Secret maximum value calculation device, method and computer program product

Abstract

The secret maximum value calculation device comprises: an initialization unit (1) setting X'=X; a pair creation unit (2) creating one or more pairs from X' in such a way that no element is included in two or more pairs; a determination unit (3) determining, for each of the one or more pairs created, the number of elements [[x' included in each of the one or more pairs by secret calculation] i ]],[[x j ]]; a set updating unit (4), when there is a hidden value in X' that is not included in one or more pairs, setting a set including the hidden values ​​in X' that are not included in one or more pairs and the hidden values ​​determined by the determination unit as a new X'; a control unit (5), controlling to repeatedly perform the above-mentioned processing until |X'|=1; and a flag determination unit (6), determining the flag [[z(x i )]](i=1,…,n), so that in [[x g ]](g∈[1,n]) is the maximum value when [[z(x g )]]=[[1]], when i≠g, it is [[z(x i )]]=[[0]].

Description

Technical Field

[0001] The present invention relates to cryptographic application technology, and in particular to a method for calculating a maximum value and a flag of the maximum value without disclosing input or output. Background Art

[0002] As a method of obtaining a specific calculation result without restoring the encrypted numerical value, there is a method called secret calculation (for example, refer to non-patent document 1). In the method of non-patent document 1, encryption is performed so that fragments of the numerical value are distributed to three secret calculation devices, and the three secret calculation devices perform collaborative calculations. As a result, the results of addition and subtraction operations, constant addition operations, multiplication operations, constant multiples, logical operations ("not", "and", "or", "exclusive or"), and data format conversion (integer, binary) can be maintained in a state of being distributed to the three secret calculation devices, that is, in an encrypted state, without restoring the numerical value. In the case of calculating the maximum value and the sign of the maximum value of n encrypted values ​​by secret calculation, there is a method as follows: the current maximum value and the number of the element as the maximum value are maintained as ciphertext, and compared with n ciphertexts in sequence, the maximum value and the number of the element as the maximum value are continuously updated, and finally the sign is calculated according to the number (for example, refer to non-patent document 2).

[0003] Prior art literature

[0004] Non-patent literature

[0005] Non-patent literature 1: Koji Chida, Hiroshi Hamada, Dai Igarashi, Katsumi Takahashi, and Re-examination of the calculation of the possible 3-level secret level number, In CSS, 2010.

[0006] Non-patent literature 2: Sameer Wagh, Divya Gupta, and Nishanth Chandran. Securenn: 3-party secure computation for neural network training. Proceedings on PrivacyEnhancing Technologies, Vol.1, p.24, 2019.

[0007] Summary of the invention

[0008] Problems to be solved by the invention

[0009] However, in the conventional method, although the total number of comparisons when calculating the maximum value is Θ(n), the number of comparison levels is as large as Θ(n).

[0010] An object of the present invention is to provide a secret maximum value calculation device, method and program that reduce processing time.

[0011] Means for solving problems

[0012] A secret maximum value calculation device according to one embodiment of the present invention comprises: an initialization unit, which sets X = {[[x1]], [[x2]], ..., [[x n ]]}, assuming X′=X; a pair creation unit, creating one or more pairs from X′ in such a way that no element in X′ is included in the two or more pairs; a determination unit, for each of the one or more pairs created, determining by secret calculation the number of [[x i ]],[[x j [[z(x]], a set updating unit, which sets a set including the hidden values ​​in X' that are not included in one or more pairs and the hidden values ​​determined by the determining unit as a new X', when there is a hidden value in X' that is not included in one or more pairs; a control unit, which controls so that the processing of the pair creating unit, the determining unit, and the set updating unit that sets the new X' as X' is repeatedly performed until |X'|=1; and a flag determining unit, which sets the hidden value of the only element of X' that has |X'|=1 as the maximum value, and determines the flag [[z(x]], a set updating unit, which sets the hidden value in X' that is not included in one or more pairs as a new X', and the set updating unit; i )]](i=1,…,n), so that in [[x g ]](g∈[1,n]) is the maximum value when [[z(x g )]]=[[1]], when i≠g, it is [[z(x i )]]=[[0]].

