Confidential computing system, confidential computing device, confidential computing method and computer program product

Abstract

The secret computing device uses the shares of the random number ρ and the shares of the column f to perform secret computing, thereby obtaining the element f of the column f. p‑1 ,...,f0 rotates the column ρ○f after the number of elements ρ, but does not obtain the random number ρ and the column f, and obtains the element cf representing the column ρ○f p‑1 ,..., the element cf with value α in cf0 b' The value b'∈{0,...,p-1} at the position is obtained by using the share of the random number ρ and the secret calculation of the value b'. Where p is an integer greater than 2, and f is p elements f p‑1 ,...,f0, the column, element f p‑1 ,..., an element f in f0 b The value of is α, the element f b The values ​​of the elements other than α are other than α, indicating that the element f b The value of the position is b∈{0,...,p‑1}, and ρ is a random number represented by an integer.

Description

Technical Field

[0001] The present invention relates to secret computing technology. Background Art

[0002] In secret computing (e.g., see non-patent documents 1 and 2), it is sometimes necessary to represent the share of the numerical value of the position of an element having a specific value in a column of multiple elements. For example, in secret computing, in order to shift the most significant bit (MSB) of a bit string to a specific position, it is necessary to represent the share of the numerical value of the position of the most significant bit.

[0003] Prior art literature

[0004] Non-patent literature

[0005] Non-patent document 1: Nishide Takashi, Amada Takuma, "Calculation of Floating Decimal Point Calculation by Reducing Communication Volume", Journal of the Information Processing Society, Vol. Vol. 60 No. 9, pp. 1433-1447 (2019).

[0006] Non-patent document 2: Randmets, J., "Programming Languages ​​for Secure Multiparty Computation Application Development," PhD thesis. University of Tartu (2017). Summary of the invention

[0007] Problems to be solved by the invention

[0008] However, there is no known technique for obtaining, from the shares of a column of a plurality of elements, the shares of numerical values ​​indicating the positions of elements having a specific value in the column of a plurality of elements while concealing the positions of the elements having the specific value.

[0009] The present invention is completed in view of this point, and its purpose is to obtain the share of the numerical value representing the position of the element with a specific value in the column of multiple elements based on the share of the column of multiple elements while hiding the position of the element with the specific value in the column of multiple elements.

[0010] Means for solving problems

[0011] The secret computing device uses the shares of the random number ρ and the shares of the column f to perform secret computing, thereby obtaining the element f of the column f. p-1 ,...,f0 rotates the column ρ○f after the number of elements ρ, but does not obtain the random number ρ and the column f, and obtains the element cf representing the column ρ○fp-1 ,..., the element cf with value α in cf0 b' The value b'∈{0,...,p-1} at the position of is obtained by using the share of the random number ρ and the secret calculation of the value b'. Where p is an integer greater than 2, and f is p elements f p-1 ,...,f0, the column, element f p-1 ,..., an element f in f0 b The value of is α, the element f b The values ​​of the elements other than α are other than α, indicating that the element f b The value of the position is b∈{0,...,p-1}, and ρ is a random number represented by an integer. Here, since ρ is a random number, ρ○f becomes the value that makes the element f b The position of the random position cannot be obtained from ρ○f to element f b b. Information about the location of the device.

[0012] Effects of the Invention

[0013] In this way, in the secret computing device of the present invention, based on the share of a column of multiple elements, it is possible to obtain the share of the numerical value representing the position of the element with the specific value in the column of multiple elements while concealing the position of the element with the specific value. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 This is a conceptual diagram illustrating the structure of a secure computing system according to an embodiment.

[0015] Figure 2 This is a block diagram illustrating the functional structure of a secure computing device according to an embodiment.

[0016] Figure 3 is a flowchart of a secret computing method for illustrating an embodiment.

[0017] Figure 4 It is a flowchart for explaining a specific example of the processing of step S13-j.

[0018] Figure 5 This is a block diagram of the hardware structure of a secret computing device used to illustrate an implementation method. DETAILED DESCRIPTION

[0019] Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[0020] [principle]

[0021] First, the principle of this embodiment will be described.

