Verification device, verification method, verification program, and verification system capable of performing calculation based on protocol for verifying result of stable matching problem

Abstract

To provide an efficient verification protocol for a stable matching problem in designation of a malicious antagonist, and provide a verification device, a verification method, and a verification program which perform calculation based on the verification protocol.SOLUTION: A verification device performs calculation based on a protocol for verifying a result of a stable matching problem in plural clients. The protocol defines a procedure to be implemented between the plural clients and verification device, works even in designating a malicious antagonist, and includes a confidence disclosure scheme (CDS) with two conditions.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to the field of stable matching problems, and more particularly to the field of a verification device, a verification method, a verification program, and a verification system that perform calculations in accordance with a protocol for verifying the result of a stable matching problem. [Background technology]

[0002] For the stable matching problem, we consider a set A(A={a 1 ,…,a n}) and set B(B={b 1 ,…,b n}) for each member a of set A. i is the preference order (b i_1 ,…,b i_n ), and for each member b of set B j is the preference order (a j_1 ,…,a j_n ). The preference order (also called "preference") represents an order of preference for members of the other set, i.e., members that appear earlier in the preference order are preferred over members that appear later.

[0003] A matching M is a biprojection between sets A and B. (a i ,b j ) is a pair of matching M, then M(a i )=b j , M(b j )=a i In the stable matching problem, the goal is to find a stable matching between sets A and B according to the following definition:

[0004] Definition 1 (Blocking Pair): Given sets A and B, the preference ordering of each member in sets A and B, and a matching M, the pair (a i ,b j ) become a blocking pair (also called an "unstable pair") if the following two conditions are met: (1)a i is M(ai ) rather than b j I prefer. (2)b j is M(b j ) rather than a i I prefer.

[0005] Definition 2 (Stable matching): Given sets A and B and the preference ordering of each member in sets A and B, a matching M is stable (a stable matching) if there are no blocking pairs.

[0006] Non-Patent Document 1 proposed the following protocol for the stable matching problem. There are 2n clients, each of which represents a member of set A or set B. Each client sends its preference order in plain text to the calculation server. The calculation server calculates stable matchings and returns the assigned pairs to each client.

[0007] To ensure that the matchings calculated by the calculation server are stable, the clients run a verification protocol. Each client sends its preferred order and the assigned pairs as ciphertext to the verification server. The verification server computes the ciphertext using fully homomorphic encryption and returns the verification result to each client. [Prior art documents] [Non-patent literature]

[0008] [Non-Patent Document 1] Toru Nakamura, Hiroki Okada, Kazuhide Fukushima and Takamasa Isohara, “Achieving Private Verification in Multi-stakeholder Environment and Application to Stable Matching”, Proceedings of the 25th International Conference on Enterprise Information Systems (ICEIS 2023), Volume 1, pp. 768-775

[0009] [Non-Patent Document 2] Kittiphop Phalakarn, Nuttapong Attrapadung and Kanta Matsuura, “Efficient Oblivious Evaluation Protocol and Conditional Disclosure of Secrets for DFA”, Proceedings of the International Conference on Applied Cryptography and Network Security (2022), pp. 605-625

[0010] [Non-Patent Document 3] Adi Shamir, “How to Share a Secret”, Communications of the ACM, November 1979, Volume 22, Number 11, pp. 612-613 Summary of the Invention [Problem to be solved by the invention]

[0011] The verification protocol in Non-Patent Document 1 has the following two main drawbacks. (1) The protocol is inefficient because it uses fully homomorphic encryption. (2) The protocol can only be used in a semi-honest adversary setting, where the validating server is assumed to follow the protocol correctly. This assumption may be too weak for some applications.

[0012] In contrast, the present invention does not require encryption and is therefore more efficient than the protocol of Non-Patent Document 1. Also, the present invention makes no assumptions about the behavior of the verification server and works even in a malicious adversary setting. The present invention aims to provide an efficient verification protocol for a stable matching problem in a setting of a malicious adversary, and a verification device, verification method, and verification program that perform calculations in accordance with the verification protocol. [Means for solving the problem]

[0013] The present invention is a verification protocol for the stable matching problem that works in a malicious adversarial setting. Each client represents a member of set A or set B, with its preference order and assigned pairs. The present invention uses a verification server to verify the matching results, and the verification server operates according to the verification protocol. The verification protocol consists of two Conditional Disclosure of Secrets (CDS) schemes for unstable matching and stable matching.

[0014] The verification device of the present invention is a verification device that performs calculations in accordance with a protocol for verifying the result of a stable matching problem, the protocol defines procedures to be executed between multiple clients and the verification device, functions even in a setting of a malicious adversary, and consists of two conditional secret disclosure (CDS) schemes.

