Information processing method, information processing program, and information processing system

Abstract

To prevent leakage of cryptographic keys.SOLUTION: A system comprises a user terminal, and a computation device that has an execution area for performing a computation. In the system, the user terminal generates a first secret key and a first public key, as well as a second secret key and a second public key; uses the second public key to encrypt the first secret key under a homomorphic encryption scheme; and generates a switch key. The execution area stores the switch key acquired from the user terminal. The user terminal uses the first public key to encrypt a plaintext under the homomorphic encryption scheme and generates a ciphertext, and the execution area executes a computation process on the basis of the ciphertext acquired from the user terminal. Additionally, the execution area uses the switch key to execute a key switch process on the result of the computation process, and the user terminal acquires the result of the key switch process executed by the execution area and uses the second secret key to decrypt the result.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present disclosure relates to an information processing method, an information processing program, and an information processing system. [Background technology]

[0002] In recent years, in various fields, there has been a growing trend for companies to utilize data not only internally but also through collaboration with external companies and organizations via networks. As a result, security measures for highly confidential information such as personal information and trade secrets are becoming increasingly important.

[0003] As a security measure for this, cryptographic techniques that allow calculations to be performed on encrypted data are known. For example, Non-Patent Document 1 discloses a technique that uses homomorphic encryption, which allows calculations to be performed on ciphertext. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] C. Gentry, “Fully Homomorphic Encryption Using Ideal Lattices”, STOC 2009, pp. 169-178, 2009. Summary of the Invention [Problem to be solved by the invention]

[0005] However, even if it is possible to encrypt confidential information using homomorphic encryption and perform computations on the ciphertext as is, once the encryption key is leaked, there is a risk that the encrypted confidential information will be decrypted and the information will be leaked.

[0006] Therefore, the present disclosure has been made to solve the above problem, and its purpose is to provide an information processing method that prevents the leakage of encryption keys. [Means for solving the problem]

[0007] In order to achieve the above-mentioned object, the information processing method disclosed herein is a method used in a system including a user terminal having a user control unit and a user memory unit, and a calculation device having an execution area for performing calculations, and includes the steps of: the user control unit generating a first private key and a first public key, as well as a second private key and a second public key; the user control unit encrypting the first private key using a homomorphic encryption method with the second public key to generate a switch key; the execution area storing the switch key obtained from the user control unit; the user memory unit storing at least the first public key and the second private key; the user control unit encrypting plaintext using a homomorphic encryption method with the first public key to generate a ciphertext; the execution area performing calculation processing based on the ciphertext obtained from the user control unit; the execution area performing key switch processing on the result of the calculation processing using the switch key; and the user control unit obtaining the result of the key switch processing performed by the execution area and decrypting it using the second private key.

[0008] In addition, in order to achieve the above-mentioned object, the information processing program disclosed herein is a program used in a system including a user terminal having a user control unit and a user memory unit, and an arithmetic device having an execution area for performing arithmetic operations, and includes the steps of: the user control unit generating a first private key and a first public key, as well as a second private key and a second public key; the user control unit encrypting the first private key using a homomorphic encryption method with the second public key to generate a switch key; the execution area storing the switch key obtained from the user control unit; the user memory unit storing at least the first public key and the second private key; the user control unit encrypting plaintext using a homomorphic encryption method with the first public key to generate a ciphertext; the execution area performing arithmetic processing based on the ciphertext obtained from the user control unit; the execution area performing key switch processing on the result of the arithmetic processing using the switch key; and the user control unit obtaining the result of the key switch processing performed by the execution area and decrypting it using the second private key.

[0009] In addition, to achieve the above-mentioned object, the information processing system of the present disclosure is a system comprising: a user terminal having a user control unit and a user memory unit; and a calculation device having an execution area for performing calculations, wherein the user control unit generates a first private key and a first public key, as well as a second private key and a second public key; the user control unit encrypts the first private key using a homomorphic encryption method with the second public key to generate a switch key; the execution area stores the switch key obtained from the user control unit; the user memory unit stores at least the first public key and the second private key; the user control unit encrypts plaintext using the homomorphic encryption method with the first public key to generate a ciphertext; the execution area performs calculation processing based on the ciphertext obtained from the user control unit; the execution area performs key switch processing on the result of the calculation processing using the switch key; and the user control unit obtains the result of the key switch processing performed by the execution area and decrypts it using the second private key. [Effects of the Invention]

[0010] According to the present disclosure, it is possible to provide an information processing method that prevents leakage of an encryption key. [Brief explanation of the drawings]

[0011] [Figure 1] 1 is an overall view of an information processing system 1. FIG. [Figure 2] FIG. 2 is a diagram illustrating a hardware configuration of a calculation device 100. [Figure 3] FIG. 2 is a block diagram showing the functional configuration of a calculation device 100. [Figure 4] FIG. 2 is a block diagram showing the functional configuration of a terminal device 200. [Figure 5] 2 is a flow diagram showing an example of information processing in the information processing system 1. FIG. [Figure 6] FIG. 10 is a diagram illustrating the concept of key switch processing. [Figure 7] FIG. 2 is an overall view of an information processing system 3. [Figure 8] FIG. 4 is a block diagram showing the functional configuration of a calculation device 400. [Figure 9] FIG. 2 is a block diagram showing the functional configuration of a terminal device 500. [Figure 10] 3 is a flow diagram showing an example of information processing in the information processing system 3. FIG. [Figure 11] FIG. 2 is an overall view of an information processing system 4. [Figure 12] 4 is a flow diagram showing an example of information processing in the information processing system 4. FIG. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In all drawings describing the embodiments, common components are designated by the same reference numerals, and repeated explanations will be omitted. Note that the following embodiments do not unduly limit the content of the present disclosure described in the claims. Furthermore, not all of the components shown in the embodiments are necessarily essential components of the present disclosure.

[0013] <Summary of the Invention> In the information processing system according to the present invention, operations on ciphertext encrypted by homomorphic encryption, an encryption method that allows operations to be performed while the ciphertext remains encrypted, and key switch processing using bootstrapping, which switches encryption key A used for encryption by homomorphic encryption to another encryption key B without decrypting the ciphertext, are performed in a trusted execution environment (TEE), which is a security mechanism of the processor. By performing operations on ciphertext encrypted by homomorphic encryption and key switch processing in an area that is strictly protected at the hardware level, information leakage due to key leakage and tampering attacks on calculation results is prevented.

[0014] Fig. 6 is a diagram for explaining the concept of key switch processing. The concept of key switch processing, which is a well-known technique, will be explained with reference to Fig. 6. Details of the key switch processing are described in Document A. Document A: Ilaria Chillotti, Nicolas Gama, Mariya Georgieva & Malika Izabachene, “TFHE: Fast Fully Homomorphic Encryption Over the Torus”, Journal of Cryptology 33,34-91(2020)

[0015] Key switching is a process of switching (converting) the encryption key used to generate ciphertext encrypted by homomorphic encryption to another encryption key without decrypting the ciphertext. The example in Figure 6 explains the process of switching the encryption key for plaintext m from a first public key PK1 to a second public key PK2. In the explanation of Figure 6, "encryption" refers to encryption by homomorphic encryption.

[0016] In FIG. 6, first, a first secret key SK1 is encrypted using a second public key PK2 to generate a switch key SWK (=Enc(SK1, PK2)) (arrow A1). Meanwhile, plaintext m is encrypted using the first public key PK1 to generate ciphertext Enc(m, PK1) (arrow A2). Then, the generated ciphertext Enc(m, PK1) is encrypted using the switch key SWK to perform key switching, thereby switching the key from plaintext m to ciphertext Enc(m, PK2) encrypted with the second public key PK2 (arrow A3). The ciphertext Enc(m, PK2) can be decrypted using the second secret key SK2 (arrow A4).

[0017] Since the plaintext m is encrypted using the first public key PK1 and the first secret key SK1 that decrypts the ciphertext Enc(m, PK1) is encrypted using the second public key PK2, anyone who performs key switch processing using the switch key SWK can switch the encryption key (first public key PK1) of the ciphertext Enc(m, PK1) to another encryption key (second public key PK2) without knowing the contents of the plaintext m or the first secret key SK1.

