Secret shifting system, secret shifting device, secret shifting method, recording medium

Abstract

Provided is a secret computing technology that uses a protocol for left shifting as input a numerical value to be shifted and a shift amount, and performs shift operations at high speed. The secret shift system is based on the share of the numerical value a [[a]] P and the share of the shift ρ <<ρ>> Q , calculate the fraction of the value s obtained by shifting the value a by ρ bits [[s]] P , which includes: an analog-to-digital conversion unit, calculating the share <<ρ>> p ; First flag calculation unit, calculate share [[f0]] 2 ,…,[[f L ]] 2 ; The second flag calculation unit calculates the share < <f1>> p ,…,< <f L >> p ; Shift calculation unit, calculate the share <<ρ'>> p ; Shift unit left, calculate share [[b]] P ; Right shift unit, calculate share [[c0]] P ,…,[[c d‑1 ]] P ; The third flag calculation unit calculates the share [[f0]] P ,…,[[f L ]] P ; and a shift value calculation unit, calculating the share [[s]] P .

Description

Technical Field

[0001] The present invention relates to secret computing technology, and more particularly to a technique for performing bitshift operations in secret computing. Background Art

[0002] Secret computing refers to a method of obtaining the result of a specified operation without restoring the encrypted value (for example, refer to Non-Patent Document 1). In the method of Non-Patent Document 1, encryption is performed to disperse multiple pieces of information that can restore the value to three secret computing devices. Without restoring the value, the results of addition and subtraction operations, constant sums, multiplications, constant multiples, logical operations (negation, logical AND, logical OR, exclusive OR), and data format conversions (integers, binary) can be maintained in a state where they are dispersed to three secret computing devices, that is, in an encrypted state. Usually, the number of dispersions is not limited to 3 and can be set to W (W is a specified constant of 3 or more). A protocol for implementing secret computing through coordinated computing based on W secret computing devices is called a multi-party protocol.

[0003] (Non-Patent Document 1: Koji Chida, Hiroki Hamada, Dai Igarashi, Katsumi Takahashi, "Rethinking Lightweight Verifiable 3-Party Secret Function Computation," In CSS, 2010.)

[0004] Previously, as documents related to the protocol or implementation of secret computing for performing floating point computation, there are Non-Patent Document 1 and Non-Patent Document 2. The bitshift operation required for floating point computation is an operation of shifting the bit pattern of a binary number to the left or right, and it is one of the basic operations in computer processing.

[0005] Prior Art Documents

[0006] Non-Patent Documents

[0007] Non-Patent Document 1: Takuma Amada, Shigehiro Nara, Takashi Nishide, Yu Kippu, "Multi-Party Computation for Reducing Communication Volume in Floating-Point Arithmetic," Transactions of the Information Processing Society of Japan, Vol. 60, No. 9, pp. 1433 - 1447, 2019.

[0008] Non-Patent Document 2: Randmets, J., "Programming Languages for Secure Multi-party Computation Application Development," PhD thesis. University of Tartu, 2017. Summary of the Invention

[0009] Problems to be Solved by the Invention

[0010] However, when performing a bit shift operation by secret computing, there is a problem of high computational cost because the operation is performed while concealing the left and right shift directions and shift amounts.

[0011] Therefore, an object of the present invention is to provide a secret computing technology that uses a protocol for left shifting using a numerical value to be shifted and a shift amount as input to perform a bit shift operation at high speed.

[0012] Means for solving problems

[0013] In a secret shift system according to one embodiment of the present invention, let P be a prime number, let p be the number of bits of the prime number P, let Q be the order of a factor ring, let M be the upper limit of the MSB position of the input value, let M' be the upper limit of the MSB position allowed by the share, and let [R, R'] be the range of the right shift amount covered by the divided right shift. The secret shift system is composed of three or more secret shift devices, and the share [[a]] of the value a is obtained by dividing the right shift amount. P and the share of the shift ρ <<ρ>> Q (where ρ ≥ 0 indicates a left shift, and ρ < 0 indicates a right shift), calculate the fraction [[s]] of the value s obtained by shifting the value a by ρ. P (where s = 2 ρ a), the secret shift system comprises: an analog-to-digital conversion unit, from the share <<ρ>> Q , calculate the share <<ρ>> p ; The first flag calculation unit sets u to an integer satisfying u≤M'-M+1, and sets d to an integer satisfying d≥ceiling(((R'-R+1) / u) Re ) is an integer from the share <<ρ>> Q or share <<ρ>> p , range [R,R'], value u and value d, calculate the share [[f0]] 2 =[[(ρ≥-R')]] 2 ,[[f1]] 2 =[[(ρ≥-R'+u)]] 2 ,…,[[f d-1 ]] 2 =[[(ρ≥-R'+(d-1)u)]] 2 ,[[f L ]] 2 =[[(ρ≥-R+1)]] 2 ; The second flag calculation unit, from the share [[f1]] 2 ,[[f2]] 2 ,…,[[fd-1 ]] 2 ,[[f L ]] 2 , calculate the share < <f1> > p ,< <f2>> p ,…,< <f d-1 >> p ,< <f L >> p ; Shift amount calculation unit, from the share <<ρ>> p , share< <f1> > p ,< <f2>> p ,…,< <f d-1 >> p ,< <f L >> p , the upper limit of the range R', the value u and the value d, calculate <<ρ'>> p =<<ρ>> p +R'-u(Σ 1≤i<d < <f i >> p )+((d-1)u-R')< <f L >> p ; Shift left unit, from share [[a]] P and share <<ρ'>> p , calculate the share [[b]] P =[[2 ρ’ a]] P ; right shift unit, from share [[b]] P , the upper limit of the range R', the value u and the value d, calculate the share [[c0]] P =[[2 ρ’ a / 2 R’ ]] P ,[[c1]] P =[[2 ρ’ a / (2 R’-u )]] P ,…,[[c d-1 ]] P =[[2 ρ’ a / (2 R’-(d-1)u )]] P ; The third sign calculation device, from the share [[f0]] 2 ,[[f1]] 2 ,…,[[f d-1 ]] 2 ,[[f L ]] 2 , calculate the share [[f0]] P ,[[f1]] P ,…,[[f d-1 ]] P ,[[f L ]] P ; and the shift value calculation unit, from the share [[b]] P , share[[c0]] P ,[[c1]] P ,…,[[c d-1 ]] P and share[[f0]] P ,[[f1]] P ,…,[[f d-1 ]] P ,[[f L ]] P , calculate share [[s]] P =[[c0]] P [[f0]] P +([[c1]] P -[[c0]] P )[[f1]] P +…+([[c d-1 ]] P -[[c d-2 ]] P )[[f d-1 ]] P +([[b]] P -[[c d-1 ]] P )[[f L ]] P .

[0014] In a secret shift system according to one embodiment of the present invention, let P be a prime number, let p be the number of bits of the prime number P, let M be the upper limit of the shift amount, and the secret shift system is composed of three or more secret shift devices, from the share of the value a [[a]] P and the share of the shift ρ <<ρ>> Q (where 0≤ρ≤M, the value a is shifted left by M bits to obtain the value 2 M a does not overflow), calculate the fraction [[s]] of the value s obtained by shifting the value a by ρ bits P (where s = 2 ρ a), the secret shift system comprises: a shift amount calculation unit, from the share <<ρ>> p and upper limit value M, calculate share <<M-ρ> > p ; Shift left unit, from share [[a]] P and share<<M-ρ> > p , calculate the share [[b]] P =[[2 M-ρ a]] P ; and right shift unit, from share [[b]] P and upper limit value M, calculate share [s]] P =[[2 M-ρ a / 2 M ]] P .

[0015] In a secret shift system according to one embodiment of the present invention, let P be a prime number, let p be the number of bits of the prime number P, let Q be the order of the residue class ring, let M be the upper limit value of the MSB position of the input value, and the secret shift system is composed of three or more secret shift devices, from the share of the value a [[a]] P and the share of the shift ρ <<ρ>> Q (where ρ ≥ 0 indicates a left shift, and ρ < 0 indicates a right shift), calculate the fraction [[s]] of the value s obtained by shifting the value a by ρ. P (where s = 2 ρ a), the secret shift system comprises: an analog-to-digital conversion unit, from the share <<ρ>> Q , calculate the share <<ρ>> p ; The first sign calculation unit, from the share <<ρ>> Q or share <<ρ>> p , calculate the share [[f L ]] 2 =[[(ρ≥0)]] 2 ; The second sign calculation unit, from the share [[f L ]] 2 , calculate < <f L >> p ; Shift amount calculation unit, from the share <<ρ>> p , share< <f L >> p and the upper limit value M, calculate the share <<ρ'>> p =<<ρ>> p +MM< <f L >> p ; Shift left unit, from share [[a]] P and share <<ρ'>> p , calculate the share [[b]] P =[[2 ρ’ a]] P ; right shift unit, from share [[b]] P and upper limit value M, calculate share [[c]] P =[[2 ρ’ a / 2 M ]] P ; The third sign calculation device, from the share [[f L ]] 2 , calculate the share [[f L ]] P ; and the shift value calculation unit, from the share [[b]] P , share[[c]] P and share[[f L ]] P , calculate share [[s]] P =[[c]] P +([[b]] P -[[c]] P )[[f L ]] P .

