Secret square root inverse calculation system, secret normalization system, their methods, secret calculation device and computer program product

Abstract

Calculating the reciprocal of the square root at high speed in secret computing. The secret square root reciprocal calculation system (100) takes [a] as the input and calculates [1 / √a]. The bit decomposition unit (11) generates the bit representation {a0}, …, {a λ‑1}. The first bit string generation unit (12) calculates {a' i} = {a i} ∨ {a i+1} to generate {a'0}, …, {a' λ'‑1}. The flag string generation unit (13) generates {x0}, …, {x λ'‑1} representing the leftmost bits of {a'0}, …, {a' λ'‑1}. The normalized multiplier generation unit (14) generates [c'] by combining the bits of {x λ'‑1}, …, {x0}. The second bit string generation unit (15) sets {a" i} = {a 2i} to generate {a"0}, …, {a" λ'‑1}. The flag calculation unit (16) calculates the scatter value {r} obtained by summing {x j}{a" j}. The normalization unit (18) calculates [b]: = [c'][c'][2a] if r = 1, and calculates [b]: = [c'][c'][a] if r = 0. The square root reciprocal calculation unit (19) calculates [w]: = [1 / √b]*√2 if r = 1, and calculates [w]: = [1 / √b] if r = 0. The inverse normalization unit (20) multiplies [1 / √a]: = [w][c'].

Description

Technical Field

[0001] The present invention relates to a technique for calculating the reciprocal of a square root in secret computing. Background Art

[0002] Secret computing is a cryptographic technology that calculates arbitrary functions while keeping data secret. It is expected that this feature can be used to make data available without leaking data to system operators or data users. It is known that there are several methods for secret computing, among which secret computing that uses secret distribution as a component has a small data processing unit and can be processed at high speed.

[0003] Secret dispersion refers to a method of converting secret information into several fragments called shares. For example, there is a secret dispersion called the (k,n) threshold method, which generates n shares from secret information and can be restored from more than k shares, but does not leak information from less than k shares. Shamir secret dispersion, replicated secret dispersion, and the like are known as specific methods of constructing secret dispersion. In this specification, a fragment of a value dispersed by secret dispersion is called a "share". In addition, the collection of all shares is collectively called a "dispersed value".

[0004] In recent years, research on highly statistical or machine learning based on secret computing is gaining popularity. However, most of these operations include calculations such as reciprocals, square roots, exponents, logarithms, etc. that are beyond the addition, subtraction, and multiplication operations that secret computing is good at. The calculation of the reciprocal of the square root is one of the basic operations in computers, etc., and is used in various situations. In non-patent document 1, a method for calculating the reciprocal of the square root in secret computing is disclosed. In addition, in the calculation of various functions including square roots, it is sometimes necessary to perform normalization processing so that the values ​​converge within a certain range. In secret computing, the normalization of values ​​is performed by moving the leftmost bit (MSB: most significant bit).

[0005] Prior art literature

[0006] Non-patent literature

[0007] Non-Patent Literature 1: Dai Igarashi, "Design and implementation of a secret real number operation group for the implementation of secret computing AI - O(|p|) bit communication volume O(1) round right shift for real numbers -", ​​CSS2019, 2019 (Da Igarashi, "Design and implementation of a secret real number operation group for the implementation of secret computing AI - O(|p|) bit communication volume O(1) round right shift for real numbers -", ​​CSS2019, 2019) Summary of the invention

[0008] Problems to be solved by the invention

[0009] However, the method disclosed in Non-Patent Document 1 has a problem of high calculation cost.

[0010] In view of the above-mentioned technical problems, an object of the present invention is to provide a secret computing technology capable of calculating the reciprocal of a square root at high speed.

[0011] Solutions to Solve Problems

[0012] In order to solve the above-mentioned problems, a first method of a secret square root reciprocal calculation system of the present invention includes a plurality of secret computing devices, wherein a dispersed value [a] of a value a is set as an input, and a secret square root reciprocal calculation system is used to calculate a dispersed value [1 / √a] of the reciprocal of the square root of the value a, wherein λ is the decimal point position of the value a, λ' is the smallest integer greater than or equal to λ / 2, and λ" is the largest integer less than or equal to λ / 2, and the secret computing device includes: a bit decomposition unit, which generates a bit representation a0, ..., a of the value a from the dispersed value [a] λ-1 The string of discrete values ​​{a0},…,{a λ-1}; The first bit string generating unit calculates the scattered value {a i} and the scattered value {a i+1} "or" bit a' i The scattered values ​​of {a' i}, generate the bit string a'0,…,a' λ'-1 The string of discrete values ​​{a'0},...,{a' λ'-1}; a marker string generator, generating a string {a'0}, ..., {a' λ'-1} the leftmost bit of the string x0,…,x λ'-1 The string of discrete values ​​{x0},…,{x λ'-1}; Normalization multiplier generation unit, generates a string of scattered values ​​{x0},...,{x λ'-1} The scattered value [c'] of the normalized multiplier c' after the bits are combined in reverse order; the second bit string generating unit generates the scattered value {a 2i} is set to bit a" i The scattered value of {a" i}, generate the bit string a"0,…,a" λ'-1 The string of discrete values ​​is {a"0},…,{a" λ'-1}; A flag calculation unit calculates the scattered value {x j} and the scattered value {a" j}; a normalization unit, using the scattered value [a], the scattered value [c'], and the scattered value {r}, calculates the scattered value [b] calculated as [c'][c'][2a] when r=1 and [c'][c'][a] when r=0; a square root inverse calculation unit, using the scattered value [b] and the scattered value [r], to calculate the scattered value [w] calculated as [1 / √b]*√2 when r=1 and [1 / √b] when r=0; and an inverse normalization unit, calculating the scattered value [1 / √a] obtained by multiplying the scattered value [w] by the scattered value [c'].

