Secret selected product calculation system, secret selected product calculation method, secret calculation device and program product

Abstract

In secret computing, selected products are calculated at high speed. The secret selected product calculation system (100) converts the conditions [c0], ..., [c n‑1 ] and 2 values ​​of table m 0,0 ,m 0,1 ,…,m n‑1,0 ,m n‑1,1 As input, the total product [A] of the multipliers selected according to the condition output is calculated by the condition integration unit (11). i c i+1 The table conversion unit (12) generates m' 00 :=m i, 0m i+1,0 、m' 01 :=m i,0 m i+1,1 、m' 10 :=m i,1 m i+1,0 、m' 11 :=m i,1 m i+1,1 The 4-value table m' 00 ,m' 01 ,m' 10 ,m' 11 The public value multiplication unit (13) calculates [a i ]:=[c i c i+1 ](m 00 +m 11 ‑m 01 ‑m 10 )+[c i ](m i+1,0 ‑m i,0 )+[c i+1 ](m i,1 ‑m i,0 )+m i,0 The real number multiplication unit (14) calculates all multiplications by [a i ] value [A]. When n is an odd number, the multiplication unit (15) is selected according to c n‑1 Will start from m n‑1,0 ,m n‑1,1 The selected multiplier is multiplied by [A].

Description

Technical Field

[0001] The present invention relates to a technique for computing selected products in secret computing. Background Art

[0002] The so-called secret computing refers to encryption technology that calculates arbitrary functions while keeping data secret. It is expected that this feature can be used to make data utilization without leaking data to system operators and data users. It is known that there are several methods in secret computing, among which secret computing that uses secret distribution as a component has a small data processing unit and can be processed at a high speed.

[0003] Secret dispersion is a method of converting secret information into several fragments called shares. For example, there is a secret dispersion called the (k,n) threshold method, which generates n shares from secret information and can be restored from more than k shares, but does not leak information from less than k shares. Shamir secret dispersion, replicated secret dispersion, and the like are known as specific methods of constructing secret dispersion. In this specification, a fragment of a value dispersed by secret dispersion is called a "share". In addition, the collection of all shares is collectively called a "dispersed value".

[0004] In recent years, research on highly statistical or machine learning based on secret computing has become popular. However, most of these operations include calculations such as reciprocals, square roots, exponents, and logarithms that exceed the addition, subtraction, and multiplication operations that secret computing is good at. The selected product is an operation of performing a reference value multiple times and selecting from a table of two values ​​consisting of public values, and multiplying the reference result. The selected product is used when calculating an exponential function through secret computing. In Non-Patent Document 1, a method for calculating an exponential function in secret computing is disclosed, in which the calculation of the selected product is used.

[0005] Prior art literature

[0006] Non-patent literature

[0007] Non-Patent Literature 1: Dai Igarashi, "Design and Implementation of a Secret Real Number Operation Group for the Implementation of Secret Computation AI - Right Shift of O(|p|) Bit Communication O(1) Circle for Real Numbers -", ​​CSS2019, 2019 Summary of the invention

[0008] Problems to be solved by the invention

[0009] However, the method disclosed in Non-Patent Document 1 has a problem of high calculation cost.

[0010] In view of the above-mentioned technical problems, an object of the present invention is to provide a secret computing technology capable of calculating a selected product at high speed.

[0011] Means for solving problems

[0012] In order to solve the above-mentioned problem, a secret selected product calculation system of one embodiment of the present invention includes a plurality of secret calculation devices, which calculate n conditions c0, ..., c n-1 The string of discrete values ​​[c0],…,[c n-1 ] and a table m of two values ​​that correspond to the conditions and the two multipliers respectively 0,0 ,m 0,1 ,…,m n-1,0 ,m n-1,1 As input, a distributed value [A] of the total product of multipliers selected according to a condition is output, and the secret computing device includes: a condition integration unit, for each even number i greater than 0 and less than n, calculating the distributed value [c i ] and the dispersion value [c i+1 ] multiplied by the scattered value [c i c i+1 ]; Table conversion unit, for each even number i greater than 0 and less than n, generates m' 00 :=m i, 0m i+1,0 、m' 01 :=m i,0 m i+1,1 、m' 10 :=m i,1 m i+1,0 、m' 11 :=m i,1 m i+1,1 The 4-value table m' 00 ,m' 01 ,m' 10 ,m' 11 ; The public value multiplication unit generates and calculates [c i c i+1 ](m 00 +m 11 -m 01 -m 10 )+[c i ](m i+1,0 -m i,0 )+[c i+1 ](m i,1 -m i,0 )+m i,0 The value after a i The dispersion value [a i ]'s public value multiplication unit; real number multiplication unit, calculates all multiplications by the scattered value [ai ]; and select the multiplication unit, when n is an odd number, according to the condition c n-1 The multiplier m n-1,1 ,m n-1,0 The selected multiplier is multiplied by the scatter value [A].

