Secret index unit unified system, secret index unit unified device, secret index unit unified method, secret sum calculation system, secret product sum calculation system, program

Abstract

The present invention provides a secret computing technology that effectively unifies the exponent of floating point. → a]] P ,[[ → ρ]] Q )( → a=(a0,…,a m‑1 ), → ρ=(ρ0,…,ρ m‑1 )) to calculate the fraction of floating-point vectors with unified exponents ([[ → b]] P ,[[ → ρ max ]] Q )( → b=(b0,…,b m‑1 ), → ρ max =(ρ max ,…,ρ max )(ρ max =max{ρ0,…,ρ m‑1}), satisfying 2 ρ_i a i ≒2 ρ_max b i ) secret exponent unified system, including: the mantissa calculation unit, according to the share [[ → a]] P The i-th element and the share [[ → ρ dif ]] Q =[[ → ρ]] Q ‑[[ → ρ max ]] Q Convert to a share of the replication secret << → ρ dif >> Q The i-th element of i The share of i ]] P (b i =2 ‑ρ_dif,i a i ), from which the share [[ → b]] P .

Description

Technical Field

[0001] The present invention relates to secret computing technology, and in particular to a technology for performing unified operations on exponents of multiple floating points in secret computing. Background Art

[0002] Secret computing refers to a method of obtaining the result of a specified operation without restoring the encrypted value (for example, refer to reference non-patent document 1). In the method of reference non-patent document 1, multiple information that can restore the value is encrypted and distributed among three secret computing devices. It is possible to maintain the state of maintaining the encrypted state of the results of addition and subtraction, constant sum, multiplication, constant multiple, logical operation (negation, logical product, logical sum, exclusive or), and data format conversion (integer, binary) distributed among the three secret computing devices without restoring the value. Usually, the distribution number is not limited to 3, and can be W (W is a specified constant greater than 3). The protocol that realizes secret computing through coordinated calculations performed by W secret computing devices is called a multi-party protocol.

[0003] (Reference Non-Patent Document 1: Hiroshi Chida, Hiroki Hamada, Dai Igarashi, Katsumi Takahashi, "Rethinking Lightweight Verifiable Tripartite Hidden Function Computation," In CSS, 2010.)

[0004] Conventionally, as documents related to protocols and implementations of secret calculations for performing floating point operations, there are Non-Patent Documents 1 and 2. In order to calculate the sum of floating points, it is necessary to unify the exponents of the floating points to be added.

[0005] Prior art literature

[0006] Non-patent literature

[0007] Non-patent document 1: Takuma Amada, Nara Naruyasu, Nishide Takashi, Yoshiura Hiroshi, "Multi-party computation of floating-point operations for reducing communication traffic," Journal of Information Processing Society, Vol. 60, No. 9, pp. 1433-1447, 2019.

[0008] Non-patent document 2: Randmets, J., "Programming Languages ​​for Secure Multi-party Computation Application Development," PhD thesis. University of Tartu, 2017. Summary of the invention

[0009] Problems to be solved by the invention

[0010] Among them, the method of unifying the exponent part of the floating point while maintaining confidentiality has the problem of poor efficiency.

[0011] Therefore, an object of the present invention is to provide a secret calculation technique for efficiently unifying the exponent parts of floating points.

[0012] Means for Solving the Problem

[0013] One aspect of the present invention is a secret exponent part unification system. Let P be a prime number and Q be the order of the residue class ring. It is composed of three or more secret exponent part unification devices. According to the shares of the floating point vector ( → a, → ρ) ( → a]] P , → ρ]] Q ), where ( → a = (a0, a1,..., a m-1 ), → ρ = (ρ0, ρ1,..., ρ m-1 )) to calculate the shares of the floating point vector ( → a, → ρ) whose exponent part has been unified ( → b, → ρ max ) ( → b]] P , → ρ max Q ), where ( → b = (b0, b1,..., b m-1 ), → ρ max = (ρ max , ρ max ,..., ρ max ) (where ρ max = max{ρ0, ρ1,..., ρ m-1}, | → ρ max | = m), satisfying 2 ρ _ i a i ≒2 ρ _ max b i ) (0 ≦ i < m). It includes: a maximum value calculation unit that calculates the share [[ρ → ρ]] Q based on the share max ρ]] Q ; a difference calculation unit that, based on the share → ρ]] Q and the share [[ρ​max Q , calculate the share → ρ dif Q = → ρ]] Q - → ρ max Q , the mantissa calculation unit, according to the share → a]] P and the share → ρ dif Q , for i satisfying 0 ≦ i < m, according to the share → a]] P 's i-th element [[a i P and the share → ρ dif Q converted to the share << → ρ dif >> Q 's i-th element <<ρ dif,i >> Q , calculate the value b i obtained by shifting the value a dif,i by -ρ i bits [[b i P (where b i =2 -ρ_dif,i a i ), and thus calculate the share → b]] P =([[b0]] P ,[[b1]] P ,…,[[b m-1 P ); and the output unit, according to the share → b]] P and the share [[ρ max Q , generate the share ( → b]] P , → ρ max Q ).

[0014] Advantages of the Invention

[0015] According to the present invention, it is possible to efficiently unify the exponent part of floating-point numbers while maintaining anonymity. Brief Description of the Drawings ​​​​​​​​​​

[0016] Figure 1 1 is a block diagram showing the structure of the secret index unit unified system 10.

[0017] Figure 2 It is a unified device 100 representing a secret index unit i Block diagram of the structure.

[0018] Figure 3 1 is a flowchart showing the operation of the secret index unit unified system 10.

[0019] Figure 4 is a block diagram showing the structure of the secret and computing system 20.

[0020] Figure 5 is a secret and computing device 200 i Block diagram of the structure.

[0021] Figure 6 is a flow chart showing the operation of the secret and computing system 20.

[0022] Figure 7 is a block diagram showing the structure of the secret product-sum calculation system 30.

[0023] Figure 8 is a secret product-sum calculation device 300 i Block diagram of the structure.

[0024] Fig. 9 is a flowchart showing the operation of the secret product sum calculation system 30.

[0025] Fig.10 This is a diagram showing an example of a functional configuration of a computer that realizes each device in the embodiment of the present invention. DETAILED DESCRIPTION

[0026] Hereinafter, the embodiments of the present invention will be described in detail. In addition, the same reference numerals are given to components having the same functions, and duplicate descriptions are omitted.

[0027] Before describing each embodiment, the description method in this specification will be described.

[0028] ^ (caret) indicates a superscript. For example, x y^z Represents y z is the superscript for x, y^z Represents y z is a subscript for x. In addition, _ (underscore) indicates a subscript. For example, x y_z Represents y z is the superscript for x, y_z Represents y z is the subscript for x.

[0029] In addition, superscripts such as ^x and ~x of a certain character x should be recorded directly above the "x", but due to the restrictions on recording notations in the specification, they are recorded as ^x and ~x.

[0030] Technical Background

[0031] The secret computing in each embodiment of the present invention is constructed using the existing secret computing protocol. Here, the notation is first explained.

[0032] "Memorization"

[0033] Let P be a prime number. For example, let Mersenne prime number P = 2 61 -1. Let p be the number of bits of prime number P. In addition, it is sometimes expressed as p = |P|. When P is a Mersenne prime, p is a prime number. For example, if P = 2 61 -1, then p = 61. In addition, let Q be the order of the residue class ring. The order Q is used as a prime number P and its number of bits p. In addition, the order Q can be used for the exponent part of the floating point. When the order Q is used for the exponent part of the floating point, for example, Q = 2 13 -1.

