Secret exponential function calculation system, secret exponential function calculation method, secret calculation device and computer program product

Abstract

Fast calculation of the exponential function in secret computation. The secret exponential function calculation system (100) takes [a] as input and calculates [exp(a)]. The minimum value subtraction unit (11) calculates [a'] := [a] - μ. The bit decomposition unit (12) generates the bit representations [a'0],..., [a' u‑1 of the upper u bits of a' based on [a']. The selective product unit (13) calculates the total product [f'] that becomes the value of [a' i ? f i : 1]. The upper bit calculation unit (14) calculates the total product [ε'] of [a' i ? 2 ε_i : 1] for 0 ≤ i < u. The lower bit calculation unit (15) calculates [a' ρ := [a'] - Σ2 i‑t [a' i . The exponential function calculation unit (16) calculates [w] := [exp(a' ρ )]. The result calculation unit (17) calculates [w][f'][ε']exp(μ).

Description

Technical Field

[0001] The present invention relates to a technique for calculating an exponential function in secure computation. Background Art

[0002] Secure computation is an encryption technique for calculating an arbitrary function while keeping data hidden. It is expected to effectively utilize this feature to enable a data utilization method that does not leak data for both system operators and data users. Several methods are known in secure computation, among which the method of splitting a secret into components has a small data processing unit and can perform high-speed processing.

[0003] Secret sharing is a method of transforming a secret message into several pieces called shares. For example, there is a secret sharing called the (k, n) threshold method, which generates n shares from a secret message, can recover the secret from k or more shares, and does not leak the secret message from less than k shares. Specific construction methods of secret sharing are known, such as Shamir secret sharing and replicated secret sharing. In this specification, one piece of the value split by secret sharing is called a "share". In addition, the entire set of all shares is called a "split value".

[0004] In recent years, research on advanced statistics and machine learning based on secure computation has been prevalent. However, most of these operations involve calculations such as reciprocals, square roots, exponents, and logarithms, which are beyond the addition, subtraction, and multiplication operations that secure computation is good at. The calculation of the exponential function is one of the basic operations in computers and is used in various situations. In Non-Patent Document 1, a method for calculating the exponential function in secure computation is disclosed.

[0005] Prior Art Documents

[0006] Non-Patent Documents

[0007] Non-Patent Document 1: Ohkura Daisuke, "Design and Implementation of Secure Real Number Operation Groups for Implementing Secure Computation AI - Right Shift for Real Numbers with O(||p||) Bit Communication Volume and O(1) Rounds", CSS2019, 2019 Summary of the Invention

[0008] Problems to be Solved by the Invention

[0009] However, the method disclosed in Non-Patent Document 1 has a problem of high computational cost.

[0010] In view of the above technical problems, an object of the present invention is to provide a secure computation technique capable of calculating the exponential function at high speed.

[0011] Means for Solving the Problems

[0012] In order to solve the above-mentioned problems, a secret exponential function calculation system of one embodiment of the present invention includes multiple secret computing devices, which take the scattered value [a] of value a as input, calculate the scattered value [exp(a)] of the output of the exponential function of value a, wherein μ is the minimum value that value a can take, t is a specified integer, and u is the number of bits of value a that are higher than t bits below the decimal point. The secret computing device includes: a minimum value subtraction unit, which calculates the scattered value [a'] of value a' obtained by subtracting the minimum value μ from the scattered value [a]; and a bit decomposition unit, which generates a bit representation a'0,…,a' of the high-order u bits of value a' based on the scattered value [a']. u-1 The string of discrete values ​​[a'0],…,[a' u-1 ]; select the product part, and for each integer i greater than 0 and less than u, convert f i Let exp(2 i-t )'s mantissa, the calculation will be i =1, then f i If a' i =0 is 1, and the high-order bit calculation unit calculates ε for each integer i greater than 0 and less than u. i Let exp(2 i-t ) of the exponential part, the calculation will be if a' i =1 then 2 ε _ i If a' i =0, and 1 is 1; the low-order bit calculation unit calculates the value of ε' obtained by multiplying all the values ​​?? by 2 for each integer i greater than or equal to 0 and less than u; i-t and the dispersion value [a' i The sum of the values ​​obtained by multiplying [a'] and [b'] is subtracted from the scattered value [a'] to obtain the value a' ρ The dispersion value [a' ρ ]; exponential function calculation unit, find the use of the scattered value [a' ρ ]Calculate [exp(a' ρ )]; and a result calculation unit that calculates a dispersion value [exp(a)] obtained by multiplying the dispersion value [w], the dispersion value [f'], the dispersion value [ε'] and exp(μ).

