Secure aggregation computation device and method

Abstract

A secure aggregation computation device 10 comprises: a sorting unit 1 that, by sorting rows of a table which includes a share {→g} of a group key column →g, a share {→o} of an order key column →o, and a share {→v} of a data column →v on the basis of the order key column →o and the group key column →g, generates a sorted table using the share {→g}, the share {→o}, and the share {→v}; a group boundary flag column generation unit (2) that uses a share {→g'} of a sorted group key column →g' included in the sorted table to generate a share [→b] of a boundary flag column →b which indicates a boundary between groups in the sorted table; and an aggregation computation unit 3 that uses the share [→b] and a share {→v'} of a sorted data column →v' included in the sorted table to perform, for each group, a prescribed aggregation computation using a prescribed binary operator.

Description

Secure aggregation device and method

[0001] The disclosure techniques relate to secure computation techniques.

[0002] Window functions are used to divide records into groups and perform aggregations within those groups. While GROUPBY is a similar function, Window functions differ in that they can output the aggregation results for each group on a record-by-record basis. Furthermore, within each group, you can specify the range (for example, how many rows before and after a given row) for aggregation. This enables calculations such as ranking, moving averages, and cumulative sums.

[0003] Non-patent document 1 is an example of research that implements such window functions on secure computation.

[0004] Hiroki Sudo, Ryo Kikuchi, "A Proposal for a Secret SQL Window Function Protocol," SCIS2022, pp. 1-6, 2022.

[0005] Non-patent document 1 proposes a method for implementing window functions using secure computation. However, the method in non-patent document 1 performs aggregation within each frame for each row, and the communication volume is O(ml) when the number of rows in a frame is m and the total number of records is l. Therefore, it is not efficient when the number of frames is large and has the problem of being difficult to apply to large-scale data. In particular, when the range of frames targeted by the disclosed technology is not a constant but proportional to the number of records l, the communication volume becomes O(l 2 This sometimes resulted in the following:

[0006] The disclosed technology aims to provide a secure aggregation device and method with higher computational efficiency than conventional methods.

[0007] A confidential aggregation device according to one aspect of the disclosure technology has a table with a group key column. → g's share { → g} and the order key column → o's share { → o} and data column → v share { → v} includes and share {→ g} and share { → o} and share { → v} are used to generate a sorted table by sorting the rows of the table based on the order key column → o and the group key column → g. A sorting unit generates a sorted table, and a group boundary flag column generation unit generates a share → b] of the group boundary flag column that represents the group boundaries in the sorted table using the share { → g’} of the sorted group key column → g’ included in the sorted table. An aggregation calculation unit performs a predetermined aggregation calculation using a predetermined binary operator for each group using the share → b] and the share { → v’} of the sorted data column → v’ included in the sorted table. → It is provided with.

[0008] According to the disclosed technology, a secret aggregation calculation device and method with higher calculation efficiency than before can be realized.

[0009] FIG. 1 is a diagram showing an example of the functional configuration of a secret aggregation calculation device. FIG. 2 is a diagram showing an example of the processing procedure of a secret aggregation calculation method. FIG. 3 is a diagram showing an example of processing. FIG. 4 is a diagram for explaining an example of an algorithm. FIG. 5 is a diagram for explaining an example of an algorithm. FIG. 6 is a diagram for explaining an example of an algorithm. FIG. 7 is a diagram showing another example of the functional configuration of a secret aggregation calculation device. FIG. 8 is a diagram showing an example of the functional configuration of a computer.

[0010] Hereinafter, embodiments of the disclosed technology will be described with reference to the drawings. In the drawings, components having the same function are given the same number, and redundant explanations are omitted.

[0011] [Preparation] <Notation> A vector is → described as x. The i-th element of the vector is x i and is represented by.

[0012] The symbol "→" used in text should ideally be placed directly above the following character, but due to limitations in text notation, it is placed immediately before the character. In mathematical formulas, these symbols are placed in their original position, that is, directly above the character. For example, in text, → "X" is written in mathematical formulas as follows: <Secret Sharing> Secret sharing is an encryption method that divides data into multiple values ​​and distributes them to multiple parties. For example, data can be encrypted using (k,n) threshold secret sharing. (k,n) threshold secret sharing is a secret sharing method that divides data into n random values ​​(called shares), and allows the original data to be reconstructed by collecting k or more shares, while information about the original data cannot be obtained from less than k shares. For example, Shamir secret sharing (see, for example, reference 1) and replication secret sharing (see, for example, references 2 and 3) are used.

