Secret computation system, secret computation device, method, and program product

Abstract

A secret computation system according to one embodiment includes a first secret computation device, a second secret computation device, and a third secret computation device each holding a three-party share of a hidden input sequence, the first secret computation device having a first conversion section that converts the three-party share held by itself into a two-party share with the third secret computation device, a first calculation section that calculates a result obtained by applying a permutation held by itself to the two-party share held by itself, subtracts a result obtained by applying a second permutation determined in accordance with the permutation to a first sequence determined in a predetermined manner and a third sequence obtained from a second sequence determined in a predetermined manner, and a first transmission section that transmits the third sequence and the second permutation to the second secret computation device, the third secret computation device having a second conversion section that converts the three-party share held by itself into a two-party share with the first secret computation device, a second calculation section that calculates a fourth sequence obtained by adding the first sequence to a result obtained by applying a first permutation determined in accordance with the permutation to the two-party share held by itself, a second transmission section that transmits the fourth sequence to the third secret computation device, and a first output section that outputs, as a two-party share with the second secret computation device of a result obtained by applying the permutation to the input sequence, a second sequence obtained by adding a result obtained by applying the second permutation to the fourth sequence to the third sequence, the second secret computation device having a second output section that outputs, as a two-party share with the third secret computation device of a result obtained by applying the permutation to the input sequence, a sequence obtained by adding a result obtained by applying the second permutation to the fourth sequence to the third sequence.

Description

Technical Field

[0001] This invention relates to a secret computing system, secret computing device, method, and program. Background Technology

[0002] Secret computation is a useful technique known to perform various computations at high speed while hiding data. In many analyses, retrieving and extracting data from a dataset (sequence) that matches specific criteria is a frequently used and important process. However, in secret computation, since the criteria used for retrieval (e.g., search keywords) also need to reference data while it remains hidden, it risks becoming a simple search of the entire sequence on each reference to find matching conditions, requiring significant computational and communication overhead.

[0003] To address this problem, techniques are known to significantly reduce citation costs by constructing special data structures beforehand using permutations or sorting (e.g., non-patent documents 1 and 2). How to construct and cite such data structures at high speed is crucial for data citation in secret computing.

[0004] In the construction of the data structure described above, hidden permutations, which allow the permutation method to be kept hidden from the participants (participants) in secret computation, play a crucial role. Various methods are known for implementing hidden permutations. For example, one method is known that permutes the sequence while keeping both the sequence and the permutation hidden, provided that the permutation and the random number sequence are shared among the participants beforehand. Another method is known that hides the sequence from all participants while keeping the permutation hidden from participants other than the one holding the permutation.

[0005] <Prior art documents>

[0006] <Non-Patent Literature>

[0007] Non-Patent Literature 1: Atsuhiko Ichikawa, Hiroki Hamada, Ryo Kikuchi, and Dai Igarashi. Oblivious RAM with optimized hidden hash and inferior logarithmic efficiency in three-party computation. Draft of the Symposium on Cryptography and Information Security (SCIS) 2020 (2020).

[0008] Non-Patent Literature 2: Hiroki Hamada, Atsuhiko Ichikawa. A Secret Computation Sequence Access Algorithm with Constant Rounds and Including Inferior Linear Local Computation. Draft of the Symposium on Cryptography and Information Security (SCIS) 2019 (2019). Summary of the Invention

[0009] <Problem to be solved by this invention>

[0010] However, in the aforementioned conventional techniques (such as non-patent documents 1 and 2), due to the repeated random permutation (shuffling) or partial sorting of the sequence, there are problems of poor actual efficiency, or although the actual efficiency is good, there is a vulnerability to unauthorized references.

[0011] In view of the above problems, one embodiment of the present invention aims to perform efficient and secure hidden sequence permutation in secret computations involving three parties.

[0012] <Methods for solving problems>

[0013] To achieve the above objectives, a secret computing system according to one embodiment includes a first secret computing device, a second secret computing device, and a third secret computing device, each holding a three-party share of a hidden input sequence. The first secret computing device has a first conversion unit that converts its own three-party share into a two-party share with the third secret computing device; a first calculation unit that calculates a result obtained by applying its own permutation to its own two-party shares, and subtracts a result obtained by applying a second permutation determined according to the permutation to a first sequence determined by a predetermined method, and a third sequence obtained by the second sequence determined by a predetermined method; and a first transmission unit that transmits the third sequence and the second permutation to the second secret computing device, the third secret computing device having a second conversion unit. The third secret computing device converts its own three-party share into a two-party share with the first secret computing device; a second computing unit calculates a fourth sequence by adding the first sequence to the result obtained by applying the first permutation determined according to the permutation to the two-party share it holds; a second sending unit sends the fourth sequence to the third secret computing device; and a first output unit takes the second sequence as the two-party share between the third secret computing device and the second secret computing device as the result obtained by applying the permutation to the input sequence. The second secret computing device has a second output unit that adds the result obtained by applying the second permutation to the fourth sequence to the third sequence as the two-party share between the third secret computing device and the input sequence.