[0013] Effects of the Invention

[0014] According to the present invention, it is possible to calculate selected products at high speed in secret computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a diagram illustrating the functional structure of a secret selected product calculation system.

[0016] Figure 2 This is a diagram illustrating the functional structure of a secure computing device.

[0017] Figure 3 This is a diagram illustrating the processing procedure of the secret selected product calculation method.

[0018] Figure 4 This is a diagram illustrating a functional structure of a computer. DETAILED DESCRIPTION

[0019] Hereinafter, the embodiments of the present invention will be described in detail. In addition, the same reference numerals are attached to components having the same functions in the drawings, and duplicate descriptions are omitted.

[0020] In this specification, the following notations are used.

[0021] [·] is data after the value is anonymized. For example, the distributed value can be used using Shamir secret distribution, copy secret distribution, etc.

[0022] [a? b:c] means that if a=1, it means b, and if a=0, it means c.

[0023]

Mathematical formula 1

[0024]

[0025] They represent NOT, AND, OR, and XOR respectively.

[0026] By determining the decimal point position in the integers on the ring, it can be regarded as a real number with a fixed decimal point. In the present invention, the real number with a fixed decimal point represented on the ring in this way is simply expressed as a real number.

[0027] [Implementation method: Secret selection product calculation system]

[0028] The embodiment of the present invention is a secret selected product calculation system and method that takes as input a string of dispersed values ​​of n conditions and a table of two values ​​consisting of two public values ​​corresponding to each condition, refers to the table of two values ​​according to each condition, and outputs a dispersed value of a value multiplied by all reference results. The following is an overview of the selected public multiplication operation protocol performed by the secret selected product calculation system of the embodiment.

[0029] In the calculation of exponential functions, etc., operations of selecting from a binary table consisting of public values ​​according to a secret truth value reference value are performed multiple times, and processing such as multiplying the respective reference results is performed. Hereinafter, this processing is referred to as "the public table of binary values ​​should be referenced". In this case, it is more effective to refer to a table of 4 values ​​by combining two binary tables. Combining two binary tables to form a table of 4 values ​​is a calculation of public values, so it can be processed with high precision. If this method is used, it is also advantageous in terms of precision because the number of real number multiplication operations in secret calculations is reduced. The following shows an algorithm for referring to the public table of binary values ​​executed in the present invention.

[0030] [Algorithm 1: Reference to the public table of 2 values]

[0031] Input: multiplier m 0,0 ,m 0,1 ,…,m n-1 ,0,m n-1 ,1. Condition [c0],…,[c n-1 ]

[0032] Output:

[0033]

Mathematical formula 2

[0034]

[0035] 1: Set n2 to the largest even number less than n.

[0036] 2: for each i∈{0,2,…,n2-2}

[0037] 3: Calculate [c i c i+1 ].

[0038] 4: Set to m' 00 :=m i,0 m i+1,0 、m' 01 :=m i,0 m i+1,1 、m' 10 :=m i,1 m i+1,0 、m' 11 :=m i,1 m i+1,1 .

[0039] 5: Calculate [a i ]:=[c i c i+1 ](m 00 +m 11 -m 01 -m 10 )+[c i ](m i+1,0 -m i,0 )+[c i+1 ](m i,1 -m i,0 )+m i,0 .

[0040] 6: Calculate the following expression by real number multiplication. If n is an odd number, the final right shift is not performed.

[0041]

Mathematical formula 3

[0042]

[0043] 7: If n is an odd number, the remaining m n-1,0 ,m n-1,1 By [c n-1 ] is selected and multiplied by [A] for output.

[0044] The selected public multiplication operation performed in step 7 of Algorithm 1 can be performed efficiently by using, for example, Algorithm 2 below.

