CONFIDENTIAL INFORMATION PROCESSING SYSTEM, CONFIDENTIAL INFORMATION PROCESSING PROCESS AND CONFIDENTIAL INFORMATION PROCESSING PROGRAM

Abstract

A confidential information processing system, conforming to a quantum homomorphic cryptographic technique that satisfies strong circuit confidentiality, comprises an encryption device (400). The encryption device (400) includes an encryption unit (404) that generates a first ciphertext by encrypting a first plaintext using a first public parameter and a first encryption key, and that generates a second ciphertext by encrypting a second plaintext using a second public parameter and a second encryption key. Each of the first and second public parameters is a parameter generated using a security parameter.The first encryption key is an encryption key generated using the first public parameter, and the first decryption key is a decryption key generated using the security parameter. The second encryption key is an encryption key generated using the second public parameter, and the second decryption key is a decryption key generated using the security parameter.

Description

Technical area

[0001] This disclosure relates to a confidential information processing system, a confidential information processing method, and a confidential information processing program. State of the art

[0002] Quantum homomorphic encryption is a cryptographic technique that allows a quantum arithmetic operation to be performed while the data remains encrypted. Although the use of cloud services is widespread, recently, due to cracking, concerns about cloud reliability, and other issues, encrypting data and storing it in the cloud has been considered. Quantum homomorphic encryption can perform an arithmetic operation on encrypted data without decrypting the encrypted data. Therefore, quantum homomorphic encryption is a technique that enables the use of cloud services using quantum computation without compromising security.

[0003] A cryptographic method for improving the security of quantum homomorphic encryption. A cryptographic method that achieves the security that no information about the arithmetic processing of a result of a quantum arithmetic operation is leaked while the data remains encrypted is a quantum homomorphic encryption that satisfies circuit confidentiality. Among the parts of quantum homomorphic encryption that satisfy circuit confidentiality, in particular, a quantum homomorphic encryption that achieves the security that no information about the quantum arithmetic operation of a result of a quantum homomorphic arithmetic operation on a ciphertext not generated by an encryption algorithm is leaked is a quantum homomorphic encryption that satisfies strong circuit confidentiality.Quantum homomorphic encryption, which satisfies strict circuit confidentiality, is implemented when an arithmetic operation is performed on encrypted data by performing the arithmetic operation while the data remains encrypted by quantum homomorphic encryption, which satisfies normal circuit confidentiality, after the input validity is verified. Specifically, input validity consists in generating an encryption key, which is the input of the arithmetic operation, by a key generation algorithm, and generating a ciphertext, which is the input of the arithmetic operation, by an encryption algorithm.Quantum homomorphic encryption that satisfies normal circuit confidentiality is a quantum homomorphic encryption in which circuit confidentiality is only valid for a ciphertext generated by the encryption algorithm.

[0004] Non-Patent Literature 1 discloses a configuration example of quantum homomorphic encryption that satisfies the confidentiality of the memory circuits, and a configuration example of quantum homomorphic encryption that satisfies the confidentiality of the strong circuits and can perform homomorphic arithmetic operation on ciphertexts encrypted with different encryption keys. Reference listNon-patent literature

[0005] Non-patent literature 1: Chardouvelis,O.et al., “Rate-1 Quantum Fully Homomorphic Encryption”, TCC 2021: Theory of Cryptography, pp.149-176, 2021. Summary of the inventionTechnical problem

[0006] Conventional quantum homomorphic encryption that satisfies the circuit confidentiality requirement disclosed in Non-Patent Document 1 uses a special computational problem called the Decisional Small Polynomial Ratio (DSPR) problem as the basis for security. However, it is known that the DSPR problem can be easily solved using a quantum computer. Specifically, for the quantum homomorphic cryptographic technique disclosed in Non-Patent Document 1, the security of homomorphic encryption that satisfies circuit confidentiality using circuit confidentiality as a configuration component depends on the difficulty of the DSPR problem. Therefore, quantum homomorphic encryption that satisfies the strong circuit confidentiality requirement disclosed in Non-Patent Document 1 is not secure even for a quantum computer.

[0007] The present disclosure aims to realize a quantum homomorphic cryptographic technique that ensures strong circuit confidentiality safe for a quantum computer and enables homomorphic operation by quantum computation between ciphertexts encrypted with different encryption keys from each other. Solution to the problem

[0008] A confidential information processing system according to the present disclosure, which conforms to a quantum homomorphic cryptographic technique that satisfies strong circuit confidentiality, the confidential information processing system comprising an encryption device comprising an encryption unit for generating a first ciphertext by encrypting a first plaintext using a first public parameter and a first encryption key, and for generating a second ciphertext by encrypting a second plaintext using a second public parameter and a second encryption key, wherein each of the first public parameter and the second public parameter is a parameter generated using a security parameter, the first encryption key is an encryption key generated using the first public parameter and a first decryption key that is a decryption key generated using the security parameter, and the second encryption key is an encryption key generated using the second public parameter and a second decryption key is a decryption key generated using the security parameter. Advantageous effects of the invention

[0009] According to the present disclosure, it is possible to realize a quantum homomorphic cryptographic technique that ensures strong circuit confidentiality safe for a quantum computer and enables quantum homomorphic operation by quantum computation between ciphertexts encrypted with different encryption keys from each other. Short description of the drawings Fig. 1 is a diagram showing a configuration example of a confidential information processing system 100 according to Embodiment 1. Fig. 2 is a diagram showing a configuration example of a public parameter generation device 200 according to Embodiment 1. Fig. 3 is a diagram showing a configuration example of a key generation device 300 according to Embodiment 1. Fig. 4 is a diagram showing a configuration example of an encryption device 400 according to Embodiment 1. Fig. 5 is a diagram showing a configuration example of a homomorphic arithmetic operation device 500 according to Embodiment 1. Fig. 6 is a diagram showing a configuration example of a decryption device 600 according to Embodiment 1. Fig. 7 is a diagram showing an example of a hardware configuration of each device according to Embodiment 1. Fig. 8 is a flowchart showing an operation of the confidential information processing system 100 according to Embodiment 1. Fig. 9 is a flowchart showing the operation of the confidential information processing system 100 according to Embodiment 1. Fig. 10 is a flowchart showing the operation of the confidential information processing system 100 according to Embodiment 1. Fig. 11 is a diagram showing an example of a hardware configuration for each device according to a modification of Embodiment 1. Description of embodiments

[0010] In the description and drawings of the embodiments, the same elements and corresponding elements are denoted by the same reference numerals. The description of elements denoted by the same reference numerals is omitted or simplified where appropriate. Arrows in the drawings primarily indicate the flow of data or the flow of processing. Furthermore, "unit" can also be interpreted as "device," "circuit," "process," "procedure," "process," "step," or "circuitry." Embodiment 1.

