Secure aggregation computational device and method

Abstract

A secure aggregation computational device 10 comprises: a sorting unit 1 that generates a sorted table in which rows of a table are sorted on the basis of an order key column →o and a group key column →g; a group boundary flag column generation unit 2 that generates a share [→b1] of a boundary flag column →b1 representing boundaries of groups in the sorted table; an intermediate aggregation result column generation unit 4 that generates a share {→p} of an intermediate aggregation result column →p, an i-th element of which is the value obtained by calculation using some or all of the elements included in a group to which the i-th element belongs; a subgroup boundary flag column generation unit 5 that generates a share [→b2] of a boundary flag column →b2 representing boundaries of subgroups within each group in the sorted table, a subgroup being a portion within each group where the value of an order key is the same value consecutively; and a final aggregation result column generation unit 6 that generates a share {→s} of a final aggregation result column →s in which values aggregated from elements belonging to respective subgroups within the intermediate aggregation result column →p are the respective elements belonging to each subgroup.

Description

Secure aggregation device and method

[0001] The disclosure techniques relate to secure computation techniques.

[0002] Window functions are used to divide records into groups and perform aggregations within those groups. While GROUPBY is a similar function, Window functions differ in that they can output the aggregation results for each group on a record-by-record basis. Furthermore, within each group, you can specify the range (for example, how many rows before and after a given row) for aggregation. This enables calculations such as ranking, moving averages, and cumulative sums.

[0003] Non-patent document 1 is an example of research that implements such window functions on secure computation.

[0004] Hiroki Sudo, Ryo Kikuchi, "A Proposal for a Secret SQL Window Function Protocol," SCIS2022, pp. 1-6, 2022.

[0005] Non-patent document 1 proposes a method for implementing window functions using secure computation. However, the method described in Non-patent document 1 could only perform aggregation in Rows mode, out of the three aggregation modes: Rows, Range, and Group. Furthermore, in Range mode aggregation, if the same value appears consecutively in the order key column within a group, the same aggregated value is output for each row as a single unit (specifically, the aggregated value of the last row in the row considered as a single unit). Also, if the same value appears consecutively in the order key column but spans across groups, separate aggregated values ​​are output for each. In this respect, Range mode aggregation is more complex than Rows mode aggregation.

[0006] The disclosed technology aims to provide a secure aggregation device and method capable of performing Rows-mode aggregation.

[0007] A confidential aggregation device according to one aspect of the disclosure technology has a table with a group key column. → g's share { → g} and the order key column → o's share {→ o}, and the data sequence → share of v{ → v} and includes the share{ → g}, and the share{ → o}, and the share{ → v} are used to generate a sorted table by sorting the rows of the table based on the order key sequence → o and the group key sequence → g, and a sorting part that generates a sorted table, and the sorted group key sequence → share of g’{ → g’} is used to generate a boundary flag sequence → b 1 share of → b 1 that represents the group boundaries in the sorted table, and the sorted data sequence → share of v’{ → v’}, and the share → b 1 are used to generate an intermediate aggregation result sequence → share of p{ → p} whose i-th element is a value obtained by calculation using some or all of the elements included in the group to which the i-th element belongs, and the sorted order key sequence → share of o’{ → o’}, and the share → b 1 are used to represent that a part where the values of the order keys are continuously the same within each group is a subgroup, and to generate a boundary flag sequence → b 2 share of → b 2 that represents the boundaries of the subgroups within each group in the sorted table, and the share{ → p}, and the share → b 2 are used to generate a final aggregation result sequence → s whose elements are values aggregated from the elements belonging to each subgroup within the intermediate aggregation result sequence → share of{→ It comprises a final aggregate result column generation unit that generates s}.

[0008] According to the disclosed technology, it is possible to perform aggregation in Rows mode.

[0009] Figure 1 shows an example of the functional configuration of a secure tallying device. Figure 2 shows an example of the processing procedure for a secure tallying method. Figure 3 shows an example of processing. Figure 4 is a diagram illustrating an example of an algorithm. Figure 5 is a diagram illustrating an example of an algorithm. Figure 6 is a diagram illustrating an example of an algorithm. Figure 7 is a diagram illustrating an example of an algorithm. Figure 8 is a diagram illustrating another example of an algorithm. Figure 9 shows another example of processing. Figure 10 is a diagram illustrating another example of an algorithm. Figure 11 shows another example of processing. Figure 12 shows another example of the functional configuration of a secure tallying device. Figure 13 shows an example of the functional configuration of a computer.

[0010] Embodiments of the disclosed technology will be described below with reference to the drawings. Note that components having the same function are numbered identically in the drawings, and redundant explanations are omitted.

[0011] [Preparation] <Notation> Vectors → Let's denote it as x. The i-th element of the vector is x i It is represented as follows.