[0045] [Algorithm 2: Multiplication of the value to be right-shifted based on the selected public multiplier]

[0046] Input: [a], multipliers m0, m1, condition [c]

[0047] Output: [m1a] if c = 1, [m0a] if c = 0

[0048] 1: Calculate [m1a], [m0a].

[0049] 2: Through the if-then-else gate, output [c? m1a:m0a].

[0050] The public value multiplication operation executed in step 1 of Algorithm 2 can be performed efficiently by combining the following two algorithms, for example.

[0051] [Algorithm 3: Performing public value multiplication simultaneously without increasing processing cost starting from right shift]

[0052] Input: [x], multiplier m, shift amount σ

[0053] Output: shifted [mx]

[0054] 1: Calculate the public value 2 σ / m.

[0055] 2: Calculate the following equation by dividing the public value. Here, [mx] is regarded as the expression where the decimal point position is lower than [x] by σ.

[0056]

Mathematical formula 4

[0057]

[0058] [Algorithm 4: Right shift / divisor open division operation based on multiple divisors]

[0059] Input: [a], divisors d0, d1, …, d n-1

[0060] Output: [a / d0],[a / d1],…,[a / d n-1 ]

[0061] 1: Find the quotient [q] of [a].

[0062] 2: Using the quotient [q], calculate and output [a / d i ].

[0063] The quotient obtained in step 1 of Algorithm 4 can be obtained efficiently by quotient transfer (see Reference 1).

[0064] "Reference 1" Ryo Kikuchi, Dai Ikarashi, Takahiro Matsuda, Koki Hamada, and Koji Chida, "Efficient bit-decomposition and modulus-conversion protocols with an honest majority," Proceedings of Information Security and Privacy-23rdAustralasian Conference (ACISP 2018), pp.64-82, July 11-13, 2018.

[0065] When simply selecting from a 2-value table and multiplying, the selection of the 2 public values ​​is off-line, so it becomes (n-1) real number multiplication operations. In Algorithm 1, it is effective to use n / 2 integer multiplication operations and (n / 2)-1 real number multiplication operations, and right shift n / 2 times. Furthermore, in Algorithm 1, when n is an odd number, Algorithm 2 is used, and the mantissa of the table that cannot be combined with 4 values ​​is also effective.

[0066] For reference, the following shows an algorithm for calculating the exponential function on secret calculations using Algorithm 1.

[0067] 〔Algorithm 5: Exponential Function Protocol〕

[0068] Input: [a]

[0069] Output: [exp(a)]

[0070] Parameter: t := -1

[0071] 1: Calculate [a'] := [a] - μ.

[0072] 2: Extract the bits above the t bits below the decimal point by bit decomposition, transform mod p, and obtain [a'0], …, [a' u-1 .

[0073] 3: For each 0 ≤ i < u, set f i , ε i to the mantissa part and the exponent part of exp(2 i-t ), respectively.

[0074] 4: Using [a'0], …, [a' u-1 as conditions and 1, f0, 1, f1, …, 1, f u-1 as options, obtain the product [f'] through a public table referring to 2 values.

[0075] 5: For each 0 ≤ i < u, calculate the following formula through the if-then-else gate disclosed by the option.

[0076]

Mathematical Formula 5

[0077]

[0078] 6: Calculate the product [ε'] of [ε' i related to each i. This is the power of 2 of the exponent part of the upper bit part.

[0079] 7: Calculate the following formula. This is the representation number of the lower bit part.

[0080]

Mathematical Formula 6

[0081]

[0082] 8: Calculate the exponential function [exp(a' ρ )] for [a' ρ . Set the result to [w].

[0083] 9: Calculate [w][f'][ε']exp(μ) and output.

[0084] The multiplication operation based on the selected public multiplier performed in step 4 of Algorithm 3 can be performed efficiently by using Algorithm 1.

[0085] <Secret selection product calculation system 100>

[0086] The secret selection product calculation system 100 of the embodiment is an information processing system that executes the above-mentioned reference 2-value public table. Figure 1 As shown, the secret selected product computing system 100 includes N (≥3) secret computing devices 11, ..., 1 N In this embodiment, the secure computing devices 11, ..., 1 N Each of the devices is connected to a communication network 9. The communication network 9 is a circuit switching or packet switching communication network configured so that each connected device can communicate with each other, such as the Internet, LAN (Local Area Network), WAN (Wide Area Network), etc. In addition, each device does not necessarily need to be able to communicate online via the communication network 9. For example, it can also be configured so that the input to the secure computing device 1 n The information of (n=1, ..., N) is stored in a removable recording medium such as a magnetic tape or a USB memory, and is input from the removable recording medium to the secure computing device 1 in an offline manner. n .