[0016] Effects of the Invention

[0017] According to the present invention, it is possible to perform a shift operation at a high speed while concealing a numerical value to be shifted and a shift amount. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 is a block diagram showing the structure of the secret shift system 10.

[0019] Figure 2 is a secret shifting device 100 i Block diagram of the structure.

[0020] Figure 3 1 is a flowchart showing the operation of the secret shift system 10.

[0021] Figure 4 2 is a block diagram showing the structure of the secret shift system 20.

[0022] Figure 5 It indicates the secret shifting device 200 i Block diagram of the structure.

[0023] Figure 6 2 is a flowchart showing the operation of the secret shift system 20.

[0024] Figure 7 3 is a block diagram showing the structure of the secret shift system 30.

[0025] Figure 8 It indicates the secret shifting device 300 i Block diagram of the structure.

[0026] Fig. 9 : is a flowchart showing the operation of the secret shift system 30.

[0027] Fig.10 This is a diagram showing an example of a functional configuration of a computer that implements each device in the embodiment of the present invention. DETAILED DESCRIPTION

[0028] Hereinafter, the embodiments of the present invention will be described in detail. In addition, the same reference numerals are given to components having the same functions, and duplicate descriptions are omitted.

[0029] Before describing each embodiment, the description method in this specification will be described.

[0030] ^ (caret) indicates a superscript. For example, x y^z Represents y z is a superscript for x, y^z Represents y z is a subscript for x. In addition, _ (underscore) indicates a subscript. For example, x y_z Represents y z is a superscript for x, y_z Represents y z is the subscript for x.

[0031] In addition, superscripts "^" and "~" such as ^x and ~x of a certain character x should originally be written just above "x", but due to the limitation of the description in the specification, they are written as ^x and ~x.

[0032] <Technical Background>

[0033] The secret computing in each embodiment of the present invention is constructed using the existing secret computing protocol. Here, the notation is first explained.

[0034] "Memorization"

[0035] Let P be a prime number. For example, the Mersenne prime number P = 2 61 -1. Let p be the number of bits of prime number P. In addition, it is sometimes expressed as p = |P|. When P is a Mersenne prime, p becomes prime. For example, if P = 2 61 -1, then p = 61. In addition, let Q be the order of the residue class ring. The order Q is used as the prime number P or its bit number p. In addition, the order Q can be used for the exponent part of the floating point. When the order Q is used for the exponent part of the floating point, for example, Q = 2 13 -1.

[0036] Let k be a threshold value of secret distribution. For example, k=2. Also, let n be the number of secret distribution (that is, the number of parties of secret calculation). For example, n=3.

[0037] [[x]] y = represents the share of mod y element x subjected to (k,n)-secret distribution. As a secret distribution method, for example, Shamir secret distribution or copy secret distribution can be used. <x>> y = represents the share of mod y element x that has been (k,n)-copied secret distribution. Since (k,n)-copied secret distribution is (k,n)-secret distribution, the protocol applicable to the share that has been (k,n)-secret distribution can also be used for the share that has been (k,n)-copied secret distribution. In addition, when the share is represented as < <x>> y When , it means that the property of copy secret distribution is used. In addition, (k, k)-copy secret distribution is called (k, k)-addition secret distribution. <x> y Represents a share obtained by performing (k, k)-additive secret sharing on the element x modulo y.

[0038] [[x]] 2^m Represents the share obtained by arranging m shares of the form [[x]] 2 . Additionally, [[x]] 2^m is sometimes regarded as the bit representation of a numerical value.

[0039] x ≒ y means that x and y are equal as real numbers on a computer. That is, it means that the difference between x and y is within a certain error range.

[0040] For two numbers a and d, a / d represents the value of integer division obtained by discarding the fractional part. Therefore, integer division based on a power of 2 is equivalent to a right shift. Additionally, for two numbers a and d, (a / d) Re represents the value of real division.

[0041] For a number a, ceiling(a) represents the smallest integer greater than or equal to a.

[0042] (prop) takes the value 1 when the proposition prop holds and 0 when it does not. For example, (1 > 0) becomes 1.

[0043] The floating-point number 2 b a (where a and b represent the mantissa part and the exponent part respectively) is represented as the floating-point number (a, b). Additionally, m floating-point numbers 2 b _ 0 a0, 2 b _ 1 a1, …, 2 b _ m-1 a m-1 (where a i , b i (0 ≤ i < m) represent the mantissa part and the exponent part respectively) are represented as the floating-point vector ( → a, → b) (where → a = (a0, a1, …, a m-1 ), → b = (b0, b1, …, b m-1 ). Sometimes, the length m of the vector → a = (a0, a1, …, a m-1 ) is denoted as | → a|.

[0044] Existing Confidential Computing Protocols

[0045] First, the existing secret computing protocol used in the present invention is described. For addition and subtraction operations, constant sum, multiplication operation, constant multiple, logical operation (negation, logical AND, logical OR, XOR), data format conversion (integer, binary number), and exponential function calculation, the existing protocol is used. For other existing protocols used in the present invention, the following protocols are used.

[0046] [Transformation from (k,n)-secret sharing (copy secret sharing) to (k,k)-addition secret sharing]

[0047] Input: Share of value x [[x]] y (The share of value x < <x>> y )

[0048] Output: Share of value x <x> y

[0049] Specifically, there is a method described in Reference Non-Patent Document 2.

[0050] (Reference non-patent document 2: Kikuchi, R., Ikarashi, D., Matsuda, T., Hamada, K. and Chida, K., "Efficient Bit-Decomposition and Modulus-Conversion Protocols withan Honest Majority," 23rd Australasian Conference on Information Security and Privacy (ACISP 2018), Lecture Notes in Computer Science,Vol.10946,Springer,pp.64-82,2018.)

[0051] [Transition from (k,k)-addition secret distribution to (k,n)-secret distribution (copy secret distribution)]

[0052] Input: Share of value x <x> y

[0053] Output: Share of value x [[x]] y (The share of value x < <x>> y )

[0054] Specifically, there is a method described in Reference Non-Patent Document 2.

[0055] [mod 2 → mod q conversion]

[0056] Input: Share of value x [[x]] 2 (The share of value x < <x>> 2 )

[0057] Output: Share of value x [[x]] q (The share of value x < <x>> q )

[0058] Specifically, there is a method described in Reference Non-Patent Document 2.

[0059] [Shift Amount Disclosure Right Shift]

[0060] Input: Share of value x [[x]] q , displacement ρ

[0061] Output: The fraction of the value obtained by shifting the value x right by ρ places [[x / 2 ρ ]] q

[0062] Specifically, there is a method described in Reference Non-Patent Document 3.

[0063] (Reference non-patent document 3: Sanpin Fuki, Igarashi Dai, Hamada Hiroshi, Kikuchi Ryo, "High precision, high efficiency, secret design, installation," CSS2018, 2018.)

[0064] [Batch Shift Amount Disclosure Right Shift]

[0065] Input: Share of value x [[x]] q , shift amount ρ0,…,ρ m-1

[0066] Output: Move the value x to ρ0,…,ρ m-1 The fraction of the value obtained by right shifting [[x / 2 ρ _ 0 ]] q ,…,[[x / 2 ρ _ m-1 ]] q

[0067] Specifically, there is a method described in Reference Non-Patent Document 4.

[0068] (Reference Non-Patent Document 4: Dai Igarashi, "Elementary Number Group on M op / s Super Secret Computation," SCIS2020, 2020.)

[0069] In addition, as an obvious method, it is also possible to disclose the right shift by the shift amount and repeat the right shift so as to disclose the right shift by the shift amount.

[0070] [Analog-to-digital conversion using quotient transfer]

[0071] Input: Share of value x < <x>> q

[0072] Output: Share of value x < <x>> r

[0073] Specifically, there is a method described in Reference Non-Patent Document 2.

[0074] [Bit Decomposition]

[0075] Input: Share of value x [[x]] q

[0076] Parameter: The maximum number of digits of the input value M

[0077] Output: Share of value x [[x]] 2^M

[0078] Specifically, there is a method described in Reference Non-Patent Document 2.

[0079] The Secret Computing Protocol of the Invention

[0080] Next, the secret computing protocol of the present invention is described.

[0081] [Multiplicative Rotation (shift amount hides left shift)]

[0082] Input: Share of value a [[a]] P 、The share of the circulation amount (shift amount) ρ (≥0) <<ρ>> p

[0083] Output: The fraction of the value obtained by shifting the value a left by ρ bits [[2 ρ a]] P

[0084] The output share can be calculated by a protocol using multiplication or exponential function calculation, or can be calculated by a method that considers random permutation (see Non-Patent Document 5). As a specific example, the case of n=3 will be described.

[0085] (Reference Non-Patent Document 5: Dai Igarashi, Hiroshi Hamada, Ryo Kikuchi, Koji Chida, "Statistical Processing of Environmental Statistics of 1 Second, Secret Calculation Base Improvement," SCIS2014, 2014.)

[0086] (Round 1)

[0087] step 1: share [[a]] P Convert to the (k,k)-additive secret distribution of the shares of party 0 and party 1 P .

