Secret reciprocal calculation system, secret normalization system, their methods, secret calculation device and computer program product

Abstract

在秘密计算中以高精度进行归一化。秘密倒数计算系统(100)将[a]作为输入，计算[1 / a]。比特分解部(11)生成a的比特表现{a0},…,{aλ‑1}。标志串生成部(12)生成表示{a0},…,{aλ‑1}的最左比特的{x0},…,{xλ‑1}。比特串生成部(13)生成成为{y0},{y1}:＝{0}、{yi}:＝{(￢ai‑2∧xi‑1)XORxi}(2≤i<λ)、{yλ}:＝{￢aλ‑2∧xλ‑1}的{y0},…,{yλ}。归一化乘数生成部(14)生成对{yλ},…,{y0}进行比特结合而得的[c]。归一化部(15)计算[b]:＝[a][c]。

Description

Technical Field

[0001] The present invention relates to a technique for calculating reciprocals in secure computation. Background Art

[0002] So-called secure computation is an encryption technique for calculating an arbitrary function while keeping data concealed. It is expected to effectively utilize this feature to achieve a data utilization method that does not leak data for system operators and data users. There are several methods in secure computation, among which a method that divides a secret into components is known to have a small data processing unit and enable high-speed processing.

[0003] So-called secret sharing is a method of transforming a secret message into several pieces called shares. For example, there is a (k, n) threshold secret sharing, in which n shares are generated from a secret message, the secret can be recovered from k or more shares, and the secret message is not leaked from less than k shares. Specific construction methods of secret sharing are known, such as Shamir secret sharing or replicated secret sharing. In this specification, one piece of a value scattered by secret sharing is called a "share". In addition, the entire set of all shares is called a "scattered value".

[0004] In recent years, research on advanced statistics and machine learning based on secure computation has been prevalent. However, most of these operations involve calculations such as reciprocals, square roots, exponents, and logarithms, which are beyond the addition, subtraction, and multiplication operations that secure computation is good at. The calculation of reciprocals is one of the basic operations in computers and is used in various situations. In Non-Patent Document 1, a method for calculating reciprocals in secure computation is disclosed. In addition, in various function calculations involving reciprocals, it is sometimes necessary to perform normalization to converge the numerical value within a certain range. In secure computation, the normalization of a numerical value is performed by shifting the leftmost bit (most significant bit: msb).

[0005] Prior Art Documents

[0006] Non-Patent Documents

[0007] Non-Patent Document 1: Ohkura Daisuke, "Design and Implementation of Secure Real Number Operation Group for Implementing Secure Computation AI - Right Shift for Real Numbers with O(|p|) Bit Communication Volume and O(1) Rounds", CSS2019, 2019 Summary of the Invention

[0008] Problems to be Solved by the Invention

[0009] However, in the prior art, there is a problem that the approximation accuracy during normalization in secure computation is insufficient.

[0010] In view of the above-mentioned technical problems, an object of the present invention is to provide a secret computing technology that can perform normalization with high precision.

[0011] Means for solving problems

[0012] In order to solve the above-mentioned problem, a first embodiment of a secret inverse calculation system of the present invention includes a plurality of secret calculation devices, and takes a dispersed value [a] of a value a as input, and calculates a dispersed value [1 / a] of the inverse of the value a, wherein λ is the decimal point position of the value a, and the secret calculation device includes: a bit decomposition unit, which generates a bit representation a0, ..., a of the value a according to the dispersed value [a]. λ-1 The string of discrete values ​​{a0},…,{a λ-1}; A flag string generation unit generates a string {a0}, ..., {a λ-1} the leftmost bit of the string x0,…,x λ-1 The string of discrete values ​​{x0},…,{x λ-1}; Bit string generation unit, generates bit string y0,…,y λ The string of discrete values ​​{y0},…,{y λ}, where {y0}, {y1} are scattered values ​​of 0, {y2},…, {y λ-1} is an integer greater than or equal to 2 and less than λ, and the calculated scattered value {a i-2} and the logical NOT of the scattered value {x i-1}, and the result obtained by the logical product of the scattered value {x i} is a discrete value of the value obtained by performing a logical XOR calculation, {y λ} is to calculate the scattered value {a λ-2} and the logical NOT of the scattered value {x λ-1}; a normalization multiplier generation unit generates a string of scattered values ​​{y0},…,{y λ a distributed value [c] of a normalized multiplier c obtained by combining the bits in reverse order; a normalization unit that calculates a distributed value [b] obtained by multiplying the distributed value [a] and the distributed value [c]; an inverse calculation unit that uses the distributed value [b] to obtain a distributed value [w] obtained by calculating [1 / b]; and an inverse normalization unit that calculates a distributed value [1 / a] obtained by multiplying the distributed value [w] and the distributed value [c].

