Generate n split public keys hi (i = 1, 2, ..., n) such that The ciphertext generation unit of the first system encrypts each of the divided data Mi based on the plurality of divided public keys hi to generate each ciphertext Ci, and transmits each of the generated ciphertext Ci to the second system; The partial decryption processing unit of the second system receives each of the ciphertexts Ci from the first system, and generates partially decrypted ciphertexts by decrypting a part of each of the ciphertexts Ci based on each of the multiple split private keys sj; The decryption processing unit of the second system decrypts data M by calculating M1×M2× . . . ×Mn based on each of the partially decrypted ciphertexts, and outputs the data M. The information processing system according to claim 1 .

3. The recording unit of the second system stores, as common cryptographic parameters, a prime number p, a prime factor q of p-1, and a generator g of a subgroup of order q of a multiplicative group of a prime field Zp, and stores the private key s obtained by randomly generating an integer between 1 and q; The recording unit of the first system stores the data M, the common encryption parameters, and the public key h=g ｓ Store mod p, The private key division unit of the second system s=s1+s2+...+sm mod q m split secret keys sj (j=1, 2, ..., m) are generated so that The divided data generation unit of the first system M=M1×M2×...×Mn mod p n pieces of divided data Mi (i=1, 2, . . . , n) are generated so that h=h1×h2×...×hn mod p Generate n split public keys hi (i = 1, 2, ..., n) such that The ciphertext generation unit of the first system generates each ciphertext Ci=(g ｒ ,hi ｒ ×Mi), and transmit each of the generated ciphertexts Ci to the second system; The partial decryption processing unit of the second system ｒ ) ｓｊ mod p, The decoding processing unit of the second system a=(') ｒ ) ｓ１ ×(' ｒ ) ｓ２ ×・・・×(' ｒ ) ｓｍ mode p Calculate β=(h1) ｒ ×M1)×(M2 ｒ ×M2)×・・・×((n ｒ ×Mn) mode p Calculate M = β / α mod p and outputting the data M. The information processing system according to claim 1 .

4. the divided data generation unit of the first system adds a predetermined number of predetermined bit data to a predetermined bit of the data, and then generates a plurality of divided data by dividing the data to which the predetermined bit data has been added; the decoding processing unit of the second system determines whether the data has been successfully decoded based on whether the predetermined bits of the decoded data are the predetermined number of predetermined bit data. The information processing system according to claim 1 .

5. the divided data generation unit of the first system generates a plurality of divided data by concatenating a predetermined number of bit data 0s to a most significant bit of the data and then dividing the data to which the bit data 0s are concatenated; the decoding processor of the second system determines whether the data has been successfully decoded based on whether the most significant bit of the decoded data is the predetermined number of bit data 0; 5. The information processing system according to claim 4.

6. The first system includes a first server and a plurality of transmitting terminals; the second system includes a second server and one or more receiving terminals; The second server, A recording unit that stores a private key of the homomorphic public key cryptography; a private key division unit that reads the private key from the storage unit, generates a plurality of split private keys by dividing the private key, and transmits each split private key to each of the plurality of receiving terminals; Equipped with The first server a recording unit that stores data to be transmitted from the first organization to the second organization and a public key of a homomorphic public key cryptography corresponding to the private key; a divided data generation unit that generates a plurality of divided data by dividing the data and a plurality of divided public keys by dividing the public key, and transmits each of the divided data and each of the divided public keys to each of the plurality of transmitting terminals; Equipped with the transmitting terminal receives the divided data and the divided public key from the first server, generates a ciphertext by encrypting the divided data using the divided public key, and transmits the generated ciphertext to the receiving terminal corresponding to the transmitting terminal; the receiving terminal receives the ciphertext from the transmitting terminal, generates a partially decrypted ciphertext by decrypting a part of the ciphertext using the split private key, and transmits the generated partially decrypted ciphertext to the second server; The second server, a decryption processing unit that aggregates and decrypts the partially decrypted ciphertexts received from each of the plurality of receiving terminals, and outputs the data. The information processing system according to claim 1 .

7. An information processing system in which a first system managed by a first organization and a second system managed by a second organization are communicatively connected, The second system is A recording unit that stores a private key of the homomorphic public key cryptography; a private key division unit that reads the private key from the recording unit and generates a plurality of split private keys by dividing the private key; Equipped with The first system comprises: a recording unit that stores a plurality of pieces of numerical data and a public key of a homomorphic public key cryptography corresponding to the private key; a divided data generation unit that divides the public key to generate divided public keys in the same number as the plurality of numeric data; a ciphertext generation unit that generates ciphertexts by encrypting the numerical data using the plurality of split public keys, and transmits the generated ciphertexts to the second system; Equipped with The second system is a partial decryption processing unit that receives each of the ciphertexts from the first system and generates partially decrypted ciphertexts by decrypting a part of each of the ciphertexts using each of the plurality of split private keys; a decryption processing unit that aggregates and decrypts each of the partially decrypted ciphertexts and outputs a multiplication result or an addition result of the plurality of numerical data. Information processing system.

8. An information processing method in an information processing system in which a first system managed by a first organization and a second system managed by a second organization are communicatively connected, comprising: the second system includes a storage unit that stores a private key of homomorphic public key cryptography, reads the private key from the storage unit, and generates a plurality of split private keys by dividing the private key; the first system, which includes a recording unit that stores data to be transmitted from the first organization to the second organization and a public key of homomorphic public key cryptography corresponding to the private key, generates a plurality of split data by dividing the data and a plurality of split public keys by dividing the public key, generates each ciphertext by encrypting the split data using the plurality of split public keys, and transmits each of the generated ciphertexts to the second system; the second system receives each of the ciphertexts from the first system, generates partial decrypted ciphertexts by decrypting a part of each of the ciphertexts using each of the plurality of split private keys, aggregates and decrypts each of the partial decrypted ciphertexts, and outputs the data. Information processing methods.

Images