[0015] In addition, the multiple clients may be members of either set A or set B, which have the same number of members, and if they are members of set A, they may have a preference order for each member of set B, and if they are members of set B, they may have a preference order for each member of set A, and may transmit to the verification device information indicating the preference order and the matching pair partner, as well as an encoded output of a common secret and randomness.

[0016] In addition, the two conditional secret disclosure (CDS) schemes may be a CDS scheme for unstable matching and a CDS scheme for stable matching, and the verification device may output a value equal to the common secret only if matching between the multiple clients is unstable when executing a procedure in the CDS scheme for unstable matching, and output a value equal to the common secret only if matching between the multiple clients is stable when executing a procedure in the CDS scheme for stable matching.

[0017] In addition, the verification method of the present invention is a verification method that has a verification device perform calculations in accordance with a protocol for verifying the result of a stable matching problem, the protocol defines procedures to be executed between multiple clients and the verification device, functions even in a setting of a malicious adversary, and is composed of two conditional secret disclosure (CDS) schemes.

[0018] In addition, a verification program according to the present invention is a verification program that causes a computer to perform calculations in accordance with a protocol for verifying the result of a stable matching problem, the protocol defines procedures to be executed between multiple clients and the computer, functions even in a malicious adversary setting, and is composed of two conditional secret disclosure (CDS) schemes.

[0019] Furthermore, the verification system of the present invention is a verification system that performs processing and calculations in accordance with a protocol for verifying the results of a stable matching problem in multiple clients, and includes multiple client terminals operated by the multiple clients and a verification server, wherein the protocol defines procedures to be executed between the multiple client terminals and the verification server, functions even in the case of a malicious adversary setting, and is composed of two conditional secret disclosure (CDS) schemes. Effect of the Invention

[0020] Our method correctly verifies the result of the stable matching problem. Our method is constructed from a CDS scheme and does not require encryption. Since the secret of the CDS scheme is considered as a witness for verification, our method works even in the setting of a malicious adversary. [Brief description of the drawings]

[0021] [Figure 1] 1 is a conceptual diagram showing an entire verification system according to an embodiment. [Diagram 2] FIG. 1 illustrates a CDS scheme for unstable matching of an embodiment. [Diagram 3] FIG. 2 illustrates a CDS scheme for stable matching according to an embodiment. [Figure 4] FIG. 2 illustrates a verification protocol for stable matching of an embodiment. [Diagram 5] FIG. 13 is a diagram showing a specific example of a verification protocol according to an embodiment. [Figure 6] FIG. 13 is a diagram showing the continuation of the specific example of the verification protocol of the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] An overview of the verification system 1 is shown in Fig. 1. Fig. 1(A) shows the execution of the algorithm in the CDS scheme for unstable matching, and Fig. 1(B) shows the execution of the algorithm in the CDS scheme for stable matching. The details of these two CDS schemes will be described later.

[0023] Each client 10 that is a member of set A or set B receives a preference order (a i_1 ,…,a i_n ) or (b j_1 ,…,b j_n ), matching result M(a i ) or M(b j ), the encoded output of the common secret s and the randomness r is sent to the verification server 20. The verification server 20 performs calculations according to a verification protocol described below and outputs the results. The verification protocol uses two CDS schemes as building blocks: a CDS scheme for unstable matchings and a CDS scheme for stable matchings. In the following, the output of the verification server 20 when executing the algorithm in the CDS scheme for unstable matching is denoted as s 1 ´, and the output of the verification server 20 when executing the algorithm in the CDS scheme for stable matching is s 2 ´ is explained as follows.

[0024] Note that client 10 is both a member (person) of set A or set B and a terminal (client terminal) operated by a client as a person. However, since using the terms differently each time would be cumbersome, hereinafter the terms will be collectively referred to as client 10.

[0025] The CDS scheme of the present invention follows Definition 3 (see Non-Patent Document 2), and the verification protocol of the present invention follows Definition 4 of Multi-Client Verifiable Computation (MVC) (see Non-Patent Document 2). i Let be the domain of each input, S be the domain of the secret, and R be the domain of randomness.