[0013] The second method of the present invention is a secret normalization system, which includes a plurality of secret computing devices, and normalizes the dispersed value [a] of the value a, wherein λ is the decimal point position of the value a, and the secret computing device includes: a bit decomposition unit, which generates a bit representation a0, ..., a of the value a according to the dispersed value [a] λ-1 The string of discrete values ​​{a0},…,{a λ-1}; a marker string generation unit generates a string representing a distributed value {a0}, ..., {a λ-1} the leftmost bit of the string x0,…,x λ-1 The string of discrete values ​​{x0},…,{x λ-1}; Bit string generation unit, generates bit string y0,…,y λ The string of discrete values ​​{y0},…,{y λ}, where {y0}, {y1} are scattered values ​​of 0, {y2},…, {y λ-1} is an integer greater than or equal to 2 and less than λ, and the calculated scattered value {a i-2} and the logical NOT of the scattered value {x i-1}, and the result obtained by the logical product of the scattered value {x i} is a discrete value obtained by performing a logical XOR calculation on {y λ} is to calculate the scattered value {a λ-2} and the logical NOT of the scattered value {x λ-1}; a normalization multiplier generation unit generates a string of scattered values ​​{y0},…,{y λ} A distributed value [c] of the normalized multiplier c obtained by combining the bits in reverse order; and a normalization unit that calculates a distributed value [b] obtained by multiplying the distributed value [a] and the distributed value [c].

[0014] Effects of the Invention

[0015] According to the present invention, normalization can be performed with high accuracy in secret computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a diagram illustrating the functional structure of a secret reciprocal calculation system.

[0017] Figure 2 This is a diagram illustrating the functional structure of a secure computing device.

[0018] Figure 3 It is a diagram illustrating the functional configuration of the inverse number calculation unit.

[0019] Figure 4 This is a diagram illustrating the processing procedure of the secret reciprocal calculation method.

[0020] Figure 5 This is a diagram illustrating the processing procedure of the inverse number calculation unit.

[0021] Figure 6 This is a diagram illustrating a functional structure of a computer. DETAILED DESCRIPTION

[0022] Hereinafter, the embodiments of the present invention will be described in detail. In the drawings, components having the same functions are denoted by the same reference numerals, and repeated descriptions are omitted.

[0023] In this specification, the following notations are used.

[0024] [·] is data obtained by anonymizing the numerical value. For example, a distributed value such as Shamir's secret distribution or copied secret distribution can be used.

[0025] {·} is data obtained by hiding the bit·. For example, a distributed value such as a copy secret distribution on Z2 can be used.

[0026] λ represents the decimal point position. It is assumed that the number of bits of the ring or field used in the secret calculation is about half of |p|.

[0027] Regarding [a? b:c], if a=1, then [a? b:c] represents b, and if a=0, then [a? b:c] represents c.

[0028]

Mathematical formula 1

[0029]

[0030] They represent logical NOT (NOT), logical product (AND), logical sum (OR), and logical exclusive OR (XOR) respectively.

[0031] By determining the decimal point position for the integers on the ring, it can be regarded as a fixed-point real number. In the present invention, such a fixed-point real number represented on the ring is simply denoted as a real number.

[0032] [Implementation method: Secret countdown calculation system]

[0033] The embodiment of the present invention is a secret reciprocal calculation system and method that takes a dispersed value [a] of a value a as input and calculates a dispersed value [1 / a] of the reciprocal of the value a while keeping the value a hidden. The following is an overview of the reciprocal protocol executed by the secret reciprocal calculation system of the embodiment.

[0034] In the past, in secret computing, the processing cost of elementary function groups such as reciprocals, square roots, exponential functions, and logarithmic functions that exceed addition, subtraction, and multiplication operations was high and was not implemented. In the present invention, in order to solve these problems, an algorithm that can efficiently and uniformly approximate the elementary function group in secret computing is used, and the reciprocal can be efficiently calculated. This approximation method can approximate the main elementary functions including the reciprocal by only changing the parameters in a single method. Moreover, this approximation method is the communication volume / number of cycles of three real number multiplications in single precision (23 bits), which is the theoretically optimal efficiency.