[0013] [Reference 1] Adi Shamir, "How to share a secret", Communications of the ACM, Vol. 22, No. 11, pp. 612-613, 1979. [Reference 2] Mitsuru Ito, Akira Saito and Takao Nishizeki, "Secret sharing scheme realizing general access structure", Electronics and Communications in Japan (Part III: Fundamental Electronic Science), Vol. 72, No. 9, pp. 56-64, 1989. [Reference 3] Ronald Cramer, Ivan Damgard, and Yuval Ishai, "Share conversion, pseudorandom secret-sharing and applications to secure computation", In Theory of Cryptography Conference, pp. 342-362. Springer, 2005. Z pThe share generated by the above secret sharing is denoted as {x}. The share generated by secret sharing on Z2 is denoted as [x] to distinguish it. This is because it is more efficient to use a dedicated secret sharing type to distribute values ​​on Z2. Similarly, the distribution of the substitution π is denoted as <π> to distinguish it. Also, → Share vectors obtained by secret sharing for each element of x { → This is represented as x. Values ​​that are not secret and should be known by all servers are called public values.

[0014] Furthermore, the calculation of secret sharing may be implemented using homomorphic cryptography performed by a single device.

[0015] <Local Operations> Due to the properties of secret sharing, the addition of shares, addition with public values, multiplication with public values, and sign inversion can be calculated locally using only the shares held by each party. Each operation is denoted as follows:

[0016] Addition: {x} + {y} = {x + y} Addition with public value: {x} + y = {x + y} Multiplication with public value: {x}・y = {x・y} Sign inversion: -{x} = {-x} <Multiplication> In Shamir secret sharing, multiplication of shares can be achieved using the method of Gennaro et al. (see, for example, reference 4), and in replication secret sharing, using the method of Chida et al. (see, for example, reference 5).

[0017] [Reference 4] Rosario Gennaro, Michael O. Rabin and Tal Rabin, "Simplified VSS and fact-track multiparty computations with applications to threshold cryptography", In PODC, pp. 101-111, 1998. [Reference 5] Koji Chida, Koki Hamada, Dai Ikarashi, Ryo Kikuchi and Benny Pinkas, "High-throughput secure AES computation", In Michael Brenner and Kurt Rohloff, editors, Proceedings of the 6th Workshop on Encrypted Computing & Applied Homomorphic Cryptography, WAHCCCS 2018, Toronto, ON, Canada, October 19, 2018, pp. 13-24. ACM, 2018. The multiplication of shares {x} and {y} is expressed as follows:

[0018] {x}・{y}={x・y} <Modulus transformation> Secret sharing on Z2[x] to Z p This is a protocol for converting the above secret sharing {x}. A specific method is known, as described in reference 6.

[0019] [Reference 6] Ryo Kikuchi, Dai Ikarashi, Takahiro Matsuda, Koki Hamada and Koji Chida, "Efficient bit-6 decomposition and modulus-conversion protocols with an honest majority", pp. 64-82, 2018. Modulus conversion (ModConv) is denoted as follows:

[0020] {x}←ModConv([x]) <Stable sort> Sorting is an operation that rearranges a share column in ascending or descending order. Known sorting methods include the method by Asharov et al., described in Reference 7.

[0021] [Reference 7] Gilad Asharov, Koki Hamada, Dai Ikarashi, Ryo Kikuchi, Ariel Nof, Benny Pinkas, Katsumi Takahashi and Junichi Tomida, "Efficient secure three-party sorting with applications to data analysis and heavy hitters", In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, New York, NY, USA, November 2022. ACM. Note that sorting can be divided into two phases: creating a substitution table and substitution. If a substitution table is created, only the substitution phase needs to be performed for other columns that are sorted according to the key. A vector of length m { → Generate a transposition table with x as the key, and use <π> for { → The operations for rearranging y are denoted as follows:

[0022] Permutation table generation:<π>←genPerm({ → x}) Rearrange:{ → y'}←sort(<π>,{ → y}) However, { → y is { → It is a vector of the same length m as x.

[0023] <Equality Comparison> Equality can be determined by bit decomposition and calculation using a comparison circuit that takes the share of the bit sequence as input. The equality of {x} and {y} is denoted as [b]←Equality({x},{y}).

