Information processing method, information processing program, and information processing system

Abstract

To prevent leakage of cryptographic keys.SOLUTION: A system comprises a user terminal, and a computation device that has an execution area for performing a computation. In the system, the user terminal generates a first secret key and a first public key, as well as a second secret key and a second public key; uses the second public key to encrypt the first secret key under a homomorphic encryption scheme; and generates a switch key. The execution area stores the switch key acquired from the user terminal. The user terminal uses the first public key to encrypt a plaintext under the homomorphic encryption scheme and generates a ciphertext, and the execution area executes a computation process on the basis of the ciphertext acquired from the user terminal. Additionally, the execution area uses the switch key to execute a key switch process on the result of the computation process, and the user terminal acquires the result of the key switch process executed by the execution area and uses the second secret key to decrypt the result.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present disclosure relates to an information processing method, an information processing program, and an information processing system. [Background technology]

[0002] In recent years, in various fields, there is a growing trend for companies to utilize data not only internally but also through collaboration with external companies and organizations via networks. Therefore, security measures for highly confidential information such as personal information and trade secrets are becoming more and more important.

[0003] As a security measure, cryptographic techniques that allow calculations to be performed on encrypted data are known. For example, Non-Patent Document 1 discloses a technique using homomorphic encryption that allows calculations to be performed on ciphertext. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] C. Gentry, “Fully Homomorphic Encryption Using Ideal Lattices”, STOC 2009, pp. 169-178, 2009. Summary of the Invention [Problem to be solved by the invention]

[0005] However, even if it is possible to encrypt confidential information using homomorphic encryption and perform computations on the ciphertext as is, once the encryption key is leaked, there is a risk that the encrypted confidential information will be decrypted and the information will be leaked.

[0006] Therefore, the present disclosure has been made to solve the above problem, and has an object to provide an information processing method that prevents leakage of an encryption key. [Means for solving the problem]

[0007] In order to achieve the above-mentioned object, an information processing method according to the present disclosure is a method used in a system including a user terminal having a user control unit and a user memory unit, and a calculation device having an execution area for performing calculations, and includes the steps of: the user control unit generating a first private key and a first public key, as well as a second private key and a second public key; the user control unit encrypting the first private key using a homomorphic encryption scheme with the second public key to generate a switch key; the execution area storing the switch key acquired from the user control unit; the user memory unit storing at least the first public key and the second private key; the user control unit encrypting plaintext using the homomorphic encryption scheme with the first public key to generate a ciphertext; the execution area performing calculation processing based on the ciphertext acquired from the user control unit; the execution area performing key switch processing on the result of the calculation processing using the switch key; and the user control unit acquiring a result of the key switch processing performed by the execution area and decrypting it using the second private key.

[0008] In addition, in order to achieve the above-mentioned object, an information processing program according to the present disclosure is a program used in a system including a user terminal having a user control unit and a user memory unit, and a calculation device having an execution area for performing calculations, and includes the steps of: the user control unit generating a first private key and a first public key, as well as a second private key and a second public key; the user control unit encrypting the first private key using a homomorphic encryption scheme with the second public key to generate a switch key; the execution area storing the switch key acquired from the user control unit; the user memory unit storing at least the first public key and the second private key; the user control unit encrypting plaintext using the homomorphic encryption scheme with the first public key to generate a ciphertext; the execution area executing calculation processing based on the ciphertext acquired from the user control unit; the execution area executing key switch processing on the result of the calculation processing using the switch key; and the user control unit acquiring a result of the key switch processing executed by the execution area and decrypting it using the second private key.

[0009] In addition, in order to achieve the above-mentioned object, the information processing system of the present disclosure is a system comprising a user terminal having a user control unit and a user memory unit, and a calculation device having an execution area for performing calculations, in which the user control unit generates a first private key and a first public key, as well as a second private key and a second public key, the user control unit encrypts the first private key using a homomorphic encryption scheme with the second public key to generate a switch key, the execution area stores the switch key acquired from the user control unit, the user memory unit stores at least the first public key and the second private key, the user control unit encrypts plaintext using the homomorphic encryption scheme with the first public key to generate a ciphertext, the execution area executes calculation processing based on the ciphertext acquired from the user control unit, the execution area executes key switch processing on the result of the calculation processing using the switch key, and the user control unit acquires the result of the key switch processing executed by the execution area and decrypts it using the second private key. Effect of the Invention

[0010] According to the present disclosure, it is possible to provide an information processing method that prevents leakage of an encryption key. [Brief description of the drawings]

[0011] [Figure 1] 1 is an overall view of an information processing system 1. FIG. [Diagram 2] FIG. 2 is a diagram illustrating a hardware configuration of a calculation device 100. [Diagram 3] FIG. 2 is a block diagram showing the functional configuration of a calculation device 100. [Figure 4] FIG. 2 is a block diagram showing the functional configuration of a terminal device 200. [Diagram 5] 2 is a flow diagram showing an example of information processing in the information processing system 1. FIG. [Figure 6] FIG. 4 is a diagram illustrating a concept of key switch processing. [Figure 7] FIG. 2 is an overall view of an information processing system 3. [Figure 8] FIG. 4 is a block diagram showing the functional configuration of a calculation device 400. [Figure 9] FIG. 5 is a block diagram showing the functional configuration of a terminal device 500. [Figure 10] 4 is a flow diagram showing an example of information processing in the information processing system 3. FIG. [Figure 11] FIG. 2 is an overall view of an information processing system 4. [Figure 12] 4 is a flow diagram showing an example of information processing in the information processing system 4. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In all drawings describing the embodiments, common components are given the same reference numerals, and repeated explanations will be omitted. Note that the following embodiments do not unduly limit the contents of the present disclosure described in the claims. In addition, not all components shown in the embodiments are necessarily essential components of the present disclosure.

[0013] <Summary of the Invention> In the information processing system according to the present invention, calculations of ciphertext encrypted by homomorphic encryption, which is an encryption method that allows calculations to be performed in an encrypted state, and key switch processing using bootstrapping, which switches encryption key A used for encryption by homomorphic encryption to another encryption key B without decrypting the ciphertext, are performed in a trusted execution environment (TEE), which is a security mechanism of a processor. By performing calculations of ciphertext encrypted by homomorphic encryption and key switch processing in an area that is strictly protected at the hardware level, information leakage due to key leakage and tampering attacks on calculation results is prevented.

[0014] Fig. 6 is a diagram for explaining the concept of key switch processing. The concept of key switch processing, which is a well-known technique, will be explained with reference to Fig. 6. Details of the key switch processing are described in Document A. Document A: Ilaria Chillotti, Nicolas Gama, Mariya Georgieva & Malika Izabachene, “TFHE: Fast Fully Homomorphic Encryption Over the Torus”, Journal of Cryptology 33,34-91(2020)

[0015] The key switch process is a process of switching (converting) the encryption key used when generating ciphertext encrypted by homomorphic encryption to another encryption key without decrypting the ciphertext. In the example of Fig. 6, a process of switching the encryption key for plaintext m from a first public key PK1 to a second public key PK2 will be described. In the explanation of Fig. 6, "encryption" means encryption by homomorphic encryption.

[0016] In Fig. 6, first, the first secret key SK1 is encrypted using the second public key PK2 to generate a switch key SWK (=Enc(SK1, PK2)) (arrow A1). Meanwhile, the plaintext m is encrypted using the first public key PK1 to generate a ciphertext Enc(m, PK1) (arrow A2). Then, the generated ciphertext Enc(m, PK1) is encrypted using the switch key SWK to perform a key switch process, and the key can be switched to ciphertext Enc(m, PK2) encrypted from the plaintext m using the second public key PK2 (arrow A3). The ciphertext Enc(m, PK2) can be decrypted using the second secret key SK2 (arrow A4).

[0017] Since the plaintext m is encrypted with the first public key PK1 and the first secret key SK1 that decrypts the ciphertext Enc(m, PK1) is encrypted with the second public key PK2, anyone performing key switch processing using the switch key SWK can switch the encryption key (first public key PK1) of the ciphertext Enc(m, PK1) to another encryption key (second public key PK2) without knowing the contents of the plaintext m or the first secret key SK1.

