Secret division system, secret calculation device, secret division method, and computer program product

Abstract

Division is performed with fewer processing stages. The secret computing device (1) uses the hidden value [N] of the real number N and the hidden value [D] of the natural number D to obtain a hidden value representing the result of N divided by D. The initialization unit (12) sets the hidden value [] of the partial remainder to 0. The parallel comparison unit (13) calculates the partial divisor n=P j+1 R+N j The hidden value [n] is compared in parallel with the [D]×g of each integer g greater than or equal to 1 and less than R, resulting in comparisons E1,…,E R‑1 The concealment value [E1],…,[E R‑1 The update department (14) uses the comparison results E1,…,E R‑1 The concealment values ​​[E1], ..., [E R‑1 ], calculate the expression that satisfies n=DQ j +P j Q's business j The stealth value [Q] j ] and partial remainder P j The hidden value [P] j The repetitive control unit (15) performs the parallel comparison unit (13) and the update unit (14) for each integer j from L1-1 to -L0.

Description

Technical Field

[0001] This invention relates to encryption application technology, and in particular to a technology for efficiently performing division without disclosing the input or output values. Background Technology

[0002] As a method for obtaining specific computational results without restoring the encrypted numerical values, there is a method called secret computation (for example, see Non-Patent Document 1). In the method described in Non-Patent Document 1, encryption is performed by distributing fragments of the numerical value among three secret computing devices. By performing collaborative computation through the three secret computing devices, the results of addition and subtraction operations, constant addition, multiplication, constant multiplication, logical operations ("NOT", "AND", "OR", "XOR"), and data form transformations (integers, binary) can be maintained in the state of being distributed among the three secret computing devices without restoring the numerical values, i.e., while still being encrypted.

[0003] There are methods for implementing Goldschmidt division in secret computation when performing division without disclosing the values ​​of the input or output (e.g., see Non-Patent Literature 2).

[0004] Existing technical documents

[0005] Non-patent literature

[0006] Non-patent literature 1: Koji Chida, Hiroshi Hamada, Dai Igarashi, Katsumi Takahashi, "Reexamination of the Calculation of the Number of Secret Levels in the Possible 3パーティSecret Level", CSS, 2010

[0007] Non-patent document 2: Dan Bogdanov, Margus Niitsoo, Tomas Toft, and JanWillemson, "High-performance secure multi-party computation for data mining applications," International Journal of Information Security, Vol. 11, No. 6, pp. 403-418, 2012. Summary of the Invention

[0008] The problem that the invention aims to solve

[0009] However, implementing Goldschmidt division in secret computation requires the use of fixed-point multiplication. Fixed-point multiplication in secret computation suffers from the problem of handling numerous series, i.e., a large number of communications.

[0010] The purpose of this invention is to address the aforementioned technical challenges by implementing division with fewer processing stages without using fixed-point multiplication.

[0011] Solution for solving the problem

[0012] To address the aforementioned issues, one aspect of the secret division system of this invention sets R to an integer greater than or equal to 3, sets L0 and L1 to non-negative integers, and sets N to a value greater than or equal to 0 and less than 3. Let D be a real number, and let it be a natural number. , …, Let N be the value of each digit from the L0th decimal place to the L1st integer place in base R, and let j be each integer from L1-1 to -L0. A secret division system is a secret division system that includes multiple secret computing devices and uses the hidden value of N [N] and the hidden value of D [D] to obtain a hidden value representing the result of N divided by D. The secret computing device includes: [the device is used to calculate the partial remainder...] The hidden value [ The initialization part is set to 0; the partial divisor n=P is calculated. j+1 R+N j The hidden value [n] is compared in parallel with the [D]×g of each integer g greater than or equal to 1 and less than R, resulting in comparisons E1, …, E R-1 The concealment value [E1], …, [E R-1 The parallel comparison section; and the comparison results E1, …, E R-1 The hidden value [E1], …, [E R-1 ], calculate the expression that satisfies n=DQ j +P j Q's business j The stealth value [Q] j ] and partial remainder P j The hidden value [P] j The update department.

[0013] The effects of the invention

[0014] According to the present invention, since division is performed without using fixed-point multiplication, division can be performed with fewer processing stages. Attached Figure Description

[0015] Figure 1 This is a diagram illustrating the functional structure of the secret division system.

[0016] Figure 2 This is a diagram illustrating the functional structure of a secret computing device.

[0017] Figure 3 This is a diagram illustrating the process of the secret division method.

[0018] Figure 4 This is a diagram illustrating the functional structure of a computer. Detailed Implementation

[0019] First, let me explain the writing methods and definitions of terms used in this instruction manual.

[0020] <Description Method>

[0021] The value of a given value 'a' that has been concealed through encryption or secret distribution is called the concealed value of 'a', denoted as [a]. In the case of concealment as secret distribution, [a] refers to the set of secret distribution fragments held by each secret computing device.