[0024] <aggregation>Aggregation operations (see, for example, reference 8) are performed on the elements of a vector { → This is an operation that aggregates x.

[0025] [Reference 8] Saikrishna Badrinarayanan, Sourav Das, Gayathri Garimella, Srinivasan Raghuraman and Peter Rindal, "Secret-shared joins with multiplicity from aggregation trees", Cryptology ePrint Archive, 2022. Aggregation operations use control bits to specify the aggregation range. → Taking b] and the binary operator ★ as arguments, { → This operation returns the aggregated result obtained by applying a binary operator to the elements within a given range for each i row of {x}.

[0026] The control bits are, for example, a bit vector with values ​​of 0 or 1, where 0 indicates the beginning of a group and 1 indicates being within a group. In other words, if a row is 0, that row is the beginning of a group, and if it is 1, the group consists of the sequence of 1s from the previous 0 to the row before the next 0.

[0027] A binary operator is an operator that takes two operands and produces a single result. An example of a binary operator is addition (+). In this case, the Sum function can be implemented. Another example of a binary operator is an operator that returns the larger of two operands. In this case, the Max function can be implemented. Other examples of binary operators are subtraction (-), multiplication (*), division ( / ), and exponentiation (^). Binary operators can also be operators other than those listed above. Such binary operators can be implemented, for example, using comparison operators and the If Gate function.

[0028] There are three types of aggregation operations: Prefix Aggregation, which aggregates from the first row to the current row; Suffix Aggregation, which aggregates from the current row to the last row; and Full Aggregation, which aggregates from the first row to the row before the last row.

[0029] In prefix aggregation, { → For each row of {x}, the elements of that row and the rows before it in the group to which that row belongs are counted. More specifically, j ≤ i is the first row of the group to which i belongs (starting from i, the first row b j Assuming that j) is such that = 0, in Prefix Aggregation, the following calculation using elements from j to row i is performed: { → This is performed for each i-th row of {x}.

[0030] { → y i }=★ k=j i { → x k }={ → x j }★{ → x j+1 }★…★{ → x i } [ → According to b], { → The execution of Prefix Aggregation using the binary operator ★ for x} is expressed as follows:

[0031] { → y}←prefixAgg({ → x},[ → b],★) …(1) In Suffix Aggregation, { → For each row of {x}, the elements of that row and the rows after it within the group to which that row belongs are aggregated. More specifically, assuming that h≧i is the end of the group to which i belongs, in Suffix Aggregation, the following calculation using the elements from row i to row h is performed: → This is performed for each i-th row of {x}.

[0032] { → y i}=★ k=i h { → x k}={ → x i}★{ → x i+1}★…★{ → x h} → b] according to, the execution of Suffix Aggregation using the binary operator ★ for { → x} is expressed as follows.

[0033] { → y}←suffixAgg({ → x}, → b],★) …(2) In Full Aggregation, for each row of { → x}, the elements of all rows within the group to which that row belongs are aggregated. More specifically, assuming j≦i is the start of the group to which i belongs (the j where b j =0 is reached when tracing back from i), and h≧i is the end of the group to which i belongs, in Full Aggregation, the following calculation using the elements from row j to row h is performed for each i-th row of { → x}.

[0034] { → y i}=★ k=h j { → x k}={ → x j}★{ → x j+1}★…★{ → x h} → b] according to, the execution of Full Aggregation using the binary operator ★ for { → x} is expressed as follows.

[0035] { → y}←fullAgg({ → x}, → b],★) …(3) Thus, after sorting, → By performing the Aggregation operation using [b], the communication volume can be made O(l), resulting in higher computational efficiency than before.

[0036] Note that these Aggregation operations may be performed by the Aggregation Tree method described in Reference 8. As a result, the communication volume can be made O(l log l) and the number of rounds can be made O(log l), further increasing the computational efficiency.

[0037] [Secret Aggregation Operation Device and Method] As shown in FIG. 1, the secret aggregation operation device 10 includes, for example, a sorting unit 1, a group boundary flag sequence generation unit 2, and an aggregation operation unit 3.

[0038] The secret aggregation operation method is realized, for example, when each component of the secret aggregation operation device 10 performs the processes from step S1 to step S3 shown in FIG. 2.

