CONFIDENTIAL INFORMATION PROCESSING FACILITY, CONFIDENTIAL INFORMATION PROCESSING PROCESSES AND CONFIDENTIAL INFORMATION PROCESSING PROGRAM

Abstract

A key generation unit (200) generates an encryption key PK, a decryption key SK, and a homomorphic operation key EVK. An encryption unit (300) generates encrypted data C. DPK (m) by encrypting plaintext data with the encryption key PK. A denial random number generator (400) takes the encryption key PK and the ciphertext data CPDK (m) as input to generate denial random number data r* to deny the disclosure of plaintext data m. A homomorphic operation device (500) generates post-homomorphic operation ciphertext data C MPK (M) by performing a homomorphic operation on the computation result of the plaintext data using the homomorphic operation key EVK. A decryption device (600) decrypts the post-homomorphic operation ciphertext data C. MPK (M).

Description

Technical field

[0001] This disclosure relates to a Confidential Information Processing System, a Confidential Information Processing Procedure, and a Confidential Information Processing Program. Background on the state of the art

[0002] Homomorphic encryption is a cryptographic technique that allows analytical processing to be performed on data while the data remains encrypted. Although cloud services are now widespread, it is still advisable to store data encrypted in the cloud due to concerns about cracking or cloud reliability. Homomorphic encryption is a technique that enables the use of cloud services without compromising security, as operations can be performed on encrypted data without decrypting it.

[0003] A feature to prevent the forced disclosure of data encrypted in a ciphertext by an authorized user, such as the government, in order to increase the security of homomorphic encryption, is deniability.

[0004] An encryption algorithm in general public-key cryptography uses public-key data and random number data to encrypt plaintext data. Since the public-key data is public information, the ciphertext data is uniquely determined when the plaintext and random number data are generated. Denial capability is a property that allows random numbers to be generated to encrypt data that differs from the plaintext data actually being encrypted. This property allows a user to generate random numbers that can encrypt incorrect data into ciphertext data stored by the user, thus delegating the analysis processing to a cloud service.This makes it possible to avoid forced disclosure of data if the disclosure of plaintext data is forced by an authorized user.

[0005] In the non-patent literature 1, a first configuration example for a homomorphic encryption is disclosed which satisfies the refusal capability. Reference list Non-patented literature

[0006] Non-patent literature 1: Shweta Agrawal, Shafi Goldwasser and Saleet Mossel, “Deniable Fully Homomorphic Encryption from LWE”, In CRYPTO, pages 641-670, 2021.

[0007] Non-Patent Literature 2: Adriana Lopez-Alt, Eran Tromer, and Vinod Vaikuntanathan, “On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption,” In STOC, pages 1219-1234, 2012. Summary of the invention: Technical problem

[0008] The homomorphic encryption with refusal capability described in non-patent literature 1 can only perform analysis processing between ciphertext data encrypted with the same key. Consequently, when performing analysis processing using data from different users in a cloud service that employs the refusal homomorphic encryption disclosed in non-patent literature 1, it is necessary to share a key between users; therefore, data confidentiality between users cannot be guaranteed.

[0009] The purpose of the present disclosure is to implement a refusalable homomorphic encryption in which data can be encrypted by each user using different keys. Solution to the problem

[0010] A confidential information processing system as disclosed herein comprises: a key generation device to generate an encryption key PK, a decryption key SK and a homomorphic operation key EVK; an encryption device to encrypt data C DPK (m) to generate by encrypting plaintext data m with the encryption key PK; a denial random number generator to generate denial random number data r* for refusing to disclose the plaintext data using the encryption key PK and the ciphertext data C DPK (m) to generate as input; a homomorphic operation facility to process post-homomorphic operation ciphertext data C MPK (M) by performing a homomorphic operation on a computation result of the plaintext data with the homomorphic operation key EVK; and a decryption device to decrypt the post-homomorphic operation ciphertext data. Advantageous effects of the invention

[0011] In a confidential information processing system according to the present disclosure, it is possible to detect the substitution or impersonation of a specific person by continuously processing confidential information unconsciously for that specific person. Brief description of the drawings Fig. Figure 1 is a representation illustrating an example of a system configuration of a confidential information processing system according to a first embodiment; Fig. 2 is a block diagram illustrating a configuration of a key generation device according to a first embodiment; Fig. Figure 3 is a block diagram illustrating a configuration of an encryption device according to a first embodiment; Fig. Figure 4 is a block diagram illustrating a configuration of a denial random number generator according to a first embodiment; Fig. Figure 5 is a block diagram illustrating a configuration of a homomorphic operation device according to a first embodiment; Fig. Figure 6 is a block diagram illustrating a configuration of a decryption device according to a first embodiment; Fig. Figure 7 is a flowchart illustrating the operation of a respective facility in the Confidential Information Processing System according to a first embodiment; Fig. Figure 8 is a flowchart illustrating a homomorphic operation of the Confidential Information Processing System according to a first embodiment; Fig. Figure 9 is a flowchart illustrating a homomorphic operation of the Confidential Information Processing System according to a first embodiment; Fig. Figure 10 is a representation illustrating an example of a hardware configuration of a respective facility in the confidential information processing system according to a first embodiment; and Fig. Figure 11 is a representation illustrating an example of a hardware configuration of a respective facility in the Confidential Information Processing System according to a variant of a first embodiment. Description of embodiments

[0012] The present embodiment is described below with reference to graphical representations. In each graphical representation, identical or corresponding parts are designated by the same reference numerals. Explanations of these identical or corresponding elements are appropriately omitted or simplified in the description of the embodiment. Arrows in the representations primarily illustrate data flows or process sequences. First embodiment*** Configuration description ***

[0013] Fig. Figure 1 is a representation illustrating an example of a system configuration of the Confidential Information Processing System 100 according to the present embodiment.

[0014] The Confidential Information Processing System 100 is equipped with a Key Generation Device 200, an Encryption Device 300, a Denial Random Number Generation Device 400, a Homomorphic Operation Device 500 and a Decryption Device 600.

[0015] The Internet 101 is a communication channel that connects the Key Generation Device 200, a multitude of Encryption Devices 300, the Denial Random Number Generator 400, the Homomorphic Operation Device 500, and the Decryption Device 600. The Internet 101 is an example of a network. Other network types can be used instead of the Internet 101.

[0016] The key generation device 200, for example, is a PC. PC is an abbreviation for Personal Computer.