[0034] Let k be a threshold value of secret distribution. For example, k=2. Also, let n be a distribution number of secret distribution (ie, the number of parties of secret calculation). For example, n=3.

[0035] [[x]] y = represents the share obtained by performing (k, n)-secret distribution on the mod y element x. As a secret distribution method, for example, Shamir secret distribution or copy secret distribution can be used. In the following, the share obtained by performing (k, n)-copy secret distribution on the mod y element x is denoted by < <x>> y Since (k,n)-copy secret distribution is (k,n)-secret distribution, the protocol that can be applied to the shares after (k,n)-secret distribution can also be applied to the shares after (k,n)-copy secret distribution. In addition, the shares are represented as < <x>> y When , it means that the property of copy secret distribution is used. In addition, in particular, (k, k)-copy secret distribution is called (k, k)-additive secret distribution. In the following, the share obtained by performing (k, k)-additive secret distribution on the mod y element x is denoted by <x> y representation

[0036] [[x]] 2^m represents the shares arranged from m shares in the form of [[x]] 2 In addition, [[x]] is sometimes regarded as the bit representation of a numerical value. 2^m regarded as the bit representation of a numerical value.

[0037] x≒y means that x and y are equal as real numbers on a computer. That is, it means that the difference between x and y is within a certain error range.

[0038] For two numbers a and d, a / d represents the integer division value obtained by truncating the decimal part. Therefore, integer division based on powers of 2 is equivalent to a right shift. In addition, for two numbers a and d, (a / d) Re represents the real division value.

[0039] For a number a, ceiling(a) represents the smallest integer greater than or equal to a.

[0040] (prop) takes the value 1 when the proposition prop holds and 0 when it does not hold. For example, (1>0) is 1.

[0041] Regarding floating-point 2 b a (where a and b represent the mantissa part and the exponent part respectively) is represented as floating-point (a, b). In addition, m floating-point 2s b _ 0 a0, 2 b _ 1 a1, …, 2 b _ m-1 a m-1 (where a i , b i (0≦i<m) represent the mantissa part and the exponent part respectively) are represented as a floating-point vector ( → a, → b) (where → a = (a0, a1, …, a m-1 ), → b = (b0, b1, …, b m-1 ))). Sometimes, the length m of the vector → a = (a0, a1, …, a m-1 ) is represented as | → a|.

[0042] "Existing Secret Computation Protocols"

[0043] First, the existing secret computing protocol used in the present invention is described. Existing protocols are used for addition and subtraction, constant sum, multiplication, constant multiple, logical operation (negation, logical product, logical sum, XOR), data format conversion (integer, binary), and exponential function calculation. In addition, the following protocols are used as existing protocols used in the present invention.

[0044] [Transformation from (k,n)-secret sharing (copy secret sharing) to (k,k)-addition secret sharing]

[0045] Input: Share of value x [[x]] y (The share of value x < <x>> y )

[0046] Output: Share of value x <x> y

[0047] Specifically, there is a method described in Reference Non-Patent Document 2.

[0048] (Reference non-patent document 2: Kikuchi, R., Ikarashi, D., Matsuda, T., Hamada, K. and Chida, K., "Efficient Bit-Decomposition and Modulus-Conversion Protocols withan Honest Majority," 23rd Australasian Conference on Information Security and Privacy (ACISP 2018), Lecture Notes in Computer Science,Vol.10946,Springer,pp.64-82,2018.)

[0049] [Transition from (k,k)-addition secret distribution to (k,n)-secret distribution (copy secret distribution)]

[0050] Input: Share of value x <x> y

[0051] Output: Share of value x [[x]] y (The share of value x < <x>> y )

[0052] Specifically, there is a method described in Reference Non-Patent Document 2.

[0053] [mod 2 → mod q conversion]

[0054] Input: Share of value x [[x]] 2 (The share of value x < <x>> 2 )

[0055] Output: Share of value x [[x]] q (The share of value x < <x>> q )

[0056] Specifically, there is a method described in Reference Non-Patent Document 2.

[0057] [Shift amount discloses right shift]

[0058] Input: Share of value x [[x]] q , the displacement ρ

[0059] Output: The fraction of the value obtained by shifting the value x right by ρ bits [[x / 2 ρ ]] q

[0060] Specifically, there is a method described in Reference Non-Patent Document 3.

[0061] (Refer to non-patent document 3: Sanpin Kibuki, Igarashi Dai, Hamada Hiroki, and Kikuchi Ryo, "Design and implementation of high-precision and high-efficiency secret logistic regression," CSS2018, 2018.)

[0062] [Total shift amount disclosed right shift]

[0063] Input: Share of value x [[x]] q , the shift amount ρ0,…,ρ m-1

[0064] Output: Shift the value x right by ρ0 bits,…,ρ m-1 bits to obtain the value of [[x / 2 ρ _ 0 ]] q ,…,[[x / 2 ρ _ m-1 ]] q

[0065] Specifically, there is a method described in Reference Non-Patent Document 4.

[0066] (Refer to non-patent document 4: Dai Igarashi, "Elementary function groups for secret computation exceeding M op / s," SCIS2020, 2020.)

[0067] In addition, as an obvious method, it is also possible to configure a total shift amount public right shift by repeating the shift amount public right shift.

[0068] [Modulus conversion using quotient shift]

[0069] Input: Share of value x < <x>> q

[0070] Output: Share of value x < <x>> r

[0071] Specifically, there is a method described in Reference Non-Patent Document 2.

[0072] [Bit Decomposition]

[0073] Input: Share of value x [[x]] q

[0074] Parameter: Maximum number of bits of the input value M

[0075] Output: Share of value x [[x]] 2^M

[0076] Specifically, there is a method described in Reference Non-Patent Document 2.

[0077] The Secret Computing Protocol of the Invention

[0078] Next, the secret computing protocol of the present invention is described.

[0079] [Multiplication rotation (shift amount hides left shift)]

[0080] Input: Share of value a [[a]] P , the share of rotation (displacement) ρ (≥0) <<ρ>> p

[0081] Output: The fraction of the value obtained by shifting the value a left by ρ bits [[2 ρ a]] P

[0082] The output share can be calculated by a protocol using multiplication or exponential function calculation, or can be calculated by a method using the idea of ​​random permutation (see Non-Patent Document 5). As a specific example, a case where n=3 is described.

[0083] (Refer to non-patent document 5: Dai Igarashi, Hiroki Hamada, Ryo Kikuchi, and Hiroshi Chida, "Improvement of secret computing radix sorting with the goal of statistical processing of network environment response within 1 second," SCIS 2014, 2014.)

[0084] (First round)

[0085] Step 1: Share [[a]] P Transformed into (k,k)-additive secret distribution with shares of party 0 and party 1 P .

[0086] Step 2: Party 0 and Party 1 pre-share the random number r 01 In addition, Party 1 and Party 2 pre-share the random number r 12 .

[0087] Step 3: Calculate b0=2 (<<ρ>>^p)_01 P 0-r 01 , send b0 to party 2.

[0088] Here, <<ρ>> p 01 Represents the share of party 0 and party 1 <<ρ>> p Maintain a share. In addition, P 0 means square 0 about the share P Maintain share.

[0089] Step 4: Calculate b1=2 using square 1 (<<ρ>>^p)_12 (2 (<<ρ>>^p)_01 P 1+r 01 )-r 12 , send b1 to party 0.

[0090] Here, <<ρ>> p 12 About Share<<ρ>> p Indicates the shares held by Party 1 and Party 2. In addition, P 1 means party 1 about the share P Maintain share.