[0018] In the information processing system of the present invention, the key switch processing as described above is executed in the TEE, which is a trusted execution area, thereby preventing information leakage to the outside. Furthermore, even if the TEE is subjected to an unauthorized attack, the risk of key leakage can be reduced by securely storing the decryption key (second secret key) for decrypting the ciphertext generated by the key switch processing on the switch key generation side. [Example]

[0019] (Configuration of Information Processing System 1) Fig. 1 is an overall view of an information processing system 1. The overall view of the information processing system according to this embodiment will be described with reference to Fig. 1.

[0020] An information processing system 1 according to this embodiment includes a calculation device 100 and one or more terminal devices 200 used by a user. The calculation device 100 and the terminal devices 200 are communicably connected via a network NW. The network NW is configured from a WAN (Wide Area Network), a LAN (Local Area Network), or the like. In the information processing system 1, the calculation device 100 performs calculation processes such as statistical processing, database search processing, machine learning learning processing, and inference processing on data transmitted from the terminal devices 200 while the data remains encrypted.

[0021] The computing device 100 includes a TEE 10. A TEE (Trusted Execution Environment) is a type of secure hardware and a security mechanism for a processor. The TEE 10 can execute a program while protecting highly confidential data by, for example, generating an isolated area in memory that is tightly protected at the hardware level, called an enclave.

[0022] The terminal device 200 accepts input from a user and transmits the input content to the arithmetic device 100 via the network NW. The terminal device 200 also receives data transmitted from the arithmetic device 100 via the network NW and presents the data to the user. There may be multiple terminal devices 200. The results of the arithmetic device 100 performing arithmetic processing on the data transmitted from the terminal device 200 may be acquired by another terminal device 200.

[0023] (Hardware configuration of the arithmetic device 100) 2 is a diagram showing the hardware configuration of the arithmetic device 100. The hardware configuration of the arithmetic device 100 according to this embodiment will be described with reference to FIG.

[0024] The computing device 100 may be realized by a general-purpose computer such as a workstation, a server computer, a desktop personal computer (PC), a laptop PC, etc., or may be logically realized by cloud computing.

[0025] The arithmetic device 100 includes a processor 11, a memory 12, a storage 13, a communication IF 14, and an input / output IF 15.

[0026] The processor 11 is hardware for executing an instruction set written in a program and controls the operation of the entire computer. The processor 11 includes the TEE 10. Within the enclave of the TEE 10, programs are executed in a state that cannot be accessed from the outside, and data is stored in a state that cannot be accessed from the outside.

[0027] The memory 12 is for temporarily storing programs and data to be processed by the programs, etc. The memory 12 is realized by a volatile memory such as a DRAM (Dynamic Random Access Memory). The programs stored in the memory 12 are programs for executing the information processing method according to the present invention, etc.

[0028] The storage 13 is a storage device for saving data, and is realized by, for example, a flash memory, an HDD (Hard Disc Drive), or the like.

[0029] The communication IF 14 is an interface for transmitting and receiving signals so that the arithmetic device 100 can communicate with an external device, such as a wireless communication device for wireless communication or a USB (Universal Serial Bus) connector for serial communication.

[0030] The input / output IF 15 is an interface between an input device for receiving input from a user and an output device for presenting information to the user. The input device is realized by, for example, a keyboard, a mouse, a touch panel, buttons, a microphone, etc. The output device is realized by, for example, a display, a printer, a speaker, etc.

[0031] The hardware configuration of the terminal device 200 may be the same as that shown in Fig. 2 except that the TEE 10 is omitted. Similar to the above-described arithmetic device 100, the operation of each component of the terminal device 200 is realized by the processor 11 in accordance with a program stored in the memory 12.

[0032] (Functional configuration of the arithmetic device 100) 3 is a block diagram showing the functional configuration of the arithmetic device 100. The functional configuration of the arithmetic device 100 according to the first embodiment will be described with reference to FIG.

[0033] The arithmetic device 100 includes a communication unit 110, a storage unit 120, an input unit 130, an output unit 140, and a control unit 150.

[0034] The communication unit 110 performs processing for the arithmetic device 100 to communicate with other devices. The other devices may be PCs connected via a network, or terminals such as smartphones or tablets. The other devices may also be input / output devices, such as devices that input and output data using flash memory or HDDs.

[0035] The communication unit 110 also transmits and receives data via a secure communication channel with devices connected via the network NW or locally. The construction of a secure communication channel and the communication method are well-known techniques using a common key (such as a session key) or a public key, and therefore a description thereof will be omitted.

[0036] The storage unit 120 is configured with, for example, a volatile memory such as RAM, a flash memory, an HDD, etc., and stores data used by the arithmetic device 100 and computer programs used for various processes. The computer programs may be installed from a predetermined server or the like, or may be installed from a computer-readable portable recording medium using a known setup program or the like. The portable recording medium may be, for example, a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), etc.

[0037] The storage unit 120 may include, for example, a machine learning model database that stores machine learning models used in the arithmetic device 100. The storage unit 120 may also include, for example, a key database that stores keys used by the control unit 150 (described later) to encrypt data or decrypt encrypted data, as well as communication keys. The key database may include, for example, a public key generated by the terminal device 200 (described later). Note that the keys may not be stored within the arithmetic device 100, but may be stored in a secure key management device (not shown) that is connected to the arithmetic device 100 via a network or directly.

[0038] The input unit 130 is an interface that accepts user input to the arithmetic device 100. The input unit 130 is, for example, a keyboard, a touch panel, or a microphone that detects voice input, but is not limited to these.

[0039] The output unit 140 is an interface that outputs information to notify a user of the arithmetic device 100. The output unit 140 is, for example, a display or a speaker that outputs audio, but is not limited to these. The output unit 140 displays data received from the terminal device 200 or the like on a display, for example.

[0040] The control unit 150 is a processor such as a CPU (Central Processing Unit) that controls each function of the arithmetic device 100 and operates based on a program stored in the storage unit 120 in advance.

[0041] The control unit 150 includes the TEE 10. The TEE 10 is a trusted execution area, and as described above, within the enclave of the TEE 10, programs are executed in a state that cannot be accessed from the outside, and data is stored in a state that cannot be accessed from the outside. The control unit 150 also includes an execution area other than the TEE (REE; Rich Execution Environment, not shown in FIG. 3). The REE is an execution area isolated from the TEE, and realizes the basic functions of the processor.

[0042] The TEE 10 stores a switch key acquired from the terminal device 200, which will be described later. In this embodiment, the switch key can be used to switch the encryption key of the ciphertext from a first public key to a second public key. The TEE 10 may also store the first public key and / or the second public key acquired from the terminal device 200.

[0043] The TEE 10 also performs arithmetic processing based on the ciphertext acquired from the terminal device 200 via the communication unit 110. The arithmetic processing includes at least processing related to addition or multiplication of homomorphic ciphertexts, and may also perform statistical processing, database search processing, machine learning learning processing, inference processing, and the like. For example, when performing the inference processing, the machine learning model may be encrypted by homomorphic encryption using the same encryption key (first public key or second public key) as the encryption key used for the ciphertext to be inferred. Encrypting the machine learning model with the same encryption key as the encryption key used for the ciphertext to be inferred can reduce the effort required for key switching compared to using a different encryption key, thereby improving computational efficiency.

[0044] Examples of homomorphic encryption methods include the Paillier method, the ElGamal method, the Lifted-ElGamal method, the Somewhat Homomorphic Encryption method, the Fully Homomorphic Encryption method, the RSA method, the Elliptic Curve Cryptography method, the Elliptic Curve Cryptography (L1 configuration) method, the Lattice Cryptography (BFV, BGV) method, the Lattice Cryptography (CKKS) method, the Lattice Cryptography (TFHE) method, the Lattice Cryptography (TFHE variant) method, the Goldwasser-Micali cryptography method, the NTRU cryptography method, and the DGHV (Dijk, Gentry, Halevi, and Vaikuntanathan) cryptography method. Furthermore, if the memory available in the TEE is not large enough to execute the arithmetic processing, the arithmetic processing may be executed in a secure execution area other than the TEE 10 of the control unit 150. The secure execution area may be realized by temporarily constructing a virtual execution area, for example, so that external access is difficult. Furthermore, the arithmetic processing may be executed in the REE.

[0045] Furthermore, the TEE 10 executes a key switch process on the result of the arithmetic process using a switch key. The key switch process is a process of switching the encryption key of a homomorphic ciphertext to another encryption key. In this embodiment, the TEE 10 executes the key switch process using the switch key to switch the encryption key of the ciphertext from a first public key to a second public key.