[0022] In this embodiment, n secret computing devices PA(0), ..., PA(n-1) perform secret computing according to a plurality of (p) elements f p-1 ,...,f0, the share (secret distributed value) of column f, after hiding the multiple elements f p-1 ,...,f0, the element f with a specific value α in the column f b , we get the element f with the specific value α. b The share of the values ​​of the positions. Where n is an integer greater than 2, j = 0, ..., n-1, and p is an integer greater than 2. For example, p is a prime number (for example, p is a Mersenne prime number such as 61). In addition, f is p elements f p-1 ,...,f0, the column, element f p-1 ,..., an element f in f0 b The value of f is α, the element f b The values ​​of the elements other than α are other than α, indicating that the element f b The value of the position is b∈{0,...,P-1}. The preferred element f p-1 ,...,the element f in f0 b All the values ​​of the elements other than α are β, β≠α. That is, it is preferred that each element f i (where i∈{0,...,p-1}) is a binary value (fi∈{α,β}). For example, column f is a bit string, and element f p-1 ,..., each element f of f0 i is a bit, element f p-1 ,..., each element f of f0 i The value of is 0 or 1. It can be (α, β) = (1, 0) or (α, β) = (0, 1). For example, column f = (f p-1 ,...,f0) represents the residue class ring Z modulo P represented by p bits P The element A∈Z P (ie, when A is regarded as an integer, A mod P) represents a specific bit position b (for example, the most significant bit) when it is expressed as a binary number, and the element f corresponding to the specific bit position b of the element A b The value of is α=1, and the value of the other elements is β=0. For example, p represents the number of bits of P. P is an integer greater than 1, for example, P is a Mersenne number. An example of P is a Mersenne prime number P=2 p -1 (for example, 2 61 -1). However, this does not limit the present invention.

[0023] Each secure computing device PA(j) holds p as a parameter. Each secure computing device PA(j) inputs p elements f p-1,...,f0 column f=(f p-1 ,...,f0)'s share sha(f) j For example, f=(f p-1 ,...,f0)'s share sha(f) j Each element f p-1 ,...,f0's share column sha(fp-1) j ,...,sha(f0) j However, this does not limit the present invention. The share of x sha(x) j Represents the share (secret distribution value) allocated to the secret computing device PA(j) from the share obtained by secret distributing χ in accordance with a prescribed secret distribution method. It is not limited to the secret distribution method. Examples of secret distribution methods include (k,n)-secret distribution methods such as the (k,n)-copy type secret distribution method (for example, refer to reference 1, etc.), the (k,n)-Shamir secret distribution method (for example, refer to reference 2, etc.), and the (k,k)-addition secret distribution method. Here, k is an integer greater than 2 and less than n. The (k,n)-copy type secret distribution method when n=k is called the (k,k)-addition secret distribution method. In addition, regardless of the type of secret distribution method, the share of χ is represented by sha(χ) j For example, the share of χ1 is sha(χ1) j and the share of χ2 (χ2) j The shares may be those following the same secret distribution method or those following different secret distribution methods.

[0024] Reference 1: Igarashi Dai, Hamada Hiroshi, Kikuchi Ryo, Chida Koji, "インターネットEnvironment レスポンス 1 second のstatistical processing をocular finger した, secret calculation base ソートの improvement", SCIS2014, 2014.

[0025] Reference 2: A. Shamir, "How to share a secret," Communications of the ACM, Vol. 22, No. 11, pp. 612-613, 1979.

[0026] <Step S1>

[0027] Each secure computing device PA(j) generates a share sha(p) of a random number p represented by an integer j. The random number ρ is preferably a uniform random number, but the random number ρ may not be a uniform random number. For example, a pseudo-random number that can approximate a uniform random number may also be the random number ρ. In addition, the random number ρ may be limited to an integer greater than 0 or may not be limited. Each secret computing device PA(j) generates a share sha(p) j For example, at least some of the n secure computing devices PA(0), ..., PA(n-1) cooperate to generate the random number sha(ρ)0, ..., sha(ρ) of the random number ρ. n-1 The share of random number ρ is sha(ρ)0,...,sha(ρ) n-1 For example, the remainder class ring Z modulo p p The element ρ∈Z p (That is, if ρ is regarded as an integer, then ρ_mod p) is the share obtained by secret distribution. It is not limited to the share sha(ρ)0,...,sha(ρ) n-1 For example, in the share sha(ρ) j In the case of the (k, k)-addition secret distribution method, each of the k secret computing devices PA(0), ..., PA(k-1) generates a random number ρ j , we can also use each random number ρ j Let sha(ρ) j In this case, ρ=ρ0+...+ρ k-1 ∈Z p (That is, if ρ,ρ0,...,ρ n-1 Considered as an integer, then ρ=ρ0+…+ρ k-1 mod p). For example, in the share sha(ρ) j In the case of a (k,n)-replicated secret distribution method, each of the n secret computing devices PA(0), ..., PA(n-1) can generate a random number ρ j , and the random numbers ρ0,…,ρ n-1 The true partial set (the set of sub-shares) of each share sha(P) j In the case of (k,n)-replicated secret sharing, ρ=ρ0+...+ρ n-1 ∈Z p , according to the share sha(ρ)0,...,sha(ρ) n-1 For any k of them, we can get all the random numbers ρ0,…,ρ n-1 , but the information about ρ cannot be obtained based on the shares less than k.