[0091] (Second round)

[0092] Step 5: Square 0 calculation <c> P 0=2 (<<ρ>>^p) _ 20 b1.

[0093] Here, <<ρ>> p 20 Represents the share of party 2 and party 0 <<ρ>> p Maintain share.

[0094] Step 6: Square 2 Calculation <c> P 2=2 (<<ρ>>^p) _ 20 (2 (<<ρ>>^p) _ 12 b0+r 12 ).

[0095] (Third round)

[0096] Step 7: Share <c> P Convert to (k,n)-secret distributed shares [[c]] P .

[0097] Here, c = 2 ρ a is established.

[0098] [Shift amount hides right shift]

[0099] Input: Share of value a [[a]] P , the share of the shift amount ρ <<ρ>> p

[0100] Parameter: Upper limit value M of the shift amount

[0101] Where 0≤ρ≤M, the value a is set to the value 2 obtained by shifting left by M bits. M a does not overflow.

[0102] Output: The fraction of the value obtained by shifting the value a right by ρ bits [[a / 2 ρ ]] P

[0103] Step 1: Calculate <<M-ρ> > p .

[0104] Step 2: Using the multiplication round, calculate the fraction of the value obtained by shifting the value a left by M-ρ bits [[2 M-ρ a]] P .

[0105] Step 3: Use the shift amount to open the right shift and calculate the value 2 M-ρ The fraction of the value obtained by right shifting a by M bits is [[a / 2 ρ ]] P =[[2 M-ρ a / 2 M ]] P .

[0106] [Shift amount concealment shift (part 1)]

[0107] Input: Share of value a [[a]] P , the share of the shift amount ρ <<ρ>> Q (It is assumed that when ρ ≥ 0, it indicates a left shift, and when ρ < 0, it indicates a right shift)

[0108] Parameter: The upper limit value M of the MSB (Most Significant Bit) position of the input value

[0109] Output: The fraction of value s obtained by shifting value a by ρ bits [[s]] P

[0110] Here, s = 2 ρ a is established.

[0111] Step 1: Using the modulus conversion, calculate the share <<ρ>> p The modulus conversion can utilize, for example, the modulus conversion using the quotient transfer described above.

[0112] Step 2: Calculate [[f L ]] 2 =[[(ρ≥0)]] 2 .

[0113] Step 3: Using the mod 2 → mod p conversion, calculate < <f L >> p .

[0114] Step 4: Calculate <<ρ'>> p =<<ρ>> p +MM< <f L >> p .

[0115] Step 5: Use the multiplication cycle to calculate [[b]] P =[[2 ρ’ a]] P .

[0116] Step 6: Use the shift amount to reveal the right shift and calculate [[c]] P =[[2 ρ’ a / 2 M ]] P .

[0117] Step 7: Using the mod 2 → mod P conversion, calculate [[f L ]] P .

[0118] Step 8: Calculate [[s]] P =[[c]] P +([[b]] P -[[c]] P )[[f L ]] P .

[0119] This formula is a selection gate. When ρ<0, s=c, and when ρ≥0, s=b.

[0120] [Displacement Amount Concealment Displacement (Part 2)]

[0121] Input: Share of value a [[a]] P , the share of the shift amount ρ <<ρ>> Q (It is assumed that when ρ ≥ 0, it indicates a left shift, and when ρ < 0, it indicates a right shift)

[0122] Parameters: The upper limit value M of the MSB position of the input value, the upper limit value M' of the MSB position allowed by the share

[0123] Output: The fraction of value s obtained by shifting value a by ρ bits [[s]] P

[0124] Here, s = 2 ρ a is established.

[0125] Step 1: Calculate u = M'-M+1, d = ceiling (((M-1) / u) Re ).

[0126] Here, u is the right shift amount that can be covered by hiding the right shift once (specifically, the amount in the range of 1 to M'-M bits), and d is the number of times the right shift is performed to hide the shift amount required to perform the right shift in the range of 1 to M-1 bits.

[0127] Step 2: Using the modulus conversion, calculate the share <<ρ>> p The modulus conversion can utilize, for example, the modulus conversion using the quotient transfer described above.

[0128] Step 3: Calculate [[f0]] by comparing the size 2 =[[(ρ≥-M+1)]] 2 ,[[f1]] 2 =[[(ρ≥-M+1+u)]] 2 ,…,[[f d-1 ]] 2 =[[(ρ≥-M+1+(d-1)u)]] 2 ,[[f L ]] 2 =[[(ρ≥0)]] 2

[0129] Here, if f L , then f d-1 If f d-1 , then f d-2 ,… holds. Let f0,f1,…,f have such properties d-1 ,f L It is called a shift mark.

[0130] Step 4: Using the mod 2 → mod p conversion, calculate < <f1> > p ,< <f2>> p ,…,< <f d-1 >> p ,< <f L >> p .

[0131] In this step, you do not need to <f0>> p Calculation.

[0132] Step 5: Calculate <<ρ'>> p =<<ρ>> p +M-1-u(Σ 1≦i<d < <f i >> p )+((d-1)u-M+1)< <f L >> p .

[0133] Step 6: Use the multiplication cycle to calculate [[b]] P =[[2 ρ’ a]] P .

[0134] Step 7: Use the total shift amount to disclose the right shift and calculate [[c0]] P =[[2 ρ’ a / 2 M-1 ]] P ,[[c1]] P =[[2 ρ’ a / (2 M-1-u )]] P ,…,[[c d-1 ]] P =[[2 ρ’ a / (2 M-1-(d-1)u )]] P .

[0135] Step 8: Using the mod 2 → mod P conversion, calculate [[f0]] P ,[[f1]] P ,…,[[f d-1 ]] P ,[[f L ]] P .

[0136] In this step, we need to calculate [[f0]] p .

[0137] Step 9: Calculate [[s]] P =[[c0]] P [[f0]] P +([[c1]] P -[[c0]] P )[[f1]] P +…+([[c d-1 ]] P -[[c d-2 ]] P )[[f d-1 ]] P +([[b]] P -[[c d-1 ]] P )[[f L ]] P .

[0138] This formula is for the shift marks f0,f1,…,f d-1 ,f L The selection gate of f0,f1,…,f d-1 ,f L If all are 0, then s = 0, if f0, then s = c0, if f1, then s = c1, ..., if f L , then s=b.

[0139] [Displacement Amount Concealment Displacement (Part 3)]

[0140] Input: Share of value a [[a]] P , the share of the shift amount ρ <<ρ>> Q (It is assumed that when ρ ≥ 0, it indicates a left shift, and when ρ < 0, it indicates a right shift)

[0141] Parameters: The upper limit value M of the MSB position of the input value, the upper limit value M' of the MSB position allowed by the share

[0142] Output: The fraction of value s obtained by shifting value a by ρ bits [[s]] P

[0143] Here, s = 2 ρ a is established.

[0144] Step 1: Set u to an integer that satisfies u≦M'-M+1. Also, set [R,R'] to the range of the right shift amount covered by the right shift after the division, and set d to satisfy d≥ceiling(((R'-R+1) / u) Re ) is an integer.

[0145] the following,{} L Indicates that when a shift amount greater than -R is not considered (for example, when it is known that it is a right shift), the calculation of the part enclosed by the brackets can be omitted. In addition, {}0 indicates that when a shift amount less than -R' is not considered (for example, when it is known that the right shift amount is greater than the value to which the shift concealment shift (1) can be applied but is not an extremely large value), the calculation of the part enclosed by the brackets can be omitted.

[0146] Step 2: Using the modulus conversion, calculate the share <<ρ>> p The modulus conversion can utilize, for example, the modulus conversion using the quotient transfer described above.