[0013] Effects of the Invention

[0014] Can reduce processing time. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a diagram showing an example of the functional structure of a secret maximum value calculation device.

[0016] Figure 2 This is a diagram showing an example of the processing steps of the secret maximum value calculation method.

[0017] Figure 3 This is a diagram showing an example of a functional configuration of a computer. DETAILED DESCRIPTION

[0018] Hereinafter, the embodiments of the present invention will be described in detail. In addition, in the drawings, the same reference numerals are given to components having the same functions, and repeated descriptions are omitted.

[0019] [Notation]

[0020] The value obtained by obscuring a certain value a through encryption or secret sharing, etc., is called the obscured value of a, denoted as [[a]]. In the case where the obscuring is secret sharing, [[a]] refers to the set of fragments of the secret sharing held by each secret computing device.

[0021] <Decoding>

[0022] The process of taking the obscured value [[a]] of a as input and calculating the value c such that c = a is denoted as c ← Open([[a]]).

[0023] <Arithmetic Operations>

[0024] For addition, subtraction, and multiplication operations, the obscured values [[a]] and [[b]] of two values a and b are taken as input, and the obscured values [[c1]], [[c2]], and [[c3]] of the calculation results c1 = a + b, c2 = a - b, and c3 = ab are calculated respectively. The execution of these operations is denoted as follows:

[0025] [[c1]] ← Add([[a]], [[b]])

[0026] [[c2]] ← Sub([[a]], [[b]])

[0027] [[c3]] ← Mul([[a]], [[b]]).

[0028] When there is no concern about causing misunderstanding, Add([[a]], [[b]]), Sub([[a]], [[b]]), and Mul([[a]], [[b]]) are abbreviated as [[a]] + [[b]], [[a]] - [[b]], and [[a]] × [[b]] respectively.

[0029] <Comparison>

[0030] The comparison operation takes the obscured values [[a]] and [[b]] of two values a and b as input, and calculates the obscured values [[c1]], [[c2]], and [[c3]] of the truth values c ∈ {0, 1} of a = b, a ≤ b, and a < b. Regarding the truth values, 1 is set when it is true and 0 when it is false. The execution of this operation is denoted as:

[0031] [[c0]] ← EQ([[a]], [[b]])

[0032] [[c1]] ← LE([[a]], [[b]])

[0033] [[c2]] ← LT([[a]], [[b]]).

[0034] <Select>

[0035] The operation of selection takes as input the hidden value [[c]] of the truth value c∈{0,1} and the hidden values ​​[[a]] and [[b]] ​​of two values, a and b, and calculates the hidden value [[d]] of d that satisfies the following mathematical formula 1.

[0036] [Mathematical formula 1]

[0037]

[0038] The execution of this operation is described as:

[0039] [[d]]←IfElse([[c]],[[a]],[[b]]).

[0040] This operation can be realized by [[d]]←[[c]]×([[a]]-[[b]])+[[b]].

[0041] [Secret maximum value calculation device and method]

[0042] like Figure 1 As shown, the secret maximum value calculation device includes, for example, an initialization unit 1, a pair creation unit 2, a determination unit 3, a set update unit 4, a control unit 5, and a flag determination unit 6.

[0043] The secret maximum value calculation method is performed by, for example, each component of the secret maximum value calculation device as follows and Figure 2 The processing of steps S1 to S6 shown is implemented.

[0044] The following describes the various components of the secret maximum value calculation device.

[0045] <Initialization Section 1>

[0046] Initialization unit 1 receives input X={[[x1]],[[x2]],...,[[x n ]]}. n is a predetermined positive integer greater than or equal to 2. For example, n≥4.

[0047] The initialization unit 1 initializes the set X' by setting X'=X (step S1).

[0048] The initialized X′ is output to the pair creation unit 2 .