[0014] <The Effects of the Invention>

[0015] It enables efficient and secure hidden sequence permutations in secret computations involving three parties. Attached Figure Description

[0016] Figure 1 This is a diagram illustrating an example of the overall configuration of a secret computing system according to this embodiment.

[0017] Figure 2 This is a diagram illustrating an example of the hardware configuration of a computer.

[0018] Figure 3 This is a timing diagram used to illustrate Example 1.

[0019] Figure 4 This is a timing diagram used to illustrate Example 2.

[0020] Figure 5 This is a timing diagram used to illustrate Example 3.

[0021] Figure 6 This is a timing diagram used to illustrate Example 4. Detailed Implementation

[0022] Hereinafter, one embodiment of the present invention will be described. This embodiment describes a secret computation system 1 that enables efficient and secure hidden sequence permutation in secret computation performed by three parties by asymmetricizing the information obtained by each party. Furthermore, the construction and referencing of any data structure (a data structure in a sequence format that hides the data and the reference position when accessing the data (hereinafter also referred to as a reference position hidden sequence) that utilizes the hidden sequence permutation will be described using the secret computation system 1 according to this embodiment.

[0023] It should be noted that, in the following text, the three participants will be referred to as P1, P2, and P3, and it is assumed that P1 is the participant holding the swap.

[0024] <Preparation>

[0025] First, prepare some symbols, terms, or concepts.

[0026] Third-party data hiding

[0027] Hide the plaintext x using...

[0028] [Number 1]

[0029] This indicates the results shared among the three parties. It should be noted that in the following text of the specification, these will be represented as [x]1, [x]2, and [x]3 respectively.

[0030] At this point, although [x] i By participant P i It can be held, but it can also be abstracted below as "the state x shared by all participants," simply represented as [x]. Furthermore, each [x]...i These are called segments or shares. Furthermore, it is assumed that plaintext x can be recovered using any two of the three shares [x]1, [x]2, and [x]3, while plaintext x cannot be recovered using only one share.

[0031] As an example of a technology that satisfies the above, a secret distribution method can be cited (e.g., reference 1 or reference 2, etc.), but it is not limited to this. Any method can be used as long as it satisfies the same functionality and security as the secret distribution method.

[0032] Additive two-way data hiding

[0033] The plaintext x is hidden, and the results shared between the two parties are represented by <x>1 and <x>2, specifically, these two values ​​are random values ​​that satisfy <x>1 + <x>2 = x. Although it is assumed that each <x>1 and <x>2 is held separately by any two participants among P1, P2, and P3, this state can also be abstracted and represented simply as <x>. Furthermore, it is assumed that [x] can be converted into <x> without communication between the participants.

[0034] As an example of a technology that satisfies the above, a secret distribution method can be cited (e.g., reference 1 or reference 2, etc.), but it is not limited to this. Any method can be used as long as it satisfies the same functionality and security as the secret distribution method.

[0035] Random share generation

[0036] The process of generating a share [r] of a random number r without any participant knowing the plaintext r is called random share generation. This process can be implemented, for example, in the secret distribution method, by the techniques described in reference 3, etc., but is not limited thereto. Any technique can be used as long as it meets the same functionality and security requirements.

[0037] Pseudo-random function

[0038] Hereinafter, we assume that F represents a pseudo-random function capable of secret computation, and F([a],[s]) represents the secret computation of the pseudo-random function with respect to the secret value [a] and the key [s]. This secret computation process can be implemented, for example, by the techniques described in Reference 4, etc., but is not limited thereto. Any technique that satisfies the same functionality and security as that technique can be used.

[0039] Sequence permutation

[0040] Let the following assumptions be made: Let π: {1,…,m}→{1,…,m} denote a permutation (sorting) of any sequence of length m (without secret computation), and let πA denote the sequence obtained by applying permutation π to sequence A. Here, for A=(A1,…,A…) m ),become

[0041] [Number 2]

[0042] Furthermore, suppose we use the notation ○ to denote the composition of two substitutions. For example, if it is

[0043] [Number 3]

[0044] Then πA = π2(π1A) is satisfied.