[0013] The second method of the secret normalization system of the present invention is a secret normalization system comprising a plurality of secret computing devices, which normalizes the scattered values ​​[a] of the value a in order to calculate the scattered values ​​[1 / √a] of the reciprocal of the square root of the value a, wherein λ is the decimal point position of the value a, λ' is the smallest integer greater than or equal to λ / 2, and λ" is the largest integer less than or equal to λ / 2, and the secret computing device comprises: a bit decomposition unit, which generates bit representations a0, ..., a of the value a from the scattered values ​​[a] λ-1 The string of discrete values ​​{a0},…,{a λ-1}; The first bit string generating unit calculates the scattered value {a i} and the scattered value {a i+1} "or" bit a' i The scattered values ​​of {a' i}, generate the bit string a'0,…,a' λ'-1 The string of discrete values ​​{a'0},...,{a' λ'-1}; a marker string generator, generating a string {a'0}, ..., {a' λ'-1} the leftmost bit of the string x0,…,x λ'-1 The string of discrete values ​​{x0},…,{x λ'-1}; Normalization multiplier generation unit, generates a string of scattered values ​​{x0},...,{x λ'-1} The scattered value [c'] of the normalized multiplier c' after the bits are combined in reverse order; the second bit string generating unit generates the scattered value {a 2i} is set to bit a" i The scattered value of {a" i}, generate the bit string a"0,…,a" λ'-1 The string of discrete values ​​is {a"0},…,{a" λ'-1}; A flag calculation unit calculates the scattered value {x j} and the scattered value {a" j}; and a normalization unit, using the scattered value [a], the scattered value [c'] and the scattered value {r}, to calculate the scattered value [b] when [c'][c'][2a] is calculated when r=1 and [c'][c'][a] is calculated when r=0.

[0014] Effects of the Invention

[0015] According to the present invention, the reciprocal of a square root can be calculated at high speed in secret computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a diagram illustrating the functional structure of a secret reciprocal square root calculation system.

[0017] Figure 2 This is a diagram illustrating the functional structure of a secure computing device.

[0018] Figure 3 This is a diagram illustrating the functional configuration of a reciprocal square root calculation unit.

[0019] Figure 4 is a diagram illustrating the processing procedure of the secret reciprocal square root calculation method.

[0020] Figure 5 This is a diagram illustrating the processing procedure of the inverse square root calculation unit.

[0021] Figure 6 This is a diagram illustrating a functional structure of a computer. DETAILED DESCRIPTION

[0022] Hereinafter, the embodiments of the present invention will be described in detail. In addition, the same reference numerals are attached to components having the same functions in the drawings, and duplicate descriptions are omitted.

[0023] In this specification, the following notations are used.

[0024] [·] is data after the value is anonymized. For example, the distributed value can be used using Shamir secret distribution, copy secret distribution, etc.

[0025] {·} is data after bit·masking. For example, a distributed value such as copy secret distribution on Z2 can be used.

[0026] λ represents the decimal point position. It is assumed that the number of bits of the ring or field used in the secret computation is about half of |p|.

[0027] [a? b:c] means that if a=1, it means b, and if a=0, it means c.

[0028]

Mathematical formula 1

[0029]

[0030] They represent NOT, AND, OR, and XOR respectively.

[0031] By determining the decimal point position of the integer on the ring, it can be regarded as a real number with a fixed decimal point. In the present invention, the real number with a fixed decimal point represented on the ring by such processing is simply described as a real number.

[0032] [Implementation method: Secret square root reciprocal calculation system]

[0033] The embodiment of the present invention is a secret reciprocal square root calculation system and method that takes a dispersed value [a] of a value a as input and calculates a dispersed value [1 / √a] of the reciprocal of the square root of the value a while concealing the value a. The following is an overview of the reciprocal square root protocol for executing the secret reciprocal square root calculation system of the embodiment.

[0034] In the past, in secret computing, elementary function groups such as reciprocals or square roots, exponential functions, and logarithmic functions that exceed addition, subtraction, and multiplication operations have high processing costs and have not yet been implemented. In the present invention, in order to solve these problems, an algorithm that can efficiently and uniformly approximate elementary function groups in secret computing is used, and the reciprocal of the square root can be efficiently calculated. This approximation method can approximate the main elementary functions including the reciprocal of the square root by simply changing the parameters in a single method. Furthermore, this approximation method is equivalent to the communication volume / number of rounds of three real number multiplication operations in single precision (23 bits), which is the theoretically optimal efficiency.

[0035] The reciprocal of the square root can be applied when the optimization method Adam in machine learning is introduced into secret computing. In order to calculate the reciprocal of the square root of the plain text efficiently, the following normalization is sometimes performed. -1 ) and the leftmost bit (MSB: most significant bit) of input a, and perform the following transformation. That is, multiply by 2 e Normalized to the interval [0.5,1), we can find the inverse of the square root 1 / √(2 e a) Then multiply by √2 e .