[0026] Definition 3 (CDS): For k senders (clients) and 1 receiver (server), f:X 1 ×…×X kLet {0,1} be the condition, s be a secret from set S, and r be a randomness from set R chosen randomly with uniform distribution. Enc i Let be a probabilistic polynomial-time encoding algorithm (for all 1≦i≦k) and Dec be a deterministic decoding algorithm. The correctness and secrecy of the CDS must be such that

[0027] Correctness: f(x 1 ,…,x k )=1, X 1 ×…×X k All inputs from (x 1 ,…,x k ), Dec(x 1 ,…,x k ,Enc 1 (x 1 ,s,r),…,Enc k (x k ,s,r))=s

[0028] Confidentiality: f(x 1 ,…,x k )=0, X 1 ×…×X k Input from (x 1 ,…,x k ), for a secret s from set S and randomness r from set R, there exists a polynomial-time algorithm Sim whose distributions are indistinguishable. {Sim(x 1 ,…,x k )}={Enc 1 (x 1 ,s,r),…,Enc k (x k ,s,r)}

[0029] If the input satisfies the conditions of the blocking pair, the server can compute secret s. If the input does not satisfy the conditions of the blocking pair, the server cannot compute anything about secret s.

[0030] Definition 4 (MVC): Consider a setup with k clients. The i-th client receives input α i have f(α 1 ,…,α k MVC consists of the following four algorithms, which aim to calculate

[0031] δ←Setup: The algorithm Setup generates a randomness δ common to all clients.

[0032] (α i ',τ i )←Input(α i ,δ,1 λ ): The algorithm Input is the input α i , the common randomness δ, and the security parameter 1 λ Using the above, the coding input α i ´ and the decryption secret τ i Generate.

[0033] (β 1 ,…,β k )←Compute(f,α 1 ´,…,α k ´): The algorithm Compute is a description of a function f and an encoded input α 1 ´,…,α k ', the encoded output β 1 ,…,β k Generate.

[0034] y←Verify(β i , τ i ): The algorithm Verify checks the encoded output β i and the decryption secret τ i to produce a result y, which is ⊥ if the protocol is aborted.

[0035] The soundness of the protocol is defined as follows: Health: All inputs (α1 ,…,α k ) and for the malicious server, δ←Setup,(α i ',τ i )←Input(α i ,δ,1 λ ), (β 1 ,…,β k )←Compute(f,α 1 ´,…,α k ´) and for all 1≦i≦k, y→Verify(β i , τ i )).

[0036] Pr[y≠f(α 1 ,…,α k )∧y≠⊥]≦negl(λ) must hold, where negl is a negligible function, which in the limit grows much slower than any polynomial.

[0037] The probability that the server will successfully output an incorrect result is negligible in any case.

[0038] Furthermore, we use Sharmir's secret shares (see Non-Patent Document 3) as a building block of the CDS scheme for stable matching (Figure 3). To generate shares, we first randomly generate a polynomial p(x) of degree t in a particular prime field with the secret s as a constant term. For each 1≦i≦k, the i-th share can be generated as p(i). The reconstruction process is performed by interpolating the polynomial p(x) of degree t, so t+1 shares p(i) are required. (x 0 ,y 0 =p(x 0 ))…(x k-1 ,y k-1 =p(x k-1 ) then the secret s can be found by calculating the following formula:

[0039]

number

[0040] CDS scheme for unstable matching: A conditional secret disclosure (CDS) scheme for unstable matchings is proposed in Figure 2. The goal of this CDS scheme is to allow the server to compute the secret s if and only if the matching M is an unstable matching.

[0041] Each client 10 that is a member of set A or set B receives a preference order (a i_1 ,…,a i_n ) or (b j_1 ,…,b j_n ), matching result M(a i ) or M(b j ), common secrets 1 and randomness r 1 Enc a_i Or Enc b_j 1 to the verification server 20. As a result, the verification server 20 has the preference orders of all clients 10 and the perfect matching results M.

[0042] The procedure (algorithm) executed between the client 10 and the verification server 20 in the CDS scheme for unstable matching includes the following three steps. In the first step, member a i Each client 10 represents M(a i ) is preferred to each member b i_k On the other hand, client 10 uses the tuple (a i ,b i_k ,s 1 -r i,i_k ) for every tuple. a_i and is sent to the verification server 20. Note that a "tuple" means an ordered set of multiple objects.

[0043] In the second step, member b j For each client 10 representing M(bj), j_k On the other hand, client 10 uses the tuple (a j_k,b j ,r j_k,j ) for every tuple. b_j and is sent to the validation server 20.

[0044] In the third step, the decryption algorithm is a_i Blocking pairs from (a i ,b j ,s 1 -r i,j ) and Enc b_j Blocking pairs from (a i ,b j ,r i,j ), the verification server 20 1 ´ as (s 1 -r i,j )+(r i,j )=s 1 If there is no blocking pair, the validation server 20 outputs a random value.

[0045] CDS Scheme for Stable Matching: A conditional secret disclosure (CDS) scheme for stable matchings is proposed in Figure 3. The goal of this CDS scheme is to allow the server to compute the secret s if and only if the matching M is a stable matching.