[0017] Key generation unit 200 generates an encryption key used for encryption, a homomorphic operation key used for homomorphic operations, and a decryption key used to decrypt ciphertext data. Key generation unit 200 transmits the encryption key to encryption unit 300 and denial random number generator 400 via Internet 101, the homomorphic operation key to homomorphic operation unit 500, and the decryption key to decryption unit 600. These keys can also be transmitted directly, by email, or similar means.Since the decryption key contains confidential information, it is stored in the key generation unit 200 and the decryption unit 600 to prevent it from being leaked.

[0018] The encryption device 300 generates encrypted data by encrypting plaintext data with the encryption key. The encryption device 300 generates encrypted data by encrypting plaintext data using a single encryption key. The encryption device 300 is, for example, a PC. The encryption device 300 generates ciphertext data by encrypting plaintext data, which is obtained from sensors and similar devices in factories, with the stored encryption key. The encryption device 300 transmits the ciphertext data to the homomorphic operation device 500.

[0019] The denial random number generator 400 generates denial random number data to deny the disclosure of plaintext data, using the encryption key and ciphertext data as input. The denial random number generator 400 is, for example, a PC. The denial random number generator 400 also functions as an encryption key storage device, receiving and storing the encryption key transmitted by the key generation device 200.

[0020] The denial random number generator 400 generates denial random number data from the ciphertext data, plaintext data and random number data transmitted by the encryption device 300, and stores the denial random number data.

[0021] The homomorphic operation unit 500 generates post-homomorphic operation ciphertext data, which is related to a computational result of the plaintext data by performing a homomorphic operation, using the homomorphic operation key and the encrypted data as input. The homomorphic operation unit 500 is, for example, a computing unit with a large-capacity storage medium. The homomorphic operation unit 500 also functions as a data storage unit. That is, when the homomorphic operation unit 500 receives a storage request for ciphertext data from the encryption unit 300, it stores these ciphertext data fragments.

[0022] Homomorphic Operation Unit 500 also functions as a unit that performs a homomorphic operation on the stored ciphertext data. That is, Homomorphic Operation Unit 500 generates ciphertext data (post-homomorphic operation ciphertext data), which is the result of an operation on the plaintext data of the ciphertext file, from a stored homomorphic operation key and stored ciphertext data, and transmits the post-homomorphic operation ciphertext data to Decryption Unit 600. The stored homomorphic operation key is the homomorphic operation key stored in Homomorphic Operation Unit 500. The stored ciphertext data is ciphertext data stored in Homomorphic Operation Unit 500.

[0023] The decryption device 600 decrypts the post-homomorphic operation ciphertext data. The decryption device 600 is, for example, a PC. The decryption device 600 also functions as a decryption key storage device, receiving and storing the decryption key transmitted by the key generation device 200.

[0024] The decryption device 600 is also a PC that operates as a ciphertext data decryption device to obtain operation results by receiving the ciphertext data (post-homomorphic operation ciphertext data) transmitted by the homomorphic operation device 500 and decrypting the ciphertext data with the stored decryption keys.

[0025] Furthermore, any of the key generation device 200, encryption device 300, denial random number generation device 400, homomorphic operation device 500 and decryption device 600 can be provided simultaneously in the same PC.

[0026] One configuration of the present embodiment is described below.

[0027] As in Fig. As shown in Figure 1, the Confidential Information Processing System 100 is equipped with the Key Generation Device 200, the Encryption Device 300, the Denial Random Number Generator 400, the Homomorphic Operation Device 500, and the Decryption Device 600. The configurations of the Key Generation Device 200, the Encryption Device 300, the Denial Random Number Generator 400, the Homomorphic Operation Device 500, and the Decryption Device 600 are explained sequentially below.

[0028] Fig. Figure 2 is a block diagram showing the configuration of the key generation device 200 according to the present embodiment.

[0029] As in Fig. As shown in Figure 2, the key generation device 200 is equipped with an input unit 201, a denial-capable decryption key generation unit 202, a denial-capable encryption key generation unit 203, a homomorphic multi-key decryption key generation unit 204, a homomorphic multi-key encryption key generation unit 205, a homomorphic operation key generation unit 206 and a transmission unit 207 as functional elements.

[0030] Although not shown, the key generation device 200 is further equipped with a storage unit which stores data that is used in each part of the key generation device 200.

[0031] The input unit 201 receives a security parameter λ and transmits the security parameter λ to the denialable decryption key generation unit 202 and the homomorphic multi-key decryption key generation unit 204.

[0032] The Denial Decryption Key Generator 202 generates a Denial Decryption Key DSK using the security parameter λ, which was received as input from the Input Unit 201. Furthermore, the Denial Decryption Key Generator 202 transmits the Denial Decryption Key DSK to the Denial Encryption Key Generator 203, the Homomorphic Operation Key Generator 206, and the Transmission Unit 207.

[0033] The Refusal Key Generator 203 generates a Refusal Key DPK using the Refusal Key Decryption Key DSK, which was received as input from the Refusal Key Decryption Generator 202. The Refusal Key Generator 203 then transmits the Refusal Key DPK to the Transmission Unit 207.

[0034] The homomorphic multi-key decryption key generation unit 204 generates a homomorphic multi-key decryption key MSK using the security parameter λ, which was received as input from the input unit 201. Furthermore, the homomorphic multi-key decryption key generation unit 204 transmits the homomorphic multi-key decryption key MSK to the homomorphic multi-key encryption key generation unit 205 and the transmission unit 207.

[0035] The homomorphic multi-key encryption key generation unit 205 generates a homomorphic multi-key encryption key MPK using the homomorphic multi-key decryption key MSK, which was received as input from the homomorphic multi-key decryption key generation unit 204. Furthermore, the homomorphic multi-key encryption key generation unit 205 transmits the homomorphic multi-key encryption key MPK to the homomorphic operation key generation unit 206 and the transmission unit 207.

[0036] The homomorphic operation key generation unit 206 generates a homomorphic operation key EVK using the denialable decryption key DSK, received from the denialable decryption key generation unit 202, and the homomorphic multi-key encryption key MPK, received from the homomorphic multi-key encryption key generation unit 205, as input. Furthermore, the homomorphic operation key generation unit 206 transmits the homomorphic operation key EVK to the transmission unit 207.