[0147] Step 3: Calculate {[[f0]] by comparing the size 2 =[[(ρ≥-R')]] 2 ,}0[[f1]] 2 =[[(ρ≥-R'+u)]] 2 ,…,[[f d-1 ]] 2 =[[(ρ≥-R'+(d-1)u)]] 2 {,[[f L ]] 2 =[[(ρ≥-R+1)]] 2 } L .

[0148] Here, if f L , then f d-1 If f d-1 , then f d-2 ,… hold. Let f0,f1,…,f have such properties d-1 ,f L It is called a shift mark.

[0149] Step 4: Using the mod 2 → mod p conversion, calculate < <f1> > p ,< <f2>> p ,…,< <f d-1 >> p {,< <f L >> p } L

[0150] Step 5: Calculate <<ρ'>> p =<<ρ>> p +R'-u(Σ 1≦i<d < <f i >> p ){+((d-1)u-R')< <f L >> p } L .

[0151] Step 6: Use the multiplication cycle to calculate [[b]] P =[[2 ρ’ a]] P .

[0152] Step 7: Use the total shift amount to disclose the right shift and calculate {[[c0]] P =[[2 ρ’ a / 2 R’ ]] P ,}0[[c1]] P =[[2 ρ’ a / (2 R’-u )]] P ,…,[[c d-1 ]] P =[[2 ρ’ a / (2 R’-(d-1)u )]] P .

[0153] Step 8: Using the mod 2→mod P conversion, calculate {[[f0]] P ,}0[[f1]] P ,…,[[f d-1 ]] P {,[[f L ]] P } L .

[0154] Step 9: Calculate [[s]] P ={[[c0]] P [[f0]] P +(}0[[c1]] P {-[[c0]] P )}0[[f1]] P +…+([[c d-1 ]] P -[[- d-2 P )- d-1 P {+([[- P -[[- d-1 P )- L P} L 。

[0155] This formula is the selection gate for shift flags f0, f1, …, f d-1 , f L . If f0, f1, …, f d-1 , f L are all 0, then s = 0. If f0, then s = c0. If f1, then s = c1, … If f L , then s = b.

[0156] In addition, if R = 1, R’ = M - 1, u = M’ - M + 1, d = ceiling(((R’ - R + 1) / u) Re ), then the shift amount hiding shift (its 3) becomes the shift amount hiding shift (its 2). Thus, the shift amount hiding shift (its 3) is a protocol that generalizes the shift amount hiding shift (its 2).

[0157] [Maximum value calculation]

[0158] Input: Shares of vector → a → a]] Q (where → a = (a0, a1, …, a m-1 ), a i (0 ≦ i < m) are integers represented in bits)

[0159] Parameter: The maximum number of bits M of the input value

[0160] Output: The share of the maximum value a max [[a max Q (where a max = max{a0, a1, …, a m-1})

[0161] Step 1: Calculate the share of a i (0 ≦ i < m) that is the OR of the leftmost bits a i,M-1 (0 ≦ i < m) of a max,M-1 [[a max,M-1 Q (where a max,M-1 = a​​​​​​ 0,M-1 OR a 1,M-1 OR…OR a m-1,M-1 )。

[0162] Step 2: For 0 ≦ i < m, calculate [[e i,M-1 Q =[[a i,M-1 XOR a max,M-1 Q 。

[0163] Step 3: for j = M - 2 to 0 do

[0164] Step 3-1: For 0 ≦ i < m, calculate [[b i,j Q =[[a i,j ∧e i,j+1 Q 。

[0165] Step 3-2: Calculate the share [[a i,j (0 ≦ i < m) of a as the OR of [[b max,j [[a max,j Q (where [[a max,j =b 0, j OR b 1,j OR…OR b m-1,j )

[0166] Step 3-3: For 0 ≦ i < m, calculate [[e’ i,j Q =[[e i,j+1 ∧￢a max,j Q

[0167] Step 3-4: For 0 ≦ i < m, calculate [[e i,j Q =[[b i,j XOR e’ i,j Q 。

[0168] Step 4: Generate [[a max =a max,M-1 a max,M …a max,0 (a max,M-1 a max,M …a max,0 is the bit representation with [[a max,j set to the bit at the j-th position from the right).

[0169] ​​​​​​​​​In addition, when this protocol is executed after the above bit decomposition, it is sufficient to set Q = 2.

[0170] [Exponent part unification of floating-point vectors]

[0171] Input: Shares of a floating-point vector ( → a, → ρ) ( → a]] P , → ρ]] Q )(where → a = (a0, a1,..., a m-1 ), → ρ = (ρ0, ρ1,..., ρ m-1 ))

[0172] Output: Shares of a floating-point vector ( → a, → ρ) with the exponent part unified ( → b, → ρ max )( → b]] P , → ρ max Q )(where → b = (b0, b1,..., b m-1 ), → ρ max = (ρ max , ρ max ,..., ρ max )(where ρ max = max{ρ0, ρ1,..., ρ m-1}, | → ρ max | = m))

[0173] Here, 2 ρ _ i a i ≒ 2 ρ _ max b i (0 ≤ i < m) holds.

[0174] Step 1: Using the maximum value calculation, obtain [[ρ → ρ]] Q according to max Q .

[0175] Step 2: Calculate → ρ dif ​​]] Q =[[ → ρ]] Q -[[ → ρ max ]] Q .

[0176] Step 3: Use the shift amount to conceal the shift (Part 2) or the shift amount to conceal the shift (Part 3), according to the share [[ → a]] P The i-th element [[a i ]] P and share → ρ dif ]] Q Convert to a share of the replication secret << → ρ dif >> Q The i-th element of dif,i >> Q , calculate the value a i Displacement-ρ dif,i The value b obtained by bit i The share of i ]] P (Among them, b i =2 -ρ _ dif, i a i ), from which the share [[ → b]] P =([[b0]] P ,[[b1]] P ,…,[[b m-1 ]] P ).

[0177] Step 4: Generate shares ([[ → b]] P ,[[ → ρ max ]] Q ).

[0178] [Floating point vector sum]

[0179] Input: floating point vector ( → a, → ρ)'s share ([[ → a]] P ,[[ → ρ]] Q )(in, → a=(a0,a1,…,a m-1 ), → ρ=(ρ0,ρ1,…,ρ m-1 ))

[0180] Parameter: vector length m

[0181] Output: As a floating point vector ( → a, → The floating point sum of the elements of ρ) is the share of the floating point (b,σ) ([[b]] P ,[[σ]] Q )

[0182] Here, Σ 0≦i<m 2 ρ _ i a i ≒2 σ b is established.

[0183] Step 1: Use the exponential part of the floating point vector to unify and calculate the unified share ([[ → a]] P ,[[ → ρ]] Q )'s index part ([[ → a']] P ,[[ → ρ max ]] Q )(in, → a'=(a'0,a'1,…,a' m-1 ), → ρ max =(ρ max ,ρ max ,…,ρ max )(where ρ max =max{ρ0,ρ1,…,ρ m-1 },| → ρ max |=m), satisfying 2 ρ _ i a i ≒2 ρ _ max a' i (0≦i <m))。

[0184] Step 2: Calculate the share ([[b]] P ,[[σ]] Q )(where b = Σ 0≦i<m a' i ,σ=ρ max ).