[0018] In the information processing system of the present invention, the above-mentioned key switch processing is executed in a TEE, which is a trusted execution area, thereby preventing information leakage to the outside. Furthermore, even if the TEE is subjected to an unauthorized attack, the risk of key leakage can be reduced by securely storing the decryption key (second private key) for decrypting the ciphertext generated by the key switch processing on the switch key generation side. EXAMPLES

[0019] (Configuration of Information Processing System 1) Fig. 1 is an overall view of an information processing system 1. The overall view of the information processing system according to this embodiment will be described with reference to Fig. 1.

[0020] The information processing system 1 according to the present embodiment includes a calculation device 100 and one or more terminal devices 200 used by a user. The calculation device 100 and the terminal devices 200 are communicably connected via a network NW. The network NW is configured from a wide area network (WAN) or a local area network (LAN). In the information processing system 1, the calculation device 100 performs calculation processes such as statistical processing, database search processing, machine learning learning processing, and inference processing on data transmitted from the terminal devices 200 while keeping the data encrypted.

[0021] The computing device 100 includes a TEE 10. A TEE (Trusted Execution Environment) is a type of secure hardware and a security mechanism for a processor. The TEE 10 can execute a program while protecting highly confidential data by generating an isolated area that is tightly protected at the hardware level, called an enclave, on a memory, for example.

[0022] The terminal device 200 accepts input from a user and transmits the input contents to the arithmetic device 100 via the network NW. The terminal device 200 also receives data transmitted from the arithmetic device 100 via the network NW and presents the data to the user. There may be a plurality of terminal devices 200. The results of the arithmetic device 100 performing arithmetic processing on the data transmitted from the terminal device 200 may be acquired by another terminal device 200.

[0023] (Hardware configuration of the arithmetic device 100) Fig. 2 is a diagram showing a hardware configuration of the arithmetic device 100. The hardware configuration of the arithmetic device 100 according to this embodiment will be described with reference to Fig. 2.

[0024] The computing device 100 may be realized, for example, by a general-purpose computer such as a workstation, a server computer, a stationary PC (Personal Computer), a laptop PC, etc., or may be logically realized by cloud computing.

[0025] The arithmetic device 100 includes a processor 11, a memory 12, a storage 13, a communication IF 14, and an input / output IF 15.

[0026] The processor 11 is hardware for executing an instruction set written in a program, and controls the operation of the entire computer. The processor 11 includes the TEE 10. Within the enclave of the TEE 10, programs are executed in a state that cannot be referenced from the outside, and data is stored in a state that cannot be referenced from the outside.

[0027] The memory 12 is for temporarily storing programs and data to be processed by the programs, etc. The memory 12 is realized by a volatile memory such as a DRAM (Dynamic Random Access Memory). The programs stored in the memory 12 are programs for executing the information processing method according to the present invention, etc.

[0028] The storage 13 is a storage device for saving data and is realized by, for example, a flash memory, a hard disc drive (HDD), etc.

[0029] The communication IF 14 is an interface for transmitting and receiving signals so that the arithmetic device 100 can communicate with an external device, for example, a wireless communication device for wireless communication, a Universal Serial Bus (USB) connector for serial communication, or the like.

[0030] The input / output IF 15 is an interface between an input device for receiving input from a user and an output device for presenting information to the user. The input device is realized by, for example, a keyboard, a mouse, a touch panel, a button, a microphone, etc. The output device is realized by, for example, a display, a printer, a speaker, etc.

[0031] The hardware configuration of the terminal device 200 may be the same as that shown in Fig. 2 except that the TEE 10 is omitted. The operation of each component of the terminal device 200 is realized by the processor 11 according to a program stored in the memory 12, similar to the above-mentioned arithmetic device 100.

[0032] (Functional configuration of the arithmetic device 100) Fig. 3 is a block diagram showing a functional configuration of the arithmetic device 100. The functional configuration of the arithmetic device 100 according to the first embodiment will be described with reference to Fig. 3.

[0033] The arithmetic device 100 includes a communication unit 110, a storage unit 120, an input unit 130, an output unit 140, and a control unit 150.

[0034] The communication unit 110 performs processing for the arithmetic device 100 to communicate with other devices. The other devices may be PCs connected via a network, or terminals such as smartphones and tablets. The other devices may also be input / output devices, such as flash memories and HDDs, that input and output data.

[0035] The communication unit 110 also transmits and receives data through a secure communication channel with devices connected via the network NW or locally, etc. The construction of a secure communication channel and the communication method are well-known techniques using a common key (such as a session key) or a public key, so a description thereof will be omitted.

[0036] The storage unit 120 is configured, for example, with a volatile memory such as a RAM, a flash memory, a HDD, etc., and stores data used by the arithmetic device 100 and computer programs used for various processes. The computer programs may be installed from a predetermined server or the like, or may be installed from a computer-readable portable recording medium using a known setup program or the like. The portable recording medium is, for example, a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), etc.

[0037] The storage unit 120 may include, for example, a machine learning model database that stores a machine learning model used in the arithmetic device 100. The storage unit 120 may also include, for example, a key database that stores a key for the control unit 150 described later to encrypt data or decrypt encrypted data, and a key for communication. The key database may include, for example, a public key generated by the terminal device 200 described later. Note that the key may not be stored in the arithmetic device 100, but may be stored in a secure key management device (not shown) that is connected to the arithmetic device 100 via a network or directly.

[0038] The input unit 130 is an interface that accepts user input to the arithmetic device 100. The input unit 130 is, for example, a keyboard, a touch panel, or a microphone that detects voice input, but is not limited to these.

[0039] The output unit 140 is an interface that outputs information to notify a user of the arithmetic device 100. The output unit 140 is, for example, a display or a speaker that outputs audio, but is not limited to these. The output unit 140 displays data received from the terminal device 200 or the like on a display.

[0040] The control unit 150 is a processor such as a CPU (Central Processing Unit) that controls each function of the arithmetic device 100 and operates based on a program stored in the storage unit 120 in advance.

[0041] The control unit 150 includes the TEE 10. The TEE 10 is a trusted execution area, and as described above, within the enclave of the TEE 10, programs are executed in a state that cannot be referenced from the outside, and data is stored in a state that cannot be referenced from the outside. The control unit 150 includes an execution area other than the TEE (REE; Rich Execution Environment, not shown in FIG. 3). The REE is an execution area isolated from the TEE, and realizes the basic functions of the processor.

[0042] The TEE 10 stores a switch key acquired from the terminal device 200, which will be described later. In this embodiment, the switch key can switch the encryption key of the ciphertext from the first public key to the second public key. The TEE 10 may also store the first public key and / or the second public key acquired from the terminal device 200.

[0043] Furthermore, the TEE 10 executes arithmetic processing based on the ciphertext acquired from the terminal device 200 via the communication unit 110. The arithmetic processing includes at least processing related to addition or multiplication between homomorphic ciphertexts, and may perform statistical processing, database search processing, machine learning learning processing, inference processing, and the like. For example, when performing the inference processing, the above-mentioned machine learning model may be encrypted by homomorphic encryption using the same encryption key (first public key or second public key) as the encryption key used for the ciphertext to be inferred. If the machine learning model is encrypted with the same encryption key as the encryption key used for the ciphertext to be inferred, the effort of performing key switching processing can be saved compared to using a different encryption key, and calculation efficiency can be improved.

[0044] Examples of encryption methods having homomorphism include the Paillier method, the ElGamal method, the Lifted-ElGamal method, the Somewhat Homomorphic Encryption method, the Fully Homomorphic Encryption method, the RSA method, the Elliptic Curve Cryptography method, the Elliptic Curve Cryptography (L1 configuration) method, the Lattice Cryptography (BFV, BGV) method, the Lattice Cryptography (CKKS) method, the Lattice Cryptography (TFHE) method, the Lattice Cryptography (TFHE variant) method, the Goldwasser-Micali cryptography method, the NTRU cryptography method, and the DGHV (Dijk, Gentry, Halevi, and Vaikuntanathan) cryptography method. If the memory available in the TEE is not large enough to execute the arithmetic processing, the arithmetic processing may be configured to be executed in a secure execution area other than the TEE 10 of the control unit 150. The secure execution area may be realized by an area that is difficult to access from the outside, for example, by temporarily constructing a virtual execution area. The arithmetic processing may be configured to be executed in the REE.

[0045] Furthermore, the TEE 10 executes a key switch process on the result of the arithmetic process using a switch key. The key switch process is a process of switching an encryption key of a homomorphic ciphertext to another encryption key. In this embodiment, the TEE 10 executes the key switch process using the switch key to switch the encryption key of the ciphertext from a first public key to a second public key.