[0037] The transmission unit 207 generates a decryption key SK= (DSK, MSK) from the refusal decryption key DSK generated by the refusal decryption key generation unit 202 and the homomorphic multi-key decryption key MSK generated by the homomorphic multi-key decryption key generation unit 204, and transmits the decryption key SK = (DSK, MSK) to the decryption device 600.Alternatively, the transmission unit 207 generates an encryption key PK from the refusal encryption key DPK generated by the refusal encryption key generator 203 and the homomorphic multiple key encryption key MPK generated by the homomorphic multiple key encryption key generator 205, and transmits the encryption key PK to the encryption device 300 and the refusal random number generator 400. Otherwise, the transmission unit 207 transmits the homomorphic operation key EVK generated by the homomorphic operation key generator 206 to the homomorphic operation device 500.

[0038] Fig. Figure 3 is a block diagram showing the configuration of the encryption device 300 according to the present embodiment.

[0039] As in Fig. As shown in Figure 3, the encryption device 300 is equipped with an input unit 301, an encryption key storage unit 302, a plaintext storage unit 303, a random number generation unit 304, an encryption unit 305, a random number storage unit 306 and a transmission unit 307 as functional elements.

[0040] Although not shown, the Encryption Device 300 is further equipped with a storage unit which stores data that is used in each unit of the Encryption Device 300.

[0041] The input unit 301 receives the encryption key PK transmitted by the key generation device 200 and transmits the encryption key PK to the encryption key storage unit 302. Furthermore, the input unit 301 receives plaintext data m and transmits these pieces of plaintext data m to the plaintext data storage unit 303.

[0042] The encryption key storage unit 302 stores the encryption key PK received from the input unit 301.

[0043] The plaintext storage unit 303 stores the plaintext data received from the input unit 301.

[0044] The random number generation unit 304 generates random number data r from the encryption key PK stored in the encryption key storage unit 302, and transmits the random number data r to the encryption unit 305 and the random number storage unit 306.

[0045] The encryption unit 305 receives the encryption key PK transmitted by the encryption key storage unit 302, the plaintext data m transmitted by the plaintext data storage unit 303, and the random number data r from the random number generation unit 304, and generates the ciphertext data C. PK(m) the plaintext data m. The encryption unit 305 then transmits the ciphertext data C. PK (m) to transmission unit 307. C is used below. PK (m) for ciphertext data obtained by encrypting the plaintext data m with the encryption key PK.

[0046] The random number storage unit 306 stores the random number data r, which is received from the random number generation unit 304.

[0047] The transmission unit 307 receives the ciphertext data C PK (m) from the encryption unit 305 and transmits the ciphertext data C PK (m) to the denial random number generator 400 and the homomorphic operation device 500.

[0048] Fig. Figure 4 is a block diagram illustrating the configuration of the denial random number generator 400 according to the present embodiment.

[0049] As in Fig. As shown in Figure 4, the denial random number generator 400 is equipped with an input unit 401, an encryption key storage unit 402, a denial random number generator 403 and a denial random number storage unit 404 as functional elements.

[0050] Although not shown, the Reject Random Number Generator 400 is further equipped with a storage unit which stores data that is used in each unit of the Reject Random Number Generator 400.

[0051] The input unit 401 receives the encryption key PK transmitted by the key generation device 200 and transmits the encryption key PK to the encryption key storage unit 402. Alternatively, the input unit 401 receives the ciphertext data C. PK(m) and the random number data r, which are transmitted by the encryption device 300, and transmits this to the denial random number generator 403.

[0052] The encryption key storage unit 402 stores the encryption key PK received from the input unit 401 of the denial random number generator 400.

[0053] The denial random number generator 403 generates denial random number data r* from the ciphertext data C. PK (m) and the random number data r received from the input unit 401, and the encryption key PK stored in the encryption key storage unit 402, and transmits the denial random number data r* to the denial random number storage unit 404.

[0054] The denial random number storage unit 404 stores the denial random number data r* received from the denial random number generation unit 403.

[0055] Fig. Figure 5 is a block diagram representing the configuration of the homomorphic operation device 500 according to the present embodiment.

[0056] As in Fig. As shown in Figure 5, the homomorphic operation facility 500 is equipped with an input unit 501, a homomorphic operation key storage unit 502, a ciphertext storage unit 503, an arithmetic processing configuration unit 504, a homomorphic operation unit 505 and a transmission unit 506 as functional elements.

[0057] Although not shown, the Homomorphic Operation Unit 500 is further equipped with a storage unit which stores data that is used in each unit of the Homomorphic Operation Facility 500.

[0058] The input unit 501 receives homomorphic operation keys EVK1 and EVK2, which are transmitted by the key generation unit 200, and transmits them to the homomorphic operation key storage unit 502. Alternatively, the input unit 501 receives the ciphertext data C. PK1 (m1) and C PK2 (m2), which are transmitted by the encryption device 300, and transmits them to the ciphertext storage unit 503. Otherwise, the input unit 501 receives an operation loop f and transmits the operation loop f to the arithmetic processing configuration unit 504.

[0059] The homomorphic operation key storage unit 502 stores the homomorphic operation keys EVK1 and EVK2, which were received from the input unit 501.

[0060] The ciphertext storage unit 503 stores the ciphertext data C received from the input unit 501. PK1 (m1) and the ciphertext data C PK2 (m2).

[0061] The arithmetic processing configuration unit 504 generates a homomorphic operation circuit C using the operation circuit f received from the input unit 501 and the ciphertext data C received from the ciphertext storage unit 503. PK1 (m1) and C PK2 (m2) as input.

[0062] The homomorphic operation unit 505 receives the homomorphic operation keys EVK1 and EVK2 from the homomorphic operation key storage unit 502, and the homomorphic operation circuit C from the arithmetic processing configuration unit 504, and calculates the ciphertext data C. PK (M) with respect to the operation result data M = f (m1, m2), which are related to the plaintext data m1 and the plaintext data m2 by applying the operation cycle f, and transfers the ciphertext data C PK (M) to the transmission unit 506. Here, f (m1, m2) represents the result of the calculation of the operation cycle f using two pieces of plaintext data m1 and m2 as input, while PK represents a set {PK1, PK2} composed of the encryption keys PK1 and PK2. Furthermore, C PK(M) hereafter refers to the post-homomorphic operation ciphertext data of operation result data M with respect to the encryption key set PK = {PK1, PK2}. The operation result data M can be derived from the post-homomorphic operation ciphertext data C. PK (M) can be decrypted using the decryption keys SK1 and SK2.