[0011] The present embodiment will be described in detail below with reference to the drawings. *** Description of the configuration ***

[0012] Fig. 1 shows a system configuration example of a confidential information processing system 100 according to the present embodiment. The confidential information processing system 100 includes a public parameter generation device 200, a key generation device 300, an encryption device 400, a homomorphic arithmetic operation device 500, and a decryption device 600, as shown in Fig. 1 shown

[0013] Internet 101 is a communication path connecting public parameter generation device 200, key generation device 300, a plurality of encryption devices 400, homomorphic arithmetic operation device 500, and decryption device 600. Internet 101 is a specific example of a network. Instead of Internet 101, another type of network may be used.

[0014] A specific example of a public parameter generating device 200 is a personal computer (PC). The public parameter generating device 200 generates a public parameter used to generate an encryption key, a decryption key, and a ciphertext, and transmits data indicating the generated public parameter to each of the key generating device 300, the encryption device 400, and the homomorphic arithmetic operation device 500 via the Internet 101. The data indicating the generated public parameter can be transmitted directly by mail or similar means.

[0015] A specific example of a key generation device 300 is a personal computer. The key generation device 300 generates an encryption key used for encryption and a decryption key, transmits data indicating the generated encryption key to the encryption device 400 and the homomorphic arithmetic operation device 500 via the Internet 101, and transmits data indicating the generated decryption key to the decryption device 600. The data indicating each generated key can be transmitted directly by mail or similar means.

[0016] Since the decryption key is secret information, the decryption key is stored in both the key generation device 300 and the decryption device 600 to prevent leakage.

[0017] A specific example of an encryption device 400 is a personal computer. The encryption device 400 generates ciphertext data by encrypting plaintext data obtained from a sensor or the like of a factory using a stored public parameter and a stored encryption key, and transmits the generated ciphertext data to the homomorphic arithmetic operation device 500 via the Internet 101.

[0018] A specific example of the homomorphic arithmetic operation device 500 is a computer with a large-capacity storage medium. The homomorphic arithmetic operation device 500 is also referred to as a circuit-confidential quantum homomorphic arithmetic operation device.

[0019] The homomorphic arithmetic operation device 500 also functions as a data storage device. That is, upon receiving a storage request for ciphertext data from the encryption device 400, the homomorphic arithmetic operation device 500 stores the ciphertext data corresponding to the storage request.

[0020] The homomorphic arithmetic operation device 500 also functions as a device that performs a homomorphic arithmetic operation on stored ciphertext data, i.e., on stored ciphertext data. That is, the homomorphic arithmetic operation device 500 generates ciphertext data from a stored public parameter, a stored encryption key, and stored ciphertext data, which corresponds to a result of an arithmetic operation on plaintext data corresponding to the stored ciphertext data, and transmits the generated ciphertext data to the decryption device 600 via the Internet 101.

[0021] A specific example of a decryption device 600 is a PC. The decryption device 600 also functions as a decryption key storage device, receiving data indicating a decryption key transmitted from the key generation device 300 and storing the decryption key indicated in the received data.

[0022] The decryption device 600 is also a PC that operates as a decryption device for ciphertext data, receives the ciphertext data transmitted from the homomorphic arithmetic operation device 500, and obtains a result of the arithmetic operation by decrypting the received ciphertext data using a stored decryption key.

[0023] At least two of the public parameter generating means 200, the key generating means 300, the encryption means 400, the homomorphic arithmetic operation means 500, and the decryption means 600 may be included in the same PC at the same time.

[0024] A configuration of the present embodiment is described below. The number of elements generated by each device may be two or more.

[0025] Fig. 2 is a block diagram showing a configuration example of the common parameter generating device 200. The common parameter generating device 200 includes an input unit 201, a public parameter generating unit 202, and a transmission unit 203, as shown in Fig. 2. Although not shown, the public parameter generating device 200 includes a storage medium that stores data used in each unit of the public parameter generating device 200.

[0026] The input unit 201 receives data indicating a security parameter λ and transmits the received data indicating the security parameter λ to the public parameter generation unit 202.

[0027] The public parameter generation unit 202 takes the security parameter λ specified in the data received from the input unit 201 as input and generates a public parameter, which is a parameter for generating an encryption key and a decryption key. The public parameter generation unit 202 then transmits data indicating the generated public parameter PP to the transmission unit 203.

[0028] The transmission unit 203 transmits to each of the key generation device 300, the encryption device 400, and the homomorphic arithmetic operation device 500 the data indicating the public parameter PP generated by the public parameter generation unit 202.

[0029] Fig. 3 is a block diagram showing a configuration example of the key generation device 300. The key generation device 300 includes an input unit 301, a public parameter storage unit 302, a decryption key generation unit 303, an encryption key generation unit 304, and a transmission unit 305, as shown in Fig. 3. Although not shown, the key generation device 300 includes a storage medium that stores data used in each unit of the key generation device 300.

[0030] The input unit 301 receives the data indicating the public parameter PP transmitted from the public parameter generation unit 200 and transmits the public parameter PP indicated in the received data to the public parameter storage unit 302.

[0031] Further, the input unit 301 receives the data indicating the security parameter λ and transmits the received data indicating the security parameter λ to the decryption key generation unit 303.

[0032] The public parameter storage unit 302 stores the public parameter PP specified in the data received from the input unit 301.

[0033] The decryption key generation unit 303 generates a decryption key SK using the security parameter λ specified in the data received from the input unit 301, and transmits data indicating the generated decryption key SK to the encryption key generation unit 304 and the transmission unit 305.

[0034] The encryption key generation unit 304 uses the public parameter PP specified in the data received from the public parameter storage unit 302 and the decryption key SK specified in the data received from the decryption key generation unit 303 as input to generate an encryption key PK, and transmits data indicating the generated encryption key PK to the transmission unit 305.

[0035] The encryption key generation unit 304 generates a first encryption key using a first public parameter and a first decryption key, and generates a second encryption key using a second public parameter and a second decryption key. Here, each of the first public parameter and the second public parameter is a parameter generated using the security parameter λ. Each of the first decryption key and the second decryption key is a decryption key generated using the security parameter λ.

[0036] The transmission unit 305 transmits to the decryption device 600 data indicating the decryption key SK generated by the decryption key generation unit 303.