[0185] [Floating point vector product sum]

[0186] Input: floating point vector ( → a, → ρ)'s share ([[ → a]] P ,[[ → ρ]] Q )(in, → a=(a0,a1,…,a m-1 ), → ρ=(ρ0,ρ1,…,ρ m-1 )), floating point vector( → b, → σ)'s share ([[ → b]] P ,[[ → σ]] Q )(in, → b=(b0,b1,…,b m-1 ), → σ=(σ0,σ1,…,σ m-1 ))

[0187] Parameter: vector length m

[0188] Output: As a floating point vector ( → a, → ρ) elements as floating-point vectors ( → b, → The sum of the floating-point products of the elements of σ) is the fraction of the floating-point (c,τ) ([[c]] P ,[[τ]] Q )

[0189] Here, Σ 0≦i<m 2 ρ _ i+σ _ i a i b i ≒2 τ c is established.

[0190] Step 1: Use the exponential part of the floating point vector to unify and calculate the unified share ([[ → a]] P ,[[ → ρ]] Q )'s index part ([[ → a']] P ,[[ → ρ max ]] Q )(in, → a'=(a'0,a'1,…,a' m-1 ), → ρ max =(ρ max ,ρ max ,…,ρ max )(where ρ max =max{ρ0,ρ1,…,ρ m-1},| → ρ max |=m), satisfying 2 ρ _ i a i ≒2 ρ _ max a’ i (0≦i<m)), calculate the exponent part shares ( → b]] P , → σ]] Q ) of the elements with unified shares ( → b’]] P , → σ max Q )(where → b’=(b’0,b’1,…,b’ m-1 ), → σ max =(σ max ,σ max ,…,σ max )(where σ max =max{σ0,σ1,…,σ m-1},| → σ max |=m), satisfying 2 σ _ i b i ≒2 σ _ max b’ i )(0≦i<m)).

[0191] Step 2: Calculate the shares ([[c]] P ,[[τ]] Q )(where c=Σ 0≦i<m a’ i b’ i ,τ=ρ max +σ max ).

[0192] <First Embodiment>

[0193] Next, refer to​ < / f1> < / f1> < / c> < / c> < / c> Figure 1 to Figure 3 The secret index department unified system 10 is described. Figure 1 1 is a block diagram showing the structure of the secret exponent unit unification system 10. The secret exponent unit unification system 10 includes W (W is a predetermined integer greater than or equal to 3) secret exponent unit unification devices 1001, ..., 100 W . Secret index unit unifying device 1001, ..., 100 W The two devices are connected to the network 800 and can communicate with each other. The network 800 may be, for example, a communication network such as the Internet or a broadcast channel. Figure 2 It is a unified device 100 representing a secret index unit i Block diagram of the structure of (1≤i≤W). Figure 3 1 is a flowchart showing the operation of the secret index unit unified system 10.

[0194] like Figure 2 As shown, the secret index unit unifying device 100 i A maximum value calculation unit 110 is included i , difference calculation unit 120 i , the fraction calculation unit 130 i , output unit 140 i and recording unit 190 i . Except for the recording unit 190 i Other secret index department unified device 100 i Each structural unit is configured to be able to perform operations required for secret computing, that is, operations required to implement the functions of each structural unit in the protocol described in <Technical Background>. In the present invention, the specific functional structure for implementing each operation is sufficient to be a structure that can execute the algorithms disclosed in reference non-patent documents 1 to 5, which are existing structures, so detailed descriptions are omitted. In addition, the recording unit 190 i It is a unified device 100 for recording secret index i The structure part of the information required for processing.

[0195] Unify the device 100 through W secret indexes i The secret exponent unified system 10 realizes the secret exponent unified calculation of floating point vectors as a multi-party protocol. Thus, the maximum value calculation unit 110 (not shown) of the secret exponent unified system 10 is composed of maximum value calculation units 1101, ..., 100 W The difference calculation unit 120 (not shown) is composed of difference calculation units 1201, ..., 120 W The mantissa calculation unit 130 (not shown) is composed of mantissa calculation units 1301, ..., 130 W The output unit 140 (not shown) is composed of output parts 1401, ..., 140 W Composition

[0196] Let \(P\) be a prime number and \(Q\) be the order of the residue class ring. The secret exponent part unification system 10 calculates, according to the shares \(([a],[\rho])\) of the floating-point vector \((a,\rho)\) (where \(a=(a_0,a_1,\cdots,a)\), \(\rho = (\rho_0,\rho_1,\cdots,\rho)\)), the shares \(([b],[\rho])\) of the floating-point vector \((b,\rho)\) that unifies the exponent part of the floating-point vector \((a,\rho)\) (where \(b=(b_0,b_1,\cdots,b)\), \(\rho=( \rho,\rho,\cdots,\rho)\) and \(\rho=\max\{\rho_0,\rho_1,\cdots,\rho\}\), \(|\rho| = m\)), satisfying \(2^a\approx2^b\) (\(0\leq i < m\)). Hereinafter, the operation of the secret exponent part unification system 10 will be described. → a, → ρ) → a]] P , → ρ]] Q )(where → a=(a0,a1,…,a m-1 ), → ρ=(ρ0,ρ1,…,ρ m-1 )) and calculates the shares → a, → ρ) → b, → ρ max ) (where → b=(b0,b1,…,b P ), → ρ max =(ρ Q )(where ρ → b=(b0,b1,…,b m-1 ), → ρ max =(ρ max ,ρ max ,…,ρ max )(where ρ max =max{ρ0,ρ1,…,ρ m-1},| → ρ max |=m), satisfying 2 ρ _ i a i ≒2 ρ _ max b i (0≦i<m)). Hereinafter, the operation of the secret exponent part unification system 10 will be described. Figure 3 The operation of the secret exponent part unification system 10 will be described.

[0197] In S110, the maximum value calculation unit 110 calculates, according to the share \([\rho]\), the share \([\rho]\). The maximum value calculation unit 110 may be configured to be able to perform the maximum value calculation, for example. → ρ]] Q , calculates the share [[ρ max Q . The maximum value calculation unit 110 may be configured to be able to perform the maximum value calculation, for example.

[0198] In S120, the difference calculation unit 120 calculates, according to the share → ρ]]​ Q and the share [[ρ max Q , calculate the share → ρ dif Q = → ρ]] Q - → ρ max Q .

[0199] In S130, the mantissa calculation unit 130, based on the share → a P and the share → ρ dif Q , for i satisfying 0 ≦ i < m, based on the i-th element [[a → a P i and the i-th element <<ρ P >> → ρ dif Q converted to the share of the replicated secret sharing << → ρ dif >> Q , calculate the share dif,i b Q of the value obtained by shifting the value a i by -ρ dif,i bits (where b i = 2 i a P ), and thus calculate the share i b -ρ_dif,i = ( i b0 → b P = ([[b0 P , [[b1 P , …, [[b m-1 P ). The mantissa calculation unit 130 may be configured, for example, to be able to perform shift amount hidden shift (the second one) or shift amount hidden shift (the third one).

[0200] In S140, the output unit 140, based on the share → b P calculated in S130 and the share [[ρ max Q , generates the share ( → b P ,[[ → ρ max ]] Q ).

[0201] According to the embodiment of the present invention, it is possible to efficiently unify floating point exponent parts while maintaining confidentiality.

[0202] <Second embodiment>

[0203] Below, refer to Figures 4 to 6 The secret and computing system 20 is described. Figure 4 2 is a block diagram showing the structure of the secret and computing system 20. The secret and computing system 20 includes W (W is a predetermined integer greater than 3) secret and computing devices 2001, ..., 200 W . Secret and computing device 2001, ..., 200 W The two devices are connected to the network 800 and can communicate with each other. The network 800 may be, for example, a communication network such as the Internet or a broadcast channel. Figure 5 is a secret and computing device 200 i Block diagram of the structure of (1≤i≤W). Figure 6 is a flow chart showing the operation of the secret and computing system 20.