[0046] (Functional configuration of terminal device 200) 4 is a block diagram showing the functional configuration of the terminal device 200. The functional configuration of the terminal device 200 according to the first embodiment will be described with reference to FIG.

[0047] The terminal device 200 is a “user terminal” and includes a communication unit 210 , a storage unit 220 , an input unit 230 , an output unit 240 , and a control unit 250 .

[0048] The communication unit 210 performs processing for the terminal device 200 to communicate with other devices. The function of the communication unit 210 is similar to that of the communication unit 110 of the arithmetic device 100, and therefore a duplicated description will be omitted.

[0049] The storage unit 220 functions as a "user storage unit" and is configured, for example, by volatile memory such as RAM, flash memory, or HDD. The storage unit 220 stores data used by the terminal device 200 and computer programs used for various processes. The functions of the storage unit 220 are similar to those of the storage unit 220 of the terminal device 200, and therefore a duplicated description will be omitted.

[0050] The storage unit 220 stores at least a first public key and a second private key generated by the control unit 250 (described later). These keys may not be stored within the terminal device 200, but may be stored in a secure key management device (not shown) connected to the terminal device 200 via a network or directly.

[0051] The functions of the input section 230 and the output section 240 are similar to those of the input section 130 and the output section 140 of the arithmetic device 100, and therefore a duplicated description will be omitted.

[0052] The control unit 250 functions as a "user control unit," controls each function of the terminal device 200, and is a processor such as a CPU (Central Processing Unit) that operates based on a program stored in the storage unit 220 in advance.

[0053] The control unit 250 generates two key pairs. Specifically, it generates a first private key and a first public key, and a second private key and a second public key. These two key pairs may be generated by the key management device described above.

[0054] Furthermore, the control unit 250 encrypts the first private key using the second public key by homomorphic encryption to generate a switch key. The control unit 250 transmits the generated switch key to the calculation device 100 via the communication unit 210. After transmitting the switch key to the calculation device 100, the control unit 250 may delete the switch key or store it in the storage unit 220.

[0055] Furthermore, the control unit 250 encrypts plaintext input via the communication unit 210 or the input unit 230 using the first public key according to homomorphic encryption, to generate ciphertext.

[0056] Furthermore, the control unit 250 acquires the result of the second arithmetic processing executed by the TEE 10 via the communication unit 210 and decrypts it using the second private key. This allows the content of the result of the second arithmetic processing to be acquired without being disclosed to the outside.

[0057] Note that the control unit 250 may delete the first private key after generating the switch key. By deleting (destroying) the first private key, the first private key will not be leaked to the outside, and the risk that a ciphertext generated by encryption using the first public key will be decrypted by a third party can be reduced.

[0058] Fig. 5 is a flow diagram showing an example of information processing in the information processing system 1. The flow of information processing in the information processing system 1 will be described with reference to Fig. 5. Note that the processing flow is an example and is not limited to the order shown in Fig. 5.

[0059] In step S101, the control unit 250 of the terminal device 200 generates two key pairs. Specifically, it generates a first secret key SK1 and a first public key PK1, and a second secret key SK2 and a second public key PK2. Note that these key pairs may be generated by a key management device external to the terminal device 200 and acquired by the terminal device 200.

[0060] In step S102, the control unit 250 of the terminal device 200 encrypts the first secret key SK1 using the second public key PK2 by homomorphic encryption to generate the switch key SWK.

[0061] In step S103, the TEE 10 of the calculation device 100 acquires and stores the switch key SWK generated in step S102 from the terminal device 200. The TEE 10 or the storage unit 120 may also acquire and store the first public key PK1 or the second public key PK2 from the terminal device 200.

[0062] Furthermore, the storage unit 220 of the terminal device 200 stores at least a first public key and a second secret key. The control unit 250 of the terminal device 200 may delete the first secret key SK1 after generating the switch key SWK. By deleting the first secret key SK1, it is possible to reduce the risk that a ciphertext generated by encryption using the first public key will be decrypted.

[0063] In step S104, the control unit 250 of the terminal device 200 encrypts the plaintext m using the first public key PK1 according to the homomorphic encryption method to generate the ciphertext Enc(m, PK1).

[0064] In step S105, the TEE 10 of the arithmetic device 100 acquires the ciphertext Enc(m,PK1) from the terminal device 200 and executes arithmetic processing. For example, based on a request from the user of the terminal device 200, the TEE 10 performs statistical processing, database search processing, machine learning learning processing, inference processing, etc. on the ciphertext Enc(m,PK1) while it remains encrypted. Note that when multiplication or addition of the ciphertext Enc(m,PK1) with other ciphertexts is to be efficiently performed, it is preferable that the other ciphertexts be encrypted with the first public key PK1.

[0065] In step S106, the TEE 10 of the arithmetic device 100 performs key switch processing on the result of the arithmetic processing using the switch key SWK. Specifically, the TEE 10 performs key switch processing on the ciphertext Enc(m',PK1) that is the result of the arithmetic processing using the switch key SWK to generate ciphertext Enc(m',PK2) encrypted with the second public key PK2.

[0066] In step S107, the control unit 250 of the terminal device 200 obtains the ciphertext Enc(m',PK2) that is the result of the key switch processing from the arithmetic device 100, and decrypts it using the second secret key SK2. In this way, the terminal device 200 can securely obtain the result m' of the arithmetic processing on the plaintext m by decrypting the result of the key switch processing.

[0067] The terminal device 200 may share the second secret key with another terminal device 200 and provide the result of the key switch processing to the other terminal device 200. The result m' of the arithmetic processing can be provided to the other terminal device 200 without disclosing the plaintext m held by the terminal device 200.

[0068] (Explanation of effect) As described above, in the information processing system according to the present invention, operations on ciphertext encrypted by homomorphic encryption, which is an encryption method that allows operations to be performed while the ciphertext is in an encrypted state, and key switch processing, which switches encryption key A used for encryption by homomorphic encryption to another encryption key B without decrypting the ciphertext, are performed in a trusted execution environment (TEE), which is a security mechanism of a processor. By generating the key used for data encryption and the key used for data decryption using different key generation processes and using technologies for preventing information leakage, such as TEE and homomorphic encryption, and at the same time performing key switch processing, it is possible to prevent information leakage due to key leakage and tampering attacks on calculation results.

[0069] In addition, using a TEE increases reliability at the hardware level and makes it difficult to access data from outside, thereby preventing information leaks.

[0070] Furthermore, by using TEE, it is possible to ensure that the system is secure based on a process (remote attestation) in which the integrity of the program is verified by a remote trusted certification authority or the like.

[0071] Furthermore, in the information processing system according to the present invention, after generating the switch key, the first private key is deleted. The ciphertext generated by encryption using the first public key is handled in the TEE, which is an execution environment with extremely high security strength in the computing device 100, and is therefore extremely difficult for an attacker to steal. Therefore, it is virtually impossible to decrypt the ciphertext encrypted using the first public key, and the security of the original data to be encrypted can be made extremely strong.

[0072] <Modification of Example 1> The information processing system 2 according to this modification has the same configuration as the information processing system 1, except that it includes a calculation device 300 instead of the calculation device 100 (see FIG. 1) of the information processing system 1 according to embodiment 1. Therefore, a description of the same configuration as embodiment 1 will be omitted.

[0073] In the arithmetic device 300 of the information processing system 2, the processing that was performed by the TEE 10 of the arithmetic device 100 is performed by a normal execution environment in an operating system (OS). Specifically, the normal execution environment of the arithmetic device 300 performs a process of storing a switch key (corresponding to step S103 in FIG. 5), an execution of an arithmetic process (corresponding to step S105 in FIG. 5), and an execution of a key switch process (corresponding to step S106 in FIG. 5).

[0074] In a typical execution environment of the arithmetic device 300, an execution area such as a memory space may be divided into a key management area and an arithmetic area. The key management area is a dedicated area for managing the switch key. The OS and applications cannot directly access the key management area. The arithmetic area is an area where arithmetic processing is executed. In order for the arithmetic area to obtain the switch key from the key management area, it must be done via a secure protocol. By dividing the areas in this way, the risk of unauthorized access to the switch key can be reduced, and the overall security of the system can be improved.

