Confidential id matching system

Abstract

To provide a mechanism for determining whether pieces of confidential information match each other, while maintaining a confidential state.SOLUTION: There is provided a method for determining a fact that pieces of data match each other. The method is configured so that: each of multiple provider servers having confidential information performs processing with respect to its own confidential information, using one or more pieces of prescribed information; processed confidential information is divided into multiple pieces of partial information; a part of partial information are exchanged; at least one of the multiple provider servers or another server executes prescribed calculation using the part of exchanged partial information, and other partial information, without sharing by the multiple provider servers, at least one piece of prescribed information used for the processing; therefore it is determined that pieces of confidential information match each other.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a technique for determining whether or not pieces of secret information correspond to each other. [Background technology]

[0002] WO 2020 / 075273 (Patent Document 1) is a document disclosing background technology of this technical field. This publication states that "an information processing device is provided that executes a predetermined process accurately and quickly by secret computation. When the absolute value of the difference value between the secretly shared first and second shares is equal to or less than the natural number t, the information processing device calculates the difference value between the first and second shares. Furthermore, the information processing device performs a magnitude comparison regarding the first and second shares by using bit decomposition of the least significant bit to the mth bit (m is a natural number) regarding the difference value" (see abstract). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2020 / 075273 Summary of the Invention [Problem to be solved by the invention]

[0004] Patent Document 1 describes secure computation. However, Patent Document 1 does not consider a method for determining whether or not pieces of secret information correspond to each other while keeping them secret.

[0005] The present invention has been made in consideration of the above circumstances, and has an object to provide a mechanism for determining whether or not pieces of secret information correspond to each other while keeping the information confidential. [Means for solving the problem]

[0006] In order to solve the above problems, for example, the configurations described in the claims are adopted. The present application includes multiple means for solving the above-mentioned problems. One example is a method for determining whether data correspond to each other, in which each of multiple business servers, each having secret information, processes its own secret information using one or more specified information, divides the processed secret information into multiple partial information, exchanges some of the partial information, and at least one of the multiple business servers, or another server, determines whether the secret information corresponds to each other by performing a specified calculation using the exchanged partial information and other partial information, without the multiple business servers sharing at least one of the specified information used in the processing. Effect of the Invention

[0007] According to the present invention, it is possible to provide a mechanism for determining whether or not pieces of secret information correspond to each other while keeping the information confidential. Other objects, configurations and advantages than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 shows an example of the configuration of a secret ID matching system 100. As shown in FIG. [Diagram 2] FIG. 2 shows an example of the configuration of the business server 101. [Diagram 3] FIG. 3 shows an example of the matching process flow for pattern 1. [Figure 4] FIG. 4 shows an example of the matching process flow for pattern 2. [Diagram 5] FIG. 5 shows an example of the matching process flow for pattern 3. [Figure 6] FIG. 6 shows an example of the matching process flow for pattern 4. [Figure 7] FIG. 7 shows an example of the matching process flow for pattern 5. [Figure 8] FIG. 8 shows an example of the matching process flow for pattern 6. [Figure 9] FIG. 9 shows an example of the matching process flow for pattern 7. [Figure 10] FIG. 10 shows an example of the matching process flow for pattern 8. [Figure 11] FIG. 11 shows an example of the matching process flow for pattern 9. [Figure 12] FIG. 12 shows an example of the matching process flow for pattern 10. [Figure 13] FIG. 13 shows an example of the matching process flow for pattern 11. [Figure 14] FIG. 14 shows an example of the matching process flow for pattern 12. [Figure 15] FIG. 15 shows an example of the matching process flow for pattern 13. [Figure 16] FIG. 16 shows an example of the matching process flow for pattern 14. [Figure 17] FIG. 17 shows an example of the matching process flow for pattern 15. [Figure 18] FIG. 18 shows an example of the matching process flow for pattern 16. [Figure 19] FIG. 19 shows an example of the flow of the pattern 17 matching process. [Figure 20] FIG. 20 shows an example of the pattern 18 matching process flow. [Figure 21] FIG. 21 shows an example of the matching process flow for pattern 19. [Figure 22] FIG. 22 shows an example of a matching process flow for pattern 20. [Diagram 23] FIG. 23 shows an example of the flow of the pattern 21 matching process. [Figure 24] FIG. 24 shows an example of the flow of the pattern 22 matching process. [Diagram 25] FIG. 25 shows an example of the matching process flow for pattern 23. [Figure 26] FIG. 26 shows an example of the pattern 24 matching process flow. [Figure 27] FIG. 27 shows an example of the matching process flow for pattern 25. [Figure 28]FIG. 28 shows an example of the pattern 26 matching process flow. [Figure 29] FIG. 29 shows an example of the matching process flow for pattern 27. [Diagram 30] FIG. 30 shows an example of the process flow of the match checking protocol 1. [Diagram 31] FIG. 31 shows an example of the processing flow of the match checking protocol 2-1. [Diagram 32] FIG. 32 shows an example of the processing flow of the match checking protocol 2-2. [Diagram 33] FIG. 33 shows an example of the processing flow of the match checking protocol 2-3. [Diagram 34] FIG. 34 shows an example of the processing flow of the match checking protocol 2-4. [Diagram 35] FIG. 35 shows an example of the processing flow of the match checking protocol 2-5. [Diagram 36] FIG. 36 shows an example of the processing flow of the match checking protocol 3-1. [Figure 37] FIG. 37 shows an example of the processing flow of the match checking protocol 3-2. [Figure 38] FIG. 38 shows an example of the configuration of a secret ID matching system 3800. [Figure 39] FIG. 39 shows an example of the configuration of the noise generation server 3801. [Diagram 40] FIG. 40 shows an example of the configuration of the correspondence determination server 3802 . [Diagram 41] FIG. 41 shows an example of the matching process flow of pattern 5-2. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, the embodiments will be described with reference to the drawings. 1. Example 1-1. Overview of the Example One way to utilize confidential information is to cross-reference confidential information between multiple businesses to increase the number of columns of data. This makes the information more valuable for analysis. To realize this method, a common ID is required to cross-reference confidential information.

[0010] If a common ID is shared among multiple businesses, it is possible to match confidential information with each other based on the common ID. However, if a common ID is not shared among multiple businesses, it is necessary to use identifiable personal data as the common ID. In that case, for example, an email address or a phone number could be used as the common ID.

[0011] However, since email addresses and phone numbers are highly personally identifiable information, it is difficult to use them as is. In order to use email addresses and phone numbers as common IDs, for example, the information must be converted into processed information. By converting the information into processed information, it is possible to avoid sharing information that is highly personally identifiable.

[0012] However, even if the information is converted into processed information, it is not advisable for joint users to share information on how to create a temporary ID that can restore the personal information that was the source of the processed information, as this could allow a third party to restore the original personal information.

[0013] In light of the above, it can be said that a major issue is the lack of a means to safely cross-reference confidential information when it is shared.

[0014] In view of such a problem, the present embodiment provides a mechanism for determining the identity of data between businesses. By identifying the same data between businesses using this mechanism, it becomes possible to compare secret information between businesses using the data as a common ID. Note that the data for which identity is determined in the present embodiment is, for example, data with high personal identification potential, such as an email address or a telephone number.

[0015] In this embodiment, when determining whether data is identical between businesses, the confidential information of each business is processed, for example, by adding noise to the confidential information, and converting the confidential information into processed information.

[0016] In addition, in this embodiment, a comparison operation of secret information is performed using an encryption technique with information-theoretic security. The encryption technique with information-theoretic security referred to here is, for example, secret sharing or Vernam cipher. In this embodiment, by using such an encryption technique, sharing of information (for example, noise or a method for generating noise) used in processing information between businesses is avoided.

[0017] As a result, according to this embodiment, it becomes possible to determine whether data is identical without the businesses sharing information used to process the information.

[0018] An example of the definition of information-theoretic security is given below. According to Shannon's definition: Cryptosystem x∈X: Plaintext k∈K: key c∈C: ciphertext Complete confidentiality is achieved when the following two conditions are met. (1) For all x∈X, c∈C, p(x|c)=p(x). (2) p(K|C) = p(K) = 2 -|K| |K|=|X|: key length = data length

[0019] Here, condition (1) means that any decryption result obtained with any key is equally likely. Condition (2) means that the estimation probability of the key sequence is uniformly distributed.

[0020] Cryptographic methods that satisfy information-theoretic security include one-time pad, Vernam cipher, and secret sharing.

[0021] 1-2. Configuration of the embodiment FIG. 1 shows an example of the configuration of a secret ID matching system 100. As shown in FIG. The secret ID matching system 100 includes two business server 101A and 101B. The business server 101A is a server used by business A, and the business server 101B is a server used by business B. Both servers are connected to a wired or wireless network and can transmit and receive information to and from each other.

[0022] Businesses A and B each possess confidential information and jointly use it. Specifically, businesses A and B cross-reference each other's confidential information and increase the number of columns of data, thereby making the information more valuable for analysis.

[0023] A common ID is necessary to match this secret information. Therefore, in order to identify the common ID, businesses A and B identify data that are common to each other. Note that the common data identified in this embodiment is data that is highly identifiable to individuals, such as an email address or a phone number.

[0024] In the following description, the business servers 101A and 101B will be collectively referred to as the "business server 101" unless there is a particular need to distinguish between them.

[0025] The business server 101 may be, for example, a portable terminal (mobile terminal) such as a smartphone, tablet, mobile phone, or personal digital assistant (PDA), or may be a wearable terminal such as glasses, wristwatch, or clothing. The business server 101 may be a stationary or portable computer, or a server located on the cloud or a network. The business server 101 may have a function of a VR (Virtual Reality) terminal, an AR (Augmented Reality) terminal, or an MR (Mixed Reality) terminal. Alternatively, the business server 101 may be a combination of a plurality of these terminals. For example, a combination of one smartphone and one wearable terminal may function logically as one terminal. The business server 101 may be an information processing terminal other than these.

[0026] The business entity server 101 includes a processor that executes an operating system, applications, programs, etc., a main storage device such as a RAM (Random Access Memory), an auxiliary storage device such as an IC card, a hard disk drive, an SSD (Solid State Drive), a flash memory, etc., a communication control unit such as a network card, a wireless communication module, a mobile communication module, etc., input devices such as a touch panel, a keyboard, a mouse, voice input, and input by motion detection by imaging of a camera unit, and an output device such as a monitor, a display, etc. The output device may be a device or terminal that transmits information to be output to an external monitor, display, printer, device, etc.

[0027] The main memory stores various programs and applications (modules), and the processor executes these programs and applications to realize the various functional elements of the overall system. Each of these modules may be implemented in hardware by integration or the like. Each module may be an independent program or application, or may be implemented as a subprogram or function within a single integrated program or application.

[0028] In this specification, each module is described as an entity (subject) that performs processing, but in reality, a processor that processes various programs, applications, etc. (modules) executes the processing. Various databases (DB) are stored in the auxiliary storage device. A "database" is a functional element (storage unit) that stores a data set so that it can handle any data operation (e.g., extraction, addition, deletion, overwriting, etc.) from a processor or an external computer. There are no limitations on the method of implementing the database, and it may be, for example, a database management system, spreadsheet software, or a text file such as XML, JSON, CSV, or TSV.

[0029] FIG. 2 shows an example of the configuration of the business server 101. The business server 101 is configured, for example, by a server placed on a cloud. The main memory device 201 stores programs and applications such as a processing module 210, a division module 211, an exchange module 212, a correction module 213, an N exchange module 214, and a correspondence determination module 215. The processor 203 executes these programs and applications to realize each functional element of the business server 101.

[0030] The processing module 210 processes the secret information using one or more pieces of predetermined information. The predetermined information referred to here is, for example, noise, and the processing module adds noise to the secret information. The processing module 210 may process the confidential information using predetermined information exchanged between the business servers 101 and predetermined information not exchanged.

[0031] The division module 211 encrypts the processed secret information using cryptographic techniques with information-theoretic security. In this case, the module divides the secret information or the processed secret information into two or more pieces of information. The processed secret information here is, for example, secret information to which noise has been added. Alternatively, the division module 211 may divide the secret information exchanged between the entity servers 101 or the further corrected secret information into a plurality of partial information.

[0032] The exchange module 212 exchanges encrypted secret information obtained by processing and encrypting the secret information between the business servers 101. Specifically, the module exchanges any one of the following information between the business servers 101: Processed confidential information Partial information generated by dividing the processed secret information - Secret information is divided and generated, and then processed into partial information Corrected partial information

[0033] The correction module 213 corrects the processed secret information, partial information generated by dividing the processed secret information, or the secret information or partial information exchanged between the business servers 101, using noise or a part generated by dividing the noise. At this time, the module adds or removes noise or a part of the noise. The noise (in other words, the predetermined information) used at this time may be information exchanged between the business servers 101.

[0034] The N exchange module 214 exchanges between the business servers 101 a part generated by dividing the noise (in other words, the predetermined information) or a part of the multiple generated noises.

[0035] The correspondence determination module 215 determines whether the secret information corresponds to each other by performing a specified calculation using each encrypted secret information, without sharing at least one of the specified information used to process the secret information between the business servers 101.

[0036] At this time, the module determines whether the secret information corresponds to each other based on each partial information and noise. More specifically, the module performs calculations based on a part of the partial information to which noise has been added or removed and another part of the partial information to determine whether the secret information corresponds to each other.

[0037] The module may determine whether the pieces of secret information correspond to each other by performing a predetermined calculation using any of the following information: Partial information exchanged between the business server 101 and other partial information (including processed partial information) Corrected partial information and other partial information (including processed partial information) Corrected multiple partial information Corrected confidential information

[0038] As another method, the module adds or removes noise to some of the partial information and compares them to determine whether they correspond. In addition, the module adds or removes noise to other partial information and compares them to determine whether they correspond. If both of the above two determinations are positive, the module determines that the secret information corresponds to each other. Note that the correspondence between pieces of secret information includes the coincidence of the pieces of secret information.

[0039] The auxiliary storage device 202 stores various data 220 such as secret information and noise used in the secret ID matching described later.

[0040] 1-4. Operation of the embodiment The secret ID matching according to this embodiment is composed of six processes: processing, division, exchange, correction, noise exchange, and match determination. Below, each pattern of the secret ID matching, which is composed of a combination of multiple processes among these six processes, will be described in order. The 27 patterns explained below are roughly divided into 8 patterns that do not include noise exchange and 19 patterns that do include noise exchange. Below, we will first explain the 8 patterns that do not include noise exchange, and then explain the 19 patterns that include noise exchange.

