Secret computation device, secret computation system, secret computation method, and computer program product

Abstract

In X = {{x0,...,x} n‑1}} and Y={{y0,...,y m‑1 In the concealed state, the concealed operation result, representing the concealed information of the Intersect operation result of X and Y, is obtained. The secret computing device obtains a column ([s],[M]), which includes [s] containing n [B0] and m [B1], and [x0],...,[x]... n‑1 ] and [y0],...,[y m‑1 For column ([s],[M]), perform a cross-correlation operation with elements M0,...,M. n+m -1 represents the order of the contents respectively, and the corresponding stable sorting is used to obtain the column ([s'], [M']), which is used as the column in M'. q =M' q+1 time eq q =T, when it is not like that eq q =F of [eq q ], and as in s' q =s' q+1 time seq q =T, when it is not like that, seq q =F of [seq q ], obtained as in eq q =T and seq q =F when f q =D1, when it is not like that f q =D0 of [f q ], and output [f q ] and [M' q [α] represents the anonymized information of α.

Description

Technical Field

[0001] This invention relates to encryption technology, and in particular to secret computation technology. Background Technology

[0002] In a normal set, duplicate elements are not allowed. Therefore, a set that allows duplicate elements is called a "multiset". For two multisets X and Y, the intersection operation is defined as follows.

[0003] Intersect(X,Y) = X'∩Y'

[0004] Here, X' represents the set obtained by removing duplicate elements from the multiset X. That is, X' is the set obtained by replacing multiple identical elements belonging to the multiset X with a single element. Similarly, Y' represents the set obtained by removing duplicate elements from the multiset Y. X'∩Y' represents the intersection of sets X' and Y'.

[0005] Furthermore, there are known methods for secretly calculating the hidden information of two sets by using the hidden information of the two sets, and obtaining the result of the intersection calculation of the two sets while keeping the information hidden (for example, see Non-Patent Literature 1, etc.).

[0006] Existing technical documents

[0007] Non-patent literature

[0008] Non-patent document 1: Hiroshi Hamada, Dai Igarashi, Koji Chida, "Improved Algorithms for Computing Relational Algebra Operators for Secure Function Evaluation", Technical Journal of Communications LOIS2012-82, Vol. 112, No. 446, pp. 76-82, 2013. Summary of the Invention

[0009] The problem that the invention aims to solve

[0010] However, in previous secret computation methods, duplicate elements are not allowed in the sets that are the objects of the intersection computation. Therefore, using the hidden information of two multisets X and Y as input, the hidden information of Intersect(X,Y) cannot be obtained based on previous secret computation methods.

[0011] This problem can be solved by first using the hidden information of two multisets X and Y as input, and then using secret computation to obtain the hidden information of sets X' and Y' after removing duplicate elements of the multisets X and Y. Finally, applying the previous secret computation method to the hidden information of sets X' and Y', the hidden information of the intersection of sets X' and Y' can be obtained.

[0012] However, the computational cost of secret computation to obtain the hidden information of a set from the hidden information of a multiset by removing the duplicate elements of that multiset is very high.

[0013] This invention was made in view of the following point, and aims to provide a technique for using the hidden information of two multisets X, Y as input, and obtaining the hidden operation result representing the hidden information of Intersect(X,Y) through secret computation with low computational cost.

[0014] Methods for solving problems

[0015] The secret computing device of the present invention is as follows, when the first multiset X={{x0,...,x...} is used... n-1 The second multiset Y = {{y0,...,y} m-1 In the concealed state, the concealed operation result is obtained, which represents the concealed information of the Intersect operation result of the first multiset X and the second multiset Y. Here, n and m are positive integers, i=0,...,n-1, j=0,...,m-1, q=0,...,n+m-1, and [α] is the concealed information of α.

[0016] (A) The input flags are assigned to the n first elements [x0],...,[x n-1 ] and m second elements [y0],...,[y m-1 As input, we obtain a column [s] = ([s0], ..., [s1]) containing n first values ​​[B0] and m second values ​​[B1]. n-1 ],[s n ],...,[s n+m-1 ])=([B0],...,[B0],[B1],...,[B1])and contains the first element [x0],...,[x n-1 ] and the second element [y0],...,[y m-1 The column [M] = ([M0],...,[M]) n-1 ],[M n ],...,[M n+m-1 ])=([x0],...,[x n-1 ],[y0],...,[ym-1 A column ([s], [M]) with input flags, where B0 and B1 are different from each other, and the first value of each is [s]. i ]=[B0] and each first element [M i ]=[x i Related to each second value [s] j+n ]=[B1] and each of the second elements [M j+n ]=[y j Related to.

[0017] (B) The stable sorting part, for columns with input labels ([s], [M]), maintains [s]... q ] and [M q Under the state of correspondence with column [M], through secret calculation, the elements M0,...,M corresponding to column [M] are compared. n+m-1 The order of the contents represented by each element is stably sorted, resulting in a sequence containing the sorted values ​​[s'0],...,[s'0]. n+m-1 The column [s'] = ([s'0],...,[s'0]) n+m-1 ]) and sorted elements [M'0],...,[M' n+m-1 The column [M'] = ([M'0],...,[M'0]) n+m-1 The sorted columns ([s'],[M']) of ]).

[0018] (C) The equality determination unit uses the sorted columns ([s'],[M']) to secretly calculate the first equality determination result [eq]. q ] and the result of the second equality judgment [seq q ]. Among them, in M' q =M' q+1 At that time, eq q =T, not M' q =M' q+1 At that time, eq q =F,eq n+m-1 =F, in s' q =s' q+1 At that time, seq q =T, not s' q =s' q+1 , seq q =F, seq n+m-1 =F, T, and F are all different from each other.