[0075] In the first embodiment, key switch processing and the like are performed by a trusted execution environment (TEE). The TEE is an execution environment that is tightly protected at the hardware level, and therefore has high security. However, there are issues such as high hardware costs and limitations on the amount of data that can be processed. The configuration according to this modification can reduce hardware costs compared to using a TEE. Furthermore, it can easily supply resources according to the amount of data that can be processed.

[0076] Furthermore, in this modification, by deleting the first private key after generating the switch key, it is possible to reduce the risk of decrypting a ciphertext generated by encryption using the first public key. To decrypt a ciphertext encrypted using the first public key, the first private key corresponding to the first public key is required. That is, if the first private key is deleted, it is impossible to decrypt the ciphertext encrypted using the first public key. On the other hand, even if the first private key is deleted, it is possible to decrypt the ciphertext encrypted using the first public key if there is a switch key for key-switching the encryption key from the first public key to the second public key and a second private key for decrypting the ciphertext after the key-switching process. However, in this case, an attacker needs to obtain not only the second private key stored locally (terminal device 200) but also the switch key stored in the cloud (computing device 300). Because it is extremely difficult to obtain both keys, it is virtually impossible to decrypt the ciphertext. Therefore, in this variant, even in an execution environment that does not use a TEE, it is virtually impossible to decrypt the ciphertext generated by encryption using the first public key, thereby achieving high security.

[0077] The execution environment of the arithmetic device 300 may also be realized by constructing a virtual execution environment. [Example]

[0078] In the first embodiment, the key switch processing is performed on homomorphic ciphertexts generated by one user (one terminal device). In the present embodiment, the key switch processing is performed on homomorphic ciphertexts generated by multiple users.

[0079] Homomorphic encryption is an encryption method that allows computations to be performed on ciphertexts encrypted using a certain public key while they are still encrypted. However, to enable computational processing on multiple ciphertexts, these ciphertexts must be in the same encryption space, i.e., encrypted using the same encryption key (public key). In this embodiment, to enable computational processing on homomorphic ciphertexts generated by multiple users using different encryption keys, a key switch process is performed to switch the encryption keys of these ciphertexts to the same encryption key. After performing the computational processing, a key switch process is performed to switch the encryption key of the execution result (ciphertext) to the encryption key (public key) generated by each user. This enables decryption using a decryption key (private key) held by each user, allowing computational processing to be performed using data from other organizations while keeping the data held by each user confidential. In other words, computational processing is performed on the data held by each user while it remains encrypted, without disclosure, and each user can decrypt and view only the computation result.

[0080] (Configuration of information processing system 3) 7 is an overall view of the information processing system 3. The overall view of the information processing system according to this embodiment will be described with reference to FIG.

[0081] The information processing system 3 according to this embodiment includes a computing device 400 and terminal devices 500-1, 500-2, ..., 500-N (N is a natural number) used by users. In the following description, the terminal devices 500-1, 500-2, ..., 500-N will be referred to as terminal devices 500 unless there is a need to distinguish them. The information processing system 3 is a platform that allows each organization (user) participating in the system to use data held by that organization without disclosing detailed data content to other organizations. Note that an organization is not limited to a company or an organization, but may be a group such as a department, section, group, or team divided by role. The terminal device 500 is associated with the organization participating in the platform.

[0082] The computing device 400 includes a TEE 40. The computing device 400 has the same hardware configuration as the computing device 100, and the TEE 40 is a security mechanism similar to the TEE 10 described above.

[0083] The terminal device 500 accepts input from a user and transmits the input content to the arithmetic device 400 via the network NW. The terminal device 500 also receives data transmitted from the arithmetic device 400 via the network NW and presents it to the user.

[0084] (Functional configuration of the arithmetic device 400) Fig. 8 is a block diagram showing the functional configuration of the arithmetic device 400. The functional configuration of the arithmetic device 400 according to the second embodiment will be described with reference to Fig. 8. Note that components common to the arithmetic device 100 are given the same reference numerals, and repeated description will be omitted.

[0085] The arithmetic device 400 includes a communication unit 110, a storage unit 120, an input unit 130, an output unit 140, and a control unit 450. The control unit 450 is a processor such as a CPU that controls each function of the arithmetic device 400 and operates based on a program stored in advance in the storage unit 120.

[0086] The control unit 450 includes the TEE 40. The TEE 40 generates an intermediate private key and an intermediate public key. For example, a key pair may be generated by a key application included in the TEE 40. The control unit 450 controls the communication unit 110 to transmit the intermediate public key to each terminal device 500. The control unit 450 also acquires a second public key (described below) generated in each terminal device 500 via the communication unit 110. The TEE 40 encrypts the intermediate private key using the second public key acquired from each terminal device 500 using a homomorphic encryption scheme to generate a second switch key. The second switch key can be used to switch the encryption key of a ciphertext from the intermediate public key to the second public key.

[0087] The TEE 40 stores the first switch keys acquired from each of the terminal devices 500 (described later) and the second switch keys generated as described above. The second public key may be stored in the storage unit 120 or the like. The intermediate private key may be deleted after the second switch key is generated.

[0088] Furthermore, the TEE 40 executes a first key switch process on the ciphertext acquired from the terminal device 500 via the communication unit 110, using a first switch key corresponding to the terminal device 500 that generated the ciphertext. By the first key switch process, the encryption key of the ciphertext acquired from the terminal device 500 is switched from the first public key to the intermediate public key.

[0089] The TEE 40 also performs arithmetic processing based on the ciphertext on which the first key switch processing has been performed. The arithmetic processing includes at least processing related to addition or multiplication of homomorphic ciphertexts. More specifically, the processing is processing related to addition or multiplication of ciphertexts acquired from each terminal device 500-K (K is a natural number satisfying 1≦K≦N), and may be statistical processing, database search processing, machine learning learning processing, inference processing, or the like. Because the ciphertexts acquired from each terminal device 500 are converted into ciphertexts in the same encryption space by the first key switch processing using the first switch key, processing related to addition or multiplication, or the like, can be performed.

[0090] Furthermore, the TEE 40 executes a second key switch process on the result of the arithmetic process (ciphertext) using a second switch key. By the second key switch process, the encryption key of the result of the arithmetic process (ciphertext) is switched from the intermediate public key to the second public key.

[0091] (Functional configuration of terminal device 500) Fig. 9 is a block diagram showing the functional configuration of the terminal device 500. The functional configuration of the terminal device 500 according to the second embodiment will be described with reference to Fig. 9. Note that components common to the terminal device 200 are assigned the same reference numerals, and repeated description will be omitted.

[0092] The terminal device 500 is a “user terminal” and includes a communication unit 210 , a storage unit 520 , an input unit 230 , an output unit 240 , and a control unit 550 .

[0093] The storage unit 520 functions as a "user storage unit" and has the same functions as the storage unit 220. The storage unit 520 stores at least a first public key and a second private key generated by the control unit 550, which will be described later. These keys may not be stored within the terminal device 500, but may be stored in a secure key management device (not shown) that is connected to the terminal device 500 via a network or directly.

[0094] The control unit 550 functions as a "user control unit," controls each function of the terminal device 500, and is a processor such as a CPU that operates based on a program stored in the storage unit 520 in advance.

[0095] The control unit 550 generates two key pairs. Specifically, it generates a first private key and public key, and a second private key and public key. These two key pairs may be generated by the key management device described above. The first private key and public key, and the second private key and public key generated by each terminal device 500 are different from each other.

[0096] Furthermore, the control unit 550 encrypts the first private key using the intermediate public key by homomorphic encryption to generate a first switch key. The first switch key can switch the encryption key of the ciphertext from the first public key to the intermediate public key. The control unit 550 transmits the generated first switch key to the arithmetic device 400 via the communication unit 210. After transmitting the first switch key to the arithmetic device 400, the control unit 550 may store the first switch key in the storage unit 220 or may delete it.

[0097] Note that the control unit 550 may delete the first private key after generating the first switch key. By deleting (destroying) the first private key, the first private key will not be leaked to the outside, and the risk that a ciphertext generated by encryption using the first public key will be decrypted by a third party, i.e., the risk that plaintext (original data) will be leaked, can be reduced.

[0098] Furthermore, the control unit 550 encrypts plaintext input via the communication unit 210 or the input unit 230 using the first public key according to the homomorphic encryption method to generate ciphertext.