[0041] Before describing each pattern, a definition of the algebraic system is provided. A pair (G,·) of a set G and a binary operation (map·:G×G→G) on it that satisfies the associative law is called a semigroup. Here, the associative law states that for any a, b, c∈G, (a·b)·c=a·(b·c). A semigroup that satisfies the commutative law is called a commutative semigroup. The commutative law here is the law that for any a, b∈G, a·b=b·a holds.

[0042] A semigroup (G,·) that has an identity and an inverse is called a group. Here, having an identity means that e∈G exists such that for any a∈G, a·e=e·a=a is satisfied, and having an inverse means that for any a∈G, b∈G exists such that a·b=b·a=e is satisfied. In particular, a group that satisfies the commutative law is called a commutative group. In the following, for each pattern, we first state what kind of group or semigroup is required for the protocol to be valid against noise. At a minimum, this means that any protocol that holds for semigroups also holds for groups, and any protocol that holds for non-commutative systems also holds for commutative systems. Here, the secret information is a space that is affected by noise. Any space that can be affected by noise can be used.

[0043] 1-4-1.No noise exchange 1-4-1-1. Pattern 1 (Abelian group) Pattern 1 is executed in the order of processing, division, replacement, correction, and match determination. FIG. 3 shows an example of the matching process flow for pattern 1. In the flow 300 shown in the figure, first, the processing module 210A of the business A generates a noise "r AA ", "r AB " (step 301). Then, the module generates the generated noise "r AA ", "r AB " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 302).

[0044] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB " (step 303). Then, the module generates the generated noise "r BA ", "r BB " to confidential information "s B ” and add noise addition information “s′ B" is generated (step 304).

[0045] In the description of the operation of this embodiment, the modules of the operator A are differentiated from the modules of the operator B by adding the suffix "A" to the end of the module name, and the modules of the operator B are differentiated from the modules of the operator A by adding the suffix "B" to the end of the module name.

[0046] Next, the division module 211A of the operator A divides the noise-added information “s′ A Share " [s′ A ] A ", [s′ A ] B " (step 305). Similarly, the division module 211B of the operator B uses the secret sharing scheme to derive the noise-added information “s′ B Share " [s′ B ] A ", [s′ B ] B " (step 306).

[0047] Next, the switching module 212A of the operator A receives the share “[s′ A ] B " to the business server 101B (step 307). Similarly, the switching module 212B of the operator B receives the share “[s′ B ] A " to the business server 101A (step 308).

[0048] Next, the correction module 213A of the operator A calculates the share “[s′ A ] A " to noise "r AA Remove the " and share "[s" A ] A The module also generates a share "[s' B ] A " with noise "r AB Add " and share " [s" B ] A " is generated (step 310).

[0049] Similarly, the correction module 213B of the operator B corrects the share “[s′ A ] B " with noise "r BA Add " and share " [s" A ] B The module also generates a share "[s' B ] B " to noise "r BB Remove the " and share "[s" B ] B " is generated (step 312).

[0050] The share “[s″ generated in step 309 above A ] A " and the share "[s" generated in step 311 above A ] B " is "s A +r AB +r BA " share. On the other hand, the share “[s″ generated in step 310 above B ] A " and the share "[s" generated in step 312 above. B ] B " is "s B +r AB +r BA " share.

[0051] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ A ] A " ", "[s" B ] A " ", "[s" A ] B " ", "[s" B ] B " to the secret information "s A ", "s B In step 313, the module uses match determination protocol 1. This match determination protocol 1 will be described later.

[0052] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. The above is an explanation of pattern 1.

[0053] 1-4-1-2. Pattern 2 (Non-Abelian Semigroups) Pattern 2 is executed in the order of processing, division, exchange, correction, and match check. In this pattern 2, the Vernam cipher is generalized using group theory. FIG. 4 shows an example of the matching process flow for pattern 2. Before describing the flow 400 shown in the figure, the information that appears in this flow will be defined.

[0054] First, let F be the secret space. Assume that there exists a secret sharing scheme in which F is the secret space, which is linear and has a matching check. JPEG2025034980000002.jpg11170

[0055] Next, flow 400 will be described. First, the processing module 210A of the business A generates noise “l A (∈G L ) (step 401). The module then generates the generated noise "l A " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 402).

[0056] Similarly, the processing module 210B of the entity B generates a noise “r B (∈G R )" (step 403). The module then generates the generated noise "r B " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 404). The process of adding noise in steps 402 and 404 is, for example, an XOR operation.

[0057] Next, the division module 211A of the operator A divides the information "s' A Split "s" into partial information "s' A,h ", "s' A,t " (step 405). The module also generates a noise "l A " is split into partial noise "l A,h ", "l A,t " is generated (step 406).

[0058] Similarly, the segmentation module 211B of operator B receives the information "s' B Split "s" into partial information "s' B,h ", "s' B,t " (step 407). The module also generates a noise "r B " is split into partial noise "r B,h ", "r B,t " is generated (step 408). The split process will be described later.

[0059] Next, the switching module 212A of the operator A converts the partial information "s' A,h " to the business server 101B (step 409). Similarly, the switching module 212B of the operator B receives the partial information "s' B,h " to the business server 101A (step 410).

[0060] Next, the correction module 213A of the operator A corrects the partial information "s' B,h " to partial noise "l A,h " is added to the partial information "s" B,h " is generated (step 411). Similarly, the correction module 213B of the operator B corrects the partial information “s′ A,h " to the partial noise "r B,h " is added to the partial information "s" A,h " is generated (step 412). The noise adding process in steps 411 and 412 is, for example, an XOR operation.

[0061] Next, the correspondence determination module 215 of the operator A or B uses the partial information "s" B,h ","s" A,h In step 413, the module uses match determination protocol 2. This match determination protocol 2 will be described later.

[0062] Next, the correspondence determination module 215A of the business A determines the partial information “s′ A,h ", "s' B,h ","s" B,h " is deleted (not shown). Similarly, the correspondence determination module 215B of the operator B uses the partial information “s′ B,h ", "s' A,h ","s" A,h " is deleted (not shown). Note that the deletion referred to here includes not only a process of simply deleting data, but also other processes that make the data unusable (for example, a process of irreversibly converting the data).

[0063] Next, the switching module 212A of the operator A converts the partial information "s' A,t " to the business server 101B (step 414). Similarly, the switching module 212B of the operator B receives the partial information "s' B,t " to the business server 101A (step 415).

[0064] Next, the correction module 213A of the operator A corrects the partial information "s' B,t " to partial noise "l A,t " is added to the partial information "s" B,t " is generated (step 416). Similarly, the correction module 213B of the operator B corrects the partial information “s′ A,t " to the partial noise "r B,t " is added to the partial information "s" A,t " is generated (step 417). The process of adding noise in steps 416 and 417 is, for example, an XOR operation.

[0065] Next, the correspondence determination module 215 of the operator A or B uses the partial information "s" B,t ","s" A,t In step 418, the module uses match determination protocol 2. This match determination protocol 2 will be described later.

[0066] As a result of the determination in steps 413 and 418, the partial information "s" B,h ","s" A,h " matches and partial information "s" B,t ","s" A,t If the two match, the secret information "s A ", "s B " matches. The above is an explanation of pattern 2.

[0067] 1-4-1-3. Pattern 3 (Non-Abelian Semigroups) Pattern 3 is executed in the order of processing, exchange, correction, and match check. In this pattern 3, the Vernam cipher is generalized using group theory. FIG. 5 shows an example of the matching process flow for pattern 3. Before describing the flow 500 shown in the figure, the information that appears in this flow will be defined.

[0068] First, let F be the space of secret information. Assume that there exists a secret sharing scheme in which F is the space of secret information and which has a match check function. JPEG2025034980000003.jpg10170

[0069] Next, flow 500 will be described. First, the processing module 210A of the business A generates noise “l A (∈G L ) (step 501). The module then generates the generated noise "l A" to confidential information "s A ” and add noise addition information “s′ A " is generated (step 502).

[0070] Similarly, the processing module 210B of the entity B generates a noise “r B (∈G R )" (step 503). The module then generates the generated noise "r B " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 504). The process of adding noise in steps 502 and 504 is, for example, an XOR operation.

[0071] Next, the switching module 212A of the operator A converts the noise-added information "s' A " to the business server 101B (step 505). Similarly, the switching module 212B of the operator B receives the noise-added information "s' B " to the business server 101A (step 506).

[0072] Next, the correction module 213A of the operator A calculates the noise-added information “s′ B " with noise "l A " is added to the correction information "s" B " is generated (step 507). Similarly, the correction module 213B of the operator B corrects the partial information “s′ A " with noise "r B " is added to the correction information "s" A " is generated (step 508). The process of adding noise in steps 507 and 508 is, for example, an XOR operation.

[0073] Next, the correspondence determination module 215 of the operator A or B receives the correction information "s" B ","s" A " to the secret information "s A ", "s BIn step 509, the module uses match determination protocol 2. This match determination protocol 2 will be described later. This concludes the explanation of pattern 3.

[0074] Here, for pattern 3, G L , If F is finite, then G L If the action of is transitive, then it is safe (g L ·s L From s L (No information is available about G R Similarly, we prove that if the action of G on F is transitive, then it is safe. To prove this, we need only prove that for a, b∈F, the following quantities do not depend on a. F is a random variable uniformly distributed over F, and U G is a random variable uniformly distributed on G.

number

[0075] Where:

number

[0076] Using this,

number

[0077] However, the following was used:

number

[0078] JPEG2025034980000008.jpg9170 Therefore,

number

[0079] Next, we will explain examples of groups to which Pattern 3 applies. JPEG2025034980000011.jpg24170

[0080] JPEG2025034980000012.jpg38170

[0081] (3) More generally, F=G L =G R Consider the standard group action, where =G. JPEG2025034980000013.jpg34170

[0082] Next, we will show a specific calculation example for the example group (2) where pattern 3 applies. We will perform the calculation for the case of n=q, q=5. P L and P R Common secret information S L , S R Let's say you have the following.

number

number

number

[0083] At this time, P L calculates the following, P R Send to.

number

number

[0084] Where: It looks like this: JPEG2025034980000019.jpg26170. Finally, add noise and correct it.

[0085] P L computes the following:

number

number

[0086] JPEG2025034980000022.jpg14170

[0087] 1-4-1-4. Pattern 4 (Non-Abelian Group) Pattern 4 is executed in the order of processing, division, correction, replacement, and match determination. FIG. 6 shows an example of the matching process flow for pattern 4. In the flow 600 shown in the figure, first, the processing module 210A of the business A generates a noise "r AA ", "r AB " (step 601). Then, the module generates the generated noise "r AA ", "r AB " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 602).

[0088] Similarly, the processing module 210B of the entity B generates a noise “r BA", "r BB " (step 603). Then, the module generates the generated noise "r BA ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 604).

[0089] Next, the division module 211A of the operator A divides the noise-added information “s′ A Share " [s′ A ] A ", [s′ A ] B " (step 605). Similarly, the division module 211B of the operator B uses the secret sharing scheme to derive the noise-added information “s′ B Share " [s′ B ] A ", [s′ B ] B " (step 606).

[0090] Next, the correction module 213A of the operator A calculates the share “[s′ A ] A " to noise "r AA Remove the " and share "[s" A ] A The module also generates a share "[s' A ] B " to noise "r AB Remove the " and share "[s" A ] B The share "[s" A ] A " ", "[s" A ] B " is "s A +r AB +r BA " share.

[0091] Similarly, the correction module 213B of the operator B corrects the share “[s′ B ]A " to noise "r BA Remove the " and share "[s" B ] A The module also generates a share "[s' B ] B " to noise "r BB Remove the " and share "[s" B ] B The share "[s" B ] A " ", "[s" B ] B " is "s B +r AB +r BA " share.

[0092] Next, the switching module 212A of the operator A receives the share “[s″ A ] B " to the business server 101B (step 611). Similarly, the switching module 212B of the operator B may B ] A " to the business server 101A (step 612).

[0093] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ A ] A " ", "[s" B ] A " ", "[s" A ] B " ", "[s" B ] B " to the secret information "s A ", "s B In step 613, the module in question uses match determination protocol 1. This match determination protocol 1 will be described later.

[0094] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. The above is an explanation of pattern 4.

[0095] 1-4-1-5. Pattern 5 (Commutative Semigroup) Pattern 5 is executed in the order of processing, replacement, division, correction, and match determination. FIG. 7 shows an example of the matching process flow for pattern 5. In the flow 700 shown in the figure, first, the processing module 210A of the business A generates a noise "r AA ", "r AB " (step 701). Then, the module generates the generated noise "r AA ", "r AB " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 702).

[0096] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB " (step 703). Then, the module generates the generated noise "r BA ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 704).

[0097] Next, the switching module 212A of the operator A converts the noise-added information "s' A " to the business server 101B (step 705). Similarly, the switching module 212B of the operator B receives the noise-added information "s' B " to the business server 101A (step 706).

[0098] Next, the division module 211A of the operator A divides the noise-added information “s′ B Share " [s′ B ] A ", [s′ B ] B " (step 707). Similarly, the division module 211B of the operator B uses the secret sharing scheme to derive the noise-added information “s′ A Share " [s′ A ] A ", [s′ A ] B " (step 708).

[0099] Next, the correction module 213A of the operator A calculates the share “[s′ B ] A " with noise "r AA Add " and share " [s" B ] A The module also generates a share "[s' B ] B " with noise "r AB Add " and share " [s" B ] B The share "[s" B ] A " ", "[s" B ] B " is "s B +r AA +r AB +r BA +r BB " share.

[0100] Similarly, the correction module 213B of the operator B corrects the share “[s′ A ] A " with noise "r BA Add " and share " [s" A ] A The module also generates a share "[s' A ] B " with noise "r BB Add " and share " [s" A ] B The share "[s" A ] A " ", "[s" A ] B " is "s A +r AA +rAB +r BA +r BB " share.

[0101] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ B ] A " ", "[s" B ] B " ", "[s" A ] A " ", "[s" A ] B " to the secret information "s A ", "s B In step 713, the module in question uses match determination protocol 1. This match determination protocol 1 will be described later.

[0102] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 5.

[0103] 1-4-1-6. Pattern 6 (Commutative group) Pattern 6 is executed in the order of division, processing, exchange, and match check. FIG. 8 shows an example of the matching process flow for pattern 6. In the flow 800 shown in the figure, first, the division module 211A of the operator A divides the secret information “s A " Share " [s A ] A ", [s A ] B " (step 801). Similarly, the division module 211B of the entity B divides the secret information “s B " Share " [s B ] A ", [s B ] B " (step 802).

[0104] Next, the processing module 210A of the business A generates a noise “rA " (step 803). Then, the module generates the generated noise "r A " Share " [s A ] A ” and the noise addition share “[s′ A ] A " (step 804). The module also generates the generated noise "r A " Share " [s A ] B ” and the noise removal share “[s′ A ] B " is generated (step 805).