[0087] For example, Figure 2 As shown, the secret computing device 1n included in the secret selected product computing system 100 of the embodiment includes: a condition integration unit 11, a table conversion unit 12, a public value multiplication unit 13, a real number multiplication unit 14, and a selection multiplication unit 15. The secret computing device 1n is connected to other secret computing devices 1 n' (n'=1, ..., N, where n≠n') coordinates and performs the processing of each step described later, thereby realizing the secret selected product calculation method of the implementation method.

[0088] Secret computing device 1 n For example, it is a special device that is constructed by reading a special program into a well-known or special computer having a central processing unit (CPU) and a main storage device (RAM) and the like. n For example, each process is executed under the control of a central processing unit. nThe data or data obtained in each process is stored in a main storage device, for example. The data stored in the main storage device is read out to the central processing unit as needed and used in other processes. n Each processing unit of the secure computing device 1 may also be at least partially composed of hardware such as an integrated circuit. n Each storage unit may be composed of a main storage device such as RAM (Random Access Memory), an auxiliary storage device composed of a semiconductor memory element such as a hard disk, an optical disk or a flash memory, or middleware such as a relational database or a key-value storage.

[0089] refer to Figure 3 , describing the processing procedure of the secret selected product calculation method executed by the secret selected product calculation system 100 of the implementation mode.

[0090] In the following, n2 is set to be the largest even number less than n. For each even number i greater than 0 and less than n2-2, the following steps S11 to S13 are executed.

[0091] In step S11, the condition integration unit 11 of each secure computing device 1n calculates the condition c i The dispersion value [c i ] and condition c i+1 The dispersion value [c i+1 ] The integration condition of multiplication c i c i+1 The dispersion value [c i c i+1 The condition integration unit 11 converts the scattered value [c i c i+1 ] is output to the public value multiplication unit 13.

[0092] In step S12, the table conversion unit 12 of each secure computing device 1n generates m' 00 :=m i,0 m i+1,0 、m' 01 :=m i,0 m i+1,1 、m' 10 :=m i,1 m i+1,0 、m' 11 :=m i,1 m i+1,1 The 4-value table m' 00 ,m' 01 ,m' 10 ,m' 11 The table conversion unit 12 converts the 4-value table m' 00 ,m' 01,m' 10 ,m' 11 The result is output to the public value multiplication unit 13 .

[0093] In step S13, each secure computing device 1 n The public value multiplication unit 13 calculates [a i ]:=[c i c i+1 ](m' 00 +m' 11 -m' 01 -m' 10 )+[c i ](m i+1,0 -m i,0 )+[c i+1 ](m i,1 -m i,0 )+m i,0 The public value multiplication unit 13 multiplies the distributed value [a i ] is output to the real number multiplication operation unit 14.

[0094] In step S14, each secure computing device 1 n The real number multiplication unit 14 calculates all the multiplications by the scattered value [a i ] is the scattered value [A] of the value A after ]. That is, the following formula is calculated. The multiplication operation becomes a real number multiplication operation, so it is necessary to perform a right shift at the end. When n is an odd number, the right shift is not performed here.

[0095]

Mathematical formula 7

[0096]

[0097] In step S15, each secure computing device 1 n The selection multiplication unit 15, when n is an odd number, if c n-1 =1, select m n-1,1 , if c n-1 =0, select m n-1,0 , multiplied by the scattered value [A] of value A and output. That is, calculate [A][c n-1 ? m n-1,1 :m n-1,0 ].

[0098] The above describes the embodiments of the present invention, but the specific structure is not limited to these embodiments. Needless to say, even if there are appropriate design changes within the scope of the purpose of the present invention, they are also included in the present invention. The various processes described in the embodiments are not only executed in a time series according to the order of the description, but can also be executed in parallel or individually according to the processing capacity or needs of the device executing the processing.

[0099] [Program, recording medium]

[0100] When the various processing functions in the various devices described in the above embodiments are implemented by a computer, the processing contents of the functions that each device should have are recorded in a program. Then, the program is read into Figure 4 In the storage unit 1020 of the computer shown in the figure, by operating the control unit 1010, the input unit 1030, the output unit 1040, etc., various processing functions in the above-mentioned devices are realized on the computer.