[0049] <To Creation Section 2>

[0050] X' initialized by the initialization unit 1 is input to the creation unit 2. In the second and subsequent processing of the creation unit 2, X' updated by the set update unit 4 is input.

[0051] The pair creation unit 2 creates one or more pairs from the input X′ so that no element in X′ is included in two or more pairs (step S2 ).

[0052] The created one or more pairs are output to the determination unit 3 . If there is a secret value in X′ that is not included in one or more pairs, the secret value in X′ that is not included in the one or more pairs is output to the set updating unit 4 .

[0053] For example, the pair creation unit 2 creates two or more pairs at least once. When n≥4, calculation can be performed by comparison of n-2 or less levels.

[0054] <Decision Section 3>

[0055] One or more pairs created by the pair creating unit 2 are input to the determining unit 3 .

[0056] For each of the one or more pairs created, the determination unit 3 determines [[x i ]],[[x j ]], the hidden value with a larger value with respect to the order R (step S3).

[0057] The determined larger concealment value is output to the set updating unit 4 .

[0058] <Collection Update Section 4>

[0059] The set updating unit 4 receives the larger secret value determined by the determining unit 3. If there is a secret value in X′ that is not included in one or more pairs, the secret value in X′ that is not included in the one or more pairs is input to the set updating unit 4.

[0060] If there is a secret value in X' that is not included in one or more pairs, the set updating unit 4 sets a set including the secret values ​​in X' that are not included in one or more pairs and the secret values ​​determined by the determining unit 3 as a new X' (step S4).

[0061] <Control Unit 5>

[0062] The control unit 5 controls the creation unit 2, the determination unit 3, and the set updating unit 4 to repeat the processing using the new X' generated by the set updating unit 4 as X' until |X'|=1 (step S5).

[0063] Here, |X′| is the number of elements contained in the set X′.

[0064] X′, which is |X′|=1, is output to the flag determination unit 6 .

[0065] <Flag determination unit 6>

[0066] X′, which is |X′|=1, is input to the flag determination unit 6 .

[0067] The flag determination unit 6 determines the flag [[z(x i )]](i=1,…,n), so that in [[x g ]](g∈[1,n]) is the maximum value when [[z(x g )]]=[[1]], when i≠g, it is [[z(x i )]]=[[0]](step S6).

[0068] For example, the flag determination unit 6 determines whether X′ contains even one [x i ] Perform the following (a) and (b) to determine the flag [[z(x i )]]. Flags[[z(x i )]] is calculated in the reverse order of the calculation order of the creation unit 2, the determination unit 3, the set updating unit 4 and the control unit 5.

[0069] (a) The flag determination unit 6 is in [[x i ]] is [[x g ]], set to [[z(x g )]]=[[1]].

[0070] (b) The flag determination unit 6 is in [[x k ]] is through [[x i ]] and [[x j ]], and [[z(x k )]] After the calculation is completed, use [[x i ]] and [[x j ]] and the comparison results of [[z(x k )]], calculate so that for [[x i ]] and [[x j ]]Zhongda's side[[x + ]] and becomes [[z(x + )]]=[[x k ]], for the smaller party [[x - ]] and becomes [[z(x - )]]=[[0]].

[0071] In the conventional method, since the maximum value is successively updated from the set of hidden values while maintaining the maximum value, the number of comparison levels becomes Θ(n). On the other hand, as in the above-described embodiment, by recursively calculating the maximum value while exponentially reducing the problem, the number of comparison levels can be made smaller.

[0072] Specifically, when calculating the hidden value of the maximum value and the hidden value of the flag indicating whether it is the maximum value from the set of hidden values of size n, in the conventional method, the number of comparison levels becomes Θ(n), but by appropriately selecting the order of comparison, it is possible to reduce the number of comparison levels while keeping the total number of comparisons at Θ(n).

[0073] [Example of algorithm]

[0074] Hereinafter, an example of an algorithm implemented by the above-described secret maximum value calculation device and method will be described. In this algorithm, when creating pairs, └|X′| / 2┘ pairs are created. Also, └|X′| / 2┘ is the largest integer less than or equal to |X′| / 2. By this algorithm, the number of comparison levels can be asymptotically set to O(log n) with respect to n.