[0028] <Step S2>

[0029] Each secure computing device PA(j) uses the share sha(ρ) of the random number ρ j and the share of column f is sha(f) j The secret calculation of column f is obtained to make the element f p-1 ,...,f0 is rotated (circularly shifted) by ρ elements, and the column ρ○f=(cf p-1 ,...,cf0), but does not obtain the random number ρ and column f. For example, each secure computing device PA(j) obtains the element f of column f as a bit string p-1 ,...,f0 is a bit string after the bit rotation of ρ bits, that is, the column ρ○f. Since the rotation is a partial group of permutations, this processing can be realized, for example, by limiting the permutation to the rotation using a random permutation based on secret computing (for example, reference 3). In addition, the rotation is equivalent to a multiplication or division operation on the remainder class ring, so it can also be realized by exponentiation, multiplication, division, etc. based on secret computing. In this case, the module of the remainder class ring becomes a Mersenne prime.

[0030] Reference 3: Hamada Hiroshi, Igarashi Dai, Chida Koji, Takahashi Katsumi, "3-パーティSecret Level Calculation and Replacement Manual", CSS2010 (2010).

[0031] The rotation of the ρ element of χ can be to shift χ to the left by the ρ element when ρ is positive, and to shift χ to the right by the ρ element when ρ is negative. Conversely, when ρ is positive, χ can be shifted to the right by the ρ element, and when ρ is negative, χ can be shifted to the left by the ρ element. Here, column ρ○f is a recovery value (public value), but each secret computing device PA(j) does not know the random number ρ itself. Therefore, even if each secret computing device PA(j) can calculate the random number ρ based on column ρ○f=(cf p-1 ,...,cf0) we know that the element cf with value α b’ (where b'∈{0,...,p-1}) and the element f of the original column f cannot be known. p-1 ,..., which element in f0 has the value of α (it is not known which element is the element with the value of α). In particular, in the element f p-1 ,..., an element f in f0 b The value of is α, the element f b When the values ​​of all elements other than α are β (β≠α), the information obtained from the column ρ○f is indistinguishable from the information obtained from an arbitrary random number. Therefore, higher security can be ensured.

[0032] <Step S3>

[0033] Each secure computing device PA(j) obtains an element cf representing the column ρ○f p-1 ,..., the element cf with value α in cf0 b’ The value of the position b'∈{0,...,p-1}. That is, each secure computing device PA(j) obtains the element cf p-1 ,...,cf0 satisfies cf b’ = value b' of α. b', b, ρ satisfy b' = b + ρ ∈ Z p relationship.

[0034] <Step S4>

[0035] Each secret computing device (PA(j) is based on b'=b+ρ∈Z p By using the share of the random number ρ, sha(ρ) j And the secret calculation of value b', get the share of value b sha(b) j For example, in the share sha(ρ) j and share sha(b) j When following the (k, k)-addition secret distribution method or the (k, n)-copy secret distribution method, each secret computing device PA(j) obtains sha(b) j =b'-sha(ρ) j ∈Z p As a share of value b, sha(b) j .

[0036] [First embodiment]

[0037] Next, a first embodiment of the present invention will be described using the drawings. In the first embodiment, the following examples will be described.

[0038] P is a prime number. For example, P is a Mersenne prime number (for example, P = 2 61 -1).

[0039] p is the number of bits of P. When P is a Mersenne prime, p is also a prime number (eg, p=61).

[0040] · A column f is a column in which each element f p-1 ,..., a bit sequence of length p with bits 0 or 1 in f0 (a p-dimensional vector (f p-1 ,...,f0)).

[0041] Element f p-1 ,..., an element f in f0 b The value of α is 1, and the element f b All elements other than β have a value of β = 0. For example, column f = (f p-1,...,f0) represents A∈Z represented by p bits P The highest bit position of b, the element f corresponding to the highest bit position b b The value of is α=1, and the values ​​of other elements are β=0.