[0035] The reciprocal is an obvious component of the division operation. The division operation is well known as a function that is frequently used but slow in processing plain text. In order to perform the calculation efficiently, the following normalization is sometimes performed in the reciprocal calculation of plain text. The decimal point of the input a is 0.5 (i.e., 2 -1 ) and the leftmost bit (MSB: most significant bit) of input a is set to e, and the following transformation is performed. That is, multiply by 2 e Normalized to the interval [0.5,1), find the reciprocal 1 / 2 e a, multiply by 2 e .

[0036]

Mathematical formula 2

[0037]

[0038] In the reciprocal, in the normalization to the standard [0.5,1), the accuracy is about 21 bits through the 8th-order polynomial approximation. Since 23 bits of accuracy are generally required in single precision, it is necessary to introduce a technology to further improve the accuracy. Usually, the leftmost bit is moved to normalize to [0.5,1), but then if the next bit of the leftmost bit is 0 (that is, if the value is [0.5,0.75), it is multiplied by 1.5. Therefore, since [0.5,0.75) is moved to [0.75,1.125), if it is [0.75,1), no action is performed, and it is normalized to [0.75,1.125). [0.75,1.125) is a narrower interval than [0.5,1), so it is an effective technology in the interpolation polynomial approximation that the narrower the approximation interval, the higher the accuracy. In fact, the approximation accuracy exceeds 23 bits through this technology. On the other hand, since the processing cost of implementing this technology is about the communication volume λ (≒|p| / 2) and the number of loops 2, it is more efficient than adding one real number multiplication operation (communication volume 8 / 3*|p|, number of loops 3).

[0039] The following represents an algorithm for approximating the set of elementary functions on secret computations with an 8th degree polynomial.

[0040] [Algorithm 1: Function approximation protocol based on 8th degree polynomial]

[0041] Input: [x]∈[L,R)

[0042] Parameters: a, b, c, d, f, g, H, i, j, k, l, m, n, o, p, q, α, β, γ, δ, ζ

[0043] Output: [func(x)] corresponding to the target function func

[0044] 1: Calculate [y']: = [x(δx+ai)-j] by sum of products, and lower the decimal point by right shifting.

[0045] 2: Calculate [y]: = [y'+(ix+j)].

[0046] 3: Calculate [z']: = [y(ζy+bk)+(cl)xm] by product-sum, and lower the decimal point position by right shifting.

[0047] 4: Calculate [z]: = [z' + (ky + lx + m)].

[0048] 5: Calculate [w' / γ] by product sum: = [z(αz+dn / γ)+(βx+fo / γ)y+(gp)x+(Hq) / γ], and perform multiplication based on γ and reduction of the decimal point to obtain [w'].

[0049] 6: Output [w]: = [w' + (nz + oy + px + q)].

[0050] The decimal point drop performed in steps 1 and 3 of Algorithm 1 can be efficiently performed by using the public divisor division disclosed in Non-Patent Document 1, for example.

[0051] The simultaneous execution of the public value multiplication and the decimal point reduction performed in step 5 of Algorithm 1 can be performed efficiently by using the following algorithm, for example.

[0052] [Algorithm 2: Starting from right shift, multiplying the public value simultaneously without increasing the processing cost]

[0053] Input: [x], multiplier m, shift amount σ

[0054] Output: shifted [mx]

[0055] 1: Calculate the public value 2 σ / m.

[0056] 2: Calculate the following expression by public value division. Here, [mx] is regarded as the expression with the decimal point position lower than [x] by σ.

[0057]

Mathematical formula 3

[0058]

[0059] The parameters L, R, a, b, c, d, f, g, H, i, j, k, l, m, n, o, p, q, α, β, γ, δ, ζ used in Algorithm 1 are set according to the approximated function func. When approximating the reciprocal function used as the object of the present invention, the parameters can be set as shown in the following table. In addition, e x ,e y ,e z ,e w is the decimal point position of x, y, z, w, e′ y ,e′ z ,e′ w is the decimal point position of y', z', and w'. These are the parameters that determine the right shift amount in the 8th degree polynomial approximation. For example, the right shift amount when calculating y from y' is e' y -e y .