[0063] The transmission unit 506 transmits the post-homomorphic operation ciphertext data C received from the homomorphic operation unit 505. PK (M) to the decryption device 600.

[0064] Fig. Figure 6 is a block diagram showing the configuration of the decryption device 600 according to the present embodiment.

[0065] As in Fig. As shown in Figure 6, the decryption device 600 is equipped with an input unit 601, a decryption key storage unit 602, a decryption processing unit 603 and a decryption result storage unit 604 as functional elements.

[0066] Although not shown, the Decryption Device 600 is further equipped with a storage unit which stores data that is used in each unit of the Decryption Device 600.

[0067] The input unit 601 receives the decryption keys SK1 and SK2 transmitted by the key generation unit 200. Alternatively, the input unit 601 receives the post-homomorphic operation ciphertext data C. PK (M), which are the operation result data M relating to the set of encryption keys PK = {PK1, PK2} transmitted by the homomorphic operation facility 500.

[0068] The decryption key storage unit 602 stores the decryption keys SK1 and SK2 received from the input unit 601.

[0069] The decryption processing unit 603 receives the post-homomorphic operation ciphertext data C. PK (M) from the input unit 601, and the decryption keys SK1 and SK2 from the decryption key storage unit 602. The decryption processing unit 603 decrypts the operation result data M, which is derived from the post-homomorphic operation ciphertext data C. PK (M) was encrypted with the decryption keys SK1 and SK2, and transfers the operation result data M to the decryption result storage unit 604.

[0070] The decryption result storage unit 604 receives and stores the operation result data M from the decryption processing unit 603. *** Description of Functioning ***

[0071] Next, the operation of the Confidential Information Processing System 100 according to the present embodiment will be described. A workflow of the Confidential Information Processing System 100 corresponds to a Confidential Information Processing Procedure. Furthermore, a program that implements the operation of the Confidential Information Processing System 100 corresponds to a Confidential Information Processing Program.

[0072] Fig. Figure 7 is a flowchart illustrating the operation of each facility in the Confidential Information Processing System 100 according to the present embodiment.

[0073] The schedule in Fig. Figure 7 illustrates the generation and storage processing of encryption keys, decryption keys, and homomorphic operation keys.

[0074] Steps S701 to S713 in Fig. Figure 7 illustrates processes that are performed by the key generation device 200, the encryption device 300, the denial random number generation device 400, the homomorphic operation device 500, and the decryption device 600.

[0075] The processes from step S701 to step S705 are executed by the key generation unit 200.

[0076] The processes from step S706 to S707 are executed by the encryption device 300.

[0077] The processes from step S708 to step S709 are executed by the denial random number generator 400.

[0078] The processes from step S710 to S711 are executed by the homomorphic operation facility 500.

[0079] The processes from step S712 to S713 are executed by the decryption unit 600.

[0080] In step S701, the input unit 201 of the key generation device 200 receives the security parameter λ.

[0081] In step S702, the denial-of-decryption key generation unit 202 of the key generation device 200 generates a denial-of-decryption key DSK using the security parameter λ received as input from the input unit 201 in the key generation device 200 in step S701. Furthermore, the homomorphic multi-key decryption key generation unit 204 of the key generation device 200 generates a homomorphic multi-key decryption key using the security parameter λ received as input from the input unit 201 in the key generation device 200 in step S701. The denial-of-decryption key DSK is generated using the key generation algorithm described in non-patent literature 1.Furthermore, the homomorphic multi-key decryption key MSK is generated using the key generation algorithm described in the non-patent literature 2.

[0082] In step S703, the denial-capable encryption key generation unit 203 of the key generation unit 200 generates a denial-capable encryption key DPK using the denial-capable decryption key DSK as input. Additionally, the homomorphic multi-key encryption key generation unit 205 of the key generation unit 200 generates a homomorphic multi-key encryption key MPK using the homomorphic multi-key decryption key MSK as input. Here, the denial-capable encryption key DPK is generated using the key generation algorithm described in non-patent literature 1. Furthermore, the homomorphic multi-key encryption key MPK is generated using the key generation algorithm described in non-patent literature 2.

[0083] In step S704, the homomorphic operation key generation unit 206 of the key generation unit 200 outputs a homomorphic multi-key ciphertext, obtained by encrypting the denyable decryption key DSK using homomorphic multi-key encryption, as the homomorphic operation key EVK. Specifically, the homomorphic operation key generation unit 206 generates the homomorphic operation key EVK in the format (Formula 1) as follows, using the denyable decryption key DSK and the homomorphic multi-key encryption key MPK as input. EVK=Enc(MPK,DSK)

[0084] Here, the Enc algorithm is an encryption algorithm explained in non-patent literature 2.

[0085] In step S705, the transmission unit 207 of the key generation unit 200 generates a decryption key SK from the denialable decryption key DSK and the homomorphic multi-key decryption key MSK, which is represented in the format of (Formula 2) as follows. Furthermore, the transmission unit 207 of the key generation unit 200 generates an encryption key PK from the denialable encryption key DPK and the homomorphic multi-key encryption key MPK, which is represented in the format of (Formula 3) as follows. SK=(DSK,MSK) PK=(DPK,MPK)

[0086] The transmission unit 207 in the key generation unit 200 transmits the encryption key PK to the encryption unit 300 and the denialable random number generator 400. Additionally, the transmission unit 207 in the key generation unit 200 transmits the homomorphic operation key EVK, generated by the homomorphic operation key generator 206 in the key generation unit 200, to the homomorphic operation unit 500. Furthermore, the transmission unit 207 in the key generation unit 200 transmits the decryption key SK to the decryption unit 600.

[0087] In step S706, the input unit 301 in the encryption device 300 receives the encryption key PK, which was transmitted by the transmission unit 207 of the key generation device 200 in step S705.

[0088] In step S707, the encryption key storage unit 302 in the encryption device 300 stores the encryption key PK received from the input unit 301 in the encryption device 300 in step S706.

[0089] In step S708, the input unit 401 in the denial-capable random number generator 400 receives the encryption key PK, which was transmitted by the transmission unit 207 in the key generation device 200 in step S705.

[0090] In step S709, the encryption key storage unit 402 stores the encryption key PK in the denial random number generator 400, which was received by the input unit 401 in the denial random number generator 400 in step S708.