[0012] The symbol "→" used in text should ideally be placed directly above the following character, but due to limitations in text notation, it is placed immediately before the character. In mathematical formulas, these symbols are placed in their original position, that is, directly above the character. For example, in text, → "X" is written in mathematical formulas as follows: <Secret Sharing> Secret sharing is an encryption method that divides data into multiple values ​​and distributes them to multiple parties. For example, data can be encrypted using (k,n) threshold secret sharing. (k,n) threshold secret sharing is a secret sharing method that divides data into n random values ​​(called shares), and allows the original data to be reconstructed by collecting k or more shares, while information about the original data cannot be obtained from less than k shares. For example, Shamir secret sharing (see, for example, reference 1) and replication secret sharing (see, for example, references 2 and 3) are used.

[0013] [Reference 1] Adi Shamir, "How to share a secret", Communications of the ACM, Vol. 22, No. 11, pp. 612-613, 1979. [Reference 2] Mitsuru Ito, Akira Saito and Takao Nishizeki, "Secret sharing scheme realizing general access structure", Electronics and Communications in Japan (Part III: Fundamental Electronic Science), Vol. 72, No. 9, pp. 56-64, 1989. [Reference 3] Ronald Cramer, Ivan Damgard, and Yuval Ishai, "Share conversion, pseudorandom secret-sharing and applications to secure computation", In Theory of Cryptography Conference, pp. 342-362. Springer, 2005. Z p The share generated by the above secret sharing is denoted as {x}. The share generated by secret sharing on Z2 is denoted as [x] to distinguish it. This is because it is more efficient to use a dedicated secret sharing type to distribute values ​​on Z2. Similarly, the distribution of the substitution π is denoted as <π> to distinguish it. Also, → Share vectors obtained by secret sharing for each element of x {→ This is represented as x. Values ​​that are not secret and should be known by all servers are called public values.

[0014] Furthermore, the calculation of secret sharing may be implemented using homomorphic cryptography performed by a single device.

[0015] <Local Operations> Due to the properties of secret sharing, the addition of shares, addition with public values, multiplication with public values, and sign inversion can be calculated locally using only the shares held by each party. Each operation is denoted as follows:

[0016] Addition: {x} + {y} = {x + y} Addition with public value: {x} + y = {x + y} Multiplication with public value: {x}・y = {x・y} Sign inversion: -{x} = {-x} <Multiplication> In Shamir secret sharing, multiplication of shares can be achieved using the method of Gennaro et al. (see, for example, reference 4), and in replication secret sharing, using the method of Chida et al. (see, for example, reference 5).

[0017] [Reference 4] Rosario Gennaro, Michael O. Rabin and Tal Rabin, "Simplified VSS and fact-track multiparty computations with applications to threshold cryptography", In PODC, pp. 101-111, 1998. [Reference 5] Koji Chida, Koki Hamada, Dai Ikarashi, Ryo Kikuchi and Benny Pinkas, "High-throughput secure AES computation", In Michael Brenner and Kurt Rohloff, editors, Proceedings of the 6th Workshop on Encrypted Computing & Applied Homomorphic Cryptography, WAHCCCS 2018, Toronto, ON, Canada, October 19, 2018, pp. 13-24. ACM, 2018. The multiplication of shares {x} and {y} is expressed as follows:

[0018] {x}・{y}={x・y} <Modulus transformation> Secret sharing on Z2[x] to Z p This is a protocol for converting the above secret sharing {x}. A specific method is known, as described in reference 6.

[0019] [Reference 6] Ryo Kikuchi, Dai Ikarashi, Takahiro Matsuda, Koki Hamada and Koji Chida, "Efficient bit-6 decomposition and modulus-conversion protocols with an honest majority", pp. 64-82, 2018. Modulus conversion (ModConv) is denoted as follows:

[0020] {x}←ModConv([x]) <Stable sort> Sorting is an operation that rearranges a share column in ascending or descending order. Known sorting methods include the method by Asharov et al., described in Reference 7.

[0021] [Reference 7] Gilad Asharov, Koki Hamada, Dai Ikarashi, Ryo Kikuchi, Ariel Nof, Benny Pinkas, Katsumi Takahashi and Junichi Tomida, "Efficient secure three-party sorting with applications to data analysis and heavy hitters", In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, New York, NY, USA, November 2022. ACM. Note that sorting can be divided into two phases: creating a substitution table and substitution. If a substitution table is created, only the substitution phase needs to be performed for other columns that are sorted according to the key. A vector of length m { → Generate a transposition table with x as the key, and use <π> for { → The operations for rearranging y are denoted as follows:

[0022] Permutation table generation:<π>←genPerm({ → x}) Rearrange:{ → y'}←sort(<π>,{ → y}) However, { → y is { → It is a vector of the same length m as x.