[0045] <The Overall Structure of Secret Computing System 1>

[0046] Next, refer to Figure 1 The overall configuration of the secret computing system 1 according to this embodiment will be described. Figure 1 This is a diagram illustrating an example of the overall configuration of the secret computing system 1 according to this embodiment.

[0047] like Figure 1 As shown, the secret computing system 1 according to this embodiment includes a secret computing device 10, a secret computing device 20, and a secret computing device 30. Furthermore, the secret computing device 10, the secret computing device 20, and the secret computing device 30 can be connected to each other in a communicable manner via a communication network 40 such as the Internet.

[0048] The secret computing device 10 is a computer or computer system that functions as a participant P1, and includes a secret computing processing unit 101 and a storage unit 102. The secret computing processing unit 101 performs various processes for constructing hidden sequence permutations or reference position hidden sequences. In addition, the storage unit 102 stores various information (e.g., permutations, sequence shares, etc.) required to perform these various processes.

[0049] The secret computing device 20 is a computer or computer system that functions as participant P2, and includes a secret computing processing unit 201 and a storage unit 202. The secret computing processing unit 101 performs various processes for constructing and referencing secret sequence permutations or hidden sequence references. The storage unit 202 stores various information (e.g., sequence shares) required for performing these various processes.

[0050] The secret computing device 30 is a computer or computer system that functions as a participant P3, and includes a secret computing processing unit 301 and a storage unit 302. The secret computing processing unit 301 performs various processes for constructing and referencing secret sequence permutations or hidden sequence references. The storage unit 302 stores various information (e.g., sequence shares) required for performing these various processes.

[0051] <Hardware Composition of Secret Computing System 1>

[0052] Next, the hardware configuration of the secret computing device 10, secret computing device 20, and secret computing device 30 included in the secret computing system 1 according to this embodiment will be described. The secret computing device 10, secret computing device 20, and secret computing device 30 can, for example, be configured using... Figure 2 The hardware configuration of the computer 500 shown is used to implement this.

[0053] Figure 2 The computer 500 shown includes an input device 501, a display device 502, an external I / O panel 503, a communication I / O panel 504, a processor 505, and a memory device 506 as hardware. These hardware components are connected in a communicative manner via a bus 507.

[0054] Input device 501 may be, for example, a keyboard, mouse, or touch panel. Display device 502 may be, for example, a monitor. It should be noted that computer 500 may also not have at least one of the input device 501 and display device 502.

[0055] External I / F 503 is the interface between the recording medium 503a and external devices. It should be noted that examples of recording media 503a include CD (Compact Disc), DVD (Digital Versatile Disk), SD memory card (Secure Digital Memory Card), and USB (Universal Serial Bus) memory card.

[0056] Communication I / F 504 is an interface for connecting to communication network 40. Processor 505 is, for example, a CPU (Central Processing Unit) or GPU (Graphics Processing Unit) or other various computing devices. Memory device 506 is, for example, a HDD (Hard Disk Drive), SSD (Solid State Drive), RAM (Random Access Memory), ROM (Read Only Memory), or flash memory or other various storage devices.

[0057] The secret computing device 10, secret computing device 20, and secret computing device 30 according to this embodiment can be used to... Figure 2 The hardware configuration of the computer 500 shown implements the various processes described later. It should be noted that... Figure 2 The hardware configuration of the computer 500 shown is only an example, and various hardware configurations may be adopted depending on the purpose of the object applying the secret computing system 1.

[0058] It should be noted that the secret computing processing unit 101 is implemented, for example, by having the processor 505 of the computer 500 implementing the secret computing device 10 execute one or more programs installed in the secret computing device 10. Furthermore, the storage unit 102 is implemented, for example, by the memory device 506 of the computer 500 implementing the secret computing device 10.

[0059] Similarly, the secret computing processing unit 201 is implemented, for example, by having the processor 505 of the computer 500 implementing the secret computing device 20 execute one or more programs installed in the secret computing device 20. Furthermore, the storage unit 202 is implemented, for example, by the memory device 506 of the computer 500 implementing the secret computing device 20.

[0060] Similarly, the secret computing processing unit 301 is implemented, for example, by having the processor 505 of the computer 500 implementing the secret computing device 30 execute one or more programs installed in the secret computing device 30. Furthermore, the storage unit 302 is implemented, for example, by the memory device 506 of the computer 500 implementing the secret computing device 30.

[0061] <Example 1>

[0062] In this embodiment, P1 holds any plaintext permutation π, and all participants hold (or are input with) any hidden sequence.

[0063] [Number 4]

[0064] In this case, apply the permutation π to the share, and for only P2 and P3, obtain the additive two-way share of the permuted sequence.