[0013] Effects of the Invention

[0014] According to the present invention, it is possible to calculate an exponential function at high speed in secret computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a diagram illustrating the functional structure of a secret exponential function calculation system.

[0016] Figure 2 This is a diagram illustrating the functional structure of a secure computing device.

[0017] Figure 3 It is a diagram illustrating the functional structure of a selective product unit.

[0018] Figure 4 It is a diagram illustrating the functional configuration of an exponential function calculation unit.

[0019] Figure 5 This is a diagram illustrating the processing procedure of the secret exponential function calculation method.

[0020] Figure 6 2 is a diagram illustrating a process of selecting a product part.

[0021] Figure 7 It is a diagram illustrating the processing procedure of the exponential function calculation unit.

[0022] Figure 8 This is a diagram illustrating a functional structure of a computer. DETAILED DESCRIPTION

[0023] Hereinafter, the embodiments of the present invention will be described in detail. In the drawings, components having the same functions are denoted by the same reference numerals, and repeated descriptions are omitted.

[0024] In this specification, the following notations are used.

[0025] [·] is data obtained by anonymizing the numerical value. For example, a distributed value such as Shamir's secret distribution or copied secret distribution can be used.

[0026] Regarding [a? b:c], if a=1, then [a? b:c] represents b, and if a=0, then [a? b:c] represents c.

[0027]

Mathematical formula 1

[0028] ∧,∨,

[0029] They represent logical NOT (NOT), logical product (AND), logical sum (OR), and logical exclusive OR (XOR) respectively.

[0030] By determining the decimal point position for the integers on the ring, it can be regarded as a fixed-point real number. In the present invention, such a fixed-point real number represented on the ring is simply denoted as a real number.

[0031] The "_" (underscore) in a subscript means that the character on the right is attached to the character on the left in a subscript manner. For example, "ab_c " means b c Attached to a in superscript form.

[0032] [Implementation method: secret exponential function calculation system]

[0033] An embodiment of the present invention is a secret exponential function calculation system and method for taking a dispersed value [a] of a value a as input and calculating a dispersed value [exp(a)] of an exponential function output of the value a while keeping the value a secret. The following is an overview of an exponential function protocol executed by the secret exponential function calculation system of the embodiment.

[0034] In the past, in secret computing, the processing cost of elementary function groups such as reciprocals, square roots, exponential functions, and logarithmic functions that exceed addition, subtraction, and multiplication operations was high and was not implemented. In the present invention, in order to solve these problems, an algorithm that can efficiently and uniformly approximate elementary function groups in secret computing is used, and exponential functions can be efficiently calculated. This approximation method can approximate the main elementary functions including exponential functions by only changing parameters in a single method. Moreover, this approximation method is the communication volume / number of cycles of three real number multiplication operations in single precision (23 bits), which is the theoretically optimal efficiency.

[0035] The exponential function is used as a component of the sigmoid function or the softmax function in various machine learning methods such as logistic regression and deep learning, and is also an important function used in statistics such as Fisher's correctness test. Since Taylor expansion converges quickly, it is appropriate to calculate the exponential function using Taylor expansion.

[0036]

Mathematical formula 2

[0037]

[0038] However, it is obvious that if x is large, the above equation converges slowly, so direct input is not applicable. Since the exponential function has additive properties on the input, x can be additively decomposed as follows to calculate the following equation.

[0039] (1) Minimum value of the input μ

[0040] (2) The high-order u bits x0,…,x0 are the t bits below the decimal point of x-μ. u-1

[0041] (3) The number x represented by the bits lower than x0 of x-μ ρ

[0042]

Mathematical formula 3

[0043] expx=expμexp2 -t x0…exp2 u-t-1 x u-1 expx ρ

[0044] Here, expμ is a public value. exp2 -t x0,…,exp2 u-t-1 x u-1 Calculated through a binary table. ρ The part is calculated by approximation and is normalized to [0,2 -t ). The value of t varies depending on the processing system, but the processing cost of secret computing increases when referring to a large table, so it should be set to the smallest possible value. In addition, expx ρ It can also be calculated by polynomial interpolation.