[0019] (D) The output flag generation unit uses the first equal sign to determine the result [eq q ] and the result of the second equality judgment [seq q ], through secret calculation, the output flag [f] is obtained. q]. Among them, in "eq q =T and seq q When =F”, f q =D1, in cases where it is not "eq" q =T and seq q When =F”, f q =D0, D1 and D0 are different from each other.

[0020] (E) The output flags assigned to the output include interrelated output flags [f q ] and the sorted elements [M'] of column [M'] q The result of the concealment operation.

[0021] Invention Effects

[0022] Therefore, by using the hidden information of two multisets X and Y as input, the hidden operation result representing the hidden information of Intersect(X,Y) can be obtained through secret computation with low computational cost. Attached Figure Description

[0023] Figure 1 This is a block diagram illustrating the functional structure of a secret computing system in an illustrative implementation.

[0024] Figure 2 This is a block diagram illustrating the functional structure of a secret computing device in an illustrative embodiment.

[0025] Figure 3 This is a flowchart illustrating the secret calculation method for implementing the method.

[0026] Figure 4 This is a block diagram illustrating the hardware structure of a secret computing device in an exemplary embodiment. Detailed Implementation

[0027] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

[0028] [Definition of the term]

[0029] First, define the notation used in the implementation.

[0030] X={{x0,...,x n-1}} represents x0,...,x n-1 Let X be a multiset of elements (the first multiset). Let n represent the elements x0,...,x that belong to the multiset X. n-1 The number of positive integers. n can be 1 or more than 2. i = 0, ..., n-1 are elements x0, ..., x n-1 The index, which denotes the element corresponding to index i of the multiset X as x. iElements x0,...,x n-1 Any two or more elements in the text can represent the same content (e.g., numbers, characters (letters, numbers, etc.), dates, and times), and the elements x0,...,x... can be identical to each other. n-1 Each element can represent entirely different content. In elements x0,...,x n-1 Within each element's content, the relationships between index i and element x0,...,x are defined separately. n-1 The content they represent has a corresponding sequential relationship (order). For example, in elements x0,...,x n-1 When representing numerical values, for features x0,...,x n-1 Each value defines an order (e.g., descending or ascending) corresponding to its magnitude. For example, in features x0,...,x n-1 When representing letters, for elements x0,...,x n-1 Each letter defines the corresponding order relationship (e.g., alphabetical order or its reverse order). For example, in elements x0,...,x n-1 When representing dates and times, for elements x0,...,x n-1 The dates and times represented by each element define the corresponding order (e.g., chronological or retrograde order). For example, in elements x0,...,x n-1 When representing multiple characters such as numbers, letters, and symbols, for elements x0,...,x n-1 The characters each represent define the order relationship between the characters (e.g., character code order or character code reverse order).

[0031] Y={{y0,...,y m-1}} represents y0,...,y m-1 Let Y be a multiset of elements (the second multiset). Let m represent the elements y0,...,y that belong to the multiset Y. m-1 A positive integer representing the number of elements. m can be 1 or more than 2. j=0,...,m-1 are elements y0,...,y m-1 The index, which denotes the element corresponding to index j of the multiset Y as y. j . Elements y0,...,y m-1 Any two or more elements in the array can represent the same content, and the elements y0,...,y m-1 The content represented by each element can also be completely different from the others. For elements y0,...,y... m-1 Also, separate from index j, it defines the relationships with elements y0,...,y m-1The corresponding order of the content. Additionally, the relationship between the elements y0,...,y m-1 The definition of the corresponding order relationship of the content (e.g., descending order, alphabetical order, etc.) and the relationship with elements x0,...,x n-1 The definitions of the corresponding order relationships for each element are the same; for elements x0,...,x n-1 ,y0,...,y m-1 It also defines the elements x0,...,x n-1 ,y0,...,y m-1 The corresponding order of the content.

[0032] (κ0,...,κ) P-1 ) represents P elements κ0,...,κ P-1 Columns. For example, column (κ0,...,κ P-1 ) is a set of elements κ0,...,κ P-1 A vector, but not limited to columns (κ0,...,κ). P-1 The implementation method of ). P represents the column (κ0,...,κ). P-1 The elements κ0,...,κ of ) P-1 The number of positive integers. p=0,...,P-1 are elements κ0,...,κ P-1 The index will correspond to the column (κ0,...,κ). P-1 The elements of index p are represented as κ. p .

[0033] [α] represents the hidden information of α. That is, [α] represents the information obtained by hiding α. When α is multiple elements κ0,...,κ... P-1 The columns (κ0,...,κ) P-1 In the case of ), α = (κ0,...,κ) P-1 It has multiple elements κ0,...,κ P-1 The respective columns of concealed information [κ0],...,[κ] P-1 [α] is also represented as [α]. Here, the concealed information [α] is information capable of secret computation. That is, with α concealed, by using secret computation with the concealed information [α], the concealed information [β] of the computation result β for α can be obtained. Secret computation can be based on secret distribution (e.g., see Non-Patent Document 1, etc.) or on homomorphic encryption. In the former case, [α] is a share obtained by secretly distributing α (sometimes called a secret share or secret distribution value). In the latter case, [α] is the ciphertext obtained by encrypting α using homomorphic encryption.

[0034] <Secret Dispersal>

[0035] Secret distribution is an encryption method that divides data into multiple values ​​(shares) and distributes them among multiple parties. An example of secret distribution is the (K,N) threshold secret distribution. The (K,N) threshold secret distribution is a secret distribution method with the following property: when the original data is divided into N random shares and distributed among multiple parties, if more than K shares are collected, the original data can be reconstructed, but the information of the original data cannot be obtained from shares less than K. Here, K and N are positive integers satisfying K≦N. Specific examples of (K,N) threshold secret distribution include the Shamir secret distribution (e.g., see reference 1, etc.) and the replication secret distribution (e.g., see references 2, 3, etc.).

