Secret relational algebra operation system, secret computing device, secret relational algebra operation method and program

Abstract

The secret computation unit (1) included in the secret relational algebra operation system secretly performs a combination of first and second relational algebra operations on the input table of the operands. The input unit (11) contains the encrypted table of the operands. The first relational algebra operation unit (12) secretly performs the first relational algebra operation on the input table. The valid row extraction unit (13) generates an intermediate table from which valid rows have been extracted from the results of the first relational algebra operation. The second relational algebra operation unit (14) secretly performs the second relational algebra operation on the intermediate table. The output unit (15) outputs the result of the second relational algebra operation.

Description

Technical Field

[0001] This invention relates to secret computation techniques, and in particular to techniques for performing secret computations on relational algebra operations. Background Technology

[0002] A Database Management System (DBMS) is a system used to store and efficiently process large amounts of data, serving as a crucial foundation for data analysis or its preprocessing. When conducting comprehensive data analysis for promising applications considered as secret computing, not only analytical components such as statistical analysis or machine learning are needed, but also a DBMS as a subsystem for managing the synthesized data.

[0003] In this invention, the object is a database management system known as a relational database management system (RDBMS). A relational database management system is a database management system that processes data in the form of tables and can retrieve or modify data based on user queries. Queries are expressed using query languages ​​based on relational algebra operations. A representative language of such query languages ​​is Structured Query Language (SQL).

[0004] The report includes research on the implementation of a database management system that uses secret computing, citing examples such as Non-Patent Literature 1 and Non-Patent Literature 2.

[0005] Existing technical documents

[0006] Non-patent literature

[0007] Non-patent document 1: Kiribuchi Naoto, Igarashi Dai, "Secret state processing possible design", CSS2015, pp.419-426, 2015.

[0008] Non-patent document 2: Yusuke Ishida, Jun Kunii, Junichi Oketani, Yukiya Ohata, Takahiro Matsuda, Anoman Nairobi, Goichiro Hanaoka, "Query Ahead: Possibility of the common story and the secret design of the secret DB design and installation", SCIS2020, pp.1-8, 2020. Summary of the Invention

[0009] The problem that the invention aims to solve

[0010] Database processing in relational database management systems can be viewed as an iterative synthesis of relational algebraic operations. When synthesizing g(f(·)) from two relational algebraic operations f and g, one method for constructing g(f(·)) through secret computation is to replace the relational algebraic operations f and g with completely hidden protocol f. sec ,g sec , such as g sec (f sec The method is constructed as follows: ([·]). Here, [·] indicates that the value · is encrypted.

[0011] However, in relational algebra operations used in database management systems, the number of output rows is often less than the number of input rows (e.g., sum, difference, intersection, restriction, association, summary, etc.). When performing such relational algebra operations by concealing the row count and performing secret computations, dummy rows are inserted into the result. This leads to the following problem: even if the number of valid rows in the result is small, the apparent number of output rows becomes large, increasing the computational cost of subsequent processing of the result.

[0012] The purpose of this invention is to reduce the computational cost of secret computation for the synthesis of relational algebra operations, in view of the above-mentioned technical problems.

[0013] Methods for solving problems

[0014] To address the aforementioned issues, the secret relational algebra operation system of the first aspect of the present invention includes multiple secret computing devices, and secretly performs relational algebra operations on an input table of the operands. Each secret computing device includes: a relational algebra operation unit that secretly performs relational algebra operations on an input table or an intermediate table; and a valid row extraction unit that generates an intermediate table from the results of the relational algebra operations that have extracted valid rows.

[0015] The secret computing apparatus of the second aspect of the present invention, which secretly calculates the synthesis of relational algebra operations on an input table of operands, includes: a relational algebra operation unit that secretly calculates relational algebra operations on an input table or an intermediate table; and a valid row extraction unit that generates an intermediate table from which valid rows have been extracted from the results of the relational algebra operations.