[0105] Similarly, the processing module 210B of the entity B generates a noise “r B " (step 806). Then, the module generates the generated noise "r B " Share " [s B ] A ” and the noise addition share “[s′ B ] A " (step 807). The module also generates the generated noise "r B " Share " [s B ] B ” and the noise removal share “[s′ B ] B " is generated (step 808).

[0106] Next, the switching module 212A of the operator A receives the share “[s′ A ] B " to the business server 101B (step 809). Similarly, the switching module 212B of the operator B receives the share “[s′ B ] A " to the business server 101A (step 810).

[0107] The share “[s′]” generated in step 804 above A ] A " and the share "[s' generated in step 805 above A ]B " is "s A " share. On the other hand, the share “[s′ B ] A " and the share "[s' B ] B " is "s B " share.

[0108] Next, the correspondence determination module 215 of the operator A or B determines the share “[s′ A ] A ", [s′ B ] A ", [s′ A ] B ", [s′ B ] B " to the secret information "s A ", "s B In step 811, the module uses match determination protocol 1. This match determination protocol 1 will be described later.

[0109] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 6.

[0110] 1-4-1-7. Pattern 7 (Commutative group) Pattern 7 is executed in the order of division, processing, replacement, correction, and match determination. FIG. 9 shows an example of the matching process flow for pattern 7. In the flow 900 shown in the figure, first, the division module 211A of the entity A divides the secret information “s A " Share " [s A ] A ", [s A ] B " (step 901). Similarly, the division module 211B of the entity B divides the secret information “s B " Share " [s B ]A ", [s B ] B " (step 902).

[0111] Next, the processing module 210A of the business A generates a noise “r AA ", "r AB " (step 903). Then, the module generates the generated noise "r AA " Share " [s A ] A ” and the noise addition share “[s′ A ] A " (step 904). The module also generates the generated noise "r AB " Share " [s A ] B ” and the noise addition share “[s′ A ] B " is generated (step 905).

[0112] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB " (step 906). Then, the module generates the generated noise "r BA " Share " [s B ] A ” and the noise addition share “[s′ B ] A " (step 907). The module also generates the generated noise "r BB " Share " [s B ] B ” and the noise addition share “[s′ B ] B " is generated (step 908).

[0113] Next, the switching module 212A of the operator A receives the share “[s′ A ] B " to the business server 101B (step 909). Similarly, the switching module 212B of the operator B receives the share “[s′ B ]A " to the business server 101A (step 910).

[0114] Next, the correction module 213A of the operator A uses a random number generator to generate a noise "r' AA " (step 911). Then, the module generates the share "[s' A ] A " with noise "r' AA Add " and share " [s" A ] A The module also generates a share "[s' B ] A " with noise "r AA ", "r AB ", "r' AA Add " and share " [s" B ] A " is generated (step 913).

[0115] Similarly, the correction module 213B of the operator B uses a random number generator to generate a noise “r′ BB The module then generates a share "[s′ A ] B " with noise "r BA ", "r BB ", "r' BB Add " and share " [s" A ] B The module also generates a share "[s' B ] B " with noise "r' BB Add " and share " [s" B ] B " is generated (step 916).

[0116] The share “[s″ generated in step 912 A ] A " and the share "[s" generated in step 915 A ] B " is "s A +r" share. The share “[s″ generated in step 913 B ] A " and the share "[s" generated in step 916 B ] B " is "s B +r" share. Here, r=r AA +r AB +r BA +r BB +r′ AA +r′ BB It is.

[0117] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ A ] A " ", "[s" B ] A " ", "[s" A ] B " ", "[s" B ] B " to the secret information "s A ", "s B In step 917, the module uses match determination protocol 1. This match determination protocol 1 will be described later.

[0118] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 7.

[0119] 1-4-1-8. Pattern 8 (Commutative group) Pattern 8 executes division, exchange, and match check in that order. FIG. 10 shows an example of the matching process flow for pattern 8. In the flow 1000 shown in the figure, first, the division module 211A of the entity A divides the secret information “s A " Share " [s A ] A ", [s A ] B " (step 1001). Similarly, the division module 211B of the entity B divides the secret information “s B " Share " [s B ] A ", [s B ] B " (step 1002).

[0120] Next, the switching module 212A of the operator A selects the share “[s A ] B " to the business server 101B (step 1003). Similarly, the switching module 212B of the operator B may B ] A " to the business server 101A (step 1004).

[0121] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s A ] A ", [s B ] A ", [s A ] B ", [s B ] B " to the secret information "s A ", "s B In step 1005, the module uses match determination protocol 1. This match determination protocol 1 will be described later.

[0122] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 8.

[0123] 1-4-2. With noise exchange Next, we will explain 19 patterns that include noise exchange. 1-4-2-1. Pattern 9 (Commutative group) Pattern 9 is executed in the order of noise exchange, processing, exchange, correction, and match determination. FIG. 11 shows an example of the matching process flow for pattern 9. In the flow 1100 shown in the figure, the N switching module 214A of the operator A generates a noise "r AA ", "r AB " (step 1101). Then, the module generates the generated noise "r AB " to the business server 101B (step 1102).

[0124] Similarly, the N switching module 214B of the operator B generates a noise “r BA ", "r BB " (step 1103). Then, the module generates the generated noise "r BA " to the business server 101A (step 1104).

[0125] Next, the processing module 210A of the business A detects the noise "r AA ", "r BA " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 1105). Similarly, the processing module 210B of the business B detects the noise "r AB ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 1106).

[0126] Next, the switching module 212A of the operator A converts the noise-added information "s' A " to the business server 101B (step 1107). Similarly, the switching module 212B of the operator B receives the noise-added information "s' B " to the business server 101A (step 1108).

[0127] Next, the correction module 213A of the operator A calculates the noise-added information “s′ B " with noise "r AA " and noise "r AB By removing "s", the correction information "s" B" is generated (step 1109). Similarly, the correction module 213B of the operator B adds noise-added information “s′ A " with noise "r BB " and noise "r BA By removing "s", the correction information "s" A " is generated (step 1110).

[0128] Next, the correspondence determination module 215 of the operator A or B receives the correction information "s" B ","s" A " to the secret information "s A ", "s B In step 1111, the module uses match determination protocol 2. This match determination protocol 2 will be described later.

[0129] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 9.

[0130] 1-4-2-2. Pattern 10 (Commutative group) Pattern 10 is executed in the order of processing, replacement, noise replacement, correction, and match determination. FIG. 12 shows an example of the matching process flow for pattern 10. In the flow 1200 shown in the figure, first, the processing module 210A of the business A generates a noise "r AA ", "r AB " (step 1201). Then, the module generates the generated noise "r AA ", "r AB " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 1202).

[0131] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB" (step 1203). Then, the module generates the generated noise "r BA ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 1204).

[0132] Next, the switching module 212A of the operator A converts the noise-added information "s' A " to the business server 101B (step 1205). Similarly, the switching module 212B of the operator B receives the noise-added information "s' B " to the business server 101A (step 1206).

[0133] Next, the N switching module 214A of the operator A detects the noise "r AB " to the business server 101B (step 1207). Similarly, the N switching module 214B of the operator B receives the noise "r BA " to the business server 101A (step 1208).

[0134] Next, the correction module 213A of the operator A calculates the noise-added information “s′ B " with noise "r AA " and noise "r BA By removing "s", the correction information "s" B " is generated (step 1209). Similarly, the correction module 213B of the operator B adds noise-added information “s′ A " with noise "r BB " and noise "r AB By removing "s", the correction information "s" A " is generated (step 1210).

[0135] Next, the correspondence determination module 215 of the operator A or B receives the correction information "s" B ","s" A " to the secret information "s A ", "s BIn step 1211, the module in question uses match determination protocol 2. This match determination protocol 2 will be described later.

[0136] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 10.

[0137] 1-4-2-3. Pattern 11 (Commutative Semigroup) Pattern 11 is executed in the order of processing, replacement, correction, noise replacement, and match determination. FIG. 13 shows an example of the matching process flow for pattern 11. In the flow 1300 shown in the figure, first, the processing module 210A of the business A generates a noise "r AA ", "r AB " (step 1301). Then, the module generates the generated noise "r AA ", "r AB " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 1302).

[0138] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB " (step 1303). Then, the module generates the generated noise "r BA ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 1304).

[0139] Next, the switching module 212A of the operator A converts the noise-added information "s' A " to the business server 101B (step 1305). Similarly, the switching module 212B of the operator B receives the noise-added information "s' B" to the business server 101A (step 1306).

[0140] Next, the correction module 213A of the operator A calculates the noise-added information “s′ B " with noise "r AB " and correction information "[s" B ] A " is generated (step 1307). Similarly, the correction module 213B of the operator B adds noise-added information “s′ A " with noise "r BA " and correction information "[s" A ] B " is generated (step 1308).

[0141] Next, the N switching module 214A of the operator A detects the noise "r AA " is transmitted to the business server 101B (step 1309). AA :=[s″ B ] B It is. Similarly, the N switching module 214B of the operator B receives the noise "r BB " is sent to the business server 101A (step 1310). BB :=[s″ A ] A It is.

[0142] Next, the response determination module 215 of the operator A or B receives the correction information “[s″ B ] A " ", "[s" A ] B " and the noise "[s" A ] A " ", "[s" B ] B " to the secret information "s A ", "s B In step 1311, the module uses match determination protocol 1. This match determination protocol 1 will be described later.

[0143] Here, s″ A:=[s″ A ] A +[s″ A ] B =[s A ] A +[s A ] B +r=s A +r. Also, s″ B :=[s″ B ] A +[s″ B ] B =[s B ] A +[s B ] B +r=s B +r. Here, r=r AA +r AB +r BA +r BB It is.

[0144] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 11.

[0145] 1-4-2-4. Pattern 12 (Commutative Semigroup) Pattern 12 is executed in the order of noise exchange, division, processing, exchange, correction, and match determination. FIG. 14 shows an example of the matching process flow for pattern 12. In the flow 1400 shown in the figure, the N switching module 214A of the operator A generates a noise "r AA ", "r AB " (step 1401). Then, the module generates the generated noise "r AB " to the business server 101B (step 1402).

[0146] Similarly, the N switching module 214B of the operator B generates a noise “r BA ", "r BB " (step 1403). Then, the module generates the generated noise "r BA" to the carrier server 101A (step 1404).

[0147] Next, the division module 211A of the operator A divides the secret information “s A " Share " [s A ] A ", [s A ] B " (step 1405). Similarly, the division module 211B of the entity B divides the secret information “s B " Share " [s B ] A ", [s B ] B " (step 1406).

[0148] Next, the processing module 210A of the business A detects the noise "r AA " Share " [s A ] A ” and the noise addition share “[s′ A ] A " (step 1407). The module also generates a noise "r BA " Share " [s A ] B ” and the noise addition share “[s′ A ] B " is generated (step 1408).

[0149] Similarly, the processing module 210B of the business B detects the noise "r AB " Share " [s B ] A ” and the noise addition share “[s′ B ] A " (step 1409). The module also generates a noise "r BB " Share " [s B ] B ” and the noise addition share “[s′ B ] B " is generated (step 1410).

[0150] Next, the switching module 212A of the operator A calculates the noise-added share “[s′ A ] B " to the business server 101B (step 1411). Similarly, the switching module 212B of the operator B determines the noise-added share “[s′ B ] A " to the business server 101A (step 1412).

[0151] Next, the correction module 213A of the operator A calculates the noise-added share “[s′ A ] A " with noise "r AB " and noise correction share "[s" A ] A The module also generates the noise-added share [s′ B ] A " with noise "r AA " and noise correction share "[s" B ] A " is generated (step 1414).

[0152] Similarly, the correction module 213B of the operator B adjusts the noise addition share “[s′ A ] B " with noise "r BB " and noise correction share "[s" A ] B The module also generates the noise-added share '[s' B ] B " with noise "r BA " and noise correction share "[s" B ] B " is generated (step 1416).

[0153] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ A ] A " ", "[s" B ] A " ", "[s" A ] B " ", "[s"B ] B " to the secret information "s A ", "s B In step 1417, the module uses match determination protocol 1. This match determination protocol 1 will be described later.

[0154] Here, s″ A :=[s″ A ] A +[s″ A ] B =[s A ] A +[s A ] B +r=s A +r. Also, s″ B :=[s″ B ] A +[s″ B ] B =[s B ] A +[s B ] B +r=s B +r. Here, r=r AA +r AB +r BA +r BB It is.

[0155] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 12.

[0156] 1-4-2-5. Pattern 13 (Commutative group) Pattern 13 is executed in the order of noise exchange, processing, exchange, division, correction, and match determination. FIG. 15 shows an example of the matching process flow for pattern 13. In the flow 1500 shown in the figure, the N switching module 214A of the operator A generates a noise "r AA ", "r AB" (step 1501). Then, the module generates the generated noise "r AB " to the business server 101B (step 1502).

[0157] Similarly, the N switching module 214B of the operator B generates a noise “r BA ", "r BB " (step 1503). Then, the module generates the generated noise "r BA " to the carrier server 101A (step 1504).

[0158] Next, the processing module 210A of the business A detects the noise "r AA ", "r BA " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 1505). Similarly, the processing module 210B of the business B detects the noise "r AB ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 1506).

[0159] Next, the switching module 212A of the operator A converts the noise-added information "s' A " to the business server 101B (step 1507). Similarly, the switching module 212B of the operator B receives the noise-added information "s' B " to the carrier server 101A (step 1508).

[0160] Next, the division module 211A of the operator A divides the noise-added information “s′ B Share " [s′ B ] A ", [s′ B ] B " (step 1509). Similarly, the division module 211B of the operator B uses the secret sharing scheme to derive the noise-added information “s′A Share " [s′ A ] A ", [s′ A ] B " (step 1510).

[0161] Next, the correction module 213A of the operator A calculates the share “[s′ B ] A " with noise "r AA Add " and share " [s" B ] A The module also generates a share "[s' B ] B " to noise "r AB Remove the " and share "[s" B ] B " is generated (step 1512).

[0162] Similarly, the correction module 213B of the operator B corrects the share “[s′ A ] A " to noise "r BA Remove the " and share "[s" A ] A The module also generates a share "[s' A ] B " with noise "r BB Add " and share " [s" A ] B " is generated (step 1514).

[0163] The share “[s″ generated in step 1511 above B ] A " and the share "[s" generated in step 1512 above B ] B " is "s B +r AA +r BB " share. On the other hand, the share “[s″ generated in step 1513 above A ] A " and the share "[s" generated in step 1514 above. A ]B " is "s A +r AA +r BB " share.