[0099] Furthermore, control unit 550 acquires the result of the arithmetic processing in which the second key switch processing has been executed from arithmetic device 400 via communication unit 210, and decrypts it using the second secret key.

[0100] FIG. 10 is a flow diagram showing an example of information processing in the information processing system 3. The flow of information processing in the information processing system 3 will be described with reference to FIG. 10. Note that the processing flow is an example and is not limited to the order shown in FIG. 10. Also, in FIG. 10, for ease of explanation, two terminal devices (terminal device 500-1 and terminal device 500-2) are shown, but there may be three or more terminal devices 500. Also, in FIG. 10, the first private key of terminal device 500-K is shown as SK1_k, the first public key is shown as PK1_k, the second private key is shown as SK2_k, and the second public key is shown as PK2_k.

[0101] In step S201, the control unit 550 of the terminal device 500-1 generates two key pairs. Specifically, the control unit 550 generates a first private key SK1_1 and a public key PK1_1, and a second private key SK2_1 and a public key PK2_1. Note that these key pairs may be generated by a key management server external to the terminal device 500-1 and acquired by the terminal device 500.

[0102] In step S202, the TEE 40 of the arithmetic device 400 generates an intermediate private key InSK and an intermediate public key InPK.

[0103] In step S203, the control unit 550 of the terminal device 500-1 acquires the intermediate public key InPK from the arithmetic device 400.

[0104] In step S204, the control unit 550 of the terminal device 500-1 encrypts the first secret key SK1_1 using the intermediate public key InPK acquired in step S203 by homomorphic encryption to generate a first switch key SWK1(SK1_1, InPK).

[0105] In step S205, the TEE 40 of the arithmetic device 400 acquires the first switch key SWK1 (SK1_1, InPK) and the second public key PK2_1 from the terminal device 500-1. Note that the TEE 40 may acquire the first switch key SWK1 (SK1_1, InPK) and the second public key PK2_1 at different times.

[0106] In step S206, the TEE40 of the calculation device 400 encrypts the intermediate private key InSK using the second public key PK2_1 obtained from the terminal device 500-1 using the homomorphic encryption method to generate a second switch key SWK2(InSK, PK2_1) corresponding to the terminal device 500-1.

[0107] In step S207, storage unit 520 of terminal device 500-1 stores first public key PK1_1 and second secret key SK2_1. Note that control unit 550 of terminal device 500-1 may delete first secret key SK1_1 after generating first switch key SWK(SK1_1, InPK). By deleting first secret key SK1_1, it is possible to reduce the risk that ciphertext generated by encryption using first public key PK1_1 will be decrypted.

[0108] In step S208, the terminal device 500-2 and the arithmetic device 400 perform the same key processing as that performed by the terminal device 500-1 and the arithmetic device 400 in steps S200 to S207. That is, the control unit 550 of the terminal device 500-2 generates a first secret key SK1_2 and a public key PK1_2, as well as a second secret key SK2_2 and a public key PK2_2. The control unit 550 of the terminal device 500-2 also acquires an intermediate public key InPK from the arithmetic device 400, and generates a first switch key SWK1(SK1_2, InPK). The TEE 40 of the arithmetic device 400 acquires the first switch key SWK1(SK1_2, InPK) and a second public key PK2_2 from the terminal device 500-2. Then, the TEE 40 of the arithmetic device 400 generates a second switch key SWK2(InSK, PK2_2) corresponding to the terminal device 500-2. The first private key and public key, and the second private key and public key are different keys generated by each terminal device 500. The process of step S208 may be performed simultaneously with or before the key processes performed by terminal device 500-1 and arithmetic device 400 in steps S200 to S207.

[0109] In step S209, the TEE 40 of the arithmetic device 400 stores the first switch key SWK1 (SK1_k, InPK) and the second switch key SWK2 (InSK, PK2_k) corresponding to each terminal device 500-K (K=1, 2 in FIG. 10).

[0110] Note that the TEE 40 of the arithmetic device 400 may delete the intermediate private key InSK from the storage area after generating the second switch key SWK(InSK, PK2_k) corresponding to each terminal device 500-K. By deleting the intermediate private key InSK, it is possible to prevent an attacker from stealing the intermediate private key InSK and decrypting the ciphertext after the key switch process is executed using the first switch key of each terminal device 500-K, thereby preventing the plaintext (original data) from leaking.

[0111] Furthermore, the first private key SK1_k and the intermediate private key InSK may be deleted either alone or both.

[0112] In step S210, the control unit 550 of the terminal device 500-1 encrypts the plaintext m_1 using the first public key PK1_1 by homomorphic encryption to generate the ciphertext Enc(m_1, PK1_1).

[0113] In step S211, the TEE 40 of the arithmetic device 400 acquires the ciphertext Enc(m_1, PK1_1) from the terminal device 500-1.

[0114] In step S212, the control unit 550 of the terminal device 500-2 encrypts the plaintext m_2 using the first public key PK1_2 by homomorphic encryption to generate ciphertext Enc(m_2, PK1_2).

[0115] In step S213, the TEE 40 of the arithmetic device 400 acquires the ciphertext Enc(m_2, PK1_2) from the terminal device 500-2.

[0116] In step S214, the TEE 40 of the arithmetic device 400 executes a first key switch process on the ciphertext Enc(m_k, PK1_k) acquired from each terminal device 500-K, using the first switch key SWK(SK1_k, InPK) corresponding to the terminal device 500-K that generated the ciphertext. Specifically, the TEE 40 executes the key switch process on the ciphertext Enc(m_1, PK1_1) acquired from the terminal device 500-1, using the first switch key SWK(SK1_1, InPK) corresponding to the terminal device 500-1. The TEE 40 executes the key switch process on the ciphertext Enc(m_2, PK1_2) acquired from the terminal device 500-2, using the first switch key SWK(SK1_2, InPK) corresponding to the terminal device 500-2. By the key switch process in step S214, the encryption key of the ciphertext acquired from each terminal device 500 is switched from the first public key PK1_k generated in each terminal device 500-K to the intermediate public key InPK.

[0117] In step S215, the TEE 40 of the arithmetic device 400 executes arithmetic processing based on each ciphertext Enc(m_k, InPK) on which the first key switch processing has been executed. For example, in response to a request from the user of the terminal device 500-1, the TEE 40 performs machine learning learning processing, inference processing, etc. on each ciphertext Enc(m_k, InPK) while keeping it encrypted.

[0118] In step S216, in response to the transmission request for the arithmetic processing result (m'), the TEE 40 of the arithmetic device 400 performs key switch processing on the arithmetic processing result using the second switch key SWK2(InSK, PK2_k) corresponding to the terminal device 500-K that made the transmission request. Specifically, for example, in response to the transmission request for the arithmetic processing result from the terminal device 500-1, the TEE 40 performs key switch processing on the ciphertext Enc(m', InPK), which is the arithmetic processing result, using the second switch key SWK2(InSK, PK2_1) corresponding to the terminal device 500-1, to generate ciphertext Enc(m', PK2_1), that is, a ciphertext encrypted with the second public key PK2_1 generated by the terminal device 500-1.

[0119] Similarly, for example, in response to a request for the result of the arithmetic processing of the terminal device 500-2, a key switch process is performed to generate a ciphertext Enc(m',PK2_2), i.e., a ciphertext encrypted with the second public key PK2_2 generated by the terminal device 500-2.

[0120] In step S217, the terminal device 500-1 acquires the ciphertext Enc(m', PK2_1), and the terminal device 500-2 acquires the ciphertext Enc(m', PK2_2).

[0121] In step S218, the control unit 550 of the terminal device 500-1 decrypts the ciphertext Enc(m',PK2_1) using the second secret key SK2_1. In this way, by decrypting the result of the key switch process, the terminal device 500-1 can securely obtain the result m' of the arithmetic process between the plaintext m_1 and the plaintext m_k held by the other terminal device 500-K.

[0122] In step S219, the control unit 550 of the terminal device 500-2 decrypts the ciphertext Enc(m',PK2_2) using the second secret key. Similar to the terminal device 500-1, the terminal device 500-2 can securely obtain the result m' of the arithmetic operation between the plaintext m_2 and the plaintext m_k held by the other terminal device 500-K.