[0037] In addition, the transmission unit 305 transmits the data indicating the encryption key PK generated by the encryption key generation unit 304 to each of the encryption device 400 and the homomorphic arithmetic operation device 500.

[0038] Fig. 4 is a block diagram showing a configuration example of the encryption device 400. The encryption device 400 includes an input unit 401, a public parameter storage unit 402, an encryption key storage unit 403, an encryption unit 404, and a transmission unit 405, as shown in Fig. 4. Although not shown, the encryption device 400 includes a recording medium that stores data used in each unit of the encryption device 400.

[0039] The input unit 401 receives the data indicating the public parameter PP transmitted from the public parameter generation unit 200 and transmits the received data indicating the public parameter PP to the public parameter storage unit 402.

[0040] Further, the input unit 401 receives the data indicating the encryption key PK transmitted from the key generation device 300 and transmits the received data indicating the encryption key PK to the encryption key storage unit 403.

[0041] Furthermore, the input unit 401 receives plaintext data m and transmits the received plaintext data m to the encryption unit 404.

[0042] The public parameter storage unit 402 stores the public parameter PP specified in the data received from the input unit 401.

[0043] The encryption key storage unit 403 stores the encryption key PK specified in the data received from the input unit 401.

[0044] The encryption unit 404 generates ciphertext data C_PK(m) corresponding to the plaintext data m using the public parameter PP received from the public parameter storage unit 402, the encryption key PK received from the encryption key storage unit 403, and the plaintext data m received from the input unit 401, and transmits the generated ciphertext data C_PK(m) to the transmission unit 405. Hereinafter, ciphertext data obtained by encrypting the plaintext data m using the encryption key PK is referred to as ciphertext data C_PK(m).

[0045] The encryption unit 404 generates a first ciphertext by encrypting a first plaintext using the first public parameter and the first encryption key, and generates a second ciphertext by encrypting a second plaintext using the second public parameter and the second encryption key.

[0046] The transmission unit 405 receives the ciphertext data C_PK(m) from the encryption unit 404 and transmits the received ciphertext data C_PK(m) to the homomorphic arithmetic operation device 500.

[0047] Fig. 5 is a block diagram showing a configuration example of the homomorphic arithmetic operation device 500. The homomorphic arithmetic operation device 500 includes an input unit 501, a public parameter storage unit 502, an encryption key storage unit 503, a ciphertext storage unit 504, a homomorphic arithmetic operation unit 505, and a transmission unit 506, as shown in Fig. 5. Although not shown, the homomorphic arithmetic operation device 500 includes a recording medium that stores data used in each unit of the homomorphic arithmetic operation device 500.

[0048] The input unit 501 receives data indicating a public parameter PP1 and data indicating a public parameter PP2 transmitted by the public parameter generation unit 200, and transmits the received data indicating the public parameter PP1 and the received data indicating the public parameter PP2 to the public parameter storage unit 502. Here, the number at the end of the symbol indicating each element is a notation for distinguishing multiple existing elements of the same type from each other. For the public parameter PP1 and the public parameter PP2, 1 or 2 is indicated to distinguish two public parameters PP generated by the public parameter generation unit 200. In addition, the public parameter PP1 corresponds to the first public parameter. The public parameter PP2 corresponds to the second public parameter.

[0049] Furthermore, the input unit 501 receives data indicating an encryption key PK1 and data indicating an encryption key PK2 transmitted from the key generation unit 300, and transmits the received data indicating the encryption key PK1 and the received data indicating the encryption key PK2 to the encryption key storage unit 503. The encryption key PK1 corresponds to the first encryption key. The encryption key PK2 corresponds to the second encryption key. The first encryption key consists of a first homomorphic public key generated based on a first homomorphic decryption key and a first quantum homomorphic public key generated based on a first quantum homomorphic decryption key.The second encryption key consists of a second homomorphic public key generated based on a second homomorphic decryption key and a second quantum homomorphic public key generated based on a second quantum homomorphic decryption key.

[0050] Further, the input unit 501 receives the ciphertext data C_PK(m1) and ciphertext data C_PK(m2) transmitted from the encryption device 400 and transmits the received ciphertext data C_PK(m1) and the received ciphertext data C_PK(m2) to the ciphertext storage unit 504. Here, the plaintext data m1 corresponds to the first plaintext. The plaintext data m2 corresponds to the second plaintext. The ciphertext data C_PK(m1) corresponds to the first ciphertext. The ciphertext data C_PK(m2) corresponds to the second ciphertext. The first ciphertext is a ciphertext generated based on the first public parameter, a first one-time pad key, the first homomorphic public key, the first quantum homomorphic public key, and a first random number.The second ciphertext is a ciphertext generated based on the second public parameter, a second one-time pad key, the second homomorphic public key, the second quantum homomorphic public key, and a second random number.

[0051] Further, the input unit 501 receives data indicating an arithmetic operation circuit f and transmits the received data indicating the arithmetic operation circuit f to the homomorphic arithmetic operation unit 505. The arithmetic operation circuit f may be composed of a plurality of arithmetic operation circuits.

[0052] The public parameter storage unit 502 stores the public parameter PP1 and public parameter PP2 specified in the data received from the input unit 501.

[0053] The encryption key storage unit 503 stores the encryption key PK1 and the encryption key PK2 indicated in the data received from the input unit 501.

[0054] The ciphertext storage unit 504 stores the ciphertext data C_PK(m1) and the ciphertext data C_PK(m2) received from the input unit 501.

[0055] The homomorphic arithmetic operation unit 505 calculates ciphertext data C_PK(M) using the arithmetic operation circuit f specified in the data received from the input unit 501, the public parameter PP1 and public parameter PP2 received from the public parameter storage unit 502, the encryption key PK1 and encryption key PK2 received from the encryption key storage unit 503, and the ciphertext data C_PK(m1) and C_PK(m2) received from the ciphertext storage unit 504, and transmits the calculated ciphertext data C_PK(M) to the transmission unit 506.Here, the ciphertext data C_PK(M) is data indicating a ciphertext corresponding to the arithmetic operation result data M(=f(m1, m2)), which is data indicating an arithmetic operation result obtained by applying an arithmetic operation indicated by the arithmetic operation circuit f to the plaintext data m1 and the plaintext data m2. Furthermore, f(m1, m2) represents a result of executing the arithmetic operation specified by the arithmetic operation circuit f with the plaintext data m1 and the plaintext data m2, which are two pieces of plaintext data, as input. Hereinafter, homomorphically arithmetically operated ciphertext data of the arithmetic operation result data M with respect to a set {PK1, PK2} consisting of the encryption key PK1 and the encryption key PK2 is represented as C_PK(M). C_PK(M) is also referred to as homomorphically operated ciphertext data.Here, the plaintext data m1 corresponds to the first plaintext. The plaintext data m2 corresponds to the second plaintext. C_PK(M) corresponds to a third ciphertext. The arithmetic operation result data M can be decrypted using a decryption key SK1 and a decryption key SK2 for the ciphertext data C_PK(M). The decryption key SK1 corresponds to the first decryption key. The decryption key SK2 corresponds to the second decryption key. The first decryption key consists of the first homomorphic decryption key and the first quantum homomorphic decryption key. The second decryption key consists of the second homomorphic decryption key and the second quantum homomorphic decryption key.