[0046] (Functional configuration of terminal device 200) Fig. 4 is a block diagram showing a functional configuration of the terminal device 200. The functional configuration of the terminal device 200 according to the first embodiment will be described with reference to Fig. 4.

[0047] The terminal device 200 is a “user terminal” and includes a communication unit 210 , a storage unit 220 , an input unit 230 , an output unit 240 , and a control unit 250 .

[0048] The communication unit 210 performs processing for the terminal device 200 to communicate with other devices. The function of the communication unit 210 is similar to that of the communication unit 110 of the arithmetic device 100, and therefore a duplicated description will be omitted.

[0049] The storage unit 220 functions as a "user storage unit" and is composed of, for example, a volatile memory such as a RAM, a flash memory, a HDD, etc. The storage unit 220 stores data used by the terminal device 200 and computer programs used for various processes. The functions of the storage unit 220 are similar to those of the storage unit 220 of the terminal device 200, so duplicated explanations will be omitted.

[0050] The storage unit 220 stores at least a first public key and a second private key generated by the control unit 250, which will be described later. Note that these keys may not be stored within the terminal device 200, but may be stored in a secure key management device (not shown) that is connected to the terminal device 200 via a network or directly.

[0051] The functions of the input section 230 and the output section 240 are similar to those of the input section 130 and the output section 140 of the arithmetic device 100, and therefore a duplicated description will be omitted.

[0052] The control unit 250 functions as a “user control unit”, controls each function of the terminal device 200, and is a processor such as a CPU (Central Processing Unit) that operates based on a program stored in the storage unit 220 in advance.

[0053] The control unit 250 generates two sets of key pairs. Specifically, the control unit 250 generates a first private key and a first public key, and a second private key and a second public key. Note that these two sets of key pairs may be generated by a key management device as described above.

[0054] Furthermore, the control unit 250 encrypts the first private key using the second public key by homomorphic encryption to generate a switch key. The control unit 250 transmits the generated switch key to the arithmetic device 100 via the communication unit 210. After transmitting the switch key to the arithmetic device 100, the control unit 250 may delete the switch key or store it in the storage unit 220.

[0055] Furthermore, the control unit 250 encrypts plaintext input via the communication unit 210 or the input unit 230 using the first public key according to homomorphic encryption to generate ciphertext.

[0056] Furthermore, the control unit 250 acquires the result of the second arithmetic processing executed by the TEE 10 via the communication unit 210, and decrypts it using the second private key. This makes it possible to acquire the content of the result of the second arithmetic processing without it being revealed to the outside.

[0057] Note that the control unit 250 may delete the first private key after generating the switch key. By deleting (destroying) the first private key, the first private key will not be leaked to the outside, and the risk that a ciphertext generated by encryption using the first public key will be decrypted by a third party can be reduced.

[0058] Fig. 5 is a flow diagram showing an example of information processing in the information processing system 1. The flow of information processing in the information processing system 1 will be described with reference to Fig. 5. Note that the flow of processing is an example, and is not limited to the order shown in Fig. 5.

[0059] In step S101, the control unit 250 of the terminal device 200 generates two key pairs. Specifically, it generates a first secret key SK1 and a first public key PK1, and a second secret key SK2 and a second public key PK2. Note that these key pairs may be generated by a key management device outside the terminal device 200 and acquired by the terminal device 200.

[0060] In step S102, the control unit 250 of the terminal device 200 encrypts the first secret key SK1 using the second public key PK2 by homomorphic encryption to generate the switch key SWK.

[0061] In step S103, the TEE 10 of the arithmetic device 100 acquires the switch key SWK generated in step S102 from the terminal device 200 and stores it. In addition, the TEE 10 or the storage unit 120 may acquire the first public key PK1 or the second public key PK2 from the terminal device 200 and store it.

[0062] Furthermore, the storage unit 220 of the terminal device 200 stores at least the first public key and the second secret key. The control unit 250 of the terminal device 200 may delete the first secret key SK1 after generating the switch key SWK. By deleting the first secret key SK1, it is possible to reduce the risk that a ciphertext generated by encryption using the first public key will be decrypted.

[0063] In step S104, the control unit 250 of the terminal device 200 encrypts the plaintext m using the first public key PK1 by homomorphic encryption to generate the ciphertext Enc(m, PK1).

[0064] In step S105, the TEE 10 of the arithmetic device 100 obtains the ciphertext Enc(m, PK1) from the terminal device 200 and executes arithmetic processing. For example, based on a request from a user of the terminal device 200, the TEE 10 performs statistical processing, database search processing, machine learning learning processing, inference processing, or the like on the ciphertext Enc(m, PK1) while keeping it encrypted. Note that when multiplication or addition is efficiently performed on the ciphertext Enc(m, PK1) with another ciphertext, the other ciphertext may be encrypted by the first public key PK1.

[0065] In step S106, the TEE 10 of the arithmetic device 100 executes a key switch process on the result of the arithmetic process using the switch key SWK. Specifically, the TEE 10 executes a key switch process on the ciphertext Enc(m', PK1) that is the result of the arithmetic process using the switch key SWK to generate a ciphertext Enc(m', PK2) encrypted with the second public key PK2.

[0066] In step S107, the control unit 250 of the terminal device 200 obtains the ciphertext Enc(m', PK2) which is the result of the key switch processing from the arithmetic device 100, and decrypts it using the second secret key SK2. In this way, the terminal device 200 can safely obtain the result m' of the arithmetic processing on the plaintext m by decrypting the result of the key switch processing.

[0067] The terminal device 200 may share the second secret key with another terminal device 200 and provide the result of the key switch processing to the other terminal device 200. The result m' of the arithmetic processing can be provided to the other terminal device 200 without disclosing the plaintext m held by the terminal device 200.

[0068] (Explanation of effect) As described above, in the information processing system according to the present invention, calculations of ciphertext encrypted by homomorphic encryption, which is an encryption method that allows calculations to be performed in an encrypted state, and key switch processing for switching encryption key A used for encryption by homomorphic encryption to another encryption key B without decrypting the ciphertext are performed in a trusted execution environment (TEE), which is a security mechanism of a processor. By generating a key used for data encryption and a key used for data decryption by different key generation processes and using a technology for preventing information leakage, such as TEE and homomorphic encryption, and at the same time performing key switch processing, it is possible to prevent information leakage due to key leakage and tampering attacks on calculation results.

[0069] In addition, the use of a TEE increases reliability at the hardware level and makes it difficult to access data from outside, thereby preventing information leaks.

[0070] In addition, by using a TEE, it is possible to ensure that the system is in a secure state based on a process (remote attestation) in which the integrity of the program is verified by a remote trusted certification authority, etc.

[0071] Furthermore, in the information processing system according to the present invention, after generating the switch key, the first private key is deleted. The ciphertext generated by encryption using the first public key is handled in the TEE, which is an execution environment with extremely high security strength in the computing device 100, and is therefore extremely difficult for an attacker to steal. Therefore, it is practically impossible to decrypt the ciphertext encrypted using the first public key, and the security of the original data to be encrypted can be made extremely strong.

[0072] <Modification of Example 1> An information processing system 2 according to this modification has the same configuration as the information processing system 1, except that an arithmetic device 300 is provided instead of the arithmetic device 100 (see FIG. 1) of the information processing system 1 according to the embodiment 1. Therefore, a description of the same configuration as the embodiment 1 will be omitted.

[0073] In the arithmetic device 300 of the information processing system 2, the normal execution environment of an operating system (OS) performs the processes that were performed by the TEE 10 of the arithmetic device 100. Specifically, the normal execution environment of the arithmetic device 300 performs the process of storing a switch key (corresponding to step S103 in FIG. 5), the execution of arithmetic processing (corresponding to step S105 in FIG. 5), and the execution of key switch processing (corresponding to step S106 in FIG. 5).

[0074] In a normal execution environment of the arithmetic device 300, an execution area such as a memory space may be divided into a key management area and an arithmetic area. The key management area is a dedicated area for managing the switch key. The OS and applications cannot directly access the key management area. The arithmetic area is an area where arithmetic processing is executed. In order for the arithmetic area to obtain the switch key from the key management area, it is necessary to do so via a secure protocol. By dividing the areas in this way, the risk of unauthorized access to the switch key can be reduced, and the overall security of the system can be improved.