[0036] Reference 1: Adi Shamir, "How to share a secret," Communications of theACM, Vol. 22, No. 11, pp. 612-613, 1979.

[0037] Reference 2: Mitsuru Ito, Akira Saito, and Takao Nishizeki, "Secretsharing scheme realizing general access structure," Electronics and Communications in Japan (Part III: Fundamental Electronic Science), Vol. 72, No. 9, pp. 56-64, 1989.

[0038] Reference 3: Ronald Cramer, Ivan Damgard, and Yuval Ishai, "Shareconversion, pseudorandom secret-sharing and applications to securecomputation," In Theory of Cryptography Conference, pp. 342-362. Springer, 2005.

[0039] The following examples illustrate operations based on secret computation (for example, see Non-Patent Document 1, etc.).

[0040] <Equals sign determination>

[0041] The so-called equality determination of concealed information [α1], [α2] based on secret computation refers to the operation of taking the concealed information [α1], [α2] (e.g., shares) of α1 and α2 as input and outputting the concealed information [β] (e.g., shares) of β∈{T,F}, where β=T (true) when α1=α2 and β=F (false) when α1=α2. Here, T and F represent mutually distinct values ​​(T≠F), for example, T=1 and F=0. The execution of this operation is described below.

[0042] [β]←E Q ([α1],[α2])

[0043] <NOT operation>

[0044] The so-called NOT operation based on secret computation of concealed information [α] refers to the operation that takes the concealed information [α] of α∈{T,F} as input and outputs the truth value β∈{T,F} of the concealed information [β] when α=T (true) and β=F (false) when α=F (false) and β=T (true). For example, in the case of T=1 and F=0, β=α(XOR)1 is satisfied. Here, α1(XOR)α2 represents the logical XOR of α1 and α2. The execution of this operation is described as follows.

[0045] [β]←N OT ([a])

[0046] <AND operation>

[0047] The so-called AND operation of concealed information [α1] and [α2] based on secret computation refers to using the concealed information [α1] and [α2] of α1 and α2 ∈ {T, F} as input and outputting the logical AND operation β = α1 (AND) α2 ∈ {T, F} concealed information [β]. When α1 = T (true) and α2 = T (true), β = T (true); otherwise, β = F (false). The execution of this operation is described below.

[0048] [β]←A ND ([α1],[α2])

[0049] <Hidden Stable Sort>

[0050] The so-called column based on secret computation is [α] = ([α0],...,[α]). P-1 The hidden stable ordering of ]) means that the columns (α0,...,α) will be ordered together. P-1 The elements α0,...,α P-1 The hidden information [α0],...,[α P-1 Used as input, and output with elements α0,...,α P-1The order of the content they represent, and the corresponding elements α0,...,α P-1 The stable sorting results are α'0,...,α' P-1 The hidden information [α'] = ([α'0],..., [α'0]) P-1 The processing of ]). Here, the stable sorting results α'0,...,α' P-1 It is based on the elements α0,...,α P-1 The order of the content they represent is determined by the elements α0,...,α P-1 The hidden stable sorting is obtained by a stable sorting in descending or ascending order, which can be predetermined or determined based on the input. This hidden stable sorting is achieved by the following two algorithms (GenPerm, S...). ORT )constitute.

[0051] [Π]←GenPerm([α]): The algorithm GenPerm is used to convert [α]=([α0],..., ... P-1 [α] is used as input, and through secret computation, the output is used to convert [α0],...,[α] into the input. P-1 Hidden stable sorting to [α'0],...,[α' P-1 The algorithm for concealing the permutation information Π of ] is as follows.

[0052] [α']←S ORT ([Π],[α]): Algorithm S ORT It is an algorithm that takes [Π] and [α] as input, and obtains [α'] through secret computation and outputs it.

[0053] The method for achieving its high speed is disclosed in reference 4, etc.

[0054] Reference 4: Igarashi Dai, Hamada Hiroshi, Kikuchi Ryo, Chida Koji. "A Design and an Implementation of Super-high-speed Multi-party Sorting: The Day When Multi-party Computation Reaches Scripting Languages: The Day When Multi-party Computation Reaches Scripting Languages),” In CSS2017, pp. 1-8, 2017.

[0055] [Implementation Method]

[0056] Next, embodiments of the present invention will be described.

[0057] <Structure>

[0058] like Figure 1 As illustrated, the secret computing system 1 of this embodiment has W secret computing devices 11-0, ..., 11-(W-1) configured to communicate via a network. Here, W is an integer of 1 or more. For example, when the secret computing devices 11-0, ..., 11-(W-1) perform secret computing based on secret distribution, W is an integer of 2 or more; when performing secret computing based on homomorphic encryption, W is an integer of 1 or more.

[0059] like Figure 2 As illustrated, the secret computing device 11-w (where w = 0, ..., W-1) includes an input unit 111-w, an input flag assignment unit 112-w, a substitution information generation unit 113-w, a stable sorting unit 114-w, an equality determination unit 115-w, an output flag generation unit 116-w, an output flag assignment unit 117-w, a control unit 118-w, and a storage unit 119-w. The secret computing device 11-w executes each process based on the control of the control unit 118-w, and stores the data input to the secret computing device 11-w and the data obtained in each process in the storage unit 119-w, which can be read out as needed for other processes.

