Calculation method, calculation system, calculation program, calculation device, and encryption device

Abstract

To provide a calculation method, a system, a program, and a device, and an encryption device performing high-speed calculation while reducing a risk of information leakage.SOLUTION: A calculation method includes: a conversion step of a first encryption device converting first personal information into first anonymized personal information; an encryption step of the first encryption device encrypting the first anonymized personal information; a conversion step of a second encryption device converting second personal information into second anonymized personal information; an encryption step of the second encryption device encrypting the second anonymized personal information; an acquisition step of a calculation device acquiring the encrypted first anonymized personal information and second anonymized personal information; a decoding step of the calculation device decoding the encrypted first anonymized personal information and second anonymized personal information; a matching step of the calculation device matching the decoded first anonymized personal information and second anonymized personal information with each other; and a calculation step of the calculation device performing predetermined calculation from the first anonymized personal information and second anonymized personal information which are matched.SELECTED DRAWING: Figure 10

Description

[Technical field]

[0001] The present invention relates to a calculation method, a calculation system, a calculation program, a calculation device, and an encryption device. Regarding. [Background technology]

[0002] Privacy tech has been attracting attention in recent years. Cited Reference 1 proposes a method to make personal information available while protecting privacy by de-identifying personal information held by multiple organizations and processing it by matching it using homomorphic encryption. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Kazuma Nozawa (and 8 others), "Proposal and Evaluation of Data Integration Methods Suitable for Combining Personal Data Across Organizations," Computer Security Symposium 2022, October 24, 2022 Summary of the Invention [Problem to be solved by the invention]

[0004] In the above-mentioned conventional technology, homomorphic encryption is used for secure calculations, so while the risk of information leakage is low, the amount of calculations is large and the calculations take a huge amount of time.

[0005] The present invention has been made in consideration of the above problems, and has an object to enable high-speed calculations while reducing the risk of information leakage. [Means for solving the problem]

[0006] A calculation method according to one embodiment is a calculation method executed by a calculation system including a first encryption device, a second encryption device, and a calculation device, and includes a conversion step in which the first encryption device converts first personal information into first non-identifiable processed information, an encryption step in which the first encryption device encrypts the first non-identifiable processed information, a conversion step in which the second encryption device converts second personal information into second non-identifiable processed information, an encryption step in which the second encryption device encrypts the second non-identifiable processed information, an acquisition step in which the calculation device acquires the encrypted first non-identifiable processed information and the second non-identifiable processed information, a decryption step in which the calculation device decrypts the encrypted first non-identifiable processed information and the second non-identifiable processed information, a matching step in which the calculation device matches the decrypted first non-identifiable processed information and the second non-identifiable processed information, and a calculation step in which the calculation device performs a predetermined calculation from the matched first non-identifiable processed information and the second non-identifiable processed information. Effect of the Invention

[0007] According to one embodiment, it is possible to perform calculations at high speed while reducing the risk of information leakage. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 illustrates an example of the configuration of a computing system 1000. [Diagram 2] FIG. 2 illustrates an example of a hardware configuration of a computing device 1. [Diagram 3] 2 is a diagram illustrating an example of a hardware configuration of an encryption device 2. FIG. [Figure 4] FIG. 2 is a diagram illustrating an example of a hardware configuration of a user terminal 3. [Diagram 5] FIG. 2 illustrates an example of a functional configuration of a calculation device 1. [Figure 6] 2 is a diagram illustrating an example of a functional configuration of an encryption device 2. FIG. [Figure 7] FIG. 2 is a diagram showing an example of personal information 221. [Figure 8] FIG. 2 is a diagram showing an example of non-identifiable processed information 222. [Figure 9] FIG. 2 is a diagram illustrating an example of a functional configuration of a user terminal 3. [Figure 10] 1 is a flowchart illustrating an example of a process executed by the computing system 1000. [Figure 11] 1 is a schematic diagram showing an example of processing executed by a computing system 1000. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, each embodiment of the present invention will be described with reference to the accompanying drawings. In the description of the specification and drawings of each embodiment, components having substantially the same functional configuration are designated by the same reference numerals, and redundant description will be omitted.

[0010] <System configuration> First, an overview of a computing system 1000 according to this embodiment will be described. The computing system 1000 is a system that converts personal data owned by multiple owners into non-identifiable processed information, collates the data, and enables all of the personal data owned by the multiple owners to be used lawfully.

[0011] Personal data refers to personal information that constitutes the personal information database.

[0012] A personal information database is a collection of information, including personal information, that is systematically organized so that specific personal information can be searched for.

[0013] Personal information is information about a living individual that can identify a specific individual based on the name, date of birth, and other descriptions contained in the information. Personal information includes identification information and attribute information.

[0014] Identification information is information that identifies an individual. Examples of identification information include, but are not limited to, a name, an email address, or a facial image. Personal information may include multiple pieces of identification information.

[0015] Attribute information is information that indicates the attributes of an individual. Examples of attribute information include, but are not limited to, age, sex, address, occupation, and purchased products. Personal information may include multiple pieces of attribute information.

[0016] De-identified processed information is information obtained by de-identifying personal information. De-identified processed information is personal information or non-personal information. De-identified processed information that is personal information is, for example, pseudonymized information. De-identified processed information that is non-personal information is, for example, pseudonymized information, anonymously processed information, individual-related information, or other non-personal information.

[0017] Pseudonymized information is information about an individual that has been obtained by processing personal information so that a specific individual cannot be identified unless it is compared with other information.

[0018] Anonymously processed information is information about an individual that is obtained by processing personal information so that a specific individual cannot be identified, and the personal information cannot be restored.

[0019] Personal information refers to information about a living individual that does not fall under any of the categories of personal information, pseudonymized information, or anonymously processed information.