[0091] In step S710, the input unit 501 in the homomorphic operation unit 500 receives the homomorphic operation key PK, which was transmitted by the transmission unit 207 in the key generation unit 200 in step S705.

[0092] In step S711, the homomorphic operation key storage unit 502 in the homomorphic operation device 500 stores the homomorphic operation key EVK received from the input unit 501 in the homomorphic operation device 500 in step S710.

[0093] In step S712, the input unit 601 in the decryption device 600 receives the decryption key SK, which was transmitted by the transmission unit 207 in the key generation device 200 in step S705.

[0094] In step S713, the decryption key storage unit 602 stores the decryption key SK received in step S712 from the input unit 601 in the decryption device 600 in the decryption device 600.

[0095] Fig. Figure 8 is a flowchart illustrating the homomorphic operation in the Confidential Information Processing System 100 according to the present embodiment.

[0096] The processes from step S801 to S815 in Fig. 8 are performed by the encryption device 300, the homomorphic operation device 500 and the decryption device 600.

[0097] The processes from step S801 to S806 are executed by the encryption device 300.

[0098] The processes from step S807 to S812 are executed by the homomorphic operation facility 500.

[0099] The processes from step S807 to S815 are executed by the decryption unit 600.

[0100] In step S801, the input unit 301 in the encryption device 300 receives plaintext data m1 and m2, which are collected, for example, from a sensor or the like, and transmits the plaintext data m1 and m2 to the plaintext storage unit 303.

[0101] In step S802, the plaintext storage unit 303 stores the plaintext data m1 and m2 received from the input unit 301 in the encryption unit 300.

[0102] In step S803, the random number generation unit 304 in the encryption device 300 generates random number data r1 and r2, and transfers these to the random number storage unit 306 in the encryption device 300.

[0103] In step S804, the random number storage unit 306 in the encryption device 300 stores the random number data r1 and r2 received from the random number generation unit 304 in the encryption device 300.

[0104] In step S805, the encryption unit 305 in the encryption device 300 generates ciphertext data C. DPK1 (m1) from the refusalable encryption key DPK1 stored in the encryption key storage unit 302 in the encryption device 300, the random number data r1 stored in the random number storage unit 306, and the plaintext data m1 stored in the plaintext storage unit 303. In addition, the encryption unit 305 in the encryption device 300 generates ciphertext data C DPK2(m2) from the refusalable encryption key DPK2 stored in the encryption key storage unit 302 in the encryption device 300, the random number data r2 stored in the random number storage unit 306, and the plaintext data m2 stored in the plaintext storage unit 303. The ciphertext data C DPK1 (m1) and C DPK2 (m2) are transferred to the transmission unit 307 of the encryption device 300.

[0105] In step S806, the transmission unit 307 in the encryption device 300 receives the ciphertext data C transmitted by the encryption unit 305 in step S805. DPK1 (m1) and C DPK2 (m2) and transfers them to the Homomorphic Surgery Facility 500.

[0106] In step S807, the input unit 501 in the homomorphic operation unit 500 receives the ciphertext data C transmitted by the transmission unit 307 in the encryption unit 300. DPK1 (m1) and C DPK2 (m2), and transfers it to the ciphertext storage unit 503.

[0107] In step S808, the ciphertext storage unit 503 in the homomorphic operation unit 500 receives the ciphertext data C transmitted by the input unit 501 in the homomorphic operation unit 500 in step S807. DPK1 (m1) and C DPK2 (m2), and stores them.

[0108] In step S809, the input unit 501 in the homomorphic operation unit 500 receives the operation circuit f, which is entered from a keyboard, a mouse, a memory device or the like, and transmits the operation circuit f to the arithmetic processing configuration unit 504.

[0109] In step S810, the arithmetic processing configuration unit 504 in the homomorphic operation facility 500 generates a homomorphic operation processing loop F, which is represented in the format of (formula 4) as follows, where the input is the ciphertext data C stored in step S808 in the ciphertext storage unit 503 in the homomorphic operation unit 500. DPK1 (m1) and C DPK2 (m2) and the operation circuit f transferred from input unit 501 to homomorphic operation unit 500 in step S809. The homomorphic operation processing circuit F is transferred to homomorphic operation unit 505 in homomorphic operation unit 500. F(DSK1, DSK2)=f(Dec(DSK1, CDPK1(m1)),Dec(DSK2, CDPK2(m2)))

[0110] Here, the Dec algorithm is a decryption algorithm explained in non-patent literature 1.

[0111] In the Homomorphic Operation Facility 500, during the homomorphic operation, encrypted data is converted from a denial ciphertext to a homomorphic multi-key ciphertext by performing decryption processing of denial homomorphic encryption while the encrypted data remains encrypted.

[0112] In step S811, the homomorphic operation unit 505 in the homomorphic operation facility 500 generates post-homomorphic operation ciphertext data C. MPK (M) using the homomorphic operation algorithm described in non-patent literature 2, wherein the homomorphic operation key EVK and the homomorphic operation processing loop F are used as input, and transmits the post-homomorphic operation ciphertext data C MPK (M) to the transmission unit 506.

[0113] In step S812, the transmission unit 506 in the homomorphic operation unit 500 transmits the post-homomorphic operation ciphertext data C MPK (M) to the decryption device 600.

[0114] In step S813, the input unit 601 in the decryption unit 600 receives the post-homomorphic operation ciphertext data C MPK (M), which were transferred by the transmission unit 506 in the homomorphic operation facility 500 in step S812, and transfers the post-homomorphic operation ciphertext data C MPK (M) to the decryption processing unit 603.

[0115] In step S814, the decryption processing unit 603 in the decryption device 600 uses the post-homomorphic operation ciphertext data C. MPK(M), received by input unit 601 in decryption unit 600 in step S813, and the decryption keys MSK1 and MSK2, stored in decryption key storage unit 602 in decryption unit 600, to perform decryption processing, and obtains the decryption result M. Here it is only possible to obtain the decryption result M = f (m1, m2) for the encryption key set MPK = {MPK1, MPK2} of the post-homomorphic operation ciphertext data C. MPK(M) is decrypted only if the homomorphic multi-key encryption key MPK1 is generated by the homomorphic multi-key encryption key generation unit 205 using the homomorphic multi-key decryption key MSK1 as input, and the homomorphic multi-key encryption key MPK2 is generated by the homomorphic multi-key encryption key generation unit 205 using the homomorphic multi-key decryption key MSK2 as input. The decryption processing unit 603 transmits the decryption result M to the decryption result storage unit 604.