[0065] [Number 5]

[0066] In this case, it will be referred to Figure 3 Please provide an explanation. Figure 3This is a timing diagram used to illustrate Embodiment 1. It should be noted that, in the following text of the specification, it is assumed that the arrow markings directly above the symbols will be placed in the upper left corner. For example, in the text of the specification, the number 5 mentioned above will be represented as < → T>; → T=π → D.

[0067] The secret computing processing unit 101 of the secret computing device 10 will share [ → D] converted to < → D>1 (S101). Similarly, the secret computing processing unit 301 of the secret computing device 30 will divide [ → D] converted to < → D > 2(S102). It should be noted that, here, although it is assumed that P1 holds < → D>1, P2 holds < → D>2, but it can also be assumed that P1 holds < → D>2, P2 holds < → D>1. In the following text, assume P1 holds < → D>1, P2 holds < → D>2.

[0068] Next, the secret computing processing unit 101 of the secret computing device 10 selects the option that satisfies...

[0069] [Number 6]

[0070] The random permutations π1 and π2 (S103). Furthermore, the secret calculation processing unit 101 of the secret calculation device 10 selects and < → D > 1 Random sequences of the same size → U、 → V(S104).

[0071] Next, the secret computing processing unit 101 of the secret computing device 10 calculates... → A: =π < → D>1-π2 → U- → V(S105).

[0072] Then, the secret computing processing unit 101 of the secret computing device 10 sends π2 and... → A(S106), and sends π1 to the secret computing device 30. → U and → V(S107).

[0073] The secret computing device 30's secret computing processing unit 301 calculates... →B: =π1< → D>2+ → U(S108), then the → B is sent to the secret computing device 20 (S109). Additionally, the secret computing processing unit 301 of the secret computing device 30 determines its own output as < → T>2:= → V(S110).

[0074] The secret computing processing unit 201 of the secret computing device 20 determines its own output as < → T>1:= → A+π2 → B(S111).

[0075] In the aforementioned agreement, because... → A+π2 → B=π → D- → V, therefore < → T>1、< → T>2 is → T=π → The additive share of D for both parties. Additionally, in the above protocol, the communication volume is 4 × (sequence < → The size of D) + 2 × (the size of the permutation π) bits, with 2 rounds. Therefore, in this embodiment, efficient hidden sequence permutation can be achieved. Furthermore, it is known that since P1, as the permutation holder, does not possess < → T>, thus enabling, for example, secure hidden sequence permutations that prevent P1 from performing (unauthorized) operations or obtaining information.

[0076] Therefore, according to this embodiment, arbitrary permutations can be applied to the hidden sequence, and a secure reference position hidden sequence can be obtained efficiently.

[0077] <Example 2>

[0078] This embodiment is an extension of embodiment 1, see below. Figure 4 The use of arbitrary cryptographic pseudo-random number generators (without secret computation) to reduce communication volume and rounds is explained. Figure 4 This is a timing diagram used to illustrate Example 2. In this example, it is assumed that a common pseudo-random number generator Φ and its input p are shared beforehand between P1 and P3. It should be noted that, similar to Example 1, P1 holds arbitrary plaintext permutations π, and all participants hold any hidden sequence. → D).

[0079] Figure 4S201 to S202 are the same as S101 to S102 in Example 1, so their description is omitted.

[0080] The secret computing processing unit 101 of the secret computing device 10 executes ψ(p) to obtain the random number sequence π1. → U、 → V(S203). Similarly, the secret calculation processing unit 301 of the secret calculation device 30 executes ψ(p) to obtain the random number sequence π1, → U、 → V(S204). That is, P1 and P3 independently execute ψ(p) to obtain a common random number sequence π1. → U、 → V.

[0081] Next, the secret computing processing unit 101 of the secret computing device 10 calculates the substitution.

[0082] [Number 7]

[0083] (S205).

[0084] Next, the secret computing processing unit 101 of the secret computing device 10 calculates... → A: =π < → D>1-π2 → U- → V(S206).

[0085] The secret computing processing unit 101 of the secret computing device 10 sends π2 and π2 to the secret computing device 20. → A(S207).

[0086] The subsequent S208 to S211 are the same as S108 to S111 in Example 1, so their description is omitted.

[0087] In this embodiment, by sharing any update rule related to p in advance between P1 and P3 (e.g., updating to p←p+1 each time ψ(p) is executed), it is possible to execute repeatedly without sharing p or ψ again. Thus, the communication volume can be reduced to 2×(sequence < → The size of D) + 2 × (the size of π) bits, and the number of rounds is reduced to 1.