[0020] FIG. 1 is a diagram showing an example of the configuration of a computing system 1000. As shown in FIG. 1, the computing system 1000 includes a computing device 1, an encryption device 2A, an encryption device 2B, and a user terminal 3, which are connected to each other so as to be able to communicate with each other via a network N. Hereinafter, the encryption devices 2A and 2B may be collectively referred to as an encryption device 2. The network N may be, for example, a wired local area network (LAN), a wireless LAN, the Internet, a public line network, a mobile data communication network, or a combination thereof. In the example of FIG. 1, the computing system 1000 includes one computing device 1 and one user terminal 3, but may include a plurality of each. In the example of FIG. 1, the computing system 1000 includes two encryption devices 2, but may include one or three or more.

[0021] The computing device 1 is an information processing device that performs secure computation using non-identifiable processed information. The computing device 1 is, for example, but not limited to, a PC (Personal Computer), a smartphone, a tablet terminal, a server device, or a microcomputer. The computing device 1 includes a TEE (Trusted Execution Environment).

[0022] A TEE is a type of HIEE (Hardware-assisted Isolated Execution Environment) and is a secure computing technology in a broad sense. More specifically, a TEE is a program execution environment protected by hardware, and can execute calculations without leaking data to the outside. A TEE is composed of, for example, a CPU (Central Processing Unit), a protected area (enclave) created in a RAM (Random Access Memory), and a communication path between the CPU and the protected area. A TEE may also be composed of a CPU, a RAM designed as a protected area in its entirety, and a communication path between the CPU and the protected area.

[0023] The encryption device 2 is an information processing device that converts personal information into non-identifiable processed information and transmits it to the computing device 1. The encryption device 2 is, for example, but not limited to, a PC, a smartphone, a tablet terminal, a server device, or a microcomputer. The encryption device 2A corresponds to the first encryption device in the claims, and the encryption device 2B corresponds to the second encryption device in the claims.

[0024] The user terminal 3 is an information processing device used by a user of the computing system 1000. The user is, for example, but not limited to, the owner of personal information. The user terminal 3 is, for example, but not limited to, a PC, a smartphone, or a tablet terminal. The user terminal 3 may function as the encryption device 2.

[0025] <Hardware configuration of calculation device 1> Next, a description will be given of a hardware configuration of the computing device 1. Fig. 2 is a diagram showing an example of a hardware configuration of the computing device 1. As shown in Fig. 2, the computing device 1 includes a processor 101, a memory 102, a storage 103, a communication I / F 104, an input device 105, an output device 106, and a drive device 107, which are connected to each other via a bus B1.

[0026] The processor 101 controls each component of the computing device 1 and realizes the functions of the computing device 1 by expanding into the memory 102 various programs including an OS (Operating System) and a computing program stored in the storage 103 and executing them. The processor 101 is, for example, a CPU, an MPU (Micro Processing Unit), a GPU (Graphics Processing Unit), an ASIC (Application Specific Integrated Circuit), or a DSP (Digital Signal Processor), but is not limited to these.

[0027] The memory 102 is, for example, a read only memory (ROM), a RAM, or a combination thereof. The ROM is, for example, a programmable ROM (PROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), or a combination thereof. The RAM is, for example, but is not limited to, a dynamic RAM (DRAM) or a static RAM (SRAM).

[0028] 2, the TEE is composed of the processor 101 (CPU), a part of the bus B1, and a part of the memory 102 (RAM). However, as described above, the TEE may be composed of the processor 101, the bus B1, and the entire memory 102.

[0029] The storage 103 stores various programs including an OS and a computing program, and data. The storage 103 is, for example, a flash memory, a hard disk drive (HDD), a solid state drive (SSD), or a storage class memory (SCM), but is not limited to these.

[0030] The communication I / F 104 is an interface for connecting the computing device 1 to an external device via the network N and controlling communication. The communication I / F 104 is, for example, Bluetooth (registered trademark), Wi-Fi (registered trademark), ZigBee (registered trademark), or Ethernet (registered trademark), but is not limited thereto.

[0031] The input device 105 is a device for inputting information to the computing device 1. The input device 105 is, for example, a mouse, a keyboard, a touch panel, a microphone, a scanner, a photographing device (camera), various sensors, or an operation button, but is not limited to these.

[0032] The output device 106 is a device for outputting information from the calculation device 1. The output device 106 is, for example, a display device, a projector, a printer, a speaker, or a vibrator, but is not limited to these.

[0033] The drive device 107 is a device that reads and writes data to the recording medium 108. The drive device 107 is, for example, but not limited to, a magnetic disk drive, an optical disk drive, a magneto-optical disk drive, or an SD card reader. The recording medium 108 is, for example, but not limited to, a CD (Compact Disc), a DVD (Digital Versatile Disc), a FD (Floppy Disk), an MO (Magneto-Optical disk), a BD (Blu-ray (registered trademark) Disc), a USB (registered trademark) memory, or an SD card.

[0034] In this embodiment, the calculation program may be written into memory 102 or storage 103 during the manufacturing stage of the calculation device 1, or may be provided to the calculation device 1 via the network N, or may be provided to the calculation device 1 via a non-transitory computer-readable recording medium such as a recording medium 108.

[0035] <Hardware configuration of encryption device 2> Next, a description will be given of the hardware configuration of the encryption device 2. Fig. 3 is a diagram showing an example of the hardware configuration of the encryption device 2. As shown in Fig. 3, the encryption device 2 includes a processor 201, a memory 202, a storage 203, a communication I / F 204, an input device 205, an output device 206, and a drive device 207, which are connected to each other via a bus B2.

[0036] The processor 201 loads into the memory 202 various programs including an OS and a calculation program stored in the storage 203 and executes them, thereby controlling each component of the encryption device 2 and realizing the functions of the encryption device 2. The processor 201 is, for example, a CPU, an MPU, a GPU, an ASIC, or a DSP, but is not limited to these.

[0037] The memory 202 may be, for example, a ROM, a RAM, or a combination thereof. The ROM may be, for example, a PROM, an EPROM, an EEPROM, or a combination thereof. The RAM may be, for example, but is not limited to, a DRAM or an SRAM.