[0060]

Table 1

[0061]

[0062] The following is an algorithm for calculating the inverse of a secret calculation using Algorithm 1. Here, the algorithm for normalizing the input to be calculated to calculate the inverse (Algorithm 3) and the algorithm for calculating the inverse using the algorithm (Algorithm 4) are described separately.

[0063] [Algorithm 3: Normalization protocol for inverse calculation]

[0064] Input: [a]

[0065] Output: [b], [c] (where b is the value obtained by moving the leftmost bit of a to the decimal point position λ and multiplying it by 1.5 if the bit below the leftmost bit of a is 0 (i.e., if the decimal point position is set to λ+1, a is normalized to [0.75, 1.125)). c is the number used in normalization and its inverse operation, satisfying b = ac.)

[0066] 1: The bit representation of [a] is obtained by bit decomposition {a0},…,{aλ-1}.

[0067] 2: Get the bit string {x0},…,{x0} where only the leftmost bit of a is 1 λ-1}.

[0068] 3: In 2≤i<λ, {yi} is set by the following formula.

[0069]

Mathematical formula 4

[0070]

[0071] 4: Set {y0}, {y1}, {y λ}.

[0072]

Mathematical formula 5

[0073] {y0}:={y1}:={0}

[0074]

[0075] If the input bit of the lower bit of the MSB is 1, the y of the upper bit of the MSB i 1. In order to perform upside-down inversion in the next step, combine y i Set by reversing upside down.

[0076] 5: Use bit combination to convert {y λ},…,{y0} are combined as [c].

[0077] c is a value obtained by moving the MSB of a to a certain position and then multiplying by 1.5 if the bit next to the MSB is 0. Note that it is a fixed point with a decimal point at 1.

[0078] 6: Calculate [b]:=[a][c], output [b], [c].

[0079] [Algorithm 4: Countdown Protocol]

[0080] Input: [a]

[0081] Output: [1 / a]

[0082] 1: Through Algorithm 3, we obtain the value [b] obtained by normalizing [a] to [0.75, 1.125) and the value [c] obtained by multiplying for normalization.

[0083] 2: Execute Algorithm 1 on [b] to calculate the reciprocal of [b]. Set the result to [w].

[0084] 3: Calculate [w][c].

[0085] The generation of the flag string representing the leftmost bit performed in step 2 of Algorithm 3 can be performed efficiently by using the following algorithm, for example.

[0086] [Algorithm 5: MSB flag string acquisition protocol]

[0087] Input: integers represented by bits {a0},…,{a λ-1}

[0088] Output: A bit string {x0},...,{x λ-1}

[0089] 1: In 0≤i<λ-1, let {f i}:={f i+1 ∨a i}.

[0090] 2: Set {f λ-1}:={a λ-1}. So far, {f0},…,{f λ-1} becomes a bit string with 01 arranged with MSB as the boundary, such as 0,0,0,1,1,1,…,1.

[0091] 3: When 0≤i<λ-1, set {x i}:={f i XOR f i+1}.

[0092] 4: Set {x λ-1}:={a λ-1}. So far, {x0},…,{x λ-1} becomes a bit string such as 0,0,0,1,0,0,…,0 where only the MSB position is 1.

[0093] <Secret Countdown Calculation System 100>

[0094] The inverse calculation system 100 of the embodiment is an information processing system that executes the inverse protocol. Figure 1 As shown, the secret inverse calculation system 100 includes N (≥3) secret calculation devices 11, ..., 1 N In this embodiment, the secret computing devices 11, ..., 1 NEach of the devices is connected to a communication network 9. The communication network 9 is a circuit switching or packet switching communication network configured so that each connected device can communicate with each other, such as the Internet, LAN (Local Area Network), WAN (Wide Area Network), etc. In addition, each device does not necessarily have to be able to communicate online via the communication network 9. For example, it can also be configured to send a signal to the secure computing device 1. n The input information (n=1, ..., N) is stored in a removable recording medium such as a magnetic tape or a USB memory, and is transmitted from the removable recording medium to the secure computing device 1. n Enter in offline mode.