[0088] <Example 3>

[0089] This embodiment is an extension of the hidden sequence permutation described in Embodiments 1 and 2, referring to... Figure 5 The method for generating the permutation π using P1 is explained. Figure 5This is a timing diagram used to illustrate Example 3. It should be noted that in Examples 1 and 2, the method for generating the substitution π is not limited.

[0090] In this embodiment, it is assumed that an arbitrary pseudo-random function F capable of secret computation is pre-shared among all participants, and at least P1 holds an arbitrary mechanism M that uniquely computes permutations based on the plaintext values ​​of the output of F. Here, it is assumed that mechanism M is such that if the input sequence (f1,…,f…)… n Then the output is a bijective π: {1,…,m}→{1,…,m} (where n≤m), if the input value f i Then, the device or algorithm that outputs π(i) is needed. As a mechanism M, for example, cuckoo hashing as described in reference 5 can be used, but it is not limited to this; any device or algorithm with properties similar to cuckoo hashing can be used. It should be noted that in several mechanisms, including cuckoo hashing, the output of the pseudo-random function is multi-valued f. i (1) ,…,f i (l) (Where, l is a lowercase letter L), it is also possible to consider that the output when it is input into M is also a multi-valued π. (1) (i),…,π (l) (i) (where l is the lowercase letter L) can also be used in this embodiment.

[0091] In this embodiment, as [D] i ]=([k i ], ), and use the shares of all participants holding (or being input) the hidden arbitrary sequence as [ → D]:=([D1],…,[D n However, suppose k i It functions as a retrieval keyword for data references illustrated in Example 4, and assumes that each D i Holding different k i .in addition, It can be data of any type, size, and number, but in principle it is a share.

[0092] First, the secret computing processing unit 101 of the secret computing device 10, the secret computing processing unit 201 of the secret computing device 20, and the secret computing processing unit 301 of the secret computing device 30 perform random share generation to obtain random share [s] (S301). That is, random share generation is performed at all participating parties, and P1, P2, and P3 obtain shares [s]1, [s]2, and [s]3, respectively.

[0093] Next, the secret calculation processing unit 101 of the secret calculation device 10, the secret calculation processing unit 201 of the secret calculation device 20, and the secret calculation processing unit 301 of the secret calculation device 30 calculate [f] for i=1,…,n. i ]←F([k i ],[s]), to obtain [ → f]:=([f1],…,[f n (S302). That is, compute [f] for i=1,…,n at all participating parties. i ]←F([k i ],[s]), to obtain [ → f]:=([f1],…,[f n Therefore, P1, P2, and P3 each receive their respective shares. → f]1、[ → f]2 and [ → f]3.

[0094] Next, the secret computing processing unit 201 of the secret computing device 20 will process its own share [ → f]2 is sent to the secret computing device 10 (S303). However, the secret computing processing unit 301 of the secret computing device 30 can also send its own share [ → f]3 is sent to the secret computing device 10. That is, either P2 or P3 can transfer its share [ → f] is sent to P1.

[0095] The secret computing processing unit 101 of the secret computing device 10 uses its own share [ → f]1 and the share sent from secret computing device 20 (or secret computing device 30) → f], restore → f(S304).

[0096] Next, the secret computing processing unit 101 of the secret computing device 10 will process the plaintext... → f is input into mechanism M, resulting in the permutation π (S305).

[0097] Then, the secret computing processing unit 101 of the secret computing device 10, the secret computing processing unit 201 of the secret computing device 20, and the secret computing processing unit 301 of the secret computing device 30 perform the secret sequence permutation (S306) described in Embodiment 1 or 2. As a result, P2 obtains < → T>1, P3 obtains < → T>2. However, when the range of bijective π is m, n<m, before performing the hidden sequence permutation described in Example 1 or 2, at all participants [→ The share of dummy data is added in a way that the length of D is m. It should be noted that the dummy data used here only needs to satisfy the condition that the search keyword and... → Any k contained in D i "All are different" can be any value.

[0098] Then, the secret computing processing unit 101 of the secret computing device 10 stores [s]1 in the storage unit 102 (S307). Additionally, the secret computing processing unit 201 of the secret computing device 20 stores [s]2 and < → T>1 is stored in storage unit 202 (S308). Similarly, the secret calculation processing unit 301 of the secret calculation device 30 stores [s]3 and < → T>2 is stored in storage unit 302 (S309).

[0099] According to the aforementioned protocol, the construction of any data structure (reference position hidden sequence) exemplified by the Cuckoo hash table described in Reference 5, etc., can be achieved primarily through a single permutation. Furthermore, since P1, which is known to have permuted π, does not hold the sequence < → Therefore, P1 cannot observe the data reference (sequence reference) described in Example 4, and cannot identify the reference. Thus, as described in Example 1, this embodiment enables the efficient acquisition of a secure reference location hiding sequence.