[0088] Step 2: Party 0 and Party 1 share a random number r 01 In addition, Party 1 and Party 2 have a total random number r 12 .

[0089] Step 3: Calculate b0=2 (<<ρ>>^p)_01 P 0-r 01 , and sends b0 to party 2.

[0090] Here, <<ρ>> p 01 Represents the share <<ρ>> p The shares held by party 0 and party 1. P 0About Share P And square 0 maintains the share.

[0091] Step 4: Calculate 2 by 1 (<<ρ>>^p)_12 (2 (<<ρ>>^p)_01 P 1+r 01 )-r 12 , and transfer b1 to square 0.

[0092] Here, <<ρ>> p 12 Represents the share <<ρ>> p The shares held by Party 1 and Party 2. P 1 means about the share P And the share maintained by Party 1.

[0093] (Round 2)

[0094] Step 5: Square 0 calculation <c> P 0=2 (<<ρ>>^p) _ 20 b1.

[0095] Here, <<ρ>> p 20 Represents about <<ρ>> p The shares held by Party 2 and Party 0.

[0096] Step 6: Calculation of square 2 <c> P 2=2 (<<ρ>>^p) _ 20 (2 (<<ρ>>^p) _ 12 b0+r 12 ).

[0097] (Round 3)

[0098] Step 7: Share <c> P Convert to (k,n)-secret distributed shares [[c]] P .

[0099] Here, c = 2 ρ a is established.

[0100] [Shift amount hides right shift]

[0101] Input: Share of value a [[a]] P , the share of the shift amount ρ <<ρ>> p

[0102] Parameter: Upper limit value M of the shift amount

[0103] Here, assuming 0≤ρ≤M, the value 2 is obtained by shifting the value a left by M bits. M a does not overflow.

[0104] Output: The fraction of the value obtained by shifting the value a right by ρ places [[a / 2 ρ ]] P

[0105] step 1: Calculate <<M-ρ> > p

[0106] Step 2: Using a multiplication loop, calculate the fraction of the value obtained by shifting the value a left by M-ρ bits [[2 M-ρ a]] P .

[0107] Step 3: Use the shift amount to open the right shift and calculate the value 2 M-ρ The fraction of the value obtained by shifting a right by M bits [[a / 2 ρ ]] P =[[2 M-ρ a / 2 M ]] P .

[0108] [Shift amount concealment shift (part 1)]

[0109] Input: Share of value a [[a]] P , the share of the shift amount ρ <<ρ>> Q (where ρ≥0 indicates left shift, and ρ<0 indicates right shift)

[0110] Parameter: The upper limit value M that the MSB (Most Significant Bit) position of the input value can take

[0111] Output: The fraction of the value s obtained by shifting the value a by ρ bits [[s]] P

[0112] Here, s = 2 ρ a is established.

[0113] Step 1: Use analog-to-digital conversion to calculate the share <<ρ>> p In the analog-to-digital conversion, for example, the above-mentioned analog-to-digital conversion using quotient transition can be used.

[0114] Step 2: Calculate [[f L ]] 2 =[[(ρ≥0)]] 2 .

[0115] Step 3: Use mod 2 → mod p conversion to calculate < <f L >> p .

[0116] Step 4: Calculate <<ρ'>> p =<<ρ>> p +MM< <f L >> p .

[0117] Step 5: Loop calculation using multiplication [[b]] P =[[2 ρ’ a]] P .

[0118] Step 6: Use the shift amount to expose the right shift to calculate [[c]] P =[[2 ρ’ a / 2 M ]] P .

[0119] Step 7: Use mod 2 → mod P transformation to calculate [[f L ]] P .

[0120] Step 8: Calculate [[s]] P =[[c]] P +([[b]] P -[[c]] P )[[f L ]] P .

[0121] This formula becomes a selection gate, and when ρ<0, s=c, and when ρ≥0, s=b.

[0122] [Displacement Amount Concealment Displacement (Part 2)]

[0123] Input: Share of value a [[a]] P , the share of the shift amount ρ <<ρ>> Q (where ρ≥0 indicates left shift, and ρ<0 indicates right shift)

[0124] Parameters: The upper limit value M of the MSB position of the input value, the upper limit value M' of the MSB position allowed by the share

[0125] Output: The fraction of the value s obtained by shifting the value a by ρ bits [[s]] P

[0126] Here, s = 2 ρ a is established.

[0127] Step 1: Calculate u = M'-M+1, d = ceiling (((M-1) / u) Re ).

[0128] Here, u is the right shift amount that can be concealed by one shift amount (specifically, the amount in the range from 1 to M'-M bits), and d is the number of times the right shift is performed to conceal the shift amount required to perform the right shift in the range from 1 to M-1 bits.

[0129] Step 2: Use analog-to-digital conversion to calculate the share <<ρ>> p For analog-to-digital conversion, for example, the above-mentioned quotient shift analog-to-digital conversion can be used.

[0130] Step 3: Calculate [[f0]] by comparing the size 2 =[[(ρ≥-M+1)]] 2 ,[[f1]] 2 =[[(ρ≥-M+1+u)]] 2 ,…,[[f d-1 ]] 2 =[[(ρ≥-M+1+(d-1)u)]] 2 ,[[f L ]] 2 =[[(ρ≥0)]] 2 .

[0131] Here, if f L Then f d-1 Established, if f d-1 Then f d-2 ,… holds. Let f0,f1,…,f have such properties d-1 ,f L These are called transitive flags.

[0132] Step 4: Use mod 2 → mod p conversion to calculate < <f1> > p ,< <f2>> p ,…,< <f d-1 >> p ,< <f L >> p .

[0133] In this step, there is no need to calculate < <f0>> p .

[0134] Step 5: Calculate <<ρ'>> p =<<ρ>> p +M-1-u(Σ 1≤i<d < <f i >> p )+((d-1)u-M+1)< <f L >> p .

[0135] Step 6: Using a multiplication loop, calculate [[b]] P =[[2 ρ’ a]] P .

[0136] Step 7: Use the total shift amount to disclose the right shift and calculate [[c0]] P =[[2 ρ’ a / 2 M-1 ]] P ,[[c1]] P =[[2 ρ’ a / (2 M-1-u )]] P ,…,[[c d-1 ]] P =[[2 ρ’ a / (2 M-1-(d-1)u )]] P .

[0137] Step 8: Use mod 2 → mod P conversion to calculate [[f0]] P ,[[f1]] P ,…,[[f d-1 ]] P ,[[f L ]] P .

[0138] In this step, we need to calculate [[f0]] p .

[0139] Step 9: Calculate [[s]] P =[[c0]] P [[f0]] P +([[c1]] P -[[c0]] P )[[f1]] P +…+([[c d-1 ]] P -

[0140] [[c d-2 ]] P )[[f d-1 ]] P +([[b]] P -[[c d-1 ]] P )[[f L ]] P .

[0141] This formula becomes the sign f0,f1,…,f relative to the shift d-1 ,f L The selection gate of f0,f1,…,f d-1 ,f L If all are 0, then s = 0. If it is f0, then s = c0. If it is f L Then s=b.

[0142] [Displacement Amount Concealment Displacement (Part 3)]

[0143] Input: Share of value a [[a]] P , the share of the shift amount ρ <<ρ>> Q (where ρ≥0 indicates left shift, and ρ<0 indicates right shift)

[0144] Parameters: The upper limit value M of the MSB position of the input value, the upper limit value M' of the MSB position allowed by the share

[0145] Output: The fraction of the value s obtained by shifting the value a by ρ bits [[s]] P

[0146] Here, s = 2 ρ a is established.

[0147] Step 1: Set u to an integer that satisfies u≤M'-M+1. Also, set [R,R'] to the range of the right shift amount covered by the right shift after the division, and set d to satisfy d≥ceiling(((R'-R+1) / u) Re ) is an integer.

[0148] the following,{} L Indicates that the calculation of the part enclosed by the brackets can be omitted when the shift amount is larger than -R (for example, when it is known that it is a right shift). In addition, {}0 indicates that the calculation of the part enclosed by the brackets can be omitted when the shift amount is smaller than -R' (for example, when it is known that the right shift amount is larger than the value that the shift amount concealment shift (1) can be applied but is not an extremely large value).

[0149] Step 2: Use analog-to-digital conversion to calculate <<ρ>> p For analog-to-digital conversion, for example, the above-mentioned quotient shift analog-to-digital conversion can be used.

[0150] Step 3: Calculate {[[f0]] by comparing the size 2 =[[(ρ≥-R')]] 2 ,}0[[f1]] 2 =[[(ρ≥-R'+u)]] 2 ,…,[[f d-1 ]] 2 =[[(ρ≥-R'+(d-1)u)]] 2 {,[[f L ]] 2 =[[(ρ≥-R+1)]] 2 } L .

[0151] Here, if f L Then f d-1 Established, if f d-1 Then f d-2 ,… holds. Let f0,f1,…,f have such properties d-1 ,f L It is called a shift mark.

[0152] Step 4: Use mod 2 → mod p conversion to calculate < <f1> > p ,< <f2>> p ,…,< <f d-1 >> p {,< <f L >> p } L .