[0164] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ B ] A " ", "[s" B ] B " ", "[s" A ] A " ", "[s" A ] B " to the secret information "s A ", "s B In step 1515, the module uses match determination protocol 3. This match determination protocol 3 will be described later.

[0165] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 13.

[0166] 1-4-2-6. Pattern 14 (Commutative group) Pattern 14 is executed in the order of noise exchange, processing, exchange, correction, division, and match determination. FIG. 16 shows an example of the matching process flow for pattern 14. In the flow 1600 shown in the figure, the N switching module 214A of the operator A generates a noise "r AA ", "r AB " (step 1601). Then, the module generates the generated noise "r AB " to the business server 101B (step 1602).

[0167] Similarly, the N switching module 214B of the operator B generates a noise “r BA ", "r BB " (step 1603). Then, the module generates the generated noise "r BA" to the business server 101A (step 1604).

[0168] Next, the processing module 210A of the business A detects the noise "r AA ", "r BA " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 1605). Similarly, the processing module 210B of the business B detects the noise "r AB ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 1606).

[0169] Next, the switching module 212A of the operator A converts the noise-added information "s' A " to the business server 101B (step 1607). Similarly, the switching module 212B of the operator B receives the noise-added information "s' B " to the business server 101A (step 1608).

[0170] Next, the correction module 213A of the operator A calculates the noise-added information “s′ B " with noise "r AA " and noise "r AB By removing "s", the correction information "s" B " is generated (step 1609). Similarly, the correction module 213B of the operator B adds noise-added information “s′ A " with noise "r BB " and noise "r BA By removing "s", the correction information "s" A " is generated (step 1610).

[0171] Next, the division module 211A of the operator A divides the noise-added information “s″ B Share "[s" B ] A " ", "[s" B ]B " (step 1611). Similarly, the division module 211B of the operator B divides the noise-added information “s″ A Share "[s" A ] A " ", "[s" A ] B " (step 1612).

[0172] The share “[s″ generated in step 1611 above B ] A " and "[s" B ] B " is "s B +r AA +r BB " share. On the other hand, the share “[s″ generated in step 1612 above A ] A " and "[s" A ] B " is "s A +r AA +r BB " share.

[0173] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ B ] A " ", "[s" B ] B " ", "[s" A ] A " ", "[s" A ] B " to the secret information "s A ", "s B In step 1613, the module in question uses match determination protocol 3. This match determination protocol 3 will be described later.

[0174] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 14.

[0175] 1-4-2-7. Pattern 15 (Commutative group) Pattern 15 is executed in the order of noise exchange, processing, division, exchange, correction, and match determination. FIG. 17 shows an example of the matching process flow for pattern 15. In the flow 1700 shown in the figure, the N switching module 214A of the operator A generates a noise "r AA ", "r AB " (step 1701). Then, the module generates the generated noise "r AB " to the business server 101B (step 1702).

[0176] Similarly, the N switching module 214B of the operator B generates a noise “r BA ", "r BB " (step 1703). Then, the module generates the generated noise "r BA " to the carrier's server 101A (step 1704).

[0177] Next, the processing module 210A of the business A detects the noise "r AA ", "r BA " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 1705). Similarly, the processing module 210B of the business B detects the noise "r AB ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 1706).

[0178] Next, the division module 211A of the operator A divides the noise-added information “s′ A Share " [s′ A ] A ", [s′ A ] B " (step 1707). Similarly, the division module 211B of the operator B uses the secret sharing scheme to derive the noise-added information “s′B Share " [s′ B ] A ", [s′ B ] B " (step 1708).

[0179] Next, the switching module 212A of the operator A receives the share “[s′ A ] B " to the business server 101B (step 1709). Similarly, the switching module 212B of the operator B receives the share “[s′ B ] A " to the business server 101A (step 1710).

[0180] Next, the correction module 213A of the operator A calculates the share “[s′ A ] A " to noise "r AA By removing "s", the noise reduction share "[s" A ] A The module also generates a share "[s' B ] A " to noise "r AB By removing "s", the noise reduction share "[s" B ] A " is generated (step 1712).

[0181] Similarly, the correction module 213B of the operator B corrects the share “[s′ A ] B " to noise "r BA By removing "s", the noise reduction share "[s" A ] B The module also generates a share "[s' B ] B " to noise "r BB By removing "s", the noise reduction share "[s" B ] B " is generated (step 1714).

[0182] Here, s″ A:=[s″ A ] A +[s″ A ] B =s A It is. Also, s″ B :=[s″ B ] A +[s″ B ] B =s B It is.

[0183] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ A ] A " ", "[s" B ] A " ", "[s" A ] B " ", "[s" B ] B " to the secret information "s A ", "s B In step 1715, the module in question uses match determination protocol 3. This match determination protocol 3 will be described later.

[0184] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 15.

[0185] 1-4-2-8. Pattern 16 (Commutative group) Pattern 16 is executed in the order of division, processing, replacement, noise replacement, correction, and match determination. FIG. 18 shows an example of the matching process flow for pattern 16. In the flow 1800 shown in the figure, first, the division module 211A of the entity A divides the secret information “s A " Share " [s A ] A ", [s A ] B " (step 1801). Similarly, the division module 211B of the entity B divides the secret information “sB " Share " [s B ] A ", [s B ] B " (step 1802).

[0186] Next, the processing module 210A of the business A generates a noise “r AA ", "r AB " (step 1803). Then, the module generates the generated noise "r AA " Share " [s A ] A ” and the noise addition share “[s′ A ] A " (step 1804). The module also generates the generated noise "r AB " Share " [s A ] B ” and the noise addition share “[s′ A ] B " is generated (step 1805).

[0187] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB " (step 1806). Then, the module generates the generated noise "r BA " Share " [s B ] A ” and the noise addition share “[s′ B ] A " (step 1807). The module also generates the generated noise "r BB " Share " [s B ] B ” and the noise addition share “[s′ B ] B " is generated (step 1808).

[0188] Next, the switching module 212A of the operator A calculates the noise-added share “[s′ A ] B " to the carrier's server 101B (step 1809). Similarly, the switching module 212B of the operator B determines the noise-added share “[s′ B ] A " to the business server 101A (step 1810).

[0189] Next, the N switching module 214A of the operator A detects the noise "r AA " to the carrier's server 101B (step 1811). Similarly, the N switching module 214B of the operator B receives the noise "r BB " to the carrier server 101A (step 1812).

[0190] Next, the correction module 213A of the operator A calculates the share “[s′ A ] A " to noise "r AB By removing "s", the noise reduction share "[s" A ] A The module also generates a share "[s′ B ] A " to noise "r BB By removing "s", the noise reduction share "[s" B ] A " is generated (step 1814).

[0191] Similarly, the correction module 213B of the operator B corrects the share “[s′ A ] B " to noise "r AA By removing "s", the noise reduction share "[s" A ] B The module also generates a share "[s′ B ] B " to noise "r BA By removing "s", the noise reduction share "[s" B ] B " is generated (step 1816).

[0192] Here, s″ A :=[s″ A ]A +[s″ A ] B =s A It is. Also, s″ B :=[s″ B ] A +[s″ B ] B =s B It is.

[0193] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ A ] A " ", "[s" B ] A " ", "[s" A ] B " ", "[s" B ] B " to the secret information "s A ", "s B In step 1817, the module in question uses match determination protocol 1. This match determination protocol 1 will be described later.

[0194] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 16.

[0195] 1-4-2-9. Pattern 17 (Commutative group) Pattern 17 is executed in the order of processing, replacement, division, noise replacement, correction, and match determination. FIG. 19 shows an example of the flow of the pattern 17 matching process. In the flow 1900 shown in the figure, the processing module 210A of the business A generates a noise “r AA ", "r AB " (step 1901). Then, the module generates the generated noise "r AA ", "r AB " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 1902).

[0196] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB " (step 1903). Then, the module generates the generated noise "r BA ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 1904).

[0197] Next, the switching module 212A of the operator A converts the noise-added information "s' A " to the business server 101B (step 1905). Similarly, the switching module 212B of the operator B receives the noise-added information "s' B " to the business server 101A (step 1906).

[0198] Next, the division module 211A of the operator A divides the noise-added information “s′ B Share " [s′ B ] A ", [s′ B ] B " (step 1907). Similarly, the division module 211B of the operator B uses the secret sharing scheme to derive the noise-added information “s′ A Share " [s′ A ] A ", [s′ A ] B " (step 1908).

[0199] Next, the N switching module 214A of the operator A detects the noise "r AB " to the business server 101B (step 1909). Similarly, the N switching module 214B of the operator B receives the noise "r BA " to the business server 101A (step 1910).

[0200] Next, the correction module 213A of the operator A calculates the share “[s′ B ] B " with noise "r AA Add " and share " [s" B ] B The module also generates a share "[s′ B ] A " to noise "r BA Remove the " and share "[s" B ] A " is generated (step 1912).

[0201] Similarly, the correction module 213B of the operator B corrects the share “[s′ A ] B " to noise "r AB Remove the " and share "[s" A ] B The module also generates a share "[s′ A ] A " with noise "r BB Add " and share " [s" A ] A " is generated (step 1914).

[0202] The share “[s″ generated in step 1911 above B ] B " and the share "[s" generated in step 1912 above B ] A " is "s B +r AA +r BB " share. On the other hand, the share “[s″ generated in step 1913 above A ] B " and the share "[s" generated in step 1914 above A ] A " is "s A +r AA +r BB " share.

[0203] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ B ] B " ", "[s" B ] A " ", "[s" A ] B " ", "[s" A ] A " to the secret information "s A ", "s B In step 1915, the module in question uses match determination protocol 3. This match determination protocol 3 will be described later.

[0204] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 17.

[0205] 1-4-2-10. Pattern 18 (Commutative group) Pattern 18 is executed in the order of processing, replacement, noise replacement, correction, division, and match determination. FIG. 20 shows an example of the pattern 18 matching process flow. In the flow 2000 shown in the figure, the processing module 210A of the business A generates a noise "r AA ", "r AB " (step 2001). Then, the module generates the generated noise "r AA ", "r AB " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 2002).

[0206] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB " (step 2003). Then, the module generates the generated noise "r BA ", "r BB " to confidential information "s B ” and add noise addition information “s′ B" is generated (step 2004).

[0207] Next, the switching module 212A of the operator A converts the noise-added information "s' A " to the business server 101B (step 2005). Similarly, the switching module 212B of the operator B receives the noise-added information "s' B " to the business server 101A (step 2006).

[0208] Next, the N switching module 214A of the operator A detects the noise "r AB " to the business server 101B (step 2007). Similarly, the N switching module 214B of the operator B receives the noise "r BA " to the business server 101A (step 2008).

[0209] Next, the correction module 213A of the operator A calculates the noise-added information “s′ B " with noise "r AA " and noise "r BA By removing "s", the correction information "s" B " is generated (step 2009). Similarly, the correction module 213B of the operator B adds noise-added information “s′ A " with noise "r BB " and noise "r AB By removing "s", the correction information "s" A " is generated (step 2010).

[0210] Next, the division module 211A of the operator A uses the secret sharing scheme to compile the correction information "s" B Share "[s" B ] A " ", "[s" B ] B " (Step 2011). Similarly, the division module 211B of the operator B divides the noise-added information “s″ A Share "[s" A ]A " ", "[s" A ] B " (Step 2012).

[0211] The share “[s″ generated in step 2011 above B ] A " and "s" B ] B " is "s B +r AA +r BB " share. On the other hand, the share “[s″ generated in step 2012 above A ] A " and "[s" A ] B " is "s A +r AA +r BB " share.

[0212] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ B ] A " ", "[s" B ] B " ", "[s" A ] A " ", "[s" A ] B " to the secret information "s A ", "s B In step 2013, the module uses match determination protocol 3. This match determination protocol 3 will be described later.

[0213] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 18.

[0214] 1-4-2-11. Pattern 19 (Commutative group) Pattern 19 is executed in the order of processing, division, replacement, noise replacement, correction, and match determination. FIG. 21 shows an example of the matching process flow for pattern 19. In the flow 2100 shown in the figure, first, the processing module 210A of the business A generates a noise "r AA ", "r AB " (step 2101). Then, the module generates the generated noise "r AA ", "r AB " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 2102).

[0215] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB " (step 2103). Then, the module generates the generated noise "r BA ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 2104).

[0216] Next, the division module 211A of the operator A divides the noise-added information “s′ A Share " [s′ A ] A ", [s′ A ] B " (step 2105). Similarly, the division module 211B of the operator B uses the secret sharing scheme to derive the noise-added information “s′ B Share " [s′ B ] A ", [s′ B ] B " (step 2106).

[0217] Next, the switching module 212A of the operator A receives the share “[s′ A ] B " to the business server 101B (step 2107). Similarly, the switching module 212B of the operator B receives the share “[s′ B ] A" to the carrier server 101A (step 2108).

[0218] Next, the N switching module 214A of the operator A detects the noise "r AA " to the business server 101B (step 2109). Similarly, the N switching module 214B of the operator B receives the noise "r BB " to the business server 101A (step 2110).

[0219] Next, the correction module 213A of the operator A calculates the share “[s′ A ] A " to noise "r AB By removing "s", the noise reduction share "[s" A ] A The module also generates a share "[s' B ] A " to noise "r BB By removing "s", the noise reduction share "[s" B ] A " is generated (step 2112).

[0220] Similarly, the correction module 213B of the operator B corrects the share “[s′ A ] B " to noise "r AA By removing "s", the noise reduction share "[s" A ] B The module also generates a share "[s' B ] B " to noise "r BA By removing "s", the noise reduction share "[s" B ] B " is generated (step 2114).

[0221] Here, s″ A :=[s″ A ] A +[s″ A ] B =s A It is. Also, s″ B :=[s″ B ] A +[s″ B ] B =s B It is.

[0222] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ A ] A " ", "[s" B ] A " ", "[s" A ] B " ", "[s" B ] B " to the secret information "s A ", "s B In step 2115, the module in question uses match determination protocol 1. This match determination protocol 1 will be described later.

[0223] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 19.

[0224] 1-4-2-12. Pattern 20 (Commutative Semigroup) Pattern 20 is executed in the order of processing, noise replacement, correction, and match determination. FIG. 22 shows an example of a matching process flow for pattern 20. In the flow 2200 shown in the figure, first, the processing module 210A of the business A generates a noise "r AA ", "r AB " is generated (step 2201). AA =[s'' B ] A ". The module then generates the noise "r AA ", "r AB " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 2202).

[0225] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB " is generated (step 2203). BB =[s'' A ] B ". The module then generates the noise "r BA ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 2204).

[0226] Next, the N switching module 214A of the operator A detects the noise "r AB " to the business server 101B (step 2205). Similarly, the N switching module 214B of the operator B receives the noise "r BA " to the business server 101A (step 2206).