[0116] In step S815, the decryption key storage unit 604 in the decryption device 600 stores the decryption result M, which was transferred by the decryption processing unit 603, in the decryption device 600 in step S814.

[0117] It should be noted that the decryption device 600 only accepts a post-homomorphic operation ciphertext as input. However, if a pre-homomorphic operation ciphertext is to be decrypted by instructing the homomorphic operation device 500 to perform a homomorphic operation with respect to an operation to output the same value as the input, and the post-homomorphic operation ciphertext is decrypted in the same way as in the process in step S814, the plaintext data of the pre-homomorphic operation ciphertext can be decrypted.

[0118] Step S815 marks the end of homomorphic operation processing in the Confidential Information Processing System 100.

[0119] Fig. Figure 9 is a flowchart illustrating the homomorphic operation in the Confidential Information Processing System 100 according to the present embodiment.

[0120] The processes from step S901 to S904 in Fig. 9 are executed by the encryption device 300 and the denial random number generator 400.

[0121] The process in step S901 is performed by the encryption device 300.

[0122] The processes from step S902 to step S904 are executed by the denial random number generator 400.

[0123] In step S901, the transmission unit 307 in the encryption device 300 transmits the plaintext data m1 and m2, which are stored in the plaintext storage unit 303 in the encryption device 300, together with the random number data r1 and r2, which are stored in the random number storage unit 306 in the encryption device 300, to the denial random number generation device 400.

[0124] In step S902, the input unit 401 in the denial random number generator 400 receives the plaintext data m1 and m2 and the random number data r1 and r2, which were transmitted in step S901 by the transmission unit 307 in the encryption unit 300, and transmits them to the denial random number generator 403 in the denial random number generator 400.

[0125] In step S903, the denial random number generator 403 in the denial random number generator 400 receives the plaintext data m1 and the random number data r1, which were received in step S902 by the input unit 401 in the denial random number generator 400, and generates denial random number data r1*. Additionally, the denial random number generator 403 in the denial random number generator 400 receives the plaintext data m2 and the random number data r2, which were received by the input unit 401 in the denial random number generator 400 in step S902, and generates denial random number data r2*. The denial random number data r1* and r2* are transferred to the denial random number storage unit 404 in the denial random number generation unit 400.

[0126] In step S904, the denial random number storage unit 404 stores the denial random number data r1* and r2* in the denial random number generation unit 400, which were received in step S903 from the denial random number generation unit 403 in the denial random number generation unit 400.

[0127] In the present embodiment, the Confidential Information Processing System 100 has been explained as follows.

[0128] The key generation device 200 generates a first denialable encryption key and a first denialable decryption key, as well as a second denialable encryption key and a second denialable decryption key, which are used in denialable encryption. Each of the sets of first denialable encryption key and first denialable decryption key, and the set of second denialable encryption key and second denialable decryption key, is a separate key generated by different users.Furthermore, the key generation device 200 generates a first homomorphic multi-key encryption key and a first homomorphic multi-key decryption key, as well as a second homomorphic multi-key encryption key and a second homomorphic multi-key decryption key, which are used in homomorphic multi-key encryption. Additionally, the key generation device 200 generates a first homomorphic operation key from the first denyable decryption key and the first homomorphic multi-key encryption key. Furthermore, the key generation device 200 generates a second homomorphic operation key from the second denyable decryption key and the second homomorphic multi-key encryption key.

[0129] The encryption device 300 encrypts the first plaintext data with the first denialable encryption key to produce the first encrypted data. The encryption device 300 then encrypts the second plaintext data with the second denialable encryption key to produce the second encrypted data.

[0130] The denial random number generator 400 generates initial denial random number data to deny disclosure of the initial plaintext data using the initial denialable encryption key and the initial ciphertext data as input. Furthermore, the denial random number generator 400 generates second denial random number data to deny disclosure of the second plaintext data using the second denialable encryption key and the second ciphertext data as input.

[0131] The Homomorphic Operation Facility 500 generates post-homomorphic encryption ciphertext data obtained by performing a homomorphic operation on the computation results of the first plaintext data and the second plaintext data using the first homomorphic operation key, the second homomorphic operation key, and the first encrypted data and the second encrypted data as input.

[0132] The decryption device 600 decrypts the post-homomorphic encryption ciphertext data using the first denialable decryption key and the second denialable encryption key. *** Hardware Configuration Description***

[0133] Fig. Figure 10 is a representation that provides an example of the hardware configuration for each facility of the Confidential Information Processing System 100 according to the present embodiment.

[0134] In the following, each of the Key Generation Facility 200, the Encryption Facility 300, the Denial Random Number Generator Facility 400, the Homomorphic Operation Facility 500 and the Decryption Facility 600 can be referred to as each facility of the Confidential Information Processing System 100.

[0135] Each Confidential Information Processing System 100 installation is a computer. Each Confidential Information Processing System 100 installation is equipped with a 910 processor and other hardware components such as a 921 memory unit, a 922 auxiliary memory unit, a 930 input interface, a 940 output interface, and a 950 communication unit. The 910 processor is connected to the other hardware components via signal lines and controls these other hardware components.

[0136] As in Fig. 2 to Fig. As described in section 6, each facility of the Confidential Information Processing System 100 is equipped with functional elements.

[0137] The functional elements of each unit in the Confidential Information Processing System 100 are implemented by software. Furthermore, the memory components of each unit in the Confidential Information Processing System 100 are provided in the storage unit 921. It should be noted that the memory components may also be provided in the auxiliary storage unit 922, or may be distributed between storage unit 921 and auxiliary storage unit 922.

[0138] The 910 processor is a device that executes the Confidential Information Processing Program. The Confidential Information Processing Program is a program that implements the functional elements of each device in the Confidential Information Processing System 100.

[0139] The 910 processor is an integrated circuit (IC) that performs arithmetic processing. Specific examples of the 910 processor include a CPU, a DSP, or a GPU. IC stands for Integrated Circuit. CPU stands for Central Processing Unit. DSP stands for Digital Signal Processor. GPU stands for Graphics Processing Unit.