[0042] In addition, in this embodiment, x∈Z is distributed according to the (k,n)-secret distribution method. y (x_mod y when x is considered an integer) The shares obtained by secret distribution are marked as [x] y , will follow the (k,k)-addition secret distribution method and x∈Z y The shares obtained by secret distribution are marked as <x> y , will follow the (k,n)-copy secret distribution method and x∈Z y The shares obtained by secret distribution are marked as < <x>> y In addition, [x] assigned to the secret computing device PA(j) y Note it as [x] j y , which is allocated to the secret computing device PA(j) <x> y Recorded as <x> j y , the < <x>> y Marked as < <x>> j y .

[0043] <Structure>

[0044] like Figure 1 As illustrated, the secret computing system 1 of the present embodiment has n secret computing devices PA(0), ..., PA(n-1). The secret computing devices PA(0), ..., PA(n-1) are configured to be able to exchange data. In the present embodiment, the secret computing devices PA(0), ..., PA(n-1) are configured to be able to communicate through a network, and an example of exchanging data via a network is described. However, this is not a limitation of the present invention, and the secret computing devices PA(0), ..., PA(n-1) may also be configured to be able to exchange data via a removable recording medium, or may exchange data via a removable recording medium. Figure 2 As illustrated, the secret computing device PA(j) of the present embodiment has a communication unit 11-j, a random number share generation unit 12-j, a rotation unit 13-j, a position extraction unit 14-j, a numerical share conversion unit 15-j, a control unit 16-j, and a storage unit 17-j. The secret computing device PA(j) performs each process under the control of the control unit 16-j. The data used in each process and the data obtained in each process are stored in the storage unit 17-j and read out as needed for each process. In the storage unit 17-j, the number of bits p of P is stored as a parameter. In addition, the exchange of data between the secret computing devices PA(0), ..., PA(n-1) is performed through each communication unit 11-j.

[0045] <Processing>

[0046] Below, use Figure 3 The processing of each secure computing device P(j) is described.

[0047] As column f = (f p-1 ,...,f0) of the bit share vector [f] j 2 Input to communication unit 11-j. Bit share vector [f] j 2 For example, each element f p-1 ,...,f0's share of the column [f p-1 ] j 2 ,...,[f0] j 2 (Step S11-j).

[0048] The random number share generation unit 12-j uses p read from the storage unit 17-j to communicate with other secure computing devices PA m At least a portion of the random number share generation units 12-m (where m∈{0, ..., n-1} and m≠j) cooperate to generate a share of random numbers (e.g., uniform random numbers) ρ <<ρ>> j p And output (step S12-j).

[0049] The rotation unit 13-j uses the bit share vector [f] input in step S11-j. j 2 and the share of the random number ρ obtained in step S12-j <<ρ>> j p The secret calculation of column f is thus obtained without obtaining the random number ρ and column f. p-1 ,...,f0 is a column after the rotation of ρ elements (ρ bit rotation) ρ○f=(cf p-1 ,...,cf0) and output. For example, when ρ is positive, column ρ○f is a circular shift of column f to the left by ρ elements, and when ρ is negative, column ρ○f is a circular shift of column f to the right by ρ elements. A specific example of this processing will be described later (step S13-j).

[0050] The position extraction unit 14-j uses the column ρ○f=(cf p-1 ,...,cf0), get the element cf representing the column ρ○f p-1 ,..., the element cf with value α=1 in cf0 b’ The value b'∈{0,...,P-1} of the position is obtained and output (step S14-j).

[0051] The numerical share conversion unit 15-j converts the random number p obtained in step S12-j into a share p by using the p read from the storage unit 17-j. > j p , and the secret calculation of the value b' obtained in step S14-j, calculate < > j p =b'-<<ρ>> j p ∈Z p , output the resulting share < > j p (Step S15-j).

[0052] <Specific Example of Processing of Step S13-j>

[0053] The process of step S13-j can be implemented using random permutation based on secret computing (for example, reference 3). A specific example of this process is shown below.

[0054] <<Specific example 1>>

[0055] Specific example 1 is an example in the case of n=3 and k=2.

[0056] 1: The rotation unit 13-0 of the secure computing device PA(0) and the rotation unit 13-1 of the secure computing device PA(1) cooperate to convert the bit share vector [f]0 2 and bit share vector [f]1 2 Convert to shares that follow the (2, 2)-additive secret distribution method <f>0 2 and share <f>1 2 (See, for example, Reference 4). That is, f= <f> 0 2 + <f>1 2 . Share <f>0 2 Assigned to the secret computing device PA(0), the share <f>1 2 Assigned to the secure computing device PA(1).