[0100] <Example 4>

[0101] In this embodiment, refer to Figure 6 For the sequence < obtained in Example 3 → This section explains how to reference T>. Figure 6 This is a timing diagram used to illustrate Example 4. It should be noted that in this example, it is assumed that the same pseudo-random function F and mechanism F used in Example 3 are pre-shared among all participants.

[0102] The following section defines the two-party share <D> of data that matches the search keyword, taking the three-party share [k] as input and outputting the data that matches the search keyword. Please explain the situation.

[0103] First, the secret computing processing unit 101 of the secret computing device 10, the secret computing processing unit 201 of the secret computing device 20, and the secret computing processing unit 301 of the secret computing device 30 calculate [f]←F([k],[s]) (S401). That is, [f]←F([k],[s]) is calculated by all participants. Thus, each P i(i=1,2,3) hold [f] i .

[0104] Next, the secret computing processing unit 201 of the secret computing device 20 and the secret computing processing unit 301 of the secret computing device 30 mutually recover [f] to obtain plaintext f (S402). That is, P2 sends its own [f]2 to P3. Similarly, P3 sends its own [f]3 to P2. Then, P2 uses its own [f]2 and the [f]3 sent from P3 to recover f. Similarly, P3 uses its own [f]3 and the [f]2 sent from P2 to recover f.

[0105] Next, the secret computing processing unit 201 of the secret computing device 20 inputs the plaintext f into the mechanism M to obtain the value q (S403). Similarly, the secret computing processing unit 301 of the secret computing device 30 inputs the plaintext f into the mechanism M to obtain the value q (S404). That is, P2 and P3 independently input the plaintext f into the mechanism M to obtain the value q.

[0106] Then, the secret computing processing unit 201 of the secret computing device 20 outputs < → The qth element <T>1 q >1 (S405). Similarly, the secret computing processing unit 301 of the secret computing device 30 outputs < → The qth element <T>2 q >1 (S406). That is, P2 and P3 each output < independently. → The qth element of T> <T> q >.

[0107] At this point, if such as k i =k such data [D i ]=([k i ], ) is included in [ → In D], the result calculated using the pseudo-random function is also f. i In the case of =f, it is possible to correctly reference <T as q=π(i). q >=<D i >. Additionally, at this point, since P2 and P3 do not know the permutation π or the sequence (f1,…,f…), n Therefore, even if only f and q are observed, it is difficult to identify the reference position (i.e., index i) in the original sequence. Furthermore, if mechanism M always maps any output f of the pseudo-random function F to the range {1,…,m}, then even for inputs such as k not included in the original data sequence... → Such unauthorized references in D will also be referenced in the same way. → Any element of Tq ; q∈{1,…,m}, and also has resistance to attacks that attempt to identify the index by deliberately making unauthorized references.

[0108] It should be noted that, as explained in Example 3, when the pseudo-random function and the mechanism output multiple values ​​respectively, P2 and P3 replace q to obtain the multiple-valued q. (1) ,…,q (l) (Where, l is the lowercase letter L). In this case, all elements are output in S405 and S406.

[0109] [Number 8]

[0110] At this point, the required data <D> = (<k>, ) and any element

[0111] [Number 9]

[0112] They are equal. Therefore, each participant can also use any operation or secret calculation, such as equality check, to select a specific element from all the above elements and output it.

[0113] Summary

[0114] As described above, the secret computation system 1 according to this embodiment, in the secret computation of three participants, can efficiently apply the arbitrary permutation π held by P1 to the sequence while keeping it hidden in P2 and P3 by utilizing the asymmetry of information of each participant. Furthermore, by preventing P1 from holding the permuted sequence, it achieves higher security than existing technologies. Additionally, this permutation can be used to construct arbitrary data that can hide the reference position of the sequence. Here, the asymmetry of information of each participant refers to the asymmetry of information between participant P1, who holds the permutation for the sequence, and participants P2 and P3, who hold the permuted sequence itself. It also implies that the information is asymmetric between participants P2 and P3.

[0115] It should be noted that, for example, in the sequence permutation method described in Reference 6, it is assumed that the permutation is hidden from all participants. In contrast, in this embodiment, P1 holds any plaintext permutation π. Therefore, in Reference 6, in order to perform arbitrary permutations that are not limited to random permutations, it is necessary to allow for additional communication costs or to add new processing. However, in this embodiment, arbitrary permutations can be performed without any restrictions.