[0046] Each client 10 selects a preference order (a i_1 ,…,a i_n ) or (b j_1 ,…,b j_n ), matching result M(a i ) or M(b j ), common secrets 2 , common randomness r 2 =(r k ) 1≦k≦2n^2-1 Enc a_i Or Enc b_j 1 to the verification server 20. As a result, the verification server 20 has the preference orders of all clients 10 and the perfect matching results M.

[0047] The procedure (algorithm) executed between the client 10 and the verification server 20 in the CDS scheme for stable matching includes the following four steps. In the first step, all clients 10 2 Polynomial p(x) of -1=Σ i=1 to 2n^2-1 x i +s=r (2n^2-1) x (2n^2-1) +…+r 1 x 1 +s 2 Generate.

[0048] In the second step, member a i Each client 10 represents M(a i ) is preferred to each member b i_k For tuple (i(n+1) 2 +i k (n+1), p(i(n+1) 2 +i k (n+1))) is generated. i ) is preferred or disliked by each member b i_z On the other hand, client 10 receives tuple (i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1))) for every tuple. a_i and sent to the validation server 20.

[0049] In the third step, member b j Each client 10 represents M(b j ) is preferred to each member a j_k For tuple (j k (n+1) 2 +j(n+1),p(j k (n+1) 2 +j(n+1))) is generated. j ) is preferred or disliked by each member a j_zOn the other hand, client 10 uses tuple (j z (n+1) 2 +j(n+1)+2,p(j z (n+1) 2 +j(n+1)+2)) for every tuple. b_j and sent to the validation server 20.

[0050] In the fourth step, for the decryption algorithm, if there is no blocking pair, the verification server 20 2 Then, the verification server 20 can obtain different tuples (x, p(x)) by interpolation. i=1 to 2n^2-1 x i +s 2 Restore s 2 ´As a secret 2 If there is at least one blocking pair, 2n 2 Since it is not possible to obtain distinct tuples (x, p(x)) and interpolation is not possible, the validation server 20 outputs a random value.

[0051] Verification protocol for stable matching: A verification protocol for stable matching is proposed in Figure 4. The goal is to allow each client to calculate whether the matching result is stable or not.

[0052] This verification protocol uses as a building block the CDS scheme shown in Figure 2 and Figure 3. Even if a malicious server tries to change the verification result by returning random values, the probability that the server will succeed in outputting an incorrect result is negligible.

[0053] Each client 10 selects a preference order (a i_1 ,…,a i_n ) or (b j_1 ,…,b j_n ) and the matching result M(a i ) or M(b j The verification server 20 has the preference orders of all the clients 10 and the results M of perfect matching. The procedure (algorithm) defined by the verification protocol includes the following four steps:

[0054] The first step is the Setup algorithm: δ = (s 1 ,s 2 ,r 1 ,r 2 )→Setup. Client 10 uses the shared secret (s 1 ,s 2 ) and common randomness (r 1 ,r 2 ) from a multi-party protocol or a common source of randomness. The validation server 20 does not know these values.

[0055] The second step is the Input Algorithm:(α i ',τ i ) → Input(α i ,δ,1 λ ). Client 10 is a secret 1 and randomness r 1 We implement the CDS scheme for unstable matching (Figure 2) using the secret s 2 and randomness r 2 We implement the CDS scheme for stable matching (Figure 3) using i contains all inputs of i, and α i ´ contains all CDS messages of i, and τ i =(s1,s2).

[0056] The third step is the Compute algorithm: (βi) i in A∪B ←Compute(f,{αi´} i in A∪B ). The verification server 20 calculates the output value s based on the two CDS schemes. 1 ´ and s 2 ' is calculated, where β i =(s 1 ´,s 2 ´).

[0057] The fourth step is the Verify algorithm: y←Verify(β i , τ i ). s 1 ´=s 1 In this case, all clients 10 output "not a stable matching (unstable matching)". 2 ´=s 2 If so, all clients 10 output "stable matching". Otherwise, they output ⊥.

[0058] 5 and 6 are diagrams showing a specific example of the verification protocol. In this example, n=3 clients a 1 , a 2 and a 3 group and client b 1 , b 2 and b 3 The groups are members of set A and set B, respectively. That is, 2n=6, A={a 1 ,a 2 ,a 3}, B={b 1 ,b 2 ,b 3}.