[0057] Reference 4: Kikuchi, R., Ikarashi, D., Matsuda, T., Hamada, K. and Chida, K., "Efficient Bit-Decomposition and Modulus-Conversion Protocols with an HonestMajority," Information Security and Privacy-23rd Australasian Conference, ACISP2018, Wollongong, NSW, Australia, July 11-13, 2018, Proceedings (Susilo, W. and Yang, G., eds.), Lecture Notes in Computer Science, Vol. 10946, Springer, pp. 64-82 (online), DOI: 10.1007 / 978-3-319-93638-3 5 (2018).

[0058] 2: The rotation unit 13-0 of the secure computing device PA(0) and the rotation unit 13-1 of the secure computing device PA(1) share the random number element r 01,p-1 ,...,r 01,0 Column r 01 =(r 01,p-1 ,...,r 01,0 For example, the rotation unit 13-0 may randomly generate the column r 01 The rotation units 13-0 and 13-1 may share a seed value in advance, and share the same column r by performing a process determined by using the seed value. 01 .

[0059] 3: The rotation unit 13-0 of the secure computing device PA(0) uses the quota <<ρ>>0 p , share <f>0 2 and column r 01 , calculate B0 = (ρ 01 )○ <f>0 2 -r 01 , and sent to the rotation unit 13-2 of the secure computing device PA2. Among them, the following relationship is satisfied.

[0060] <<ρ>>0 p =(ρ 01 ,ρ 20 )

[0061] <<ρ>>1 p =(ρ 01 ,ρ 12 )

[0062] <<ρ>>2 p =(ρ 12 ,ρ 20 )

[0063] ρ=ρ 01 +ρ 12 +ρ 20 ∈Z p

[0064] ρ、ρ 01 , 20 , 12 is an element of the remainder class ring modulo ρ, ρ, ρ 01 , 20 , 12 The operation of ρ, ρ 01 , 20 , 12 The operation of the share is the residue class ring Z modulo ρ p Operations on (operations on mod p).

[0065] 4: The rotation unit 13-1 of the secure computing device PA(1) uses the share <<ρ>>1 p , share <f>1 2 , and column r 01 , calculate B1 = (ρ 01 )○ <f>1 2 +r 01 , and sent to the rotation unit 13-2 of the secure computing device PA2.

[0066] 5: The rotation unit 13-2 of the secure computing device PA2 uses the share <<ρ>>2 p , share <f>2 2 , B0 and B1, calculate C = (ρ 20 )○((ρ 12 )○(B0+B1)). Here, the following holds.

[0067] C=(ρ 20 )○((ρ 12 )○(B0+B1))

[0068] =(ρ 20 )○((ρ 12 )○((ρ 01 )○ <f>0 2 -r 01 +(r 01 )○ <f>1 2 +r 01 ))

[0069] =(ρ 20 )○((r 12 )○((r 01 )○( <f> 0 2 + <f>1 2 ))

[0070] =(ρ 20 )○((ρ 12 )○((ρ 01 )○f)

[0071] =(ρ 20 +ρ 12 +ρ 01 )○f

[0072] =ρ○f

[0073] <<Specific example 2>>

[0074] Specific example 2 is an example of generalizing n and k. As specific example 2, a group of n secure computing devices PA(0), ..., PA(n-1) is labeled as PA, and k secure computing devices selected from PA are The group is denoted as SP(i). Where n and k are integers greater than 2, n>k, N= n C k , i=0,...,N-1. n C k represents the total number of combinations when k different combinations are selected from n different combinations. is the function value of α and β, satisfying SP(0),...,SP(N-1) are different from each other, and SP(0),...,SP(N-1) for i'=0,...,N-2 is |SP(i')∩SP(I'+1) c |=1. Here, α c represents the complement of α, and |α| represents the number of elements of α. That is, the group SP(i') is a group that is different from the group SP(i'+1) by only one secure computing device.

[0075] Share <f> (SP(i)) are k shares following the (k,k)-additive secret distribution method maintained by group SP(i), in particular, the shares <f> (SP(0)) is the k shares obtained by secret distributing f according to the (k,k)-addition secret distributing method <f> 0 p ,..., <f> k-1 p 。 <f> (PA(θ)∈SP(i)) It is a share <f> (SP(i)) The share held by the secret computing device PA(θ)∈SP(i).

[0076] The n shares obtained by distributing the ρ secret according to the (k,n)-replication secret distribution method <<ρ>>0 p ,...,<<ρ>> n-1 p The sub-shares are denoted as ρ0,...,ρ n-1 ∈Z p That is, ρ=ρ0+...+ρ n-1 ∈Z p (That is, ρ=ρ0+...+ρ n-1 modp). n-1 The sub-share corresponding to group SP(i) in is denoted as ρ (SP(i)) That is, ρ (SP(i)) represents the k secret computing devices belonging to group SP(i) The corresponding share The sub-shares included.

