Secret logical calculation device

Abstract

Provided is a secret logical calculation device in a secret logical calculation system comprising three or more secret logical calculation devices for calculating ternary logic in a secret manner, wherein: a truth value of the ternary logic is expressed using two bits; the first bit x0 from between the two bits (x0, x1 used to represent the truth value of the ternary logic is a flag indicating whether the truth value is Undefined, and the second bit x1 represents a true / false value which is the truth value when the first bit x0 indicates that the truth value is not Undefined (however, when the first bit x0 indicates that the value is Undefined, the second bit (x0, x1) represents Undefined).

Description

Secret Logic Computing Device

[0001] The present invention relates to a secure computation technique, and more particularly to a technique for securely computing ternary logic.

[0002] Three-valued logic is a type of logic that includes two truth values, True and False, as well as the truth value Undefined. Figures 1 and 2 show the truth table for logical AND and logical OR, respectively, in three-valued logic. Plain text three-valued logic is used in practice, for example, in the database language SQL.

[0003] Secure computation is a computational method that obtains the result of a specified operation without restoring the encrypted value. 3-party MPC, which is multi-party computation by three parties, encrypts multiple pieces of information that can be used to restore a value by distributing them among three secure computing devices. The results of addition, subtraction, constant sum, multiplication, constant multiplication, logical operations (logical AND, logical OR, negation, exclusive OR), and data format conversion (integer, binary) can be stored in a distributed, encrypted state among the three secure computing devices without restoring the value. In general, the number of shares is not limited to 3 and can be W (W is a predetermined constant greater than or equal to 3).

[0004] For ordinary binary logic, an efficient method for realizing multi-party computation is known (see Non-Patent Document 1).

[0005] Koji Chida, Koki Hamada, Dai Ikarashi, Ryo Kikuchi, and Benny Pinkas, "High-throughput secure AES computation," Proceedings of the 6th Workshop on Encrypted Computing & Applied Homomorphic Cryptography, WAHC '18, pp.13-24, ACM, 2018.

[0006] However, there is no known method for realizing multi-party computation for three-valued logic.

[0007] Therefore, an object of the present invention is to provide a technique for securely computing three-valued logic.

[0008] One aspect of the present invention is a secret logic computing device in a secret logic computing system consisting of three or more secret logic computing devices that performs secret computation of ternary logic, where the truth value of the ternary logic is represented using two bits.

[0009] According to the present invention, it is possible to perform secure computation of three-valued logic.

[0010] 1 is a diagram showing a truth table for logical product (AND) in ternary logic; 2 is a diagram showing a truth table for logical sum (OR) in ternary logic; 3 is a block diagram showing the configuration of a secure logic computing system 10; 4 is a diagram showing the configuration of a secure logic computing device 100; i Fig. 1 is a block diagram showing the configuration of a secure logical computing system 10. Fig. 2 is a flowchart showing the operation of the secure logical computing system 10. Fig. 3 is a diagram showing an example of the functional configuration of a computer that realizes each device in an embodiment of the present invention.

[0011] Hereinafter, an embodiment of the present invention will be described in detail. Note that components having the same functions are given the same numbers and redundant explanations will be omitted.

[0012] <Technical Background> <<1: Method for Representing Truth Values ​​in Ternary Logic>> This section describes a method for representing truth values ​​in ternary logic in an embodiment of the present invention. In binary logic, which handles two truth values, True and False, one bit is sufficient to represent a truth value. On the other hand, in ternary logic, which handles three truth values, True, False, and Undefined, two bits are required to represent a truth value. There are several possible methods for representing truth values ​​in ternary logic using two bits, but in an embodiment of the present invention, the three values ​​of True, False, and Undefined are represented according to the following rules using a pair (x0, x1) of two bits x0 and x1, which represent either a truth value of True or False. Hereinafter, (x0, x1) will be referred to as the two bits used to represent a truth value in ternary logic, and x0 and x1 will be referred to as the first and second bits of the two bits used to represent a truth value in ternary logic.