[0140] The 921 memory unit is a storage device that temporarily stores data. A concrete example of a 921 memory unit is SRAM or DRAM. SRAM stands for Static Random Access Memory. DRAM stands for Dynamic Random Access Memory.

[0141] The Auxiliary Storage Device 922 is a storage device in which data is stored. A specific example of the Auxiliary Storage Device 922 is a hard disk drive (HDD). Furthermore, the Auxiliary Storage Device 922 can be a portable storage medium, such as an SD (registered trademark) memory card, a CF (compact disk), NAND flash memory, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disc, or a DVD. HDD is an abbreviation for Hard Disk Drive. SD (registered trademark) is an abbreviation for Secure Digital. CF is an abbreviation for CompactFlash (registered trademark). DVD is an abbreviation for Digital Versatile Disk.

[0142] The 930 input interface is a port connected to an input device, such as a mouse, keyboard, or touch panel. For example, the 930 input interface could be a USB port. The 930 input interface could also be a port connected to a LAN. USB stands for Universal Serial Bus. LAN stands for Local Area Network.

[0143] The 940 output interface is a port to which a cable from an output device, such as a display, is connected. The 940 output interface is, for example, a USB port or an HDMI port (registered trademark). The display is, for example, an LCD. The 940 output interface is also referred to as the display interface. HDMI (registered trademark) is an abbreviation for High-Definition Multimedia Interface. LCD is an abbreviation for Liquid Crystal Display.

[0144] The 950 communication device is equipped with a receiver and a transmitter. The 950 communication device connects to communication networks such as a LAN, the internet, telephone lines, or WLAN (registered trademark). The 950 communication device is, for example, a communication chip or a NIC. NIC stands for Network Interface Card.

[0145] The Confidential Information Processing (CIPP) program is executed in the CIPP system 100. The CIPP program is loaded into and executed by the processor 910. Memory unit 921 stores not only the CIPP program but also the OS. OS is short for Operating System. The processor 910 executes the CIPP program while running the OS. The CIPP program and the OS can be stored in auxiliary memory unit 922. The CIPP program and the OS stored in auxiliary memory unit 922 are loaded into memory unit 921 and executed by the processor 910.Furthermore, the confidential information processing program can be fully or partially integrated into the OS.

[0146] The Confidential Information Processing System 100 can also be equipped with multiple processors that replace the Processor 910. These multiple processors share the execution of the Confidential Information Processing program. Each of these processors is a separate entity that executes the Confidential Information Processing program in the same way as the Processor 910.

[0147] The data, information, signal and variable values ​​used, processed or output by the Confidential Information Processing Program are stored in the memory unit 921, the auxiliary memory device 922 or a register or cache memory within the processor 910.

[0148] The "unit" of a given functional element of a given facility in the Confidential Information Processing System 100 can be replaced by "circuit," "step," "operation," "process," or "circuit." The Confidential Information Processing program causes a computer to execute a "process" that replaces the "unit" of a given functional element of the given facility in the Confidential Information Processing System 100. The "unit" of a given facility that is the functional element of a given facility in the Confidential Information Processing System 100 can be replaced by "program," "program product," "computer-readable storage medium storage programs," or "computer-readable recording medium recording programs."Furthermore, the Confidential Information Processing Procedure is a procedure that is carried out by executing the Confidential Information Processing Program through the Confidential Information Processing System 100.

[0149] The confidential information processing program can be stored and provided on a computer-readable recording medium. Alternatively, the confidential information processing program can be provided as a software product. *** Other configurations ***

[0150] In the present embodiment, functional elements of each unit of the Confidential Information Processing System 100 are implemented by software. Alternatively, the functional elements of each unit in the Confidential Information Processing System 100 can also be implemented by hardware components.

[0151] Specifically, each unit in the Confidential Information Processing System 100 can be equipped with an electronic circuit 909 instead of the processor 910.

[0152] Fig. Figure 11 is a representation which shows an example of a hardware configuration of a respective facility in the Confidential Information Processing System 100 according to a variant of the present embodiment.

[0153] The electronic circuit 909 is a dedicated electronic circuit that implements the functional elements of a specific facility within the Confidential Information Processing System 100. The electronic circuit 909 can be, in particular, a single circuit, a compound circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA stands for Gate Array. ASIC stands for Application Specific Integrated Circuit. FPGA stands for Field-Programmable Gate Array.

[0154] The functional elements of each unit of the Confidential Information Processing System 100 can be implemented by a single electronic circuit or distributed across several electronic circuits.

[0155] Another option is that some of the functional elements of a given device in the Confidential Information Processing System 100 can be implemented by an electronic circuit, while the remaining functions can be implemented by software. Furthermore, some or all of the functions of the functional elements of a given device in the Confidential Information Processing System 100 can be implemented by firmware.

[0156] Both the processor and the electronic circuitry are also referred to as processing circuits. In other words, the functional elements of a given system within Confidential Information Processing System 100 are implemented by the processing circuit. ***Description of the effect of the present embodiment***

[0157] The confidential information processing system according to the present embodiment has, for example, the following effects.

[0158] In general, assuming delegation of analysis processing to a cloud using homomorphic encryption, it is sufficient to establish denial capability only for the ciphertext before analysis processing, and the ciphertext after analysis processing does not need to be a homomorphically encrypted ciphertext with denial capability.

[0159] In the confidential information processing system according to the present embodiment, the system is equipped by combining homomorphic encryption with refusal capability and homomorphic multi-key encryption with the function of enabling analysis processing of data on data encrypted with different keys, while ensuring refusal capability.

[0160] In the confidential information processing system according to the present embodiment, in order to combine homomorphic encryption with denial capability and homomorphic multi-key encryption, a special analysis processing circuit is designed to perform analysis processing while the ciphertext of the homomorphic encryption with denial capability is converted into the ciphertext of the homomorphic multi-key encryption, thereby enabling analysis processing of data encrypted with different keys while maintaining denial capability.

[0161] This makes it possible to provide homomorphic encryption, enabling the analysis of data encrypted with different keys. Furthermore, it is sufficient to encrypt the data to be encrypted using only the key of the data's originator, thus improving efficiency.

[0162] Since plaintext data is generally encrypted using homomorphic encryption, where a homomorphic operation can only be performed on data encrypted with the same key, a homomorphic operation cannot be performed on data encrypted with different keys. With the confidential information processing system according to the present embodiment, it is possible to perform a homomorphic operation between ciphertext data generated with different encryption keys.