[0060] <Processing>

[0061] Secret computing device 11-w (where w = 0, ..., W-1) calculates the multiset (first multiset) X = {{x0, ..., xn} of the number of elements n. n-1 The multiset (second multiset) Y = {{y0,...,y} and the number of elements m. m-1In the hidden state, the hidden information [Z] of the data structure representing the hidden information of the multisets X and Y, Intersect(X,Y)=X'∩Y', is obtained through secret computation and output. Here, X' represents the set from which duplicate elements have been removed from multiset X, and Y' represents the set from which duplicate elements have been removed from multiset Y. For example, if the elements of multisets X and Y represent letters, and n=5 and m=3, and X={{x0,x1,x2,x3,x4}}={{a,a,b,c,d}} and Y={{y0,y1,y2}}={{b,b,c}}, then X'={a,b,c,d} and Y'={b,c}, and Intersect(X,Y)=X'∩Y'={b,c}. Figure 3 To illustrate the secret computing process of the secret computing device 11-w.

[0062] In the input section 111-w of the secret computing device 11-w, the multiple set X={{x0,...,x} is input. n-1 The hidden information [X] = ([x0],...,[x]) n-1 ]) and the multiset Y={{y0,...,y m-1 The hidden information [Y] = ([y0],...,[y]) m-1 In the specific example above, [X] = ([a], [a], [b], [c], [d]) and [Y] = ([b], [b], [c]) are input. [X] and [Y] can be sent from any of the W secret computing devices 11-0, ..., 11-(W-1), or from other devices not shown in the figure (step S111-w).

[0063] In [X] = ([x0],...,[x] n-1 The n elements (first element) contained in the ]) are [x0],...,[x n-1 ] and in [Y] = ([y0],...,[y m-1 The m elements (second element) contained in the ]) are [y0],...,[y m-1 The elements [a], [b], [c], [d] and [b], [c] are input to the input flag assignment unit 112. For example, in the specific example described above, five elements [a], [b], [c], [d] and three elements [b], [b], [c] are input to the input flag assignment unit 112.

[0064] The input flag assignment unit 112 first sets [s0] and [s1] as shown in formulas (1) and (2).

[0065] [s0]=[B0] n =([B0],...,[B0])=([s0],...,[s n-1 ]) (1)

[0066] [s1]=[B1] m =([B1],...,[B1])=([s1],...,[s m-1 ]) (2)

[0067] Here, B0 and B1 are different from each other. There are no restrictions on B0 and B1; for example, it can be B0=0 and B1=1, or it can be B0=1 and B1=0.

[0068] Next, the input flag assignment unit 112 obtains and outputs columns ([s], [M]) containing columns [s] and [M]. Column [s] is obtained by arranging the columns ([B0], ..., [B0]) of n values ​​[B0], ..., [B0] from equation (1) into columns ([B0], ..., [B0]) of m values ​​[B1], ..., [B1] from equation (2), containing n values ​​(first value) [B0] and m values ​​(second value) [B1]. Column [M] is obtained by arranging the columns ([B1], ..., [B1]) of n elements [x0], ..., ... n-1 Arrange m elements [y0],...,[y] to form a sequence. m-1 The result obtained contains n elements [x0],...,[x] n-1 ] and m elements [y0],...,[y m-1 They are expressed as equations (3) and (4) below.

[0069] [s] = ([s0],...,[s]) n-1 ],[s n ],...,[s n+m-1 ])

[0070] =([B0],...,[B0],[B1],...,[B1]) (3)

[0071] [M] = ([M0],...,[M]) n-1 ],[M n ],...,[M n+m-1 ])

[0072] =([x0],...,[x n-1 ],[y0],...,[y m-1 ]) (4)

[0073] Here, in the column with input flags ([s],[M]), [si ]=[B0] and [M i ]=[x i Related to, [s j+n ]=[B1] and [M j+n ]=[y j [B0] is associated with [x], that is, [B0] is assigned to [x] corresponding to the multiset X. i The concealment flag [B1] is assigned to [y] corresponding to the multiset Y. j The concealment flag. For example, the input flag assignment part 112 will ([s0 T ],[X T ]) and ([s1) T ],[Y T The values ​​are combined vertically and output as a column with input flags ([s], [M]). Where α T This represents the transpose of α. That is, the input flag assignment unit 112 outputs, for example, the following column with input flags ([s], [M]).

[0074]

[0075] For example, with X={{a,a,b,c,d}} and Y={{b,b,c}}, and B0=0 and B1=1, the input flag column ([s],[M]) becomes as follows.

[0076]

[0077] Column [M] is sent to the permutation information generation unit 113-w, and the column with input flags ([s], [M]) is sent to the stable sorting unit 114-w (step S112-w).

[0078] The column [M] is input into the permutation information generation unit 113-w. The permutation information generation unit 113-w performs secret calculations, applying the aforementioned algorithm GenPerm ([Π] = ← GenPerm([M])) to the column [M], to obtain the permutation information for ([M0],...,[M]). n-1 ],[M n ],...,[M n+m-1 Hidden stable sorting to ([M'0],...,[M') n-1 ],[M' n ],...,[M' n+m-1 The substitution information Π of the ]) is concealed information [Π] and output. The concealed information [Π] is sent to the stable sorting unit 114-w (step S113-w).

[0079] In the stable sorting unit 114-w, input flag columns ([s], [M]) and concealment information [Π] are input. The stable sorting unit 114-w applies the aforementioned algorithm S to the input flag columns ([s], [M]) and concealment information [Π]. ORT (([s'],[M']) ←S ORT ([Π], ([s], [M]))), for the input flag column ([s], [M]), maintain [s] for q=0,...,n+m-1 q ] and [M q Under the state of correspondence with column [M], through secret calculation, the elements M0,...,M corresponding to column [M] are compared. n+m-1 The order of the contents represented by each element corresponds to a stable sort (hidden stable sort), resulting in the sorted column ([s'], [M']) which is then output. [s'] represents the sorted values ​​[s'0], ..., ... n+m-1 The column [s'] = ([s'0],...,[s'0]) n+m-1 [M'] represents the sorted elements [M'0],...,[M'0],... n+m-1 The column [M'] = ([M'0],...,[M'0]) n+m-1 After sorting, the columns ([s'],[M']) are displayed as follows.