[0204] like Figure 5 As shown, the secret and computing device 200 i Including Index Department Unification Department 210 i , and calculation unit 220 i and Recording Department 290 i . Except for the recording unit 290 i Other than secret and computing devices 200 i Each structural unit is configured to be able to perform operations required for secret computing, that is, operations required to implement the functions of each structural unit in the protocol described in <Technical Background>. In the present invention, the specific functional structure for implementing each operation is sufficient to be a structure that can execute the algorithms disclosed in reference non-patent documents 1 to 5, which are existing structures, so detailed descriptions are omitted. In addition, the recording unit 290 i Is a recording secret and computing device 200 i The structure part of the information required for processing.

[0205] By W secrets and computing device 200 i The secret and calculation system 20 implements the secret calculation of floating point vector sum as a multi-party protocol. Thus, the exponent unification unit 210 (not shown) of the secret and calculation system 20 is composed of exponent unification units 2101, ..., 210 W The sum calculation unit 220 (not shown) is composed of the sum calculation units 2201, ..., 220 W constitute.

[0206] Let P be a prime number, let Q be the order of the residue class ring, the secret and calculation system 20 is based on the floating point vector ( → a, → ρ)'s share ([[ → a]] P ,[[ → ρ]] Q )(in, → a=(a0,a1,…,a m-1 ), → ρ=(ρ0,ρ1,…,ρ m-1 )), computed as a floating-point vector ( → a, → The floating point sum of the elements of ρ) is the share of the floating point (b,σ) ([[b]] P ,[[σ]] Q )(where Σ 0≦i<m 2 ρ _ i a i ≒2 σ b) Below, according to Figure 6 The operation of the secret and computing system 20 is described.

[0207] In S210, the index unit 210 calculates the index of the index according to the share ([[ → a]] P ,[[ → ρ]] Q ), computing the unified floating-point vector ( → a, → ρ) floating-point exponent of the floating-point vector ( → a', → ρ max )'s share ([[ → a']] P ,[[ → ρ max ]] Q )(in, → a'=(a'0,a'1,…,a' m-1 ), → ρ max =(ρ max ,ρ max ,…,ρ max )(where ρ max =max{ρ0,ρ1,…,ρ m-1 },| → ρ max | = m), satisfying 2 ρ _ i a i ≈ 2 ρ _ max a’ i (0 ≤ i < m)) The exponent part unification unit 210 can be constituted by using, for example, each unit included in the secret exponent part unification system 10 (that is, the maximum value calculation unit 110, the difference calculation unit 120, the mantissa part calculation unit 130, the output unit 140). In this case, the secret sum calculation device 200 i 's exponent part unification unit 210 i is configured to include the maximum value calculation unit 110 i , the difference calculation unit 120 i , the mantissa part calculation unit 130 i , the output unit 140 i .

[0208] In S220, the sum calculation unit 220 calculates the share ( → a’]] P , → ρ max ) calculated in S210 to calculate the share ([[b]] Q , [[σ]] P ), [[σ]] Q )(where b = Σ 0≦i<m a’ i , σ = ρ max ).

[0209] According to the embodiment of the present invention, by using the secret calculation that efficiently unifies the exponent part of the floating point, the sum of the floating points can be efficiently calculated.

[0210] <Third Embodiment>

[0211] Hereinafter, the secret product-sum calculation system 30 will be described with reference to Figure 7 to Figure 9 is a block diagram showing the structure of the secret product-sum calculation system 30. The secret product-sum calculation system 30 includes W (W is a prescribed integer of 3 or more) secret product-sum calculation devices 3001,..., 300 Figure 7 . The secret product-sum calculation devices 3001,..., 300 W are connected to the network 800 and can communicate with each other. The network 800 can be, for example, a communication network such as the Internet or a broadcast channel. W is a block diagram showing the structure of the secret product-sum calculation device 300 Figure 8 (1 ≤ i ≤ W). i Fig. 9 ​is a flowchart showing the operation of the secret product sum calculation system 30.

[0212] like Figure 8 As shown, the secret product-sum calculation device 300 i Including Index Department Unification Department 310 i , product-sum calculation unit 320 i and Recording Department 390 i . Except for the recording unit 390 i The secret product sum calculation device 300 other than i Each structural unit is configured to be able to perform operations required for secret computing, that is, operations required to implement the functions of each structural unit in the protocol described in <Technical Background>. In the present invention, the specific functional structure for implementing each operation is sufficient to be a structure that can execute the algorithms disclosed in reference non-patent documents 1 to 5, which are existing structures, so detailed descriptions are omitted. In addition, the recording unit 390 i is a recording secret product and calculation device 300 i The structure part of the information required for processing.

[0213] By W secret product-sum computing devices 300 i The secret product-sum calculation system 30 implements the secret calculation of floating-point vector product sum as a multi-party protocol. Thus, the exponent unification unit 310 (not shown) of the secret product-sum calculation system 30 is composed of exponent unification units 3101, ..., 310 W The product-sum calculation unit 320 (not shown) is composed of product-sum calculation units 3201, ..., 320 W constitute.

[0214] Let P be a prime number, let Q be the order of the residue class ring, the secret product and sum calculation system 30 is based on the floating point vector ( → a, → ρ)'s share ([[ → a]] P ,[[ → ρ]] Q )(in, → a=(a0,a1,…,a m-1 ), → ρ=(ρ0,ρ1,…,ρ m-1 )) and floating point vectors ( → b, → σ)'s share ([[ → b]] P ,[[ → σ]] Q )(in, → b=(b0,b1,…,b m-1 ), → σ=(σ0,σ1,…,σ m-1 )), computed as a floating-point vector ( → a, → ρ) elements as floating-point vectors ( → b, → The sum of the floating-point products of the elements of σ) is the fraction of the floating-point (c,τ) ([[c]] P ,[[τ]] Q )(where Σ 0≦i<m 2 ρ _ i+σ _ i a i b i ≒2 τ c) Below, according to Fig. 9 The operation of the secret product-sum calculation system 30 will be described.

[0215] In S310, the index unit 310 calculates the index of the index according to the share ([[ → a]] P ,[[ → ρ]] Q ) and share ([[ → b]] P ,[[ → σ]] Q ), computing the unified floating-point vector ( → a, → ρ) floating-point exponent of the floating-point vector ( → a', → ρ max )'s share ([[ → a']] P ,[[ → ρ max ]] Q )(in, → a'=(a'0,a'1,…,a' m-1 ), → ρ max =(ρ max ,ρ max ,…,ρ max )(where ρ max =max{ρ0,ρ1,…,ρ m-1 },| → ρ max |=m), satisfying 2 ρ _ i a i ≒2 ρ _ max a’ i (0 ≦ i < m)) and unified the floating-point vector of → b, → σ) of the exponent part of the floating-point number → b’, → σ max ) share ( → b’]] P , → σ max Q )(where → b’ = (b’0, b’1, …, b’ m-1 ), → σ max = (σ max , σ max , …, σ max )(where σ max = max{σ0, σ1, …, σ m-1}, | → σ max | = m), satisfying 2 σ _ i b i ≒2 σ _ max b’ i (0 ≦ i < m)). The exponent part unification unit 310 can be constituted by using, for example, each unit included in the secret exponent part unification system 10 (that is, the maximum value calculation unit 110, the difference calculation unit 120, the mantissa part calculation unit 130, and the output unit 140). In this case, the secret sum calculation device 300 i 's exponent part unification unit 310 i is configured to include the maximum value calculation unit 110 i , the difference calculation unit 120 i , the mantissa part calculation unit 130 i , and the output unit 140 i .