[0056] The homomorphic arithmetic operation unit 505 generates the third ciphertext by performing quantum computation using the first public parameter, the second public parameter, the first ciphertext, the second ciphertext, the first encryption key, and the second encryption key. Here, the third ciphertext is a ciphertext generated by encrypting an arithmetic operation result obtained by applying an arithmetic operation specified by the arithmetic operation circuit f to the first plaintext and the second plaintext. The arithmetic operation circuit f may each include a part for calculating a first decryption random number and a part for calculating a second decryption random number.The first decryption random number is a random number calculated based on the security parameter, the first one-time pad key, the first one-time pad key ciphertext data, the first quantum homomorphic public key, and the first random number, and is a random number for decrypting the third ciphertext. The second decryption random number is a random number calculated based on the security parameter, the second one-time pad key, the second one-time pad key ciphertext data, the second quantum homomorphic public key, and the second random number, and is a random number for decrypting the third ciphertext.When at least one of the first encryption key, the second encryption key, the first ciphertext, and the second ciphertext has not been generated, the homomorphic arithmetic operation unit 505 generates random quantum data as the third ciphertext.

[0057] The homomorphic arithmetic operation unit 505 determines whether the first encryption key has been generated by the encryption device based on whether the first decryption random number has been generated, and determines whether the second encryption key has been generated by the encryption device based on whether the second decryption random number has been generated. The homomorphic arithmetic operation unit 505 determines whether the first ciphertext has been generated by the encryption device based on whether the first decryption random number has been generated, and determines whether the second ciphertext has been generated by the encryption device based on whether the second decryption random number has been generated.

[0058] The transmission unit 506 transmits the arithmetically operated ciphertext data C_PK(M) received from the homomorphic arithmetic operation unit 505 to the decryption device 600.

[0059] Fig. is a block diagram showing a configuration example of the decryption device 600. The decryption device 600 includes an input unit 601, a decryption key storage unit 602, a decryption processing unit 603, and a decryption result storage unit 604, as shown in Fig. 6. Although not shown, the decryption device 600 includes a recording medium that stores data used in each unit of the decryption device 600.

[0060] The input unit 601 receives data indicating the decryption key SK1 and data indicating the decryption key SK2 transmitted by the key generation device 300, and transmits the received data indicating the decryption key SK1 and the received data indicating the decryption key SK2 to the decryption key storage unit 602.

[0061] Further, the input unit 601 receives the arithmetic-operated ciphertext data C_PK(M) of the arithmetic operation result data M with respect to the set PK={PK1, PK2} of the encryption key transmitted from the homomorphic arithmetic operation device 500, and transmits the received arithmetic-operated ciphertext data C_PK(M) to the decryption processing unit 603.

[0062] The decryption key storage unit 602 stores the decryption key SK1 and the decryption key SK2 indicated in the data received from the input unit 601.

[0063] The decryption processing unit 603 receives the arithmetic operation ciphertext data C_PK(M) from the input unit 601, receives the decryption key SK1 and the decryption key SK2 from the decryption key storage unit 602, decrypts the arithmetic operation result data M encrypted using the decryption key SK1 and the decryption key SK2 received for the received arithmetic operation ciphertext data C_PK(M), and transmits the decrypted arithmetic operation result data M to the decryption result storage unit 604.

[0064] The decryption result storage unit 604 receives the arithmetic operation result data M from the decryption processing unit 603 and stores the received arithmetic operation result data M.

[0065] Fig. Fig. 7 is a diagram showing an example of the hardware resources of each device according to the present embodiment. Each device is a general computer including a processor 11 (central processing unit) as shown in Fig. 7 shown.

[0066] A specific example of the processor 11 is a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU). The processor 11 is connected to and controls hardware devices such as a read-only memory (ROM) 13, a random access memory (RAM) 14, a communication board 15, a display 31 (display device), a keyboard 32, a mouse 33, a drive 34, and a magnetic disk device 20 via a bus 12. The drive 34 is a device that reads from and writes to a storage medium such as a flexible disk drive (FD), a compact disc (CD), and a digital versatile disc (DVD).

[0067] The ROM 13, the RAM 14, the magnetic disk device 20 and the drive 34 are examples of storage devices.

[0068] The keyboard 32, the mouse 33 and the communication board 15 are examples of input devices.

[0069] The display 31 and the communication board 15 are examples of output devices.

[0070] The communication board 15 is connected wired or wirelessly to a communication network such as a local area network (LAN), the Internet, or a telephone line.

[0071] The magnetic disk device 20 stores an operating system (OS) 21, a program group 22 and a file group 23.

[0072] Program group 22 includes programs that perform functions described in the present embodiment as each "unit." The programs are read and executed by processor 11. That is, the programs cause a computer to operate as each "unit" and cause the computer to execute a process or method of each "unit."

[0073] The file group 23 includes various pieces of data (input, output, determination results, calculation results, and processing results, etc.) used in each “unit” described in the present embodiment.

[0074] Processes of the present embodiment described using flowcharts or the like are executed using hardware such as the processor 11, a storage device, an input device, and an output device.

[0075] What is described as each “unit” can be implemented by firmware, software, hardware, or a combination thereof.

[0076] Any program described in this specification may be recorded on a computer-readable, non-volatile recording medium. A specific example of a non-volatile recording medium is an optical disk or flash memory. Any program described in this specification may be provided as a program product. *** Description of a business ***

[0077] An operation of the confidential information processing system 100 corresponds to a confidential information processing method. The confidential information processing method is also a general term for methods corresponding to the operations of the individual devices that make up the confidential information processing system 100. Furthermore, a program that implements the operation of the confidential information processing system 100 is synonymous with a confidential information processing program. The confidential information processing program is also a general term for programs that implement the operations of the individual devices that make up the confidential information processing system 100.