[0227] Next, the correction module 213A of the operator A calculates the noise-added information “s′ A " with noise "r BA " is added to the correction information "s" A " is generated (step 2207). A =[s'' A ] A " Similarly, the correction module 213B of the operator B adds noise-added information “s′ B " with noise "r AB " is added to the correction information "s" B " is generated (step 2208). B =[s'' B ] B "

[0228] Next, the correspondence determination module 215 of the operator A or B detects the noise “[s′′ B ] A ", [s''' A ] B ", correction information "[s''' A ]A ", [s''' B ] B " to the secret information "s A ", "s B In step 2209, the module in question uses match determination protocol 1. This match determination protocol 1 will be described later.

[0229] Here, s′′′ A :=[s′′′ A ] A +[s'' A ] B =s″ A +r BB =s A +r AA +r AB +r BA +r BB It is. Also, s′′′ B :=[s′′′ B ] A +[s'' B ] B =s″ B +r AA =s B +r AA +r AB +r BA +r BB It is.

[0230] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 20.

[0231] 1-4-2-13. Pattern 21 (Commutative group) Pattern 21 is executed in the order of processing, noise replacement, division, correction, and match determination. FIG. 23 shows an example of the flow of the pattern 21 matching process. In the flow 2300 shown in the figure, the processing module 210A of the business A generates a noise “r AA ", "r AB" (step 2301). Then, the module generates the generated noise "r AA ", "r AB " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 2302).

[0232] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB " (step 2303). Then, the module generates the generated noise "r BA ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 2304).

[0233] Next, the N switching module 214A of the operator A detects the noise "r AB " to the business server 101B (step 2305). Similarly, the N switching module 214B of the operator B receives the noise "r BA " to the business server 101A (step 2306).

[0234] Next, the division module 211A of the operator A divides the noise-added information “s′ A Share " [s′ A ] A ", [s′ A ] B " (step 2307). Similarly, the division module 211B of the operator B uses the secret sharing scheme to derive the noise-added information “s′ B Share " [s′ B ] A ", [s′ B ] B " (step 2308).

[0235] Next, the correction module 213A of the operator A calculates the share “[s′ A ] A " to noise "rAA Remove the " and share "[s" A ] A The module also generates a share "[s' A ] B " with noise "r BA Add " and share " [s" A ] B " is generated (step 2310).

[0236] Similarly, the correction module 213B of the operator B corrects the share “[s′ B ] A " with noise "r AB Add " and share " [s" B ] A The module also generates a share "[s' B ] B " to noise "r BB Remove the " and share "[s" B ] B " is generated (step 2312).

[0237] The share “[s″ generated in step 2309 above A ] A " and the share "[s" generated in step 2310 above. A ] B " is "s A +r AB +r BA " share. On the other hand, the share “[s″ generated in step 2311 above B ] A " and the share "[s" generated in step 2312 above. B ] B " is "s B +r AB +r BA " share.

[0238] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ A ] A " ", "[s" A ] B" ", "[s" B ] A " ", "[s" B ] B " to the secret information "s A ", "s B In step 2313, the module in question uses match determination protocol 3. This match determination protocol 3 will be described later.

[0239] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 21.

[0240] 1-4-2-14. Pattern 22 (Commutative group) Pattern 22 is executed in the order of processing, division, correction, noise replacement, and match determination. FIG. 24 shows an example of the flow of the pattern 22 matching process. In the flow 2400 shown in the figure, the processing module 210A of the business A generates a noise “r AA ", "r AB " (step 2401). Then, the module generates the generated noise "r AA ", "r AB " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 2402).

[0241] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB " (step 2403). Then, the module generates the generated noise "r BA ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 2404).

[0242] Next, the division module 211A of the operator A divides the noise-added information “s′A Share "s' AA ", "s' AB " (step 2405). Here, s' AB =s″ AB Let us assume that. Similarly, the division module 211B of the operator B uses the secret sharing scheme to derive the noise-added information “s′ B Share "s' BA ", "s' BB " (step 2406). Here, s' BA =s″ BA Let us assume that.

[0243] Next, the correction module 213A of the operator A calculates the share “s′ AA " to noise "r AA Remove the " and share "s" AA " is generated (step 2407). Similarly, the correction module 213B of the operator B corrects the share “s′ BB " to noise "r BB Remove the " and share "s" BB " is generated (step 2408).

[0244] Next, the N switching module 214A of the operator A detects the noise "r AB " is transmitted to the business server 101B (step 2409). A ] B =-r AB Let us assume that. Similarly, the N switching module 214B of the operator B receives the noise "r BA " is transmitted to the business server 101A (step 2410). B ] A =-r BA Let us assume that.

[0245] Next, the correction module 213A of the operator A calculates the share “s” AA Share on 's' AB " and share " [s" A ] A " is generated (step 2411). Similarly, the correction module 213B of the operator B corrects the share “s” BA Share on 's' BB " and share " [s" B ] B " is generated (step 2412).

[0246] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ B ] A " ", "[s" A ] A " ", "[s" B ] B " ", "[s" A ] B " to the secret information "s A ", "s B In step 2413, the module in question uses match determination protocol 1. This match determination protocol 1 will be described later.

[0247] Here, s″ A :=[s″ A ] A +[s″ A ] B =s″ AA +s″ AB -r AB =s′ A -r AA -r AB =s A It is. Also, s″ B :=[s″ B ] A +[s″ B ] B =s″ BA +s″ BB -r BA =s′ B -r BB -r BA =s B It is.

[0248] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 22.

[0249] 1-4-2-15. Pattern 23 (Commutative Semigroup) Pattern 23 is executed in the order of processing, noise exchange, exchange, correction, and match determination. FIG. 25 shows an example of the matching process flow for pattern 23. In the flow 2500 shown in the figure, first, the processing module 210A of the business A generates a noise "r AA ", "r AB " (step 2501). Then, the module generates the generated noise "r AA ", "r AB " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 2502).

[0250] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB " (step 2503). Then, the module generates the generated noise "r BA ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 2504).

[0251] Next, the N switching module 214A of the operator A detects the noise "r AB " to the carrier's server 101B (step 2505). Similarly, the N switching module 214B of the operator B receives the noise "r BA " to the business server 101A (step 2506).

[0252] Next, the correction module 213A of the operator A calculates the noise-added information “s′ A " with noise "r BA " is added to the correction information "s" A " is generated (step 2507). Similarly, the correction module 213B of the operator B adds noise-added information “s′B " with noise "r AB " is added to the correction information "s" B " is generated (step 2508).

[0253] Next, the switching module 212A of the operator A receives the correction information "s" A " to the business server 101B (step 2509). Similarly, the switching module 212B of the operator B receives the correction information "s" B " to the business server 101A (step 2510).

[0254] Next, the correction module 213A of the operator A generates the correction information "s" B " with noise "r AA " is added to the correction information "s''' B " is generated (step 2511). Similarly, the correction module 213B of the operator B generates the correction information “s” A " with noise "r BB " is added to the correction information "s''' A " is generated (step 2512).

[0255] Next, the response determination module 215 of the operator A or B receives the correction information “s′′ B ", "s''' A " to the secret information "s A ", "s B In step 2513, the module in question uses match determination protocol 2. This match determination protocol 2 will be described later.

[0256] Here, s′′′ A :=s″ A +r BB =s A +r AA +r AB +r BA +r BB It is. Also, s′′′ B :=s″ B +r AA =sB +r AA +r AB +r BA +r BB It is.

[0257] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 23.

[0258] 1-4-2-16. Pattern 24 (Commutative group) Pattern 24 is executed in the order of noise exchange, processing, division, correction, exchange, and match determination. FIG. 26 shows an example of the pattern 24 matching process flow. In the flow 2600 shown in the figure, the N switching module 214A of the operator A generates a noise "r AA ", "r AB " (step 2601). Then, the module generates the generated noise "r AB " to the business server 101B (step 2602).

[0259] Similarly, the N switching module 214B of the operator B generates a noise “r BA ", "r BB " (step 2603). Then, the module generates the generated noise "r BA " to the business server 101A (step 2604).

[0260] Next, the processing module 210A of the business A detects the noise "r AA ", "r BA " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 2605). Similarly, the processing module 210B of the business B detects the noise "r AB ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 2606).

[0261] Next, the division module 211A of the operator A divides the noise-added information “s′ A Share " [s′ A ] A ", [s′ A ] B " (step 2607). Similarly, the division module 211B of the operator B uses the secret sharing scheme to derive the noise-added information “s′ B Share " [s′ B ] A ", [s′ B ] B " (step 2608).

[0262] Next, the correction module 213A of the operator A calculates the share “[s′ A ] A " to noise "r AA Remove the " and share "[s" A ] A The module also generates a share "[s' A ] B " to noise "r BA Remove the " and share "[s" A ] B " is generated (step 2610).

[0263] Similarly, the correction module 213B of the operator B corrects the share “[s′ B ] A " to noise "r AB Remove the " and share "[s" B ] A The module also generates a share "[s' B ] B " to noise "r BB Remove the " and share "[s" B ] B " is generated (step 2612).

[0264] Next, the switching module 212A of the operator A receives the share “[s″A ] B " to the business server 101B (step 2613). Similarly, the switching module 212B of the operator B may B ] A " to the carrier's server 101A (step 2614).

[0265] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ A ] A " ", "[s" B ] A " ", "[s" A ] B " ", "[s" B ] B " to the secret information "s A ", "s B In step 2615, the module in question uses match determination protocol 1. This match determination protocol 1 will be described later.

[0266] Here, s″ A :=[s″ A ] A +[s″ A ] B =s A It is. Also, s″ B :=[s″ B ] A +[s″ B ] B =s B It is.

[0267] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. The above is an explanation of pattern 24.

[0268] 1-4-2-17. Pattern 25 (Commutative Semigroup) Pattern 25 is executed in the order of processing, noise exchange, correction, exchange, correction, division, and match determination. FIG. 27 shows an example of the matching process flow for pattern 25. In the flow 2700 shown in the figure, first, the processing module 210A of the business A generates a noise "r AA ", "r AB " (step 2701). Then, the module generates the generated noise "r AA ", "r AB " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 2702).

[0269] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB " (step 2703). Then, the module generates the generated noise "r BA ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 2704).

[0270] Next, the N switching module 214A of the operator A detects the noise "r AB " to the business server 101B (step 2705). Similarly, the N switching module 214B of the operator B receives the noise "r BA " to the business server 101A (step 2706).

[0271] Next, the correction module 213A of the operator A calculates the noise-added information “s′ A " with noise "r BA " is added to the correction information "s" A " is generated (step 2707). Similarly, the correction module 213B of the operator B adds noise-added information “s′ B " with noise "r AB " is added to the correction information "s" B " is generated (step 2708).

[0272] Next, the switching module 212A of the operator A receives the correction information "s"A " to the business server 101B (step 2709). Similarly, the switching module 212B of the operator B receives the correction information "s" B " to the business server 101A (step 2710).

[0273] Next, the correction module 213A of the operator A generates the correction information "s" B " with noise "r AA " is added to the correction information "s''' B " is generated (step 2711). Similarly, the correction module 213B of the operator B generates the correction information “s” A " with noise "r BB " is added to the correction information "s''' A " is generated (step 2712).

[0274] Next, the division module 211A of the operator A uses the secret sharing scheme to derive the correction information “s′′ B Share " [s′′′ B ] A ", [s''' B ] B " (step 2713). Similarly, the division module 211B of the operator B uses the secret sharing scheme to derive the correction information “s′′ A Share " [s′′′ A ] A ", [s''' A ] B " (step 2714).

[0275] Next, the response determination module 215 of the operator A or B determines the share “[s′′ B ] A ", [s''' B ] B ", [s''' A ] A ", [s''' A ] B " to the secret information "s A ", "s BIn step 2715, the module in question uses match determination protocol 3. This match determination protocol 3 will be described later.

[0276] Here, s′′′ A :=s″ AA +s″ AB =s A +r AA +r AB +r BA +r BB It is. Also, s′′′ B :=s″ BA +s″ BB =s B +r AA +r AB +r BA +r BB It is.

[0277] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. The above is an explanation of pattern 25.

[0278] 1-4-2-18. Pattern 26 (Commutative Semigroup) Pattern 26 is executed in the order of processing, noise exchange, correction, division, exchange, correction, and match determination. FIG. 28 shows an example of the pattern 26 matching process flow. In the flow 2800 shown in the figure, first, the processing module 210A of the business A generates a noise "r AA ", "r AB " (step 2801). Then, the module generates the generated noise "r AA ", "r AB " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 2802).

[0279] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB" (step 2803). Then, the module generates the generated noise "r BA ", "r BB " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 2804).

[0280] Next, the N switching module 214A of the operator A detects the noise "r AB " to the business server 101B (step 2805). Similarly, the N switching module 214B of the operator B receives the noise "r BA " to the carrier's server 101A (step 2806).

[0281] Next, the correction module 213A of the operator A calculates the noise-added information “s′ A " with noise "r BA " is added to the correction information "s" A " is generated (step 2807). Similarly, the correction module 213B of the operator B adds noise-added information “s′ B " with noise "r AB " is added to the correction information "s" B " is generated (step 2808).

[0282] Next, the division module 211A of the operator A uses the secret sharing scheme to compile the correction information "s" A Share "[s" A ] A " ", "[s" A ] B " (step 2809). A ] A =[s'' A ] A Let us assume that. Similarly, the division module 211B of the operator B uses the secret sharing scheme to derive the correction information “s″ B Share "[s" B ] A " ", "[s" B ] B " (step 2810).B ] B =[s'' B ] B Let us assume that.

[0283] Next, the switching module 212A of the operator A receives the share “[s″ A ] B " to the business server 101B (step 2811). Similarly, the switching module 212B of the operator B may B ] A " to the carrier's server 101A (step 2812).

[0284] Next, the correction module 213A of the operator A calculates the share “[s″ B ] A " with noise "r AA " and share "s' B ] A " is generated (step 2813). Similarly, the correction module 213B of the operator B corrects the share “[s″ A ] B " with noise "r BB " and share "s' A ] B " is generated (step 2814).

[0285] Next, the response determination module 215 of the operator A or B determines the share “[s′′ A ] A ", [s''' B ] A ", [s''' A ] B ", [s''' B ] B " to the secret information "s A ", "s B In step 2815, the module in question uses match determination protocol 1. This match determination protocol 1 will be described later.

[0286] Here, s′′′ A :=[s′′′A ] A +[s'' B ] A =s A +r AA +r AB +r BA +r BB It is. Also, s′′′ B :=[s′′′ B ] A +[s'' B ] B =s B +r AA +r AB +r BA +r BB It is.

[0287] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 26.