[0023] <Equality Comparison> Equality can be determined by bit decomposition and calculation using a comparison circuit that takes the share of the bit sequence as input. The equality of {x} and {y} is denoted as [b]←Equality({x},{y}).

[0024] <aggregation>Aggregation operations (see, for example, reference 8) are performed on the elements of a vector { → This is an operation that aggregates x.

[0025] [Reference 8] Saikrishna Badrinarayanan, Sourav Das, Gayathri Garimella, Srinivasan Raghuraman and Peter Rindal, "Secret-shared joins with multiplicity from aggregation trees", Cryptology ePrint Archive, 2022. Aggregation operations use control bits to specify the aggregation range. → Taking b] and the binary operator ★ as arguments, { → This operation returns the aggregated result obtained by applying a binary operator to the elements within a given range for each i row of {x}.

[0026] The control bits are, for example, a bit vector with values ​​of 0 or 1, where 0 indicates the beginning of a group and 1 indicates being within a group. In other words, if a row is 0, that row is the beginning of a group, and if it is 1, the group consists of the sequence of 1s from the previous 0 to the row before the next 0.

[0027] A binary operator is an operator that takes two operands and produces a single result. An example of a binary operator is addition (+). In this case, the Sum function can be implemented. Another example of a binary operator is an operator that returns the larger of two operands. In this case, the Max function can be implemented. Other examples of binary operators are subtraction (-), multiplication (*), division ( / ), and exponentiation (^). Binary operators can also be operators other than those listed above. Such binary operators can be implemented, for example, using comparison operators and the If Gate function.

[0028] There are three types of aggregation operations: Prefix Aggregation, which aggregates from the first row to the current row; Suffix Aggregation, which aggregates from the current row to the last row; and Full Aggregation, which aggregates from the first row to the row before the last row.

[0029] In prefix aggregation, { → For each row of {x}, the elements of that row and the rows before it in the group to which that row belongs are counted. More specifically, j ≤ i is the first row of the group to which i belongs (starting from i, the first row b j Assuming that j) is such that = 0, in Prefix Aggregation, the following calculation using elements from j to row i is performed: { → This is performed for each i-th row of {x}.

[0030] { → y i }=★ k=j i { → x k }={ → x j }★{ → x j+1 }★…★{ → x i } [ → According to b], { → The execution of Prefix Aggregation using the binary operator ★ for x} is expressed as follows:

[0031] { → y}←prefixAgg({ → x},[ → b],★) …(1) In Suffix Aggregation, { → For each row of {x}, the elements of that row and the rows after it within the group to which that row belongs are aggregated. More specifically, assuming that h≧i is the end of the group to which i belongs, in Suffix Aggregation, the following calculation using the elements from row i to row h is performed: → This is performed for each i-th row of {x}.

[0032] { → y i}=★ k=i h { → x k}={ → x i}★{ → x i+1}★…★{ → x h} [[ID=2*]] → b] according to, the execution of Suffix Aggregation using the binary operator ★ for { → x} is expressed as follows.

[0033] { → y}←suffixAgg({ → x}, → b],★) …(2) In Full Aggregation, for each row of { → x}, the elements of all rows within the group to which that row belongs are aggregated. More specifically, assuming j≦i is the start of the group to which i belongs (the j for which b j =0 when tracing back from i), and h≧i is the end of the group to which i belongs, in Full Aggregation, the following calculation using the elements from the j-th to the h-th rows is performed for each i-th row of { → x}.

[0034] { → y i}=★ k=h j { → x k}={ → x j}★{ → x j+1}★…★{ → x h} → b] according to, the execution of Full Aggregation using the binary operator ★ for { → x} is expressed as follows.

[0035] { → y}←fullAgg({ → x}, → b],★) …(3) In this way, after sorting, → By performing the aggregation operation using [b], the amount of data transferred can be reduced to O(l), resulting in higher computational efficiency than before.

[0036] Alternatively, these aggregation operations may be performed using the Aggregation Tree method described in Reference 8. This allows the communication time to be O(l log l) and the number of rounds to be O(log l), further increasing computational efficiency.

[0037] [Secret Aggregation Calculation Device and Method] The secret aggregation calculation device 10, as shown in Figure 1, includes, for example, a sorting unit 1, a group boundary flag column generation unit 2, an intermediate aggregation result column generation unit 4, a subgroup boundary flag column generation unit 5, and a final aggregation result column generation unit 6.

[0038] The secure tally calculation method is implemented, for example, by having each component of the secure tally calculation device 10 perform the processing shown in steps S1 to S6 in Figure 2.

[0039] The tables subject to the secret aggregation operation include a group key column. → g's share { → g} and the order key column → o's share { → o} and data column → v share { → v} is included. The table subject to this secret aggregation operation is input to the sorting unit 1. For example, the table subject to the secret aggregation operation is stored in the table storage unit 0. In this case, the table read from the table storage unit 0 is input to the sorting unit 1. In the example of Figure 1, the table storage unit 0 is located outside the secret aggregation device 10, but the table storage unit 0 may be provided inside the secret aggregation device 10.