[0016] The effects of the invention

[0017] According to the present invention, the result of the previous relational algebra operation input into the subsequent relational algebra operation is only a valid row, thus reducing the computational cost of secretly calculating the composition of relational algebra operations. Attached Figure Description

[0018] Figure 1 This is a diagram illustrating the functional structure of a secret relational algebra operation system.

[0019] Figure 2 This is a diagram illustrating the functional structure of a secret computing device.

[0020] Figure 3 This is a diagram illustrating the processing procedure of the secret relational algebra operation method.

[0021] Figure 4 This is a diagram illustrating the functional structure of a computer. Detailed Implementation

[0022] Hereinafter, embodiments of the present invention will be described in detail. Furthermore, in the accompanying drawings, structural parts with the same function will be given the same reference numerals, and repeated descriptions will be omitted.

[0023] [Notation]

[0024] Explain the notation used in this specification. Vectors are denoteed using lowercase letters (e.g., x). The i-th element of vector x is denoted by xi. i The vector is represented by σ(x). σ(x) represents the vector obtained by permuting vector x with the permutation σ. Two-dimensional permutations (tables) are denoteed using uppercase letters (e.g., X). The value obtained by encrypting the value x is denoted as [x]. Additionally, the vector obtained by encrypting the elements of vector x is also denoted as [x]. The table obtained by encrypting the elements of table x is denoted as [X].

[0025] [the term]

[0026] The following explains the definitions of the terms used in this specification.

[0027] <Secret Calculation>

[0028] Secret computation refers to a general term for techniques that perform prescribed calculations while keeping the data hidden. As a specific implementation method, one example is the secret distribution method. Secret distribution refers to an encryption method that divides data into multiple values ​​and distributes them to multiple parties. As a secret distribution that can be used for secret computation, the (k,n) threshold secret distribution can be cited. The (k,n) threshold secret distribution is a secret distribution method with the following property: when data is divided into n random values ​​(called "shares"), if more than k shares are collected, the original data can be restored; it is impossible to obtain information about the original data from shares smaller than k. Among the known (k,n) threshold secret distributions are the Shamir secret distribution (see reference 1) and the replication secret distribution (see references 2 and 3).

[0029] [Reference 1] Adi Shamir, "How to share a secret", Communications of the ACM, Vol. 22, No. 11, pp. 612-613, 1979.

[0030] [Reference 2] Mitsuru Ito, Akira Saito, and Takao Nishizeki, "Secretsharing scheme realizing general access structure", Electronics and Communications in Japan (Part III: Fundamental Electronic Science), Vol.72, No.9, pp.56-64, 1989.

[0031] [Reference 3] Ronald Cramer, Ivan Damgard, and Yuval Ishai, "Shareconversion, pseudorandom secret-sharing and applications to securecomputation", Theory of Cryptography Conference, pp. 342-362. Springer, 2005.

[0032] Although this specification describes an implementation where data is encrypted using a (k,n) threshold secret distribution as one method of secret distribution, secret computation can also be based on homomorphic encryption or garbled circuits, in addition to secret distribution. This invention can be used without being confined to a specific implementation method.

[0033] Random permutation

[0034] Random permutation refers to a protocol for shuffling a one-dimensional permutation (vector) using a random permutation σ. Random permutation can also be applied to two-dimensional permutations (tables). In this specification, the operation of shuffling the table [X] obtained by the hidden two-dimensional permutation X using permutation σ is denoted as σ[X]←RANDPERM([X]). In this case, it means that each column of the two-dimensional array X is permuted by the same random permutation σ.

[0035] As an implementation method of the hidden random permutation algorithm, reference 4 is known, for example. In addition, reference 4 is an algorithm based on the secret distribution method, but as an obvious method that does not rely on the secret distribution method, there is, for example, a random permutation using logic circuits containing random numbers.

[0036] 〔Reference 4〕 Igarashi Dai, Hamada Hiroshi, Kikuchi Ryo, Chida Koji, "インターネットENVIRONMENT 1SEC" "Statistical processing method, secret calculation base method improvement", SCIS2014, pp.1-8, 2014.