[0038] The storage 203 stores various programs including an OS and a calculation program, and data. The storage 203 is, for example, a flash memory, a HDD, an SSD, or an SCM, but is not limited to these.

[0039] The communication I / F 204 is an interface for connecting the encryption device 2 to an external device via the network N and controlling communication. The communication I / F 204 is, for example, Bluetooth (registered trademark), Wi-Fi (registered trademark), ZigBee (registered trademark), or Ethernet (registered trademark), but is not limited thereto.

[0040] The input device 205 is a device for inputting information to the encryption device 2. The input device 205 is, for example, a mouse, a keyboard, a touch panel, a microphone, a scanner, a photographing device (camera), various sensors, or an operation button, but is not limited to these.

[0041] The output device 206 is a device for outputting information from the encryption device 2. The output device 206 is, for example, a display device, a projector, a printer, a speaker, or a vibrator, but is not limited to these.

[0042] The drive device 207 is a device that reads and writes data to the recording medium 208. The drive device 207 is, for example, but not limited to, a magnetic disk drive, an optical disk drive, a magneto-optical disk drive, or an SD card reader. The recording medium 208 is, for example, but not limited to, a CD, a DVD, a FD, an MO, a BD (Blu-ray (registered trademark) Disc), a USB (registered trademark) memory, or an SD card.

[0043] In this embodiment, the calculation program may be written into the memory 202 or storage 203 during the manufacturing stage of the encryption device 2, or may be provided to the encryption device 2 via the network N, or may be provided to the encryption device 2 via a non-transitory computer-readable recording medium such as the recording medium 208.

[0044] <Hardware configuration of user terminal 3> Next, a description will be given of the hardware configuration of the user terminal 3. Fig. 4 is a diagram showing an example of the hardware configuration of the user terminal 3. As shown in Fig. 4, the user terminal 3 includes a processor 301, a memory 302, a storage 303, a communication I / F 304, an input device 305, an output device 306, and a drive device 307, which are connected to each other via a bus B3.

[0045] The processor 301 controls each component of the user terminal 3 and realizes the functions of the user terminal 3 by expanding into the memory 302 various programs including an OS and a calculation program stored in the storage 303 and executing them. The processor 301 is, for example, a CPU, an MPU, a GPU, an ASIC, or a DSP, but is not limited to these.

[0046] The memory 302 may be, for example, a ROM, a RAM, or a combination thereof. The ROM may be, for example, a PROM, an EPROM, an EEPROM, or a combination thereof. The RAM may be, for example, but is not limited to, a DRAM or an SRAM.

[0047] The storage 303 stores various programs including an OS and a calculation program, and data. The storage 303 is, for example, a flash memory, a HDD, an SSD, or an SCM, but is not limited to these.

[0048] The communication I / F 304 is an interface for connecting the user terminal 3 to an external device via the network N and controlling communication. The communication I / F 304 is, for example, Bluetooth (registered trademark), Wi-Fi (registered trademark), ZigBee (registered trademark), or Ethernet (registered trademark), but is not limited to these.

[0049] The input device 305 is a device for inputting information to the user terminal 3. The input device 305 is, for example, a mouse, a keyboard, a touch panel, a microphone, a scanner, an image capturing device (camera), various sensors, or an operation button, but is not limited to these.

[0050] The output device 306 is a device for outputting information from the user terminal 3. The output device 306 is, for example, but is not limited to, a display device (display), a projector, a printer, a speaker, or a vibrator. The user terminal 3 includes a display device 306D as the output device 306.

[0051] The drive device 307 is a device that reads and writes data to the recording medium 308. The drive device 307 is, for example, but not limited to, a magnetic disk drive, an optical disk drive, a magneto-optical disk drive, or an SD card reader. The recording medium 308 is, for example, but not limited to, a CD, a DVD, a FD, an MO, a BD (Blu-ray (registered trademark) Disc), a USB (registered trademark) memory, or an SD card.

[0052] In this embodiment, the calculation program may be written into the memory 302 or storage 303 during the manufacturing stage of the user terminal 3, or may be provided to the user terminal 3 via the network N, or may be provided to the user terminal 3 via a non-transitory computer-readable recording medium such as the recording medium 308.

[0053] <Functional configuration of calculation device 1> Next, a description will be given of the functional configuration of the computing device 1. Fig. 5 is a diagram showing an example of the functional configuration of the computing device 1. As shown in Fig. 5, the computing device 1 includes a communication unit 11, a storage unit 12, and a control unit 13.

[0054] The communication unit 11 is realized by the communication I / F 104. The communication unit 11 transmits and receives information between the encryption device 2 and the user terminal 3 via the network N. The communication unit 11 receives encrypted non-identifiable processed information from the encryption device 2, and transmits a calculation result to the user terminal 3.

[0055] The storage unit 12 is realized by a memory 102 and a storage 103. In the storage unit 12, a protected area constituting the TEE stores encrypted non-identifiable processed information 121A, 121B, encryption keys 122A, 122B, non-identifiable processed information 123A, 123B, matching information 124, and a calculation result 125. Hereinafter, the encrypted non-identifiable processed information 121A, 121B, the encryption keys 122A, 122B, and the non-identifiable processed information 123A, 123B may be collectively referred to as encrypted non-identifiable processed information 121, encryption key 122, and non-identifiable processed information 123, respectively.

[0056] The encrypted non-identifiable processed information 121 is non-identifiable processed information encrypted by the encryption device 2. The encrypted non-identifiable processed information 121A is non-identifiable processed information encrypted by the encryption device 2A, and the encrypted non-identifiable processed information 121B is non-identifiable processed information encrypted by the encryption device 2B.

[0057] The encryption key 122 is an encryption key for decrypting the encrypted unidentifiable process information 121. The encryption key 122A is an encryption key for decrypting the encrypted unidentifiable process information 121A, and the encryption key 122B is an encryption key for decrypting the encrypted unidentifiable process information 121B. The encryption key 122 may be a common key for common key cryptography such as AES, or a private key for a public key cryptosystem such as RSA. The encryption keys 122A and 122B may be a common encryption key or different encryption keys.