[0078] Fig. Fig. 8 is a flowchart showing an example of the generation and storage of a public parameter in the confidential information processing system 100. The processes of generation and storage of the public parameter are described in Fig. 8 described.

[0079] Steps S701 to S703 are processes executed by the public parameter generating means 200, steps S704 to S705 are processes executed by the key generating means 300, steps S706 to S707 are processes executed by the encryption means 400, and steps S708 to S709 are processes executed by the homomorphic arithmetic operation means 500. (Step S701)

[0080] The input unit 201 receives the security parameter λ. (Step S702)

[0081] The public parameter generation unit 202 takes the security parameter λ received from the input unit 201 in step S701 as input and generates the public parameter PP. (Step S703)

[0082] The transmission unit 203 receives the public parameter PP generated by the public parameter generation unit 202 in step S702 and transmits data indicating the received public parameter PP to each of the key generation device 300, the encryption device 400, and the homomorphic arithmetic operation device 500. (Step S704)

[0083] The input unit 301 receives the data indicating the public parameter PP received from the transmission unit 203 in step S703. (Step S705)

[0084] The public parameter storage unit 302 stores the public parameter PP specified in the data received from the input unit 301 in step S704. (Step S706)

[0085] The input unit 401 receives in step S703 the data transmitted from the transmission unit 203 indicating the public parameter PP. (Step S707)

[0086] The public parameter storage unit 402 stores the public parameter PP specified in the data received from the input unit 401 in step S706. (Step S708)

[0087] The input unit 501 receives in step S703 the data transmitted from the transmission unit 203 indicating the public parameter PP. (Step S709)

[0088] The public parameter storage unit 502 stores the public parameter PP specified in the data received from the input unit 501 in step S708.

[0089] Fig. Fig. 9 is a flowchart showing an example of a process for generating and storing an encryption key and a decryption key in the confidential information processing system 100. The processes of generating and storing the encryption key and the decryption key are explained using Fig. 9 described.

[0090] Steps S801 to S804 are processes executed by the key generation device 300, steps S805 to S806 are processes executed by the encryption device 400, steps S807 to S808 are processes executed by the homomorphic arithmetic operation device 500, and steps S809 to S810 are processes executed by the decryption device 600. (Step S801)

[0091] The input unit 301 receives the data indicating the security parameter λ. (Step S802)

[0092] The decryption key generation unit 303 takes as input the security parameter λ specified in the data received from the input unit 301 in step S801 and generates a decryption key SK expressed in a format such as [Formula 1]. SK=(sk,qsk)

[0093] Here, a homomorphic decryption key sk is generated using a homomorphic key generation algorithm described in [Reference 1] with the security parameter λ as input. Furthermore, a quantum homomorphic decryption key qsk is generated using a quantum homomorphic key generation algorithm described in [Reference 2] with the security parameter λ and a random number r as input. [Reference 1]

[0094] Ostrovsky, R. et al., “Maliciously Circuit-private FHE.”, CRYPTO 2014: Advances in Cryptology-CRYPTO 2014, pp. 536-553, 2014. [Reference 2]

[0095] Agarwal, A. et al., “Post-Quantum Multi-Party Computation,” EUROCRYPT 2021: Advances in Cryptology - EUROCRYPT 2021, pp. 435-464, 2021. (Step S803)

[0096] The encryption key generation unit 304 takes the decryption key SK generated by the decryption key generation unit 303 in step S802 and the public parameter PP stored in the public parameter storage unit 302 as input, and generates the encryption key PK in a format such as [Formula 2]. PK=(pk,qpk,[r])

[0097] Here, a homomorphic public key pk is generated using the homomorphic key generation algorithm described in [Reference 1] and the homomorphic decryption key sk as input. A quantum homomorphic public key qpk is generated using the quantum homomorphic key generation algorithm described in [Reference 2], with the public parameter PP, the quantum homomorphic decryption key qsk, and the random number r as input. Furthermore, a random number ciphertext [r] is generated using a homomorphic encryption algorithm described in [Reference 1], with the random number r and the homomorphic public key pk as input. (Step S804)

[0098] The transmission unit 305 receives the data indicating the decryption key SK generated by the decryption key generation unit 303 in step S802 and the data indicating the encryption key PK generated by the key generation unit 304 in step S803, transmits the received data indicating the encryption key PK to each of the encryption devices 400 and the homomorphic arithmetic operation device 500, and transmits the received data indicating the decryption key SK to the decryption device 600. (Step S805)

[0099] The input unit 401 receives in step S804 the data transmitted from the transmission unit 305 indicating the public parameter PP. (Step S806)

[0100] The encryption key storage unit 403 stores the encryption key PK indicated in the data received from the input unit 401 in step S805. (Step S807)

[0101] The input unit 501 receives the data indicating the encryption key PK transmitted from the transmission unit 305 in step S804. (Step S808)

[0102] The encryption key storage unit 503 stores the encryption key PK indicated in the data received from the input unit 501 in step S807. (Step S809)

[0103] The input unit 601 receives the data transmitted from the transmission unit 305 indicating the decryption key SK in step S804. (Step S810)

[0104] The decryption key storage unit 602 stores the decryption key SK indicated in the data received from the input unit 601 in step S809.

[0105] Since the decryption key SK is secret information, the decryption key storage unit 602 needs to strictly store the decryption key SK to prevent the decryption key SK from being leaked.

[0106] Fig. Fig. 10 is a flowchart showing an example of the homomorphic arithmetic operation in the confidential information processing system 100. The homomorphic arithmetic operation will be explained with reference to Fig. 10 described.