[0080]

[0081] Here, M'0,...,M' n+m-1 The columns are related to elements M0,...,M n+m-1 The order of the content they represent, and the corresponding elements M0,...,M0, are all related. n+m-1 The stable sorting results of the columns, and the sorted values ​​[s'] q ] is stablely ordered to each ordered element [M'] through secret computation. q ] elements [M r Related elements [s] r ]. Where q=0,...,n+m-1, r=0,...,n+m-1. For example, in the case of the input flag column ([s],[M]) illustrated in equation (5), the following sorted column ([s'],[M']) is obtained.

[0082]

[0083] After sorting, the columns ([s'],[M']) are sent to the equality determination unit 115-w, and the column [M'] is sent to the output flag assignment unit 117-w (step S114-w).

[0084] The sorted column ([s'], [M']) is input into the equality determination unit 115-w. Using the sorted column ([s'], [M']), the equality determination unit 115-w, for q=0,...,n+m-1, secretly calculates the equality determination result (the first equality determination result) [eq]. q ] and the result of the equality check (the result of the second equality check) [seq q And output. Where, in M' q =M' q+1 At that time, eq q =T, not M' q =M' q+1 At that time, eq q =F,eq n+m-1 =F, in s' q =s' q+1 At that time, seq q =T, not s' q =s' q+1 At that time, seq q =F, seq n+m-1 =F, T, and F are all distinct. There are no restrictions on T and F; for example, it could be either T=1 and F=0, or T=0 and F=1. These processes can utilize the aforementioned secret computation-based concealment information [M'] q ],[M' q+1 The equality determination of ] and the concealment of information based on secret computation [s' q ],[s' q+1 The equality determination is achieved by using the equality determination part 115-w. For example, the equality determination part 115-w performs a secret calculation for q=0,...,n+m-1 (i.e., q∈[0,n+m)), and executes the following equations (7) and (8) to obtain the equality determination result [eq]. q ] and [seq q And output. These processes have no order dependency, so the processes of equations (7) and (8) can also be performed in parallel for q=0,...,n+m-1.

[0085] [eq q ]←E Q ([M' q ],[M' q+1 ]) Among them, [eq n+m-1 =F]=[F] (7)

[0086] [seq q ]←E Q ([s' q ],[s' q+1 ]) Among them, [seq n+m-1 ]=[F] (8)

[0087] For example, in the case of the sorted columns ([s'],[M']) illustrated in equation (6), if T=1 and F=0 are set, then the equality determination results of equations (9) and (10) can be obtained [eq q ] and [seq q ].

[0088] [eq0]=[1],[eq1]=[0],[eq2]=[1],[eq3]=[1],[eq4]=[0],[eq5]=[1],[eq6]=[0],[eq7]=[0] (9)

[0089] [seq0]=[1],[seq1]=[1],[seq2]=[0],[seq3]=[1],[seq4]=[0],[seq5]=[0],[seq6]=[0],[seq7]=[0] (10)

[0090] Equal sign determination result [eq q ] and [seq q It is sent to the output flag generation unit 116-w (step S115-w).

[0091] The equality determination result [eq] is input into the output flag generation unit 116-w. q ] and [seq q The output flag generation unit 116-w uses the equality sign to determine the result [eq] q ] and [seq q The output flag [f] is obtained through secret computation. q And output it. Among them, in "eq" q =T and seq q When =F”, f q =D1, in cases where it is not "eq" q =T and seq q When =F”, f q =D0, D1, and D0 are all different from each other. D1 and D0 are not limited; for example, it can be either D1=1 and D0=0, or D1=0 and D0=1.

[0092] The process is set to D1=T and D0=F, and can be implemented as shown in the following equation (11) by using the aforementioned NOT operation and AND operation of the concealed information based on secret computation.

[0093] [f q ]←A ND ([eq q ],N OT ([seq q ])) (11)

[0094] Output flags [f q The column [f] is represented as follows.

[0095]

[0096] For example, in the equality determination results of equations (9) and (10) [eq q ] and [seq q In the case of ], if D1=1 and D0=0, then column [f] becomes as follows.

[0097]

[0098] Column [f] is sent to the output flag assignment section 117-w (step S116-w).

[0099] The column [f] and column [M'] are input to the output flag assignment unit 117-w. For q=0,...,n+m-1, the output flag assignment unit 117-w assigns the output flag [f] of column [f]... q ] and the sorted elements [M'] of column [M'] q They are interconnected, and the output includes the interconnected output flags [f] q ] and sorted elements [M' q The result of the concealment operation [Z]. For example, the result of the concealment operation [Z] is represented as follows.

[0100]

[0101] For example, in the case of column [M'] in equation (6) and column [f] in equation (12), the result of the concealment operation [Z] becomes as follows.

[0102]

[0103] The concealment result [Z] represents the concealed information [Intersect(X,Y)] of the Intersect operation result Intersect(X,Y) = X'∩Y' of multisets X and Y. That is, it becomes f in column [f]. h =D1 (where h∈{0,...,n+m-1}) output flags[f h Related sorted elements [M' h The corresponding M' h Become an element of Intersect(X,Y). For example, in equation (13) where D1=1 and D0=0, become f in column [f]. h =1 output flag [f hThe b and c corresponding to the sorted elements [b][c] become elements of Intersect(X,Y) (step S117-w).