[0153] Step 5: Calculate <<ρ'>> p =<<ρ>> p +R'-u(Σ 1≤i<d < <f i >> p ){+((d-1)u-R')< <f L >> p } L .

[0154] Step 6: Using a multiplication loop, calculate [[b]] P =[[2 ρ’ a]] P .

[0155] Step 7: Use the total shift amount to disclose the right shift and calculate {[[c0]] P =[[2 ρ’ a / 2 R’ ]] P ,}0[[c1]] P =[[2 ρ’ a / (2 R’-u )]] P ,…,[[c d-1 ]] P =[[2 ρ’ a / (2 R’-(d-1)u )]] P .

[0156] Step 8: Use mod 2 → mod P conversion to calculate {[[f0]] P ,}0[[f1]] P ,…,[[f d-1 ]] P {,[[f L ]] P } L .

[0157] Step 9: Calculate [[s]] P ={[[c0]] P [[f0]] P +(}0[[c1]] P {-[[c0]] P )}0[[f1]] P +…+([[c d-

[0158] 1]] P -[[c d-2 ]] P )[[f d-1 ]] P {+([[b]] P -[[c d-1 ]] P )[[f L ]] P } L .

[0159] This formula becomes the sign f0,f1,…,f relative to the shift d-1 ,f L The selection gate, if f0,f1,…,f d-1 ,f L Then all become 0, if it is f0, it becomes s=c0, if it is f1, it becomes c1, ..., if it is f L Then s=b.

[0160] In addition, if we assume R = 1, R' = M-1, u = M'-M+1, d = ceiling (((R'-R+1) / u) Re ), then the shift amount concealment shift (part 3) becomes the shift amount concealment shift (part 2). Therefore, the shift amount concealment shift (part 3) is a protocol that generalizes the shift amount concealment shift (part 2).

[0161] <First Embodiment>

[0162] Below, refer to < / f1> < / f1> < / c> < / c> < / c> Figure 1 to Figure 3 The secret shift system 10 will be described. Figure 1 1 is a block diagram showing the structure of the secret shift system 10. The secret shift system 10 includes W (W is a predetermined integer greater than or equal to 3) secret shift devices 1001, ..., 100 W . Secret shifting device 1001, ..., 100 W The two devices are connected to a network 800 and can communicate with each other. The network 800 may be, for example, a communication network such as the Internet or a broadcast communication path. Figure 2 is a secret shifting device 100 i Block diagram of the structure of (1≤i≤W). Figure 3 1 is a flowchart showing the operation of the secret shift system 10.

[0163] like Figure 2 As shown, the secret shifting device 100 i The shift amount calculation unit 140 is included i , left shift unit 150 i , right shift unit 160 i 、Recording Department 190 i . In addition to recording section 190 i Other secret shifting devices 100 i Each structural unit is configured to be able to perform operations required for secret computing, that is, operations required to realize the functions of each structural unit in the protocol described in <Technical Background>. In the present invention, the specific functional structure for realizing each operation is sufficient in a structure that can execute the algorithms disclosed in each non-patent document of reference non-patent documents 1 to 5, for example. These are existing structures, so detailed descriptions are omitted. In addition, the recording unit 190 i The secret shifting device 100 is recorded i For example, the upper limit value M of the shift amount described later is recorded.

[0164] By means of W secret shifting devices 100 i The secret shift system 10 implements a secret calculation of right shift concealing the shift amount as a multi-party protocol. Therefore, the shift amount calculation unit 140 (not shown) of the secret shift system 10 is composed of shift amount calculation units 1401, ..., 140 W The left shift unit 150 (not shown) is composed of left shift units 1501, ..., 150 W The right shift unit 160 (not shown) is composed of right shift units 1601, ..., 160 W constitute.

[0165] Let P be a prime number, p be the number of bits of the prime number P, and M be the upper limit of the shift amount. The secret shift system 10 starts from the share of the value a [[a]] P and the share of the shift ρ <<ρ>> p (where 0≤ρ≤M, the value a is shifted left by M bits to obtain the value 2 M a does not overflow), calculate the fraction [[s]] of the value s obtained by shifting the value a right by ρ bits P (where s = a / 2 ρ ). Below, according to Figure 3 The operation of the secret shift system 10 will be described.

[0166] In S140, the shift amount calculation unit 140 calculates the shift amount according to the share <<ρ>> p and upper limit value M, calculate share <<M-ρ> > p .

[0167] In S150, the left shift unit 150 shifts the bit position according to the share [[a]] P and the share calculated by S140 <<M-ρ> > p , calculate the share [[b]] P =[[2 M-ρ a]] P The left shift unit 150 may be configured to be capable of performing a shift amount concealing left shift, for example.

[0168] In S160, the right shift unit 160 calculates the amount [[b]] ​​of the P and upper limit value M, calculate the serving size [[s]] P =[[2 M-ρ a / 2 M ]] P The right shift unit 160 may be configured to be capable of performing a right shift with a disclosed shift amount, for example.

[0169] According to the embodiment of the present invention, it is possible to perform a right shift operation at high speed while concealing a numerical value to be shifted and a shift amount.

[0170] <Second Embodiment>

[0171] Below, refer to Figures 4 to 6 The secret shift system 20 will be described. Figure 4 2 is a block diagram showing the structure of the secret shift system 20. The secret shift system 20 includes W (W is a predetermined integer greater than or equal to 3) secret shift devices 2001, ..., 200 W . Secret shifting device 2001, ..., 200 W The two devices are connected to a network 800 and can communicate with each other. The network 800 may be, for example, a communication network such as the Internet or a broadcast communication path. Figure 5 It indicates the secret shifting device 200 i Block diagram of the structure of (1≤i≤W). Figure 6 2 is a flowchart showing the operation of the secret shift system 20.

[0172] like Figure 5 As shown, the secret shifting device 200 i The analog-to-digital conversion unit 210 is included i , first flag calculation unit 220 i , the second flag calculation unit 230 i , shift amount calculation unit 240 i , left shift unit 250 i , right shift unit 260 i , third flag calculation unit 270 i , shift value calculation unit 280 i and Records Department 290 i . In addition to recording section 290 i Other secret shifting devices 200 i Each structural unit is configured to be able to perform operations required for secret computing, that is, operations required to realize the functions of each structural unit in the protocol described in <Technical Background>. In the present invention, the specific functional structure for realizing each operation is sufficient in a structure that can execute the algorithms disclosed in each non-patent document 1 to 5, for example. These are existing structures, so detailed descriptions are omitted. In addition, the recording unit 290 i It is a recording secret shifting device 200 i For example, the upper limit value M of the MSB position of the input numerical value described later is recorded.

[0173] By means of W secret shifting devices 200 i The secret shift system 20 implements the secret calculation of concealing the shift amount (part 1) as a multi-party protocol. Therefore, the analog-to-digital conversion unit 210 (not shown) of the secret shift system 20 is composed of analog-to-digital conversion units 2101, ..., 210 W The first flag calculation unit 220 (not shown) is composed of first flag calculation units 2201, ..., 220 W The second flag calculation unit 230 (not shown) is composed of second flag calculation units 2301, ..., 230 W The shift amount calculation unit 240 (not shown) is composed of shift amount calculation units 2401, ..., 240 W The left shift unit 250 (not shown) is composed of left shift units 2501, ..., 250 W The right shift unit 260 (not shown) is composed of right shift units 2601, ..., 260 W The third flag calculation unit 270 (not shown) is composed of third flag calculation units 2701, ..., 270 W The shift value calculation unit 280 (not shown) is composed of shift value calculation units 2801, ..., 280 W constitute.

[0174] Let P be a prime number, p be the number of bits of the prime number P, and M be the upper limit of the MSB position of the input value. The secret shift system 20 calculates the value a according to the share [[a]] P and the share of the shift ρ <<ρ>> Q (where ρ ≥ 0 is set to indicate left shift, and ρ < 0 is set to indicate right shift), calculate the value s share [[s]] obtained by shifting the value a by ρ P (where s = 2 ρ a) Below, according to Figure 6 The operation of the secret shift system 20 will be described.

[0175] In S210, the mode conversion unit 210 converts the value of Q , calculate the share <<ρ>> p The analog-to-digital conversion unit 210 may be configured to perform analog-to-digital conversion, for example.

[0176] In S220, the first flag calculation unit 220 calculates the value of the first flag according to the share <<ρ>> Q , calculate the share [[f L ]] 2 =[[(ρ≥0)]] 2 The first flag calculation unit 220 is configured, for example, to calculate the value of Q , calculate the share <<(ρ≥0)>> Q , using analog-to-digital conversion, according to the share <<(ρ≥0)>> Q , calculate the share <<(ρ≥0)>> 2 , and the share <<(ρ≥0)>> 2 Convert to share L ]] 2 =[[(ρ≥0)]] 2 Alternatively, you can also replace the share <<ρ>> Q , and the usage share <<ρ>> p .

[0177] In S230, the second flag calculation unit 230 calculates the share [[f L ]] 2 , calculate < <f L >> p The second flag calculation unit 230 may be configured to be able to perform, for example, mod 2→mod p conversion.