[0216] In S320, the product-sum calculation unit 320 calculates the share ( → a’]] P , → ρ max Q ) and the share ( → b’]] P , → σ max Q ) to calculate the share ([[c]] P ​​​,[[τ]] Q )(where c = Σ 0≦i<m a' i b' i ,τ=ρ max +σ max ).

[0217] According to the embodiment of the present invention, by utilizing the secret calculation of the exponent part of the floating point to efficiently unify the floating point, it is possible to efficiently calculate the floating point product sum.

[0218] <Supplementary Note>

[0219] Fig.10 The processing in each of the above-mentioned devices can be implemented by causing the recording unit 2020 to read a program for causing the computer to function as each of the above-mentioned devices and causing the control unit 2010, the input unit 2030, the output unit 2040, etc. to operate.

[0220] The device of the present invention, for example, as a separate hardware entity, has an input unit that can be connected to a keyboard, an output unit that can be connected to a liquid crystal display, a communication unit that can be connected to a communication device (such as a communication cable) that can communicate with the outside of the hardware entity, a CPU (Central Processing Unit, which can also have a cache memory, registers, etc.), RAM and ROM as memories, an external storage device as a hard disk, and a bus connected in a manner that can exchange data between the above-mentioned input unit, output unit, communication unit, CPU, RAM, ROM, and external storage device. In addition, as needed, a device (drive) that can read and write recording media such as CD-ROMs, etc., can also be set in the hardware entity. As a physical entity with such hardware resources, there is a general-purpose computer, etc.

[0221] The external storage device of the hardware entity stores the programs required to realize the above functions and the data required in the processing of the programs, etc. (not limited to the external storage device, for example, the programs can also be read in advance and stored in the ROM as a dedicated storage device). In addition, the data obtained by the processing of these programs is appropriately stored in the RAM, external storage device, etc.

[0222] In the hardware entity, each program stored in an external storage device (or ROM, etc.) and the data required for processing the program are read into the memory as needed, and the CPU interprets and executes / processes them appropriately. As a result, the CPU realizes the specified functions (represented as the various structural parts such as the above-mentioned, ... parts, ... units, etc.).

[0223] The present invention is not limited to the above-mentioned embodiments and can be appropriately changed within the scope of the present invention. In addition, the processing described in the above-mentioned embodiments is not only performed sequentially according to the recorded order, but can also be performed in parallel or individually according to the processing capacity or needs of the device executing the processing.

[0224] As described above, when the processing functions in the hardware entity (device of the present invention) described in the above embodiment are implemented by a computer, the functional processing content that the hardware entity should have is described by a program. Then, by executing the program on a computer, the processing functions in the above hardware entity are implemented on the computer.

[0225] The program describing the processing content can be recorded in advance in a computer-readable recording medium. As a computer-readable recording medium, it can also be a device such as a magnetic recording device, an optical disk, an optical magneto-optical recording medium, a semiconductor memory, etc. Specifically, for example, as a magnetic recording device, a hard disk device, a floppy disk, a magnetic tape, etc. can be used, as an optical disk, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only Memory), a CD-R (Recordable) / RW (ReWritable), etc. can be used, as an optical magneto-optical recording medium, an MO (Magneto-Optical Disc) can be used, and as a semiconductor memory, an EEP-ROM (Electronically Erasable and Programmable-Read Only Memory) can be used.

[0226] In addition, the program can be circulated by, for example, selling, transferring, leasing, etc. a removable recording medium such as a DVD or CD-ROM recording the program. Furthermore, the program can be circulated by storing the program in advance in a storage device of a server computer and forwarding the program from the server computer to other computers via a network.

[0227] The computer executing such a program, for example, first temporarily stores the program recorded in a removable recording medium or the program forwarded from a server computer in its own storage device. Then, when executing the process, the computer reads the program stored in its own storage device and executes the process based on the read program. In addition, as another execution method of the program, it can also be set that the computer directly reads the program from the removable recording medium and executes the process based on the program, and further, it can also be set that each time the program is forwarded from the server computer to the computer, the process based on the received program is executed in sequence. In addition, it can also be configured that the program is not forwarded from the server computer to the computer, but the so-called ASP ((Application Service Provider)) type service that realizes the processing function only according to the execution instruction and the result acquisition is used to execute the above-mentioned process. In addition, the program in this method contains information for the processing performed by the electronic computer, that is, information according to the program (although it is not a direct instruction to the computer, it has data of the nature of the processing of the computer, etc.).

[0228] In this embodiment, a hardware entity is formed by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0229] The above-mentioned description of the embodiments of the present invention is provided for the purpose of illustration and description. There is no intention to be exhaustive, nor is there any intention to limit the invention to the strict form disclosed. Deformations and changes can be made according to the above teachings. The embodiments are intended to provide the best illustration of the principles of the present invention, and are the ways selected and expressed by technicians in this field in various embodiments or with various modifications to suit the practical use of considerations. All such modifications and changes are within the scope of the present invention as determined by the attached claims, which are interpreted in accordance with the scope given by fairness, legality and equity.< / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x> < / x>

Claims

1. A unified system of secret index departments, Let P be a prime number, let Q be the order of the residue class ring, It is composed of 3 or more secret exponent unification devices, according to the floating point vector ( → a, → ρ)'s share ([[ → a]] P ,[[ → ρ]] Q ), computing the unified floating-point vector ( → a, → ρ) is a floating-point vector ( → b, → ρ max )'s share ([[ → b]] P ,[[ → ρ max ]] Q ), where < sup>→a=(a0,a1,…,a m-1 ), → ρ=(ρ0,ρ1,…,ρ m-1 ), among them, → b=(b0,b1,…,b m-1 ), → r max =(ρ max ,r max ,…,r max ), among them, ρ max = max{ρ0, ρ1, …, ρ m-1}, | → ρ max | = m, satisfying 2 ρ _ i a i ≈ 2 ρ _ max b i , where 0 ≤ i < m, The secret index department unified system includes: Maximum calculation unit, according to the share [[ → ρ]] Q , calculate the share [[ρ max ]] Q ; Differential calculation unit, according to the share [[ → ρ]] Q and share [[ρ max ]] Q , calculate the share [[ → r dif ]] Q =[[ → p]] Q -[[ → r max ]] Q ; Mantissa calculation unit, according to the share → a]] P and the share → ρ dif Q , for i satisfying 0 ≤ i < m, according to the share → a]] P 's i-th element [[a i P and the share → ρ dif Q converted to the share << → ρ dif >> Q 's i-th element <<ρ dif,i >> Q , calculate the share i of the value b dif,i obtained by shifting the value a i by -ρ i bits [[b P , and thus calculate the share → b]] P = ([[b0]] P , [[b1]] P , …, [[b m-1 P ), where b i = 2 -ρ _ dif,i a i ; and​​​​ Output unit, according to the share [[ → b]] P and share [[ρ max ]] Q , generating shares ([[ → b]] P , [[ → r max ]] Q )。 2. A secret index unit unifying device, which is a secret index unit unifying device in a secret index unit unifying system composed of three or more secret index unit unifying devices, Let P be a prime number, let Q be the order of the residue class ring, According to the floating point vector ( → a, → ρ)'s share ([[ → a]] P ,[[ → ρ]] Q ), computing the unified floating-point vector ( → a, → ρ) is a floating-point vector ( → b, → ρ max )'s share ([[ → b]] P ,[[ → ρ max ]] Q ), where < sup>→a=(a0,a1,…,a m-1 ), → ρ=(ρ0,ρ1,…,ρ m-1 ), among them, → b=(b0,b1,…,b m-1 ), → ρ max =(ρ max ,ρ max ,…,ρ max ), where ρ max =max{ρ0,ρ1,…,ρ m-1}, | → ρ max | = m, satisfying 2 ρ _ i a i ≈2 ρ _ max b i , where 0 ≤ i < m, The secret index unit unifying device comprises: The maximum value calculation part, based on the share [[ → ρ]] Q , calculate the share [[ρ max ]] Q ; The difference calculation part, based on the share [[ → ρ]] Q and share [[ρ max ]] Q , calculate the share[[ → ρ dif ]] Q =[[ → ρ]] Q -[[ → ρ max ]] Q ; Mantissa calculation unit, based on the share → a]] P and the share → ρ dif Q , for i satisfying 0 ≤ i < m, based on the share → a]] P of the i-th element [[a i P and the share → ρ dif Q converted to the share << → ρ dif >> Q of the i-th element <<ρ dif,i >> Q , calculate the share i of the value b dif,i obtained by shifting the value a i by -ρ i bits [[b P , and thereby calculate the share → b]] P = ([[b0]] P , [[b1]] P , …, [[b m-1 P ), where b i = 2 -ρ_dif,i a i ; and​​​​ Output, according to the share [[ → b]] P and share [[ρ max ]] Q , generating shares ([[ → b]] P ,[[ → ρ max ]] Q ).