[0077] As described above, for i'=0,...,N-2, |SP(i')∩SP(i'+1) c |=1 constitutes SP(0), ..., SP(N-1). Here, represents the secret computing device included in the group SP(i') but not included in the group SP(i'+1). In addition, represents a secure computing device that is not included in the group SP(i') and is included in the group SP(i'+1). Furthermore, for j=1,...,k-1 Represents the secure computing devices included in the group SP(i') and the group SP(i'+1).

[0078] use Figure 4 , specific example 2 of step S13-j is explained.

[0079] k secret computing devices belonging to group SP(0) Rotary part The bit share vector will be the share held by group SP(0) Converted to the share obtained by distributing f according to the (k,k)-addition secret distribution method <f> 0,..., <f> k-1 (Share <f> (SP(0)) ). In the secret computing device belonging to group SP(0) The storage unit 17-θ stores the share <f> θ (Step S131).

[0080] The control units 16-j of all the secure computing devices PA(j) set i=0 (step S132).

[0081] k secret computing devices belonging to group SP(i) Rotary part ρ (SP(i)) ○ <f> (SP(i)) ∈Z P Calculate (unit rotation) and use the resulting value as the new share <f> (SP(i)) , stored in the storage unit

[0082] The control unit 16 - j determines whether i ≥ N-1 (step S134 ), and proceeds to step S137 if i ≥ N-1, and proceeds to step S135 if not i ≥ N-1.

[0083] In step S135, first, the secret computing device Rotary part and secret computing devices Rotary part Share random numbers r(i,1),...,r(i,k-1))∈Z p Furthermore, the secret computing device Rotary part Use share <f> (PA(0)∈SP(i)) and random numbers r(i,1),...,r(i,k-1)) to obtain shares <f> (PA(k)∈SP(i+1)) That is, the secret computing device The share is obtained by the following formula <f> (PA(k)∈SP(i+1)) .

[0084]

Formula 1

[0085]

[0086] Secret computing device The share obtained as above <f> (PA(k)∈SP(i+1)) Send to secret computing device

[0087] In addition, confidential computing devices Rotary part Use shares for j'=1, ..., k-1 respectively <f> (PA(j')∈SP(i)) And the random number r(i,j'), get the share usage share <f> (PA(j')∈SP(i+1)) That is, the secret computing device Rotary part The shares are obtained by the following formula <f> (PA(j')∈SP(i+1)) (Step S135).

[0088]

Formula 2

[0089] <f> (PA(j′)∈SP(i+1))

[0090] ＝ <f> (PA(j′)∈SP(i) +r(i, j′)

[0091] The control unit 16-j of all the secure computing devices PA(j) sets i+1 as a new i (step S136), and the process proceeds to step S133.

[0092] In step S137 (when i ≥ N-1 in step S134), the secure computing device belonging to group SP(N-1) Rotary part In step S133, the storage unit is used The share of storage <f> (SP(N-1)) , collaboratively obtain the restoration value ρ○f.

[0093] [Hardware Structure]

[0094] The secret computing device PA(j) in the implementation mode is, for example, a device that is constructed by executing a prescribed program using a general-purpose or special-purpose computer having a processor (hardware, controller) such as a CPU (central processing unit), a memory such as a RAM (random-access memory), and a ROM (read-only memory). The computer may have one processor and a memory, or may have multiple processors and memories. The program may be installed in the computer or recorded in a ROM or the like in advance. In addition, instead of using an electronic circuit (circuitry) that realizes a functional structure by reading in a program like a CPU, an electronic circuit that realizes a processing function alone may be used to constitute a part or all of the processing unit. In addition, the electronic circuit constituting one device may also include multiple CPUs.