[0101] The program describing the processing contents may be recorded in a computer-readable recording medium. The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory.

[0102] The program may be circulated by selling, transferring, renting, or other removable recording media such as DVDs and CD-ROMs that record the program. Furthermore, the program may be stored in a storage device of a server computer and circulated by forwarding the program from the server computer to other computers via a network.

[0103] The computer executing such a program, for example, first temporarily stores the program recorded in a removable recording medium or the program forwarded from a server computer in its own storage device. Then, when executing the process, the computer reads the program stored in its own storage device and executes the process according to the read program. Moreover, as another execution method of the program, the computer can also directly read the program from the removable recording medium and execute the process according to the program, and further, it can also successively execute the process according to the received program each time the program is forwarded from the server computer to the computer. Moreover, it can also be set to a structure that performs the above-mentioned process by not forwarding the program from the server computer to the computer, but only by the execution instruction and the result acquisition to realize the processing function, so-called ASP (Application Service Provider) type service. Moreover, the program in this method contains information for the processing of the electronic computer, that is, information based on the program (although not a direct instruction to the computer, but having the nature of specifying the processing of the computer, etc.).

[0104] Furthermore, in this embodiment, the present device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

Claims

1. A secret selected product computing system, comprising a plurality of secret computing devices, which calculates n conditions c0,…,c n-1 The string of discrete values ​​[c0],…,[c n-1 ] and a table m of two values ​​that correspond to the conditions and two multipliers, respectively. 0,0 ,m 0,1 ,…,m n-1,0 ,m n-1,1 As input, output is the scattered value [A] of the total product of the multipliers selected according to the condition, The secret computing device comprises: The condition integration unit calculates the dispersion value [c i ] and the dispersion value [c i+1 ] after multiplication of the scattered value [c i c i+1 ]; The table conversion unit generates a table consisting of m' for each even number i that is greater than 0 and less than n. 00 :=m i,0 m i+1,0 、m' 01 :=m i,0 m i+1,1 、m' 10 :=m i,1 m i+1,0 、m' 11 :=m i,1 m i+1,1 The 4-value table m' 00 ,m' 01 ,m' 10 ,m' 11 ; The public value multiplication unit generates and calculates [c i c i+1 ](m' 00 +m' 11 -m' 01 -m' 10 )+[c i ](m i+1,0 -m i,0 )+[c i+1 ](m i,1 -m i,0 )+m i,0 The value after a i The dispersion value [a i ]; The real number multiplication unit calculates all the scattered values ​​[a i ]; and Select the multiplication unit, when n is an odd number, according to the condition c n-1 The multiplier m n-1,1 ,m n-1,0 The selected multiplier is multiplied by the scatter value [A].

2. A secret selected product calculation method, executed by a secret selected product calculation system, wherein the secret selected product calculation system comprises a plurality of secret calculation devices, and n-1 The string of discrete values ​​[c0],…,[c n-1 ] and a table m of two values ​​that correspond to the conditions and two multipliers, respectively. 0,0 ,m 0,1 ,…,m n-1,0 ,m n-1,1 As input, output is the scattered value [A] of the total product of the multipliers selected according to the condition, The condition integration unit of each secret computing device calculates the distributed value [c i ] and the dispersion value [c i+1 ] after multiplication of the scattered value [c i c i+1 ]; The table conversion unit generates a table consisting of m' for each even number i that is greater than 0 and less than n. 00 :=m i,0 m i+1,0 、m' 01 :=m i,0 m i+1,1 、m' 10 :=m i,1 m i+1,0 、m' 11 :=m i,1 m i+1,1 The 4-value table m' 00 ,m' 01 ,m' 10 ,m' 11 ; The public value multiplication unit generates and calculates [c i c i+1 ](m' 00 +m' 11 -m' 01 -m' 10 )+[c i ](m i+1,0 -m i,0 )+[c i+1 ](m i,1 -m i,0 )+m i,0 The value after a i The dispersion value [a i ]; The real number multiplication unit calculates all the scattered values ​​[a i ]; and When n is an odd number, the multiplication unit is selected according to the condition c n-1 The multiplier m n-1,1 ,m n-1,0 The selected multiplier is multiplied by the scatter value [A].

3. A secret computing device used in the secret selected product computing system of claim 1.

4. A computer program product comprising a computer program for causing a computer to function as the secure computing device recited in claim 3.

Images