[0123] In the second embodiment, similarly to the modified example of the first embodiment, the processing performed by the TEE 40 of the arithmetic device 400 may be performed by a normal execution environment in the OS of the arithmetic device 400. When the normal execution environment performs the processing, the hardware cost can be reduced compared to when a TEE is used. Furthermore, the execution environment of the arithmetic device 400 may be realized by constructing a virtual execution environment.

[0124] Furthermore, similar to the modification of the first embodiment, in the normal execution environment of the arithmetic device 400, an execution area such as a memory space may be divided into a key management area and an arithmetic area. By dividing the areas in this way, the risk of unauthorized access to the switch key can be reduced, and the overall security of the system can be improved.

[0125] (Explanation of effect) As described above, in this embodiment, a key switch process is performed to switch the encryption keys of homomorphic ciphertexts generated by multiple users using different encryption keys to the same encryption key. Then, after executing a computation process, a key switch process is performed to switch the encryption keys of the execution results (ciphertexts) to encryption keys (public keys) generated by each user. This enables decryption using the decryption keys (private keys) held by each user, allowing computation to be performed using data from other organizations while keeping the data held by each user confidential. In other words, the data held by each user is processed in an encrypted state without being disclosed, and only the computation results can be decrypted and viewed by each user.

[0126] Furthermore, in this embodiment, at least one of the following steps is performed: a step of deleting the first private key after generating a first switch key in each terminal device; or a step of deleting the intermediate private key from a storage area in the computing device after generating a second switch key corresponding to each terminal device. By deleting the private key, ciphertext encrypted with the public key paired with the private key becomes impossible to decrypt. In other words, by deleting the first private key and / or the intermediate private key, it becomes impossible to decrypt ciphertext encrypted with the first public key in each terminal device to plaintext (original data), thereby making it possible to extremely strengthen security. [Example]

[0127] The information processing system according to this embodiment further includes a management device in addition to the computing device and the terminal devices. The management device itself does not provide data, but it can decrypt and view data encrypted and provided by each terminal device, as well as the results of computations performed based on the encrypted data provided by each terminal device. 11 is an overall view of the information processing system 4. The information processing system according to this embodiment will be described with reference to FIG.

[0128] The information processing system 4 includes a calculation device 600, terminal devices 700-1, . . . , 700-N, and a management device 800.

[0129] The management device 800 is associated with a user who manages and supervises each organization participating in the information processing system 4, and handles highly confidential information in a centralized manner. The user of the management device 800 may be, for example, a human resources department or a production management department, and has the authority to view the data held by each terminal device 700 and the results of arithmetic processing based on the data held by each terminal device 700. The management device 800 has a management control unit 810 and a management storage unit 820. The management storage unit 820 stores a management public key and a management private key. The management public key and management private key may be generated by the management control unit 810 and stored in the management storage unit 820, or may be managed (generated and stored) by an external key management device.

[0130] The TEE 60 of the arithmetic device 600 acquires the managed public key stored in the management storage unit 820 of the management device 800, and encrypts the intermediate private key using the managed public key by homomorphic encryption to generate a managed switch key. The TEE 60 also executes key switch processing using the managed switch key on the result of the arithmetic processing executed based on the ciphertext that has undergone the first key switch processing. The result of the arithmetic processing that has undergone the key switch processing is decrypted by the management control unit 810 of the management device 800 using the managed private key.

[0131] In this way, the user of the management device 800 can view the results of the arithmetic processing by key switch processing using the managed switch key. In addition, the user can also view the ciphertext transmitted from each terminal device 700, not the arithmetic processing results obtained by the TEE 60 of the arithmetic device 600, by key switch processing using the managed switch key.

[0132] The terminal device 700 has a control unit and a storage unit (not shown in FIG. 11). The control unit of the terminal device 700 generates a first private key and a public key. The storage unit of the terminal device 700 stores the public key. Note that the first private key and the public key may be managed (generated, stored, etc.) by a key management device such as that described above.

[0133] The control unit of the terminal device 700 acquires the intermediate public key from the calculation device 600, encrypts the first private key using the intermediate public key by homomorphic encryption, generates a first switch key, and transmits it to the calculation device 600. The TEE 60 of the calculation device 600 uses the first switch key to execute a first key switch process on the ciphertext acquired from each terminal device 700. Note that the functional configurations of the calculation device 600 and the terminal device 700 are similar to those of the calculation device 400 and the terminal device 500, respectively, and therefore redundant explanations will be omitted.

[0134] Fig. 12 is a flow diagram showing an example of information processing in the information processing system 4. The flow of information processing in the information processing system 4 will be described with reference to Fig. 12. Note that the processing flow is an example and is not limited to the order shown in Fig. 12. Also, in Fig. 12, for ease of explanation, one or more terminal devices 700 will be described as terminal device 700-K (K is a natural number satisfying 1≦K≦N).

[0135] In step S301, the terminal device 700-K generates a key pair. Specifically, it generates a first secret key SK1_k and a public key PK1_k. Note that the key pair may be generated by a key management device external to the terminal device 700-K and acquired by the terminal device 700-K.

[0136] In step S302, the TEE 60 of the computing device 600 generates an intermediate private key InSK and an intermediate public key InPK.

[0137] In step S303, the terminal device 700-K obtains the intermediate public key InPK from the arithmetic device 600.

[0138] In step S304, the terminal device 700-K encrypts the first secret key SK1_k using the intermediate public key InPK acquired in step S303 by homomorphic encryption to generate a first switch key SWK1(SK1_k, InPK).

[0139] In step S305, the TEE 60 of the arithmetic device 600 acquires the first switch key SWK1(SK1_k, InPK) from the terminal device 700-K.

[0140] In step S306, the management control unit 810 of the management device 800 generates a management private key AdSK and a management public key AdPK.

[0141] In step S307, the TEE 60 of the arithmetic device 600 acquires the management public key AdPK from the management device 800.

[0142] In step S308, the TEE 60 of the arithmetic device 600 encrypts the intermediate private key InSK using the management public key AdPK obtained from the management device 800 by homomorphic encryption to generate a management switch key SWK2(InSK, AdPK).

[0143] In step S309, the TEE 60 of the arithmetic device 600 stores the administration switch key SWK2 (InSK, AdPK) and the first switch key SWK1 (SK1_k, InPK) corresponding to each terminal device 700-K.

[0144] In step S310, the terminal device 700-K stores the first public key PK1_k.

[0145] In step S311, the management storage unit 820 of the management device 800 stores the management private key AdSK.

[0146] The generation of the key pair (steps S301, 302, 306) may be performed simultaneously or at separate times. The same applies to the storage of the key (steps S309, 310, 311).

[0147] In step S312, the terminal device 700-K encrypts the plaintext m_k using the first public key PK1_k by homomorphic encryption to generate ciphertext Enc(m_k, PK1_k).

[0148] In step S313, the TEE 60 of the calculation device 600 acquires the ciphertext Enc(m_k, PK1_k) from the terminal device 700-K.

[0149] In step S314, the TEE 60 of the arithmetic device 600 performs a first key switch process on the ciphertext Enc(m_k, PK1_k) acquired from each terminal device 700-K, using the first switch key SWK1(SK1_k, InPK) corresponding to the terminal device 700-K that generated the ciphertext. Specifically, the TEE 60 performs a key switch process on the ciphertext Enc(m_k, PK1_k) acquired from the terminal device 700-K, using the first switch key SWK1(SK1_1, InPK) corresponding to the terminal device 700-K. By the first key switch process in step S314, the encryption key of the ciphertext acquired from each terminal device 700 is switched from the first public key PK1_k generated in each terminal device 700-K to the intermediate public key InPK.

[0150] In step S315, the TEE 60 of the arithmetic device 600 executes arithmetic processing based on each ciphertext Enc(m_k, InPK) on which the first key switch processing has been executed. For example, in response to a request from the user of the terminal device 700-K or the management device 800, the TEE 60 performs machine learning learning processing, inference processing, etc. on each ciphertext Enc(m_k, InPK) while keeping it encrypted.

[0151] In step S316, the TEE 60 of the arithmetic device 600 receives from the management device 800 a request to transmit the result (m′) of the arithmetic processing.