[0036]

Mathematical formula 2

[0037]

[0038] In non-patent document 1, in order to obtain the value [c] of the power of 2 multiplied for normalization, a protocol is performed by adding [√c] to the protocol for matching the leftmost bit. However, if the processing cost is evaluated, it is found that it is more efficient to first calculate [√c] and then multiply it by 2 to obtain [c]. Therefore, in the present invention, the reciprocal square root protocol disclosed in non-patent document 1 is transformed to first calculate [√c] and then multiply it by 2 to obtain [c].

[0039] The following is an algorithm for approximating elementary function groups in secret computation using 8th-degree polynomials.

[0040] [Algorithm 1: Function approximation protocol based on 8th degree polynomial]

[0041] Input: [x]∈[L,R)

[0042] Parameters: a, b, c, d, f, g, H, i, j, k, l, m, n, o, p, q, α, β, γ, δ, ζ

[0043] Output: [func(x)] corresponding to the target function func

[0044] 1: Calculate [y']:=[x(δx+ai)-j] by product sum, and lower the decimal point position by right shifting.

[0045] 2: Calculate [y]: = [y'+(ix+j)].

[0046] 3: Calculate [z']:=[y(ζy+bk)+(cl)xm] by product sum, and lower the decimal point position by right shifting.

[0047] 4: Calculate [z]: = [z' + (ky + lx + m)].

[0048] 5: Calculate [w' / γ] by product sum: = [z(αz+dn / γ)+(βx+fo / γ)y+(gp)x+(Hq) / γ], and perform multiplication based on γ and reduction of the decimal point to obtain [w'].

[0049] 6: Output [w]: = [w' + (nz + oy + px + q)].

[0050] The reduction of the decimal point position performed in steps 1 and 3 of Algorithm 1 can be efficiently performed by using the open division operation of the divisor disclosed in Non-Patent Document 1, for example.

[0051] The simultaneous execution of the public value multiplication and the decimal point reduction performed in step 5 of Algorithm 1 can be performed efficiently by using the following algorithm, for example.

[0052] [Algorithm 2: Performing public value multiplication simultaneously without increasing processing cost starting from right shift]

[0053] Input: [x], multiplier m, shift amount σ

[0054] Output: shifted [mx]

[0055] 1: Calculate the public value 2 σ / m.

[0056] 2: Calculate the following equation by dividing the public value. Here, [mx] is regarded as the expression where the decimal point position is lower than [x] by σ.

[0057]

Mathematical formula 3

[0058]

[0059] The parameters L, R, a, b, c, d, f, g, H, i, j, k, l, m, n, o, p, q, α, β, γ, δ, ζ used in Algorithm 1 are set according to the function func to be approximated. In the present invention, when the reciprocal function of finding the square root is to be approximated, the parameters can be set as shown in the following table. x ,e y ,e z ,e w is the decimal point position of x, y, z, w, e' y ,e' z ,e' w is the decimal point position of y', z', and w'. These are the parameters that determine the right shift amount in the 8th degree polynomial approximation. For example, the right shift amount when calculating y from y' is e' y -e y .

[0060]

Table 1

[0061]

[0062] The following is an algorithm for calculating the reciprocal of a square root in secret calculation using Algorithm 1. Here, the algorithm for calculating the reciprocal of a square root by normalizing the input to be calculated (Algorithm 3) and the algorithm for calculating the reciprocal of a square root using the algorithm (Algorithm 4) are described separately.

[0063] [Algorithm 3: Normalization protocol for the inverse of the square root]

[0064] Input: [a]

[0065] Output: [b], [r], [c'] (where b is the value after the leftmost bit of a is moved to the position of λ-1 (i.e., the value after a is normalized to [0.5,1)). r is a truth value indicating whether to multiply the result of the calculation by √2. c' is the power of 2 used in normalization and its inverse operation.)

[0066] 1: The bit representation of [a] is obtained by bit decomposition {a0},…,{a λ-1}.

[0067] 2: Set λ' and λ" by the following formula. That is, set the smallest integer greater than or equal to λ / 2 as λ', and set the largest integer less than or equal to λ / 2 as λ".

[0068]

Mathematical formula 4

[0069]

[0070] 3: When 0≤i<λ", set {a' i}:={a i ∨a i+1}. That is, calculate {a i} and {a i+1}'s "or".

[0071] 4: If λ is an odd number, set {a' λ'-1}:={a λ-1}.

[0072] a' is a bit string representing an integer obtained by connecting two bits of a at a time by OR.

[0073] 5: Get the bit string {x0},…,{x0} where only the leftmost bit of a' is 1 λ'-1}.

[0074] 6: Combine {x λ'-1},…,{x0}, let [c'].

[0075] 7: When 0≤i<λ", set {a" i}:={a 2i}.

[0076] 8: If λ is an odd number, set it to {a" λ'-1}:={a λ-1}.

[0077] a" is a bit string obtained by arranging the even-numbered bits of a (starting from 0).

[0078] 9: Calculate the sum of products {r}: = {x0a"0+…+x λ'-1 a" λ'-1}.

[0079] r is a true value indicating whether the MSB is located at an even bit.

[0080] 10: Set {r} to [r] through mod p transformation.

[0081] 11: Calculate [b]:=[c'][c'][r? 2a:a], and output [b], [r], [c'].