[0058] The non-identifiable processed information 123 is non-identifiable processed information obtained by decrypting the encrypted non-identifiable processed information 121 using the encryption key 122. The non-identifiable processed information 123A is non-identifiable processed information obtained by decrypting the encrypted non-identifiable processed information 121A using the encryption key 122A, and corresponds to the first non-identifiable processed information in the claims. The non-identifiable processed information 123B is non-identifiable processed information obtained by decrypting the encrypted non-identifiable processed information 121B using the encryption key 122B, and corresponds to the second non-identifiable processed information in the claims.

[0059] The combined information 124 is obtained by combining the non-identification processed information 123A and the non-identification processed information 123B and putting them together into one.

[0060] The calculation result 125 is information indicating the result of a predetermined calculation performed from the matching information 124. The calculation result 125 is, for example, a counting result for each attribute, a causal relationship between attributes, a correlation between attributes, a record overlap count, a statistical analysis result (sum, average, variance, median, frequency, etc.), a machine learning model (parameters) that has learned the matching information 124, or an inference result by a machine learning model, but is not limited to these.

[0061] The control unit 13 is realized by the processor 101 reading and executing a program from the memory 102 and cooperating with other hardware configurations. The control unit 13 controls the overall operation of the computing device 1. The control unit 13 includes an acquisition unit 131, a decryption unit 132, a matching unit 133, and a calculation unit 134.

[0062] The acquisition unit 131 acquires the encrypted non-identifiable processed information from the encryption device 2 , and stores it in the storage unit 12 as the encrypted non-identifiable processed information 121 .

[0063] The decryption unit 132 decrypts the encrypted non-identifiable processed information 121 using the encryption key 122 , and stores the obtained non-identifiable processed information in the storage unit 12 as non-identifiable processed information 123 .

[0064] The matching unit 133 matches the non-identifiable processed information 123A and 123B, and stores the matched information 124 in the memory unit 12.

[0065] The calculation unit 134 executes a predetermined calculation on the matching information 124 and stores the obtained calculation result in the storage unit 12 as the calculation result 125 .

[0066] The functional configuration of the computing device 1 is not limited to the above example, and may include other functional configurations than those described above.

[0067] <Functional configuration of the encryption devices 2A and 2B> Next, the functional configuration of the encryption devices 2A and 2B will be described. Fig. 6 is a diagram showing an example of the functional configuration of the encryption devices 2A and 2B. As shown in Fig. 6, the encryption devices 2A and 2B each include a communication unit 21A, 21B, a storage unit 22A, 22B, and a control unit 23A, 23B. Hereinafter, the communication units 21A, 21B, the storage units 22A, 22B, and the control units 23A, 23B may be collectively referred to as the communication unit 21, the storage unit 22, and the control unit 23, respectively.

[0068] The communication unit 21 is realized by the communication I / F 204. The communication unit 21 transmits and receives information to and from the computing device 1 via the network N. The communication units 21A and 21B transmit encrypted personal information 221A and 221B to the computing device 1, respectively.

[0069] The storage unit 22 is realized by a memory 202 and a storage 203. The storage units 22A and 22B store personal information 221A and 221B, non-identifiable processed information 222A and 222B, hash functions 223A and 223B, salts 224A and 224B, encryption keys 225A and 225B, and encrypted non-identifiable processed information 226A and 226B, respectively.

[0070] The personal information 221 is personal data and includes identification information and attribute information. The personal information 221A corresponds to the first personal information in the claims, and the personal information 221B corresponds to the second personal information in the claims. The personal information 221A and the personal information 221B are each owned by different owners.

[0071] FIG. 7 is a diagram showing an example of personal information 221A, 221B. Personal information 221A, 221B in FIG. 7 includes "name," "age," "gender," and "product" as information items. "Name" is information indicating the name of an individual. "Name" corresponds to identification information. "Age" is information indicating the age of an individual. "Age" corresponds to attribute information. "Gender" is information indicating the gender of an individual. "Gender" corresponds to attribute information. "Product" is information indicating the product purchased by an individual.

[0072] It should be noted that the personal information 221 is not limited to the example in Fig. 7. The personal information 221 may not include some of the above information items, and may include information items other than those described above.

[0073] The non-identifiable processed information 222 is non-identifiable processed information obtained by converting the personal information 221, and includes salted hashed identification information and k-anonymized attribute information. The non-identifiable processed information 222A is obtained by converting the personal information 221A, and corresponds to the first non-identifiable processed information in the claims. The non-identifiable processed information 222B is obtained by converting the personal information 221B, and corresponds to the second non-identifiable processed information in the claims. The identification information of the personal information 221A and 221B is salted hashed using the same method.

[0074] FIG. 8 is a diagram showing an example of the non-identifiable processed information 222A, 222B. The non-identifiable processed information 222A, 222B in FIG. 8 includes information items "name", "age", "gender", and "product". "Name" is an individual's name salted and hashed (hash value) so that the individual cannot be identified. Since the identification information is salted and hashed using the same method, "aaa", which is the "name" common to the non-identifiable processed information 222A, 222B, has the same hash value. This allows the computing device 1 to match the non-identifiable processed information 222A, 222B in a state in which the individual cannot be identified. "Age" is k-anonymized information indicating the age of an individual. "Gender" is k-anonymized information indicating the gender of an individual. "Product" is k-anonymized information indicating the product purchased by an individual.

[0075] The hash function 223 is a function for salting and hashing the identification information of the personal information 221. The hash functions 223A and 223B are the same. The hash function 223 is, for example, sha256, but is not limited to this.

[0076] The salt 224 is a salt (noise) for salted hashing the identification information of the personal information 221. The salts 224A and 224B are common to each other.