[0075] In the first embodiment, key switch processing and the like are performed by a trusted execution environment (TEE). The TEE has high security because it is an execution environment that is strictly protected at the hardware level. On the other hand, there are problems such as high hardware costs and limited data processing volume. The configuration according to this modification can reduce hardware costs more than when a TEE is used. In addition, it can easily supply resources according to the data processing volume.

[0076] In addition, in this modification, after generating the switch key, the first secret key is deleted, thereby reducing the risk that the ciphertext generated by encryption using the first public key will be decrypted. In order to decrypt the ciphertext encrypted using the first public key, the first secret key corresponding to the first public key is required. That is, if the first secret key is deleted, it is impossible to decrypt the ciphertext encrypted using the first public key. On the other hand, even if the first secret key is deleted, it is possible to decrypt the ciphertext encrypted using the first public key if there is a switch key for key-switching the encryption key from the first public key to the second public key and a second secret key for decrypting the ciphertext after the key-switching. However, in this case, the attacker needs to obtain not only the second secret key stored locally (terminal device 200) but also the switch key stored in the cloud (computing device 300). Since it is very difficult to obtain two keys, it is practically impossible to decrypt the ciphertext. Therefore, in this variant, even in an execution environment that does not use a TEE, it is virtually impossible to decrypt the ciphertext generated by encryption using the first public key, thereby achieving high security.

[0077] The execution environment of the arithmetic device 300 may be realized by constructing a virtual execution environment. EXAMPLES

[0078] In the first embodiment, the key switch processing is performed on homomorphic ciphertexts generated by one user (one terminal device). In the present embodiment, the key switch processing is performed on homomorphic ciphertexts generated by a plurality of users.

[0079] Homomorphic encryption is an encryption method that can perform calculations on ciphertexts encrypted using a certain public key while they are still in the encrypted state. However, in order to enable calculation processing for multiple ciphertexts, these ciphertexts must be in the same encryption space, that is, must be encrypted with the same encryption key (public key). In this embodiment, in order to enable calculation processing of homomorphic ciphertexts generated by multiple users using different encryption keys, a key switch process is performed to switch the encryption keys of these ciphertexts to the same encryption key. Then, after the calculation processing is performed, a key switch process is performed to switch the encryption key of the execution result (ciphertext) to the encryption key (public key) generated by each user. This makes it possible to decrypt with a decryption key (private key) held by each user, and it is possible to perform calculation processing utilizing data of other organizations while keeping data held by the own organization secret. In other words, calculation processing is performed on the data held by each user while it is still in the encrypted state without being disclosed, and each user can decrypt and view only the calculation result.

[0080] (Configuration of information processing system 3) Fig. 7 is an overall view of the information processing system 3. The overall view of the information processing system according to this embodiment will be described with reference to Fig. 7.

[0081] The information processing system 3 according to the present embodiment includes a calculation device 400 and terminal devices 500-1, 500-2, ..., 500-N (N is a natural number) used by users. In the following description, the terminal devices 500-1, 500-2, ..., 500-N are described as terminal devices 500 unless there is a need to distinguish them. The information processing system 3 is a platform that allows each organization (user) participating in the system to use data held by each organization without disclosing detailed contents of the data to other organizations. Note that the organization is not limited to a company or an organization, and may be a group such as a department, section, group, or team divided by role. The terminal device 500 is associated with the organization participating in the platform.

[0082] The computing device 400 includes a TEE 40. The computing device 400 has the same hardware configuration as the computing device 100, and the TEE 40 is a security mechanism similar to the TEE 10 described above.

[0083] The terminal device 500 accepts input from a user and transmits the input contents to the arithmetic device 400 via the network NW. The terminal device 500 also receives data transmitted from the arithmetic device 400 via the network NW and presents it to the user.

[0084] (Functional configuration of the arithmetic device 400) Fig. 8 is a block diagram showing a functional configuration of the arithmetic device 400. The functional configuration of the arithmetic device 400 according to the second embodiment will be described with reference to Fig. 8. Note that components common to the arithmetic device 100 are denoted by the same reference numerals, and repeated description will be omitted.

[0085] The arithmetic device 400 includes a communication unit 110, a storage unit 120, an input unit 130, an output unit 140, and a control unit 450. The control unit 450 is a processor such as a CPU that controls each function of the arithmetic device 400 and operates based on a program stored in the storage unit 120 in advance.

[0086] The control unit 450 includes the TEE 40. The TEE 40 generates an intermediate private key and an intermediate public key. For example, a key pair may be generated by a key application included in the TEE 40. The control unit 450 controls the communication unit 110 to transmit the intermediate public key to each terminal device 500. The control unit 450 also acquires a second public key (described later) generated in each terminal device 500 via the communication unit 110. The TEE 40 encrypts the intermediate private key by homomorphic encryption using the second public key acquired from each terminal device 500 to generate a second switch key. The second switch key can switch the encryption key of the ciphertext from the intermediate public key to the second public key.

[0087] The TEE 40 stores the first switch key acquired from each of the terminal devices 500 described below, and the second switch key generated as described above. The second public key may be stored in the storage unit 120 or the like. The intermediate private key may be deleted after the second switch key is generated.

[0088] Furthermore, the TEE 40 executes a first key switch process on the ciphertext acquired from the terminal device 500 via the communication unit 110, using a first switch key corresponding to the terminal device 500 that generated the ciphertext. By the first key switch process, the encryption key of the ciphertext acquired from the terminal device 500 is switched from the first public key to the intermediate public key.

[0089] Furthermore, the TEE 40 executes arithmetic processing based on the ciphertext on which the first key switch processing has been executed. The arithmetic processing includes at least processing related to addition or multiplication between homomorphic ciphertexts. More specifically, the processing is processing related to addition or multiplication of the ciphertext acquired from each terminal device 500-K (K is a natural number satisfying 1≦K≦N), and may be statistical processing, database search processing, machine learning learning processing, inference processing, or the like. Since the ciphertext acquired from each terminal device 500 is converted into a ciphertext in the same encryption space by the first key switch processing using the first switch key, it is possible to perform processing related to addition or multiplication, or the like.

[0090] Furthermore, the TEE 40 executes a second key switch process on the result of the arithmetic processing (ciphertext) by using a second switch key. By the second key switch process, the encryption key of the result of the arithmetic processing (ciphertext) is switched from the intermediate public key to the second public key.

[0091] (Functional configuration of terminal device 500) Fig. 9 is a block diagram showing a functional configuration of the terminal device 500. The functional configuration of the terminal device 500 according to the second embodiment will be described with reference to Fig. 9. Note that components common to the terminal device 200 are denoted by the same reference numerals, and repeated description will be omitted.

[0092] Terminal device 500 is a “user terminal” and includes a communication unit 210 , a storage unit 520 , an input unit 230 , an output unit 240 , and a control unit 550 .

[0093] The storage unit 520 functions as a "user storage unit" and has the same functions as the storage unit 220. The storage unit 520 stores at least a first public key and a second private key generated by the control unit 550 described later. Note that these keys may not be stored within the terminal device 500, but may be stored in a secure key management device (not shown) that is connected to the terminal device 500 via a network or directly.

[0094] The control unit 550 functions as a “user control unit”, controls each function of the terminal device 500, and is a processor such as a CPU that operates based on a program stored in the storage unit 520 in advance.

[0095] The control unit 550 generates two sets of key pairs. Specifically, the control unit 550 generates a first private key and a public key, and a second private key and a public key. These two sets of key pairs may be generated by the above-mentioned key management device. In addition, the first private key and a public key, and the second private key and a public key generated by each terminal device 500 are different keys.

[0096] Furthermore, the control unit 550 encrypts the first private key by homomorphic encryption using the intermediate public key to generate a first switch key. The first switch key can switch the encryption key of the ciphertext from the first public key to the intermediate public key. The control unit 550 transmits the generated first switch key to the arithmetic device 400 via the communication unit 210. After transmitting the first switch key to the arithmetic device 400, the control unit 550 may store the first switch key in the storage unit 220 or may delete the first switch key.

[0097] Note that the control unit 550 may delete the first private key after generating the first switch key. By deleting (destroying) the first private key, the first private key will not be leaked to the outside, and the risk that a ciphertext generated by encryption using the first public key will be decrypted by a third party, that is, the risk that plaintext (original data) will be leaked, can be reduced.

[0098] Furthermore, the control unit 550 encrypts plaintext input via the communication unit 210 or the input unit 230 using the first public key according to homomorphic encryption scheme to generate ciphertext.