[0082] [Algorithm 4: Reciprocal Square Root Protocol]

[0083] Input: [a]

[0084] Output: [1 / √a]

[0085] 1: Use Algorithm 3 to obtain the value [b] after normalizing [a] to [0.5,1), and the [c'] and [r] required for the inverse normalization operation.

[0086] 2: Execute Algorithm 1 on [b] to calculate the inverse of the square root of [b]. At this time, the multiplication of the public value γ performed in step 5 of Algorithm 1 is performed with the condition set to [r] and the options set to √2γ, γ respectively, and the selective public multiplication is performed to calculate [w' / γ]*γ*[r? √2:1]. The result is set to [w].

[0087] 3: Calculate [w][c'].

[0088] The generation of the flag string indicating the leftmost bit executed in step 5 of Algorithm 3 can be performed efficiently by using the following algorithm, for example.

[0089] [Algorithm 5: MSB flag string acquisition protocol]

[0090] Input: integers represented by bits {a0},…,{a λ-1}

[0091] Output: A bit string {x0},...,{x λ-1}

[0092] 1: When 0≤i<λ-1, set {f i}:={f i+1 ∨a i}.

[0093] 2: Set {f λ-1}:={a λ-1}. So far, {f0},…,{f λ-1}It becomes a bit string arranged in 01 with MSB as the boundary, such as 0,0,0,1,1,1,…,1.

[0094] 3: When 0≤i<λ-1, set {x i}:={f i XOR f i+1}.

[0095] 4: Set {x λ-1}:={a λ-1}. So far, {x0},…,{x λ-1}It becomes a bit string in which only the MSB position is 1, such as 0,0,0,1,0,0,…,0.

[0096] The selective public multiplication operation performed in step 2 of Algorithm 4 can be performed efficiently by using the following algorithm, for example.

[0097] [Algorithm 6: Multiplication of the value to be right-shifted by the optional public multiplier]

[0098] Input: [a], multipliers m0, m1, condition [c]

[0099] Output: [m1a] if c = 1, [m0a] if c = 0

[0100] 1: Calculate [m1a], [m0a].

[0101] 2: Through the if-then-else gate, output [c? m1a:m0a].

[0102] The public value multiplication operation performed in step 1 of Algorithm 6 can be efficiently performed by combining Algorithm 2 with the following algorithm, for example.

[0103] [Algorithm 7: Right shift / divisor open division operation under multiple divisors]

[0104] Input: [a], divisors d0, d1, …, d n-1

[0105] Output: [a / d0],[a / d1],…,[a / d n-1 ]

[0106] 1: Find the quotient [q] of [a].

[0107] 2: Using the quotient [q], calculate and output [a / d i ].

[0108] The quotient obtained in step 1 of Algorithm 7 can be obtained efficiently by quotient transfer (see Reference 1).

[0109] "Reference 1" Ryo Kikuchi, Dai Ikarashi, Takahiro Matsuda, Koki Hamada, and Koji Chida, "Efficient bit-decomposition and modulus-conversion protocols with an honest majority," Proceedings of Information Security and Privacy-23rdAustralasian Conference (ACISP 2018), pp.64-82, July 11-13, 2018.

[0110] <Secret Square Root Reciprocal Calculation System 100>

[0111] The secret reciprocal square root calculation system 100 of the embodiment is an information processing system that executes the reciprocal square root protocol described above. Figure 1 As shown, the secret square root inverse calculation system 100 includes N (≥3) secret calculation devices 11, ..., 1 N In this embodiment, the secure computing devices 11, ..., 1 N Each of the devices is connected to a communication network 9. The communication network 9 is a circuit switching or packet switching communication network configured so that each connected device can communicate with each other, such as the Internet, LAN (Local Area Network), WAN (Wide Area Network), etc. In addition, each device does not necessarily need to be able to communicate online via the communication network 9. For example, it can also be configured so that the input to the secure computing device 1 n The information of (n=1, ..., N) is stored in a removable recording medium such as a magnetic tape or a USB memory, and is input from the removable recording medium to the secure computing device 1 in an offline manner. n .

[0112] The secure computing device 1 included in the secure inverse square root computing system 100 of the embodiment n For example Figure 2 As shown, the invention has a bit decomposition unit 11, a first bit string generation unit 12, a flag string generation unit 13, a normalization multiplier generation unit 14, a second bit string generation unit 15, a flag calculation unit 16, a flag conversion unit 17, a normalization unit 18, a square root inverse calculation unit 19, and an inverse normalization unit 20. The square root inverse calculation unit 19 is, for example, Figure 3The secure computing device 100 includes a parameter storage unit 190, a first product-sum unit 191, a first adding unit 192, a second product-sum unit 193, a second adding unit 194, a third product-sum unit 195, a selected product calculating unit 196, and a third adding unit 197. n By connecting to other secure computing devices 1 n' (n'=1, ..., N, where n≠n') coordinates, while performing the processing of each step described later, the secret square root inverse calculation method of the implementation method is realized.

[0113] Secret computing device 1 n For example, it is a special device that is constructed by reading a special program into a well-known or special computer having a central processing unit (CPU) and a main storage device (RAM) and the like. n For example, each process is executed under the control of a central processing unit. n The data or data obtained in each process is stored in a main storage device, for example. The data stored in the main storage device is read out to the central processing unit as needed and used in other processes. n Each processing unit of the secure computing device 1 may also be at least partially composed of hardware such as an integrated circuit. n Each storage unit may be composed of a main storage device such as RAM (Random Access Memory), an auxiliary storage device composed of a semiconductor memory element such as a hard disk, an optical disk or a flash memory, or middleware such as a relational database or a key-value storage.