[0037] <Restore>

[0038] This is an operation that restores the value (or vector) [x] after the secret has been dispersed, to obtain the original value (or vector) x. In this specification, this operation is denoted as x←REVEAL([x]).

[0039] [Implementation Method]

[0040] The secret relational algebra operation system of the implementation method is an information processing system that performs secret computation of the composition g(f(·)) of relational algebra operations f and g under the condition that the composition is hidden except for the row number. Here, it is assumed that the secret relational algebra operation protocol is a general protocol that does not depend on relational algebra operations f and g.

[0041] In this embodiment, the following configuration method is adopted: as such a protocol, a row reduction protocol φ, which leaves only valid rows, is inserted between relational algebra operations f and g, as g. sec (φ(f sec ([R]))). Where R∈P, P represents the class of the record set. Any operation f, g in relational algebra is represented as a mapping of f, g: P→P. Therefore, if a row reduction protocol φ on [P] that hides the original data of P can be well designed, a single algorithm φ can be used to uniformly implement the row reduction protocol related to the composition of any f, g.

[0042] As an implementation of such an algorithm φ, the following row reduction protocol can be cited. This protocol first randomly permutes the result of concatenating the flag string representing the selected row with the table, then only discloses (restores) the permuted flag string. Then, based on the disclosed flags, only rows with flags set to true are retained from the randomly permuted rows of the table. Here, if the flag string is used as the result of selecting valid rows from the output of the relational algebra operation f, based on the security of the hidden random permutation algorithm, it is possible to retain only valid rows without disclosing content other than the row count.

[0043] == ...

[0044] Protocol 1: Row Reduction Protocol Row φ

[0045] ----------------------------------

[0046] Input: [X], [e] (where x is a table with n rows and m columns, and e is a flag string of length n that stores 1 at the positions corresponding to the selected rows and 0 at the other positions)

[0047] Output: [X'] (where X' is a table with n' (< n) rows and m columns)

[0048] 1: σ([X]) || σ([e]) ← RANDPERM([X] || [e])

[0049] 2: σ(e) ← REVEAL(σ([e]))

[0050] 3: Construct [X'] by selecting only n' records σ([X]) where σ(e i ) = 1 and obtaining i )

[0051] 4: Return [X']

[0052] ========================================

[0053] The secret relational algebra operation system 100 of this embodiment is as Figure 1 shown, and includes N (≥1) secret computing devices 11,..., 1 N . In the case of being composed of multiple (n ≥ 2) secret computing devices, they sometimes cooperate in processing. In this embodiment, the secret computing devices 11,..., 1 N are respectively connected to the communication network 9. The communication network 9 is a communication network configured in a circuit-switching or packet-switching manner such that the connected devices can communicate with each other. For example, the Internet, LAN (Local Area Network), WAN (Wide Area Network), etc. can be used. In addition, it is not necessary for each device to be able to communicate online via the communication network 9. For example, the information input to the secret computing device 1 i (i = 1,..., N) can be stored in a portable recording medium such as a magnetic tape or a USB memory, and can be input to the secret computing device 1 from the portable recording medium in an offline manner i .

[0054] The secret computing device 1 included in the secret relational algebra operation system 100 i For example, as Figure 2 As shown, it includes an input unit 11, a first relational algebra operation unit 12, a valid row extraction unit 13, a second relational algebra operation unit 14, and an output unit 15. The valid row extraction unit 13 includes, for example, a random permutation unit 131, a flag restoration unit 132, and an intermediate table construction unit 133. Through this secret computing device 1... i Alone or with other secret computing devices 1 i' (i' = 1, ..., N, where i ≠ i') While cooperating, the following steps are performed to realize the secret relational algebra operation method of the implementation method.