[0022] In the domain of a variable, [a, b] (square brackets) represents a closed interval, and (a, b) (round brackets) represents an open interval. For example, i∈[a, b] means that i takes values ​​greater than or equal to a and less than or equal to b. Alternatively, i∈[a, b) means that i takes values ​​greater than or equal to a and less than b.

[0023] <Addition, Subtraction, Multiplication>

[0024] For each operation of addition, subtraction, and multiplication in the hidden text, the hidden values ​​[a] and [b] of two values ​​a and b are set as inputs, and the hidden values ​​[c1], [c2], and [c3] of the calculation results c1, c2, and c3 of a+b, ab, and ab, respectively, are calculated. The execution of these operations is described as follows.

[0025] [Mathematical Expression 1]

[0026]

[0027] Without concern about causing misunderstanding, Add([a], [b]), Sub([a], [b]), and Mul([a],[b]) can be abbreviated as [a]+[b], [a]-[b], and [a]×[b], respectively.

[0028] <Comparison>

[0029] The comparison operation takes the hidden values ​​[a] and [b] of two values ​​a and b as input, and calculates the hidden value [c] of the truth value c∈{0,1} for a≦b. The value is set to 1 when true and 0 when false. The operation is described as follows.

[0030] [Mathematical Expression 2]

[0031]

[0032] Hereinafter, embodiments of the present invention will be described in detail. Furthermore, in the accompanying drawings, structural parts having the same function will be given the same reference numerals, and repeated descriptions will be omitted.

[0033] [Implementation Method]

[0034] The secret division system of the implementation method takes the hidden value [N] of the dividend N and the hidden value [D] of the divisor D as input, calculates and outputs the values ​​of each digit in the R-ary representation of N / D from the L0th digit below the decimal point to the L1th digit of the integer part. ,…, The hidden value [ ], …, [ Here, let R be an integer greater than or equal to 3, L0 and L1 be non-negative integers, and N be a number greater than or equal to 0 and less than 3. The real number, D, is a natural number. Additionally, the [...] used in the implementation method ], [ ], …, [ ], [ The following formula represents the R-ary decomposition of N. , , …, , The hidden value.

[0035] [Mathematical Expression 3]

[0036]

[0037] Reference Figure 1 This section describes a structural example of the secret division system implemented in this embodiment. For example, the secret division system 100 is as follows: Figure 1 As shown, it contains K (≥2) secret computing devices 11, …, 1 K In this embodiment, the secret computing devices 11, ..., 1 K Each device is connected to communication network 9. Communication network 9 is a line-switched or packet-switched communication network that enables the connected devices to communicate with each other; for example, it can use the Internet, LAN (Local Area Network), WAN (Wide Area Network), etc. Furthermore, the devices do not necessarily need to be able to communicate online via communication network 9. For example, it can also be configured to send input to secret computing devices 11, ..., 1 K The information is stored on a removable recording medium such as magnetic tape or USB memory, and is input offline from this removable recording medium to the secret computing device 11,..., 1 K .

[0038] Reference Figure 2 The secret calculation device 1 included in the secret division system 100 of the embodiment is explained. k Example of a structure (k=1, …,K). Secret computing device 1 k For example, Figure 2 As shown, it includes: an input unit 11, an initialization unit 12, a parallel comparison unit 13, an update unit 14, a repetitive control unit 15, and an output unit 16. This secret computing device 1 k (k=1, …, K) via one side with other secret computing devices 1 k' (k'=1, …, K, where k≠k') work together to implement the secret division method of this method while performing the steps described later.

[0039] Secret Computing Device 1 k For example, a special device is constructed by loading special programs into a known or special-purpose computer equipped with a central processing unit (CPU) and random access memory (RAM). Secret computing device 1 k For example, each process is executed under the control of the central processing unit. Input is sent to secret computing device 1. k Data, or data obtained in various processes, is stored, for example, in the main storage device. Data stored in the main storage device is read out as needed and used in other processes by the central processing unit. Secret Computing Device 1 k At least a portion of each processing unit can also be constructed using hardware such as integrated circuits.

[0040] Reference Figure 3 This describes the processing procedure of the secret division method executed by the secret division system 100 in the implementation method.

[0041] In step S11, information is sent to each secret computing device 1 k The input unit 11 receives the hidden value [N] of the dividend N and the hidden value [D] of the divisor D. Alternatively, instead of the hidden value [N] of the dividend N, the input unit 11 may receive an R-ary decomposition of the dividend N. , , …, , The hidden value [ ], …, [ When the hidden value [N] of the dividend N is input to the input unit 11, the input unit 11 generates an R-ary decomposition of the dividend N from the hidden value [N]. , , …, , The hidden value [ ], …, [ The input unit 11 will display the R-base decomposition of the dividend N. , , …, , The hidden value [ ], …, [ The hidden value [D] of the divisor D is output to the parallel comparison unit 13.