[0114] refer to Figure 4 , describing the processing procedure of the secret inverse square root calculation method executed by the secret inverse square root calculation system 100 of the implementation mode.

[0115] In step S11, each secure computing device 1 n The bit decomposition unit 11 decomposes the distributed value [a] of the value a input to the secret inverse square root calculation system 100 into bits to obtain a string of distributed values ​​{a0}, ..., {a λ-1 The bit decomposition unit 11 converts the string of distributed values ​​{a0},...,{a λ-1} is output to the first bit string generation unit 12 and the second bit string generation unit 15.

[0116] In step S12, each secure computing device 1 nThe first bit string generation unit 12 uses the scattered value string {a0}, ..., {a λ-1}, when each i<λ" generates {a' i}:={a i ∨a i+1} of the bit string a'0,…,a' λ'-1 The string of discrete values ​​{a'0},...,{a' λ'-1 Here, λ' is the smallest integer greater than or equal to λ / 2, and λ" is the largest integer less than or equal to λ / 2. That is, for each integer i greater than or equal to 0 and less than λ", the scattered value {a i} and the scattered value {a i+1} after the "or" bit a' i The scattered values ​​of {a' i} is calculated. Furthermore, when λ is an odd number, let {a' λ'-1}:={a λ-1 The first bit string generator 12 generates a string of distributed values ​​{a'0}, ..., {a' λ'-1} is output to the flag string generation unit 13.

[0117] In step S13, each secure computing device 1 n The marker string generation unit 13 uses the scattered value string {a'0}, ..., {a' λ'-1}, generate the string x0,…,x representing the leftmost bit of the value a' λ'-1 The string of discrete values ​​{x0},…,{x λ'-1 The flag string indicating the leftmost bit is, for example, a flag string obtained by using only the above-mentioned algorithm 5 in which the leftmost bit position is 1. The flag string generation unit 13 generates a sequence of distributed values ​​{x0}, ..., {x λ'-1} is output to the normalization multiplier generation unit 14 and the flag calculation unit 16.

[0118] In step S14, each secure computing device 1 n The normalized multiplier generation unit 14 generates the scattered value string {x0}, ..., {x λ'-1 The bits are combined in reverse order to generate a distributed value [c′] of a multiplier c′ (hereinafter also referred to as a “normalization multiplier”) by which the calculation result is multiplied for normalization and its inverse operation. The normalization multiplier generation unit 14 outputs the distributed value [c′] to the normalization unit 18 .

[0119] In step S15, each secure computing device 1 n The second bit string generation unit 15 uses the scattered value string {a0}, ..., {a λ-1}, generating {a" when each i<λ" i}:={a 2i} bit string a"0,…,a" λ'-1 The string of discrete values ​​is {a"0},…,{a" λ'-1 That is, for each integer i greater than or equal to 0 and less than λ", the scattered value {a 2i} is set to bit a" i The scattered value of {a" i}. Furthermore, when λ is an odd number, let {a" λ'-1}:={a λ-1 The second bit string generation unit 15 generates a string of scattered values ​​{a"0}, ..., {a" λ'-1} is output to the flag calculation unit 16.

[0120] In step S16, each secure computing device 1 n The flag calculation unit 16 uses the scattered value string {x0}, ..., {x λ'-1} and {a"0},…,{a" λ'-1}, calculate the scattered value [r] of the flag r (hereinafter also referred to as the "multiplication flag") indicating whether the calculation result is multiplied by √2. Specifically, for each integer i greater than or equal to 0 and less than λ', {x i} and {a" i That is, calculate {r}:={x0a"0+…+x λ'-1 a" λ'-1 The flag calculation unit 16 outputs the scattered value [r] to the flag conversion unit 17.

[0121] In step S17, each secure computing device 1 n The sign conversion unit 17 converts the scattered value {r} of the multiplication flag r into a scattered value [r] by mod p conversion. The sign conversion unit 17 outputs the scattered value [r] to the inverse square root calculation unit 19.

[0122] In step S18, each secure computing device 1 n The normalization unit 18 uses the scattered value [a] of the value a, the scattered value [c'] of the normalization multiplier c', and the scattered value [r] of the multiplication flag r to calculate [c'][c'][2a] when r=1 and [c'][c'][a] when r=0 to obtain the scattered value [b] of the value b normalized by the value a. That is, [b] is calculated:=[c'][c'][r? 2a:a]. The normalization unit 18 outputs the scattered value [b] to the inverse square root calculation unit 19.

[0123] In step S19, each secure computing device 1 nThe reciprocal square root calculation unit 19 executes Algorithm 1 by using the parameters of the reciprocal function that approximates the square root with an 8th-degree polynomial, and calculates the reciprocal of the square root for the scattered value [b] of the value b. At this time, the multiplication operation of the public value γ performed in step 5 of Algorithm 1 is performed by setting the condition to the scattered value [r] of the multiplication operation flag, and setting the options to √2γ, γ respectively to execute Algorithm 6. That is, the reciprocal square root calculation unit 19 uses the scattered value [b] of the value b and the scattered value [r] of the multiplication operation flag r, calculates [1 / √b]*√2 when r=1, and calculates [1 / √b] when r=0, and generates a scattered value [w] of the calculation result w. The reciprocal square root calculation unit 19 outputs the scattered value [w] to the inverse normalization unit 20.