[0039] The table to be subjected to the secret aggregation operation includes the group key sequence → shares of g { → g}, the order key sequence → shares of o { → o}, and the data sequence → shares of v { → v}. This table to be subjected to the secret aggregation operation is input to the sorting unit 1. For example, the table to be subjected to the secret aggregation operation is stored in the table storage unit 0. In this case, the table read from the table storage unit 0 is input to the sorting unit 1. In the example of FIG. 1, the table storage unit 0 is arranged outside the secret aggregation operation device 10, but the table storage unit 0 may be provided inside the secret aggregation operation device 10.

[0040] An example of the table to be subjected to the secret aggregation operation is the table in (a) of FIG. 3. In FIG. 3, for the sake of simplicity of description, the symbol for shares and the symbol "→" representing vectors are omitted.

[0041] Each component of the secret aggregation operation device 10 performs, for example, the processing of Algorithm 1 described in FIG. 4. Hereinafter, each component of the secret aggregation operation device 10 will be described.

[0042] <Sort Unit 1> Sort Unit 1 contains share { → g} and share { → o} and share{ → The input is v}.

[0043] Sorting unit 1 is share { → g} and share { → o} and share{ → Using v}, the order key column → o and group key column → A sorted table is generated by sorting the rows of the table based on g (Step S1). The sorted group key column is included in the sorted table. → g's share { → g'} is output to the group boundary flag sequence generation unit 2.

[0044] The processing of the aggregation calculation unit 3 corresponds to "1:" in algorithm 1 in Figure 4.

[0045] In the example shown in Figure 3, the sorted table will be the table shown in Figure 3(b).

[0046] The sorted table is { → g'},{ → o'},{ → Includes v'} { → g'},{ → o'},{ → v'} is grouped by a group key, and then sorted within each group by an order key column.

[0047] The sorting unit 1 performs, for example, the processing of algorithm 2 shown in Figure 5. The processing of algorithm 2 shown in Figure 5 will be explained below.

[0048] Sorting unit 1 is share { → Using o}, the order key sequence → A permutation σ sorts each column based on o. o Share <σ o Calculate > (Algorithm 2, "1:").

[0049] Sorting unit 1 is share { → g} and share { → o} and share{ → v} and share <σ o > and group key column → g is substituted σ o Column to which the condition was applied → g'' share { → g'' and the order key column → σ is substituted for o o Column to which the condition was applied → o'''s share { → o''} and the data sequence → Substitution of v σ o Column to which the condition was applied → v'' share { → Calculate v'' (Algorithm 2, "2:").

[0050] Sorting unit 1 is share { → Using g'', the column → A permutation σ sorts each column based on g''. g Share <σ g Calculate > (Algorithm 2, "3:").

[0051] Sorting unit 1 is share { → g''} and share { → o''} and share{ → v''} and share <σ g Using >, column → Substitution of g'' σ g Column to which the condition was applied → g's share { → g'} and the column → Replace o'' with σ g Column to which the condition was applied → o's share { → o'} and the column → Substitution of v'' σ g Column to which the condition was applied → v's share { → Calculate v' (Algorithm 2, "4:").

[0052] <Group Boundary Flag Column Generation Unit 2> The Group Boundary Flag Column Generation Unit 2 generates the sorted group key columns included in the sorted table. → g's share { → g'} is entered.

[0053] The group boundary flag column generation unit 2 generates the sorted group key column included in the sorted table. → g's share { → Using g'}, a boundary flag column represents the group boundaries in the sorted table. → b's share [ → b] is generated (step S2). Share [ → b) is output to the aggregation calculation unit 3.

[0054] The processing of the aggregation calculation unit 3 corresponds to "2:" in algorithm 1 in Figure 4.

[0055] In the example shown in Figure 3, share [ → b) is as shown in Figure 3(c).

[0056] The group boundary flag sequence generation unit 2 performs, for example, the processing of algorithm 3 as shown in Figure 6.

[0057] Specifically, first the group boundary flag sequence generation unit 2 generates the share [ → Set b1] to [0] (Algorithm 3's "1:"). Note that [ → b i ]teeth, → The i-th element of b → b i It means the share.

[0058] The group boundary flag column generation unit 2 is { → g' i-1 } and { → g' i Using}, { → g' i-1 }and{ → g' i If} is the same, then [1] → b i Set to ], otherwise set to [ 0 → b i Make it ] (Algorithm 3's "3:").

[0059] The process described in "3:" of Algorithm 3 is performed for each i from i=2 to i=l ("2:" to "4:" of Algorithm 3).