[0095] The secure computing device 1 included in the secure inverse computing system 100 of the embodiment n For example Figure 2 As shown in FIG. 1 , the system includes a bit decomposition unit 11, a flag sequence generation unit 12, a bit sequence generation unit 13, a normalization multiplier generation unit 14, a normalization unit 15, an inverse calculation unit 16, and an inverse normalization unit 17. The inverse calculation unit 16 is, for example, Figure 3 As shown, the secure computing device 1 includes a parameter storage unit 160, a first product-sum unit 161, a first adding unit 162, a second product-sum unit 163, a second adding unit 164, a third product-sum unit 165, a public value multiplication unit 166, and a third adding unit 167. n With other confidential computing devices1 n′ (n'=1, ..., N, where n≠n') cooperates with each other and performs the processing of each step described later, thereby realizing the secret reciprocal calculation method of the implementation method.

[0096] Secret computing device 1 n It is a special device that is configured by reading a special program into a known or special computer having a central processing unit (CPU) and a main storage device (RAM) etc. n For example, each process is executed under the control of a central processing unit. n The data and the data obtained through each process are stored in a main storage device, for example. The data stored in the main storage device is read out to the central processing unit as needed for other processing. n At least a part of each processing unit may also be constituted by hardware such as an integrated circuit. nEach storage unit may be composed of, for example, a main storage device such as RAM (Random Access Memory), an auxiliary storage device composed of a semiconductor storage element such as a hard disk, an optical disk or a flash memory, or middleware such as a relational database or a key value store.

[0097] Reference Figure 4 , describing the processing procedure of the secret inverse number calculation method executed by the secret inverse number calculation system 100 of the implementation mode.

[0098] In step S11, each secure computing device 1 n The bit decomposition unit 11 performs bit decomposition on the distributed value [a] of the value a input to the secret inverse calculation system 100 to obtain a string {a0}, ..., {a λ-1 The bit decomposition unit 11 converts the string of distributed values ​​{a0},...,{a λ-1} is output to the flag string generation unit 12 and the bit string generation unit 13.

[0099] In step S12, each secure computing device 1 n The marker string generation unit 12 uses the scattered value string {a0}, ..., {a λ-1}, generate the string x0,…,x representing the leftmost bit of the value a λ-1 The string of discrete values ​​{x0},…,{x λ-1 The flag string indicating the leftmost bit is, for example, a flag string obtained by using the above-mentioned algorithm 5 in which only the leftmost bit position is 1. The flag string generation unit 12 outputs the distributed value string {x0}, ..., {x λ-1}.

[0100] In step S13, each secure computing device 1 n The bit string generation unit 13 uses the sequence of distributed values ​​{a0}, ..., {a λ-1} and the string of discrete values ​​{x0},…,{x λ-1}, generate the bit string y0,…,y λ The string of discrete values ​​{y0},…,{y λ Specifically, first, {y0}, {y1} are set to {0}. Then, for each integer i greater than 2 and less than λ, calculate That is, {y2},…,{y λ-1} is to calculate the scattered value {a i-2} and the logical NOT of the scattered value {x i-1} and calculate the logical product of the result and the scattered value {x i} is the result of the logical exclusive OR of That is, {y λ} is to calculate the scattered value {a λ-2} and the logical NOT of the scattered value {x λ-1 The bit string generation unit 13 outputs the sequence of scattered values ​​{y0}, ..., {y λ}.

[0101] In step S14, each secure computing device 1 n The normalized multiplier generation unit 14 generates the scattered value string {y0}, ..., {y λ The bits are combined in reverse order to generate a distributed value [c] of a multiplier c (hereinafter also referred to as a “normalization multiplier”) to be multiplied by the calculation result in order to calculate normalization and its inverse operation. The normalization multiplier generation unit 14 outputs the distributed value [c] to the normalization unit 15.

[0102] In step S15, each secure computing device 1 n The normalization unit 15 calculates a variance value [b] of a value b obtained by normalizing the value a by multiplying the variance value [a] of the value a by the variance value [c] of the normalization multiplier c. The normalization unit 15 outputs the variance value [b] to the inverse calculation unit 16 .

[0103] In step S16, each secure computing device 1 n The reciprocal calculation unit 16 executes Algorithm 1 by using parameters approximating the reciprocal function with an 8th-degree polynomial, calculates the reciprocal of the scattered value [b] of the value b, and generates a scattered value [w] of the calculation result w. The reciprocal calculation unit 16 outputs the scattered value [w] to the inverse normalization unit 17.