[0013] (Rule) The first bit x0 is a flag indicating whether it is Undefined, and the second bit x1 represents a boolean value that is the truth value when the first bit x0 is not Undefined. However, if the first bit x0 indicates Undefined, the second bit x1 is ignored, and (x0, x1) represents Undefined.

[0014] Therefore, if (x0, x1)=(True, True) or (x0, x1)=(True, False), then (x0, x1) represents Undefined; if (x0, x1)=(False, True), then (x0, x1) represents True; and if (x0, x1)=(False, False), then (x0, x1) represents False.

[0015] As in the case of binary logic, True and False are represented by 1 and 0, respectively.

[0016] <<2: Secure Computation>> Secret sharing is used in the secure computation in an embodiment of the present invention. Secret sharing is an encryption technique in which data is divided into multiple pieces of data and distributed to multiple parties. One example of secret sharing is (k, n) threshold secret sharing. (k, n) threshold secret sharing is a secret sharing method that has the property that, of n shares obtained by dividing a value so that it becomes a random value, the original value can be restored from k or more shares, but the original value cannot be restored from less than k shares. Specific examples include Shamir secret sharing and cloning secret sharing. Hereinafter, a share of a value x obtained through secret sharing will be represented as [x].

[0017] [Logical Operations in Binary Logic] Let a and b be bits that represent either a true or false value, True or False, and we will explain the operations of logical product (And), logical sum (Or), negation (Not), and exclusive logical sum (Xor).

[0018] And([a], [b]) takes [a] and [b] as input and outputs [a And b]. Let c = a And b, and express it as [c] ← And([a], [b]). Note that communication is required to calculate And.

[0019] Or([a], [b]) takes [a] and [b] as input and outputs [a Or b]. Let c = a Or b, and express it as [c] ← Or([a], [b]). Note that communication is required to calculate Or.

[0020] Not([a]) takes [a] as input and outputs [Not(a)]. Let c = Not(a), and express it as [c] ← Not([a]). Note that no communication is required to calculate Not.

[0021] Xor([a], [b]) takes [a] and [b] as inputs and outputs [a Xor b]. Let c=a Xor b, and express it as [c]←Xor([a], [b]). Note that no communication is required to calculate Xor.

[0022] <<3: Ternary Logic Computation Algorithm>> The algorithms in the embodiments of the present invention are all algorithms for calculating logical products in ternary logic (hereinafter referred to as ternary logic AND) and logical sums in ternary logic (hereinafter referred to as ternary logic OR), and are constructed using the binary logical operations And, Or, Not, and Xor in secure computation.

[0023] Before explaining the algorithm in the embodiment of the present invention, points to note when configuring three-valued logic based on two-valued logic will be explained.

[0024] In plaintext, the calculation of logical product, logical sum, negation, and exclusive OR does not require communication, and the number of CPU cycles is one. Therefore, there is no bottleneck when constructing ternary logic based on binary logic. On the other hand, in secure computation, the calculation of negation and exclusive OR does not require communication, but the calculation of logical product and logical sum does. For example, according to Non-Patent Document 1, the calculation of logical product can be realized with one communication round and a communication amount of 1 bit per party. Furthermore, the calculation of logical sum can be realized by performing exclusive OR twice and logical product once. As such, the calculation of logical product and logical sum requires communication, and therefore is more costly than the calculation of negation and exclusive OR. In other words, ternary logic in secure computation differs significantly from that in plaintext in terms of the characteristics of the computational complexity. Therefore, in order to design an efficient algorithm for ternary logic in secure computation, it is necessary to construct it based on binary logic while taking into account the number of communication rounds and the communication amount.

[0025] In what follows, the inputs of a ternary logic AND / ternary logic OR are represented as (a0, a1), (b0, b1), and the output as (c0, c1) (where a0, a1, b0, b1, c0, c1 are all bits that represent either True or False).

[0026] The ternary logic AND can be realized based on two equations: c0 = a1 ∧ b0 ∨ a0 ∧ b1 ∨ a0 ∧ b0, c1 = a1 ∧ b1. The algorithm TAndNaive based on the above equations is shown below.