[0124] In step S20, each secure computing device 1 n The denormalization unit 20 multiplies the variance value [w] of the calculation result w by the variance value [c′] of the normalization multiplier c′, and outputs the result as a variance value [1 / √a] which is the inverse of the square root of the value a.

[0125] refer to Figure 5 , the processing procedure performed by the inverse square root calculation unit 19 is described in detail.

[0126] Parameters a, b, c, d, f, g, H, i, j, k, l, m, n, o, p, q, α, β, γ, δ, and ζ for approximating the reciprocal function of the square root with an 8th-degree polynomial are stored in the parameter storage unit 190. Each parameter is predetermined according to the function to be approximated, and when the reciprocal function of the square root is to be approximated, the values ​​exemplified in Table 1 may be set.

[0127] In step S191, the first product-sum unit 191 of the inverse square root calculation unit 19 calculates [y']:=[x(δx+ai)-j] by product-sum calculation, and lowers the decimal point position by right shifting. Here, x is the value b after the value a is normalized. That is, [x]:=[b]. The first product-sum unit 191 outputs [y'] to the first addition unit 192.

[0128] In step S192 , the first adder 192 of the inverse square root calculator 19 calculates [y]:=[y′+(ix+j)]. The first adder 192 outputs [y] to the second product-sum calculator 193 .

[0129] In step S193 , the second product-sum unit 193 of the inverse square root calculation unit 19 calculates [z′]:=[y(ζy+bk)+(cl)xm] by product-sum calculation, lowering the decimal point position by right shifting, and outputs [z′] to the second addition unit 194 .

[0130] In step S194 , the second adding unit 194 of the inverse square root calculating unit 19 calculates [z]:=[z′+(ky+lx+m)]. The second adding unit 194 outputs [z] to the third product-sum unit 195 .

[0131] In step S195 , the third product-sum unit 195 of the inverse square root calculation unit 19 calculates [w′ / γ]:=[z(αz+dn / γ)+(βx+fo / γ)y+(gp)x+(Hq) / γ] by product-sum. The third product-sum unit 195 outputs [w′ / γ] to the selection product calculation unit 196 .

[0132] In step S196, the selective product calculation unit 196 of the square root inverse calculation unit 19 sets the condition to [r], sets the options to √2γ and γ, respectively, and executes Algorithm 6. That is, using the scattered value {r} of the multiplication operation flag r, [w'] is calculated when r = 1: = [w' / γ] * √2γ, and [w'] is calculated when r = 0: = [w' / γ] * γ. The selective product calculation unit 196 outputs [w'] to the third adding unit 197.

[0133] In step S197 , the third adding section 197 of the inverse square root calculating section 19 calculates [w]:=[w′+(nz+oy+px+q)].

[0134] [Variation: Secret Normalization System]

[0135] The secret reciprocal square root calculation system 100 of the embodiment is configured to execute both normalization (algorithm 3) for reciprocal square root calculation and reciprocal square root calculation (algorithm 4). The secret normalization system of the modified example is configured to execute only the part of normalization (algorithm 3) for reciprocal square root calculation in the secret normalization system 100. That is, the secret normalization system takes the scattered value [a] of the value a as input, and outputs the scattered value [b] of the value b after normalizing the value a to [0.5, 1), the scattered value [c'] of the normalized multiplier c', and the scattered value [r] of the multiplication operation flag r. Specifically, the secret calculation device 1 included in the secret normalization system of the modified example n The apparatus comprises a bit decomposition unit 11 , a first bit string generation unit 12 , a flag string generation unit 13 , a normalization multiplier generation unit 14 , a second bit string generation unit 15 , a flag calculation unit 16 , a flag conversion unit 17 , and a normalization unit 18 .

[0136] The above describes the embodiments of the present invention, but the specific structure is not limited to these embodiments. Needless to say, even if there are appropriate design changes within the scope of the purpose of the present invention, they are also included in the present invention. The various processes described in the embodiments are not only executed in a time series according to the order of the description, but can also be executed in parallel or individually according to the processing capacity or needs of the device executing the processing.

[0137] [Program, recording medium]

[0138] When the various processing functions in the various devices described in the above embodiments are implemented by a computer, the processing contents of the functions that each device should have are recorded in a program. Then, the program is read into Figure 6 In the storage unit 1020 of the computer shown in the figure, by operating the control unit 1010, the input unit 1030, the output unit 1040, etc., various processing functions in the above-mentioned devices are realized on the computer.

[0139] The program describing the processing contents may be recorded in a computer-readable recording medium. The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory.

[0140] The program may be circulated by selling, transferring, renting, or other removable recording media such as DVDs and CD-ROMs that record the program. Furthermore, the program may be stored in a storage device of a server computer and circulated by forwarding the program from the server computer to other computers via a network.