[0045] The following is an algorithm for approximating a set of elementary functions for secret computations with an 8th-degree polynomial.

[0046] [Algorithm 1: Function approximation protocol based on 8th degree polynomial]

[0047] Input: [x]∈[L,R)

[0048] Parameters: a, b, c, d, f, g, H, i, j, k, l, m, n, o, p, q, α, β, γ, δ, ζ

[0049] Output: [func(x)] corresponding to the target function func

[0050] 1: Calculate [y']: = [x(δx+ai)-j] by sum of products, and lower the decimal point by right shifting.

[0051] 2: Calculate [y]: = [y'+(ix+j)].

[0052] 3: Calculate [z']: = [y(ζy+bk)+(cl)xm] by product-sum, and lower the decimal point position by right shifting.

[0053] 4: Calculate [z]: = [z' + (ky + lx + m)].

[0054] 5: Calculate [w' / γ] by product sum: = [z(αz+dn / γ)+(βx+fo / γ)y+(gp)x+(Hq) / γ], and perform multiplication based on γ and reduction of the decimal point to obtain [w'].

[0055] 6: Output [w]: = [w' + (nz + oy + px + q)].

[0056] The reduction of the decimal point position performed in steps 1 and 3 of Algorithm 1 can be efficiently performed by using the public divisor division disclosed in Non-Patent Document 1, for example.

[0057] The simultaneous execution of the public value multiplication and the decimal point reduction performed in step 5 of Algorithm 1 can be performed efficiently by using the following algorithm, for example.

[0058] [Algorithm 2: Starting from right shift, multiplying the public value simultaneously without increasing the processing cost]

[0059] Input: [x], multiplier m, shift amount σ

[0060] Output: shifted [mx]

[0061] 1: Calculate the public value 2 σ / m.

[0062] 2: Calculate the following equation by dividing the public value. Here, [mx] is considered to be lower than [x] by σ in the decimal point position.

[0063]

Mathematical formula 4

[0064]

[0065] The parameters L, R, a, b, c, d, f, g, H, i, j, k, l, m, n, o, p, q, α, β, γ, δ, ζ used in Algorithm 1 are set according to the function func to be approximated. When approximating the exponential function used as the object of the present invention, the parameters can be set as shown in the following table. x ,e y ,e z ,e w is the decimal point position of x, y, z, w, e' y ,e' z ,e' w is the decimal point position of y', z', and w'. These are the parameters that determine the right shift amount in the 8th degree polynomial approximation. For example, the right shift amount when calculating y from y' is e' y -e y .

[0066]

Table 1

[0067]

[0068]

[0069] The following shows an algorithm for calculating the exponential function in secret computing using Algorithm 1.

[0070] 〔Algorithm 3: Exponential Function Protocol〕

[0071] Input: [a]

[0072] Output: [exp(a)]

[0073] Parameter: t := -1

[0074] 1: Calculate [a'] := [a] - μ.

[0075] 2: Extract the bits higher than t bits below the decimal point by bit decomposition, and perform a mod p transformation to obtain [a'0], …, [a' u-1 .

[0076] 3: In the case of each 0 ≤ i < u, take f i , ε i as the mantissa part and the exponent part of exp(2 i-t ), respectively.

[0077] 4: Using [a'0], …, [a' u-1 as conditions and 1, f0, 1, f1, …, 1, f u-1 as options, obtain the product [f'] by referring to the powers in the binary public table.

[0078] 5: In the case of each 0 ≤ i < u, calculate the following formula according to the if-then-else gate disclosed by the option.

[0079]

Mathematical Formula 5

[0080]

[0081] 6: Calculate the product [ε'] of [ε' i for each i. This is the power of 2 of the exponent part of the high-order bit part.

[0082] 7: Calculate the following formula. This is the number represented by the low-order bit part.

[0083]

Mathematical Formula 6

[0084]

[0085] 8: Execute Algorithm 1 on [a' ρ to calculate the exponential function of [a' ρ . Let the result be [w].

[0086] 9: Calculate and output [w][f'][ε']exp(μ). Use Algorithm 2 to calculate exp(μ).