3. A method for unifying secret indexes, Let P be a prime number, let Q be the order of the residue class ring, The secret exponent unification system composed of more than three secret exponent unification devices is based on the floating point vector ( → a, → ρ)'s share ([[ → a]] P ,[[ → ρ]] Q ), computing the unified floating-point vector ( → a, → ρ) is a floating-point vector ( → b, → ρ max )'s share ([[ → b]] P ,[[ → ρ max ]] Q ), where < sup>→a=(a0,a1,…,a m-1 ), → ρ=(ρ0,ρ1,…,ρ m-1 ), where, → b=(b0,b1,…,b m-1 ), → ρ max =(ρ max ,ρ max ,…,ρ max ), where, ρ max =max{ρ0,ρ1,…,ρ m-1}, | → ρ max | = m, satisfying 2 ρ _ i a i ≒2 ρ _ max b i , where, 0 ≤ i < m, The secret index unit unification method comprises: The maximum value calculation step, the secret index unit unifies the system according to the share [[ → ρ]] Q , calculate the share [[ρ max ]] Q ; The difference calculation step, the secret index unit unified system according to the share [[ → ρ]] Q and share [[ρ max ]] Q Calculate share[[ → ρ dif ]] Q =[[ → ρ]] Q -[[ → ρ max ]] Q ; Mantissa part calculation steps, where the secret exponent part unified system is based on the share → a]] P and the share → ρ dif Q , for i satisfying 0 ≤ i < m, according to the i-th element [[a → a]] P of [[a i P and the share → ρ dif Q converted to the share << → ρ dif >> Q of the i-th element <<ρ dif,i >> Q , calculate the share [[b i of the value b dif,i obtained by shifting the value a i by -ρ i bits [[b P , and thus calculate the share → b]] P = ([[b0]] P , [[b1]] P , …, [[b m-1 P ), where b i = 2 -ρ _ dif,i a i ; and​​​​ Output step, the secret index unit unifies the system according to the share [[ → b]] P and share [[ρ max ]] Q , generating shares ([[ → b]] P ,[[ → ρ max ]] Q ).

4. A system of secrets and calculations, Let P be a prime number, let Q be the order of the residue class ring, It is composed of more than 3 secret and computing devices, according to the floating point vector ( → a, → ρ)'s share ([[ → a]] P ,[[ → ρ]] Q ), computed as a floating-point vector ( → a, → The floating point sum of the elements of ρ) is the share of the floating point (b,σ) ([[b]] P ,[[σ]] Q ),in, → a=(a0,a1,…,a m-1 ), → ρ=(ρ0,ρ1,…,ρ m-1 ), among which, meet the S 0≤i<m 2 ρ _ i a i ≒2 σ b, The secret and calculation system includes: Exponent part unification unit, according to the share ( → a]] P , → ρ]] Q ), calculates the floating-point vector ( → a, → ρ) whose floating-point exponent part is unified, and calculates the share ( → a’, → ρ max ) of the floating-point vector ( → a’]] P , → ρ max Q ), where, → a’ = (a’0, a’1, …, a’ m-1 ), → ρ max = (ρ max , ρ max , …, ρ max ), where, ρ max = max{ρ0, ρ1, …, ρ m-1}, | → ρ max | = m, satisfying 2 ρ _ i a i ≒2 ρ _ max a’ i , where, 0 ≤ i < m; and​ and calculation units, according to the share ([[ → a']] P ,[[ → ρ max ]] Q ), calculate the share ([[b]] P ,[[σ]] Q ), where b = Σ 0≤i<m a' i ,σ=ρ max , The exponent unification unit is constructed by using the units included in the secret exponent unification system according to claim 1.

5. A secret product-sum calculation system, Let P be a prime number, let Q be the order of the residue class ring, It is composed of more than 3 secret product and calculation devices, according to the floating point vector ( → a, → ρ)'s share ([[ → a]] P ,[[ → ρ]] Q ) and floating-point vectors ( → b, → σ)'s share ([[ → b]] P ,[[ → σ]] Q ), computed as a floating-point vector ( → a, → ρ) elements as floating-point vectors ( → b, → The sum of the floating-point products of the elements of σ) is the fraction of the floating-point (c,τ) ([[c]] P ,[[τ]] Q ),in, → a=(a0,a1,…,a m-1 ), → ρ=(ρ0,ρ1,…,ρ m-1 ), among them, → b=(b0,b1,…,b m-1 ), → σ=(σ0,σ1,…,σ m-1 ), among which, meet the S 0≤i<m 2 ρ _ i+σ _ i a i b i ≒2 τ c, The secret product-sum calculation system comprises: Exponent part unification unit, according to the share ( → a]] P , → ρ]] Q ) and the share ( → b]] P , → σ]] Q ), calculates the share ( → a, → ρ) of the floating-point vector ( → a’, → ρ max ) that unifies the exponent part of the floating-point vector and the share ( → a’]] P , → ρ max Q ) and the share ( → b, → σ) of the floating-point vector ( → b’, → σ max ) that unifies the exponent part of the floating-point vector, where, → b’]] P , → σ max Q ), where, → a’ = (a’0, a’1, …, a’ m-1 ), → ρ max = (ρ max , ρ max , …, ρ max ), where, ρ max = max{ρ0, ρ1, …, ρ m-1}, | → ρ max | = m, satisfying 2 ρ _ i a i ≒2 ρ _ max a’ i , where, 0 ≦ i < m, where, → b’ = (b’0, b’1, …, b’ m-1 ), → σ max = (σ max , σ max , …, σ max ), where, σ max = max{σ0, σ1, …, σ m-1 ​​},| → σ max |=m, satisfying 2 σ _ i b i ≒ 2 σ _ max b’ i , where 0 ≤ i < m; and Product and sum calculation unit, according to the share ([[ → a']] P ,[[ → ρ max ]] Q ) and share ([[ → b']] P , [[ → s max ]] Q ) calculate share([[c]] P ,[[τ]] Q ), among which, c=S 0≤i<m a' i b' i ,t=r max +s max , The exponent unification unit is constructed by using the units included in the secret exponent unification system according to claim 1.

6. A computer-readable recording medium storing a program for causing a computer to function as the secret index unit unifying device according to claim 2.

Images