[0141] The computer executing such a program, for example, first temporarily stores the program recorded in a removable recording medium or the program forwarded from a server computer in its own storage device. Then, when executing the process, the computer reads the program stored in its own storage device and executes the process according to the read program. Moreover, as another execution method of the program, the computer can also directly read the program from the removable recording medium and execute the process according to the program, and further, it can also successively execute the process according to the received program each time the program is forwarded from the server computer to the computer. Moreover, it can also be set as a structure that performs the above-mentioned process by not forwarding the program from the server computer to the computer, but only realizing the processing function through the execution instruction and the result acquisition, so-called ASP (Application Service Provider) type service. Moreover, the program in this method contains information for the processing of the electronic computer, that is, information based on the program (although not a direct instruction to the computer, but having the nature of specifying the processing of the computer, etc.).

[0142] Furthermore, in this embodiment, the present device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

Claims

1. A secret square root inverse calculation system, comprising a plurality of secret calculation devices, taking a dispersed value [a] of a value a as input, and calculating a dispersed value [1 / √a] of the inverse of the square root of the value a while concealing the value a, λ is the decimal point position of the value a, λ' is the smallest integer greater than or equal to λ / 2, λ" is the largest integer less than or equal to λ / 2, The secret computing device comprises: A bit decomposition unit generates a bit representation a0, ..., a of the value a from the distributed value [a] λ-1 The string of discrete values ​​{a0},…,{a λ-1 }; The first bit string generating unit calculates the dispersion value {a i } and the scattered value {a i+1 }"or" bit a' i The scattered values ​​of {a' i }, generate the bit string a'0,…,a' λ'-1 The string of discrete values ​​{a'0},...,{a' λ'-1 }, where, when λ is an odd number, set to {a' λ'-1 }:={a λ-1 }; The marker string generation unit generates a string {a'0}, ..., {a' λ'-1 } the leftmost bit of the string x0,…,x λ'-1 The string of discrete values ​​{x0},…,{x λ'-1 }; The normalization multiplier generation unit generates a string {x0}, ..., {x λ'-1 } The scattered value [c'] of the normalized multiplier c' after bit combination in reverse order; The second bit string generating unit generates the distributed value {a 2i } is set to bit a" i The scattered value of {a" i }, generate the bit string a"0,…,a" λ'-1 The string of discrete values ​​is {a"0},…,{a" λ'-1 }, where, when λ is an odd number, it is set to {a" λ'-1 }:={a λ-1 }; The flag calculation unit calculates, for each integer j that is greater than or equal to 0 and less than λ', the distributed value {x j } with the scattered value {a" j } after summing the products of the multiplication operation flag r; The normalization unit uses the variance value [a], the variance value [c'], and the variance value {r} to obtain a variance value [b] obtained by calculating [c'][c'][2a] when r=1 and calculating [c'][c'][a] when r=0; a square root inverse calculation unit that uses the dispersion value [b] and the dispersion value {r} to calculate a dispersion value [w] obtained by approximating [1 / √b]*√2 with an 8th-order polynomial when r=1 and approximating [1 / √b] with an 8th-order polynomial when r=0; and The inverse normalization unit calculates the variance value [1 / √a] obtained by multiplying the variance value [w] by the variance value [c′].

2. The secret inverse square root calculation system as claimed in claim 1, wherein: Let a, b, c, d, f, g, H, i, j, k, l, m, n, o, p, q, α, β, γ, δ, ζ be the parameters for approximating the square root function with an 8th-degree polynomial, let [x]:=[b], The square root inverse calculation unit comprises: The first product-sum part calculates [y']:=[x(δx+ai)-j]; The first adding part calculates [y]:=[y'+(ix+j)]; The second product-sum part calculates [z']:=[y(ζy+bk)+(cl)xm]; The second adding part calculates [z]:=[z'+(ky+lx+m)]; The third product and sum part, calculate [w' / γ]:=[z(αz+dn / γ)+(βx+fo / γ)y+(gp)x+(Hq) / γ]; a selective product calculation unit that uses the variance value {r} to calculate [w' / γ]*√2γ when r=1 and [w' / γ]*γ when r=0, and sets the calculation result to [w']; and The third adding unit calculates [w]:=[w'+(nz+op+px+q)].

3. A secret normalization system, comprising a plurality of secret computing devices, normalizing the scattered values ​​[a] of the value a in order to calculate the scattered values ​​[1 / √a] of the reciprocal of the square root of the value a while concealing the value a, λ is the decimal point position of the value a, λ' is the smallest integer greater than or equal to λ / 2, λ" is the largest integer less than or equal to λ / 2, The secret computing device comprises: A bit decomposition unit generates a bit representation a0, ..., a of the value a from the distributed value [a] λ-1 The string of discrete values ​​{a0},…,{a λ-1 }; The first bit string generating unit calculates the dispersion value {a i } and the scattered value {a i+1 }"or" bit a' i The scattered values ​​of {a' i }, generate the bit string a'0,…,a' λ'-1 The string of discrete values ​​{a'0},...,{a' λ'-1 }, where, when λ is an odd number, set to {a' λ'-1 }:={a λ-1 }; The marker string generation unit generates a string {a'0}, ..., {a' λ'-1 } the leftmost bit of the string x0,…,x λ'-1 The string of discrete values ​​{x0},…,{x λ'-1 }; The normalization multiplier generation unit generates a string {x0}, ..., {x λ'-1 } The scattered value [c'] of the normalized multiplier c' after bit combination in reverse order; The second bit string generating unit generates the distributed value {a 2i } is set to bit a" i The scattered value of {a" i }, generate the bit string a"0,…,a" λ'-1 The string of discrete values ​​is {a"0},…,{a" λ'-1 }, where, when λ is an odd number, it is set to {a" λ'-1 }:={a λ-1 }; The flag calculation unit calculates, for each integer j that is greater than or equal to 0 and less than λ', the distributed value {x j } with the scattered value {a" j } after summing the products of the multiplication operation flag r; and The normalization unit obtains a variance value [b] obtained by calculating [c'][c'][2a] when r=1 and [c'][c'][a] when r=0, using the variance value [a], the variance value [c'], and the variance value {r}.