[0077] The encryption key 225 is an encryption key for encrypting the non-identifiable processing information 222. The encryption key 225A is an encryption key for encrypting the non-identifiable processing information 222A, and the encryption key 225B is an encryption key for encrypting the non-identifiable processing information 222B. The encryption key 225 may be a common key of a common key cryptosystem such as AES, or a public key of a public key cryptosystem such as RSA. When the encryption key 225 is a public key, the encryption key 225 is generated from a private key (encryption key 122) by the computing device 1 and shared with the encryption device 2. The encryption keys 225A and 225B may be a common encryption key or different encryption keys.

[0078] The encrypted non-identifiable processed information 226 is the non-identifiable processed information 222 encrypted by the encryption device 2. The encrypted non-identifiable processed information 226A is the non-identifiable processed information 222A encrypted by the encryption device 2A, and the encrypted non-identifiable processed information 226B is the non-identifiable processed information 222B encrypted by the encryption device 2B.

[0079] The control unit 23 is realized by the processor 201 reading and executing a program from the memory 202 and working in cooperation with other hardware configurations. The control unit 23 controls the overall operation of the encryption device 2. The control units 23A and 23B include conversion units 231A and 231B and encryption units 232A and 232B, respectively.

[0080] The conversion units 231A and 231B convert the personal information 221A and 221B into non-identifiable processed information 222A and 222B, respectively, and store the non-identifiable processed information in the storage units 22A and 22B, respectively. Specifically, the conversion units 231A and 231B use the hash functions 223A and 223B and the salts 224A and 224B, respectively, to salt-hash the identification information of the personal information 221A and 221B, respectively. In addition, the conversion units 231A and 231B k-anonymize the attribute information of the personal information 221A and 221B, respectively.

[0081] The encryption units 232A and 232B encrypt the non-identifiable processed information 222A and 222B, respectively, to generate encrypted non-identifiable processed information 226A and 226B, and store them in the storage units 22A and 22B, respectively.

[0082] The functional configuration of the encryption devices 2A and 2B is not limited to the above example. For example, the encryption devices 2A and 2B may have functional configurations other than those described above. Furthermore, each functional configuration of the encryption device 2 may be realized by software as described above, or may be realized by hardware such as an IC chip, an SoC, an LSI, or a microcomputer.

[0083] <Functional configuration of user terminal 3> Next, a description will be given of the functional configuration of the user terminal 3. Fig. 9 is a diagram showing an example of the functional configuration of the user terminal 3. As shown in Fig. 9, the user terminal 3 includes a communication unit 31, a storage unit 32, and a control unit 33.

[0084] The communication unit 31 is realized by the communication I / F 304. The communication unit 31 transmits and receives information to and from the computing device 1 via the network N. The communication unit 31 receives the calculation result 125 from the computing device 1.

[0085] The storage unit 32 is realized by a memory 302 and a storage 303. The storage unit 32 stores a calculation result 321.

[0086] Calculation result 321 is information indicating the result of a predetermined calculation performed by calculation device 1 from matching information 124. Calculation result 321 includes a counting result for each attribute, causal relationships between attributes, and correlations between attributes.

[0087] The control unit 33 is realized by the processor 301 reading and executing a program from the memory 302 and working in cooperation with other hardware configurations. The control unit 33 controls the overall operation of the user terminal 3. The control unit 33 includes an acquisition unit 331 and a display unit 332.

[0088] The acquisition unit 331 acquires the calculation result 125 from the calculation device 1 and stores it in the storage unit 32 as the calculation result 321 .

[0089] Display unit 332 controls the screen displayed on display device 306D. Display unit 332 displays calculation results 321 on display device 306D in response to a user's operation.

[0090] The functional configuration of the user terminal 3 is not limited to the above example. For example, the user terminal 3 may have a functional configuration other than the above. Furthermore, each functional configuration of the user terminal 3 may be realized by software as described above, or may be realized by hardware such as an IC chip, an SoC, an LSI, or a microcomputer.

[0091] <Processing Executed by the Computing System 1000> Next, a description will be given of the processing executed by the computing system 1000. Fig. 10 is a flowchart showing an example of the processing executed by the computing system 1000. Fig. 11 is a schematic diagram showing an example of the processing executed by the computing system 1000.

[0092] In Figure 11, X A is personal information 221A (personal data) and M A Column N A is a row matrix. A is the identification information, and N A It is a row vector. P A is the attribute information, (M A -1) Column N A row matrix. K is the k-anonymization algorithm. H is the hash function 223A. r is the salt 224A. X A ' is the non-identifiable processed information 222A. Enc is the encryption algorithm. Enc(X A ') is the encrypted unidentifiable processed information 226A.

[0093] Also, in FIG. B is personal information 221B (personal data) and M B Column N Bis a row matrix. B is the identification information, and N B It is a row vector. P B is the attribute information, (M B -1) Column N B row matrix. K is the k-anonymization algorithm. H is the hash function 223B. r is the salt 224B. X B ' is the non-identifiable processed information 222B. Enc is the encryption algorithm. Enc(X B ') is the encrypted unidentifiable processed information 226B.

[0094] In FIG. 11, Dec is the decryption algorithm. Dec(Enc(X A Dec(Enc(X ')) is the non-identifiable processed information 123A. B ')) is non-identifiable processed information 123B.

[0095] (Step S101) First, the conversion unit 231A of the encryption device 2A converts the personal information 221A into the non-identifiable processed information 222A by using the hash function 223A and the salt 224A (step S101).

[0096] Specifically, as shown in FIG. 11, the conversion unit 231A converts the attribute information P A (First attribute information) is k-anonymized and (K(P A )) and identification information i of personal information 221A A (First identification information) is hashed using hash function 223A (H(i A )), add salt 224A (i A ' xor r). The conversion unit 231A converts the identification information i A may be hashed using a hash function 223A. When the hash function 223A is sha256, the salt 224A is a 256-bit random number, as shown in FIG.

[0097] (Step S102) The conversion unit 231A converts the personal information 221A (XA ) is converted to non-identifiable processed information 222A(X A After storing the above information in storage unit 22A, salt 224A is discarded (step S102). This makes it impossible to restore personal information 221A from non-identifiable processed information 222A.