[0040] An example of a table subject to secret aggregation calculations is the table in Figure 3(a). Note that in Figure 3, the share symbol and the vector symbol "→" have been omitted for simplicity.

[0041] Each component of the secure tallying device 10 performs, for example, the processing of algorithm 1 shown in Figure 4. Algorithm 1 is an algorithm that performs range mode aggregation specifying the first row to the current row. The components of the secure tallying device 10 will be described below.

[0042] <Sort Unit 1> Sort Unit 1 contains share { → g} and share { → o} and share{ → The input is v}.

[0043] Sorting unit 1 is share { → g} and share { → o} and share{ → Using v}, the order key column → o and group key column → A sorted table is generated by sorting the rows of the table based on g (Step S1). The sorted group key column is included in the sorted table. → g's share { → g'} is output to the group boundary flag sequence generation unit 2.

[0044] The processing of sorting unit 1 corresponds to "1:" in algorithm 1 in Figure 4.

[0045] In the example shown in Figure 3, the sorted table will be the table shown in Figure 3(b).

[0046] The sorted table is { → g'},{ → o'},{ → Includes v'} { → g'},{ → o'},{ → v'} is grouped by a group key, and then sorted within each group by an order key column.

[0047] The sorting unit 1 performs, for example, the processing of algorithm 2 shown in Figure 5. The processing of algorithm 2 shown in Figure 5 will be explained below.

[0048] Sorting unit 1 is share { → Using o}, the order key sequence → A permutation σ sorts each column based on o. o Share <σ o Calculate > (Algorithm 2, "1:").

[0049] Sorting unit 1 is share { → g} and share { → o} and share{ → v} and share <σ o > and group key column → g is substituted σ o Column to which the condition was applied → g'' share { → g'' and the order key column → σ is substituted for o o Column to which the condition was applied → o'''s share { → o''} and the data sequence → Substitution of v σ o Column to which the condition was applied → v'' share { → Calculate v'' (Algorithm 2, "2:").

[0050] Sorting unit 1 is share { → Using g'', the column → A permutation σ sorts each column based on g''. g Share <σ g Calculate > (Algorithm 2, "3:").

[0051] Sorting unit 1 is share { → g''} and share { → o''} and share{ → v''} and share <σ g Using >, column → Substitution of g'' σ g Column to which the condition was applied → g's share { → g'} and the column → Replace o'' with σ g Column to which the condition was applied → o's share { → o'} and the column → Substitution of v'' σ g Column to which the condition was applied → v's share { → Calculate v' (Algorithm 2, "4:").

[0052] <Group Boundary Flag Column Generation Unit 2> The Group Boundary Flag Column Generation Unit 2 generates the sorted group key columns included in the sorted table. → g's share { → g'} is entered.

[0053] The group boundary flag column generation unit 2 generates the sorted group key column included in the sorted table. → g's share { → Using g'}, a boundary flag column represents the group boundaries in the sorted table. → b 1 Share [ → b 1 ] generates (step S2). Share [ → b 1 This is output to the intermediate aggregation result column generation unit 4.

[0054] The processing of the group boundary flag sequence generation unit 2 corresponds to "2:" in algorithm 1 in Figure 4.

[0055] In the example shown in Figure 3, share [ → b 1 ] will look like Figure 3(c).

[0056] The group boundary flag sequence generation unit 2 performs, for example, the processing of algorithm 3 as shown in Figure 6.

[0057] Specifically, first the group boundary flag sequence generation unit 2 generates the share [ → b 1 Set [1] to [0] (Algorithm 3's "1:"). Note that [ → b 1 i ]teeth, → b 1 i-th element → b 1 i It means the share.

[0058] The group boundary flag column generation unit 2 is { → g' i-1 } and { → g' i Using}, { → g' i-1 }and{ → g' i If} is the same, then [1] → b 1 i Set to ], otherwise set to [ 0 → b 1 i Make it ] (Algorithm 3's "3:").

[0059] The process described in "3:" of Algorithm 3 is performed for each i from i=2 to i=l ("2:" to "4:" of Algorithm 3).

[0060] As in this example, the group boundary flag column generation unit 2 generates share { → Using g'}, a flag column [ where the first row of the group is 0 and the other rows are 1. → b 1 Generates ].

[0061] <Intermediate Aggregation Result Column Generation Unit 4> The intermediate aggregation result column generation unit 4 generates the sorted data columns included in the sorted table. → v's share { → v'} and share[ → b 1 ] is entered.