[0042] In step S12, each secret computing device 1 k The initialization part 12 will have a partial remainder The hidden value [ Initialize to [ ]=0. Additionally, the repeatedly processed index j is initialized to j=L1-1. Initialization part 12 will set a partial remainder. The hidden value [ The output is sent to the parallel comparison unit 13. Additionally, index j is output to the repetition control unit 15.

[0043] In step S13, each secret computing device 1 k The parallel comparison unit 13 will calculate as n=P j+1 R+N j The hidden value [n] of the partial divisor n is compared in parallel with the result E of each [D]×g as g∈[1, R). g The hidden value [E] g (g∈[1, R)). Specifically, the parallel comparison unit 13 calculates the comparison result E for each integer g that is greater than or equal to 1 and less than R using the following formula. g The hidden value [E] g The parallel comparison unit 13 compares the results E1, …, E. R-1 The hidden value [E1], …, [E R-1 Output to update section 14.

[0044] [Mathematical Expression 4]

[0045]

[0046] In step S14, each secret computing device 1 k The update section 14 uses the comparison results E1, …, E R-1 The concealment value [E1], …, [E R-1 ], calculate quotient Q j The stealth value [Q] j ] and partial remainder P j The hidden value [P] j Additionally, Qj and P j Satisfying n=DQ j +P j Q j ∈[0, R), P j ∈[0, R). Specifically, the update unit 14 calculates the quotient Q using the following formula. j The stealth value [Q] j ] and partial remainder P j The hidden value [P] j [Update Department 14 will discuss Q] j The stealth value [Q] j ] and partial remainder P j The hidden value [P] j Output to output section 16.

[0047] [Mathematical Expression 5]

[0048]

[0049] In step S15-1, each secret computing device 1 k The repetitive control unit 15 determines whether j is less than or equal to -L0, that is, determines whether j≦-L0 is true or false. If j≦-L0 is false, that is, j>-L0, then the process proceeds to step S15-2. If j≦-L0 is true, then the process proceeds to step S16. In step S15-2, each secret computing device 1 k The repetitive control unit 15 decrements j, i.e., calculates j = j-1, and returns the processing to step S13. In other words, the repetitive control unit 15 repeatedly executes the parallel comparison unit 13 and the update unit 14 for each j = L1-1, …, -L0.

[0050] In step S16, each secret computing device 1 k Output section 16 output merchant , …, The hidden value [ ], …, [ ].

[0051] The following describes the algorithm executed in the above implementation.

[0052] [Mathematical Expression 6]

[0053]

[0054] In the structure of the above implementation, division can be achieved through comparisons at levels L0+L1. The number of levels required for a single division is small, thus shortening the execution time, especially when division is repeatedly performed serially.

[0055] In the above embodiment, setting R=2 is equivalent to calculating division in bits. Division in bits results in a large number of comparisons. In the above embodiment, although the number of comparisons is approximately (R-1) / (log₂R) times greater than that of division in bits, the number of comparisons can be reduced to approximately 1 / (log₂R).

[0056] The embodiments of the invention have been described above. However, the specific structure is not limited to these embodiments. It goes without saying that appropriate design changes, etc., are included in the invention without departing from the spirit of the invention. The various processes described in the embodiments are not only executed sequentially in the order they are described, but can also be executed in parallel or individually depending on the processing capacity of the device executing the processes or as needed.

[0057] [Program, Recording Medium]

[0058] When implementing the various processing functions of the devices described in the above embodiments using a computer, a program records the processing content of the functions that each device should perform. Then, the program reads... Figure 4 In the storage unit 1020 of the computer shown, various processing functions of the above-mentioned devices are implemented on the computer by causing the control unit 1010, input unit 1030, output unit 1040, etc. to operate.

[0059] The program describing this processing content can be recorded on a computer-readable recording medium. Such a computer-readable recording medium can be any medium, such as a magnetic recording device, optical disc, optical-magnetic recording medium, semiconductor memory, etc.

[0060] Furthermore, the program can be distributed, for example, through the sale, transfer, or rental of removable recording media such as DVDs and CD-ROMs containing the program. Alternatively, the program can be stored in the storage device of a server computer and distributed via a network by forwarding the program from the server computer to other computers.

[0061] A computer executing such a program may first temporarily store the program recorded on a removable recording medium or the program forwarded from a server computer in its own storage device. Then, during processing, the computer reads the program stored in its own storage device and executes the processing according to the read program. Furthermore, as another method of program execution, the computer may directly read the program from the removable recording medium and execute the processing according to that program; or, each time the program is forwarded from the server computer to the computer, the processing according to the received program may be executed sequentially. Moreover, the above-mentioned processing may be performed using a so-called ASP (Application Service Provider) type service, which achieves processing functionality solely through the execution instructions and result retrieval without forwarding the program from the server computer to the computer. Furthermore, the program in this method includes information for computer processing, i.e., program-based information (data, etc., that, while not direct instructions to the computer, have the nature of specifying the computer's processing).