[0059] The order of preference for each client is as follows: a 1 :(b 2 ,b 1 ,b 3 ), a 2 :(b 3 ,b 2 ,b 1 ), a 3 :(b 1 ,b 3 ,b 2 ) b 1 :(a 2 ,a 1 ,a 3 ), b 2 :(a 3 ,a 2 ,a 1 ), b 3 :(a1 ,a 3 ,a 2 )

[0060] FIG. 5 shows a specific example of the case where matching M is an unstable matching, and shows the output of the verification server 20 in a CDS for an unstable matching, the output of the verification server 20 in a CDS for a stable matching, and the output of the client 10 in the verification protocol.

[0061] In the case of Figure 5, the matching M is defined as M={(a 1 ,b 2 ),(a 2 ,b 1 ),(a 3 ,b 3 )}. In this case, the matching M is M(a 2 )=b 1 However, client a 2 According to the preference order, client a 2 is client b 1 More than client B 2 (Condition (1)). Also, M(b 2 )=a 1 However, client b 2 According to the preference order, client b 2 is client a 1 More than client a 2 (Condition (2)). That is, since the blocking pair conditions (1) and (2) are satisfied, in the matching M in this case, (a 2 ,b 2 ) are blocking pairs, and the matching M is unstable.

[0062] In the CDS scheme for unstable matching, every client 10 has a secret s 1 and randomness (r i,j ) 1≦i,j≦n Here, s 1 = 7, r 1,3 =8, r 2,2 =3, r 2,3 =6, r3,1 =1, r 3,2 =0 (other than these r i,j (omitted).

[0063] Here, each client a i or b j But there is a matching partner M(a i )=b i Or M(b j )=a j Consider who you would prefer to be with Client a 1 There is no such person in the client a. 2 M(a 2 )=b 1 Client B prefers 3 , b 2 There is a client a 3 M(a 3 )=b 3 Client B prefers 1 Also, client b 1 There is no such person in the client b. 2 M(b 2 )=a 1 Clients prefer a 3 , a 2 There is a client b 3 M(b 3 )=a 3 Clients prefer a 1 There are.

[0064] In the first step of the CDS scheme for unstable matching, client a 1 M(a 1 )=b 2 Since there is no one who prefers it over client a, 1 does not send anything to the verification server 20. Client A 2 is M(a 2 )=b 1 Client B prefers 3 Tuple(a 2 ,b 3 ,s 1 -r 2,3)=(2,3,1) and M(a 2 )=b 1 Client B prefers 2 Tuple(a 2 ,b 2 ,s 1 -r 2,2 )=(2,2,4) is sent to the verification server 20. Client A 3 is M(a 3 )=b 3 Client B prefers 1 Tuple(a 3 ,b 1 ,s 1 -r 3,1 )=(3,1,6) is sent to the verification server 20.

[0065] Similarly, in the second step, client b 1 M(b 1 )=a 2 Since there is no one who prefers it over client b, 1 does not send anything to the verification server 20. Client B 2 is M(b 2 )=a 1 Clients prefer a 3 Tuple(a 3 ,b 2 ,r 3,2 )=(3,2,0) and M(b 2 )=a 1 Clients prefer a 2 Tuple(a 2 ,b 2 ,r 2,2 )=(2,2,3) is sent to the verification server 20. Client B 3 is M(b 3 )=a 3 Clients prefer a 1 Tuple(a 1 ,b 3 ,r 1,3 )=(1,3,8) is sent to the verification server 20.

[0066] Also in the third step, the verification server 20 2 ,b 2 ,s 1 -r 2,2 ) and (a 2 ,b 2 ,r 2,2 ) to s 1 ´=(s 1 -r 2,2 )+r 2,2 Calculate =4+3=7 and output it to each client 10.

[0067] On the other hand, in the CDS scheme for stable matching, s 2 = 9, r = (r k ) 1≦k≦2n^2-1 =1. In the first step of the CDS scheme for stable matching, all clients 10 have 2 Polynomial p(x)=Σ with -1=17 i=1 to 2n^2-1 x i +s 2 =r 17 x 17 +…+r 1 x 1 Generates +9.

[0068] Here, each client a i or b j But there is a matching partner M(a i )=b i Or M(b j )=a j Consider who you prefer more than, and who you like equally or less than. 1 M(a 1 )=b 2 There is no partner that is preferred, and there is client b that is preferred equally or less. 2 , b 1 , b 3 There is a client a 2 M(a 2 )=b 1 Client B is preferred over 3 , b 2and client b who is equally or less preferred. 1 There is a client a 3 M(a 3 )=b 3 Client B is preferred over 1 and client b who is equally or less preferred. 3 , b 2 Also, client b 1 M(b 1 )=a 2 There is no preferred partner, and the only partner that is equally preferred or less preferred is client a. 2 , a 1 , a 3 There is a client b 2 M(b 2 )=a 1 Preferred partner to client A 3 , a 2 There are two people who like it equally or less. 1 There is a client b 3 M(b 3 )=a 3 Preferred partner to client A 1 There are two people who like it equally or less. 3 , a 2 There are.