[0060] As in this example, the group boundary flag column generation unit 2 generates share { → Using g'}, a flag sequence [ where the first row of the group is 0 and the other rows are 1. → Generates b].

[0061] <Aggregation Calculation Unit 3> The aggregation calculation unit 3 includes share [ → b] and the sorted data columns included in the sorted table → v's share { → The input is v'}.

[0062] The aggregation calculation unit 3 calculates the share [ → b] and the sorted data columns included in the sorted table → v's share { → Using v'}, a predetermined aggregation operation using a predetermined binary operator is performed for each group (step S3). As a result, the aggregation unit 3 generates the aggregation result column { → Generates s.

[0063] The processing of the aggregation unit 3 corresponds to "3:" in algorithm 1 in Figure 4. The Agg in "3:" of algorithm 1 in Figure 4 may be prefixAgg from equation (1), suffixAgg from equation (2), or fullAgg from equation (3).

[0064] When the aggregation calculation unit 3 performs a prefix aggregation from the first row to the current row, it processes prefixAgg in expression (1). In the example in Figure 3, the share of the calculation result of prefix aggregation is { → s} will be as shown in Figure 3(d).

[0065] When the aggregation unit 3 performs Suffix Aggregation, which aggregates from the current row to the last row, it processes suffixAgg in equation (2). In the example in Figure 3, the share of the calculation result of Suffix Aggregation is { → s} will be as shown in Figure 3(e).

[0066] When the aggregation unit 3 performs a Full Aggregation, which aggregates from the first row to the last row, it performs the fullAgg process in equation (3). In the example in Figure 3, the share of the calculation result of Full Aggregation is { → s} will be as shown in Figure 3(f).

[0067] Information representing the type of aggregation operation to be performed by the aggregation unit 3 may be input to the aggregation unit 3. In this case, the aggregation unit 3 may perform the aggregation operation corresponding to the input information. Examples of aggregation operations performed by the aggregation unit 3 include Prefix Aggregation, which aggregates from the first row to the current row; Suffix Aggregation, which aggregates from the current row to the last row; and Full Aggregation, which aggregates from the first row to the row before the last row.

[0068] As in this example, the share of the data column { → v} and the share of the flag column [ → By taking [b] as input and specifying a binary operator, the aggregation operation is performed, resulting in the aggregated column { → It is possible to generate s.

[0069] [Variations] The specific configuration of the embodiments of the disclosed technology is not limited to the configuration described above. The specific configuration of the embodiments of the disclosed technology can be modified as appropriate, without departing from the spirit of the embodiments of the disclosed technology.

[0070] As illustrated in Figure 7, the sorting unit 1 may be composed of a plurality of sorting units 11, ..., 1N, where N is a predetermined positive integer of 2 or more. Similarly, the group boundary flag column generation unit 2 may be composed of a plurality of group boundary flag column generation units 21, ..., 2N. Similarly, the aggregation calculation unit 3 may be composed of a plurality of aggregation calculation units 31, ..., 3N. For example, let i = 1, ..., N, and assume that the sorting unit 1i, the group boundary flag column generation unit 2i, and the aggregation calculation unit 3i are provided in the secret calculation device Ai.

[0071] In this case, multiple sorting units 11, ..., 1N may cooperate to perform the processing of sorting unit 1. Similarly, multiple group boundary flag column generation units 21, ..., 2N may cooperate to perform the processing of group boundary flag column generation unit 2. Similarly, multiple aggregation calculation units 31, ..., 3N may cooperate to perform the processing of aggregation calculation unit 3.

[0072] The various processes described in the embodiments of the disclosed technology may be performed not only in chronological order according to the order described, but also in parallel or individually as required by the processing capacity of the device performing the processes.

[0073] For example, data exchange between components of a secure aggregation device may occur directly or via a storage unit not shown in the diagram.

[0074] Furthermore, the present invention may also include a device (terminal) for using the apparatus, system, or method of the present invention via a network (telecommunication line). The "device (terminal) for use" may be equipped with functions necessary to obtain the effects of implementing the apparatus, system, or method of the present invention (for example, control functions, decoding functions, restoration functions, input / output functions, etc.).

[0075] It goes without saying that the invention may be modified as appropriate without departing from its spirit.

[0076] All documents, patent applications, and technical standards described herein are incorporated by reference to the same extent as if each individual document, patent application, and technical standard were specifically and individually described as being incorporated by reference.