[0062] In addition, in this embodiment, the device is configured by executing a prescribed program on a computer, but at least a portion of these processing contents may also be implemented in hardware.

Claims

1. A secret division system, wherein R is set to an integer greater than or equal to 3, L0 and L1 are set to non-negative integers, and N is set to be greater than or equal to 0 and less than 3. Let D be a real number, and let it be a natural number. Let N be the value of each digit from the L0th decimal place to the L1th integer place in base R, and let j be each integer from L1-1 to -L0. The aforementioned secret division system comprises multiple secret computing devices and uses the hidden value of N [N] and the hidden value of D [D] to obtain the values ​​of each digit of the result of N divided by D in base R, from the L0th digit below the decimal point to the L1th digit of the integer part. The stealth value , The aforementioned secret computing device includes: Initialization part, partial remainder The stealth value Set to 0; The parallel comparison unit calculates the partial divisor n=P. j+1 R+N j The hidden value [n] is compared in parallel with the [D]×g of each integer g greater than or equal to 1 and less than R, resulting in comparisons E1, …, E R-1 The hidden value [E1], …, [E R-1 ];as well as The update section uses the comparison results E1, …, E above. R-1 The hidden value [E1], …, [E R-1 ], calculate the expression that satisfies n=DQ j +P j Q's business j The stealth value [Q] j ] and partial remainder P j The hidden value [P] j ].

2. The secret division system as described in claim 1, wherein, The parallel comparison unit described above calculates the comparison result E for g using the following formula. g The hidden value [E] g ], [Mathematical Expression 7] 。 3. The secret division system as described in claim 1 or 2, wherein, The aforementioned update department calculates the quotient Q using the following formula. j The stealth value [Q] j ], [Mathematical Expression 8] The partial remainder P is calculated using the following formula. j The hidden value [P] j ], [Mathematical Expression 9] 。 4. A secret computing device, wherein R is set to an integer greater than or equal to 3, L0 and L1 are set to non-negative integers, and N is set to be greater than or equal to 0 and less than 3. Let D be a real number, and let it be a natural number. Let N be the value of each digit from the L0th decimal place to the L1th integer place in base R, and let j be each integer from L1-1 to -L0. The aforementioned secret calculation device is used in a secret division system that uses the hidden value of N [N] and the hidden value of D [D] to obtain the values ​​of the digits of the result of N divided by D in base R, from the L0th digit below the decimal point to the L1th digit of the integer part. The stealth value , The aforementioned secret computing device includes: Initialization part, partial remainder The stealth value Set to 0; The parallel comparison unit calculates the partial divisor n=P. j+1 R+N j The hidden value [n] is compared in parallel with the [D]×g of each integer g greater than or equal to 1 and less than R, resulting in comparisons E1, …, E R-1 The hidden value [E1], …, [E R-1 ];as well as The update section uses the comparison results E1, …, E above. R-1 The hidden value [E1], …, [E R-1 ], calculate the expression that satisfies n=DQ j +P j Q's business j The stealth value [Q] j ] and partial remainder P j The hidden value [P] j ].

5. A secret division method, wherein R is set to an integer greater than or equal to 3, L0 and L1 are set to non-negative integers, and N is set to a value greater than or equal to 0 and less than 3. Let D be a real number, and let it be a natural number. Let N be the value of each digit from the L0th decimal place to the L1th integer place in base R, and let j be each integer from L1-1 to -L0. The aforementioned secret division method is executed by a secret division system, which contains multiple secret computing devices and uses the hidden value of N [N] and the hidden value of D [D] to obtain the values ​​of each digit of the result of N divided by D in base R, from the L0th digit below the decimal point to the L1th digit of the integer part. The stealth value , In the above secret division method, The initialization section of each secret computing device will have a partial remainder. The stealth value Set to 0, The divisor n=P in the parallel comparison section of each secret computing device j+1 R+N j The hidden value [n] is compared in parallel with the [D]×g of each integer g greater than or equal to 1 and less than R, resulting in comparisons E1, …, E R-1 The concealment values ​​[E1],..., [E R-1 ], The update units of each secret computing device use the above comparison results E1, …, E R-1 The hidden value [E1], …, [E R-1 ], calculate the expression that satisfies n=DQ j +P j Q's business j The stealth value [Q] j ] and partial remainder P j The hidden value [P] j ].

6. A computer program product comprising a computer program for enabling a computer to function as the secret computing device of claim 4.

Images