[0107] Steps S901 to S903 are processes executed by the encryption device 400, steps S904 to S908 are processes executed by the homomorphic arithmetic operation device 500, and steps S909 to S911 are processes executed by the decryption device 600. (Step S901)

[0108] The input unit 401 receives the plaintext data m1 and the plaintext data m2 collected, for example, by a sensor, and transmits the received plaintext data m1 and the received plaintext data m2 to the encryption unit 404. (Step S902)

[0109] The encryption unit 404 generates the ciphertext data C_PK(m1) and the ciphertext data C_PK(m2) expressed in a format such as [Formula 3] from the plaintext data m1 and the plaintext data m2 received from the input unit 401 in step S901, the public parameter PP1 and the public parameter PP2 stored in the public parameter storage unit 402, and the encryption key PK1 and the encryption key PK2 stored in the encryption key storage unit 403. The notation in a formula may differ from the notation in the present text depending on the character format that can be expressed. CPK(m1)=(c1,[[otk1]]1,[otk1,s1]1) CPK(m2)=(c2,[[otk2]]2,[otk2,s2]2)

[0110] Here, quantum ciphertext data c1 and quantum ciphertext data c2 are generated using a quantum one-time pad encryption algorithm described in [Reference 2], each with a one-time pad key otk1 and a one-time pad key otk2 as input. The one-time pad key otk1 corresponds to the first one-time pad key. The one-time pad key otk2 corresponds to the second one-time pad key. Both [[otk1]]_1 and [[otk2]]_2, which are one-time pad key ciphertext data, are generated using a multi-key quantum homomorphic encryption algorithm described in [Reference 2] with the one-time pad key otk1 or the one-time pad key otk2, a quantum homomorphic public key qpk1 or a quantum homomorphic public key qpk2, and a random number s1 or a random number s2 as input.The quantum homomorphic public key qpk1 corresponds to the first quantum homomorphic public key. The quantum homomorphic public key qpk2 corresponds to the second quantum homomorphic public key. Both the public parameter PP1 and the public parameter PP2 are used as input to the multi-key quantum homomorphic encryption algorithm. Furthermore, [otk1, s1]_1 and [otk2, s2]_2, which are one-time pad keys and random number ciphertext data, are each generated using the homomorphic encryption algorithm described in [Reference 1] with the one-time pad key otk1 or the one-time pad key otk2, a homomorphic public key pk1 or a homomorphic public key pk2, and the random number s1 or the random number s2 as input. The homomorphic public key pk1 corresponds to the first homomorphic public key.The homomorphic public key pk2 corresponds to the second homomorphic public key. The random number s1 corresponds to the first random number. The random number s2 corresponds to the second random number. The encryption unit 404 transmits the ciphertext data C_PK(m1) and the ciphertext data C_PK(m2) to the transmission unit 405 of the encryption device 400. (Step S903)

[0111] The transmission unit 405 receives the ciphertext data C_PK(m1) and the ciphertext data C_PK(m2) transmitted from the encryption unit 404 in step S902, and transmits the received ciphertext data C_PK(m1) and the received ciphertext data C_PK(m2) to the homomorphic arithmetic operation device 500. (Step S904)

[0112] The input unit 501 receives the ciphertext data C_PK(m1) and ciphertext data C_PK(m2) transmitted from the transmission unit 405 and transmits the received ciphertext data C_PK(m1) and the received ciphertext data C_PK(m2) to the ciphertext storage unit 504. (Step S905)

[0113] The ciphertext storage unit 504 receives the ciphertext data C_PK(m1) and the ciphertext data C_PK(m2) transmitted from the input unit 501 in step S904, and stores the received ciphertext data C_PK(m1) and the received ciphertext data C_PK(m2). (Step S906)

[0114] The input unit 501 receives the arithmetic operation circuit f input via a keyboard, a mouse, a storage device, or the like, and transmits the received arithmetic operation circuit f to the homomorphic arithmetic operation device 505. (Step S907)

[0115] The homomorphic arithmetic operation unit 505 generates, with the arithmetic operation circuit f received from the input unit 501, the arithmetic operation result data C_PK(M) corresponding to the arithmetic operation result data M(=f(m1, m2)) corresponding to the set of encryption keys {PK1, PK2} in the format of [Formula 4], the public parameter PP1 and the public parameter PP2 stored in the public parameter storage unit 502, the encryption key PK1 and the encryption key PK2 stored in the encryption key storage unit 503, and the ciphertext data C_PK(m1) and the ciphertext data C_PK(m2) stored in the ciphertext storage unit 504 as input, and transmits the generated arithmetic operation result data C_PK(M) to the transmission unit 506. CPK(M)=(c',(c1',c2))

[0116] Here, quantum homomorphic arithmetic ciphertext data c' is generated according to a method described in [Formula 5]. The quantum homomorphic arithmetic partial ciphertext data c1' and c2' are respectively generated using a homomorphic arithmetic algorithm described in [Reference 1] with an arithmetic operation circuit described in [Formula 7] or [Formula 8], the homomorphic public key pk1 or the homomorphic public key pk2, random number ciphertext data [r1]_1 or random number ciphertext data [r2]_2, and [otk1, s1]_1 or [otk2, s2]_2, which are one-time pad keys and random number ciphertext data, as input. c'=QOTP.Enc(otk',c")

[0117] An algorithm QOTP.Enc here is the quantum one-time pad encryption algorithm described in [Reference 2], and the one-time pad key otk' is a randomly selected bit sequence. Furthermore, c" is generated using a quantum homomorphic arithmetic algorithm described in [Reference 2] with a quantum circuit G expressed by [Formula 6], the quantum homomorphic public key qpk1 and the quantum homomorphic public key qpk2, and [[otk1]]_1 and [[otk2]]_2, which are one-time pad key ciphertext data, as input. Both the public parameter PP1 and the public parameter PP2 are used as input to the quantum homomorphic arithmetic algorithm. Gc1,c2(otk1,otk2)=f(QOTP.Dec(otk1,c1),QOTP.Dec(otk2,c2))

[0118] The algorithm QOTP.Dec is a quantum one-time pad decryption algorithm described in [Reference 2]. Tqpk1,[[otk1]]1,ρ1(r1,otk1,s1)={ρ1if (⋅,qpk1)=MKQFHE. Gen(1λ,r1)0 and [[otk1]]1=MKQFHE. Enc(qpk1,otk1,s1)otherwise Tqpk2,[[otk2]]2,ρ2(r2,otk2,s2)={ρ2if (⋅,qpk2)=MKQFHE. Gen(1λ,r2)0 and [[otk2]]2=MKQFHE. Enc(qpk2,otk2,s2)otherwise1

[0119] The algorithms MKQFHE.Gen and MKQFHE.Enc are, respectively, the quantum homomorphic key generation algorithm and the quantum homomorphic encryption algorithm described in [Reference 2]. Furthermore, a random number ρ1 and a random number ρ2 are random numbers for decrypting ciphertext data, and are numbers that satisfy the relationship of [Formula 9] with respect to the one-time pad key otk'. [Formula 7] corresponds to the part that calculates the first decryption random number. [Formula 8] corresponds to the part that calculates the second decryption random number. The random number ρ1 corresponds to the first decryption random number. The random number ρ2 corresponds to the second decryption random number.