[0116] Furthermore, for example, in the sequence permutation method described in Reference 7, since one participant holds any plaintext permutation, the range of permutations that can be applied is wider, similar to this embodiment. However, conversely, the participant holding the permutation also obtains the permuted sequence. Therefore, in Reference 7, the reference position cannot be hidden for the participant holding the permutation. In contrast, in this embodiment, as described above, the permuted sequence is held only by P2 and P3, and P1, who holds the permutation, does not have the permuted sequence. Therefore, the reference position can also be hidden for P1, who holds the permutation.

[0117] This invention is not limited to the specific embodiments disclosed above, and various modifications, alterations, or combinations with known technologies can be made without departing from the description in the claims.

[0118] [References]

[0119] Reference 1: A. Shamir. How to share a secret. Commun. ACM, Vol. 22, No.11, pp. 612-613, 1979.

[0120] Reference 2: M. Ito, A. Saito, and T. Nishizeki. Secret sharing schemesrealizing general access structures. Proceedings of the IEEE GlobalTelecommunication Conference, Globecom 87, pp. 99-102, 1987.

[0121] Reference 3: Naoto Kiribuchi, Dai Igarashi, Hiroki Hamada, Ryo Kikuchi, MEVAL3 Programmable Secrecy Library. Draft of the Seminar on Cryptography and Information Security (SCIS) 2018 (2018).

[0122] Reference 4: K. Chida, K. Hamada, D. Ikarashi, R. Kikuchi, and B.Pinkas. High-throughput secure AES computation. In WAHC@CCS 2018, pages 13-24, 2018.

[0123] Reference 5: A. Kirsch, M. Mitzenmacher, and U. Wieder. More robusthashing: Cuckoo hashing with a stash. In ESA, pages 611-622, 2008.

[0124] Reference 6: K. Chida, K. Hamada, D. Ikarashi, R. Kikuchi, N. Kiribuchi,B. Pinkas. An efficient secure threeparty sorting protocol with an honestmajority. CryptologyePrint Archive, Report 2019 / 695(2019), https: / / eprint.iacr.org / 2019 / 695

[0125] Reference 7: P. Mohassel, P. Rindal, and M. Rosulek. Fast database joins and PSI for secret shared data. Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (CCS'20). Association for ComputingMachinery, New York, NY, USA, 1271-1287. 2020.

[0126] Symbol Explanation

[0127] 1. Secret Computing System

[0128] Secret computing devices 10, 20, and 30

[0129] Secret Computing Processing Department, Units 101, 201, and 301

[0130] Storage Units 102, 202, and 302

[0131] 40. Communication Network

[0132] 500 computers

[0133] 501 Input Device

[0134] 502 Display Device

[0135] 503 External I / F

[0136] 503a Recording Media

[0137] 504 Communication I / F

[0138] 505 processor

[0139] 506 Memory Device

[0140] 507 bus.

Claims

1. A secret computing system, comprising a first secret computing device, a second secret computing device, and a third secret computing device, each holding a share of a hidden input sequence. The first secret computing device has The first conversion unit converts its own three-party share into a two-party share with the third secret computing device; A first computing unit calculates a result obtained by applying a permutation of its own shares to both parties using the first secret computing device, and subtracts a third sequence obtained by applying a second permutation determined according to the first permutation to the first sequence and a second sequence, wherein the first sequence and the second sequence are determined by a predetermined method; and The first transmitting unit sends the third sequence and the second permutation to the second secret computing device. The third secret computing device has The second conversion unit converts its own three-party share into a two-party share with the first secret computing device; The second calculation unit calculates a fourth sequence by adding the first sequence to the result obtained by applying the first permutation determined according to the permutation to the shares held by itself in both parties; The second transmitting unit sends the fourth sequence to the second secret computing device; as well as The first output unit takes the second sequence as a share between the result obtained by applying the permutation to the input sequence and the second secret computing device. The second secret computing device has The second output unit adds the result of applying the second permutation to the third sequence to the third sequence, and uses this result as a share between the result of applying the permutation to the input sequence and the third secret computing device.

2. The secret computing system according to claim 1, wherein, The first secret computing device has The first determining unit randomly determines the first permutation and the second permutation by taking the synthetic mapping between the first permutation and the second permutation as the permutation; as well as The second determining unit randomly determines the first sequence and the second sequence, which are of the same size as the shares it holds in both parties. The first transmitting unit sends the first permutation, the first sequence, and the second sequence to the third secret computing device.

3. The secret computing system according to claim 1, wherein, The first secret computing device has The third determining unit uses a pseudo-random number generator shared with the third secret computing device and input data for the pseudo-random number generator to determine the first permutation, the first sequence, and the second sequence; and The fourth determining unit determines the composite mapping between the inverse mapping of the first permutation and the permutation as the second permutation. The third secret computing device has The fifth determining unit uses a pseudo-random number generator shared with the first secret computing device and input data for the pseudo-random number generator to determine the first permutation, the first sequence, and the second sequence.