[0027] <<Algorithm TAndNaive>> ------------------------------------------------------------------ Functionality: ([c0], [c1])←TAndNaive([a0], [a1], [b0], [b1]) Input: [a0], [a1], [b0], [b1] Output: ([c0], [c1]) 1: [c1]←And([a1], [b1]) 2: [t]←And([a1], [b0]) 3: [s]←And([a0], [b1]) 4: [u]←And([a0], [b0]) 5: [c0]←Or(Or([t], [s]), [u]) 6: Output([c0], [c1]) ------------------------------------------------------------------ As can be seen from the table above, algorithm TAndNaive does not use the operation Xor.

[0028] The ternary logic OR can be realized based on two equations: c0 = ￢a1 ∧ b0 ∨ a0 ∧ ￢b1 ∨ a0 ∧ b0, c1 = a1 ∨ b1. The algorithm TOrNaive based on the above equations is shown below.

[0029] <<Algorithm TOrNaive>> ------------------------------------------------------------------ Functionality: ([c0], [c1])←TOrNaive([a0], [a1], [b0], [b1]) Input: [a0], [a1], [b0], [b1] Output: ([c0], [c1]) 1: [c1]←Or([a1], [b1]) 2: [t]←And(Not([a1]), [b0]) 3: [s]←And([a0], Not([b1])) 4: [u]←And([a0], [b0]) 5: [c0]←Or(Or([t], [s]), [u]) 6: Output([c0], [c1]) ------------------------------------------------------------------ As can be seen from the table above, algorithm TOrNaive does not use the operation Xor.

[0030] To achieve efficient ternary logic AND / OR calculations, it is best to avoid using the And and Or operations as much as possible and instead use the Xor operation as much as possible. Below, we will explain the calculation algorithm for ternary logic AND / OR using the Xor operation.

[0031] The ternary logic AND can be realized based on two equations: c0 = a0 XOR (a0 ∧ ￢b0 ∧ ￢b1) XOR (a1 ∧ b0 ∧ ￢a0), c1 = a1 ∧ b1. The algorithm TAnd based on the above equations is shown below.

[0032] <<Algorithm TAnd>> ------------------------------------------------------------------ Functionality: ([c0], [c1])←TAnd([a0], [a1], [b0], [b1]) Input: [a0], [a1], [b0], [b1] Output: ([c0], [c1]) 1: [c1]←And([a1], [b1]) 2: [t]←And(Not([b0]), Not([b1])) 3: [s]←And([a0], [t]) 4: [u]←And([b0], Not([a0])) 5: [v]←And([a1], [u]) 6: [c0]←Xor(Xor([a0], [s]), [v]) 7: Output([c0], [c1]) ------------------------------------------------------------------ As can be seen from the table above, Algorithm TAnd uses the Xor operation. Also, in calculating c0, Algorithm TAndNaive uses the And operation three times and the Or operation two times, which require communication, whereas Algorithm TAnd uses the And operation only four times. Therefore, Algorithm TAnd is more efficient than Algorithm TAndNaive.

[0033] The ternary logic OR can be realized based on two equations: c0 = a0 XOR (a0 ∧ ￢b0 ∧ b1) XOR (￢a0 ∧ ￢a1 ∧ b0), c1 = a1 ∧ b1. The algorithm TOr based on the above equations is shown below.

[0034] <<Algorithm TOr>> ------------------------------------------------------------------ Functionality: ([c0], [c1])←TOr([a0], [a1], [b0], [b1]) Input: [a0], [a1], [b0], [b1] Output: ([c0], [c1]) 1: [c1]←Or([a1], [b1]) 2: [t]←And(Not([b0]), [b1]) 3: [s]←And([a0], [t]) 4: [u]←And([b0], Not([a0])) 5: [v]←And(Not([a1]), [u]) 6: [c0]←Xor(Xor([a0], [s]), [v]) 7: Output([c0], [c1]) ------------------------------------------------------------------ As can be seen from the table above, algorithm TOr uses the Xor operation. Also, in calculating c0, algorithm TOrNaive uses the And operation three times and the Or operation two times, which require communication, whereas algorithm TOr uses the And operation only four times. Therefore, algorithm TOr is more efficient than algorithm TOrNaive.