[0099] Furthermore, control unit 550 acquires the result of the arithmetic processing in which the second key switch processing has been executed from arithmetic device 400 via communication unit 210, and decrypts it using the second private key.

[0100] FIG. 10 is a flow diagram showing an example of information processing in the information processing system 3. The flow of information processing in the information processing system 3 will be described with reference to FIG. 10. Note that the flow of processing is an example, and is not limited to the order shown in FIG. 10. Also, in FIG. 10, for ease of explanation, two terminal devices (terminal device 500-1 and terminal device 500-2) are shown, but there may be three or more terminal devices 500. Also, in FIG. 10, the first private key of terminal device 500-K is shown as SK1_k, the first public key is shown as PK1_k, the second private key is shown as SK2_k, and the second public key is shown as PK2_k.

[0101] In step S201, the control unit 550 of the terminal device 500-1 generates two key pairs. Specifically, a first secret key SK1_1 and a public key PK1_1, and a second secret key SK2_1 and a public key PK2_1. These key pairs may be generated by a key management server outside the terminal device 500-1 and acquired by the terminal device 500.

[0102] In step S202, the TEE 40 of the computing device 400 generates an intermediate private key InSK and an intermediate public key InPK.

[0103] In step S203, the control unit 550 of the terminal device 500-1 acquires the intermediate public key InPK from the arithmetic device 400.

[0104] In step S204, the control unit 550 of the terminal device 500-1 encrypts the first secret key SK1_1 using the intermediate public key InPK acquired in step S203 by homomorphic encryption to generate a first switch key SWK1(SK1_1, InPK).

[0105] In step S205, the TEE 40 of the arithmetic device 400 acquires the first switch key SWK1 (SK1_1, InPK) and the second public key PK2_1 from the terminal device 500-1. Note that the TEE 40 may acquire the first switch key SWK1 (SK1_1, InPK) and the second public key PK2_1 at separate times.

[0106] In step S206, the TEE 40 of the calculation device 400 encrypts the intermediate private key InSK using the second public key PK2_1 acquired from the terminal device 500-1 by homomorphic encryption to generate a second switch key SWK2(InSK, PK2_1) corresponding to the terminal device 500-1.

[0107] In step S207, the storage unit 520 of the terminal device 500-1 stores the first public key PK1_1 and the second secret key SK2_1. After generating the first switch key SWK(SK1_1, InPK), the control unit 550 of the terminal device 500-1 may delete the first secret key SK1_1. By deleting the first secret key SK1_1, it is possible to reduce the risk that the ciphertext generated by encryption using the first public key PK1_1 will be decrypted.

[0108] In step S208, the terminal device 500-2 and the arithmetic device 400 perform key processing similar to that performed by the terminal device 500-1 and the arithmetic device 400 in steps S200 to S207. That is, the control unit 550 of the terminal device 500-2 generates a first secret key SK1_2 and a public key PK1_2, and a second secret key SK2_2 and a public key PK2_2. In addition, the control unit 550 of the terminal device 500-2 acquires an intermediate public key InPK from the arithmetic device 400, and generates a first switch key SWK1 (SK1_2, InPK). The TEE 40 of the arithmetic device 400 acquires a first switch key SWK1 (SK1_2, InPK) and a second public key PK2_2 from the terminal device 500-2. Then, the TEE 40 of the arithmetic device 400 generates a second switch key SWK2 (InSK, PK2_2) corresponding to the terminal device 500-2. The first private key and public key, and the second private key and public key generated in each terminal device 500 are different from each other. The process of step S208 may be performed simultaneously with or prior to the key processes performed by terminal device 500-1 and arithmetic device 400 in steps S200 to S207.

[0109] In step S209, the TEE 40 of the arithmetic device 400 stores the first switch key SWK1 (SK1_k, InPK) and the second switch key SWK2 (InSK, PK2_k) corresponding to each terminal device 500-K (K=1, 2 in FIG. 10).

[0110] In addition, the TEE 40 of the arithmetic device 400 may delete the intermediate private key InSK from the storage area after generating the second switch keys SWK(InSK, PK2_k) corresponding to each terminal device 500-K. By deleting the intermediate private key InSK, it is possible to prevent an attacker from stealing the intermediate private key InSK and decrypting the ciphertext after the key switch process is executed using the first switch key of each terminal device 500-K, thereby preventing the plaintext (original data) from leaking.

[0111] Moreover, the first private key SK1_k and the intermediate private key InSK may be deleted either one of them, or both of them may be deleted.

[0112] In step S210, the control unit 550 of the terminal device 500-1 encrypts the plaintext m_1 using the first public key PK1_1 by homomorphic encryption to generate the ciphertext Enc(m_1, PK1_1).

[0113] In step S211, the TEE 40 of the arithmetic device 400 acquires the ciphertext Enc(m_1, PK1_1) from the terminal device 500-1.

[0114] In step S212, the control unit 550 of the terminal device 500-2 encrypts the plaintext m_2 using the first public key PK1_2 by homomorphic encryption to generate the ciphertext Enc(m_2, PK1_2).

[0115] In step S213, the TEE 40 of the arithmetic device 400 obtains the ciphertext Enc(m_2, PK1_2) from the terminal device 500-2.

[0116] In step S214, the TEE 40 of the arithmetic device 400 executes a first key switch process for the ciphertext Enc(m_k, PK1_k) acquired from each terminal device 500-K, using the first switch key SWK(SK1_k, InPK) corresponding to the terminal device 500-K that generated the ciphertext. Specifically, for the ciphertext Enc(m_1, PK1_1) acquired from the terminal device 500-1, the TEE 40 executes a key switch process for the ciphertext Enc(m_1, PK1_1) acquired from the terminal device 500-1, using the first switch key SWK(SK1_1, InPK) corresponding to the terminal device 500-1. For the ciphertext Enc(m_2, PK1_2) acquired from the terminal device 500-2, the TEE 40 executes a key switch process for the ciphertext Enc(m_2, PK1_2) acquired from the terminal device 500-2, using the first switch key SWK(SK1_2, InPK) corresponding to the terminal device 500-2. By the key switch process in step S214, the encryption key of the ciphertext acquired from each terminal device 500 is switched from the first public key PK1_k generated in each terminal device 500-K to the intermediate public key InPK.

[0117] In step S215, the TEE 40 of the arithmetic device 400 executes arithmetic processing based on each ciphertext Enc(m_k, InPK) on which the first key switch processing has been executed. For example, in response to a request from the user of the terminal device 500-1, the TEE 40 performs machine learning learning processing, inference processing, and the like on each ciphertext Enc(m_k, InPK) while keeping it encrypted.

[0118] In step S216, in response to a transmission request for the result of the arithmetic processing (m'), the TEE 40 of the arithmetic device 400 executes key switching processing on the result of the arithmetic processing using the second switch key SWK2(InSK, PK2_k) corresponding to the terminal device 500-K that made the transmission request. Specifically, for example, in response to a transmission request for the result of the arithmetic processing from the terminal device 500-1, the TEE 40 executes key switching processing on the ciphertext Enc(m', InPK) that is the result of the arithmetic processing using the second switch key SWK2(InSK, PK2_1) corresponding to the terminal device 500-1 to generate the ciphertext Enc(m', PK2_1), that is, the ciphertext encrypted by the second public key PK2_1 generated by the terminal device 500-1.

[0119] Similarly, for example, in response to a request for the result of the arithmetic processing of the terminal device 500-2, a key switch process is performed to generate a ciphertext Enc(m', PK2_2), that is, a ciphertext encrypted with the second public key PK2_2 generated by the terminal device 500-2.

[0120] In step S217, the terminal device 500-1 acquires the ciphertext Enc(m', PK2_1), and the terminal device 500-2 acquires the ciphertext Enc(m', PK2_2).

[0121] In step S218, the control unit 550 of the terminal device 500-1 decrypts the ciphertext Enc(m', PK2_1) using the second secret key SK2_1. In this manner, the terminal device 500-1 can safely obtain the result m' of the arithmetic process between the plaintext m_1 and the plaintext m_k held by the other terminal device 500-K by decrypting the result of the key switch process.

[0122] In step S219, the control unit 550 of the terminal device 500-2 decrypts the ciphertext Enc(m', PK2_2) using the second secret key. As with the terminal device 500-1, the terminal device 500-2 can securely obtain the result m' of the arithmetic operation between the plaintext m_2 and the plaintext m_k held by the other terminal device 500-K.