[0104] In step S17, each secure computing device 1 n The denormalization unit 17 multiplies the variance value [w] of the calculation result w by the variance value [c] of the normalization multiplier c, and outputs the result as a variance value [1 / a] which is the inverse of the value a.

[0105] Reference Figure 5 , the processing procedure performed by the inverse calculation unit 16 is described in detail.

[0106] The parameter storage unit 160 stores parameters a, b, c, d, f, g, H, i, j, k, l, m, n, o, p, q, α, β, γ, δ, ζ for approximating the reciprocal function with an 8th-degree polynomial. Each parameter is predetermined according to the function to be approximated, and when the reciprocal function is approximated, the values ​​shown in Table 1 may be set.

[0107] In step S161, the first product-sum unit 161 of the inverse calculation unit 16 calculates [y′]:=[x(δx+ai)-j] by product-sum, and lowers the decimal point position by right shifting. Here, x is the value b obtained by normalizing the value a. That is, [x]:=[b]. The first product-sum unit 161 outputs [y′] to the first addition unit 162.

[0108] In step S162 , the first adder 162 of the inverse number calculator 16 calculates [y]:=[y′+(ix+j)]. The first adder 162 outputs [y] to the second product-sum calculator 163 .

[0109] In step S163 , the second product-sum unit 163 of the inverse number calculation unit 16 calculates [z′]:=[y(ζy+bk)+(cl)xm] by product-sum, lowering the decimal point position by right shifting, and outputs [z′] to the second addition unit 164 .

[0110] In step S164 , the second adder 164 of the inverse number calculator 16 calculates [z]:=[z′+(ky+lx+m)]. The second adder 164 outputs [z] to the third product-sum calculator 165 .

[0111] In step S165 , the third product-sum unit 165 of the inverse calculation unit 16 calculates [w′ / γ]:=[z(αz+dn / γ)+(βx+fo / γ)y+(gp)x+(Hq) / γ] by product-sum. The third product-sum unit 165 outputs [w′ / γ] to the public value multiplication unit 166 .

[0112] In step S166 , the public value multiplication unit 166 of the inverse number calculation unit 16 calculates [w′]:=[w′ / γ]*γ. The public value multiplication unit 166 outputs [w′] to the third addition unit 167 .

[0113] In step S167 , the third adding section 167 of the inverse number calculating section 16 calculates [w]:=[w′+(nz+oy+px+q)].

[0114] [Variation: Secret Normalization System]

[0115] The secret inverse calculation system 100 of the embodiment is configured to execute both the normalization (algorithm 3) and the inverse calculation (algorithm 4) for inverse calculation. The secret normalization system of the modified example is configured to execute only the part of the secret inverse calculation system 100 that performs the normalization (algorithm 3) for inverse calculation. That is, the secret normalization system takes the dispersed value [a] of the value a as input, and outputs the dispersed value [b] of the value b obtained by normalizing the value a to [0.75, 1.125), and the dispersed value [c] of the normalization multiplier c. Specifically, the secret calculation device 1 included in the secret normalization system of the modified example n The system includes a bit decomposition unit 11, a flag sequence generation unit 12, a bit sequence generation unit 13, a normalization multiplier generation unit 14, and a normalization unit 15. In addition, the normalization algorithm is considered to be used to execute various functions. Therefore, the secret normalization system of the modified example is not limited to a structure for the purpose of inverse calculation.

[0116] The embodiments of the present invention are described above, but the specific structure is not limited to these embodiments. Even if there are appropriate design changes, they are of course included in the present invention without departing from the scope of the present invention. The various processes described in the embodiments can be executed not only in a time series according to the order of the description, but also in parallel or individually according to the processing capacity or needs of the device executing the processing.

[0117] [Program, recording medium]

[0118] When the various processing functions in the devices described in the above embodiments are implemented by a computer, the processing contents of the functions that each device should have are described by a program. Then, by reading the program into Figure 6 In the storage unit 1020 of the computer shown, the control unit 1010, the input unit 1030, the output unit 1040, etc. are operated, and various processing functions in the above-mentioned devices are realized on the computer.

[0119] The program describing the processing contents can be recorded in a computer-readable recording medium. The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory.

[0120] In addition, the program can be circulated by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM on which the program is recorded. Furthermore, the program can be stored in a storage device of a server computer and forwarded from the server computer to other computers via a network, thereby circulating the program.