[0095] Figure 5 is a block diagram illustrating the hardware structure of the secure computing device PA(j) in the embodiment. Figure 5 As shown in the example, the secure computing device PA(j) of this example has a CPU (Central Processing g Unit (Central Processing Unit) 10a, input unit 10b, output unit 10c, RAM (Random Access Memory) 10d, ROM (Read Only Memory) 10e, auxiliary storage device 10f and bus 10g. The CPU 10a of this example has a control unit 10aa, a calculation unit 10ab and a register 10ac, and performs various calculations according to various programs read into the register 10ac. In addition, the input unit 10b is a communication device, input terminal, keyboard, mouse, touch panel, etc. for inputting data. In addition, the output unit 10c is a communication device, output terminal, display, etc. for outputting data. In addition, the RAM 10d is an SRAM (Static Random Access Memory), a DRAM (Dynamic Random Access Memory), etc., and has a program area 10da for storing a specified program and a data area 10db for storing various data. In addition, the auxiliary storage device 10f is, for example, a hard disk, an MO (Magneto-Optical disc), a semiconductor memory, etc., and has a program area 10fa for storing a predetermined program and a data area 10fb for storing various data. In addition, the bus 10g connects the CPU 10a, the input unit 10b, the output unit 10c, the RAM 10d, the ROM 10e, and the auxiliary storage device 10f so that information can be exchanged. The CPU 10a writes the program stored in the program area 10fa of the auxiliary storage device 10f into the program area 10da of the RAM 10d according to the read OS (Operating System) program. Similarly, the CPU 10a writes various data stored in the data area 10fb of the auxiliary storage device 10f into the data area 10db of the RAM 10d. Then, the address on the RAM 10d where the program and data are written is stored in the register 10ac of the CPU 10a. The control unit 10aa of the CPU 10a sequentially reads the addresses stored in the register 10ac, reads the program and data from the area on the RAM 10d indicated by the read addresses, and causes the operation unit 10ab to sequentially execute the operations indicated by the program, and stores the operation results in the register 10ac. With such a structure, the functional structure of the secure computing device PA(j) is realized.

[0096] The above-mentioned program can be recorded in advance in a computer-readable recording medium. An example of a computer-readable recording medium is a non-transitory recording medium. Examples of such a recording medium are a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, and the like.

[0097] The circulation of the program is carried out, for example, by selling, transferring, or renting a removable recording medium such as a DVD or CD-ROM on which the program is recorded. Furthermore, it can also be set to the following structure, that is, the program is stored in the storage device of the server computer, and the program is forwarded from the server computer to other computers via a network, so that the program is circulated. As described above, a computer that executes such a program, for example, first temporarily stores the program recorded in the removable recording medium or the program forwarded from the server computer in its own storage device. Then, when executing the process, the computer reads the program stored in its own storage device and executes the process according to the read program. In addition, as another execution method of the program, it can also be that the computer directly reads the program from the removable recording medium and executes the process according to the program, and further, it can also be that each time the program is forwarded from the server computer to the computer, the process according to the received program is executed one by one. In addition, it can also be set to the following structure, that is, without forwarding the program from the server computer to the computer, the above-mentioned process is executed by the so-called ASP (Application Service Provider, Application Service Provider) type service that realizes the processing function only through the execution instruction and result acquisition. In addition, the program in this embodiment is assumed to include information provided for processing by an electronic computer and information based on the program (data having a nature that specifies processing by the computer although not a direct instruction to the computer, etc.).

[0098] In each embodiment, the present device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0099] In addition, the present invention is not limited to the above-mentioned embodiments. For example, the above-mentioned various processes can be performed not only in a time series according to the record, but also in parallel or individually according to the processing capacity of the device for performing the process or as needed. In addition, it is of course possible to change appropriately within the scope of the gist of the present invention.

[0100] Industrial Applicability

[0101] The present invention can be used, for example, for secret computing using shares. For example, in secret computing, in order to move the highest bit of a bit string to a specific position, a share of the numerical value representing the position of the highest bit is sometimes required. By using the present invention, it is possible to obtain a share of the numerical value representing the position of an element having a specific value from a share of a column of multiple elements having a specific value among the elements at the position of the highest bit, while hiding the position of the element having the specific value.

[0102] Description of Reference Numerals

[0103] 1Secret Computing System

[0104] PA(j) secret computing device

[0105] 12-j Random number share generation unit

[0106] 13-j Rotary Department

[0107] 14-j Position extraction unit

[0108] 15-j numerical share conversion unit.< / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / f> < / x> < / x> < / x> < / x> < / x> < / x>