[0055] Secret Computing Device 1 i It is a special device constructed by loading a special program into a known or special-purpose computer, such as a central processing unit (CPU) and main storage device (RAM). Secret Computing Device 1 i For example, each process is executed under the control of the central processing unit. The data is input into the secret computing device 1. i The data, or data obtained from various processes, is stored, for example, in the main storage device. Data stored in the main storage device is read out as needed and sent to the central processing unit for further processing. Secret computing device 1 i Each processing unit can also be at least partially composed of hardware such as integrated circuits.

[0056] Reference Figure 3 This describes the processing procedure of the secret relational algebra operation method executed by the secret relational algebra operation system 100 of the implementation method.

[0057] In step S11, the ciphertext [R] obtained by encrypting the table R∈P of the operands is input into each secret computing device 1. i The input unit 11. Table R is set as a table with n rows and m columns. The input unit 11 outputs the ciphertext [R] of the input table R to the first relational algebra operation unit 12.

[0058] In step S12, each secret computing device 1 i The first relational algebra operation unit 12 receives the ciphertext [R] of table R from the input unit 11 and calculates the protocol f for secret computation of relational algebra operation f. sec That is, calculate f. sec ([R]). f secOutput the ciphertext [X] of a table x with n rows and m columns, and the ciphertext [e] of a vector e of length n. Table X is the result of the relational algebra operation f on table R. Table X has more than one dummy row inserted to hide the row count. Vector e stores a flag string with 1s at the positions corresponding to valid rows of table X and 0s at the positions other than those (i.e., dummy rows). The flag string is stored in, for example, f sec The virtual row can be generated when it is inserted. The first relational algebra operation unit 12 outputs the ciphertext [X] of table X and the ciphertext [e] of the flag string e to the valid row extraction unit 13.

[0059] In step S13, each secret computing device 1 i The valid row extraction unit 13 receives the ciphertext [X] of table X and the ciphertext [e] of the flag string e from the first relational algebra operation unit 12, and generates the ciphertext [X'] of the intermediate table X'. The intermediate table X' is obtained by extracting valid rows from table X based on the flag string e. The valid row extraction unit 13 outputs the ciphertext [X'] of the intermediate table X' to the second relational algebra operation unit 14.

[0060] Specifically, the effective row extraction unit 13 performs the following steps S131 to S133 to implement the above-mentioned row reduction protocol φ.

[0061] In step S131, the random permutation unit 131 permutes the table that connects the ciphertext [X] of table X and the ciphertext [e] of the flag string e according to the random permutation σ. That is, it executes σ([X])||σ([e])←RANDPERM([X]||[e]).

[0062] In step S132, the flag restoration unit 132 restores the random replacement flag string σ[e]. That is, it executes σ(e)←REVEAL(σ([e])).

[0063] In step S133, the intermediate table construction unit 133 constructs the ciphertext [X'] of the intermediate table X' from the randomly permuted table σ([X]) based on the restored flag string e. Specifically, for i = 1, ..., n, σ(e) is extracted. i The row σ[X) = 1 i The result is output as the ciphertext [X'] of the intermediate table X'.

[0064] In step S14, each secret computing device 1 i The second relational algebra operation unit 14 receives the ciphertext [X'] of the intermediate table X' from the valid row extraction unit 13, and performs secret computation of the relational algebra operation g according to the protocol g. sec That is, the operation g sec ([X']). g secIf the principle is to output the ciphertext [R'] of table R' consisting of n' rows and m columns, then table R' is the result of relational algebra operation g on the intermediate table X', and is a composite result of relational algebra operations f and g on the input table R. Sometimes, table R' inserts more than one dummy row to hide the number of rows. In addition, sometimes all rows of table R' are valid rows, and no dummy rows are inserted. The second relational algebra operation unit 14 outputs the ciphertext [R'] of table R' to the output unit 15.

[0065] In step S15, each secret computing device 1 i The output unit 15 receives the ciphertext [R'] of table R' from the second relational algebra operation unit 14 and outputs it as the secret relational algebra operation system 100.