[0075] Input: X = {[[x1]],..., [[x n}

[0076] Output: [[y]], [[z(x1)]],..., [[z(x n )]]

[0077] Notation: [[y]], [[z(x1)]],..., [[z(x n )]] ← f([[x1]],..., [[x n )

[0078] (1) If n = 1, then return [[y]] = [[x1]], [[z(x1)]] = [[1]] and end.

[0079] (2) If n is a multiple of 2, then execute the following (2-a) to (2-f).

[0080] (2-a) h ← n / 2

[0081] (2-b) [[f i ← LE([[x i , [[x i+h )(i ∈ [1, h])

[0082] (2-c) [[m i ← IfElse([[f i , [[xi+h ]],[[x i ]])(i∈[1,h])

[0083] (2-d)[[y]],[[z(m1)]],...,[[z(m h )]]←f([[m1]],...,[[m h ]])

[0084] (2-e)[[z(x i )]]←[[z(m i )]]×(1-[[f i ]])(i∈[1,h])

[0085] (2-f)[[z(x i+h )]]←[[z(m i )]]×[[f i ]](i∈[1,h])

[0086] (3) If n is not a multiple of 2, execute the following.

[0087] (3-a)h←(n-1) / 2

[0088] (3-b)[[f i ]]←LE([[x i ]],[[x i+h ]])(i∈[1,h])

[0089] (3-c)[[m i ]]←IfElse([[f i ]],[[x i+h ]],[[x i ]])(i∈[1,h])

[0090] (3-d)[[m h+1 ]]←[[x n ]]

[0091] (3-e)[[y]],[[z(m1)]],...,[[z(m h )]],[[z(m h+1 )]]←f([[m1]],...,[[m h+1 ]])

[0092] (3-f)[[z(x i )]]←[[z(m i )]]×(1-[[f i ]])(i∈[1,h])

[0093] (3-g)[[z(xi+h )]]←[[z(m i )]]×[[f i ]](i∈[1,h])

[0094] (3-h)[[z(x n )]]←[[z(m h+1 )]]

[0095] In (2-b), (2-c), (3-b), (3-c), [[x i ]],[[x i+h Although not explicitly described in the above algorithm, the creation of this pair corresponds to the processing of the pair creation unit 2.

[0096] (2-b), (2-c), (3-b), and (3-c) correspond to the processing of determination unit 3.

[0097] In (2-d), for the new set [[m1]],...,[[m h ]]The algorithm is performed recursively. The new set [[m1]],...,[[m h ]] corresponds to X′. The new set X′=[[m1]],...,[[m h The decision of ]] corresponds to the processing of the set updating unit 4.

[0098] Similarly, in (3-d) and (3-e), for the new set [[m1]],...,[[m h+1 ]]The algorithm is performed recursively. The new set [[m1]],...,[[m h+1 ]] is X′. The new set X′=[[m1]],...,[[m h+1 The decision of ]] corresponds to the processing of the set updating unit 4.

[0099] In addition, the part in which the algorithm is recursively performed in (2-d) and (3-e) corresponds to the processing of the control unit 5.

[0100] (3-f), (3-g), and (3-h) correspond to the processing of the flag determination unit 6.

[0101] [Modifications]

[0102] Although the embodiments of the present invention have been described above, the specific configuration is not limited to these embodiments, and appropriate design changes and the like are naturally included in the present invention without departing from the gist of the present invention.

[0103] The various processes described in the embodiments may be executed not only in time series according to the order described but also in parallel or individually according to the processing capability or need of a device executing the processes.

[0104] For example, data exchange between components of the secret maximum value calculation device may be performed directly or via a storage unit (not shown).

[0105] [Program, recording medium]

[0106] When the various processing functions in the above-described devices are implemented by a computer, the processing contents of the functions that each device should have are described by a program. Then, by executing the program on the computer, the various processing functions in the above-described devices are implemented on the computer. For example, the above-described various processing functions can be implemented by having the program to be executed read into a computer. Figure 3 The recording unit 2020 of the computer shown is implemented by operating the control unit 2010, the input unit 2030, the output unit 2040, etc.