[0123] In the second embodiment, similarly to the modified example of the first embodiment, the processing performed by the TEE 40 of the arithmetic device 400 may be performed by a normal execution environment in the OS of the arithmetic device 400. When the normal execution environment performs the processing, the hardware cost can be reduced compared to using a TEE. Also, the execution environment of the arithmetic device 400 may be realized by constructing a virtual execution environment.

[0124] Also, similarly to the modification of the first embodiment, in the normal execution environment of the arithmetic device 400, an execution area such as a memory space may be divided into a key management area and an arithmetic area. By dividing the areas in this way, the risk of unauthorized access to the switch key can be reduced, and the overall security of the system can be improved.

[0125] (Explanation of effect) As described above, in this embodiment, a key switch process is performed to switch the encryption keys of homomorphic ciphertexts generated by multiple users using different encryption keys to the same encryption key. Then, after executing the arithmetic process, a key switch process is performed to switch the encryption keys of the execution results (ciphertext) to encryption keys (public keys) generated by each user. This makes it possible to decrypt data using a decryption key (private key) held by each user, and allows arithmetic processes to be performed using data from other organizations while keeping data held by the user's own organization secret. In other words, the arithmetic process is performed on the data held by each user in an encrypted state without disclosure, and each user can decrypt and view only the arithmetic results.

[0126] In addition, in this embodiment, at least one of the steps of deleting the first secret key after generating the first switch key in each terminal device, or deleting the intermediate secret key from the storage area in the computing device after generating the second switch key corresponding to each terminal device is performed. By deleting the secret key, it becomes impossible to decrypt the ciphertext encrypted with the public key paired with the secret key. In other words, by deleting the first secret key and / or the intermediate secret key, it becomes impossible to decrypt the ciphertext encrypted with the first public key in each terminal device to plaintext (original data), thereby making it possible to extremely strengthen security. EXAMPLES

[0127] The information processing system according to this embodiment further includes a management device in addition to the computing device and the terminal devices. The management device itself does not provide data, but can decrypt and view data encrypted and provided by each terminal device, and the results of computations performed based on the encrypted data provided by each terminal device. Fig. 11 is an overall view of the information processing system 4. The information processing system according to this embodiment will be described with reference to Fig. 11.

[0128] The information processing system 4 includes a calculation device 600, terminal devices 700-1, . . . , 700-N, and a management device 800.

[0129] The management device 800 is associated with a user who manages and supervises each organization participating in the information processing system 4, and handles highly confidential information in a centralized manner. The user of the management device 800 is, for example, a human resources department or a production management department, and has the authority to view the data held by each terminal device 700 and the results of arithmetic processing based on the data held by each terminal device 700. The management device 800 has a management control unit 810 and a management storage unit 820. The management storage unit 820 stores a management public key and a management private key. The management public key and the management private key may be generated by the management control unit 810 and stored by the management storage unit 820, or may be managed (generated and stored) by an external key management device.

[0130] The TEE 60 of the arithmetic device 600 acquires the managed public key stored in the management storage unit 820 of the management device 800, and encrypts the intermediate private key using the managed public key by homomorphic encryption to generate a managed switch key. Also, the TEE 60 executes key switch processing using the managed switch key on the result of the arithmetic processing executed based on the ciphertext on which the first key switch processing has been performed. The result of the arithmetic processing on which the key switch processing has been performed is decrypted by the management control unit 810 of the management device 800 using the managed private key.

[0131] In this way, the user of the management device 800 can view the results of the arithmetic processing by key switch processing using the managed switch key. In addition, the user can view the ciphertext transmitted from each terminal device 700, not the arithmetic processing results processed in the TEE 60 of the arithmetic device 600, by key switch processing using the managed switch key in the same manner.

[0132] The terminal device 700 has a control unit and a storage unit (not shown in FIG. 11). The control unit of the terminal device 700 generates a first private key and a public key. The storage unit of the terminal device 700 stores the public key. The first private key and the public key may be managed (generated and stored, etc.) by a key management device such as that described above.

[0133] The control unit of the terminal device 700 acquires the intermediate public key from the calculation device 600, encrypts the first private key using the intermediate public key by homomorphic encryption to generate a first switch key, and transmits the first switch key to the calculation device 600. The TEE 60 of the calculation device 600 executes a first key switch process on the ciphertext acquired from each terminal device 700 using the first switch key. Note that the functional configurations of the calculation device 600 and the terminal device 700 are similar to those of the calculation device 400 and the terminal device 500, respectively, and therefore overlapping explanations will be omitted.

[0134] Fig. 12 is a flow diagram showing an example of information processing in the information processing system 4. The flow of information processing in the information processing system 4 will be described with reference to Fig. 12. Note that the flow of processing is an example, and is not limited to the order shown in Fig. 12. Also, in Fig. 12, for ease of explanation, one or more terminal devices 700 are described as terminal device 700-K (K is a natural number satisfying 1≦K≦N).

[0135] In step S301, the terminal device 700-K generates a key pair. Specifically, the terminal device 700-K generates a first secret key SK1_k and a public key PK1_k. The key pair may be generated by a key management device outside the terminal device 700-K and acquired by the terminal device 700-K.

[0136] In step S302, the TEE 60 of the computing device 600 generates an intermediate private key InSK and an intermediate public key InPK.

[0137] In step S303, the terminal device 700-K obtains the intermediate public key InPK from the arithmetic device 600.

[0138] In step S304, the terminal device 700-K encrypts the first secret key SK1_k using the intermediate public key InPK acquired in step S303 by homomorphic encryption to generate a first switch key SWK1(SK1_k, InPK).

[0139] In step S305, the TEE 60 of the arithmetic device 600 acquires the first switch key SWK1(SK1_k, InPK) from the terminal device 700-K.

[0140] In step S306, the management control unit 810 of the management device 800 generates a management private key AdSK and a management public key AdPK.

[0141] In step S307, the TEE 60 of the arithmetic device 600 obtains the management public key AdPK from the management device 800.

[0142] In step S308, the TEE 60 of the arithmetic device 600 encrypts the intermediate private key InSK using the managed public key AdPK acquired from the management device 800 by homomorphic encryption to generate a managed switch key SWK2(InSK, AdPK).

[0143] In step S309, the TEE 60 of the arithmetic device 600 stores the administration switch key SWK2 (InSK, AdPK) and the first switch key SWK1 (SK1_k, InPK) corresponding to each terminal device 700-K.

[0144] In step S310, the terminal device 700-K stores the first public key PK1_k.

[0145] In step S311, the management storage unit 820 of the management device 800 stores the management private key AdSK.

[0146] The generation of the key pair (steps S301, 302, and 306) may be performed simultaneously or at separate times. The same applies to the storage of the key (steps S309, 310, and 311).

[0147] In step S312, the terminal device 700-K encrypts the plaintext m_k using the first public key PK1_k by homomorphic encryption to generate the ciphertext Enc(m_k, PK1_k).

[0148] In step S313, the TEE 60 of the arithmetic device 600 obtains the ciphertext Enc(m_k, PK1_k) from the terminal device 700-K.

[0149] In step S314, the TEE 60 of the arithmetic device 600 executes a first key switch process for the ciphertext Enc(m_k, PK1_k) acquired from each terminal device 700-K, using a first switch key SWK1(SK1_k, InPK) corresponding to the terminal device 700-K that generated the ciphertext. Specifically, for the ciphertext Enc(m_k, PK1_k) acquired from the terminal device 700-K, a key switch process is executed using a first switch key SWK1(SK1_1, InPK) corresponding to the terminal device 700-K. By the first key switch process in step S314, the encryption key of the ciphertext acquired from each terminal device 700 is switched from the first public key PK1_k generated in each terminal device 700-K to the intermediate public key InPK.

[0150] In step S315, the TEE 60 of the arithmetic device 600 executes arithmetic processing based on each ciphertext Enc(m_k, InPK) on which the first key switch processing has been executed. For example, in response to a request from a user of the terminal device 700-K or the management device 800, the TEE 60 performs machine learning learning processing, inference processing, and the like on each ciphertext Enc(m_k, InPK) while keeping it encrypted.

[0151] In step S316, the TEE 60 of the arithmetic device 600 receives from the management device 800 a request to transmit the result (m′) of the arithmetic processing.