[0062] The intermediate aggregation result column generation unit 4 generates the sorted data columns included in the sorted table. → v's share { → v'} and share[ → b 1 Using ], the value obtained by calculation using some or all of the elements included in the group to which the i-th element belongs is used as the value of the intermediate aggregate result column. → p's share { → Generate p (step S4). Share { → p} is output to the final aggregation result column generation unit 6.

[0063] The processing of the intermediate aggregation result column generation unit 4 corresponds to "3:" in algorithm 1 in Figure 4.

[0064] For example, the intermediate aggregation result column generation unit 4 is [ → b 1 ] According to { → By performing Prefix Aggregation using the binary operator + on v'}, the share { → Generate p.

[0065] In other words, the intermediate aggregation result column generation unit 4 generates the sorted data columns included in the sorted table. → v's share { → v'} and share[ → b 1 Using ], the first element of the group to which the i-th element belongs is the j-th element, and the data sequence → The intermediate summary result column where the i-th element is the sum of the elements from j to the i-th element of v'. → p's share { → Generate p.

[0066] In the example of Figure 3, share { → p} will be as shown in Figure 3(d). Intermediate summary result column → p is the same as the output result in Rows mode.

[0067] <Subgroup boundary flag column generation unit 5> The subgroup boundary flag column generation unit 5 includes share { → o'} and share[ → b 1 ] is entered.

[0068] The subgroup boundary flag column generation unit 5 generates the sorted order key column included in the sorted table. → o's share { → o'} and share[ → b 1 Using ], the portion within each group where the order key value is the same consecutively is a subgroup, and the boundary flag column represents the boundary of the subgroup within each group in the sorted table. → b 2 Share [ → b 2 Generate ] (step S5). Share [ → b 2 This is output to the final aggregation result column generation unit 6.

[0069] The processing of the subgroup boundary flag sequence generation unit 5 corresponds to "4:" in algorithm 1 in Figure 4.

[0070] The subgroup boundary flag sequence generation unit 5 performs, for example, the processing of algorithm 4 as shown in Figure 7.

[0071] Specifically, first the subgroup boundary flag sequence generation unit 5 generates the share [ → b 2 Set [1] to [0] (Algorithm 4's "1:"). Note that [ → b 2 i ]teeth, → b 2 i-th element → b 2 i It means the share.

[0072] The subgroup boundary flag column generation unit 5 generates { → o' i-1 } and { → o' i Using}, { → o' i-1 }and{ → o' i If} is the same, then [1] → b 2 i Set to ], otherwise set to [ 0 → b 2 i Make it ] (Algorithm 4's "3:").

[0073] The subgroup boundary flag column generation unit 5 is, → b 2 i ] and [ → b 1 i Using ], [ → b 2 i ] and [ → b 1 i If both of ] are [1] then [1] becomes the new [ → b 2 i Set to ], otherwise set [0] to a new [ → b 2 i Set it to ] (Algorithm 4's "4:").

[0074] The processes "3:" and "4:" of Algorithm 4 are performed for each i from i=2 to i=l ("2:" to "5:" of Algorithm 1).

[0075] In the example shown in Figure 3, share [ → b 2 This corresponds to the table in Figure 3(e).

[0076] <Final Aggregation Result Column Generation Unit 6> The final aggregation result column generation unit 6 includes share { → p} and share[ → b 2 ] is entered.

[0077] The final aggregation result column generation unit 6 generates share { → p} and share[ → b 2 Using ], the intermediate summary result column → The final aggregated result column consists of values ​​aggregated from the elements belonging to each subloop within p, with each element belonging to each subloop representing that value. → s's share { → Generate s (step S6).

[0078] The processing of the final aggregate result column generation unit 6 corresponds to "5:" in algorithm 1 in Figure 4.

[0079] For example, the final aggregate result column generation unit 6 generates share [ → b 2 ] According to { → The execution of Suffix Aggregation using the binary operator OpDuNext for p} is performed as { → By doing this for each i row of p}, share { → Generates s.

[0080] In other words, the final aggregation result column generation unit 6 generates share { → p} and share[ → b 2 Using ], and assuming that the last element of the subgroup to which the i-th element belongs is the h-th element, the data sequence → Final aggregated result sequence where the h-th element of v' is the i-th element. → s's share { → Generates s.

[0081] In the example of Figure 3, share { → s} is the table shown in Figure 3(f).

[0082] OpDuNext is a binary operator such that OpDupNext(x,y)=y. In other words, OpDuNext is an operator that outputs the right-hand operand of the two operands it takes as arguments.

[0083] The Suffix Aggregation operation copies the aggregated value from the immediately following row to rows within a group where the order key column has the same value consecutively.

[0084] This allows you to copy the output values ​​from the last row of a column that forms a single block in Range mode, thus enabling aggregation in Range mode.