[0077] [Programs, Recording Media] The functions realized by the components described herein may be implemented in a circuitry or processing circuitry, including a general-purpose processor, an application-specific processor, an integrated circuit, an ASIC (Application Specific Integrated Circuit), a CPU (a Central Processing Unit), conventional circuits, and / or a combination thereof, programmed to realize the functions described herein. A processor includes transistors and other circuits and is considered a circuitry or processing circuitry. A processor may be a programmed processor that executes a program stored in memory.

[0078] In this specification, circuitry, unit, and means are hardware programmed to perform or execute the functions described herein. Such hardware may be any hardware disclosed herein, or any hardware known to be programmed to perform or execute the functions described herein.

[0079] If the hardware is a processor that is considered to be a type of circuitry, then the circuitry, means, or unit is a combination of hardware and software used to constitute the hardware and / or processor.

[0080] The various processes described above can be carried out by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 8, and then causing the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc. to operate.

[0081] The program describing this process can be recorded on a computer-readable recording medium. Any computer-readable recording medium can be used, such as a magnetic recording device, optical disc, magneto-optical recording medium, or semiconductor memory.

[0082] Furthermore, this program may be distributed, for example, by selling, transferring, or lending portable recording media such as DVDs or CD-ROMs on which the program is recorded. Alternatively, the program may be stored in the storage device of a server computer and distributed by transferring the program from the server computer to other computers via a network.

[0083] A computer executing such a program may, for example, first store the program recorded on a portable storage medium or a program transferred from a server computer in its own storage device. Then, when processing is to be executed, the computer reads the program stored on its own storage medium and executes the processing according to the read program. Alternatively, the computer may directly read the program from the portable storage medium and execute the processing according to that program, or it may sequentially execute the processing according to the received program each time a program is transferred to it from a server computer. Furthermore, the processing may be executed using a so-called ASP (Application Service Provider) type service, where the processing function is realized only by issuing execution instructions and obtaining results, without transferring the program from the server computer to this computer.In addition, the processing may be executed using a so-called SaaS (Software as a Service) type service, where a part of the server computer is made available to the user along with the program. Furthermore, the term "program" in this form includes information used for processing by an electronic computer that is equivalent to a program (data, etc., that is not a direct instruction to the computer but has the property of defining the processing of the computer).

[0084] Furthermore, in this configuration, the device is configured by executing a predetermined program on a computer, but at least a part of these processes may be implemented in hardware.< / aggregation> ​

Claims

1. The table has a group key column → , → share { → g}, an order key column → share { → o}, and a data column → share { → v}, and using the share { → g}, the share { → o}, and the share { → v}, a sorting unit that generates a sorted table by sorting the rows of the table based on the order key column → o and the group key column → g; a group boundary flag column generation unit that generates a boundary flag column → share { → g'} representing the group boundaries in the sorted table using the sorted group key column → share → b] in the sorted table; and an aggregation calculation unit that performs a predetermined aggregation calculation using a predetermined binary operator for each group using the share → b] and the sorted data column → share { → v'} included in the sorted table. A secret aggregation calculation device.

2. A secure aggregation device according to claim 1, wherein the aggregation unit comprises the data columns included in the first row j to row i of each group. → A secure aggregation device that performs the operation using the aforementioned binary operator on the elements of v' for each row i included in each group.

3. A secure aggregation device according to claim 1, wherein the aggregation unit comprises the data columns included in the last row h to row i of each group. → A secure aggregation device that performs the operation using the aforementioned binary operator on the elements of v' for each row i included in each group.

4. The table has a group key column. → g's share { → g} and the order key column → o's share { → o} and data column → v share { → v} includes, and the sorting unit is the share { → g} and the aforementioned share { → o} and the aforementioned share { → Using v}, the order key sequence → o and the group key column → A sorting step generates a sorted table by sorting the rows of the table based on g, and a group boundary flag column generation unit generates the sorted group key column included in the sorted table. → g's share { → Using g'}, a boundary flag column representing the group boundaries in the sorted table. → b's share [ → The group boundary flag column generation step generates b] and the aggregation calculation unit generates the share[ → b] and the sorted data columns included in the sorted table. → v's share { → A secret aggregation method comprising an aggregation calculation step that performs a predetermined aggregation operation using a predetermined binary operator for each group using v'}, and a secret aggregation calculation method.

Images