[0104] <Features of this embodiment>

[0105] As mentioned above, in the stable sorting section 114-w, while maintaining [s] q ] and [M q Under the state of correspondence with column [M], through secret calculation, the elements M0,...,M corresponding to column [M] are compared. n+m-1 The order of the contents represented by each element is stably sorted accordingly, resulting in the sorted column ([s'], [M']) ([s'] = ([s'0], ..., [s'0]). n+m-1 [M'] = ([M'0],...,[M') n+m-1 The sorted column ([s'],[M']) is then output. Because it is a stable sort, the order of multiple elements in column [M] corresponding to the same content (e.g., the same letter "b") is maintained in the sorted column ([s'],[M']). Here, the order of elements in column [s'] before sorting is also maintained in the sorted column ([s'],[M']). q ] and [M q The correspondence between [M] and [M']. Therefore, the element [M'] corresponds to the column [M'] with the same content. q（1） ],...,[M' q（Q） ]∈{[M'0],...,[M' n+m-1 The elements of the associated column [s'] q（1） ],...,[s' q（Q） ]∈{[s'0],...,[s' n+m-1 The [B0] is formed by a continuous arrangement of one or more [B0] (e.g., [0]) corresponding to the multiset X, or by a continuous arrangement of one or more [B0] (e.g., [0]) corresponding to the multiset X followed by a continuous arrangement of one or more [B1] (e.g., [1]) corresponding to the multiset Y, or by a continuous arrangement of one or more [B1] (e.g., [1]) corresponding to the multiset Y (e.g., refer to equation (6)). Therefore, regarding the output flag [f] obtained by the output flag generation unit 116-w q ], (I) for M' q =M' q+1 And, M' q and M' q+1 [M'] corresponding to mutually distinct multisets X and Y q ], for f q =D1 (e.g., 1), (II) for all other [M' q ], for f q=D0 (e.g., 0) (e.g., refer to equation (13)). Therefore, the element [M'] of (I) q The corresponding M' q It is an element of Intersect(X,Y)=X'∩Y', containing the output flag [f q ] and sorted elements [M' q The concealment result [Z] represents the concealment information [Intersect(X,Y)] of Intersect(X,Y) = X'∩Y'. For example, in the case of X = {{x0,x1,x2,x3,x4}} = {{a,a,b,c,d}} and Y = {{y0,y1,y2}} = {{b,b,c}}, Intersect(X,Y) = {b,c}. In the concealment result [Z] of its corresponding equation (13), the output flag [1] is associated with one sorted element [b] and [c] respectively, and the output flag [0] is associated with other sorted elements.

[0106] Thus, in this embodiment, for each element [M] q ], representing M q The flag indicating whether a set belongs to a multiset X or a multiset Y is hidden and assigned. By utilizing these hidden flags ([s]), regardless of whether multiset X or multiset Y contains duplicate elements, a logical AND operation X'∩Y' can be performed through secret computation to obtain the hidden information [Z] representing the result of the operation [Intersect(X,Y)]. The number of bits of the flag ([s]) is small, and the flags between the flags in the equality determination part 115-w are used for [s' q ] and [s' q+1 The computational cost of determining the equality sign is low. Furthermore, in [s' q ] and [s' q+1 There is no order dependency in the equality determination of ], so the processing of q=0,...,n+m-1 can be performed in parallel. Therefore, the computation of this embodiment can be performed at high speed. Thus, in this embodiment, by using the hidden information [X],[Y] of two multisets X,Y as input, the hidden operation result [Z] representing the hidden information of Intersect(X,Y) can be obtained by secret computation with low computational cost.

[0107] Furthermore, the obfuscated result [Z] can also be used to restore Z, or as an operand in subsequent secret calculations. For example, invalid rows can be removed from the obfuscated result [Z] using the method disclosed in Reference 5, etc., and the result can be used for other database calculations.

[0108] Reference 5: Hiroki Sudo, Dai Igarashi, "The number of rows of secret calculations and the management of the number of lines," In SCIS2021, pp. 1-6, 2021.

[0109] In addition, in the concealment operation result [Z], in a state where invalid rows are left while valid rows are concealed, concealment information indicating whether a row is valid or invalid can be assigned, and subsequent processing can be performed. Alternatively, in the aforementioned input flag assignment unit 112-w, for each ([s], [M]) with input flag columns ([s], [M]) q ],[M q ]) Assigning a representation to M q Whether the valid flag is hidden information [Ψ] q ], in maintaining ([s q ],[M q ],[Ψ q Under the corresponding state of ]), the processing from step S113-w to S117-w is performed, and subsequent processing is carried out.

[0110] [Hardware Structure]

[0111] The secret computing device 11-w in each embodiment is a device constructed by executing a predetermined program using a general-purpose or special-purpose computer, such as a processor (hardware processor) including a CPU (central processing unit), RAM (random-access memory), ROM (read-only memory), etc. That is, the secret computing device 11-w in each embodiment, for example, has processing circuitry configured to implement each of its respective components. The computer may have one processor and memory, or it may have multiple processors and memories. The program may be installed in the computer or pre-recorded in ROM, etc. Furthermore, instead of implementing the functional structure by loading a program like a CPU, a separate electronic circuitry that implements the processing function may be used to construct part or all of the processing unit. Furthermore, the electronic circuitry constituting a device may include multiple CPUs.