[0098] (Step S103) Next, the encryption unit 232A of the encryption device 2A uses the encryption key 225A to generate the non-identifiable processed information 222A(X A The encryption unit 232A encrypts the non-identifiable processed information 222A (X') (step S103). A The encrypted unidentifiable processed information 226A (Enc(X ') A ')) is stored in the storage unit 22A.

[0099] (Step S104) Thereafter, the communication unit 21A of the encryption device 2A transmits the encrypted unidentifiable processed information 226A (Enc(X B ')) is transmitted to the computing device 1 (step S104).

[0100] (Step S105) Similar to the encryption device 2A, the conversion unit 231B of the encryption device 2B converts the personal information 221B into the non-identifiable processed information 222B by using the hash function 223B and the salt 224B (step S105).

[0101] Specifically, as shown in FIG. 11, the conversion unit 231B converts the attribute information P B (The second attribute information) is k-anonymized and (K(P B )) Identification information of personal information 221B i B (Second identification information) is hashed by hash function 223B (H(i B )), add salt 224B (i B ' xor r). The conversion unit 231B converts the identification information i Bmay be hashed using a hash function 223B. When the hash function 223B is sha256, the salt 224B is a 256-bit random number, as shown in FIG.

[0102] As described above, the hash function 223A and the hash function 223B are common to both, and the salt 224A and the salt 224B are common to both.

[0103] (Step S106) The conversion unit 231B converts the personal information 221B (X B ) is converted to non-identifiable processed information 222B(X B After storing the above information in storage unit 22B, salt 224B is discarded (step S106). This makes it impossible to restore personal information 221B from non-identifiable processed information 222B.

[0104] (Step S107) Next, the encryption unit 232B of the encryption device 2B uses the encryption key 225B to generate the non-identifiable processed information 222B (X B The encryption unit 232B encrypts the non-identifiable processed information 222B (X') (step S107). B The encrypted unidentifiable processed information 226B (Enc(X ') B The encryption unit 232A and the encryption unit 232B store the encrypted data in the storage unit 22B. As described above, the encryption key 225A and the encryption key 225B may be the same or different. Furthermore, the encryption method of the encryption unit 232A and the encryption unit 232B may be the same or different.

[0105] (Step S108) Thereafter, the communication unit 21B of the encryption device 2B transmits the encrypted unidentifiable processed information 226B (Enc(X B ')) is transmitted to the computing device 1 (step S108).

[0106] The order of steps S101 to S104 and steps S105 to S108 may be reversed. If the computing system 1000 includes three or more encryption devices 2, each encryption device 2 may perform the same process as steps S101 to S104. This allows the computing device 1 to obtain, in an encrypted state, anonymized information corresponding to personal information owned by a plurality of different owners.

[0107] (Step S109) Next, the acquisition unit 131 of the computing device 1 acquires the encrypted unidentifiable processed information 226A received from the encryption device 2A, and stores it in the protected area (TEE) of the storage unit 12 as the encrypted unidentifiable processed information 121A (step S109). Similarly, the acquisition unit 131 of the computing device 1 acquires the encrypted unidentifiable processed information 226B received from the encryption device 2B, and stores it in the protected area (TEE) of the storage unit 12 as the encrypted unidentifiable processed information 121B (step S109).

[0108] (Step S110) The decryption unit 132 decrypts the encrypted non-identifiable processed information 121A by using the encryption key 122A corresponding to the encryption key 225A (step S110). The decryption unit 132 stores the non-identifiable processed information 123A obtained by decrypting the encrypted non-identifiable processed information 121A in the protected area (TEE) of the storage unit 12.

[0109] Similarly, the decryption unit 132 decrypts the encrypted non-identifiable processed information 121B by using the encryption key 122B corresponding to the encryption key 225B (step S110). The decryption unit 132 stores the non-identifiable processed information 123B obtained by decrypting the encrypted non-identifiable processed information 121B in the protected area (TEE) of the storage unit 12.

[0110] (Step S111) The matching unit 133 matches the non-identifiable processed information 123A and 123B, and stores the obtained matched information 124 in the protected area (TEE) of the storage unit 12 (step S111). As described above, the identification information of the non-identifiable processed information 123A and 123B is salted and hashed by the same method, so the matching unit 133 can match the non-identifiable processed information 123A and 123B even when an individual cannot be identified (see FIG. 8).

[0111] (Step S112) The calculation unit 134 executes a predetermined calculation on the matching information 124, and stores the obtained calculation result as the calculation result 125 in the protected area (TEE) of the storage unit 12 (step S112).

[0112] (Step S113) Thereafter, the communication unit 11 of the computing device 1 transmits the calculation result 125 to the user terminal 3 (step S113). The computing device 1 may transmit the calculation result 125 as is, or may encrypt it before transmitting it.

[0113] (Step S114) The acquisition unit 331 of the user terminal 3 acquires the calculation result 125 received from the calculation device 1, and stores it in the storage unit 32 as the calculation result 321 (step S114).

[0114] (Step S115) Display unit 332 displays calculation result 321 on display device 206D in response to a user operation (step S115).

[0115] <Summary> As described above, according to this embodiment, a calculation method is implemented by a calculation system 1000 including an encryption device 2A, an encryption device 2B, and a calculation device 1, and includes a conversion step in which the encryption device 2A converts personal information 221A into non-identifiable processed information 222A, an encryption step in which the encryption device 2A encrypts the non-identifiable processed information 222A, a conversion step in which the encryption device 2B converts personal information 221B into non-identifiable processed information 222B, an encryption step in which the encryption device 2B encrypts the non-identifiable processed information 222B, an acquisition step in which the calculation device 1 acquires encrypted non-identifiable processed information 226A, 226B, a decryption step in which the calculation device 1 decrypts the encrypted non-identifiable processed information 121A, 121B, a matching step in which the calculation device 1 matches the non-identifiable processed information 123A, 123B, and a calculation step in which the calculation device 1 performs a predetermined calculation from the matching information 124.