[0069] In the second step of the CDS scheme for stable matching, client a 1 is M(a 1 )=b 2 Client B likes it as much as 2 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(25,6) and M(a 1 )=b 2 Client B prefers 1 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1)2 +i z (n+1)+1)))=(21,51) and M(a 1 )=b 2 Client B prefers 3 Tuple (i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(29, 95) is sent to the verification server 20. Client A 2 is M(a 2 )=b 1 Client B prefers 3 Tuple(i(n+1) 2 +i k (n+1), p(i(n+1) 2 +i k (n+1)))=(44,79) and M(a 2 )=b 1 Client B prefers 2 Tuple(i(n+1) 2 +i k (n+1), p(i(n+1) 2 +i k (n+1)))=(40,10) and M(a 2 )=b 1 Client B likes it as much as 1 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(37, 54) is sent to the verification server 20. Client A 3 is M(a 3 )=b 3 Client B prefers 1 Tuple(i(n+1) 2 +i k (n+1), p(i(n+1) 2 +i k (n+1)))=(52,90) and M(a 3 )=b 3 Client B likes it as much as3 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(61,8) and M(a 3 )=b 3 Client B prefers 2 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(57, 69) is sent to the verification server 20.

[0070] Similarly, in the third step, client b 1 is M(b 1 )=a 2 Client a likes it as much as 2 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(38,13) and M(b 1 )=a 2 Client a does not prefer 1 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(22,31), and M(b 1 )=a 2 Client a does not prefer 3 Tuple (i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(54, 46) is sent to the verification server 20. Client B 2 is M(b 2 )=a 1 Clients prefer a 3 Tuple(i(n+1) 2+i k (n+1), p(i(n+1) 2 +i k (n+1)))=(56,6) and M(b 2 )=a 1 Clients prefer a 2 Tuple(i(n+1) 2 +i k (n+1), p(i(n+1) 2 +i k (n+1)))=(40,10), and M(b 2 )=a 1 Client a likes it as much as 1 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(26, 82) is sent to the verification server 20. Client B 3 is M(b 3 )=a 3 Clients prefer a 1 Tuple(i(n+1) 2 +i k (n+1), p(i(n+1) 2 +i k (n+1)))=(28,40), and M(b 3 )=a 3 Client a likes it as much as 3 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(62,8) and M(b 3 )=a 3 Client a does not prefer 2 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(46,17) is sent to the verification server 20.

[0071] The verification server 20 receives the 2 Received from client b 2 tuple for client b 2 Received from client a 2 The tuples for are both duplicated at (40,10) (this is because 2 ,b 2 ) is a blocking pair. Therefore, since there are only 17 unique tuples transmitted from all clients 10 to the verification server 20, in the fourth step of the CDS scheme for stable matching, the verification server 20 cannot perform the interpolation calculation and cannot recover p(x). 2 ´ as (s 2 = 9) to each client 10.

[0072] In the fourth step of the verification protocol, each client 10 receives the s 1 ´=s 1 (=7) and (67=)s 2 ´≠s 2 (=9). As a result, each client 10 concludes that matching M is unstable.

[0073] FIG. 6 is a diagram showing a continuation of the specific example, and shows what the output of the verification server 20 in a CDS for an unstable matching, the output of the verification server 20 in a CDS for a stable matching, and the output of the client 10 in the verification protocol will be when the matching M is a stable matching.

[0074] In the case of FIG. 6, the preference order of each client 10 is the same as that of FIG. 5, but the matching M is set as M={(a 1 ,b 1 ),(a 2 ,b 2 ),(a 3 ,b 3In this case, the conditions (1) and (2) for a blocking pair are not satisfied, and no blocking pair exists.

[0075] In the CDS scheme for unstable matching, every client 10 has a secret s 1 and randomness (r i,j ) 1≦i,j≦n Here, s 1 = 7, r 1,2 = 2, r 1,3 =8, r 2,1 = 4, r 2,3 =6, r 3,1 =1, r 3,2 =0 (other than these r i,j (omitted).

[0076] Here, each client a i or b j But there is a matching partner M(a i )=b i Or M(b j )=a j Consider who you would prefer to be with Client a 1 M(a 1 )=b 1 Client B prefers 2 There is a client a 2 M(a 2 )=b 2 Client B prefers 3 There is a client a 3 M(a 3 )=b 3 Client B prefers 1 Also, client b 1 M(b 1 )=a 1 Clients prefer a 2 There is a client b 2 M(b 2 )=a 2 Clients prefer a 3 There is a client b 3 M(b 3 )=a 3 Clients prefer a1 There are.