[0152] In step S317, in response to the request to transmit the arithmetic processing result (m'), the TEE 60 of the arithmetic device 600 executes a second key switch process on the arithmetic processing result using the management switch key SWK2(InSK, AdPK) corresponding to the management device 800 that issued the transmission request. Specifically, in response to the request to transmit the arithmetic processing result from the management device 800, the TEE 60 executes a key switch process on the ciphertext Enc(m', InPK), which is the arithmetic processing result, using the management switch key SWK2(InSK, AdPK), to generate the ciphertext Enc(m', AdPK), i.e., the ciphertext encrypted with the management public key AdPK generated by the management device 800. Note that the arithmetic device 600 may previously execute the second key switch process on the arithmetic processing result (m') using the management switch key SWK2(InSK, AdPK) corresponding to the management device 800 and store the result in a storage unit or the like, and then transmit the result of the arithmetic processing on which the second key switch process has been executed to the management device 800 in response to a transmission request from the management device 800.

[0153] In step S318, the management device 800 acquires the ciphertext Enc(m', AdPK).

[0154] In step S319, the management device 800 decrypts the ciphertext Enc(m', AdPK) using the management private key AdSK. In this way, the management device 800 can securely obtain the result m' of the arithmetic processing of the plaintext m_k held by the terminal device 700-K by decrypting the result of the key switch processing. The management device 800 can also obtain and decrypt the plaintext m_k held by the terminal device 700-K by a similar key switch processing.

[0155] In the third embodiment, similarly to the modified example of the first embodiment, the processing performed by the TEE 60 of the arithmetic device 600 may be performed by a normal execution environment in the OS of the arithmetic device 600. When the normal execution environment performs the processing, the hardware cost can be reduced compared to when a TEE is used. Furthermore, the execution environment of the arithmetic device 400 may be realized by constructing a virtual execution environment.

[0156] Furthermore, similar to the modification of the first embodiment, in the normal execution environment of the arithmetic device 600, an execution area such as a memory space may be divided into a key management area and an arithmetic area. By dividing the areas in this way, the risk of unauthorized access to the switch key can be reduced, and the overall security of the system can be improved.

[0157] (Explanation of effect) As described above, this embodiment further includes a management device in addition to the computing device and the terminal devices. Although the management device itself does not provide data, by key switch processing using the management switch key, only the management device can decrypt and view data encrypted and provided from each terminal device, as well as the results of computations performed based on the encrypted data provided from each terminal device. This makes it easy to control management authority in the platform.

[0158] <Modification of Example 3> In a modification of the third embodiment, the terminal device 700 may generate a second private key and public key in addition to the first private key and public key in the information processing system 4. The terminal device 700 generates the second private key and public key, and the calculation device 600 generates a second switch key, so that the terminal device 700 can also decrypt the ciphertext that has undergone the second key switch processing.

[0159] (Explanation of effect) The data held by each organization (user) participating in the information processing system 4 is processed in an encrypted state without being disclosed, and each user can decrypt and view the calculation results, etc., and even a management device that does not provide the data can view the data held by each organization and its calculation results.

[0160] The above-described embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and modifications are intended to be included in the scope of the invention and their equivalents as defined in the claims, as well as in the scope and spirit of the invention.

[0161] The present invention may also be embodied in the following additional notes. [Appendix 1] a plurality of user terminals each having a user control unit and a user storage unit; a computing device having an execution area for performing computations; 1. A method for use in a system comprising: At each of the user terminals, the user control unit generates a first private key and a public key, and a second private key and a public key; the execution domain generating an intermediate private key and an intermediate public key; The user control unit in each of the user terminals acquires the intermediate public key; The user control unit in each of the user terminals encrypts the first private key using the intermediate public key by homomorphic encryption to generate a first switch key; The execution domain obtains the first switch key and the second public key generated by the user control unit in each of the user terminals; The execution domain encrypts the intermediate private key using the second public key obtained from each of the user terminals using a homomorphic encryption scheme to generate a second switch key; the execution domain storing the first switch key and the second switch key corresponding to each of the user terminals; a step in which the user storage unit in each of the user terminals stores the first public key and the second private key generated by the user control unit of the user terminal; The user control unit in each of the user terminals encrypts plaintext using the first public key by homomorphic encryption to generate ciphertext; a step in which the execution area executes a first key switch process on the ciphertext acquired from the user control unit in each of the user terminals, using the first switch key corresponding to the user terminal that generated the ciphertext; a step in which the execution domain executes an arithmetic operation based on the ciphertext on which the first key switch operation has been executed; the execution area receiving a request to transmit the result of the arithmetic processing from the user terminal; a step in which the execution area executes a second key switch process on the result of the arithmetic process using the second switch key corresponding to the user terminal that has made the transmission request; the user control unit in the user terminal that has made the transmission request acquires a result of the arithmetic processing in which the second key switch processing has been executed, and decrypts the result using the second private key stored in the user storage unit in the user terminal; An information processing method comprising: [Appendix 2] The information processing method described in [Appendix 1], wherein the first private key and public key, and the second private key and public key generated by each of the user terminals are different keys. [Appendix 3] The information processing method according to [Appendix 1], wherein the arithmetic processing includes at least processing related to addition or multiplication of homomorphic ciphertext. [Appendix 4] The information processing method according to [Appendix 1], wherein the key switch process is a process of switching an encryption key of a homomorphic ciphertext to another encryption key. [Appendix 5] After at least one of the plurality of user terminals generates the first switch key, deleting the first private key generated by the user terminal; or The information processing method described in [Appendix 1] further comprises at least one of the steps of: deleting the intermediate private key after the execution area generates the second switch key. [Appendix 6] a plurality of user terminals each having a user control unit and a user storage unit; a management device having a management control unit and a management storage unit; a computing device having an execution area for performing computations; 1. A method for use in a system comprising: At each of the user terminals, the user control unit generates a first private key and a public key; the execution domain generating an intermediate private key and an intermediate public key; The user control unit in each of the user terminals acquires the intermediate public key; The user control unit in each of the user terminals encrypts the first private key using the intermediate public key by homomorphic encryption to generate a first switch key; the execution domain obtaining the first switch key generated by the user control unit in each of the user terminals; the management control unit of the management device generating a management public key and a management private key; the execution domain obtaining the management public key; The execution domain encrypts the intermediate private key using the management public key obtained from the management device using a homomorphic encryption scheme to generate a management switch key; the execution domain storing the management switch key and the first switch key corresponding to each of the user terminals; The user storage unit in each of the user terminals stores the first public key generated by the user control unit of the user terminal; the management storage unit of the management device storing the management private key; The user control unit in each of the user terminals encrypts plaintext using the first public key by homomorphic encryption to generate ciphertext; a step in which the execution area executes a first key switch process on the ciphertext acquired from the user control unit in each of the user terminals, using the first switch key corresponding to the user terminal that generated the ciphertext; a step in which the execution domain executes an arithmetic operation based on the ciphertext on which the first key switch operation has been executed; the execution area receiving a request to transmit the result of the arithmetic processing from the management device; the execution area executing a second key switch process using the managed switch key on the result of the arithmetic process; the management control unit of the management device acquiring a result of the arithmetic processing in which the second key switch processing has been executed, and decrypting the result using the management private key; An information processing method comprising: [Appendix 7] An information processing method described in any one of [Appendix 1] to [Appendix 6], wherein the execution area includes a trusted execution environment, which is a security mechanism of the processor. [Appendix 8] The information processing method according to any one of [Appendix 1] to [Appendix 6], wherein the execution area is divided into a key management area and a calculation area. [Appendix 9] a plurality of user terminals each having a user control unit and a user storage unit; a computing device having an execution area for performing computations; A program used in a system comprising: At each of the user terminals, the user control unit generates a first private key and a public key, and a second private key and a public key; the execution domain generating an intermediate private key and an intermediate public key; The user control unit in each of the user terminals acquires the intermediate public key; The user control unit in each of the user terminals encrypts the first private key using the intermediate public key by homomorphic encryption to generate a first switch key; The execution domain obtains the first switch key and the second public key generated by the user control unit in each of the user terminals; The execution domain encrypts the intermediate private key using the second public key obtained from each of the user terminals using a homomorphic encryption scheme to generate a second switch key; the execution domain storing the first switch key and the second switch key corresponding to each of the user terminals; a step in which the user storage unit in each of the user terminals stores the first public key and the second private key generated by the user control unit of the user terminal; The user control unit in each of the user terminals encrypts plaintext using the first public key by homomorphic encryption to generate ciphertext; a step in which the execution area executes a first key switch process on the ciphertext acquired from the user control unit in each of the user terminals, using the first switch key corresponding to the user terminal that generated the ciphertext; a step in which the execution domain executes an arithmetic operation based on the ciphertext on which the first key switch operation has been executed; the execution area receiving a request to transmit the result of the arithmetic processing from the user terminal; a step in which the execution area executes a second key switch process on the result of the arithmetic process using the second switch key corresponding to the user terminal that has made the transmission request; the user control unit in the user terminal that has made the transmission request acquires a result of the arithmetic processing in which the second key switch processing has been executed, and decrypts the result using the second private key stored in the user storage unit in the user terminal; An information processing program comprising: [Appendix 10] a plurality of user terminals each having a user control unit and a user storage unit; a computing device having an execution area for performing computations; A system comprising: At each of the user terminals, the user control unit generates a first private key and a public key, and a second private key and a public key; the execution domain generates an intermediate private key and an intermediate public key; the user control unit in each of the user terminals acquires the intermediate public key; The user control unit in each of the user terminals encrypts the first private key using the intermediate public key by homomorphic encryption to generate a first switch key; The execution domain acquires the first switch key and the second public key generated by the user control unit in each of the user terminals; The execution domain encrypts the intermediate private key using the second public key obtained from each of the user terminals using a homomorphic encryption scheme to generate a second switch key; the execution area stores the first switch key and the second switch key corresponding to each of the user terminals; the user storage unit in each of the user terminals stores the first public key and the second private key generated by the user control unit of the user terminal; the user control unit in each of the user terminals encrypts plaintext using the first public key by homomorphic encryption to generate ciphertext; the execution area executes a first key switch process on the ciphertext acquired from the user control unit in each of the user terminals, using the first switch key corresponding to the user terminal that generated the ciphertext; the execution region executes an arithmetic operation based on the ciphertext on which the first key switch operation has been executed; the execution area receives a transmission request for the result of the arithmetic processing from the user terminal; the execution area executes a second key switch process on the result of the arithmetic process using the second switch key corresponding to the user terminal that has made the transmission request; the user control unit in the user terminal that has made the transmission request acquires the result of the arithmetic processing in which the second key switch processing has been executed, and decrypts the result using the second private key stored in the user storage unit in the user terminal; Information processing system. [Appendix 11] a user terminal having a user control unit and a user storage unit; a computing device having an execution area for performing computations; 1. A method for use in a system comprising: the user control generating a first private key and a first public key, and a second private key and a second public key; The user control unit encrypts the first private key using the second public key by homomorphic encryption to generate a switch key; the execution area storing the switch key obtained from the user control; the user storage unit storing at least the first public key and the second private key; the user control unit encrypting plaintext using the first public key by homomorphic encryption to generate ciphertext; The execution area executes a calculation process based on the ciphertext acquired from the user control unit; a step in which the execution area executes a key switch process using the switch key on the result of the arithmetic process; the user control unit acquiring a result of the key switch process executed by the execution area and decrypting the result using the second private key; An information processing method comprising: [Appendix 12] The information processing method according to [Appendix 11], wherein the arithmetic processing includes at least processing related to addition or multiplication of homomorphic ciphertext. [Appendix 13] The information processing method according to [Appendix 11], wherein the key switch process is a process of switching an encryption key of a homomorphic ciphertext to another encryption key. [Appendix 14] The information processing method described in [Supplementary Note 11], further comprising a step in which the user control unit deletes the first private key after generating the switch key. [Appendix 15] An information processing method described in any one of [Appendix 11] to [Appendix 14], wherein the execution area includes a trusted execution environment, which is a security mechanism of the processor. [Appendix 16] An information processing method according to any one of [Appendix 11] to [Appendix 14], wherein the execution area is divided into a key management area and a calculation area. [Appendix 17] a user terminal having a user control unit and a user storage unit; a computing device having an execution area for performing computations; A program used in a system comprising: the user control generating a first private key and a first public key, and a second private key and a second public key; The user control unit encrypts the first private key using the second public key by homomorphic encryption to generate a switch key; the execution area storing the switch key obtained from the user control; the user storage unit storing at least the first public key and the second private key; the user control unit encrypting plaintext using the first public key by homomorphic encryption to generate ciphertext; The execution area executes a calculation process based on the ciphertext acquired from the user control unit; a step in which the execution area executes a key switch process using the switch key on the result of the arithmetic process; the user control unit acquiring a result of the key switch process executed by the execution area and decrypting the result using the second private key; An information processing program comprising: [Appendix 18] a user terminal having a user control unit and a user storage unit; a computing device having an execution area for performing computations; A system comprising: the user control generates a first private key, a first public key, and a second private key and a second public key; the user control unit encrypts the first private key using the second public key by homomorphic encryption to generate a switch key; the execution area stores the switch key obtained from the user control unit; the user storage unit stores at least the first public key and the second private key; the user control unit encrypts plaintext using the first public key by homomorphic encryption to generate ciphertext; The execution area executes a calculation process based on the ciphertext acquired from the user control unit, the execution area executes a key switch process using the switch key on the result of the arithmetic process; the user control unit acquires the result of the key switch process executed by the execution area and decrypts it using the second private key; Information processing system. [Explanation of symbols]