[0112] Figure 4 This is a block diagram illustrating the hardware structure of the secret computing device 11-w in various embodiments. For example... Figure 4As illustrated, the secret computing device 11-w in this example includes a CPU (central processing unit) 10a, an input unit 10b, an output unit 10c, RAM (random access memory) 10d, ROM (read-only memory) 10e, auxiliary storage device 10f, and a bus 10g. The CPU 10a in this example has a control unit 10aa, an arithmetic unit 10ab, and a register 10ac, and performs various arithmetic operations according to various programs read into the register 10ac. Furthermore, the input unit 10b includes input terminals for inputting data, a keyboard, a mouse, a touch panel, etc. Furthermore, the output unit 10c includes output terminals for outputting data, a display, a LAN card controlled by the CPU 10a which reads a predetermined program, etc. Furthermore, RAM 10d is an SRAM (Static Random Access Memory), DRAM (Dynamic Random Access Memory), etc., and has a program area 10da for storing a specified program and a data area 10db for storing various data. Furthermore, auxiliary storage device 10f is, for example, a hard disk, MO (Magneto-Optical Disc), semiconductor memory, etc., and has a program area 10fa for storing a specified program and a data area 10fb for storing various data. Furthermore, bus 10g connects CPU 10a, input unit 10b, output unit 10c, RAM 10d, ROM 10e, and auxiliary storage device 10f to enable information exchange. CPU 10a writes the program stored in program area 10fa of auxiliary storage device 10f into program area 10da of RAM 10d according to the read OS (Operating System) program. Similarly, CPU 10a writes various data stored in data area 10fb of auxiliary storage device 10f into data area 10db of RAM 10d. Furthermore, the address on RAM 10d containing the program and data is stored in register 10ac of CPU 10a. The control unit 10aa of CPU 10a sequentially reads these addresses stored in register 10ac, reads the program and data from the area on RAM 10d represented by the read address, and causes the arithmetic unit 10ab to sequentially execute the operations represented by the program, storing the calculation result in register 10ac. This structure realizes the functional structure of the secret computing device 11-w.

[0113] The above-described program can be pre-recorded on a computer-readable recording medium. Examples of computer-readable recording media are non-transitory recording media. Examples of such recording media include magnetic recording devices, optical discs, optical-magnetic recording media, and semiconductor memory.

[0114] The program can be distributed, for example, through the sale, transfer, or lending of portable recording media such as DVDs and CD-ROMs containing the program. Alternatively, the program can be stored in the storage device of a server computer and forwarded from the server computer to other computers via a network, thus distributing the program. As described above, a computer executing such a program may first temporarily store the program recorded on a portable recording medium or the program forwarded from the server computer in its own storage device. Then, during processing, the computer reads the program stored in its own storage device and executes processing following the read program. Furthermore, as another way of executing the program, the computer may directly read the program from a portable recording medium and execute processing following the program; or, each time a program is forwarded from the server computer to the computer, processing following the received program is executed sequentially. Alternatively, the program may not be forwarded from the server computer to the computer, but the processing function is achieved solely through the execution instructions and result acquisition, i.e., the above processing is performed through a so-called ASP (Application Service Provider) type service. Furthermore, in the program of this method, information that conforms to the program is provided as information for use by the computer for processing (data, etc., that are not direct instructions to the computer but have the nature of specifying the computer's processing).

[0115] In various embodiments, the apparatus is configured to be constructed by executing a prescribed program on a computer, but it may also be configured to implement at least a portion of these processing contents only in hardware.

[0116] Furthermore, the present invention is not limited to the embodiments described above. For example, it can be executed not only in a time sequence as described, but also in parallel or individually depending on the processing capability or needs of the device performing the processing. In addition, appropriate modifications can be made without departing from the spirit of the present invention.

[0117] [Potential for Industrial Applications]

[0118] This invention can be applied to the use of performing intersect operations on two multiple sets through secret computation. For example, this invention can be used to perform intersect operations in an RDBMS (Relational Database Management System) through secret computation.

[0119] [Explanation of Symbols]

[0120] 1. Secret Computing System

[0121] 11-w Secret Computing Device

[0122] 112-w Input flag assignment section

[0123] 114-w Stable sorting part

[0124] 115-w Equality Determination Section

[0125] 116-w Output Flag Generation Unit

[0126] 117-w Output flag assignment section.

Claims

1. A secret computing device, wherein the first multiset X = {{x0,...,x...} is used to compute the first multiset X = {{x0,...,x...}. n-1 The second multiset Y = {{y0,...,y} m-1 In a concealed state, a secret computing device obtains the concealed operation result of the concealed information representing the result of the Intersect operation of the first multiset X and the second multiset Y. in, n and m are positive integers, i=0,...,n-1, j=0,...,m-1, q=0,...,n+m-1, and [α] is the hidden information obtained by hiding element α. The secret computing device has: (A) Input flag assignment part, assigning n first elements [x0],...,[x n-1 ] and m second elements [y0],...,[y m-1 As input, a column with input flags ([s], [M]) is obtained, which includes: A column containing n first values ​​[B0] and m second values ​​[B1]. [s] = ([s0],...,[s]) n-1 ],[s n ],...,[s n+m-1 ])=([B0],...,[B0],[B1],...,[B1])and Includes the first element [x0],...,[x n-1 ] and the second element [y0],...,[y m-1 ] column [M]=([M0],...,[M n-1 ],[M n ],...,[M n+m-1 ])=([x0],...,[x n-1 ],[y0],...,[y m-1 ]), Among them, B0 and B1 are different from each other, and their first values ​​are [s]. i ]=[B0] and each first element [M i ]=[x i Related to each second value [s] j+n ]=[B1] and each of the second elements [M j+n ]=[y j [B0] is associated with [x], which is assigned to the [x] corresponding to the first multiset X. i The concealment flag [B1] is assigned to [y] corresponding to the second multiset Y. j The concealment marker; (B) Stable sorting unit, for the column with input flags ([s], [M]), while maintaining [s] q ] and [M q In the state of the correspondence between [M], secret calculation is performed to correlate the elements M0,...,M corresponding to the column [M]. n+m-1 The order of the contents represented by each element is stably sorted, resulting in a sequence containing the sorted values ​​[s'0],...,[s'0]. n+m-1 The column [s'] = ([s'0],...,[s'0]) n+m-1 ]) and sorted elements [M'0],...,[M' n+m-1 The column [M'] = ([M'0],...,[M'0]) n+m-1 The sorted columns ([s'], [M']) after sorting. (C) The equality determination part, in M' q =M' q+1 At that time, eq q =T, where M' is not satisfied q =M' q+1 At that time, eq q =F,eq n+m-1 =F, in s' q =s' q+1 At that time, seq q =T, where s' is not satisfied q =s' q+1 At that time, seq q =F, seq n+m-1 =F, T, and F are all distinct, representing the truth or falsity of the equality judgment result, respectively. Using the sorted columns ([s'],[M']), the first equality determination result [eq] is obtained through secret computation. q ] and the result of the second equality judgment [seq q ]; (D) Output flag generation unit, in "eq q =T and seq q When =F”, f q =D1, where "eq" is not satisfied q =T and seq q When =F”, f q =D0, D1, and D0 are all different, and are either 1 or 0 respectively. Use the result of the first equality sign [eq q ] and the second equality determination result [seq q ], through secret calculation, the output flag [f] is obtained. q ];as well as (E) Output flag assignment unit, the output includes the interrelated output flags [f q ] and the sorted elements [M'] of the column [M'] q The result of the concealment operation.