[0288] 1-4-2-19. Pattern 27 (Commutative group) Pattern 27 is executed in the order of processing, division, correction, exchange, noise exchange, correction, and match determination. FIG. 29 shows an example of the matching process flow for pattern 27. In the flow 2900 shown in the figure, first, the processing module 210A of the business A generates a noise "r AA ", "r AB " (step 2901). Then, the module generates the generated noise "r AA ", "r AB " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 2902).

[0289] Similarly, the processing module 210B of the entity B generates a noise “r BA ", "r BB " (step 2903). Then, the module generates the generated noise "r BA ", "r BB " to confidential information "sB ” and add noise addition information “s′ B " is generated (step 2904).

[0290] Next, the division module 211A of the operator A divides the noise-added information “s′ A Share " [s′ A ] A ", [s′ A ] B " (step 2905). Here, [s' A ] A =[s″ A ] A =[s'' A ] A Let us assume that. Similarly, the division module 211B of the operator B uses the secret sharing scheme to derive the noise-added information “s′ B Share " [s′ B ] A ", [s′ B ] B " (step 2906). Here, [s' B ] B =[s″ B ] B =[s'' B ] B Let us assume that.

[0291] Next, the correction module 213A of the operator A calculates the share “[s′ A ] B " to noise "r AB Remove the " and share "[s" A ] B " is generated (step 2907). Similarly, the correction module 213B of the operator B corrects the share “[s′ B ] A " to noise "r BA Remove the " and share "[s" B ] A " is generated (step 2908).

[0292] Next, the switching module 212A of the operator A receives the share “[s″ A ]B " to the business server 101B (step 2909). Similarly, the switching module 212B of the operator B may B ] A " to the business server 101A (step 2910).

[0293] Next, the N switching module 214A of the operator A detects the noise "r AA " to the business server 101B (step 2911). Similarly, the N switching module 214B of the operator B receives the noise "r BB " to the business server 101A (step 2912).

[0294] Next, the correction module 213A of the operator A calculates the share “[s″ B ] A " to noise "r BB Remove " and share " [s'' B ] A " is generated (step 2913). Similarly, the correction module 213B of the operator B corrects the share “[s″ A ] B " to noise "r AA Remove " and share " [s'' A ] B " is generated (step 2914).

[0295] Next, the response determination module 215 of the operator A or B determines the share “[s′′ A ] A ", [s''' B ] A ", [s''' A ] B ", [s''' B ] B " to the secret information "s A ", "s B In step 2915, the module in question uses match determination protocol 1. This match determination protocol 1 will be described later.

[0296] Here, s′′′ A :=[s′′′ A ] A +[s'' B ] A= s A +r AA +r AB +r BA +r BB It is. Also, s′′′ B :=[s′′′ B ] A +[s'' B ] B =s B +r AA +r AB +r BA +r BB It is.

[0297] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. This concludes the explanation of pattern 27.

[0298] 1-4-3. Matching protocol Next, the match checking protocols 1 to 3 will be explained.

[0299] 1-4-3-1. Matching protocol 1 FIG. 30 shows an example of the process flow of the match checking protocol 1. Before describing the flow 3000 shown in the figure, information held by the business servers 101A and 101B will be described. First, the business server 101A receives the share “[s′ A ] A ", [s′ B ] A " and noise "r A1 ,…r AN On the other hand, the business server 101B has a share "s' A ] B ", [s′ B ] B " and noise "r B1 ,…r BN ".

[0300] Here, share "[s′ A ] A ", [s′ A ] B When we restore the information s′ A " is obtained. The obtained information "s' A " is expressed as the following equation (1) or (2). s′ A =f(s A ,r A1 ,…,r AN ,r B1 …,r BN ) · · · (1) s′ A =f(s B ,r A1 ,…,r AN ,r B1 …,r BN ) · · · (2)

[0301] Share "[s′ B ] A ", [s′ B ] B When we restore the information s′ B " is obtained. The obtained information "s' B " is expressed as the following equation (3) or (4). s′ B =f(s B ,r A1 ,…,r AN ,r B1 …,r BN ) · · · (3) s′ B =f(s A ,r A1 ,…,r AN ,r B1 …,r BN ) · · · (4) Here, the function f(s, r) is a function that adds noise "r" to secret information "s". In addition, the function Recons([s] A ,[s] B ) is a share "[s] A "[s] B " is a function that restores

[0302] Next, flow 3000 will be described. First, the response determination module 215A of the business operator A determines the share “[s′ A ] A ", [s′ B ] A Run EqualityTest using s′ and share s′ A =s′ B ] A " is obtained (step 3001). Similarly, the correspondence determination module 215B of the operator B determines whether the share “[s′ A ] B ", [s′ B ] B Run EqualityTest using s′ and share s′ A =s′ B ] B " is obtained (step 3002). The EqualityTest will be explained later.

[0303] Next, the correspondence determination module 215 of the operator A or B determines the share “[s′ A =s′ B ] A ", [s′ A =s′ B ] B ” and restore the information “s′ A =s′ B Based on this information, the module obtains the secret information "s A ", "s B " matches or not. This concludes the explanation of match checking protocol 1.

[0304] 1-4-3-2. Matching protocol 2 Next, the match checking protocol 2 will be described. There are five types of match determination protocols 2. The five types of match determination protocols 2 can be selectively used. They will be explained in order below.

[0305] 1-4-3-2-1. Matching protocol 2-1 FIG. 31 shows an example of the processing flow of the match checking protocol 2-1. Before describing the flow 3100 shown in the figure, information held by the business servers 101A and 101B will be described. First, the business server 101A receives the information "s' A " and noise "r A1 ,…r AN On the other hand, the business server 101B has information "s' B " and noise "r B1 ,…r BN ".

[0306] Here, the information s′ A " is expressed as the following equation (5) or (6). s′ A =f(s A ,r A1 ,…,r AN ,r B1 …,r BN ) · · · (5) s′ A =f(s B ,r A1 ,…,r AN ,r B1 …,r BN ) · · · (6) Information “s′ B " is expressed as the following equation (7) or (8). s′ B =f(s B ,r A1 ,…,r AN ,r B1 …,r BN ) · · · (7) s′ B =f(s A ,r A1 ,…,r AN ,r B1 …,r BN ) · · · (8) Here, the function f(s, r) is a function that adds noise "r" to secret information "s".

[0307] Next, flow 3100 will be described. First, the correspondence determination module 215A of the operator A uses the secret sharing scheme to derive the information “s′ A Share " [s′ A ] A ", [s′ A ] B " (step 3101). Similarly, the correspondence determination module 215B of the operator B uses the secret sharing scheme to derive the information “s′ B Share " [s′ B ] A ", [s′ B ] B " (step 3102).

[0308] Next, the correspondence determination module 215A of the operator A determines the share “[s′ A ] B " to the business server 101B (step 3103). Similarly, the correspondence determination module 215B of the operator B determines whether the share “[s′ B ] A " to the business server 101A (step 3104).

[0309] Thereafter, the above-mentioned match checking protocol 1 is executed. Specifically, the correspondence determination module 215A of the business operator A determines whether the share “[s′ A ] A ", [s′ B ] A Run EqualityTest using s′ and share s′ A =s′ B ] A " is obtained (step 3105). Similarly, the correspondence determination module 215B of the operator B determines whether the share “[s′ A ] B ", [s′ B ] B Run EqualityTest using s′ and share s′ A =s′ B ] B " is obtained (step 3106). The EqualityTest will be explained later.

[0310] Next, the correspondence determination module 215 of the operator A or B determines the share “[s′ A =s′ B ] A ", [s′ A =s′ B ] B ” and restore the information “s′ A =s′ B Based on this information, the module obtains the secret information "s A ", "s B " matches or not. This concludes the description of the match checking protocol 2-1.

[0311] 1-4-3-2-2. Matching protocol 2-2 FIG. 32 shows an example of the processing flow of the match checking protocol 2-2. When executing the flow 3200 shown in the figure, the business server 101A receives the information "s' A " and noise "r A1 ,…r AN On the other hand, the business server 101B has information "s' B " and noise "r B1 ,…r BN ". This information is the same as that in the match determination protocol 2-1.

[0312] Flow 3200 will now be described. First, the correspondence determination module 215A of the operator A detects the noise "r A1 ,…r AN " (step 3201). Similarly, the correspondence determination module 215B of the carrier B removes the noise "r B1 ,…r BN " is deleted (step 3202). Note that the deletion referred to here does not only include a process of simply deleting data, but also other processes that make the data unusable (for example, a process of irreversibly converting the data).

[0313] Next, the correspondence determination module 215B of the operator B receives the information "s' B " to the business server 101A (step 3203).

[0314] Next, the correspondence determination module 215A of the operator A receives the information "s' A ", "s' B ” matches (step 3204). A ", "s B " matches or not. This concludes the explanation of the match checking protocol 2-2.

[0315] 1-4-3-2-3. Matching protocol 2-3 FIG. 33 shows an example of the processing flow of the match checking protocol 2-3. When executing the flow 3300 shown in the figure, the business server 101A receives the information "s' A " and noise "r A1 ,…r AN On the other hand, the business server 101B has information "s' B " and noise "r B1 ,…r BN ". This information is the same as that in the match determination protocol 2-1.

[0316] Flow 3300 will now be described. First, the correspondence determination module 215A of the operator A detects the noise "r A1 ,…r AN " (step 3301). Similarly, the correspondence determination module 215B of the operator B removes the noise "r B1 ,…r BN " is deleted (step 3302). Note that the deletion referred to here includes not only a process of simply deleting data, but also other processes that make the data unusable (for example, a process of irreversibly converting the data).

[0317] Next, the correspondence determination module 215A of the operator A receives the information "s'A " is encrypted to obtain information "H(s' A )" is generated (step 3303). Similarly, the correspondence determination module 215B of the operator B receives the information “s′ B " is encrypted to obtain information "H(s' B )" is generated (step 3304). Note that encryption here refers to, for example, a process of applying the same function such as hashing, or the creation of homomorphic encryption or zero-knowledge proof.

[0318] Next, the response determination module 215B of the operator B receives the information “H(s′ B )" to the business server 101A (step 3305).

[0319] Next, the response determination module 215A of the operator A receives the information “H(s′ A ), "H(s′ B ) matches (step 3306). A ", "s B " matches or not. This concludes the explanation of the match checking protocol 2-3.

[0320] 1-4-3-2-4. Matching protocol 2-4 FIG. 34 shows an example of the processing flow of the match checking protocol 2-4. When executing the flow 3400 shown in the figure, the business server 101A receives the information "s' A " and noise "r A1 ,…r AN On the other hand, the business server 101B has information "s' B " and noise "r B1 ,…r BN ". This information is the same as that in the match determination protocol 2-1.

[0321] Flow 3400 will now be described. First, the correspondence determination module 215A of the operator A detects the noise "rA1 ,…r AN " (step 3401). Similarly, the correspondence determination module 215B of the operator B deletes the noise "r B1 ,…r BN " is deleted (step 3402). Note that the deletion referred to here includes not only a process of simply deleting data, but also other processes that make the data unusable (for example, a process of irreversibly converting the data).

[0322] Next, the correspondence determination module 215A of the operator A receives the information "s' A Split "s" into partial information "s' A,1 ", "s' A,2 " is generated (step 3403). Similarly, the correspondence determination module 215B of the operator B receives the information “s′ B Split "s" into partial information "s' B,1 ", "s' B,2 " is generated (step 3404). The split process will be described later.

[0323] Next, the correspondence determination module 215A of the business A determines the partial information “s′ A,2 " to the business server 101B (step 3405). Similarly, the correspondence determination module 215B of the operator B uses the partial information “s′ B,1 " to the carrier's server 101A (step 3406).

[0324] The correspondence determination module 215A of the business operator A uses the partial information “s′ A,1 ", "s' B,1 It is then determined whether or not the two match (step 3407). Similarly, the correspondence determination module 215B of the operator B uses the partial information “s′ A,2 ", "s' B,2 It is then determined whether or not the two match (step 3408). As a result of these decisions, the partial information s′ A,1 ", "s' B,1" matches and partial information "s' A,2 ", "s' B,2 If the two match, the secret information "s A ", "s B " matches. This concludes the explanation of match checking protocol 2-4.

[0325] 1-4-3-2-5. Matching protocol 2-5 FIG. 35 shows an example of the processing flow of the match checking protocol 2-5. When executing the flow 3400 shown in the figure, the business server 101A receives the information "s' A " and noise "r A1 ,…r AN On the other hand, the business server 101B has information "s' B " and noise "r B1 ,…r BN ". This information is the same as that in the match determination protocol 2-1.

[0326] Flow 3500 will now be described. First, the correspondence determination module 215A of the operator A detects the noise "r A1 ,…r AN " (step 3501). Similarly, the correspondence determination module 215B of the operator B deletes the noise "r B1 ,…r BN " is deleted (step 3502). Note that the deletion referred to here includes not only a process of simply deleting data, but also other processes that make the data unusable (for example, a process of irreversibly converting the data).

[0327] Next, the correspondence determination module 215A of the operator A receives the information "s' A Split "s" into partial information "s' A,1 ", "s' A,2 " is generated (step 3503). Similarly, the correspondence determination module 215B of the operator B receives the information “s′ B Split "s" into partial information "s' B,1", "s' B,2 " is generated (step 3504). The split process will be described later.

[0328] Next, the correspondence determination module 215B of the operator B determines the partial information “s′ B,1 ", "s' B,2 " to the business server 101A (step 3505).

[0329] The correspondence determination module 215A of the business operator A uses the partial information “s′ A,1 ", "s' B,1 The module also checks whether the partial information "s' A,2 ", "s' B,2 It is then determined whether or not the two match (step 3507). As a result of these decisions, the partial information s′ A,1 ", "s' B,1 " matches and partial information "s' A,2 ", "s' B,2 If the two match, the secret information "s A ", "s B " matches. This concludes the explanation of match determination protocol 2-5.

[0330] 1-4-3-3. Matching protocol 3 Next, the match checking protocol 3 will be described. There are two types of match determination protocols 3. The two types of match determination protocols 3 can be selectively used. They will be explained in order below.

[0331] 1-4-3-3-1. Matching protocol 3-1 FIG. 36 shows an example of the processing flow of the match checking protocol 3-1. Before describing the flow 3600 shown in the figure, information held by the business servers 101A and 101B will be described. First, the business server 101A receives the share “[s′ A ] A ", [s′A ] B " and noise "r A1 ,…r AN On the other hand, the business server 101B has a share "s' B ] A ", [s′ B ] B " and noise "r B1 ,…r BN ".