[0087] The exponentiation of the binary public table performed in step 4 of Algorithm 3 is a process of performing a plurality of operations of referencing and selecting values ​​from a binary table composed of public values ​​according to a secret truth value, and multiplying the respective reference results. The exponentiation of the binary public table can be performed efficiently by using, for example, the following algorithm.

[0088] [Algorithm 4: Refer to the power of the binary public table]

[0089] Input: multiplier m 0,0 ,m 0,1 ,…,m n-1,0 ,m n-1,1 , conditions [c0],…,[c n-1 ]

[0090] Output:

[0091]

Mathematical formula 7

[0092]

[0093] 1: Set n2 to the largest even number less than n.

[0094] 2: For each i∈{0,2,…,n2-2}

[0095] 3: Calculate [c i c i-1 ].

[0096] 4: Set to m' 00 :=m i,0 m i+1,0 、m' 01 :=m i,0 m i+1,1 、m' 10 :=m i,1 m i+1,0 、m' 11 :=m i,1 m i+1,1 .

[0097] 5: Calculate [a i ]:=[c i c i+1 ](m' 00 +m' 11 -m' 01 -m' 10 )+[c i ](m'10 -m' 00 )+[c i+1 ](m' 01 -m' 00 )+m' 00 .

[0098] 6: The following expression is calculated by real number multiplication. However, if n is an odd number, the final right shift is not performed.

[0099]

Mathematical formula 8

[0100]

[0101] 7: If n is an odd number, then pass [c n-1 ] Select the remaining m n-1,0 ,m n-1,1 , multiply by [A], and output.

[0102] The selective disclosure multiplication operation performed in step 7 of Algorithm 4 can be performed efficiently, for example, by using the following algorithm.

[0103] [Algorithm 5: Multiplication operation for the required right shift value based on selective disclosure of multipliers]

[0104] Input: [a], multipliers m0, m1, condition [c]

[0105] Output: If c=1, then [m1a], if c=0, then [m0a]

[0106] 1: Calculate [m1a], [m0a].

[0107] 2: Through the if-then-else gate, output [c? m1a:m0a].

[0108] The public value multiplication operation performed in step 1 of Algorithm 5 can be performed efficiently by combining Algorithm 2 with the following algorithm, for example.

[0109] [Algorithm 6: Right shift / divisor open division operation in multiple divisors]

[0110] Input: [a], divisors d0, d1, …, d n-1

[0111] Output: [a / d0],[a / d1],…,[a / d n-1 ]

[0112] 1: Find the quotient [q] of [a].

[0113] 2: Using the quotient [q], calculate and output [a / d] for each i by right shifting / divisor open division operation.i ].

[0114] The quotient obtained in step 1 of Algorithm 6 can be obtained efficiently by quotient transfer (see Reference 1).

[0115] "Reference 1" Ryo Kikuchi, Dai Ikarashi, Takahiro Matsuda, Koki Hamada, and Koji Chida, "Efficient bit-decomposition and modulus-conversion protocols with an honest majority," Proceedings of Information Security and Privacy-23rdAustralasian Conference (ACISP 2018), pp.64-82, July 11-13, 2018.

[0116] <Secret Exponential Function Calculation System 100>

[0117] The secret exponential function calculation system 100 of the embodiment is an information processing system that executes the above-mentioned exponential function protocol. Figure 1 As shown, the secret exponential function calculation system 100 includes N (≥3) secret computing devices 11, ..., 1 N In this embodiment, the secret computing devices 11, ..., 1 N Each of the devices is connected to a communication network 9. The communication network 9 is a circuit switching or packet switching communication network configured so that each connected device can communicate with each other, such as the Internet, LAN (Local Area Network), WAN (Wide Area Network), etc. In addition, each device does not necessarily have to be able to communicate online via the communication network 9. For example, it can also be configured to send a signal to the secure computing device 1. n The input information (n=1, ..., N) is stored in a portable recording medium such as a magnetic tape or a USB memory, and is transmitted from the portable recording medium to the secure computing device 1. n Enter in offline mode.