[0152] In step S317, the TEE 60 of the arithmetic device 600 executes a second key switch process on the arithmetic result (m') in response to a transmission request for the arithmetic result (m') using the managed switch key SWK2 (InSK, AdPK) corresponding to the management device 800 that made the transmission request. Specifically, in response to a transmission request for the arithmetic result from the management device 800, the TEE 60 executes a key switch process on the ciphertext Enc (m', InPK) that is the arithmetic result using the managed switch key SWK2 (InSK, AdPK) to generate the ciphertext Enc (m', AdPK), that is, the ciphertext encrypted by the managed public key AdPK generated by the management device 800. Note that the arithmetic device 600 may execute the second key switch process on the arithmetic result (m') in advance using the managed switch key SWK2 (InSK, AdPK) corresponding to the management device 800 and store it in a storage unit or the like, and transmit the arithmetic result on which the second key switch process has been executed to the management device 800 in response to a transmission request from the management device 800.

[0153] In step S318, the management device 800 acquires the ciphertext Enc(m', AdPK).

[0154] In step S319, the management device 800 decrypts the ciphertext Enc(m', AdPK) using the management private key AdSK. In this way, the management device 800 can safely obtain the result m' of the arithmetic processing of the plaintext m_k held by the terminal device 700-K by decrypting the result of the key switch processing. The management device 800 can also obtain and decrypt the plaintext m_k held by the terminal device 700-K by a similar key switch processing.

[0155] In the third embodiment, similarly to the modified example of the first embodiment, the processing performed by the TEE 60 of the arithmetic device 600 may be performed by a normal execution environment in the OS of the arithmetic device 600. When the normal execution environment performs the processing, the hardware cost can be reduced compared to using a TEE. Also, the execution environment of the arithmetic device 400 may be realized by constructing a virtual execution environment.

[0156] Also, similarly to the modification of the first embodiment, in the normal execution environment of the arithmetic device 600, an execution area such as a memory space may be divided into a key management area and an arithmetic area. By dividing the areas in this way, the risk of unauthorized access to the switch key can be reduced, and the overall security of the system can be improved.

[0157] (Explanation of effect) As described above, in this embodiment, in addition to the arithmetic device and the terminal device, a management device is further provided. The management device itself does not provide data, but only the management device can decrypt and view the data encrypted and provided from each terminal device and the results of arithmetic processing based on the encrypted data provided from each terminal device by key switch processing using the management switch key. This makes it easy to control the management authority in the platform.

[0158] <Modification of the third embodiment> In a modification of the third embodiment, in the information processing system 4, the terminal device 700 may generate a second private key and public key in addition to the first private key and public key. The terminal device 700 generates the second private key and public key, and the calculation device 600 generates a second switch key, so that the terminal device 700 can also decrypt the ciphertext that has been subjected to the second key switch process.

[0159] (Explanation of effect) Data held by each organization (user) participating in information processing system 4 is processed in an encrypted state without being disclosed, and each user can decrypt and view the calculation results, etc., and even a management device that does not provide the data can view the data held by each organization and its calculation results.

[0160] The above-described embodiment can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and modifications are included in the scope of the invention and its equivalents as described in the claims, as well as in the scope and spirit of the invention.

[0161] Furthermore, the present invention may have the following aspects as shown in the appended notes. [Appendix 1] A plurality of user terminals each having a user control unit and a user storage unit; A computing device having an execution domain for performing computations; 1. A method for use in a system comprising: At each of the user terminals, the user control unit generates a first private key and a public key, and a second private key and a public key; generating an intermediate private key and an intermediate public key; the user control unit in each of the user terminals obtaining the intermediate public key; The user control unit in each of the user terminals encrypts the first private key using the intermediate public key by homomorphic encryption to generate a first switch key; The execution domain obtains the first switch key and the second public key generated by the user control unit in each of the user terminals; The execution domain encrypts the intermediate private key using the second public key obtained from each of the user terminals using a homomorphic encryption scheme to generate a second switch key; the execution domain storing the first switch key and the second switch key corresponding to each of the user terminals; The user storage unit in each of the user terminals stores the first public key and the second private key generated by the user control unit of the user terminal; The user control unit in each of the user terminals encrypts a plaintext using the first public key by homomorphic encryption to generate a ciphertext; a step of executing a first key switch process by the execution area, for the ciphertext acquired from the user control unit in each of the user terminals, using the first switch key corresponding to the user terminal that generated the ciphertext; a step of executing an arithmetic operation in the execution domain based on the ciphertext on which the first key switch operation has been performed; a step of the execution area receiving a transmission request for a result of the arithmetic processing from the user terminal; a step of executing a second key switch process by the execution area on a result of the arithmetic processing by using the second switch key corresponding to the user terminal that has made the transmission request; a step in which the user control unit in the user terminal which has made the transmission request acquires a result of the arithmetic processing in which the second key switch processing has been executed, and decrypts the result by using the second private key stored in the user storage unit in the user terminal; An information processing method comprising: [Appendix 2] An information processing method described in [Appendix 1], wherein the first private key and public key, and the second private key and public key generated by each of the user terminals are different keys. [Appendix 3] The information processing method according to [Appendix 1], wherein the arithmetic processing includes at least a process related to addition or multiplication of homomorphic ciphertext. [Appendix 4] The information processing method described in [Appendix 1], wherein the key switch process is a process of switching an encryption key of a homomorphic ciphertext to another encryption key. [Appendix 5] After at least one of the plurality of user terminals generates the first switch key, deleting the first private key generated by the user terminal; or The information processing method described in [Supplementary Note 1], further comprising at least one of the steps of: deleting the intermediate private key after the execution area generates the second switch key. [Appendix 6] A plurality of user terminals each having a user control unit and a user storage unit; A management device having a management control unit and a management storage unit; A computing device having an execution domain for performing computations; 1. A method for use in a system comprising: At each of the user terminals, the user control unit generates a first private key and a public key; generating an intermediate private key and an intermediate public key; the user control unit in each of the user terminals obtaining the intermediate public key; The user control unit in each of the user terminals encrypts the first private key using the intermediate public key by homomorphic encryption to generate a first switch key; The execution domain obtains the first switch key generated by the user control unit in each of the user terminals; generating a management public key and a management private key by the management control unit of the management device; the execution domain obtaining the management public key; The execution domain encrypts the intermediate private key using the management public key obtained from the management device using a homomorphic encryption scheme to generate a management switch key; the execution domain storing the administration switch key and the first switch key corresponding to each of the user terminals; The user storage unit in each of the user terminals stores the first public key generated by the user control unit of the user terminal; storing the management private key in the management storage unit of the management device; The user control unit in each of the user terminals encrypts a plaintext using the first public key by homomorphic encryption to generate a ciphertext; a step of executing a first key switch process by the execution area, for the ciphertext acquired from the user control unit in each of the user terminals, using the first switch key corresponding to the user terminal that generated the ciphertext; a step of executing an arithmetic operation in the execution domain based on the ciphertext on which the first key switch operation has been performed; a step of the execution area receiving a transmission request for a result of the arithmetic processing from the management device; executing a second key switch process by the execution area using the managed switch key on a result of the arithmetic process; the management control unit of the management device acquiring a result of the arithmetic processing in which the second key switch processing has been executed, and decrypting the result by using the management private key; An information processing method comprising: [Appendix 7] An information processing method described in any one of [Appendix 1] to [Appendix 6], wherein the execution area includes a trusted execution environment, which is a security mechanism of a processor. [Appendix 8] An information processing method according to any one of [Appendix 1] to [Appendix 6], wherein the execution area is divided into a key management area and a calculation area. [Appendix 9] A plurality of user terminals each having a user control unit and a user storage unit; A computing device having an execution domain for performing computations; A program for use in a system comprising: At each of the user terminals, the user control unit generates a first private key and a public key, and a second private key and a public key; generating an intermediate private key and an intermediate public key; the user control unit in each of the user terminals obtaining the intermediate public key; The user control unit in each of the user terminals encrypts the first private key using the intermediate public key by homomorphic encryption to generate a first switch key; The execution domain obtains the first switch key and the second public key generated by the user control unit in each of the user terminals; The execution domain encrypts the intermediate private key using the second public key obtained from each of the user terminals using a homomorphic encryption scheme to generate a second switch key; the execution domain storing the first switch key and the second switch key corresponding to each of the user terminals; The user storage unit in each of the user terminals stores the first public key and the second private key generated by the user control unit of the user terminal; The user control unit in each of the user terminals encrypts a plaintext using the first public key by homomorphic encryption to generate a ciphertext; a step of executing a first key switch process by the execution area, for the ciphertext acquired from the user control unit in each of the user terminals, using the first switch key corresponding to the user terminal that generated the ciphertext; a step of executing an arithmetic operation in the execution domain based on the ciphertext on which the first key switch operation has been performed; a step of the execution area receiving a transmission request for the result of the arithmetic processing from the user terminal; a step of executing a second key switch process by the execution area on a result of the arithmetic processing by using the second switch key corresponding to the user terminal that has made the transmission request; a step in which the user control unit in the user terminal which has made the transmission request acquires a result of the arithmetic processing in which the second key switch processing has been executed, and decrypts the result by using the second private key stored in the user storage unit in the user terminal; An information processing program comprising: [Appendix 10] A plurality of user terminals each having a user control unit and a user storage unit; A computing device having an execution domain for performing computations; A system comprising: At each of the user terminals, the user control unit generates a first private key and a public key, and a second private key and a public key; the execution domain generating an intermediate private key and an intermediate public key; the user control unit in each of the user terminals obtains the intermediate public key; The user control unit in each of the user terminals encrypts the first private key using the intermediate public key by homomorphic encryption to generate a first switch key; The execution domain acquires the first switch key and the second public key generated by the user control unit in each of the user terminals; The execution domain encrypts the intermediate private key using the second public key obtained from each of the user terminals using a homomorphic encryption scheme to generate a second switch key; the execution domain stores the first switch key and the second switch key corresponding to each of the user terminals; The user storage unit in each of the user terminals stores the first public key and the second private key generated by a user control unit of the user terminal; The user control unit in each of the user terminals encrypts a plaintext using the first public key by homomorphic encryption to generate a ciphertext; the execution area executes a first key switch process for the ciphertext acquired from the user control unit in each of the user terminals, using the first switch key corresponding to the user terminal that generated the ciphertext; the execution area executes an arithmetic operation based on the ciphertext on which the first key switch operation has been executed; the execution area accepts a transmission request for the result of the arithmetic processing from the user terminal; the execution area executes a second key switch process on a result of the arithmetic process by using the second switch key corresponding to the user terminal that has made the transmission request; the user control unit in the user terminal which has made the transmission request acquires a result of the arithmetic processing in which the second key switch processing has been executed, and decrypts the result using the second private key stored in the user storage unit in the user terminal; Information processing system. [Appendix 11] A user terminal having a user control unit and a user storage unit; A computing device having an execution domain for performing computations; 1. A method for use in a system comprising: the user control generating a first private key and a first public key, and a second private key and a second public key; The user control unit encrypts the first private key using the second public key by homomorphic encryption to generate a switch key; storing the switch key obtained from the user control unit in the execution area; The user storage unit stores at least the first public key and the second private key; The user control unit encrypts a plaintext using the first public key by homomorphic encryption to generate a ciphertext; The execution area executes a calculation process based on the encrypted text acquired from the user control unit; a step of executing a key switch process by the execution area using the switch key on the result of the arithmetic process; the user control unit acquiring a result of the key switch process executed by the execution area and decrypting the result using the second private key; An information processing method comprising: [Appendix 12] The information processing method according to [Appendix 11], wherein the arithmetic processing includes at least a process related to addition or multiplication of homomorphic ciphertext. [Appendix 13] The information processing method according to [Appendix 11], wherein the key switch process is a process of switching an encryption key for a homomorphic ciphertext to another encryption key. [Appendix 14] The information processing method described in [Supplementary Note 11], further comprising a step in which the user control unit deletes the first private key after generating the switch key. [Appendix 15] An information processing method described in any one of [Appendix 11] to [Appendix 14], wherein the execution area includes a trusted execution environment, which is a security mechanism of a processor. [Appendix 16] An information processing method described in any one of [Appendix 11] to [Appendix 14], wherein the execution area is divided into a key management area and a calculation area. [Appendix 17] A user terminal having a user control unit and a user storage unit; A computing device having an execution domain for performing computations; A program for use in a system comprising: the user control generating a first private key and a first public key, and a second private key and a second public key; The user control unit encrypts the first private key using the second public key by homomorphic encryption to generate a switch key; storing the switch key obtained from the user control unit in the execution area; The user storage unit stores at least the first public key and the second private key; The user control unit encrypts a plaintext using the first public key by homomorphic encryption to generate a ciphertext; The execution area executes a calculation process based on the encrypted text acquired from the user control unit; a step of executing a key switch process by the execution area using the switch key on the result of the arithmetic process; the user control unit acquiring a result of the key switch process executed by the execution area and decrypting the result using the second private key; An information processing program comprising: [Appendix 18] A user terminal having a user control unit and a user storage unit; A computing device having an execution domain for performing computations; A system comprising: the user control generates a first private key and a first public key, and a second private key and a second public key; The user control unit encrypts the first private key using the second public key by homomorphic encryption to generate a switch key; The execution area stores the switch key obtained from the user control unit; the user storage unit stores at least the first public key and the second private key; the user control unit encrypts a plaintext using the first public key by homomorphic encryption to generate a ciphertext; The execution area executes a calculation process based on the ciphertext acquired from the user control unit; the execution area executes a key switch process using the switch key on the result of the arithmetic process; the user control unit acquires a result of the key switch process executed by the execution area, and decrypts the result using the second private key; Information processing system. [Explanation of symbols]