[0332] Here, share "[s′ A ] A ", [s′ A ] B When we restore the information s′ A " is obtained. The obtained information "s' A " is expressed as the following equation (9) or (10). s′ A =f(s A ,r A1 ,…,r AN ,r B1 …,r BN ) · · · (9) s′ A =f(s B ,r A1 ,…,r AN ,r B1 …,r BN ) · · · (10)

[0333] Share "[s′ B ] A ", [s′ B ] B When we restore the information s′ B " is obtained. The obtained information "s' B " is expressed as the following equation (11) or (12). s′ B =f(s B ,r A1 ,…,r AN ,r B1 …,r BN ) · · · (11) s′ B =f(s A ,r A1 ,…,r AN ,rB1 …,r BN ) · · · (12) Here, the function f(s, r) is a function that adds noise "r" to secret information "s". In addition, the function Recons([s] A ,[s] B ) is a share "[s] A "[s] B " is a function that restores

[0334] Next, flow 3600 will be described. First, the response determination module 215A of the business operator A determines the share “[s′ A ] B " to the business server 101B (step 3601). Similarly, the correspondence determination module 215B of the operator B determines whether the share “[s′ B ] A " to the business server 101A (step 3602).

[0335] Thereafter, the above-mentioned match checking protocol 1 is executed. Specifically, the correspondence determination module 215A of the business operator A determines whether the share “[s′ A ] A ", [s′ B ] A Run EqualityTest using s′ and share s′ A =s′ B ] A " is obtained (step 3603). Similarly, the correspondence determination module 215B of the operator B determines whether the share “[s′ A ] B ", [s′ B ] B Run EqualityTest using s′ and share s′ A =s′ B ] B " is obtained (step 3604). The EqualityTest will be explained later.

[0336] Next, the correspondence determination module 215 of the operator A or B determines the share “[s′ A =s′ B ] A ", [s′ A =s′ B ] B ” and restore the information “s′ A =s′ B Based on this information, the module obtains the secret information "s A ", "s B " matches or not. This concludes the explanation of the match checking protocol 3-1.

[0337] 1-4-3-3-2. Matching protocol 3-2 FIG. 37 shows an example of the processing flow of the match checking protocol 3-2. When executing the flow 3700 shown in the figure, the business server 101A A ] A ", [s′ A ] B " and noise "r A1 ,…r AN On the other hand, the business server 101B has a share "s' B ] A ", [s′ B ] B " and noise "r B1 ,…r BN ". This information is the same as that in the match determination protocol 3-1.

[0338] Flow 3700 will now be described. First, the response determination module 215A of the business operator A determines the share “[s′ A ] A ", [s′ A ] B ” and restore the information “s′ A " is obtained (step 3701). Similarly, the correspondence determination module 215B of the operator B determines whether the share “[s′ B ] A ", [s′ B ]B ” and restore the information “s′ B " is obtained (step 3702).

[0339] Thereafter, the above-mentioned match checking protocol 2 is executed (step 3703). This concludes the explanation of match checking protocol 3-2.

[0340] 1-4-4.Random number generation protocol Generate cryptographically-generated pseudorandom numbers (CSPRNG) as random numbers (noise). Random numbers used in cryptography are required to have different properties than random numbers used in simulations, etc. To distinguish such random numbers from normal pseudorandom numbers, they are called cryptographic pseudorandom numbers. Here, a cryptographic pseudorandom number is a random number in which it is impossible to predict whether the next 1-bit output will be 0 or 1 based on the previously generated sequence (it cannot be guessed with a probability of 1 / 2 or higher).

[0341] In this respect, pseudorandom numbers can be predicted from past generated sequences, and are not cryptographically based. For example, the linear congruential algorithm is obvious if the parameters are known. Also, the Mersenne Twister algorithm is a pseudorandom number method that obtains consecutive pseudorandom numbers. Once the random number sequence is generated, it is possible to calculate the sequence. Therefore, cryptographic pseudorandom numbers are preferable to pseudorandom numbers. However, this does not mean to deny the use of pseudorandom numbers.

[0342] If the current time is set as the seed for random numbers, there is a possibility that the initial value may be guessed, since there are not many patterns for the current time. For this reason, it is not advisable to set the time as the initial value for a cryptographic pseudo-random number generator. To set the seed, it is recommended to use the random number generation devices / dev / random or / dev / urandom in Linux (registered trademark), or the dedicated function GryptGenRandom() in Windows (registered trademark). In that case, information that is constantly changing, such as information about the HDD, memory, mouse, and keyboard, can be used to generate random numbers. Note that we are not against using the current time to generate random numbers.

[0343] 1-4-5. Secret sharing protocol Secret sharing is an information sharing method in which secret information is distributed to multiple parties, and each party has no knowledge of the secret information, but the secret information can be restored by combining the information held by some of the parties. In this case, the pieces of information held by each party are called shares. Calculating the secret information from the shares without restoring the original information is called secure computation. Secret sharing is formulated below.

[0344] First, we define the access structure. In secret sharing, the information cannot be restored unless parties that satisfy certain conditions gather together. The access structure specifies what kind of parties need to gather together to restore the information.

[0345] JPEG2025034980000023.jpg20170

[0346] Next we define the distribution schema. JPEG2025034980000024.jpg20166

[0347] Next, we define secret sharing. JPEG2025034980000025.jpg25170

number

[0348] JPEG2025034980000027.jpg10170

number

[0349] JPEG2025034980000029.jpg26170

[0350] The secret sharing scheme of this embodiment is linear and has a coincidence check function.

[0351] 1-4-6. Split protocol An example of a split protocol will now be described. JPEG2025034980000030.jpg9170S element, s ij Let i∈{1,...,N} and j∈{1,...,M}, then S can be written as follows.

number

[0352] JPEG2025034980000032.jpg14170

number

[0353] For example, if N×M=5×5, we get the following.

number

[0354] 1-4-7.EqualityTest Protocol An example of EqualityTest on secret sharing will be explained. First, we define LTZ([x]) (less than zero) as follows:

number

[0355] An example of how to implement LTZ([x]) is as follows.

number

[0356] Here, LSB([x]) is a function that takes the share of the least significant bit of [x] (the share of x). Using this, ET([s 1 ],[s 2 ])(EqualityTest) is defined as follows:

number

[0357] For more information on the Equality Test in secret sharing, see, for example, the following literature: Campmans, HHM, “Optimizing convolutional neural networks in multi-party computation”, [online], April 26, 2018, Eindhoven University of Technology, [Retrieved July 25, 2023], Internet <URL: https: / / pure.tue.nl / ws / portalfiles / portal / 109478717 / 0746865_IAM_Master_ Thesis_Harm_Campmans.pdf>

[0358] 2. Variations The above embodiment may be modified as described below. 2-1. Variation 1 In the above embodiment, the noise is generated by the business server 101, but the noise may be generated by a device different from the business server 101 (for example, a noise generation server).

[0359] FIG. 38 shows an example of the configuration of a secret ID matching system 3800 including a noise generation server 3801. The secret ID matching system 3800 includes a noise generation server 3801 in addition to the two business servers 101A and 101B.

[0360] FIG. 39 shows an example of the configuration of the noise generation server 3801. The noise generation server 3801 is configured, for example, by a server placed on the cloud. A noise generation module 3910 is stored in the main memory 3901. When this program is executed by the processor 3903, each functional element of the noise generation server 3801 is realized.

[0361] The noise generation module 3910 generates noise. The generated noise is, for example, a random number. The auxiliary storage device 3902 stores noise information 3920 .

[0362] 2-2. Variation 2 In the above embodiment, the secret ID matching is performed between two business servers 101, but the secret ID matching may be performed between three or more business servers 101.

[0363] 2-3. Variation 3 The secret sharing schemes that can be used in the above embodiment include the following: (k,n)-Threshold Secret Sharing, Verifiable Secret Sharing (Feldman's Secret Sharing), Hierarchical Secret Sharing, Dynamic Secret Sharing, Robust Secret Sharing, Ideal Secret Sharing Scheme, Secret Sharing with General Access Structures, Searchable Encryption with a Secret Sharing Scheme, Multi-Level Secret Sharing

[0364] Furthermore, the secret sharing schemes that can be used in the above embodiment include the following. Additive Secret Sharing (Replicated Additive Secret Sharing Scheme, Computational Additive Secret Sharing Scheme), Shamir's Secret Sharing (Ramp Shamir secret sharing scheme), Blakley's Secret Sharing Algorithm, Proactive Secret Sharing, Mignotte's Secret Sharing Scheme, XOR Secret Sharing, Secret Sharing using Chinese Remainder Theorem (Mignotte's Secret Sharing Scheme) (Asmus-Bloom Secret Sharing Scheme), Secret Sharing using Pairings, Secret Sharing using Visual Cryptography, Secret Sharing using Combinatorial squares, Secret Sharing using Matroid Theory, Secret-sharing with a class of ternary codes, Krawczyk Secret Sharing, Quorum Secret Sharing, Vector Space Secret Sharing, Lattice-based Secret Sharing(LWE-based Secret Sharing, Homomorphic Secret Sharing), Secret Sharing by The Monotone Formulae Construction, Multi-Linear Secret-Sharing Schemes, Quantum Secret Sharing

[0365] Furthermore, the secret sharing schemes that can be used in the above embodiment include the following. Secret Sharing using Commutative Rings, Stochastic Secret Sharing, Cryptographic Secret Sharing, Regular polygamy Secret Sharing

[0366] 2-4. Variation 4 The compliance determination module 215 of the business server 101 may be provided in a device different from the business server 101 (for example, a compliance determination server).

[0367] FIG. 38 shows an example of the configuration of a secret ID matching system 3800 including a correspondence determination server 3802 . The secret ID matching system 3800 includes a correspondence determination server 3802 in addition to the two business servers 101A and 101B.

[0368] FIG. 40 shows an example of the configuration of the correspondence determination server 3802 . The response determination server 3802 is configured, for example, by a server placed on the cloud. The main memory device 4001 stores a correspondence determination module 4010. When this program is executed by the processor 4003, each functional element of the correspondence determination server 3802 is realized.

[0369] The correspondence determination module 4010 realizes the same function as the above-mentioned correspondence determination module 215. Therefore, the description of the function will be omitted. The auxiliary storage device 4002 stores the determination information 4020 .

[0370] 2-5. Variation 5 Pattern 5-2, which is a variation of the above-mentioned pattern 5, will be described. Pattern 5-2 (commutative semigroup) is executed in the order of processing, exchange, division, correction, and match determination. Figure 41 shows an example of the matching process flow of pattern 5-2.

[0371] In the flow 4100 shown in the figure, first, the processing module 210A of the business A generates a noise “ A " (step 4101). Then, the module generates the generated noise "l A " to confidential information "s A ” and add noise addition information “s′ A " is generated (step 4102).

[0372] Similarly, the processing module 210B of the entity B generates a noise “r B " (step 4103). Then, the module generates the generated noise "r B " to confidential information "s B ” and add noise addition information “s′ B " is generated (step 4104).

[0373] Next, the switching module 212A of the operator A converts the noise-added information "s' A " to the business server 101B (step 4105). Similarly, the switching module 212B of the operator B receives the noise-added information "s' B " to the business server 101A (step 4106).

[0374] Next, the division module 211A of the operator A divides the noise-added information “s′ B Share " [s′ B ] A ", [s′ B ] B " (step 4107). Similarly, the division module 211B of the operator B uses the secret sharing scheme to derive the noise-added information “s′ A Share " [s′ A ] A ", [s′ A ] B " (step 4108).

[0375] Next, the correction module 213A of the operator A calculates the share “[s′B ] A " with noise "l A Add " and share " [s" B ] A " (step 4109). The module also generates a share "[s' B ] B " with noise "l A Add " and share " [s" B ] B The share "[s" B ] A " ", "[s" B ] B " is "l A ·s B ·r B " share.

[0376] Similarly, the correction module 213B of the operator B corrects the share “[s′ A ] A " with noise "r B Add " and share " [s" A ] A The module also generates a share "[s' A ] B " with noise "r B Add " and share " [s" A ] B " is generated (step 4112). The share "[s" A ] A " ", "[s" A ] B " is "l A ·s A ·r B " share.

[0377] Next, the correspondence determination module 215 of the operator A or B determines whether the share “[s″ B ] A " ", "[s" B ] B " ", "[s" A ] A " ", "[s" A ] B " to the secret information "sA ", "s B It is determined whether or not the " matches" (step 4113). At that time, the module uses match determination protocol 1. This match determination protocol 1 will be described later.

[0378] When the module obtains the result of the match determination, it notifies the other business server 101 of the result. The above is an explanation of pattern 5-2.

[0379] 2-6. Variation 6 Regarding the groups that appear in the above examples, examples of each will be shown as a set of sets and operations. ·group ·Commutative There is a structure theorem for finitely generated commutative groups, and it is known that any finitely generated commutative group is a finite direct sum of the groups listed in 1 and 2 below. (Any finitely generated commutative group is of course a commutative group, but it is composed of a finite direct sum of the groups listed in 1 and 2 below.)

[0380] JPEG2025034980000038.jpg81170

[0381] ·Non-commutative 1. Symmetric group S n 2. Alternating Group A n 3. General linear group GL(n,K)={A|detA≠0} a. where K is a field and A is an n×n matrix of K-coefficients b. There are many other linear groups i. Special linear group ii. Orthogonal groups iii. Special orthogonal groups iv. Unitary groups v. Special unitary groups 4. Regular matrices, matrix multiplication

[0382] ·Semigroup ·Commutative JPEG2025034980000039.jpg14170

[0383] ·Non-commutative 1. Free monoids It is made from a set of characters X. As a set, it is a finite set of strings as follows: F(X) = {x 1 x 2 … x n |x i ∈X, ∀i} The calculation is done by concatenating strings. 2. Sets of square matrices and matrix products (non-commutative monoids, but also semigroups)

[0384] 2-7.Other Modifications The present invention is not limited to the above-mentioned embodiment, and various modifications are included. For example, the above-mentioned embodiment has been described in detail to clearly explain the present invention, and is not necessarily limited to those having all of the configurations described. In addition, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. In addition, it is possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.

[0385] In addition, the above-mentioned configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. In addition, the above-mentioned configurations, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information such as the program, table, file, etc. that realizes each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

[0386] In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and not all control lines and information lines in the product are necessarily shown. In reality, it can be considered that almost all components are connected to each other. The above-described embodiments disclose at least the configurations described in the claims. [Explanation of symbols]

[0387] 100: Secret ID matching system, 101A, 101B: Business server, 210: Processing module, 211: Division module, 212: Exchange module, 213: Correction module, 214: N exchange module, 215: Correspondence determination module

Claims

1. A method for determining whether data correspond to each other, comprising the steps of: Each of a plurality of business servers having confidential information The person processes his / her confidential information using one or more pieces of specified information, Divide the processed secret information into multiple pieces of information, Some partial information was exchanged, At least one of the plurality of business servers or another server, The plurality of business servers executes a predetermined calculation using the exchanged partial information and other partial information without sharing at least one of the predetermined information used in the processing, thereby determining whether the secret information corresponds to each other. A method comprising:

2. The method according to claim 1 , wherein each of the plurality of business servers corrects a part of the partial information before exchanging the partial information.