[0118] For example, Figure 2 As shown, the secret exponential function calculation system 100 of the embodiment includes a secret calculation device 1 n The system comprises a minimum value subtraction unit 11, a bit decomposition unit 12, a selection product unit 13, a high-order bit calculation unit 14, a low-order bit calculation unit 15, an exponential function calculation unit 16, and a result calculation unit 17. For example, Figure 3As shown, the selective product unit 13 includes a condition integration unit 131, a table conversion unit 132, a public value multiplication unit 133, a real number multiplication unit 134 and a selective multiplication unit 135. Figure 4 As shown, the exponential function calculation unit 16 includes a parameter storage unit 160, a first product-sum unit 161, a first addition unit 162, a second product-sum unit 163, a second addition unit 164, a third product-sum unit 165, a public value multiplication unit 166, and a third addition unit 167. n With another secret computing device 1 n' (n'=1, ..., N, where n≠n') cooperates and executes the processing of each step described later, thereby realizing the secret exponential function calculation method of the implementation method.

[0119] Secret computing device 1 n It is a special device that is configured by reading a special program into a known or special computer having a central processing unit (CPU) and a main storage device (RAM) etc. n For example, each process is executed under the control of a central processing unit. n The data and the data obtained through each process are stored in a main storage device, for example. The data stored in the main storage device is read out to the central processing unit as needed for other processing. n At least a part of each processing unit may also be constituted by hardware such as an integrated circuit. n Each storage unit may be composed of a main storage device such as RAM (Random Access Memory), an auxiliary storage device composed of a semiconductor storage element such as a hard disk, an optical disk or a flash memory, or middleware such as a relational database or a key value store.

[0120] Reference Figure 5 The processing procedure of the secret exponential function calculation method executed by the secret exponential function calculation system 100 according to the embodiment will be described.

[0121] In step S11, each secure computing device 1 nThe minimum value subtraction unit 11 obtains the distributed value [a'] of the value a input to the secret exponential function calculation system 100 by subtracting the minimum value μ of the value a from the distributed value [a] of the value a. That is, [a'] is calculated as: = [a] - μ. The minimum value subtraction unit 11 outputs the distributed value [a'] to the bit decomposition unit 12 and the low-order bit calculation unit 15.

[0122] In step S12-1, each secure computing device 1 n The bit decomposition unit 12 decomposes the bits higher than t bits below the decimal point of the distributed value [a']' of the value a' to obtain the bit representation a'0, ..., a' of the high-order u bits of the value a'. u-1 The string of discrete values ​​{a'0},...,{a' u-1 Next, the bit decomposition unit 12 performs bit decomposition on the distributed values ​​{a'0}, ..., {a' u-1} respectively perform mod p transformation to obtain the scattered value string [a'0],…,[a' u-1 The bit decomposition unit 12 outputs a sequence of distributed values ​​[a'0], ..., [a' u-1 ]. In step S12-2, the bit resolution unit 12 converts f i ,ε i Set them as exp(2 i-t )'s mantissa and exponent.

[0123] In step S13, each secure computing device 1 n The selective product unit 13 calculates if a' i =1, then f i If a' i = 0 is the scattered value [f'i] of the value f' obtained by multiplying all the values ​​that are 1. That is, [a'0], ..., [a' u-1 ] as a condition, and 1,f0,1,f1,…,1,f u-1 As an option, Algorithm 4 is executed to obtain the product [f′]. The selective product unit 13 outputs the dispersion value [f′] to the result calculation unit 17 .

[0124] In step S14, each secure computing device 1 n The high-order bit calculation unit 14 calculates a' for each integer i greater than 0 and less than u. i =1 then 2 ε _ i If a' iThe variance value [ε'] of the value ε' obtained by multiplying all values that are 1 when it is 0. That is, for each 0 ≤ i < u, it is calculated by the if-then-else gate disclosed in the option [ε' i := if [a' i then 2 ε _ i else 1, and the product [ε'] obtained by multiplying the [ε' i related to each i is calculated. The high-bit calculation unit 14 outputs the variance value [ε'] to the result calculation unit 17.

[0125] In step S15, the low-bit calculation unit 15 of each secret calculation device 1 n subtracts the sum of the values obtained by multiplying 2 i-t by [a' i from the variance value [a'] of the value a' for each integer i that is 0 or more and less than u, and obtains the variance value [a' ρ of the value a' ρ . That is, the following formula is calculated. The low-bit calculation unit 15 outputs the variance value [a' ρ to the result calculation unit 17.