[0085] <<Range mode specifying the current row to the last row>> Note that each component of the secret aggregation device 10 may perform the processing of algorithm 5 shown in Figure 8. Algorithm 5 is an algorithm that performs aggregation in Range mode specifying the current row to the last row.

[0086] In this case, the processing of the sorting unit 1 and the group boundary flag column generation unit 2 (processing of steps S1 and S2, and processing of "1:" and "2:" of algorithm 5) is the same as described above.

[0087] The intermediate aggregation result column generation unit 4 generates, for example, [ → b 1 ] According to { → By performing a suffix aggregation using the binary operator + on v'}, the share { → Generate p (step S4, process "3:" in algorithm 5).

[0088] In other words, the intermediate aggregation result column generation unit 4 generates the sorted data columns included in the sorted table. → v's share { → v'} and share[ → b 1 Using ], and assuming that the last element of the group to which the i-th element belongs is the h-th element, the data sequence → The intermediate summary result column has the value obtained by adding the elements from i to h of v' as the i-th element. → p's share { → Generate p.

[0089] If the table subject to the secret aggregation calculation is the table shown in Figure 9(a), then share { → p} is as shown in Figure 9(d).

[0090] The processing of the subgroup boundary flag sequence generation unit 5 (processing in step S5, processing "4:" of algorithm 5) is the same as described above.

[0091] In the example of Figure 9, share[ → b 2 This corresponds to the table in Figure 9(e).

[0092] The final aggregation result column generation unit 6 generates, for example, share [ → b 2 ] According to { → The execution of Prefix Aggregation using the binary operator OpDuPrev for p} is performed as { → By doing this for each i row of p}, share { → Generates s.

[0093] In other words, the final aggregation result column generation unit 6 generates share { → p} and share[ → b 2 Using ], and assuming that the first element of the subgroup to which the i-th element belongs is the j-th element, the data sequence → Final aggregated result sequence where the j-th element of v' is the i-th element. → s's share { → Generates s.

[0094] In the example of Figure 9, share { → s} will be as shown in Figure 9 (f).

[0095] OpDuPrev is a binary operator such that OpDuPrev(x,y)=x. In other words, OpDuPrev is an operator that outputs the left-hand operand of the two operands it takes as arguments.

[0096] The Prefix Aggregation operation copies the aggregated value from the row immediately preceding a row for rows within a group where the order key column has the same value consecutively.

[0097] This allows you to copy output values ​​from the first row of a column that forms a single block in Range mode, thus enabling Range mode aggregation by specifying the current row to the last row.

[0098] <<Current row - Range mode specifying the current row>> Note that each component of the secret aggregation device 10 may perform the processing of algorithm 6 shown in Figure 10. Algorithm 6 is an algorithm that performs aggregation in a range mode specifying the current row - current row.

[0099] In this case, the processing of the sorting unit 1 and the group boundary flag column generation unit 2 (processing of steps S1 and S2, and processing of "1:" and "2:" of algorithm 6) is the same as described above.

[0100] In this example, the processing of the subgroup boundary flag column generation unit 5 (processing in step S5, processing "3:" of algorithm 6) is performed before the processing of the intermediate aggregation result column generation unit 4 (processing in step S4, processing "4:" of algorithm 6).

[0101] The processing of the subgroup boundary flag sequence generation unit 5 (processing in step S5, processing "3:" of algorithm 6) is the same as described above.

[0102] If the table subject to the secret aggregation calculation is the table shown in Figure 11(a), then share[ → b 2 This is the table shown in Figure 11(e).

[0103] The intermediate aggregation result column generation unit 4 generates, for example, [ → b 2 ] According to { → By performing prefix aggregation using the binary operator + on v'}, the share { → Generate p (step S4, process "4:" of algorithm 6).

[0104] In other words, the intermediate aggregation result column generation unit 4 generates the sorted data columns included in the sorted table. → v's share { → v'} and share[ → b 1 Using ], the first element of the group to which the i-th element belongs is the j-th element, and the data sequence → The intermediate summary result column where the i-th element is the sum of the elements from j to the i-th element of v'. → p's share { → Generate p.

[0105] In the example of Figure 11, share { → p} is as shown in Figure 11(d).

[0106] The final aggregation result column generation unit 6 generates, for example, share [ → b 2 ] According to { → The execution of Suffix Aggregation using the binary operator OpDuNext for p} is performed as { → By doing this for each i row of p}, share { → Generates s.

[0107] In other words, the final aggregation result column generation unit 6 generates share { → p} and share[ → b 2 Using ], and assuming that the last element of the subgroup to which the i-th element belongs is the h-th element, the data sequence → Final aggregated result sequence where the h-th element of v' is the i-th element. → s's share { → Generates s.

[0108] In the example of Figure 11, share { → s} will be as shown in Figure 11 (f).