[0035] By adopting the above-mentioned method for expressing truth values ​​of ternary logic, it becomes possible to express ternary logic succinctly based on binary logic, thereby reducing the cost associated with secure computation of ternary logic. In particular, algorithms TAnd and TOr take into account the characteristics of secure computation of binary logic, i.e., by expressing ternary logic using the operation Xor, it is possible to reduce the bottleneck communication cost.

[0036] <First embodiment> A secure logical computation system 10 is composed of three or more secure logical computation devices 100, and performs secure computation of ternary logic. Here, the truth value of ternary logic is represented using two bits. Specifically, of the two bits (x0, x1) used to represent the truth value of ternary logic, the first bit x0 is a flag indicating whether or not it is undefined, and the second bit x1 represents a boolean value, which is the truth value when the first bit x0 indicates that it is not undefined (however, when the first bit x0 indicates that it is undefined, (x0, x1) represents undefined).

[0037] The secure logical computing system 10 will be described below with reference to Figs. 3 to 5. Fig. 3 is a block diagram showing the configuration of the secure logical computing system 10. The secure logical computing system 10 comprises W (W is a predetermined integer of 3 or more) secure logical computing devices 1001, ..., 100 W Secure logical computing devices 1001, ..., 100 W are connected to a network 800 and can communicate with each other. The network 800 may be, for example, a communication network such as the Internet or a broadcast communication path. i 5 is a block diagram showing the configuration of (1≦i≦W). FIG. 5 is a flowchart showing the operation of the secure logical computing system 10.

[0038] As shown in FIG. i is the first bit calculation unit 110 i and the second bit calculation unit 120 i and the output unit 130 i and the recording unit 190 i Recording unit 190 i The secure logical computing device 100 i Each component of the above is configured to be able to execute the operations required for the secure computation required to realize the function of the component. In this embodiment, the specific functional configuration for realizing each operation is sufficient if it is a configuration that can execute existing algorithms including the algorithms described in <Technical Background>, and since these are conventional configurations, detailed description will be omitted. iis the secure logical computing device 100 i This is a component that records information necessary for processing.

[0039] W secure logic computing devices 100 i By the collaborative computation by the above, the secure logic computing system 10 realizes secure computation of three-valued logic, which is a multi-party protocol. Therefore, the first bit computation means 110 (not shown) of the secure logic computing system 10 includes first bit computation units 110, ..., 110. W The second bit calculation means 120 (not shown) is composed of second bit calculation units 1201, ..., 120 W The output means 130 (not shown) is composed of output units 1301, ..., 130 W It consists of:

[0040] The operation of the secure logical computation system 10 will be described below with reference to Fig. 5. Let ([a0], [a1]) be the share of the first input (a0, a1) of the ternary logic AND / ternary logic OR, ([b0], [b1]) be the share of the second input (b0, b1) of the ternary logic AND / ternary logic OR, and ([c0], [c1]) be the share of the output (c0, c1) of the ternary logic AND / ternary logic OR.

[0041] In S110, the first bit calculation means 110 calculates the share [c0] from the input shares [a0], [a1], [b0], and [b1].

[0042] In S120, the second bit calculation means 120 calculates the share [c1] from the input shares [a1] and [b1].

[0043] In S130, the output means 130 outputs the share ([c0], [c1]) from the share [c0] calculated in S110 and the share [c1] calculated in S120.

[0044] A specific example of the processing in S110 and S120 will be described below.

[0045] (1) When calculating ternary logic AND using algorithm TAndNaive In S110, the first bit calculation means 110 calculates the share [c0] from the input shares [a0], [a1], [b0], [b1] using [t]←And([a1], [b0]), [s]←And([a0], [b1]), [u]←And([a0], [b0]), and [c0]←Or(Or([t], [s]), [u]).

[0046] In S120, the second bit calculation means 120 calculates the share [c1] from the input shares [a1] and [b1] by [c1]←And([a1], [b1]).