[0126]

Mathematical formula 9

[0127]

[0128] In step S16, the exponential function calculation unit 16 of each secret calculation device 1 n executes Algorithm 1 using the parameters for approximating the exponential function with an 8th-degree polynomial, thereby calculating the exponential function for the variance value [a' ρ of the value a' ρ , and generating the variance value [w] of the calculation result w. The exponential function calculation unit 16 outputs the variance value [w] to the result calculation unit 17.

[0129] In step S17, the result calculation unit 17 of each secret calculation device 1 n multiplies the variance value [w] of the calculation result w, the variance value [f'] of the value f', the variance value [ε'] of the value ε', and exp(μ), and outputs it as the variance value [exp(a)] of the output of the exponential function of the value a.

[0130] Refer to Figure 6 for a detailed description of the process executed by the selection product unit 13.

[0131] Hereinafter, let n2 be the largest even number less than or equal to u. For each even number j from 0 to n2 - 2, the following steps S131 to S133 are executed.

[0132] In step S131, the condition integration unit 131 of the selection unit 13 calculates the value a' j The dispersion value [a' j ] and value a' j+1 The dispersion value [a' j+1 ]The value obtained by multiplying j a' j+1 The dispersion value [a' j a' j+1 The condition integration unit 131 outputs the distributed value [a' j a' j+1 ].

[0133] In step S132, the table conversion unit 132 of the product unit 13 is selected as m' 00 :=1、m' 01 :=f j+1 、m' 10 :=f j 、m' 11 :=f j f j+1 , generate a four-value table m' 00 ,m' 01 ,m' 10 ,m' 11 The table conversion unit 132 converts the 4-value table m' 00 ,m' 01 ,m' 10 ,m' 11 The result is output to the public value multiplication unit 133 .

[0134] In step S133, the public value multiplication unit 133 of the product unit 13 is selected to calculate [a' j a' j+1 ](m 00 +m 11 -m 01 -m 10 )+[a' j+1 ](f j -1)+1. The public value multiplication unit 133 converts the scattered value [a" j ] is output to the real number multiplication unit 134.

[0135] In step S134, the real number multiplication unit 134 of the product unit 13 is selected to calculate the scattered value [a" j ] is the scattered value [A] of the value A obtained by multiplying all the values. That is, the following formula is calculated. Since the multiplication operation becomes a real number multiplication operation, a right shift is required at the end. However, if u is an odd number, a right shift is not performed here.

[0136]

Mathematical formula 10

[0137]

[0138] In step S135, when u is an odd number, the selection multiplication unit 135 of the selection product unit 13 converts a' u-1 =1, then f u-1 If a' u-1 =0 is 1, multiplied by the dispersion of value A [A] and output. That is, calculate [A][a' u-1 ?f u-1 :1].

[0139] Reference Figure 7 , the processing procedure performed by the exponential function calculation unit 16 is described in detail.

[0140] The parameter storage unit 160 stores parameters a, b, c, d, f, g, H, i, j, k, l, m, n, o, p, q, α, β, γ, δ, ζ for approximating an exponential function with an 8th-degree polynomial. Each parameter is predetermined according to the function to be approximated. When approximating an exponential function, the values ​​shown in Table 1 may be set.

[0141] In step S161, the first product-sum unit 161 of the exponential function calculation unit 16 calculates [y']:=[x(δx+ai)-j] by product-sum, and lowers the decimal point position by right shifting. Where x is the number a' representing the low-order bit portion of the value a. ρ That is, [x]: = [a' ρ The first product-sum unit 161 outputs [y′] to the first addition unit 162 .

[0142] In step S162 , the first adder 162 of the exponential function calculator 16 calculates [y]:=[y′+(ix+j)]. The first adder 162 outputs [y] to the second product-sum calculator 163 .

[0143] In step S163 , the second product-sum unit 163 of the exponential function calculation unit 16 calculates [z′]:=[y(ζy+bk)+(cl)xm] by product-sum, lowering the decimal point by right shifting, and outputs [z′] to the second addition unit 164 .

[0144] In step S164 , the second adder 164 of the exponential function calculator 16 calculates [z]:=[z′+(ky+lx+m)]. The second adder 164 outputs [z] to the third product-sum calculator 165 .