3. Each of the plurality of business servers corrects a part of the exchanged partial information; At least one of the plurality of business servers or the other server executes the predetermined calculation using the corrected partial information and the other partial information, thereby determining whether the pieces of secret information correspond to each other.

2. The method according to claim 1 .

4. Each of the plurality of business servers The person processes his / her own confidential information using multiple pieces of specified information, exchanging one of the plurality of predetermined pieces of information; The correction is performed using the exchanged predetermined information.

4. The method according to claim 2 or 3.

5. Each of the plurality of business servers exchanging one of a plurality of predetermined pieces of information; Processing one's own confidential information using the exchanged specified information and other specified information 4. The method according to claim 1, wherein the

6. A method for determining whether data correspond to each other, comprising the steps of: Each of a plurality of business servers having confidential information The person processes his / her confidential information using one or more pieces of specified information, Exchange secret information that has been processed, Divide the exchanged secret information into multiple pieces of information, At least one of the plurality of business servers or another server, The plurality of business servers executes a predetermined calculation using the plurality of pieces of partial information without sharing at least one of the pieces of predetermined information used in the processing, thereby determining whether the pieces of secret information correspond to each other. A method comprising:

7. The method according to claim 6, wherein each of the plurality of business servers corrects the exchanged secret information and then divides the corrected secret information into a plurality of partial information.

8. Each of the plurality of business servers corrects the generated plurality of pieces of partial information; At least one of the plurality of business servers or the other server executes the predetermined calculation using the plurality of corrected partial information to determine whether the pieces of secret information correspond to each other.

7. The method according to claim 6 .

9. Each of the plurality of business servers The person processes his / her own confidential information using multiple pieces of specified information, exchanging one of the plurality of predetermined pieces of information; The correction is performed using the exchanged predetermined information.

9. The method according to claim 7 or 8.

10. Each of the plurality of business servers exchanging one of a plurality of predetermined pieces of information; Processing one's own confidential information using the exchanged specified information and other specified information 9. The method according to any one of claims 6 to 8, characterized in that

11. A method for determining whether data correspond to each other, comprising the steps of: Each of a plurality of business servers having confidential information The person processes his / her confidential information using one or more pieces of specified information, Exchange secret information that has been processed, Correct the exchanged secret information, At least one of the plurality of business servers or another server, The plurality of business servers executes a predetermined calculation using the corrected secret information without sharing at least one of the predetermined information used in the processing, and determines whether the secret information corresponds to each other. A method comprising:

12. Each of the plurality of business servers exchanging one of a plurality of predetermined pieces of information; Processing one's own confidential information using the exchanged specified information and other specified information 12. The method according to claim 11 .

13. Each of the plurality of business servers The person processes his / her own confidential information using multiple pieces of specified information, exchanging one of the plurality of predetermined pieces of information; The correction is performed using the exchanged predetermined information.

12. The method according to claim 11 .

14. A method for determining whether data correspond to each other, comprising the steps of: Each of a plurality of business servers having confidential information Divide your secret information into multiple pieces of information, The generated plurality of pieces of partial information are processed using one or more pieces of predetermined information; Exchange some of the processed information, At least one of the plurality of business servers or another server, The plurality of business servers executes a predetermined calculation using the exchanged partial information and the other processed partial information without sharing at least one of the predetermined information used in the processing, thereby determining whether the secret information corresponds to each other. A method comprising:

15. The method according to claim 14, wherein each of the plurality of business servers corrects the processed partial information before exchanging the information.

16. Each of the plurality of business servers corrects a part of the exchanged partial information; At least one of the plurality of business servers or the other server executes the predetermined calculation using the corrected partial information and the other processed partial information, thereby determining whether the secret information corresponds to each other.

15. The method according to claim 14.

17. Each of the plurality of business servers The generated partial information is processed using a plurality of predetermined information; exchanging one of the plurality of predetermined pieces of information; The correction is performed using the exchanged predetermined information.

17. The method according to claim 15 or 16.

18. Each of the plurality of business servers exchanging one of a plurality of predetermined pieces of information; The generated partial information is processed using the exchanged specified information and other specified information.

17. The method according to any one of claims 14 to 16, characterized in that

19. A system for determining whether data correspond to each other, comprising: Each of a plurality of business servers having confidential information a processing means for processing one's own confidential information by using one or more predetermined pieces of information; A division means for dividing the processed secret information into a plurality of partial information; A first exchange means for exchanging a part of partial information; having At least one of the plurality of business servers or another server, A correspondence determination means for determining whether the secret information corresponds to each other by executing a predetermined calculation using a part of the exchanged partial information and other partial information without sharing at least one of the predetermined information used in the processing by the plurality of business servers. The method according to claim 1, further comprising:

20. Each of the plurality of business servers further includes a correction unit for correcting a part of the partial information, The first exchange means exchanges the corrected partial information.

20. The system of claim 19.

21. Each of the plurality of business servers further includes a correction means for correcting a part of the exchanged partial information, The correspondence determination means performs the predetermined calculation using the corrected partial information and the other partial information to determine whether the secret information corresponds to each other.

20. The system of claim 19.

22. the processing means processes the secret information of the user by using a plurality of predetermined pieces of information; Each of the plurality of business servers further includes a second exchange means for exchanging one of the plurality of pieces of predetermined information; The correction means performs the correction using the exchanged predetermined information.

22. A system according to claim 20 or 21, characterized in that

23. Each of the plurality of business servers further includes a second exchange means for exchanging one of a plurality of predetermined information; The processing means processes its own secret information using the exchanged predetermined information and other predetermined information.

22. A system according to any one of claims 19 to 21, characterized in that

24. A system for determining whether data correspond to each other, comprising: Each of a plurality of business servers having confidential information a processing means for processing one's own confidential information by using one or more predetermined pieces of information; a first exchange means for exchanging the processed secret information; A division means for dividing the exchanged secret information into a plurality of partial information; having At least one of the plurality of business servers or another server, A correspondence determination means for determining whether the secret information corresponds to each other by performing a predetermined calculation using the plurality of partial information without sharing at least one of the predetermined information used in the processing by the plurality of business servers. A system comprising:

25. Each of the plurality of business servers further includes a correction unit for correcting the exchanged secret information; 25. The system according to claim 24, wherein the dividing means divides the corrected secret information into a plurality of partial information.

26. Each of the plurality of business servers further includes a correction unit for correcting the plurality of pieces of generated partial information; The correspondence determination means determines whether the pieces of secret information correspond to each other by executing the predetermined calculation using the corrected pieces of partial information.

25. The system of claim 24.

27. the processing means processes the secret information of the user by using a plurality of predetermined pieces of information; Each of the plurality of business servers further includes a second exchange means for exchanging one of the plurality of pieces of predetermined information; The correction means performs the correction using the exchanged predetermined information.

27. A system according to claim 25 or 26, characterized in that

28. Each of the plurality of business servers further includes a second exchange means for exchanging one of a plurality of predetermined information; The processing means processes its own secret information using the exchanged predetermined information and other predetermined information.

27. A system according to any one of claims 24 to 26, characterized in that

29. A system for determining whether data correspond to each other, comprising: Each of a plurality of business servers having confidential information a processing means for processing one's own confidential information by using one or more predetermined pieces of information; a first exchange means for exchanging the processed secret information; A correction means for correcting the exchanged secret information; having At least one of the plurality of business servers or another server, A correspondence determination means for determining whether the secret information corresponds to each other by performing a predetermined calculation using the corrected secret information without the plurality of business servers sharing at least one of the predetermined information used in the processing. A system comprising:

30. Each of the plurality of business servers further includes a second exchange means for exchanging one of a plurality of predetermined information; The processing means processes its own secret information using the exchanged predetermined information and other predetermined information.

30. The system of claim 29.

31. the processing means processes the secret information of the user by using a plurality of predetermined pieces of information; Each of the plurality of business servers further includes a second exchange means for exchanging one of the plurality of pieces of predetermined information; The correction means performs the correction using the exchanged predetermined information.

30. The system of claim 29.

32. A system for determining whether data correspond to each other, comprising: Each of a plurality of business servers having confidential information A division means for dividing the secret information of the user into a plurality of pieces of partial information; a processing means for processing the generated plurality of pieces of partial information by using one or more pieces of predetermined information; a first exchange means for exchanging a part of the processed partial information; having At least one of the plurality of business servers or another server, A correspondence determination means for determining whether the secret information corresponds to each other by executing a predetermined calculation using the exchanged partial information and other processed partial information without the plurality of business servers sharing at least one of the predetermined information used in the processing. A system comprising:

33. Each of the plurality of business servers further includes a correction means for correcting a part of the processed partial information, The first exchange means exchanges the corrected partial information.

33. The system of claim 32.

34. Each of the plurality of business servers further includes a correction means for correcting a part of the exchanged partial information, The correspondence determination means performs the predetermined calculation using the corrected partial information and the other processed partial information to determine whether the secret information corresponds to each other.

33. The system of claim 32.

35. the processing means processes the generated plurality of pieces of partial information by using a plurality of pieces of predetermined information; Each of the plurality of business servers further includes a second exchange means for exchanging one of the plurality of pieces of predetermined information; The correction means performs the correction using the exchanged predetermined information.

35. A system according to claim 33 or 34, characterized in that

36. Each of the plurality of business servers further includes a second exchange means for exchanging one of a plurality of predetermined information; The processing means processes the generated plurality of pieces of partial information using the exchanged predetermined information and other predetermined information. A system according to any one of claims 32 to 34, characterized in that

37. A server that determines whether data correspond to each other, a processing means for processing one's own confidential information by using one or more predetermined pieces of information; A division means for dividing the processed secret information into a plurality of partial information; A first exchange means for exchanging a part of the partial information with another business server; a correspondence determination means for determining whether the pieces of secret information correspond to each other by performing a predetermined calculation using a part of the exchanged partial information and other partial information, without sharing at least one of the pieces of the predetermined information used in the processing with the other business server; A server comprising:

38. Further, a correction means for correcting a part of the partial information is provided, The first exchange means exchanges the corrected partial information with the other business server.

38. A server according to claim 37, characterized in that

39. Further comprising a correction means for correcting a part of the exchanged partial information, The correspondence determination means performs the predetermined calculation using the corrected partial information and the other partial information to determine whether the secret information corresponds to each other.

38. A server according to claim 37, characterized in that

40. the processing means processes the secret information of the user by using a plurality of predetermined pieces of information; The second exchange means exchanges one of the plurality of pieces of predetermined information with the other business server, The correction means performs the correction using the exchanged predetermined information.

40. A server according to claim 38 or 39, characterized in that

41. Further comprising a second exchange means for exchanging one of a plurality of pieces of predetermined information with the other business server, The processing means processes its own secret information using the exchanged predetermined information and other predetermined information. Server according to any one of claims 37 to 39, characterized in that it

42. A server that determines whether data correspond to each other, a processing means for processing one's own confidential information by using one or more predetermined pieces of information; A first exchange means for exchanging the processed secret information with another business server; A division means for dividing the exchanged secret information into a plurality of partial information; a correspondence determination means for determining whether the pieces of secret information correspond to each other by performing a predetermined calculation using the plurality of pieces of partial information without sharing at least one of the pieces of predetermined information used in the processing with the other business server; A server comprising:

43. The method further includes a correction means for correcting the exchanged secret information, The division means divides the corrected secret information into a plurality of partial information.

43. A server according to claim 42.

44. The method further includes a correction unit for correcting the generated plurality of pieces of partial information, The correspondence determination means determines whether the pieces of secret information correspond to each other by executing the predetermined calculation using the corrected pieces of partial information.

43. A server according to claim 42.

45. the processing means processes the secret information of the user by using a plurality of predetermined pieces of information; The second exchange means exchanges one of the plurality of pieces of predetermined information with the other business server, The correction means performs the correction using the exchanged predetermined information.

45. A server according to claim 43 or 44, characterized in that

46. Further comprising a second exchange means for exchanging one of a plurality of pieces of predetermined information with the other business server, The processing means processes its own secret information using the exchanged predetermined information and other predetermined information.

45. A server according to any one of claims 42 to 44.

47. A server that determines whether data correspond to each other, a processing means for processing one's own confidential information by using one or more predetermined pieces of information; A first exchange means for exchanging the processed secret information with another business server; A correction means for correcting the exchanged secret information; a correspondence determination means for determining whether the pieces of secret information correspond to each other by performing a predetermined calculation using the corrected secret information without sharing at least one of the pieces of the predetermined information used in the processing with the other business server; A server comprising:

48. Further comprising a second exchange means for exchanging one of a plurality of pieces of predetermined information with the other business server, The processing means processes its own secret information using the exchanged predetermined information and other predetermined information.

48. A server according to claim 47.

49. the processing means processes the secret information of the user by using a plurality of predetermined pieces of information; The second exchange means exchanges one of the plurality of pieces of predetermined information with the other business server, The correction means performs the correction using the exchanged predetermined information.

48. A server according to claim 47.

50. A server that determines whether data correspond to each other, A division means for dividing the secret information of the user into a plurality of pieces of partial information; a processing means for processing the generated plurality of pieces of partial information by using one or more pieces of predetermined information; A first exchange means for exchanging the processed partial information with another business server; a correspondence determination means for determining whether the pieces of secret information correspond to each other by performing a predetermined calculation using the exchanged partial information and other processed partial information, without sharing at least one of the pieces of the predetermined information used in the processing with the other business server; A server comprising:

51. Further comprising a correction means for correcting a part of the processed partial information, The first exchange means exchanges the corrected partial information with the other business server.

51. A server according to claim 50.

52. Further comprising a correction means for correcting a part of the exchanged partial information, The correspondence determination means performs the predetermined calculation using the corrected partial information and the other processed partial information to determine whether the secret information corresponds to each other.

51. A server according to claim 50.

53. the processing means processes the generated plurality of pieces of partial information by using a plurality of pieces of predetermined information; The second exchange means exchanges one of the plurality of pieces of predetermined information with the other business server, The correction means performs the correction using the exchanged predetermined information.

53. A server according to claim 51 or 52.

54. Further comprising a second exchange means for exchanging one of a plurality of pieces of predetermined information with the other business server, The processing means processes the generated plurality of pieces of partial information using the exchanged predetermined information and other predetermined information.

53. A server according to any one of claims 50 to 52.

55. A program for causing a computer to function as the server according to claim 37, 42, 47 or 50.

Images