4. The secret computing system according to any one of claims 1 to 3, wherein, The first secret computing device, the second secret computing device, and the third secret computing device share a pseudo-random function capable of performing secret computations. The first secret computing device has The generation unit generates a three-way share of random numbers by generating a random share among the second secret computing device and the third secret computing device. The third computing unit, through secret computation with the second secret computing device and the third secret computing device, takes the three-way share of the random number and each predetermined three-way share contained in each element of the input sequence as input, and calculates the three-way share of the sequence of pseudo-random function values. The first recovery unit recovers the sequence of pseudo-random function values ​​using a three-party share of the sequence of pseudo-random function values ​​sent from the second secret computing device or the third secret computing device, and a three-party share of the sequence of pseudo-random function values ​​held by itself. as well as The permutation generation unit takes the sequence of pseudo-random function values ​​as input and generates the permutation through a predetermined mechanism.

5. The secret computing system according to claim 4, wherein, The second secret computing device has The third computing unit calculates the three-way share of the pseudo-random function value by using the three-way share of the random number and the three-way share of the search keyword for the input sequence as input through secret calculation with the first secret computing device and the third secret computing device. The third sending unit sends its own share of the pseudo-random function value to the third secret computing device; The second recovery unit uses the three-party share of the pseudo-random function value sent from the third secret computing device and the three-party share of the pseudo-random function value held by itself to recover the pseudo-random function value. as well as The first reference position generation unit takes the pseudo-random function value as input and, through the mechanism, generates a reference position value representing the share between the result obtained by applying the permutation to the input sequence and the third secret computing device. The third secret computing device has The fourth computing unit calculates the three-way share of the pseudo-random function value by secretly computing with the first secret computing device and the second secret computing device, taking the three-way share of the random number and the three-way share of the search keyword for the input sequence as input. The fourth sending unit sends its own share of the pseudo-random function value to the second secret computing device. The third recovery unit uses the three-party share of the pseudo-random function value sent from the second secret computing device and the three-party share of the pseudo-random function value held by itself to recover the pseudo-random function value; as well as The second reference position generation unit takes the pseudo-random function value as input and generates, through the mechanism, a reference position value representing the share between the second secret computing device and the result obtained by applying the permutation to the input sequence.

6. A secret computing device that shares a three-way share of a hidden input sequence with other first and second secret computing devices, said secret computing device having: The conversion unit converts its own three-party share into a two-party share with the second secret computing device; The first determining unit randomly determines the first permutation and the second permutation by taking the synthetic mapping between the first permutation and the second permutation as the permutation it holds; The second determining unit randomly determines a first sequence and a second sequence that are the same size as the shares held by itself in both parties; The calculation unit calculates the result obtained by applying the substitution to the shares held by itself in both parties, and subtracts the result obtained by applying the second substitution to the first sequence and the second sequence to obtain a third sequence; A first transmitting unit transmits the third sequence and the second permutation to the first secret computing device; and The second transmitting unit transmits the first permutation, the first sequence, and the second sequence to the second secret computing device.

7. A method for a secret computing system, the secret computing system comprising a first secret computing device, a second secret computing device, and a third secret computing device, each holding a three-party share of a hidden input sequence. The first secret computing device executes The first conversion step involves converting the three-party share held by oneself into a two-party share between oneself and the third secret computing device; The first calculation step involves calculating the result obtained by applying the permutation of the shares held by the parties using the first secret calculation device, and subtracting the result obtained by applying the second permutation determined according to the first permutation to the first sequence and the second sequence to obtain a third sequence, wherein the first sequence and the second sequence are determined by a predetermined method; and In the first sending step, the third sequence and the second permutation are sent to the second secret computing device. The third secret computing device executes The second conversion step involves converting the three-party share held by itself into a two-party share between itself and the first secret computing device; The second calculation step involves calculating the fourth sequence by adding the first sequence to the result obtained by applying the first permutation determined according to the permutation to the shares held by the parties. The second sending step involves sending the fourth sequence to the second secret computing device; as well as In the first output step, the second sequence is taken as the share between the result obtained by applying the permutation to the input sequence and the second secret computing device. The second secret computing device executes The second output step involves adding the result of applying the second permutation to the fourth sequence to the third sequence, as a share between the result of applying the permutation to the input sequence and the third secret computing device.

8. A program product comprising a program that enables a computer to function as a first secret computing device, a second secret computing device, or a third secret computing device included in a secret computing system according to any one of claims 1 to 5.

Images