[0109] OpDuNext is a binary operator where OpDuNext(x,y)=y. In other words, OpDuNext is an operator that outputs the right-hand operand of the two operands it takes as arguments.

[0110] The Suffix Aggregation operation copies the aggregated value from the immediately following row to rows within a group where the order key column has the same value consecutively.

[0111] This allows you to copy output values ​​from the last row of a column that forms a single block in Range mode, thus enabling Range mode aggregation by specifying the current row minus the current row.

[0112] [Variations] The specific configuration of the embodiments of the disclosed technology is not limited to the configuration described above. The specific configuration of the embodiments of the disclosed technology can be modified as appropriate, without departing from the spirit of the embodiments of the disclosed technology.

[0113] As illustrated in Figure 12, the sorting unit 1 may be composed of a plurality of sorting units 11, ..., 1N, where N is a predetermined positive integer of 2 or more. Similarly, the group boundary flag column generation unit 2 may be composed of a plurality of group boundary flag column generation units 21, ..., 2N. Similarly, the intermediate aggregation result column generation unit 4 may be composed of a plurality of intermediate aggregation result column generation units 41, ..., 4N. Similarly, it may be composed of subgroup boundary flag column generation units 51, ..., 5N. Similarly, the final aggregation result column generation unit 6 may be composed of a plurality of final aggregation result column generation units 61, ..., 6N.

[0114] For example, let i = 1, ..., N, and assume that the sorting unit 1i, group boundary flag column generation unit 2i, intermediate aggregation result column generation unit 4i, subgroup boundary flag column generation unit 5i, and final aggregation result column generation unit 6i are provided in the secure computing device Ai.

[0115] In this case, multiple sorting units 11, ..., 1N may cooperate to perform the processing of sorting unit 1. Similarly, multiple group boundary flag column generation units 21, ..., 2N may cooperate to perform the processing of group boundary flag column generation unit 2. Similarly, multiple intermediate aggregation result column generation units 41, ..., 3N may cooperate to perform the processing of intermediate aggregation result column generation unit 4. Similarly, multiple subgroup boundary flag column generation units 51, ..., 5N may cooperate to perform the processing of subgroup boundary flag column generation unit 5. Similarly, multiple final aggregation result column generation units 61, ..., 6N may cooperate to perform the processing of final aggregation result column generation unit 6.

[0116] The various processes described in the embodiments of the disclosed technology may be performed not only in chronological order according to the order described, but also in parallel or individually as required by the processing capacity of the device performing the processes.

[0117] For example, data exchange between components of a secure aggregation device may occur directly or via a storage unit not shown in the diagram.

[0118] Furthermore, the present invention may also include a device (terminal) for using the apparatus, system, or method of the present invention via a network (telecommunication line). The "device (terminal) for use" may be equipped with functions necessary to obtain the effects of implementing the apparatus, system, or method of the present invention (for example, control functions, decoding functions, restoration functions, input / output functions, etc.).

[0119] It goes without saying that the invention may be modified as appropriate without departing from its spirit.

[0120] All documents, patent applications, and technical standards described herein are incorporated by reference to the same extent as if each individual document, patent application, and technical standard were specifically and individually described as being incorporated by reference.

[0121] [Programs, Recording Media] The functions realized by the components described herein may be implemented in a circuitry or processing circuitry, including a general-purpose processor, an application-specific processor, an integrated circuit, an ASIC (Application Specific Integrated Circuit), a CPU (a Central Processing Unit), conventional circuits, and / or a combination thereof, programmed to realize the functions described herein. A processor includes transistors and other circuits and is considered a circuitry or processing circuitry. A processor may be a programmed processor that executes a program stored in memory.

[0122] In this specification, circuitry, unit, and means are hardware programmed to perform or execute the functions described herein. Such hardware may be any hardware disclosed herein, or any hardware known to be programmed to perform or execute the functions described herein.

[0123] If the hardware is a processor that is considered to be a type of circuitry, then the circuitry, means, or unit is a combination of hardware and software used to constitute the hardware and / or processor.

[0124] The various processes described above can be carried out by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 13, and then causing the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc. to operate.

[0125] The program describing this process can be recorded on a computer-readable recording medium. Any computer-readable recording medium can be used, such as a magnetic recording device, optical disc, magneto-optical recording medium, or semiconductor memory.

[0126] Furthermore, this program may be distributed, for example, by selling, transferring, or lending portable recording media such as DVDs or CD-ROMs on which the program is recorded. Alternatively, the program may be stored in the storage device of a server computer and distributed by transferring the program from the server computer to other computers via a network.

