Confidential statistics processing system and confidential statistics processing method

Abstract

To provide data while ensuring data confidentiality, without having concern that an alternative encryption algorithm may be compromised.SOLUTION: A confidential statistics processing system includes: a registration machine including a data encryption processing unit that creates encrypted data obtained by encrypting plaintext data with common key encryption by using a private key of a common key, and an encrypted data creation unit that creates the encrypted data obtained by encrypting the private key and the encrypted data with searchable encryption; and a providing machine that manages the encrypted data encrypted with the searchable encryption.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a private statistical processing system and a private statistical processing method, and is suitable for application to, for example, a private statistical processing system relating to a technique for performing statistical processing while ensuring the confidentiality of data. [Background technology]

[0002] When performing data processing on the cloud, both the convenience of entrusting data processing to the cloud and the risk of information leakage from the cloud must be considered. Therefore, the use of technology that performs statistical processing in an encrypted state has attracted attention. For example, Patent Document 1 discloses an encryption technology that allows data to be searched while still encrypted. With this method, only basic searches can be performed, and calculation processing such as summing cannot be performed. Non-Patent Documents 1 and 2 disclose a technology that performs calculations such as sums and standard deviations as data processing while ensuring the confidentiality of data using unique encryption technology on the cloud. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 4512414 [Non-patent literature]

[0004] [Non-Patent Document 1] Mis-operation Resistant Searchable Homomorphic Encryption. AsiaCCS 2017, 215-229 Keita Emura, Takuya Hayashi, Noboru Kunihiro, Jun Sakuma [Non-Patent Document 2] "Don't Mix Risky Homomorphic Encryption" CCS2016 60-67, Keita Emura, Takuya Hayashi, Noboru Kunihiro, Jun Sakuma Summary of the Invention [Problem to be solved by the invention]

[0005] However, as described above, the technologies described in Non-Patent Document 1 and Non-Patent Document 2 make it possible to perform calculations such as summation while keeping the data encrypted. However, since the technologies use unique encryption technology, there is a concern that there may be no alternative encryption technology in the event that the encryption algorithm of the unique encryption technology is compromised.

[0006] The present invention has been made in consideration of the above points, and aims to propose a confidential statistical processing system and a confidential statistical processing method that can provide data while ensuring the confidentiality of the data, without concern that alternative encryption algorithms may be compromised. [Means for solving the problem]

[0007] In order to solve such problems, the present invention comprises a registration machine having a data encryption processing unit that uses a secret key of a common key cipher to create encrypted data by encrypting plain text data with the common key cipher, and an encrypted data creation unit that encrypts the private key and encrypted data with a searchable cipher to create encrypted data, and a provider machine that manages the encrypted data encrypted with the searchable cipher.

[0008] In addition, in the present invention, the method includes a data encryption processing step in which a data encryption processing unit of a registration device uses a private key of a common key cipher to create encrypted data by encrypting plain text data with the common key cipher, an encrypted data creation step in which an encrypted data creation unit of the registration device encrypts the private key and encrypted data with a searchable cipher to create encrypted data, and a management step in which a provider device manages the encrypted data encrypted with the searchable cipher. Effect of the Invention

[0009] According to the present invention, data can be provided while ensuring the confidentiality of the data, without concern that an alternative encryption algorithm may be compromised. [Brief description of the drawings]

[0010] [Figure 1] 1 is a system configuration diagram showing an example of the configuration of a confidential statistical processing system according to a first embodiment. [Diagram 2] 2 is a block diagram showing an example of a hardware configuration of a registration machine, etc.; FIG. [Diagram 3] 2 is a block diagram showing an example of a software configuration of the confidential statistical processing system according to the first embodiment. FIG. [Figure 4A] FIG. 13 is a diagram showing an example of a plaintext database managed by a registration machine. [Figure 4B] FIG. 13 is a diagram illustrating an example of a secret database managed by the provider. [Figure 4C] FIG. 13 is a diagram illustrating an example of a plaintext query generated by the analyzer. [Figure 4D] FIG. 13 is a diagram illustrating an example of an encrypted query created by an analyzer. [Diagram 5] FIG. 4 is a sequence diagram illustrating an example of a procedure of a data registration process according to the first embodiment. [Figure 6] 6 is a flowchart showing an example of detailed procedures of some steps shown in FIG. 5. [Figure 7A] FIG. 13 is a diagram illustrating an example of the configuration of a confidential database. [Figure 7B] FIG. 13 is a diagram showing an example of a hit obtained during a search in a secret database. [Figure 8] FIG. 11 is a sequence diagram showing an example of a procedure of data acquisition processing in the confidential statistical processing system according to the present embodiment. [Figure 9] 9 is a flowchart mainly showing details of specific processing procedures of some steps shown in FIG. 8. [Figure 10] 13 is a flowchart showing an example of a procedure for creating an encrypted data group in the secret statistical processing system according to the second embodiment. [Figure 11] 9 is a flowchart mainly showing details of specific processing procedures of some steps shown in FIG. 8. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0012] (1) Encryption method used in each embodiment In this embodiment, for example, the following elements and functions are used.