[0163] Furthermore, the confidential information processing system according to the present embodiment can perform a homomorphic operation between ciphertext data generated with different encryption keys; therefore, it is possible to delegate the analysis processing to a cloud server on a smaller dataset of ciphertext. Since homomorphic encryption can generally only be performed on data encrypted with the same key, a ciphertext data creator must encrypt their own plaintext data with the key of another ciphertext data creator, resulting in an extremely large ciphertext dataset. The confidential information processing system according to the present embodiment contributes to improved efficiency because it is not necessary to generate ciphertext data with a key belonging to another ciphertext data creator.

[0164] As described above, the confidential information processing system according to the present embodiment can provide homomorphic encryption capable of subjecting data encrypted with different keys to analysis processing by cleverly combining two types of encryption technologies: denial-of-service encryption and homomorphic multi-key encryption. Furthermore, it is sufficient to encrypt the data only with the key of the originator of the encrypted data, which also contributes to improved efficiency.

[0165] In the first embodiment, each unit of a respective facility in the confidential information processing system is described as an independent functional block. However, the structure of a respective facility in the confidential information processing system need not necessarily correspond to the configuration described in the embodiment above. The functional blocks of a respective facility in the confidential information processing system can have any configuration, provided they can perform the functions described in the embodiment above. Furthermore, a respective facility in the confidential information processing system can be a system composed of multiple facilities instead of a single facility.

[0166] Furthermore, several parts of the first embodiment can be combined and implemented. Alternatively, only one part of the embodiment can be implemented. This embodiment can also be implemented wholly or partially in any combination.

[0167] This means that in the first embodiment it is possible to freely combine a given embodiment, to modify any component of a given embodiment, or to omit any component in a given embodiment.

[0168] It should be noted that the embodiment described above is essentially a preferred example and is not intended to limit the scope of protection, the scope of application, or the range of uses of the present disclosure. Various modifications can be made to the embodiment described above as needed. The processes explained by means of a flowchart or sequence diagram may be modified as necessary. Reference symbol list

[0169] 100: Confidential Information Processing System; 101: the Internet; 200: Key Generation Unit; 201, 301, 401, 501, 601: Input Unit; 202: Denyable Decryption Key Generation Unit; 203: Denyable Encryption Key Generation Unit; 204: Homomorphic Multi-Key Decryption Key Generation Unit; 205: Homomorphic Multi-Key Encryption Key Generation Unit; 206: Homomorphic Operation Key Generation Unit; 207, 307, 506: Transmission Unit; 300: Encryption Unit; 302, 402: Encryption Key Storage Unit; 303: Plaintext Data Storage Unit; 304: Random Number Generation Unit; 305: Encryption unit; 306: Random number storage unit; 400: Deny random number generator; 403: Deny random number generator; 404: Deny random number storage unit; 500: Homomorphic operation unit;502: Homomorphic Operation Key Storage Unit; 503: Ciphertext Storage Unit; 504: Arithmetic Processing Configuration Unit; 505: Homomorphic Operation Unit; 600: Decryption Unit; 602: Decryption Key Storage Unit; 603: Decryption Processing Unit; 604: Decryption Result Storage Unit; 909: Electronic Circuit; 910: Processor; 921: Memory Unit; 922: Auxiliary Memory Unit; 930: Input Interface; 940: Output Interface; 950: Communication Unit. QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited non-patent literature

[0000] Shweta Agrawal, Shafi Goldwasser und Saleet Mossel., „Deniable Fully Homomorphic Encryption from LWE“, In CRYPTO, Seiten 641-670, 2021

[0006] Adriana Lopez-Alt, Eran Tromer, and Vinod Vaikuntanathan, „On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption“, In STOC, Seiten 1219-1234, 2012

[0007]

Claims

[1] Confidential Information Processing System, comprising: a key generation device to generate an encryption key, a decryption key, and a homomorphic operation key; an encryption device to generate encrypted data by encrypting plaintext data with the encryption key; a denial random number generator to generate denial random number data for refusing to disclose plaintext data using the encryption key and ciphertext data as input; a homomorphic operation facility to generate post-homomorphic operation ciphertext data by performing a homomorphic operation on a computation result of the plaintext data using the homomorphic operation key and the encrypted data as input; and a decryption device to decrypt the post-homomorphic operation ciphertext data. [2] Confidential information processing system according to claim 1, wherein the key generation device outputs a refusal encryption key used in refusal encryption and a homomorphic multi-key encryption key used in homomorphic multi-key encryption as the encryption key. [3] Confidential information processing system according to claim 2, wherein the key generation device outputs a refusal decryption key used in refusal encryption and a homomorphic multikey decryption key used in homomorphic multikey encryption as the decryption key. [4] Confidential information processing system according to claim 3, wherein the key generation device outputs a homomorphic multi-key ciphertext obtained by encrypting the refusalable decryption key with homomorphic multi-key encryption as the homomorphic operation key. [5] Confidential information processing system according to claim 4, wherein the homomorphic operation device converts the encrypted data from a refusal ciphertext to the homomorphic multi-key ciphertext by performing a decryption process from refusal homomorphic encryption, while the encrypted data remains encrypted during the homomorphic operation. [6] Confidential information processing procedure used in a confidential information processing system, wherein the confidential information processing procedure includes: by a key generation device, generating an encryption key, a decryption key and a homomorphic operation key; through an encryption device, generating encrypted data by encrypting plaintext data with the encryption key; by means of a denial random number generator, generating denial random number data to deny disclosure of plaintext data using the encryption key and ciphertext data as input; through a homomorphic operation facility, generating post-homomorphic operation ciphertext data by performing a homomorphic operation on a computation result of the plaintext data using the homomorphic operation key and the encrypted data as input; and by a decryption device, decrypting the post-homomorphic operation ciphertext data. [7] Confidential information processing program to cause a computer to perform: a key generation process to generate an encryption key, a decryption key, and a homomorphic operation key; an encryption process to generate encrypted data by encrypting plaintext data with the encryption key; a denial random number generation process to generate denial random number data for refusing to disclose the plaintext data using the encryption key and ciphertext data as input; a homomorphic operation process to generate post-homomorphic operation ciphertext data by performing a homomorphic operation on a computation result of the plaintext data using the homomorphic operation key and the encrypted data as input; and a decryption process to decrypt the post-homomorphic operation ciphertext data.

Images