[0178] In S240, the shift amount calculation unit 240 calculates the share <<ρ>> p , Share calculated by S230< <f L >> p and the upper limit value M, calculate the share <<ρ'>> p =<<ρ>> p +MM< <f L >> p .

[0179] In S250, the left shift unit 250 performs the shift operation according to the share [[a]] P and the share <<ρ'>> calculated by S240 p , calculate the share [[b]] P =[[2 ρ’ a]] P The left shift unit 250 may be configured to be capable of performing a shift amount concealing left shift, for example.

[0180] In S260, the right shift unit 260 calculates the share [[b]] ​​according to S250. P and upper limit value M, calculate share [[c]] P =[[2 ρ’ a / 2 M ]] P The right shift unit 260 may be configured to be capable of performing a right shift with a disclosed shift amount, for example.

[0181] In S270, the third flag calculation unit 270 calculates the share [[f L ]] 2 , calculate the share [[f L ]] P The third flag calculation unit 270 may be configured to be able to perform mod 2→mod P conversion, for example.

[0182] In S280, the shift value calculation unit 280 calculates the share [[b]] ​​according to S250. P , the share calculated by S260[[c]] P and the share calculated by P270[[f L ]] P , calculate share [[s]] P =[[c]] P +([[b]] P -[[c]] P )[[f L ]] P .

[0183] According to the embodiment of the present invention, a shift operation can be performed at high speed while hiding the numerical value to be shifted and the shift amount. In particular, although the amount that can be right-shifted is limited, the shift operation can be performed at high speed.

[0184] <Third Embodiment>

[0185] Below, refer to Figure 7 to Figure 9 The secret shift system 30 will be described. Figure 7 30 is a block diagram showing the structure of the secret shift system 30. The secret shift system 30 includes W (W is a predetermined integer greater than or equal to 3) secret shift devices 3001, ..., 300 W . Secret shifting device 3001, ..., 300 W The two devices are connected to a network 800 and can communicate with each other. The network 800 may be, for example, a communication network such as the Internet or a broadcast communication path. Figure 8 It indicates the secret shifting device 300 i Block diagram of the structure of (1≤i≤W). Fig. 9 : is a flowchart showing the operation of the secret shift system 30.

[0186] like Figure 8 As shown, the secret shifting device 300 i The analog-to-digital conversion unit 310 is included i , first flag calculation unit 320 i , the second flag calculation unit 330 i , shift amount calculation unit 340 i , left shift unit 350 i , right shift unit 360 i , third flag calculation unit 370 i , shift value calculation unit 380 i 、Recording Department 390 i . In addition to recording section 390 i Other secret shifting devices 300 i Each structural unit is configured to be able to perform operations required for secret computing, that is, operations required to realize the functions of each structural unit in the protocol described in <Technical Background>. In the present invention, the specific functional structure for realizing each operation is sufficient in a structure that can execute the algorithms disclosed in each non-patent document of reference non-patent documents 1 to 5, for example. These are existing structures, so detailed descriptions are omitted. In addition, the recording unit 390 i Is a recording secret shifting device 300 i For example, it records the upper limit value M of the MSB position of the input value described later (hereinafter referred to as the first upper limit value) or the upper limit value M' of the MSB position allowed by the invention (hereinafter referred to as the second upper limit value).

[0187] By means of W secret shifting devices 300 i The secret shift system 30 implements the secret calculation of the shift amount concealing shift (part 2) as a multi-party protocol. Therefore, the analog-to-digital conversion unit 310 (not shown) of the secret shift system 30 is composed of analog-to-digital conversion units 3101, ..., 310 W The first label calculation unit 320 (not shown) is composed of first label calculation units 3201, ..., 320 W The second label calculation unit 330 (not shown) is composed of second label calculation units 3301, ..., 330 W The shift amount calculation unit 340 (not shown) is composed of shift amount calculation units 3401, ..., 340 W The left shift unit 350 (not shown) is composed of left shift units 3501, ..., 350 W The right shift unit 360 (not shown) is composed of right shift units 3601, ..., 360 W The third label calculation unit 370 (not shown) is composed of third label calculation units 3701, ..., 370 W The shift value calculation unit 380 i (not shown) by the shift value calculation units 3801, ..., 380 W constitute.

[0188] Let P be a prime number, p be the number of bits of the prime number P, Q be the order of the residue class ring, M be the upper limit of the MSB position of the input value, and M' be the upper limit of the MSB position allowed by the share. The secret shift system 30 calculates the value of a according to the share [[a]] P and the share of the shift ρ <<ρ>> Q (where ρ ≥ 0 indicates a left shift, and ρ < 0 indicates a right shift), calculate the fraction [[s]] of the value s obtained by shifting the value a by ρ. P (where s = a / 2 ρ ). Below, according to Fig. 9 The operation of the secret shift system 30 will be described.

[0189] In S310, the mode conversion unit 310 converts the value of Q , calculate the share <<ρ>> p The analog-to-digital conversion unit 310 may be configured to perform analog-to-digital conversion, for example.

[0190] In S320, the first flag calculation unit 320 calculates the value of the first flag according to the share <<ρ>> Q , the first upper limit value M, the value u = M'-M+1 and the value d = ceiling (((M-1) / u) Re ), calculate the share [[f0]] 2 =[[(ρ≥-M+1)]] 2 ,[[f1]] 2 =[[(ρ≥-M+1+u)]] 2 ,…,[[f d-1 ]] 2 =[[(ρ≥-M+1+(d-1)u)]] 2 ,[[f L ]] 2 =[[(ρ≥0)]] 2 The first flag calculation unit 320 is configured, for example, to calculate the value of Q , calculate the share <<(ρ≥-M+1)>> Q ,<<(ρ≥-M+1+u)>> Q ,…,<<(ρ≥-M+1+(d-1)u)>> Q ,<<(ρ≥0)>> Q , and use analog-to-digital conversion, according to the share <<(ρ≥-M+1)>> Q ,<<(ρ≥-M+1+u)>> Q ,…,<<(ρ≥-M+1+(d-1)u)>> Q ,<<(ρ≥0)>> Q , calculate <<(ρ≥-M+1)>> 2 ,<<(ρ≥-M+1+u)>> 2 ,…,<<(ρ≥-M+1+(d-1)u)>> 2 ,<<(ρ≥0)>> 2 , the share <<(ρ≥-M+1)>> 2 ,<<(ρ≥-M+1+u)>> 2 ,…,<<(ρ≥-M+1+(d-1)u)>> 2 ,<<(ρ≥0)>> 2 Convert to shares[[f0]] 2 =[[(ρ≥-M+1)]] 2 ,[[f1]] 2 =[[(ρ≥-M+1+u)]] 2 ,…,[[f d-1 ]] 2 =[[(ρ≥-M+1+(d-1)u)]] 2 ,[[f L ]] 2 =[[(ρ≥0)]] 2 In addition, the value u and the value d may be calculated by the first flag calculation unit 320 according to the first upper limit value M and the second upper limit value M', and the value u and the value d may also be pre-recorded in the recording unit 390. i middle.

[0191] In S330, the second flag calculation unit 330 calculates the share [[f1]] calculated in S320. 2 ,[[f2]] 2 ,…,[[f d-1 ]] 2 ,[[f L ]] 2 , calculate < <f1> > p ,< <f2>> p ,…,< <f d-1 >> p ,< <f L >> p The second flag calculation unit 330 may be configured to be able to perform, for example, mod 2→mod p conversion.

[0192] In S340, the shift amount calculation unit 340 calculates the share <<ρ>> calculated in S310 p , the share calculated by S330< <f1> > p ,< <f2>> p ,…,< <f d-1 >> p ,< <f L >> p , the first upper limit value M, the value u and the value d, calculate <<ρ'>> p =<<ρ>> p +M-1-u(Σ 1≤i<d < <f i >> p )+((d-1)u-M+1)< <f L >> p .

[0193] In S350, the left shift unit 350 generates a bitwise shift according to the share [[a]] P and the share <<ρ'>> calculated by S340 p , calculate the share [[b]] P =[[2 ρ’ a]] P The left shift unit 350 may be configured to be capable of performing a shift amount concealing left shift, for example.

[0194] In S360, the right shift unit 360 calculates the share [[b]] ​​according to S350. P , the first upper limit value M, the value u and the value d, calculate the share [[c0]] P =[[2 ρ’ a / 2 M-1 ]] P ,[[c1]] P =[[2 ρ’ a / (2 M-1-u )]] P ,…,[[c d-1 ]] P =[[2 ρ’ a / (2 M-1-(d-1)u )]] P The right shift unit 360 may be configured to be able to perform, for example, a collective shift amount disclosure right shift.

[0195] In S370, the third flag calculation unit 370 calculates the share [[f0]] calculated in S320. 2 ,[[f1]] 2 ,…,[[f d-1 ]] 2 ,[[f L ]] 2 , calculate the share [[f0]] P ,[[f1]] P ,…,[[f d-1 ]] P ,[[f L ]] P The third label calculation unit 370 may be configured to be able to perform mod 2→mod P conversion, for example.