[0107] The program describing the processing contents can be recorded in a computer-readable recording medium. The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory.

[0108] In addition, the program can be circulated by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM on which the program is recorded. Furthermore, the program can also be stored in a storage device of a server computer and forwarded from the server computer to other computers via a network, thereby circulating the program.

[0109] The computer executing such a program, for example, first temporarily stores the program stored in a portable recording medium or the program forwarded from a server computer in its own storage device. Then, when executing the process, the computer reads the program stored in its own storage device and executes the process according to the read program. In addition, as another execution mode of the program, the computer can also directly read the program from the portable storage medium and execute the process according to the program, and can also execute the process according to the received program in sequence whenever the program is forwarded from the server computer to the computer. In addition, it can also be configured so that the program is not forwarded from the server computer to the computer, but the processing function is realized only by the execution instruction and the result acquisition, that is, the above-mentioned process is executed by the so-called ASP (Application Service Provider, Application Service Provider) type service. In addition, in the program of this method, it is set to include information used for the processing of the electronic computer and information in accordance with the program (not a direct instruction to the computer, but data with the nature of the processing of the computer, etc.).

[0110] In this embodiment, the present device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized only on hardware.

[0111] Description of symbols

[0112] 1 Initialization section

[0113] 2 pairs of creation department

[0114] 3Decision Department

[0115] 4Collection Update Department

[0116] 5. Control Unit

[0117] 6. Mark determination department.

Claims

1. A secret maximum value calculation device, comprising: Initialization part, set X = {[[x1]], [[x2]], ..., [[x n ]]}, let X′=X; A pair creating unit creates one or more pairs from X′ in such a way that no element in X′ is included in two or more pairs; The determination unit determines, for each of the one or more pairs created, by secret calculation, the [[x i ]],[[x j ]], the larger hidden value; a set updating unit that, when there is a hidden value in X′ that is not included in the one or more pairs, sets a set including the hidden value in X′ that is not included in the one or more pairs and the hidden value determined by the determining unit as a new X′; a control unit that controls so that the pair creation unit, the determination unit, and the set update unit repeatedly perform processing of setting the new X′ to X′ until |X′|=1, where |X′| is the number of elements included in the set X′; and The flag determination unit sets the hidden value of the only element of X′ where |X′|=1 to the maximum value, and determines the flag [[z(x i )]], so that in [[x g ]] is the maximum value when [[z(x g )]]=[[1]], when i≠g, it is [[z(x i )]]=[[0]], where i=1,…,n, g∈[1,n].

2. A secret maximum value calculation method, comprising: Initialization step, the initialization part is set to X = {[[x1]], [[x2]], ..., [[x n ]]}, let X′=X; a pair creation step, wherein the pair creation unit creates one or more pairs from X′ in such a way that no element in X′ is included in the two or more pairs; The determination step includes determining, for each of the one or more pairs created, the [[x i ]],[[x j ]], the larger hidden value; a set updating step, in which, when there is a hidden value in X′ that is not included in the one or more pairs, the set updating unit sets a set including the hidden value in X′ that is not included in the one or more pairs and the hidden value determined by the determination unit as a new X′; a control step, wherein the control unit controls so that the processing of the pair creation unit, the determination unit, and the set updating unit of setting the new X′ to X′ is repeated until |X′|=1, wherein |X′| is the number of elements included in the set X′; and In the flag determination step, the flag determination unit sets the hidden value of the only element of X′ where |X′|=1 to the maximum value, and determines the flag [[z(x i )]], so that in [[x g ]] is the maximum value when [[z(x g )]]=[[1]], when i≠g, it is [[z(x i )]]=[[0]], where i=1,…,n, g∈[1,n].

3. A computer program product, comprising a computer program for causing a computer to function as each part of the secret maximum value calculation device of claim 1.

Images