[0145] In step S165 , the third product-sum unit 165 of the exponential function calculation unit 16 calculates [w′ / γ]:=[z(αz+dn / γ)+(βx+fo / γ)y+(gp)x+(Hq) / γ] by product-sum. The third product-sum unit 165 outputs [w′ / γ] to the public value multiplication unit 166 .

[0146] In step S166 , the public value multiplication unit 166 of the exponential function calculation unit 16 calculates [w′]:=[w′ / γ]*γ. The public value multiplication unit 166 outputs [w′] to the third addition unit 167 .

[0147] In step S167 , the third adding section 167 of the exponential function calculating section 16 calculates [w]:=[w′+(nz+oy+px+q)].

[0148] The embodiments of the present invention are described above, but the specific structure is not limited to these embodiments. Even if there are appropriate design changes, they are of course included in the present invention without departing from the scope of the present invention. The various processes described in the embodiments can be executed not only in a time series according to the order of the description, but also in parallel or individually according to the processing capacity or needs of the device executing the processing.

[0149] [Program, recording medium]

[0150] When the various processing functions in the devices described in the above embodiments are implemented by a computer, the processing contents of the functions that each device should have are described by a program. Then, by reading the program into Figure 8 In the storage unit 1020 of the computer shown, the control unit 1010, the input unit 1030, the output unit 1040, etc. are operated, and various processing functions in the above-mentioned devices are realized on the computer.

[0151] The program describing the processing contents can be recorded in a computer-readable recording medium. The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory.

[0152] In addition, the program can be circulated by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM on which the program is recorded. Furthermore, the program can also be stored in a storage device of a server computer and forwarded from the server computer to other computers via a network, thereby circulating the program.

[0153] The computer executing such a program, for example, first temporarily stores the program recorded in a portable recording medium or the program forwarded from a server computer in its own storage device. Then, when executing the process, the computer reads the program stored in its own storage device and executes the process according to the read program. In addition, as another execution mode of the program, the computer can also directly read the program from the portable storage medium and execute the process according to the program, and can also execute the process according to the received program in sequence whenever the program is forwarded from the server computer to the computer. In addition, it can also be configured so that the program is not forwarded from the server computer to the computer, but the processing function is realized only by the execution instruction and the result acquisition, that is, the above-mentioned process is executed by the so-called ASP (Application Service Provider, Application Service Provider) type service. In addition, in the program of this mode, it is set to include information used for the processing of the electronic computer and information in accordance with the program (not a direct instruction to the computer, but data with the nature of the processing of the computer, etc.).

[0154] In this embodiment, the present device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized only on hardware.

Claims

1. A secret exponential function calculation system, comprising a plurality of secret calculation devices, taking a scattered value [a] of a value a as input, and calculating a scattered value [exp(a)] of an output of an exponential function of the value a, wherein: μ is the minimum value that the value a can take, t is a specified integer, u is the number of bits below the decimal point of the value a that are higher than t bits, The secret computing device comprises: a minimum value subtraction unit that obtains a variance value [a'] of a value a' obtained by subtracting the minimum value μ from the variance value [a]; The bit decomposition unit generates a bit representation a'0, ..., a' of the upper u bits of the value a' based on the distributed value [a']. u-1 The string of discrete values ​​[a'0],…,[a' u-1 ]; Select the product part and for each integer i greater than 0 and less than u, i Let exp(2 i-t )'s mantissa, the calculation will be i =1, then f i If a' i = 0 is the scattered value [f'] of the value f' obtained by multiplying all the values ​​that are 1; The high-order bit calculation unit calculates ε for each integer i greater than or equal to 0 and less than u. i Let exp(2 i-t ) of the exponential part, the calculation will be if a' i =1 then 2 ε _ i If a' i = 0 is the scattered value [ε'] of the value ε' obtained by multiplying all the values ​​that are 1; The low-order bit calculation unit calculates, for each integer i greater than or equal to 0 and less than u, the value obtained by subtracting 2 from the distributed value [a']. i-t With the scattered value [a' i ] is the sum of the values ​​obtained by multiplying them, and the value a' ρ The dispersion value [a' ρ ]; The exponential function calculation unit obtains the dispersion value [a' ρ ]Calculate [exp(a' ρ )]; and The result calculation unit calculates the variance [exp(a)] obtained by multiplying the variance [w], the variance [f'], the variance [ε'], and exp(μ).