[0121] The computer executing such a program, for example, first temporarily stores the program stored in a portable recording medium or the program forwarded from a server computer in its own storage device. Then, when executing the process, the computer reads the program stored in its own storage device and executes the process according to the read program. In addition, as another execution mode of the program, the computer can also directly read the program from the portable storage medium and execute the process according to the program, and can also execute the process according to the received program in sequence every time the program is forwarded from the server computer to the computer. In addition, it can also be configured so that the program is not forwarded from the server computer to the computer, but the processing function is realized only by the execution instruction and the result acquisition, that is, the above-mentioned process is executed by the so-called ASP (Application Service Provider, Application Service Provider) type service. In addition, in the program of this method, it is set to include information used for the processing of the electronic computer and information in accordance with the program (not a direct instruction to the computer, but data with the nature of specifying the processing of the computer, etc.).

[0122] In this embodiment, the present device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized only on hardware.

Claims

1. A secret reciprocal calculation system, comprising a plurality of secret calculation devices, and taking a dispersed value [a] of a value a as input, and calculating a dispersed value [1 / a] of the reciprocal of the value a, wherein: λ represents the number of shares of the value a distributed by secret distribution, The secret computing device comprises: The bit decomposition unit generates a bit representation a0, ..., a of the value a based on the distributed value [a]. λ-1 The string of discrete values ​​{a0},…,{a λ-1 }; The marker string generation unit generates a string {a0}, ..., {a λ-1 } the leftmost bit of the string x0,…,x λ-1 The string of discrete values ​​{x0},…,{x λ-1 }; The bit string generation unit generates the bit string y0,…,y λ The string of discrete values ​​{y0},…,{y λ }, where {y0}, {y1} are scattered values ​​of 0; {y2},…, {y λ-1 } is an integer greater than or equal to 2 and less than λ, and the distribution value {a i-2 } is logically NOT ANDed with the scattered value {x i-1 }, and the result obtained by performing a logical product of the dispersed value {x i } is a scattered value of the value calculated by performing the logical exclusive OR of {y λ } is to calculate the scattered value {a λ-2 } is logically NOT ANDed with the scattered value {x λ-1 }; The normalization multiplier generation unit generates a string {y0}, ..., {y λ } The scattered value [c] of the normalized multiplier c obtained by combining the bits in reverse order; a normalization unit that calculates a variance value [b] obtained by multiplying the variance value [a] and the variance value [c]; an inverse calculation unit that uses the variance value [b] to obtain a variance value [w] obtained by calculating [1 / b]; and The denormalization unit calculates the variance [1 / a] obtained by multiplying the variance [w] and the variance [c].

2. The secret countdown calculation system according to claim 1, wherein: a, b, c, d, f, g, H, i, j, k, l, m, n, o, p, q, α, β, γ, δ, ζ are set as parameters for approximating the reciprocal function with an 8th-degree polynomial, and [x]:=[b], The inverse calculation unit comprises: The first product-sum part calculates [y']:=[x(δx+ai)-j]; The first adding part calculates [y]:=[y'+(ix+j)]; The second product-sum part calculates [z']:=[y(ζy+bk)+(cl)xm]; The second adding part calculates [z]:=[z'+(ky+lx+m)]; The third product and sum part, calculate [w′ / γ]:=[z(αz+dn / γ)+(βx+fo / γ)y+(gp)x+(Hq) / γ]; A public value multiplication unit calculates [w']:=[w' / γ]*γ; and The third adding unit calculates [w]:=[w'+(nz+op+px+q)].

3. A secret normalization system, comprising a plurality of secret computing devices, normalizing a dispersed value [a] of a value a, wherein: λ represents the number of shares of the value a distributed by secret distribution, The secret computing device comprises: The bit decomposition unit generates a bit representation a0, ..., a of the value a based on the distributed value [a]. λ-1 The string of discrete values ​​{a0},…,{a λ-1 }; The marker string generation unit generates a string {a0}, ..., {a λ-1 } the leftmost bit of the string x0,…,x λ-1 The string of discrete values ​​{x0},…,{x λ-1 }; The bit string generation unit generates the bit string y0,…,y λ The string of discrete values ​​{y0},…,{y λ }, where {y0}, {y1} are scattered values ​​of 0; {y2},…, {y λ-1 } is an integer greater than or equal to 2 and less than λ, and the distribution value {a i-2 } is logically NOT ANDed with the scattered value {x i-1 }, and the result obtained by performing a logical product of the dispersed value {x i } is a scattered value of the value calculated by performing the logical exclusive OR of {y λ } is to calculate the scattered value {a λ-2 } is logically NOT ANDed with the scattered value {x λ-1 }; The normalization multiplier generation unit generates a string {y0}, ..., {y λ } the scattered value [c] of the normalized multiplier c obtained by combining the bits in reverse order; and The normalization unit calculates a variance value [b] obtained by multiplying the variance value [a] and the variance value [c].