[0077] In the first step of the CDS scheme for unstable matching, client a 1 is M(a 1 )=b 1 Client B prefers 2 For tuple(a 1 ,b 2 ,s 1 -r 1,2 )=(1,2,5) is sent to the verification server 20. Client A 2 is M(a 2 )=b 2 Client B prefers 3 Tuple(a 2 ,b 3 ,s 1 -r 2,3 )=(2,3,1) is sent to the verification server 20. Client A 3 is M(a 3 )=b 3 Client B prefers 1 Tuple(a 3 ,b 1 ,s 1 -r 3,1 )=(3,1,6) is sent to the verification server 20.

[0078] Similarly, in the second step, client b 1 is M(b 1 )=a 1 Clients prefer a 2 For tuple(a 2 ,b 1 ,r 2,1 )=(2,1,4) is sent to the verification server 20. Client B 2 is M(b 2 )=a 2 Clients prefer a 3 Tuple(a 3 ,b 2 ,r 3,2 )=(3,2,0) is sent to the verification server 20. Client B 3 is M(b 3 )=a 3 Clients prefer a 1 Tuple(a 1 ,b 3 ,r 1,3 )=(1,3,8) is sent to the verification server 20.

[0079] Also in the third step, the verification server 20 checks whether there is a blocking pair s 1 Since it is not possible to calculate s 1 ´ is a random value 38(s 1 (not equal to ) to each client 10.

[0080] On the other hand, in the CDS scheme for stable matching, s 2 = 9, r = (r k ) 1≦k≦2n^2-1 =1. In the first step of the CDS scheme for stable matching, all clients 10 have 2 Polynomial p(x)=Σ with -1=17 i=1 to 2n^2-1 x i +s 2 =r 17 x 17 +…+r 1 x 1 Generates +9.

[0081] Here, each client a i or b j But there is a matching partner M(a i )=b i Or M(b j )=a j Consider who you prefer more than, and who you like equally or less than. 1 M(a 1 )=b 1 Client B is the preferred partner 2 and client b who is equally or less preferred. 1 , b 3 There is a client a 2M(a 2 )=b 2 Client B is preferred over 3 and client b who is equally or less preferred. 2 , b 1 There is a client a 3 M(a 3 )=b 3 Client B is preferred over 1 and client b who is equally or less preferred. 3 , b 2 Also, client b 1 M(b 1 )=a 1 Preferred partner: Client A 2 There are two people who like it equally or less. 1 , a 3 There is a client b 2 M(b 2 )=a 2 Preferred partner to client A 3 There are two people who like it equally or less. 2 , a 1 There is a client b 3 M(b 3 )=a 3 Preferred partner to client A 1 There are two people who like it equally or less. 3 , a 2 There are.

[0082] In the second step of the CDS scheme for stable matching, client a 1 is M(a 1 )=b 1 Client B prefers 2 Tuple(i(n+1) 2 +i k (n+1), p(i(n+1) 2 +i k (n+1)))=(24,37) and M(a 1 )=b 1Client B likes it as much as 1 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(21,51) and M(a 1 )=b 1 Client B prefers 3 Tuple (i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(29, 95) is sent to the verification server 20. Client A 2 is M(a 2 )=b 2 Client B prefers 3 Tuple(i(n+1) 2 +i k (n+1), p(i(n+1) 2 +i k (n+1)))=(44,79) and M(a 2 )=b 2 Client B likes it as much as 2 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(41,78) and M(a 2 )=b 2 and clients who don't like it as much as B 1 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(37, 54) is sent to the verification server 20. Client A 3 is M(a 3 )=b 3 Client B prefers 1 Tuple(i(n+1) 2 +i k (n+1), p(i(n+1)2 +i k (n+1)))=(52,90) and M(a 3 )=b 3 Client B likes it as much as 3 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(61,8) and M(a 3 )=b 3 Client B prefers 2 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(57, 69) is sent to the verification server 20.