[0196] In S380, the shift value calculation unit 380 calculates the share [[b]] ​​calculated in S350. P , the share calculated by S360 [[c0]] P ,[[c1]] P ,…,[[c d-1 ]] P and the share [[f0]] calculated by S370 P ,[[f1]] P ,…,[[f d-1 ]] P , calculate share[[s]] P =[[c0]] P [[f0]] P +([[c1]] P -[[c0]] P )[[f1]] P +…+([[c d-1 ]] P -[[c d-2 ]] P )[[f d-1 ]] P +([[b]] P -[[c d-1 ]] P )[[f L ]] P .

[0197] According to the embodiment of the present invention, a shift operation can be performed at high speed while hiding the numerical value to be shifted and the shift amount. In particular, a shift operation can be performed at high speed without limiting the amount that can be right-shifted.

[0198] <Fourth Embodiment>

[0199] Below, refer to Figure 7 to Figure 9 The secret shift system 40 will be described. Figure 7 40 is a block diagram showing the structure of the secret shift system 40. The secret shift system 40 includes W (W is a predetermined integer greater than or equal to 3) secret shift devices 4001, ..., 400 W . Secret shifting device 4001, ..., 400 W The two devices are connected to a network 800 and can communicate with each other. The network 800 may be, for example, a communication network such as the Internet or a broadcast communication path. Figure 8 It indicates the secret shifting device 400 i Block diagram of the structure of (1≤i≤W). Fig. 9 2 is a flowchart showing the operation of the secret shift system 40.

[0200] like Figure 8 As shown, the secret shifting device 400 i An analog-to-digital conversion unit 410 is included i , first flag calculation unit 420 i , the second flag calculation unit 430 i , shift amount calculation unit 440 i , left shift unit 450 i , right shift unit 460 i , third flag calculation unit 470 i , shift value calculation unit 480 i 、Recording Department 490 i . In addition to recording section 490 i Other secret shifting devices 400 i Each structural unit is configured to be able to perform operations required for secret computing, that is, operations required to realize the functions of each structural unit in the protocol described in <Technical Background>. In the present invention, the specific functional structure for realizing each operation is sufficient in a structure that can execute the algorithms disclosed in each non-patent document of reference non-patent documents 1 to 5, for example. These are existing structures, so detailed descriptions are omitted. In addition, the recording unit 490 i Is a recording secret shift device 400 i For example, the upper limit M of the MSB position of the input value (hereinafter referred to as the first upper limit) or the upper limit M' of the MSB position allowed by the share (hereinafter referred to as the second upper limit) is recorded. For example, the range [R, R'] of the right shift amount covered by the split right shift is recorded.

[0201] By means of W secret shifting devices 400 i The secret shift system 40 realizes the secret calculation of the shift amount concealing shift (part 3) as a multi-party protocol. Therefore, the analog-to-digital conversion unit 410 (not shown) of the secret shift system 40 is composed of analog-to-digital conversion units 4101, ..., 410 W The first label calculation unit 420 (not shown) is composed of first label calculation units 4201, ..., 420 W The second label calculation unit 430 (not shown) is composed of second label calculation units 4301, ..., 430 W The shift amount calculation unit 440 (not shown) is composed of shift amount calculation units 4401, ..., 440 W The left shift unit 450 (not shown) is composed of left shift parts 4501, ..., 450 W The right shift unit 460 (not shown) is composed of right shift units 4601, ..., 460 W The third label calculation unit 470 (not shown) is composed of third label calculation units 4701, ..., 470 W The shift value calculation unit 480 (not shown) is composed of shift value calculation units 4801, ..., 480 W constitute.

[0202] Let P be a prime number, let p be the number of bits of the prime number P, let Q be the order of the residue class ring, let M be the upper limit of the MSB position of the input value, let M' be the upper limit of the MSB position allowed by the share, and let [R, R'] be the range of the right shift amount covered by the right shift after the division. The secret shift system 40 calculates the right shift amount according to the share [[a]] of the value a. P and the share of the shift ρ <<ρ>> Q (where ρ ≥ 0 indicates a left shift, and ρ < 0 indicates a right shift), calculate the fraction [[s]] of the value s obtained by shifting the value a by ρ. P (where s = a / 2 ρ ). Below, according to Fig. 9 The operation of the secret shift system 40 will be described.

[0203] In S410, the analog-to-digital conversion unit 410 converts the value of Q , calculate the share <<ρ>> p The analog-to-digital conversion unit 410 may be configured to be capable of performing analog-to-digital conversion, for example.

[0204] In S420, the first flag calculation unit 420 calculates the value of the first flag according to the share <<ρ>> Q , the range [R, R'], the value u (u is an integer satisfying u ≤ M'-M+1) and the value d (d is an integer satisfying d ≥ ceiling (((R'-R+1) / u) Re ), calculate the share [[f0]] 2 =[[(ρ≥-R')]] 2 ,[[f1]] 2 =[[(ρ≥-R'+u)]] 2 ,…,[[f d-1 ]] 2 =[[(ρ≥-R'+(d-1)u)]] 2 ,[[f L ]] 2 =[[(ρ≥-R+1)]] 2 The first flag calculation unit 420 calculates the value of the share <<ρ>> Q , calculate the share <<(ρ≥-R')>> Q ,<<(ρ≥-R'+u)>> Q ,…,<<(ρ≥-R'+(d-1)u)>> Q ,<<(ρ≥-R+1)>> Q , and use analog-to-digital conversion, according to the share <<(ρ≥-R')>> Q ,<<(ρ≥-R'+u)>> Q ,…,<<(ρ≥-R'+(d-1)u)>> Q ,<<(ρ≥-R+1)>> Q , calculate the share <<(ρ≥-R')>> 2 ,<<(ρ≥-R'+u)>> 2 ,…,<<(ρ≥-R'+(d-1)u)>> 2 ,<<(ρ≥-R+1)>> 2 , the share <<(ρ≥-R')>> 2 ,<<(ρ≥-R'+u)>> 2 ,…,<<(ρ≥-R'+(d-1)u)>> 2 ,<<(ρ≥-R+1)>> 2 Convert to shares[[f0]] 2 =[[(ρ≥-R')]] 2 ,[[f1]] 2 =[[(ρ≥-R'+u)]] 2 ,…,[[f d-1 ]] 2 =[[(ρ≥-R'+(d-1)u)]] 2 ,[[f L ]] 2 =[[(ρ≥-R+1)]] 2 Alternatively, you can also replace the share <<ρ>> Q , and the usage share <<ρ>> p Furthermore, the value u and the value d may be recorded in advance in the recording unit 490. i middle.

[0205] In S430, the second flag calculation unit 430 calculates the share [[f1]] calculated in S420. 2 ,[[f2]] 2 ,…,[[f d-1 ]] 2 ,[[f L ]] 2 , calculate the share < <f1> > p ,< <f2>> p ,…,< <f d-1 >> p ,< <f L >> p The second flag calculation unit 430 may be configured to be able to perform, for example, mod 2→mod p conversion.

[0206] In S440, the shift amount calculation unit 440 calculates the share <<ρ>> p , the share calculated by S430< <f1> > p ,< <f2>> p ,…,< <f d-1 >> p ,< <f L >> p , the upper limit of the range R', the value u and the value d, calculate the share <<ρ'>> p =<<ρ>> p +R'-u(Σ 1≤i<d < <f i >> p )+((d-1)u-R')< <f L >> p .

[0207] In S450, the left shift unit 450 performs the shift operation according to the share [[a]] P and the share <<ρ'>> calculated by S440 p , calculate the share [[b]] P =[[2 ρ’ a]] P The left shift unit 450 may be configured to be capable of performing a shift amount concealing left shift, for example.

[0208] In S460, the right shift unit 460 calculates the share [[b]] ​​in S450. P , the upper limit of the range R', the value u and the value d, calculate the share [[c0]] P =[[2 ρ’ a / 2 R’ ]] P ,[[c1]] P =[[2 ρ’ a / (2 R’-u )]] P ,…,[[c d-1 ]] P =[[2 ρ’ a / (2 R’-(d-1)u )]] P The right shift unit 460 may be configured to be capable of performing a collective shift amount disclosure right shift, for example.

[0209] In S470, the third flag calculation unit 470 calculates the share [[f0]] calculated in S420. 2 ,[[f1]] 2 ,…,[[f d-1 ]] 2 ,[[f L ]] 2 , calculate the share [[f0]] P ,[[f1]] P ,…,[[f d-1 ]] P ,[[f L ]] P The third label calculation unit 470 may be configured to be capable of performing mod 2→mod P conversion, for example.

[0210] In S480, the shift value calculation unit 480 calculates the share [[b]] ​​calculated in S450. P , the share calculated by S460 [[c0]] P ,[[c1]] P ,…,[[c d-1 ]] P and the share [[f0]] calculated by S470 P ,[[f1]] P ,…,[[f d-1 ]] P ,[[f L ]] P , calculate share [[s]] P =[[c0]] P [[f0]] P +([[c1]] P -[[c0]] P )[[f1]] P +…+([[c d-1 ]] P -[[c d-2 ]] P )[[f d-1 ]] P +([[b]] P -[[c d-1 ]] P )[[f L ]] P .