[0116] This allows the computing system 1000 to perform calculations on the non-identifiable processed information in an unencrypted state while increasing the security of the exchange of the non-identifiable processed information between the computing device 1 and the encryption device 2. As a result, the computing system 1000 can perform calculations on the non-identifiable processed information at high speed while reducing the risk of information leakage of the non-identifiable processed information.

[0117] Furthermore, according to this embodiment, the acquisition step S109, the decryption step S110, the matching step S111, and the calculation step S112 are executed by the TEE of the computing device 1. This can further reduce the risk of information leakage of the anonymized information.

[0118] <Additional Notes> The present embodiment includes the following disclosure.

[0119] (Appendix 1) A computing method executed by a computing system including a first encryption device, a second encryption device, and a computing device, comprising: a conversion step in which the first encryption device converts the first personal information into first anonymized processed information; an encryption step in which the first encryption device encrypts the first non-identifiable processed information; a conversion step in which the second encryption device converts the second personal information into second anonymized processed information; an encryption step in which the second encryption device encrypts the second non-identifiable processed information; An acquisition step in which the computing device acquires the encrypted first non-identifiable processed information and the encrypted second non-identifiable processed information; a decryption step in which the computing device decrypts the encrypted first non-identifiable processed information and the encrypted second non-identifiable processed information; a matching step in which the computing device matches the decrypted first non-identifiable processed information with the decrypted second non-identifiable processed information; A calculation step in which the calculation device performs a predetermined calculation from the matched first non-identifiable processed information and the second non-identifiable processed information; Calculation methods including:

[0120] (Appendix 2) The computing device performs the obtaining step, the decrypting step, the matching step, and the calculating step in a TEE. A calculation method as claimed in any one of the claims.

[0121] (Appendix 3) At least one of the first encryption device and the second encryption device performs the encryption step using a common key; The computing device performs the decryption step with the common key. Calculation method described in the appendix.

[0122] (Appendix 4) At least one of the first encryption device and the second encryption device performs the encryption step with a public key; The computing device performs the decryption step with a private key that corresponds to the public key. Calculation method described in the appendix.

[0123] (Appendix 5) The first personal information includes first attribute information, the converting step of the first encryption device includes a process of k-anonymizing the first attribute information, The second personal information includes second attribute information, The converting step of the second encryption device includes a process of k-anonymizing the second attribute information. Calculation method described in the appendix.

[0124] (Appendix 6) The first personal information includes first identification information, The converting step of the first encryption device includes a process of hashing the first identification information and adding a salt. Calculation method described in the appendix.

[0125] (Appendix 7) The first personal information includes first identification information, The converting step of the first encryption device includes a process of adding a salt to the first identification information and hashing the salt. Calculation method described in the appendix.

[0126] (Appendix 8) The first encryption device discards the salt after the converting step. Calculation method as set forth in Appendix 6 or Appendix 7.

[0127] (Appendix 9) The second personal information includes second identification information, The converting step of the second encryption device includes a process of hashing the second identification information and adding a salt. Calculation method described in the appendix.

[0128] (Appendix 10) The second personal information includes second identification information, The converting step of the second encryption device includes a process of adding a salt to the second identification information and hashing the salt. Calculation method described in Appendix 1.

[0129] (Appendix 11) The second encryption device discards the salt after the converting step. Calculation method set forth in Appendix 10 or Appendix 11.

[0130] (Appendix 12) The first encryption device and the second encryption device use a common hash function and salt in the conversion step. Calculation method described in Appendix 1.

[0131] (Appendix 13) The first non-identifiable processed information and the second non-identifiable processed information are pseudonymously processed information, anonymously processed information, personal information, or non-personal information. Calculation method described in Appendix 1.

[0132] (Appendix 13) A computing system including a first encryption device, a second encryption device, and a computing device, a conversion step in which the first encryption device converts the first personal information into first anonymized processed information; an encryption step in which the first encryption device encrypts the first non-identifiable processed information; a conversion step in which the second encryption device converts the second personal information into second anonymized processed information; an encryption step in which the second encryption device encrypts the second non-identifiable processed information; An acquisition step in which the computing device acquires the encrypted first non-identifiable processed information and the encrypted second non-identifiable processed information; a decryption step in which the computing device decrypts the encrypted first non-identifiable processed information and the encrypted second non-identifiable processed information; a matching step in which the computing device matches the decrypted first non-identifiable processed information with the decrypted second non-identifiable processed information; A calculation step in which the calculation device performs a predetermined calculation from the matched first non-identifiable processed information and the second non-identifiable processed information; A computing system for performing a computing method comprising:

[0133] (Appendix 14) A computing system including a first encryption device, a second encryption device, and a computing device, a conversion step in which the first encryption device converts the first personal information into first anonymized processed information; an encryption step in which the first encryption device encrypts the first non-identifiable processed information; a conversion step in which the second encryption device converts the second personal information into second anonymized processed information; an encryption step in which the second encryption device encrypts the second non-identifiable processed information; An acquisition step in which the computing device acquires the encrypted first non-identifiable processed information and the encrypted second non-identifiable processed information; a decryption step in which the computing device decrypts the encrypted first non-identifiable processed information and the encrypted second non-identifiable processed information; a matching step in which the computing device matches the decrypted first non-identifiable processed information with the decrypted second non-identifiable processed information; A calculation step in which the calculation device performs a predetermined calculation from the matched first non-identifiable processed information and the second non-identifiable processed information; A calculation program for executing a calculation method including the steps of:

[0134] (Appendix 15) An acquisition step of acquiring the encrypted first non-identifiable processed information and the encrypted second non-identifiable processed information; a decryption step of decrypting the encrypted first non-identifiable processed information and the encrypted second non-identifiable processed information; a matching step of matching the decrypted first non-identifiable processed information and the decrypted second non-identifiable processed information; A calculation step of performing a predetermined calculation from the matched first non-identification processing information and the second non-identification processing information; A computing device that runs

[0135] (Appendix 16) A conversion step of converting personal information into de-identified processed information; an encryption step of encrypting the non-identifiable processing information; a transmitting step of transmitting the encrypted de-identified information to a computing device; Cryptographic device that performs