4. A secret square root inverse calculation method, performed by a secret square root inverse calculation system, wherein the secret square root inverse calculation system comprises a plurality of secret calculation devices, wherein a dispersed value [a] of a value a is set as input, and a dispersed value [1 / √a] of the inverse of the square root of the value a is calculated while concealing the value a. λ is the decimal point position of the value a, λ' is the smallest integer greater than or equal to λ / 2, λ" is the largest integer less than or equal to λ / 2, The bit decomposition unit of each secure computing device generates a bit representation a0, ..., a of the value a from the distributed value [a]. λ-1 The string of discrete values ​​{a0},…,{a λ-1 }, The first bit string generation unit of each secret computing device calculates the distributed value {a i } and the scattered value {a i+1 }"or" bit a' i The scattered values ​​of {a' i }, generate the bit string a'0,…,a' λ'-1 The string of discrete values ​​{a'0},...,{a' λ'-1 },in, When λ is an odd number, set {a' λ'-1 }:={a λ-1 }, The identifier string generation unit of each secure computing device generates a string {a'0}, ..., {a' λ'-1 } the leftmost bit of the string x0,…,x λ'-1 The string of discrete values ​​{x0},…,{x λ'-1 }, The normalization multiplier generation unit of each secure computing device generates a string {x0}, ..., {x λ'-1 } The scattered value [c'] of the normalized multiplier c' after bit combination in reverse order, The second bit string generation unit of each secure computing device generates the distributed value {a 2i } is set to bit a" i The scattered value of {a" i }, generate the bit string a"0,…,a" λ'-1 The string of discrete values ​​is {a"0},…,{a" λ'-1 }, where, when λ is an odd number, it is set to {a" λ'-1 }:={a λ-1 }, The signature calculation unit of each secure computing device calculates the distributed value {x j } with the scattered value {a" j } after summing the products of the multiplication operation flag r, The normalization unit of each secret computing device uses the distributed value [a], the distributed value [c'], and the distributed value {r} to obtain a distributed value [b] obtained by calculating [c'][c'][2a] when r=1 and calculating [c'][c'][a] when r=0. The inverse square root calculation unit of each secret computing device uses the distributed value [b] and the distributed value {r} to calculate a distributed value [w] obtained by approximating [1 / √b]*√2 with an 8th-order polynomial when r=1 and approximating [1 / √b] with an 8th-order polynomial when r=0. The denormalization unit of each secure computing device calculates the distributed value [1 / √a] obtained by multiplying the distributed value [w] by the distributed value [c′].

5. A secret normalization method, performed by a secret normalization system, wherein the secret normalization system comprises a plurality of secret computing devices, wherein in order to calculate a dispersed value [1 / √a] of the reciprocal of the square root of the value a while concealing the value a, dispersed values ​​[a] of the value a are normalized, λ is the decimal point position of the value a, λ' is the smallest integer greater than or equal to λ / 2, λ" is the largest integer less than or equal to λ / 2, The bit decomposition unit of each secure computing device generates a bit representation a0, ..., a of the value a from the distributed value [a]. λ-1 The string of discrete values ​​{a0},…,{a λ-1 }, The first bit string generation unit of each secret computing device calculates the distributed value {a i } and the scattered value {a i+1 }"or" bit a' i The scattered values ​​of {a' i }, generate the bit string a'0,…,a' λ'-1 The string of discrete values ​​{a'0},...,{a' λ'-1 },in, When λ is an odd number, set {a' λ'-1 }:={a λ-1 }, The identifier string generation unit of each secure computing device generates a string {a'0}, ..., {a' λ'-1 } the leftmost bit of the string x0,…,x λ'-1 The string of discrete values ​​{x0},…,{x λ'-1 }, The normalization multiplier generation unit of each secure computing device generates a string {x0}, ..., {x λ'-1 } The scattered value [c'] of the normalized multiplier c' after bit combination in reverse order, The second bit string generation unit of each secure computing device generates the distributed value {a 2i } is set to bit a" i The scattered value of {a" i }, generate the bit string a"0,…,a" λ'-1 The string of discrete values ​​is {a"0},…,{a" λ'-1 }, where, when λ is an odd number, it is set to {a" λ'-1 }:={a λ-1 }, The signature calculation unit of each secure computing device calculates the distributed value {x j } with the scattered value {a" j } after summing the products of the multiplication operation flag r, The normalization unit of each secure computing device uses the distributed value [a], the distributed value [c'], and the distributed value {r} to obtain the distributed value [b] obtained by calculating [c'][c'][2a] when r=1 and [c'][c'][a] when r=0.

6. A secret computing device used in the secret inverse square root computing system of claim 1 or 2 or the secret normalization system of claim 3.

7. A computer program product, comprising a computer program, wherein the computer program is used to enable a computer to function as the secret computing device as described in claim 6.

Images