[0127] A computer executing such a program may, for example, first store the program recorded on a portable storage medium or a program transferred from a server computer in its own storage device. Then, when processing is to be executed, the computer reads the program stored on its own storage medium and executes the processing according to the read program. Alternatively, the computer may directly read the program from the portable storage medium and execute the processing according to that program, or it may sequentially execute the processing according to the received program each time a program is transferred to it from a server computer. Furthermore, the processing may be executed using a so-called ASP (Application Service Provider) type service, where the processing function is realized only by issuing execution instructions and obtaining results, without transferring the program from the server computer to this computer.In addition, the processing may be executed using a so-called SaaS (Software as a Service) type service, where a part of the server computer is made available to the user along with the program. Furthermore, the term "program" in this form includes information used for processing by an electronic computer that is equivalent to a program (data, etc., that is not a direct instruction to the computer but has the property of defining the processing of the computer).

[0128] Furthermore, in this configuration, the device is configured by executing a predetermined program on a computer, but at least a part of these processes may be implemented in hardware.< / aggregation> ​

Claims

1. The table has a group key column → share { → g} of g, an order key column → share { → o} of o, and a data column → share { → v} of v, and using the share { → g}, the share { → o}, and the share { → v}, a sorting unit that generates a sorted table by sorting the rows of the table based on the order key column → o and the group key column → g, and a group boundary flag column generation unit that generates a share → share { → g’} of the sorted group key column → b 1 representing the group boundaries in the sorted table, and a share → b 1 of the sorted data column → share { → v’} of v’ and the share → b 1 , an intermediate aggregation result column generation unit that generates a share → share { → p} of the intermediate aggregation result column p whose i-th element is a value obtained by calculation using some or all of the elements included in the group to which the i-th element belongs, and a share → share { → o’} of the sorted order key column → b 1 in the sorted table, and each part where the values of the order key are continuously the same within each group is a subgroup, and a subgroup boundary flag column generation unit that generates a share → b 2 representing the subgroup boundaries within each group in the sorted table, and the share { → b 2 and the share { → p} and the share → b 2 Using ], the intermediate summary result column → The final aggregated result column is defined as the value aggregated from the elements belonging to each subloop within p, with each element belonging to that subloop being the corresponding element. → s's share { → A final aggregation result column generation unit that generates s, and a secret aggregation calculation device including .

2. The secret aggregation calculation device according to claim 1, wherein the intermediate aggregation result column generation unit generates sorted data columns included in the sorted table. → v's share { → v'} and the aforementioned share[ → b 1 Using ], the first element of the group to which the i-th element belongs is the j-th element, and the data sequence → The intermediate summary result column where the i-th element is the sum of the elements from j to the i-th element of v'. → p's share { → The final aggregation result column generation unit generates p}, and the share { → p} and the aforementioned share[ → b 2 Using ], and assuming that the last element of the subgroup to which the i-th element belongs is the h-th element, the data sequence → Final aggregated result sequence where the h-th element of v' is the i-th element. → s's share { → A secret aggregation unit that generates s.

3. The secret aggregation calculation device according to claim 1, wherein the intermediate aggregation result column generation unit generates sorted data columns included in the sorted table. → v's share { → v'} and the aforementioned share[ → b 1 Using ], and assuming that the last element of the group to which the i-th element belongs is the h-th element, the data sequence → The intermediate summary result column has the value obtained by adding the elements from i to h of v' as the i-th element. → p's share { → The final aggregation result column generation unit generates p}, and the share { → p} and the aforementioned share[ → b 2 Using ], and assuming that the first element of the subgroup to which the i-th element belongs is the j-th element, the data sequence → Final aggregated result sequence where the j-th element of v' is the i-th element. → s's share { → A secret aggregation unit that generates s.

4. The table has a group key column → share of g{ → g}, an order key column → share of o{ → o}, and a data column → share of v{ → v}, and the sorting part uses the share{ → g}, the share{ → o}, and the share{ → v} to generate a sorted table by sorting the rows of the table based on the order key column → o and the group key column → g. The group boundary flag column generation part uses the sorted group key column → share of g'{ → g'} in the sorted table to generate a boundary flag column → b 1 share of → b 1 representing the boundaries of the groups in the sorted table. The intermediate aggregation result column generation part uses the sorted data column → share of v'{ → v'} in the sorted table and the share → b 1 to generate an intermediate aggregation result column → share of p{ → p}, where the i-th element is a value obtained by a calculation using some or all of the elements included in the group to which the i-th element belongs. The subgroup boundary flag column generation part uses the sorted order key column → share of o'{ → o'} in the sorted table and the share → b 1 to represent that a part where the values of the order key are continuously the same within each group is a subgroup, and generate a boundary flag column → b 2 share of → b 2 A sub-group boundary flag sequence generation step for generating [], and the final aggregation result column generation unit uses the share { → p} and the share → b 2 to calculate the intermediate aggregation result column → The final aggregation result column → s, where the value aggregated from the elements belonging to each sub-group within → s is used as each element belonging to each sub-group. A secret aggregation operation method including a final aggregation result column generation step for generating { → s}.

Images