[0136] The embodiments disclosed herein are illustrative in all respects and should not be considered as limiting. The scope of the present invention is indicated by the claims, not by the above meaning, and is intended to include all modifications within the meaning and scope of the claims. The present invention is not limited to the above-mentioned embodiments, and various modifications are possible within the scope of the claims, and embodiments obtained by appropriately combining the technical means disclosed in different embodiments are also included in the technical scope of the present invention. [Explanation of symbols]

[0137] 1: Computing device 2: Encryption device 3: User terminal 11: Communications Department 12: Storage part 13: Control unit 121: Encrypted non-identifying processed information 122: Encryption key 123: Non-identifiable processed information 124: Matching information 125: Calculation result 131: Acquisition Department 132: Decoding section 133: Butt joint 134: Calculation section

Claims

1. A computing method executed by a computing system including a first encryption device, a second encryption device, and a computing device, comprising: a conversion step in which the first encryption device converts the first personal information into first non-identifiable processed information; an encryption step in which the first encryption device encrypts the first non-identifiable processed information; a conversion step in which the second encryption device converts the second personal information into second anonymized processed information; an encryption step in which the second encryption device encrypts the second non-identifiable processed information; an acquisition step of the computing device acquiring the encrypted first non-identifiable processed information and the encrypted second non-identifiable processed information; a decryption step of the computing device decrypting the encrypted first non-identifiable processed information and the encrypted second non-identifiable processed information; a matching step in which the computing device matches the decrypted first non-identifiable processed information with the decrypted second non-identifiable processed information; a calculation step in which the calculation device performs a predetermined calculation from the matched first non-identifiable processed information and the second non-identifiable processed information; Calculation methods including:

2. The computing device performs the obtaining, decoding, matching and calculating steps in a TEE. A calculation method as claimed in any one of the claims.

3. At least one of the first encryption device and the second encryption device performs the encryption step using a common key; The computing device performs the decryption step with the common key. A calculation method as claimed in any one of the claims.

4. At least one of the first encryption device and the second encryption device performs the encryption step with a public key; The computing device performs the decryption step with a private key that corresponds to the public key. A calculation method as claimed in any one of the claims.

5. The first personal information includes first attribute information, the converting step of the first encryption device includes a process of k-anonymizing the first attribute information, The second personal information includes second attribute information, The converting step of the second encryption device includes a process of k-anonymizing the second attribute information. A calculation method as claimed in any one of the claims.

6. The first personal information includes first identification information, The converting step of the first encryption device includes a process of hashing the first identification information and adding a salt. A calculation method as claimed in any one of the claims.

7. The first personal information includes first identification information, The converting step of the first encryption device includes a process of adding a salt to the first identification information and hashing the salt. A calculation method as claimed in any one of the claims.

8. The first encryption device discards the salt after the converting step. The calculation method according to claim 6 or 7.

9. The second personal information includes second identification information, The converting step of the second encryption device includes hashing the second identification information and adding a salt. A calculation method as claimed in any one of the claims.

10. The second personal information includes first identification information, The converting step of the second encryption device includes a process of adding a salt to the second identification information and hashing the salt. A calculation method as claimed in any one of the claims.

11. The second encryption device discards the salt after the converting step.

12. A calculation method according to claim 10 or 11.

12. The first encryption device and the second encryption device use a common hash function and salt in the conversion step. The calculation method according to claim 1 .

13. The first non-identifiable processed information and the second non-identifiable processed information are pseudonymously processed information, anonymously processed information, personal information, or non-personal information. The calculation method according to claim 1 .

14. A computing system including a first encryption device, a second encryption device, and a computing device, a conversion step in which the first encryption device converts the first personal information into first non-identifiable processed information; an encryption step in which the first encryption device encrypts the first non-identifiable processed information; a conversion step in which the second encryption device converts the second personal information into second anonymized processed information; an encryption step in which the second encryption device encrypts the second non-identifiable processed information; an acquisition step of the computing device acquiring the encrypted first non-identifiable processed information and the encrypted second non-identifiable processed information; a decryption step of the computing device decrypting the encrypted first non-identifiable processed information and the encrypted second non-identifiable processed information; a matching step in which the computing device matches the decrypted first non-identifiable processed information with the decrypted second non-identifiable processed information; a calculation step in which the calculation device performs a predetermined calculation from the matched first non-identifiable processed information and the second non-identifiable processed information; A computing system for performing a computing method comprising:

15. A computing system including a first encryption device, a second encryption device, and a computing device, a conversion step in which the first encryption device converts the first personal information into first non-identifiable processed information; an encryption step in which the first encryption device encrypts the first non-identifiable processed information; a conversion step in which the second encryption device converts the second personal information into second anonymized processed information; an encryption step in which the second encryption device encrypts the second non-identifiable processed information; an acquisition step of the computing device acquiring the encrypted first non-identifiable processed information and the encrypted second non-identifiable processed information; a decryption step of the computing device decrypting the encrypted first non-identifiable processed information and the encrypted second non-identifiable processed information; a matching step in which the computing device matches the decrypted first non-identifiable processed information with the decrypted second non-identifiable processed information; a calculation step in which the calculation device performs a predetermined calculation from the matched first non-identifiable processed information and the second non-identifiable processed information; A calculation program for executing a calculation method including the steps of:

16. An acquisition step of acquiring the encrypted first non-identifiable processed information and the encrypted second non-identifiable processed information; a decryption step of decrypting the encrypted first non-identification processing information and the encrypted second non-identification processing information; a matching step of matching the decrypted first non-identification processing information and the decrypted second non-identification processing information; a calculation step of performing a predetermined calculation from the matched first non-identification processing information and the second non-identification processing information; A computing device that runs

17. A conversion step of converting personal information into de-identified processed information; an encryption step of encrypting the non-identifiable processing information; a transmitting step of transmitting the encrypted de-identified information to a computing device; Cryptographic device that performs

Images