[0083] Similarly, in the third step, client b 1 is M(b 1 )=a 1 Clients prefer a 2 Tuple(i(n+1) 2 +i k (n+1), p(i(n+1) 2 +i k (n+1)))=(36,8) and M(b 1 )=a 1 Client a likes it as much as 1 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(22,31), and M(b 1 )=a 1 Client a does not prefer 3 Tuple (i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(54, 46) is sent to the verification server 20. Client B 2is M(b 2 )=a 2 Clients prefer a 3 Tuple(i(n+1) 2 +i k (n+1), p(i(n+1) 2 +i k (n+1)))=(56,6) and M(b 2 )=a 2 Client a likes it as much as 2 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(42,17) and M(b 2 )=a 2 Client a does not prefer 1 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(26, 82) is sent to the verification server 20. Client B 3 is M(b 3 )=a 3 Clients prefer a 1 Tuple(i(n+1) 2 +i k (n+1), p(i(n+1) 2 +i k (n+1)))=(28,40), and M(b 3 )=a 3 Client a likes it as much as 3 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +i z (n+1)+1)))=(62,8) and M(b 3 )=a 3 Client a does not prefer 2 Tuple(i(n+1) 2 +i z (n+1)+1,p(i(n+1) 2 +iz (n+1)+1)))=(46,17) is sent to the verification server 20.

[0084] In the case of FIG. 6, since there is no blocking pair, there are no duplicates among the 18 tuples received by the verification server 20 from all clients (that is, there are 18 unique tuples). Therefore, in the fourth step of the CDS scheme for stable matching, the verification server 20 calculates p(x)=Σ i=1 to 17 x i +9 can be restored. As a result, the verification server 20 2 ´as 2 The system outputs a value 9 equal to

[0085] In the fourth step of the verification protocol, each client 10 receives the (38=)s 1 ´≠s 1 (=7) and s 2 ´=s 2 (=9). As a result, each client 10 concludes that the matching M is stable.

[0086] In addition, in the case of a malicious adversary, the verification server 20 does not perform calculations according to the verification protocol. 1 ´ and s 2 If s1' and s2' are both random values, the random value happens to be s 1 and / or s 2 Since the probability of matching with is negligibly low, s 1 ´≠s 1 And s 2 ´≠s 2 So, s 1 ´≠s 1 And s 2 ´≠s 2 If the above case is treated as an error, it is possible to prevent the verification server 20 from outputting an incorrect verification result in the case of a malicious adversary.

[0087] Furthermore, since this invention does not require encryption, works even in a malicious adversary setting, and can correctly verify the results of stable matching problems, it can contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0088] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most typical effects resulting from the present invention, and the effects of the present invention are not limited to the effects described in the embodiments.

[0089] The verification of the result of the stable matching problem by the verification server (verification device) 20 is realized by calculation according to a verification protocol. This calculation is executed by commands of a verification program installed on the verification server (verification device) 20. This verification program may be distributed by being recorded on a removable medium such as a CD-ROM or DVD-ROM, or may be distributed by being downloaded to a server via a network. Furthermore, this verification program may be provided to the verification server 20 as a Web service via a network without being downloaded. [Explanation of symbols]

[0090] 1. Verification System 10 Client 20 Verification server (verification device)

Claims

1. A verification device that performs calculations according to a protocol for verifying a result of a stable matching problem among multiple clients, comprising: The protocol comprises: defining a procedure to be executed between the plurality of clients and the verification device; It works even in a malicious adversary setup, It consists of two conditional confidentiality (CDS) schemes: Verification device.

2. The plurality of clients include A member of either set A or set B, which have the same number of members; if it is a member of set A, it has a preference order for each member of set B, and if it is a member of set B, it has a preference order for each member of set A; transmitting to the verification device the preference order and information indicative of the matching pair mates, as well as a coded output of a shared secret and randomness; The verification device according to claim 1 .

3. The two conditional secret disclosure (CDS) schemes are a CDS scheme for unstable matchings and a CDS scheme for stable matchings, The verification device includes: When executing a procedure in the CDS scheme for unstable matching, outputting a value equal to the common secret only if the matching between the plurality of clients is unstable; When executing the procedure in the CDS scheme for stable matching, output a value equal to the common secret only if matching between the multiple clients is stable. The verification device according to claim 2 .

4. A verification method for verifying a result of a stable matching problem among a plurality of clients, the method comprising: The protocol comprises: defining a procedure to be executed between the plurality of clients and the verification device; It works even in a malicious adversary setup, It consists of two conditional confidentiality (CDS) schemes: Verification method.

5. A verification program that causes a computer to perform calculations in accordance with a protocol for verifying results of a stable matching problem among multiple clients, comprising: The protocol comprises: defining procedures to be executed between said plurality of clients and said computer; It works even in a malicious adversary setup, It consists of two conditional confidentiality (CDS) schemes: Verification program.

6. A verification system that performs processing and calculations according to a protocol for verifying results of a stable matching problem among multiple clients, comprising: the verification system includes a plurality of client terminals operated by the plurality of clients and a verification server; The protocol comprises: defining a procedure to be executed between the plurality of client terminals and the verification server; It works even in a malicious adversary setup, It consists of two conditional confidentiality (CDS) schemes: Verification system.

Images