2. The secret computing device as claimed in claim 1, wherein, (A) The input flag assignment unit obtains the input flag. The column with input flags ([s],[M]) is indicated. (B) The stable sorting part is obtained using The sorted columns ([s'],[M']) are represented. M'0,...,M' n+m-1 The columns are related to the elements M0,...,M n+m-1 The order of the content they represent corresponds to the elements M0,...,M n+m-1 The stable sorting results of the columns, Each sorted value [s' q [M'] is stable sorted into each sorted element by secret calculation in the stable sorting section. q ] elements [M r Related elements [s] r ], r=0,...,n+m-1.

3. A secret computing system having the secret computing device of claim 1 or 2.

4. A secret computation method is to use the first multiset X = {{x0,...,x...} n-1 The second multiset Y = {{y0,...,y} m-1 In a concealed state, a secret computing method for a secret computing device that obtains the concealed operation result representing the concealed information of the Intersect operation result of the first multiset X and the second multiset Y. in, n and m are positive integers, i=0,...,n-1, j=0,...,m-1, q=0,...,n+m-1, and [α] is the hidden information obtained by hiding element α. The secret computation method has the following characteristics: (A) Input flag assignment step: In the input flag assignment section, n first elements [x0],...,[x n-1 ] and m second elements [y0],...,[y m-1 As input, a column with input flags ([s], [M]) is obtained, which includes: A column containing n first values ​​[B0] and m second values ​​[B1]. [s] = ([s0],...,[s]) n-1 ],[s n ],...,[s n+m-1 ])=([B0],...,[B0],[B1],...,[B1])and Includes the first element [x0],...,[x n-1 ] and the second element [y0],...,[y m-1 ] column [M]=([M0],...,[M n-1 ],[M n ],...,[M n+m-1 ])=([x0],...,[x n-1 ],[y0],...,[y m-1 ]), Among them, B0 and B1 are different from each other, and their first values ​​are [s]. i ]=[B0] and each first element [M i ]=[x i Related to each second value [s] j+n ]=[B1] and each of the second elements [M j+n ]=[y j [B0] is associated with [x], which is assigned to the [x] corresponding to the first multiset X. i The concealment flag [B1] is assigned to [y] corresponding to the second multiset Y. j The concealment marker; (B) Stable sorting step: In the stable sorting unit, for the column with input flags ([s], [M]), a secret computation is performed to maintain [s]... q ] and [M q In the state of the correspondence between [M], the elements M0,...,M corresponding to the column [M] are calculated secretly. n+m-1 The order of the contents represented by each element is stably sorted, resulting in a sequence containing the sorted values ​​[s'0],...,[s'0]. n+m-1 The column [s'] = ([s'0],...,[s'0]) n+m-1 ]) and sorted elements [M'0],...,[M' n+m-1 The column [M'] = ([M'0],...,[M'0]) n+m-1 The sorted columns ([s'], [M']) after sorting. (C) Equality check step, in M' q =M' q+1 At that time, eq q =T, where M' is not satisfied q =M' q+1 At that time, eq q =F,eq n+m-1 =F, in s' q =s' q+1 At that time, seq q =T, where s' is not satisfied q =s' q+1 At that time, seq q =F, seq n+m-1 =F, T, and F are all distinct, representing the truth or falsity of the equality judgment result, respectively. In the equality determination section, using the sorted columns ([s'],[M']), the first equality determination result [eq] is obtained through secret calculation. q ] and the result of the second equality judgment [seq q ]; (D) Output flag generation steps, in "eq q =T and seq q When =F”, f q =D1, where "eq" is not satisfied q =T and seq q When =F”, f q =D0, D1, and D0 are all different, and are either 1 or 0 respectively. In the output flag generation section, the first equality determination result [eq] is used. q ] and the second equality determination result [seq q ], through secret calculation, the output flag [f] is obtained. q ];as well as (E) Output flag assignment step: In the output flag assignment section, the output flags [f] containing interrelated values ​​are output. q ] and the sorted elements [M'] of the column [M'] q The result of the concealment operation.

5. A computer program product comprising a computer program for enabling a computer to function as a secret computing device as claimed in claim 1 or 2.

Images