4. A secret inverse calculation method, performed by a secret inverse calculation system, the secret inverse calculation system comprising a plurality of secret calculation devices, and taking a dispersed value [a] of a value a as input, and calculating a dispersed value [1 / a] of the inverse of the value a, wherein: λ represents the number of shares of the value a distributed by secret distribution, The bit decomposition unit of each secure computing device generates a bit representation a0, ..., a of the value a based on the distributed value [a]. λ-1 The string of discrete values ​​{a0},…,{a λ-1 }; The identifier string generation unit of each secure computing device generates a string {a0}, ..., {a λ-1 } the leftmost bit of the string x0,…,x λ-1 The string of discrete values ​​{x0},…,{x λ-1 }; The bit string generation unit of each secure computing device generates a bit string y0,…,y λ The string of discrete values ​​{y0},…,{y λ },in, {y0},{y1} are scattered values ​​of 0; {y2},…,{y λ-1 } is an integer greater than or equal to 2 and less than λ, and the distribution value {a i-2 } is logically NOT ANDed with the scattered value {x i-1 }, and the result obtained by performing a logical product of the dispersed value {x i } is a scattered value of the value calculated by performing the logical exclusive OR of {y λ } is to calculate the scattered value {a λ-2 } is logically NOT ANDed with the scattered value {x λ-1 }; The normalization multiplier generation unit of each secure computing device generates a string of the distributed values ​​{y0}, ..., {y λ } The scattered value [c] of the normalized multiplier c obtained by combining the bits in reverse order; The normalization unit of each secret computing device calculates a distributed value [b] obtained by multiplying the distributed value [a] and the distributed value [c]; The inverse calculation unit of each secure computing device uses the distributed value [b] to obtain a distributed value [w] obtained by calculating [1 / b]; and The denormalization unit of each secure computing device calculates the distributed value [1 / a] obtained by multiplying the distributed value [w] and the distributed value [c].

5. A secret normalization method, performed by a secret normalization system, the secret normalization system comprising a plurality of secret computing devices, normalizing a dispersed value [a] of a value a, wherein: λ represents the number of shares of the value a distributed by secret distribution, The bit decomposition unit of each secure computing device generates a bit representation a0, ..., a of the value a based on the distributed value [a]. λ-1 The string of discrete values ​​{a0},…,{a λ-1 }; The identifier string generation unit of each secure computing device generates a string {a0}, ..., {a λ-1 } the leftmost bit of the string x0,…,x λ-1 The string of discrete values ​​{x0},…,{x λ-1 }; The bit string generation unit of each secure computing device generates a bit string y0,…,y λ The string of discrete values ​​{y0},…,{y λ },in, {y0},{y1} are scattered values ​​of 0; {y2},…,{y λ-1 } is an integer greater than or equal to 2 and less than λ, and the distribution value {a i-2 } is logically NOT ANDed with the scattered value {x i-1 }, and the result obtained by performing a logical product of the dispersed value {x i } is a scattered value of the value calculated by performing the logical exclusive OR of {y λ } is to calculate the scattered value {a λ-2 } is logically NOT ANDed with the scattered value {x λ-1 }; The normalization multiplier generation unit of each secure computing device generates a string of the distributed values ​​{y0}, ..., {y λ } The scattered value [c] of the normalized multiplier c obtained by combining the bits in reverse order; as well as The normalization unit of each secure computing device calculates a distributed value [b] obtained by multiplying the distributed value [a] and the distributed value [c].

6. A secret computing device, which is the secret computing device used in the secret inverse computing system of claim 1 or 2 or the secret normalization system of claim 3.

7. A computer program product, comprising a computer program, wherein the computer program is used to enable a computer to function as the secret computing device as described in claim 6.

Images