2. The secret exponential function calculation system according to claim 1, wherein: a,b,c,d,f,g,H,i,j,k,l,m,n,o,p,q,α,β,γ,δ,ζ are set as parameters for approximating the exponential function with an 8th-degree polynomial, and [x]:=[a' ρ ], The exponential function calculation unit comprises: The first product-sum part calculates [y']:=[x(δx+ai)-j]; The first adding part calculates [y]:=[y'+(ix+j)]; The second product-sum part calculates [z']:=[y(ζy+bk)+(cl)xm]; The second adding part calculates [z]:=[z'+(ky+lx+m)]; The third product and sum part, calculate [w' / γ]:=[z(αz+dn / γ)+(βx+fo / γ)y+(gp)x+(Hq) / γ]; A public value multiplication unit calculates [w']:=[w' / γ]*γ; and The third adding unit calculates [w]:=[w'+(nz+op+px+q)].

3. The secret exponential function calculation system according to claim 1, wherein: The selection product section comprises: The condition integration unit calculates the dispersion value [a' j ] and the dispersion value [a' j+1 ] multiplied by the scattered value [a' j a' j+1 ]; The table conversion unit sets m' for each even number j that is greater than or equal to 0 and less than u. 00 :=1、m' 01 :=f j+1 、m' 10 :=f j 、m' 11 :=f j f j+1 , generate a 4-value table m' 00 ,m' 01 ,m' 10 ,m' 11 ; The public value multiplication unit generates and calculates [a' j a' j+1 ](m 00 +m 11 -m 01 -m 10 )+[a' j+1 ](f j -1)+1 to get the value a" j The dispersion value [a" j ]; The real number multiplication unit calculates the scattered value [a" j ] is the scattered value [A] of the value A obtained by multiplying all the values; and Select the multiplication part. When u is an odd number, if a' u-1 =1, then f u-1 If a' u-1 =0 is the value of 1 multiplied by the dispersion value [A].

4. A secret exponential function calculation method, performed by a secret exponential function calculation system, the secret exponential function calculation system comprising a plurality of secret calculation devices, taking a scattered value [a] of a value a as input, and calculating a scattered value [exp(a)] of an output of an exponential function of the value a, wherein: μ is the minimum value that the value a can take, t is a specified integer, u is the number of bits below the decimal point of the value a that are higher than t bits, In the secret exponential function calculation method, The minimum value subtraction unit of each secure computing device obtains a distributed value [a'] which is a value a' obtained by subtracting the minimum value μ from the distributed value [a]. The bit decomposition unit of each secure computing device generates a bit representation a'0, ..., a' of the upper u bits of the value a' based on the distributed value [a']. u-1 The string of discrete values ​​[a'0],…,[a' u-1 ]; The selected product unit of each secure computing device converts f i Let exp(2 i-t )'s mantissa, the calculation will be i =1, then f i If a' i = 0 is the scattered value [f'] of the value f' obtained by multiplying all the values ​​that are 1; The high-order bit calculation unit of each secure computing device converts ε to i Let exp(2 i-t ) of the exponential part, the calculation will be if a' i =1 then 2 ε _ i If a' i = 0 is the scattered value [ε'] of the value ε' obtained by multiplying all the values ​​that are 1; The lower bit calculation unit of each secure computing device calculates the value of subtracting 2 from the distributed value [a'] for each integer i that is greater than or equal to 0 and less than u. i-t With the scattered value [a' i ] is the sum of the values ​​obtained by multiplying them, and the value a' ρ The dispersion value [a' ρ ]; The exponential function calculation unit of each secure computing device obtains the value of the distributed value [a' ρ ]Calculate [exp(a' ρ )]; and The result calculation unit of each secure computing device calculates the distributed value [exp(a)] obtained by multiplying the distributed value [w], the distributed value [f'], the distributed value [ε'], and exp(μ).

5. A secret computing device, which is the secret computing device used in the secret exponential function calculation system according to any one of claims 1 to 3.

6. A computer program product, comprising a computer program, wherein the computer program is used to enable a computer to function as the secure computing device according to claim 5.

Images