[0211] (Variation Example)

[0212] As described in the technical background, the shift concealment shift (part 3) can omit part of the calculation when the shift amount is larger than -R or smaller than -R'. Therefore, in either case, the secret shift system 40 can be constructed by omitting part of the calculation.

[0213] According to the embodiment of the present invention, a shift operation can be performed at high speed while hiding the numerical value to be shifted and the shift amount. In particular, a shift operation can be performed at high speed without limiting the amount that can be right-shifted.

[0214] <Supplementary Note>

[0215] Fig.10 The processing in each of the above-mentioned devices can be implemented by reading a program for making the computer function as each of the above-mentioned devices into the recording unit 220 and operating the control unit 2010, the input unit 2030, the output unit 2040, etc.

[0216] The device of the present invention, for example, as a single hardware entity, has: an input unit that can be connected to a keyboard, etc., an output unit that can be connected to a liquid crystal display, etc., a communication unit that can be connected to a communication device (such as a communication cable) that can communicate with the outside of the hardware entity, a CPU (it can also have a central processing unit (Central Processing Unit), flash memory or registers, etc.), RAM (Random Access Memory) or ROM (Read Only Memory) as a memory, an external storage device as a hard disk, and a bus that connects to exchange data between these input units, output units, communication units, CPU, RAM, ROM, and external storage devices. In addition, as needed, a device (drive) that can read and write a recording medium such as a CD-ROM, etc., can also be set in the hardware entity. As a physical entity having such hardware resources, there are general-purpose computers, etc.

[0217] In the external storage device of the hardware entity, the programs required to realize the above functions and the data required in the processing of the programs are stored (not limited to the external storage device, for example, the programs can be read out in advance and stored in the ROM as a dedicated storage device). In addition, the data obtained by the processing of these programs is appropriately stored in the RAM or the external storage device.

[0218] In the hardware entity, each program stored in an external storage device (or ROM, etc.) and the data required for processing the program are read into the memory as needed, and are interpreted and executed / processed appropriately in the CPU. As a result, the CPU realizes the specified functions (the various constituent elements represented as the above-mentioned, ... parts, ... units, etc.).

[0219] The present invention is not limited to the above-mentioned embodiments, and can be appropriately modified within the scope of the present invention. The processing described in the above-mentioned embodiments is not only executed in time series according to the order of the description, but can also be executed in parallel or individually according to the processing capacity of the device executing the processing or as needed.

[0220] As described above, when the processing functions in the hardware entity (device of the present invention) described in the above embodiment are implemented by a computer, the functional processing content that the hardware entity should have is described by a program. Then, by executing the program on a computer, the processing functions in the above hardware entity are implemented on the computer.

[0221] The program describing the processing content can be recorded in advance in a computer-readable recording medium. As a computer-readable recording medium, any device such as a magnetic recording device, an optical disc, an optical magnetic recording medium, a semiconductor memory, etc. can be used. Specifically, for example, as a magnetic recording device, a hard disk device, a floppy disk, a magnetic tape, etc. can be used, as an optical disc, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only Memory), a CD-R (Recordable) / RW (ReWritable), etc. can be used, as an optical magnetic recording medium, an MO (Magneto-Optical disc) can be used, and as a semiconductor memory, an EEP-ROM (Electronically Erasable and Programmable-Read Only Memory) can be used.

[0222] The program may be circulated, for example, by selling, transferring, or renting a portable recording medium such as a DVD or CD-ROM recording the program. Furthermore, the program may be circulated by pre-storing the program in a storage device of a server computer and forwarding the program from the server computer to other computers via a network.

[0223] First, the computer executing such a program temporarily stores the program recorded in a portable recording medium or the program forwarded from the server computer in its own storage device. Then, when executing the process, the computer reads the program stored in its own storage device and executes the process according to the program read. In addition, as other execution forms of the program, it can also be set that the computer directly reads the program from the portable recording medium and executes the process according to the program. It can also be set that whenever the computer is forwarded from the server computer, the computer sequentially executes the process according to the received program. In addition, it can also be set as the following structure: if the program is not forwarded from the server computer to the computer, the processing function is realized only by its execution instruction and result acquisition, that is, through the so-called ASP (Application Service Provider, application service provider) type service, and the above-mentioned process is executed. In addition, it is assumed that the program in this method includes information equivalent to the program provided for the processing of the electronic computer (not a direct instruction to the computer, but data with the nature of the processing of the specified computer, etc.).

[0224] Furthermore, in this method, a hardware entity is formed by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0225] The above-mentioned description of the embodiments of the present invention is provided for the purpose of illustration and description. There is no intention to be exhaustive, nor is there any intention to limit the invention to the strict form disclosed. Deformations and changes can be made according to the above teachings. The embodiments are intended to provide the best illustration of the principles of the present invention, and to enable those skilled in the art to utilize the present invention in various embodiments and with various modifications, in a manner selected and expressed to suit the actual use that is considered. All such modifications or changes are within the scope of the present invention as determined by the appended claims, which are interpreted in accordance with the scope given by fairness, legality and equity. < / f1> < / f1> < / f1> < / f1> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / f1> < / f1>

Claims

1. A secret shift system, let P be a prime number, let p be the number of bits of the prime number P, let Q be the order of the residue class ring, let M be the upper limit of the MSB position of the input value, let M' be the upper limit of the MSB position allowed by the share, The secret shifting system is composed of three or more secret shifting devices, from the share of value a [[a]] P and the share of the shift ρ <<ρ>> Q , calculate the fraction of the value s obtained by shifting the value a by ρ bits [[s]] P , where ρ When ≥0, it is set to indicate left shift, when ρ<0, it is set to indicate right shift, s=2 ρ a, The secret shifting system comprises: Analog-to-digital conversion unit, from the share <<ρ>> Q , calculate the share <<ρ>> p ; The first flag calculation unit sets u to an integer that satisfies u≤M'-M+1, indicating the amount of right shift that can be covered by one right shift, and sets d to an integer that satisfies d≥ceiling(((R'-R+1) / u) indicating the number of right shifts required to perform a right shift from 1 to M-1 bits. Re ), divide the right shift of shift amount ρ into d right shifts of shift amount u each time, let [R, R'] be the range of right shift amounts covered by the divided right shifts, From the share <<ρ>> Q or share <<ρ>> p , range [R,R'], value u and value d, calculate the share [[f0]] 2 =[[(ρ≥-R')]] 2 ,[[f1]] 2 =[[(ρ≥-R'+u)]] 2 ,…,[[f d-1 ]] 2 =[[(ρ≥-R'+(d-1)u)]] 2 ,[[f L ]] 2 =[[(ρ≥-R+1)]] 2 ; The second flag calculation unit, from the share [[f1]] 2 ,[[f2]] 2 ,…,[[f d-1 ]] 2 ,[[f L ]] 2 , calculate the share < <f1> > p ,< <f2>> p ,…,<<f d-1 >> p ,<<f L >> p ; < / f1> The shift amount calculation unit is based on the share <<ρ>> p , share< <f1> > p ,< <f2>> p ,…,< <f d-1 >> p ,< <f L >> p , the upper limit of the range R', the value u and the value d, calculate <<ρ'>> p =<<ρ>> p +R'-u(Σ 1≤i<d < <f i >> p )+((d-1)u-R')< <f L >> p ; < / f1> Shift left by unit, from share [[a]] P and share <<ρ'>> p , calculate the share [[b]] P =[[2 ρ’ a]] P ; Shift right unit, from share [[b]] P , the upper limit of the range R', the value u and the value d, calculate the share [[c0]] P =[[2 ρ’ a / 2 R’ ]] P ,[[c1]] P =[[2 ρ’ a / (2 R’-u )]] P ,…,[[c d-1 ]] P =[[2 ρ’ a / (2 R’-(d-1)u )]] P ; The third flag calculation means, from the share [[f0]] 2 ,[[f1]] 2 ,…,[[f d-1 ]] 2 ,[[f L ]] 2 , calculate the share [[f0]] P ,[[f1]] P ,…,[[f d-1 ]] P ,[[f L ]] P ;as well as Shift value calculation unit, from share [[b]] P , share[[c0]] P ,[[c1]] P ,…,[[c d-1 ]] P and share[[f0]] P ,[[f1]] P ,…,[[f d-1 ]] P ,[[f L ]] P , calculate share [[s]] P =[[c0]] P [[f0]] P +([[c1]] P -[[c0]] P )[[f1]] P +…+([[c d-1 ]] P -[[c d-2 ]] P )[[f d-1 ]] P +([[b]] P -[[c d-1 ]] P )[[f L ]] P .