[0120] The homomorphic arithmetic operation unit 505 checks whether each of the encryption keys PK and each piece of ciphertext data C_PK(m) is correctly generated by performing the arithmetic operation specified by the arithmetic operation circuit f described in [Formula 7] and [Formula 8] while the data remains encrypted. When an encryption key not generated by the key generation device 300 is used in the homomorphic arithmetic operation unit 505, the random number ρ1 and the random number ρ2 cannot be obtained in the decryption device 600 due to the configuration of the arithmetic operation circuit f described in [Formula 7] and [Formula 8].Even if ciphertext data not generated by the encryption device 400 is used in the homomorphic arithmetic operation unit 505, the random number ρ1 and the random number ρ2 cannot be obtained in the decryption device 600 in a similar manner. otk'=XOR(ρ1,ρ2)

[0121] Here, an arithmetic operation circuit XOR is a circuit that calculates a bitwise XOR of ρ1 and ρ2 input to the circuit. (Step S908)

[0122] The transmission unit 506 transmits the arithmetically operated ciphertext data C_PK(M) received from the homomorphic arithmetic operation unit 505 to the decryption device 600 in step S907. (Step S909)

[0123] The input unit 601 receives the arithmetic-operated ciphertext data C_PK(M) transmitted from the transmission unit 506 in step S908 and transmits the received arithmetic-operated ciphertext data C_PK(M) to the decryption processing unit 603. (Step S910)

[0124] The decryption processing unit 603 obtains a decryption result M by performing a decryption process using the arithmetic-operated ciphertext data C_PK(M) transmitted from the input unit 601 in step S909 and the decryption key SK1 and the decryption key SK2 stored in the decryption key storage unit 602. Here, for the encryption key set {PK1, PK2} corresponding to the arithmetically operated ciphertext data C_PK(M), the decryption processing unit 603 can decrypt the decryption result M(=f(m1, m2)) only when the encryption key PK1 is generated in the encryption key generation unit 304 with the decryption key SK1 as input and the encryption key PK2 is generated in the encryption key generation unit 304 with the decryption key SK2 as input.

[0125] The decryption processing unit 603 transmits the decryption result M to the decryption result storage unit 604. (Step S911)

[0126] The decryption result storage unit 604 stores the decryption result M transmitted from the decryption processing unit 603 in step S910.

[0127] A ciphertext to be received by the decryption device 600 is a ciphertext to which the homomorphic arithmetic operation has been applied. Therefore, when the ciphertext is to be decrypted before the homomorphic arithmetic operation is applied, the plaintext data corresponding to the ciphertext before the homomorphic arithmetic operation is applied can be decrypted by requesting the homomorphic arithmetic operation device 500 to perform the homomorphic arithmetic operation that outputs the same value as the input itself, and by decrypting a ciphertext to which the homomorphic arithmetic operation has been applied, which was obtained by performing the homomorphic arithmetic operation, in the same manner as in step S910.

[0128] Step S911 terminates the homomorphic arithmetic processing of the confidential information processing system 100. *** Description of the effects of embodiment 1 ***

[0129] As described above, the present embodiment internally uses homomorphic encryption that satisfies circuit confidentiality for a quantum computer. Each of the cryptographic techniques described in [Reference 1] and [Reference 2] provides security for the quantum computer. Therefore, a quantum homomorphic encryption method that satisfies strong circuit confidentiality according to the present embodiment also provides security for the quantum computer. On the other hand, since homomorphic encryption that satisfies circuit confidentiality, which is not secure for the quantum computer, is internally used, the conventional technique does not provide security for the quantum computer.

[0130] Furthermore, since the present embodiment provides security against quantum computers, it is possible to adjust parameters more efficiently and implement an encryption method. However, since the conventional technique does not provide security for quantum computers, a ciphertext large enough to ensure security for the quantum computer must be calculated.

[0131] Accordingly, according to the present embodiment, it is not necessary to generate a ciphertext that is secure for a quantum computer and whose size is sufficiently large. *** Other configurations ***<Modifikation 1>

[0132] Fig. 11 shows an example of the hardware configuration of each device according to the present modification.

[0133] Each device includes a processing circuit 18 instead of the processor 11, the processor 11 and the ROM 13, the processor 11 and the RAM 14, or the processor 11, the ROM 13, and the RAM 14.

[0134] The processing circuit 18 is hardware that implements at least a portion of each unit included in each device.

[0135] The processing circuit 18 may be dedicated hardware or a processor that executes a program stored in RAM 14.

[0136] When the processing circuit 18 is dedicated hardware, a specific example of the processing circuit 18 is a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a combination thereof.

[0137] Each device may include a plurality of processing circuits as an alternative to processing circuit 18. The plurality of processing circuits share the role of processing circuit 18.

[0138] In each device, some functions may be implemented by dedicated hardware and the remaining functions may be implemented by software or firmware.

[0139] In a specific example, the processing circuit 18 is implemented by hardware, software, firmware, or a combination thereof.

[0140] The processor 11, the ROM 13, the RAM 14, and the processing circuit 18 are collectively referred to as the "processing circuit." That is, the functions of the individual functional components of each device are implemented by the processing circuit. *** Further embodiments ***

[0141] While Embodiment 1 has been described, various parts of the present embodiment may be implemented in combination. Alternatively, the present embodiment may be implemented in parts. Furthermore, the present embodiment may be modified in various ways as needed, and may be implemented in whole or in part in any combination.

[0142] The embodiments described above are essentially preferred examples and are not intended to limit the present disclosure, its applicability, or the scope of its uses. The methods described in the flowcharts and the like may be modified as appropriate. List of reference symbols

[0143] 11: Processor; 12: Bus; 13: ROM; 14: RAM; 15: Communication board; 18: Processing circuit; 20: Magnetic disk device; 21: OS; 22: Program group; 23: File group; 31: Display; 32: Keyboard; 33: Mouse; 34: Disk drive; 100: Confidential information processing system; 101: Internet; 200: Public parameter generation device; 201: Input unit; 202: Public parameter generation unit; 203: Transmission unit; 300: Key generation device; 301: Input unit; 302: Public parameter storage unit; 303: Decryption key generation unit; 304: Encryption key generation unit; 305: Transmission unit; 400: Encryption device; 401: Input unit; 402: Public parameter storage unit; 403: Encryption key storage unit; 404: Encryption unit; 405: Transmission unit; 500: Homomorphic arithmetic operation device; 501: Input unit; 502: Public parameter storage unit;503: Encryption key storage unit; 504: Ciphertext storage unit; 505: Homomorphic arithmetic operation unit; 506: Transmission unit; 600: Decryption device; 601: Input unit; 602: Decryption key storage unit; 603: Decryption processing unit; 604: Decryption result storage unit. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited non-patent literature