Claims

1. A secret computing system, n is an integer greater than 2, j = 0, ..., n-1, p is an integer greater than 2, and f is p elements f p-1 ,...,f0, the column, element f p-1 ,..., an element f in f0 b The value of α is, the element f b The value of the element other than α indicates that the element f b The value of the position is b∈{0,...,p-1}, ρ is a random number represented by an integer, There are n secret computing devices PA(0), ..., PA(n-1), The secret computing device PA(j) has: The rotation unit obtains the element f of the column f by using the secret calculation of the share of the random number p and the share of the column f. p-1 ,...,f0 is a column ρ○f after rotating the element amount ρ, without obtaining the random number ρ and the column f, where the column ρ○f when ρ is positive is the column f being cyclically shifted left by the element amount ρ, and the column ρ○f when ρ is negative is the column f being cyclically shifted right by the element amount ρ, or the column ρ○f when ρ is positive is the column f being cyclically shifted right by the element amount ρ, and the column ρ○f when ρ is negative is the column f being cyclically shifted left by the element amount ρ; The position extraction unit obtains the element cf representing the column ρ○f p-1 ,..., the element cf in cf0 with value α b’ The value of the position b'∈{0,...,p-1}; as well as The numerical share conversion unit is based on b'=b+ρ∈Z p The relationship between the random number ρ and the value b' is obtained by using the secret calculation of the random number ρ and the value b', where Z p is the remainder class ring modulo p.

2. A secret computing device, p is an integer greater than 2, and f is p elements f p-1 ,...,f0, the column, element f p-1 ,..., an element f in f0 b The value of α is, the element f b The value of the element other than α indicates that the element f b The value of the position is b∈{0,...,p-1}, ρ is a random number represented by an integer, The secret computing device has: The rotation unit obtains the element f of the column f by using the secret calculation of the share of the random number p and the share of the column f. p-1 ,...,f0 is a column ρ○f after rotating the element amount ρ, without obtaining the random number ρ and the column f, where the column ρ○f when ρ is positive is the column f being cyclically shifted left by the element amount ρ, and the column ρ○f when ρ is negative is the column f being cyclically shifted right by the element amount ρ, or the column ρ○f when ρ is positive is the column f being cyclically shifted right by the element amount ρ, and the column ρ○f when ρ is negative is the column f being cyclically shifted left by the element amount ρ; The position extraction unit obtains the element cf representing the column ρ○f p-1 ,..., the element cf in cf0 with value α b’ The value of the position b'∈{0,...,p-1}; as well as The numerical share conversion unit is based on b'=b+ρ∈Z p The relationship between the random number ρ and the value b' is obtained by using the secret calculation of the random number ρ and the value b', where Z p is the remainder class ring modulo p.

3. The secret computing device according to claim 2, wherein: The element f p-1 ,...,f0 b The values ​​of all elements other than are β, β≠α.

4. The secret computing device according to claim 3, wherein: i∈{0,...,p-1}, the column f is a bit string, the element f p-1 ,..., each element f of f0 i The value of is 0 or 1, which is (α, β) = (1, 0) or (α, β) = (0, 1). The random number ρ is a residual class ring Z modulo p. p The element of the random number ρ is the share of ρ∈Z p The share sha(ρ) obtained by secret distribution j , The rotation unit obtains the element f of the column f. p-1 ,...,f0 is the bit string after the bit rotation of ρ bits, that is, the column ρ○f, sha(ρ) j andsha(b) j It is the share obtained by secret distribution according to the additive secret distribution method or the replication secret distribution method. The numerical share conversion unit obtains b'-sha(ρ) j ∈Z p As the share of the value b sha(b) j .

5. The secret computing device according to any one of claims 2 to 4, wherein: The random number ρ is a uniform random number.

6. A secret computing method, p is an integer greater than 2, and f is p elements f p-1 ,...,f0, the column, element f p-1 ,..., an element f in f0 b The value of α is, the element f b The value of the element other than α indicates that the element f b The value of the position is b∈{0,...,p-1}, ρ is a random number represented by an integer, The secret computing method comprises: The rotation step includes: obtaining the element f of the column f by performing a secret calculation using the share of the random number p and the share of the column f in the rotation unit. p-1 ,...,f0 is a column ρ○f after rotating the element amount ρ, without obtaining the random number ρ and the column f, where the column ρ○f when ρ is positive is the column f being cyclically shifted left by the element amount ρ, and the column ρ○f when ρ is negative is the column f being cyclically shifted right by the element amount ρ, or the column ρ○f when ρ is positive is the column f being cyclically shifted right by the element amount ρ, and the column ρ○f when ρ is negative is the column f being cyclically shifted left by the element amount ρ; Position extraction step, in which the element cf representing the column ρ○f is obtained in the position extraction unit p-1 ,..., the element cf in cf0 with value α b’ The value of the position b'∈{0,...,p-1}; as well as The numerical share conversion step, in which the numerical share conversion unit is based on b'=b+ρ∈Z p The relationship between the random number ρ and the value b' is obtained by using the secret calculation of the random number ρ and the value b', where Z p is the remainder class ring modulo p.

7. A computer program product, comprising a computer program, wherein the computer program is used to enable a computer to function as the secure computing device according to any one of claims 2 to 5.

Images