2. A secret shift device, which is a secret shift device in a secret shift system, wherein P is a prime number, p is the number of bits of the prime number P, Q is the order of the residue class ring, M is the upper limit value of the MSB position of the input value, M' is the upper limit value of the MSB position allowed by the share, From the value a's share [[a]] P and the share of the shift ρ <<ρ>> Q , calculate the fraction of the value s obtained by shifting the value a by ρ bits [[s]] P , where ρ When ≥0, it is set to indicate left shift, when ρ<0, it is set to indicate right shift, s=2 ρ a. The secret shifting system is composed of more than three secret shifting devices. The secret shifting device comprises: Analog-to-digital conversion section, from the share <<ρ>> Q , calculate the share <<ρ>> p ; The first flag calculation unit sets u to an integer that satisfies u≤M'-M+1, indicating the right shift amount that can be covered by one right shift, and sets d to an integer that satisfies d≥ceiling(((R'-R+1) / u) indicating the number of right shifts required to perform a right shift in the range from 1 to M-1 bits. Re ), divide the right shift of shift amount ρ into d right shifts of shift amount u each time, let [R, R'] be the range of right shift amounts covered by the divided right shifts, From the share <<ρ>> Q or share <<ρ>> p , range [R,R'], value u and value d, calculate the share [[f0]] 2 =[[(ρ≥-R')]] 2 ,[[f1]] 2 =[[(ρ≥-R'+u)]] 2 ,…,[[f d-1 ]] 2 =[[(ρ≥-R'+(d-1)u)]] 2 ,[[f L ]] 2 =[[(ρ≥-R+1)]] 2 ; The second flag calculation unit calculates the value of the share [[f1]] 2 ,[[f2]] 2 ,…,[[f d-1 ]] 2 ,[[f L ]] 2 , calculate the share < <f1> > p ,< <f2>> p ,…,<<f d-1 >> p ,<<f L >> p ; < / f1> The shift amount calculation unit, from the share <<ρ>> p , share< <f1> > p ,< <f2>> p ,…,< <f d-1 >> p ,< <f L >> p , the upper limit of the range R', the value u and the value d, calculate <<ρ'>> p =<<ρ>> p +R'-u(Σ 1≤i<d < <f i >> p )+((d-1)u-R')< <f L >> p ; < / f1> Left shift part, from share [[a]] P and share <<ρ'>> p , calculate the share [[b]] P =[[2 ρ’ a]] P ; Right shift part, from share [[b]] P , the upper limit of the range R', the value u and the value d, calculate the share [[c0]] P =[[2 ρ’ a / 2 R’ ]] P ,[[c1]] P =[[2 ρ’ a / (2 R’-u )]] P ,…,[[c d-1 ]] P =[[2 ρ’ a / (2 R’-(d-1)u )]] P ; The third flag calculation unit calculates the value of the share [[f0]] 2 ,[[f1]] 2 ,…,[[f d-1 ]] 2 ,[[f L ]] 2 , calculate the share [[f0]] P ,[[f1]] P ,…,[[f d-1 ]] P ,[[f L ]] P ;as well as The shift value calculation unit, from the share [[b]] P , share[[c0]] P ,[[c1]] P ,…,[[c d-1 ]] P and share[[f0]] P ,[[f1]] P ,…,[[f d-1 ]] P ,[[f L ]] P , calculate share [[s]] P =[[c0]] P [[f0]] P +([[c1]] P -[[c0]] P )[[f1]] P +…+([[c d-1 ]] P -[[c d-2 ]] P )[[f d-1 ]] P +([[b]] P -[[c d-1 ]] P )[[f L ]] P .

3. A secret shift method, wherein P is a prime number, p is the number of bits of the prime number P, Q is the order of the residue class ring, M is the upper limit of the MSB position of the input value, M' is the upper limit of the MSB position allowed by the share, and a secret shift system composed of three or more secret shift devices shifts the value a from the share [[a]] P and the share of the shift ρ <<ρ>> Q , calculate the fraction of the value s obtained by shifting the value a by ρ bits [[s]] P , where ρ When ≥0, it is set to indicate left shift, when ρ<0, it is set to indicate right shift, s=2 ρ a, The secret shifting method comprises: The analog-to-digital conversion step, the secret shift system from the share <<ρ>> Q , calculate the share <<ρ>> p ; In the first flag calculation step, u is set to an integer that satisfies u≤M'-M+1, which represents the right shift amount that can be covered by one right shift, and d is set to an integer that satisfies d≥ceiling(((R'-R+1) / u) which represents the number of right shifts required to perform a right shift from 1 to M-1 bits. Re ), divide the right shift of shift amount ρ into d right shifts of each shift amount u, let [R, R'] be the range of right shift amounts covered by the divided right shifts, the secret shift system starts from the share <<ρ>> Q or share <<ρ>> p , range [R,R'], value u and value d, calculate the share [[f0]] 2 =[[(ρ≥-R')]] 2 ,[[f1]] 2 =[[(ρ≥-R'+u)]] 2 ,…,[[f d-1 ]] 2 =[[(ρ≥-R'+(d-1)u)]] 2 ,[[f L ]] 2 =[[(ρ≥-R+1)]] 2 ; In the second sign calculation step, the secret shift system is shifted from the share [[f1]] 2 ,[[f2]] 2 ,…,[[f d-1 ]] 2 ,[[f L ]] 2 , calculate the share < <f1> > p ,< <f2>> p ,…,<<f d-1 >> p ,<<f L >> p ; < / f1> The shift amount calculation step, the secret shift system is from the share <<ρ>> p , share< <f1> > p ,< <f2>> p ,…,< <f d-1 >> p ,< <f L >> p , the upper limit of the range R', the value u and the value d, calculate <<ρ'>> p =<<ρ>> p +R'-u(Σ 1≤i<d < <f i >> p )+((d-1)u-R')< <f L >> p ; < / f1> Left shift step, the secret shift system from share [[a]] P and share <<ρ'>> p , calculate the share [[b]] P =[[2 ρ’ a]] P ; Right shift step, the secret shift system from share [[b]] P , the upper limit of the range R', the value u and the value d, calculate the share [[c0]] P =[[2 ρ’ a / 2 R’ ]] P ,[[c1]] P =[[2 ρ’ a / (2 R’-u )]] P ,…,[[c d-1 ]] P =[[2 ρ’ a / (2 R’-(d-1)u )]] P ; In the third flag calculation step, the secret shift system is shifted from the share [[f0]] 2 ,[[f1]] 2 ,…,[[f d-1 ]] 2 ,[[f L ]] 2 , calculate the share [[f0]] P ,[[f1]] P ,…,[[f d-1 ]] P ,[[f L ]] P ;as well as The shift value calculation step, the secret shift system from the share [[b]] P , share[[c0]] P ,[[c1]] P ,…,[[c d-1 ]] P and share[[f0]] P ,[[f1]] P ,…,[[f d-1 ]] P ,[[f L ]] P , calculate share [[s]] P =[[c0]] P [[f0]] P +([[c1]] P -[[c0]] P )[[f1]] P +…+([[c d-1 ]] P -[[c d-2 ]] P )[[f d-1 ]] P +([[b]] P - [[c d-1 ]] P )[[f L ]] P 。 4. A secret shift system, let P be a prime number, let p be the number of bits of the prime number P, let M be the upper limit of the shift amount, The secret shifting system is composed of three or more secret shifting devices, from the share of value a [[a]] P and the share of the shift ρ <<ρ>> Q , calculate the fraction of the value s obtained by shifting the value a by ρ bits [[s]] P ,in, 0≤ρ≤M, the value a is shifted left by M bits to get the value 2 M a does not overflow, s = 2 ρ a, The secret shifting system comprises: The shift amount calculation unit is based on the share <<ρ>> p and upper limit value M, calculate share <<M-ρ> > p ; Shift left by unit, from share [[a]] P and share<<M-ρ> > p , calculate the share [[b]] P =[[2 M-ρ a]] P ;as well as Shift right unit, from share [[b]] P and upper limit value M, calculate share [s]] P =[[2 M-ρ a / 2 M ]] P .

5. A secret shift system, let P be a prime number, let p be the number of bits of the prime number P, let Q be the order of the residue class ring, let M be the upper limit of the MSB position of the input value, The secret shifting system is composed of three or more secret shifting devices, from the share of value a [[a]] P and the share of the shift ρ <<ρ>> Q , calculate the fraction of the value s obtained by shifting the value a by ρ bits [[s]] P , where ρ When ≥0, it is set to indicate left shift, when ρ<0, it is set to indicate right shift, s=2 ρ a, The secret shifting system comprises: Analog-to-digital conversion unit, from the share <<ρ>> Q , calculate the share <<ρ>> p ; The first sign calculation unit, from the share <<ρ>> Q or share <<ρ>> p , calculate the share [[f L ]] 2 =[[(ρ≥0)]] 2 ; The second flag calculation unit, from the share [[f L ]] 2 , calculate < <f L >> p ; The shift amount calculation unit is based on the share <<ρ>> p , share< <f L >> p and the upper limit value M, calculate the share <<ρ'>> p =<<ρ>> p +MM< <f L >> p ; Shift left by unit, from share [[a]] P and share <<ρ'>> p , calculate the share [[b]] P =[[2 ρ’ a]] P ; Shift right unit, from share [[b]] P and upper limit value M, calculate share [[c]] P =[[2 ρ’ a / 2 M ]] P ; The third sign calculation means, from the share [[f L ]] 2 , calculate the share [[f L ]] P ;as well as Shift value calculation unit, from share [[b]] P , share[[c]] P and share[[f L ]] P , calculate share [[s]] P =[[c]] P +([[b]] P -[[c]] P )[[f L ]] P . 6 . A recording medium storing a computer program for causing a computer to function as the secret shifting device according to claim 2 .

Images