[0000] Chardouvelis,O.et al., “Rate-1 Quantum Fully Homomorphic Encryption”, TCC 2021: Theory of Cryptography, pp.149-176, 2021

[0005] Ostrovsky, R. et al., „Maliciously Circuit-private FHE.“, CRYPTO 2014: Advances in Cryptology-CRYPTO 2014, S. 536-553, 2014

[0094] Agarwal, A. et al., „Post-Quantum Multi-Party Computation“, EUROCRYPT 2021: Fortschritte in der Kryptologie - EUROCRYPT 2021, S. 435-464, 2021

[0095]

Claims

[1] Confidential information processing system corresponding to a quantum homomorphic cryptographic technique that satisfies strong circuit confidentiality, the confidential information processing system comprising an encryption device comprising an encryption unit for generating a first ciphertext by encrypting a first plaintext using a first public parameter and a first encryption key, and for generating a second ciphertext by encrypting a second plaintext using a second public parameter and a second encryption key, wherein each of the first public parameter and the second public parameter is a parameter generated using a security parameter, the first encryption key is an encryption key generated using the first public parameter and a first decryption key that is a decryption key generated using the security parameter, and the second encryption key is an encryption key generated using the second public parameter and a second decryption key is a decryption key generated using the security parameter. [2] The confidential information processing system according to claim 1, further comprising a key generating device having an encryption key generating unit for generating the first encryption key using the first public parameter and the first decryption key, and for generating the second encryption key using the second public parameter and the second decryption key. [3] The confidential information processing system according to claim 1 or 2, further comprising a homomorphic arithmetic operation device having a homomorphic arithmetic operation unit for generating a third ciphertext, which is a ciphertext generated by encrypting an arithmetic operation result obtained by applying an arithmetic operation indicated by an arithmetic operation circuit to the first plaintext and the second plaintext, by performing quantum computation using the arithmetic operation circuit, the first public parameter, the second public parameter, the first ciphertext, the second ciphertext, the first encryption key, and the second encryption key. [4] The confidential information processing system according to claim 3, wherein when at least one of the first encryption key, the second encryption key, the first ciphertext, and the second ciphertext has not been generated, the homomorphic arithmetic operation unit generates random quantum data as the third ciphertext. [5] A confidential information processing system according to claim 3 or 4, wherein the first decryption key consists of a first homomorphic decryption key and a first quantum homomorphic decryption key, the second decryption key consists of a second homomorphic decryption key and a second quantum homomorphic decryption key, the first encryption key consists of a first homomorphic public key generated on the basis of the first homomorphic decryption key and a first quantum homomorphic public key generated on the basis of the first quantum homomorphic decryption key, the second encryption key consists of a second homomorphic public key generated on the basis of the second homomorphic decryption key and a second quantum homomorphic public key generated on the basis of the second quantum homomorphic decryption key, the first ciphertext is generated based on the first public parameter, a first one-time pad key, the first homomorphic public key, the first quantum homomorphic public key and a first random number, and the second ciphertext is generated based on the second public parameter, a second one-time pad key, the second homomorphic public key, the second quantum homomorphic public key, and a second random number. [6] Confidential information processing system according to claim 5, wherein the arithmetic operation circuit has a part that calculates a first decryption random number, which is a random number for decrypting the third ciphertext based on the security parameter, the first one-time pad key, the first one-time pad key ciphertext data, the first quantum homomorphic public key, and the first random number, and a part that calculates a second decryption random number, which is a random number for decrypting the third ciphertext based on the security parameter, the second one-time pad key, the second one-time pad key ciphertext data, the second quantum homomorphic public key, and the second random number, the first one-time pad key ciphertext data is ciphertext data generated based on the first one-time pad key, the first quantum homomorphic public key, and the first random number, the second one-time pad key ciphertext data is ciphertext data generated based on the second one-time pad key, the second quantum homomorphic public key, and the second random number, and the homomorphic arithmetic operation unit determines whether or not the first encryption key has been generated by the encryption device depending on whether or not the first decryption random number has been generated, and determines whether or not the second encryption key has been generated by the encryption device depending on whether or not the second decryption random number has been generated. [7] Confidential information processing system according to claim 5, wherein the arithmetic operation circuit has a part that calculates a first decryption random number, which is a random number for decrypting the third ciphertext based on the security parameter, the first one-time pad key, the first one-time pad key ciphertext data, the first quantum homomorphic public key, and the first random number, and a part that calculates a second decryption random number, which is a random number for decrypting the third ciphertext based on the security parameter, the second one-time pad key, the second one-time pad key ciphertext data, the second quantum homomorphic public key, and the second random number, the first one-time pad key ciphertext data is ciphertext data generated based on the first one-time pad key, the first quantum homomorphic public key, and the first random number, the second one-time pad key ciphertext data is ciphertext data generated based on the second one-time pad key, the second quantum homomorphic public key, and the second random number, and the homomorphic arithmetic operation unit determines whether or not the first ciphertext has been generated by the encryption device depending on whether or not the first decryption random number has been generated, and determines whether or not the second ciphertext has been generated by the encryption device depending on whether or not the second decryption random number has been generated. [8] A confidential information processing method corresponding to a quantum homomorphic cryptographic technique that satisfies strong circuit confidentiality, the confidential information processing method comprising by a computer, generating a first ciphertext by encrypting a first plaintext using a first public parameter and a first encryption key, and generating a second ciphertext by encrypting a second plaintext using a second public parameter and a second encryption key, wherein each of the first public parameter and the second public parameter is a parameter generated using a security parameter, the first encryption key is an encryption key generated using the first public parameter and a first decryption key that is a decryption key generated using the security parameter, and the second encryption key is an encryption key generated using the second public parameter and a second decryption key is a decryption key generated using the security parameter. [9] A confidential information processing program that complies with a quantum homomorphic cryptographic technique that satisfies strong circuit confidentiality, the confidential information processing program causing an encryption device that is a computer to execute an encryption process to generate a first ciphertext by encrypting a first plaintext using a first public parameter and a first encryption key, and to generate a second ciphertext by encrypting a second plaintext using a second public parameter and a second encryption key, wherein each of the first public parameter and the second public parameter is a parameter generated using a security parameter, the first encryption key is an encryption key generated using the first public parameter and a first decryption key that is a decryption key generated using the security parameter, and the second encryption key is an encryption key generated using the second public parameter and a second decryption key is a decryption key generated using the security parameter.

Images