[0066] [Variation Example]

[0067] The secret relational algebra operation system 100 of the implementation is configured to perform a single calculation of the composition g(f(·)) of relational algebra operations f and g, but it can also achieve arbitrary queries by repeatedly performing the composition of relational algebra operations. In this case, the second relational algebra operation unit 14 outputs the ciphertext [e] of the flag string e representing the valid rows of table R' together with the ciphertext [R'] of table R' to the valid row extraction unit 13. Then, the processing of the valid row extraction unit 13 and the second relational algebra operation unit 14 is repeatedly executed until the desired query is completed. Then, when the desired query is completed, the second relational algebra operation unit 14 outputs the ciphertext [R'] of table R' at that moment to the output unit 15.

[0068] [Effect]

[0069] If the result of a relational algebra operation, which is input from a preceding relational algebra operation, is only considered as a valid row, then the row count information cannot be hidden. However, since the row count of the result of a relational algebra operation can be considered a statistical value, the impact on privacy is considered relatively small. On the other hand, reducing the number of input rows is expected to significantly improve the performance of subsequent relational algebra operations. For example, even if only one row out of 10 million rows of output from a relational algebra operation is valid, by definition, 10 million rows of data inevitably become input to subsequent relational algebra operations, even if the row count is hidden. On the other hand, according to the structure of the present invention, only one row becomes input to subsequent relational algebra operations, which can reduce the number of input rows to 1 / 10 million. In fact, the results of implementing the above row reduction protocol φ in a three-party multi-party computation system confirmed that the overhead is small enough compared to the execution time that can be reduced, and the execution time can be effectively reduced.

[0070] As is unexpectedly the case with this invention, a single row reduction protocol φ can cover all the very common processing combinations for databases. In fact, while the processing used for the structure itself is mentioned in several documents, none are related to this invention, and the structure of this invention is not known to those skilled in the art.

[0071] The embodiments of the present invention have been described above. However, the specific structure is not limited to these embodiments. Appropriate design changes, etc., without departing from the spirit of the present invention are naturally included in the present invention. The various processes described in the embodiments can be executed not only in the order described but also in parallel or individually, depending on the processing capacity or needs of the device executing the processes.

[0072] [Program, Recording Medium]

[0073] When implementing the various processing functions of the devices described in the above embodiments using a computer, the processing content of the functions that each device should have is described by a program. Then, by reading this program into... Figure 4 In the storage unit 1020 of the computer shown, the control unit 1010, input unit 1030, output unit 1040, etc. are activated to realize various processing functions of the above-mentioned devices on the computer.

[0074] The program describing this processing content can be recorded on a computer-readable recording medium. Such a computer-readable recording medium could be a non-transitory storage medium, such as a magnetic recording device or an optical disc.

[0075] Furthermore, the program can be distributed, for example, through the sale, transfer, or lending of portable recording media such as DVDs and CD-ROMs containing the program. Alternatively, the program can be stored in the storage device of a server computer and then forwarded from the server computer to other computers via a network, thereby distributing the program.

[0076] The computer executing this program, for example, first temporarily stores the program recorded on a portable recording medium or the program forwarded from the server computer in its own non-temporary storage device, namely the auxiliary recording unit 105. Then, during processing, the computer reads the program stored in the auxiliary recording unit 1050, which is its own non-temporary storage device, into the storage unit 1020, which is a temporary storage device, and executes the processing according to the read program. Alternatively, as another way of executing this program, the computer can directly read the program from the portable recording medium, execute the processing according to the program, and execute the processing according to the received program whenever the program is forwarded from the server computer. Furthermore, it can be configured so that the processing function is achieved solely through the execution instructions and result acquisition without forwarding the program from the server computer, that is, by performing the above processing through a so-called ASP (Application Service Provider) type service. In addition, in this method of program, information that conforms to the program (not a direct instruction to the computer, but data that has the nature of specifying the computer's processing, etc.) is included as information used for processing by the electronic computer.