[0047] (2) When calculating ternary logical OR using algorithm TOrNaive In S110, the first bit calculation means 110 calculates the share [c0] from the input shares [a0], [a1], [b0], [b1] using [t]←And(Not([a1]), [b0]), [s]←And([a0], Not([b1])), [u]←And([a0], [b0]), and [c0]←Or(Or([t], [s]), [u]).

[0048] In S120, the second bit calculation means 120 calculates the share [c1] from the input shares [a1] and [b1] by [c1]←Or([a1], [b1]).

[0049] (3) When calculating a ternary logic AND using the algorithm TAnd In S110, the first bit calculation means 110 calculates the share [c0] from the input shares [a0], [a1], [b0], and [b1] using [t]←And(Not([b0]), Not([b1])), [s]←And([a0], [t]), [u]←And([b0], Not([a0])), [v]←And([a1], [u]), and [c0]←Xor(Xor([a0], [s]), [v]).

[0050] In S120, the second bit calculation means 120 calculates the share [c1] from the input shares [a1] and [b1] by [c1]←And([a1], [b1]).

[0051] (4) When calculating ternary logical OR using algorithm TOr In S110, the first bit calculation means 110 calculates the share [c0] from the input shares [a0], [a1], [b0], [b1] using [t]←And(Not([b0]), [b1]), [s]←And([a0], [t]), [u]←And([b0], Not([a0])), [v]←And(Not([a1]), [u]), and [c0]←Xor(Xor([a0], [s]), [v]).

[0052] In S120, the second bit calculation means 120 calculates the share [c1] from the input shares [a1] and [b1] by [c1]←Or([a1], [b1]).

[0053] According to an embodiment of the present invention, it is possible to perform secure computation of ternary logic.

[0054] <Additional Notes> The functions performed by the components described herein may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), CPUs (Central Processing Units), conventional circuits, and / or combinations thereof, programmed to perform the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may also be a programmed processor that executes a program stored in a memory.

[0055] In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions.

[0056] If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0057] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 6, and operating the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc.

[0058] The program describing the processing contents can be recorded on a computer-readable recording medium, which may be, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or any other suitable recording medium.

[0059] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0060] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored in its storage device and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. Furthermore, the server computer may execute the process at the terminal using a so-called SaaS (Software as a Service) service, which allows users to use part of the server computer along with the program. In this embodiment, the program includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that dictate computer processing).

[0061] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0062] The present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the spirit of the present invention. Furthermore, the processes described in the above embodiments may not only be executed in chronological order according to the order described, but may also be executed in parallel or individually depending on the processing capacity of the device that executes the processes or as needed.

Claims

A secret logic computing device in a secret logic computing system that is composed of three or more secret logic computing devices that perform secret computation of three-valued logic, The truth value of ternary logic is represented using two bits Secret logical computing device.

2. The secure logical computing device according to claim 1, Of the two bits (x0, x1) used to represent the truth value of ternary logic, the first bit x0 is a flag indicating whether it is undefined or not, and the second bit x1 represents a boolean value, which is the truth value when the first bit x0 is not undefined (however, when the first bit x0 indicates undefined, the two bits (x0, x1) represent undefined). A secret logical computing device characterized by:

3. The secure logical computing device according to claim 2, Let ([a0], [a1]) be the share of the first input (a0, a1) of the ternary logic AND, ([b0], [b1]) be the share of the second input (b0, b1) of the ternary logic AND, and ([c0], [c1]) be the share of the output (c0, c1) of the ternary logic AND, a first bit calculation unit that calculates a share [c0] from the shares [a0], [a1], [b0], and [b1]; Includes a second bit calculation unit that calculates the share [c1] from the shares [a1] and [b1] A secret logical computing device characterized by:

3. The secure logical computing device according to claim 2, Let ([a0], [a1]) be the share of the first input (a0, a1) of the ternary logic OR, ([b0], [b1]) be the share of the second input (b0, b1) of the ternary logic OR, and ([c0], [c1]) be the share of the output (c0, c1) of the ternary logic OR, a first bit calculation unit that calculates a share [c0] from the shares [a0], [a1], [b0], and [b1]; Includes a second bit calculation unit that calculates the share [c1] from the shares [a1] and [b1] A secret logical computing device characterized by:

Images