[0162] 1,2,3,4 Information processing system, 10,40,60 TEE, 100,300,400,600 arithmetic unit, 200,500,700 terminal device, 110,210 communication unit, 120,220,520 memory unit, 130,230 input unit, 140,240 output unit, 150,250,450,550 control unit, 800 management device, 810 management control unit, 820 management memory unit.

Claims

1. A user terminal having a user control unit and a user storage unit; A computing device having an execution domain for performing computations; 1. A method for use in a system comprising: the user control generating a first private key and a first public key, and a second private key and a second public key; The user control unit encrypts the first private key using the second public key by homomorphic encryption to generate a switch key; storing the switch key obtained from the user control unit in the execution area; The user storage unit stores at least the first public key and the second private key; The user control unit encrypts a plaintext using the first public key by homomorphic encryption to generate a ciphertext; The execution area executes a calculation process based on the encrypted text acquired from the user control unit; a step of executing a key switch process by the execution area using the switch key on the result of the arithmetic process; the user control unit acquiring a result of the key switch process executed by the execution area and decrypting the result using the second private key; An information processing method comprising:

2. The information processing method according to claim 1 , wherein the arithmetic processing includes at least a process related to addition or multiplication of homomorphic ciphertext.

3. The information processing method according to claim 1 , wherein the key switch process is a process of switching an encryption key for a homomorphic ciphertext to another encryption key.

4. The information processing method according to claim 1 , further comprising the step of: the user control unit deleting the first secret key after generating the switch key.

5. The information processing method according to claim 1 , wherein the execution domain includes a trusted execution environment that is a security mechanism of a processor.

6. The information processing method according to claim 1 , wherein the execution area is divided into a key management area and a calculation area.

7. A user terminal having a user control unit and a user storage unit; A computing device having an execution domain for performing computations; A program for use in a system comprising: the user control generating a first private key and a first public key, and a second private key and a second public key; The user control unit encrypts the first private key using the second public key by homomorphic encryption to generate a switch key; storing the switch key obtained from the user control unit in the execution area; The user storage unit stores at least the first public key and the second private key; The user control unit encrypts a plaintext using the first public key by homomorphic encryption to generate a ciphertext; The execution area executes a calculation process based on the encrypted text acquired from the user control unit; a step of executing a key switch process by the execution area using the switch key on the result of the arithmetic process; the user control unit acquiring a result of the key switch process executed by the execution area and decrypting the result using the second private key; An information processing program comprising:

8. A user terminal having a user control unit and a user storage unit; A computing device having an execution domain for performing computations; A system comprising: the user control generates a first private key and a first public key, and a second private key and a second public key; The user control unit encrypts the first private key using the second public key by homomorphic encryption to generate a switch key; The execution area stores the switch key obtained from the user control unit; the user storage unit stores at least the first public key and the second private key; the user control unit encrypts a plaintext using the first public key by homomorphic encryption to generate a ciphertext; The execution area executes a calculation process based on the ciphertext acquired from the user control unit; the execution area executes a key switch process using the switch key on the result of the arithmetic process; the user control unit acquires a result of the key switch process executed by the execution area, and decrypts the result using the second private key; Information processing system.

Images