[0077] Furthermore, in this method, the device is configured to be constructed by executing a prescribed program on a computer, but it is also possible to configure it to implement at least a portion of these processing contents only in hardware.

Claims

1. A secret relational algebra operation system including a plurality of secret computation devices, which outputs an operation result by secret-computing a composition of relational algebra operations on an input table of an operation object, wherein each secret computation device includes: a relational algebra operation section that secret-computes the relational algebra operations on the input table or an intermediate table, and outputs a ciphertext flag string indicating valid rows in an operation result of the secret-computed relational algebra operations, together with the operation result in which dummy rows are inserted; a row permutation section that secret-computes a row permutation with a secret content on a table in which the operation result and the ciphertext flag string are concatenated; a valid position computation section that extracts positions of valid rows from the operation result after the row permutation using the ciphertext flag string after the row permutation; and an intermediate table construction section that constructs the intermediate table by extracting valid rows from the operation result after the row permutation.

2. The secret relational algebra operation system according to claim 1, wherein the secret relational algebra operation system is to secret-compute an arbitrary query by repeatedly performing a composition of relational algebra operations on the input table, and the processing of the relational algebra operation section, the row permutation section, the valid position computation section, and the intermediate table construction section is repeatedly executed until the arbitrary query is completed.

3. The secret relational algebra operation system according to claim 1, wherein the row permutation with a secret content is a random permutation, and the valid position computation section restores the ciphertext flag string to extract the positions of valid rows.

4. A secret computation device that outputs an operation result by secret-computing a composition of relational algebra operations on an input table of an operation object, comprising: a relational algebra operation section that secret-computes the relational algebra operations on the input table or an intermediate table, and outputs a ciphertext flag string indicating valid rows in an operation result of the secret-computed relational algebra operations, together with the operation result in which dummy rows are inserted; a row permutation section that secret-computes a row permutation with a secret content on a table in which the operation result and the ciphertext flag string are concatenated; a valid position computation section that extracts positions of valid rows from the operation result after the row permutation using the ciphertext flag string after the row permutation; and an intermediate table construction section that constructs the intermediate table by extracting valid rows from the operation result after the row permutation.

5. A secret relational algebra operation method executed by a secret relational algebra operation system including a plurality of secret computation devices, which outputs an operation result by secret-computing a composition of relational algebra operations on an input table of an operation object, in the secret relational algebra operation method, a relational algebra operation section of each secret computation device secret-computes the relational algebra operations on the input table or an intermediate table, and outputs a ciphertext flag string indicating valid rows in an operation result of the secret-computed relational algebra operations, together with the operation result in which dummy rows are inserted, a row permutation section of each secret computation device secret-computes a row permutation with a secret content on a table in which the operation result and the ciphertext flag string are concatenated, and a valid position computation section of each secret computation device extracts positions of valid rows from the operation result after the row permutation using the ciphertext flag string after the row permutation. ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ the valid position calculation section of each secret computation device extracts the positions of valid rows from the operation result after the row permutation using the ciphertext mark string after the row permutation, the intermediate table construction section of each secret computation device constructs the intermediate table by extracting valid rows from the operation result after the row permutation.

6. A secret relational algebra operation method executed by one secret computation device, which outputs an operation result of a composition of a secret relational algebra operation on an input table of an operation object, in the secret relational algebra operation method, the relational algebra operation section secretly computes the relational algebra operation on the input table or the intermediate table, and outputs a ciphertext mark string indicating valid rows in the operation result, together with the operation result in which dummy rows are inserted as the operation result of the secret relational algebra operation, the row permutation section secretly computes a row permutation in which the contents are secret, on a table in which the operation result and the ciphertext mark string are concatenated; the valid position calculation section extracts the positions of valid rows from the operation result after the row permutation using the ciphertext mark string after the row permutation; and the intermediate table construction section constructs the intermediate table by extracting valid rows from the operation result after the row permutation.

7. A computer program product for causing a computer to execute each step of the secret relational algebra operation method according to claim 5 or 6.

Images