[0162] 1,2,3,4 Information processing system, 10,40,60 TEE, 100,300,400,600 arithmetic unit, 200,500,700 terminal device, 110,210 communication unit, 120,220,520 memory unit, 130,230 input unit, 140,240 output unit, 150,250,450,550 control unit, 800 management device, 810 management control unit, 820 management memory unit.

Claims

1. A user terminal having a user control unit and a user storage unit; A computing device having an execution domain for performing computations; 1. A method for use in a system comprising: the user control generating a first private key and a first public key, and a second private key and a second public key; The user control unit encrypts the first private key using the second public key by homomorphic encryption to generate a switch key; storing the switch key obtained from the user control unit in the execution area; The user storage unit stores at least the first public key and the second private key; The user control unit encrypts a plaintext using the first public key by homomorphic encryption to generate a ciphertext; The execution area executes a calculation process based on the encrypted text acquired from the user control unit; a step of executing a key switch process by the execution area using the switch key on the result of the arithmetic process; the user control unit acquiring a result of the key switch process executed by the execution area and decrypting the result using the second private key; An information processing method comprising:

2. The information processing method according to claim 1 , wherein the arithmetic processing includes at least a process related to addition or multiplication of homomorphic ciphertext.

3. The information processing method according to claim 1 , wherein the key switch process is a process of switching an encryption key for a homomorphic ciphertext to another encryption key.

4. The information processing method according to claim 1 , further comprising the step of: the user control unit deleting the first secret key after generating the switch key.

5. The information processing method according to claim 1 , wherein the execution domain includes a trusted execution environment that is a security mechanism of a processor.

6. The information processing method according to claim 1 , wherein the execution area is divided into a key management area and a calculation area.

7. A user terminal having a user control unit and a user storage unit; A computing device having an execution domain for performing computations; A program for use in a system comprising: the user control generating a first private key and a first public key, and a second private key and a second public key; The user control unit encrypts the first private key using the second public key by homomorphic encryption to generate a switch key; storing the switch key obtained from the user control unit in the execution area; The user storage unit stores at least the first public key and the second private key; The user control unit encrypts a plaintext using the first public key by homomorphic encryption to generate a ciphertext; The execution area executes a calculation process based on the encrypted text acquired from the user control unit; a step of executing a key switch process by the execution area using the switch key on the result of the arithmetic process; the user control unit acquiring a result of the key switch process executed by the execution area and decrypting the result using the second private key; An information processing program comprising:

8. A user terminal having a user control unit and a user storage unit; A computing device having an execution domain for performing computations; A system comprising: the user control generates a first private key and a first public key, and a second private key and a second public key; The user control unit encrypts the first private key using the second public key by homomorphic encryption to generate a switch key; The execution area stores the switch key obtained from the user control unit; the user storage unit stores at least the first public key and the second private key; the user control unit encrypts a plaintext using the first public key by homomorphic encryption to generate a ciphertext; The execution area executes a calculation process based on the ciphertext acquired from the user control unit; the execution area executes a key switch process using the switch key on the result of the arithmetic process; the user control unit acquires a result of the key switch process executed by the execution area, and decrypts the result using the second private key; Information processing system.

Images