[0013] (1-1) Registration machine This refers to any or all of registered unit a, registered unit b, ..., registered unit n.

[0014] (1-2) Symmetric Encryption (SE) In this embodiment, the functions of a key generation function Gen, an encryption function Enc, and a decryption function Dec are used to generate a key and encrypt and decrypt data. As representative common key encryption, AES encryption, 3DES encryption, etc. are known.

[0015] The key generation function Gen receives a security parameter λ as input and outputs a common key sk. SE.Gen(λ) → sk The encryption function Enc receives a common key sk and data d as input, and outputs encrypted data ED. SE.Enc(sk,d) →ED The decryption function Dec takes the common key sk and the encrypted data ED as input, and outputs plaintext data d. SE.Dec(sk,ED)→d

[0016] (1-3) ID-Based Encryption (IBE) In this embodiment, the functions of a key generation function Gen, an encryption function Enc, and a decryption function Dec are used to generate a key and encrypt and decrypt data. Many methods are known for this purpose, including the method proposed by Dan Boneh et al.

[0017] The key generation function Gen takes a security parameter λ and a plaintext query q as input, and outputs a secret key sk_q. IBE.Gen(λ,d) →sk_q The encryption function Enc takes a plaintext query q and plaintext data d as input, and outputs encrypted data IED. IBE.Enc(q,d) → IED The decryption function Dec receives the decryption key sk_q and the encrypted data IED as input, and outputs plaintext data d. IBE.Dec(sk_q,IED) →d (1-4) Secure Searchable Encryption (SSE) In this embodiment, the functions of a key generation function Gen, an encryption function Enc, a query encryption function Query, and a comparison function Cmp are used to process key generation, data encryption, query encryption, and comparison. Many methods are known for this purpose, including the method proposed by Reza Curtmola.

[0018] The key generation function Gen receives a security parameter λ as input and outputs an encryption key sek and a query encryption key sqk. SSE.Gen(λ) → sek,sqk

[0019] The encryption function Enc receives the encryption key sek and the plaintext data d as input, and outputs the encrypted data SED. SSE.Enc(sek,d) → SED

[0020] The query encryption function Query takes a query encryption key sqk and a plaintext query q as input, and outputs an encrypted query SEQ. SSE.Qeury(sqk,q) → SEQ

[0021] The comparison function Cmp receives the encrypted query SEQ and the encrypted data SED as input, and outputs 1 if d=q, and 0 if d≠q. SSE.Cmp(SEQ,SED) → 1 (when d=q) or 0 (when d≠q)

[0022] (1-5) Homomorphic Encryption In this embodiment, in order to enable key generation, data encryption and decryption, and additive calculation, it has functions such as a key generation function Gen, an encryption function Enc, a decryption function Dec, and an additive function Add. Many methods are known for this purpose, including the method proposed by Pascal Paillier.

[0023] The key generation function Gen receives a security parameter λ as input and outputs an encryption key hek and a decryption key hdk. HE.Gen(λ) → hek,hdk

[0024] The encryption function Enc takes the encryption key hek and plaintext data d as input, and outputs the data while ensuring its confidentiality. HE.Enc(hek,d) → HED

[0025] The decryption function Dec receives the decryption key hdk and the encrypted data HED as input, and outputs plaintext data d. HE.Dec(hdk,HED)→d

[0026] The number of encrypted data HED input to the additive function Add is arbitrary. Encrypted data HED1, encrypted data HED2, ..., encrypted data HEDn are input, and the encrypted data HEDsum is obtained by adding plaintext data d1, plaintext data d2, ..., plaintext data dn. HE.Add(HED1,HED2,...,HEDn)→ HEDsum= Enc(hek,d1+d2+...dn) However, HE.Enc(hek,d1) → HED1, HE.Enc(hek,d2) → HED2, and HE.Enc(hek,dn) → HEDn.

[0027] The multiplication function Mul receives the encrypted data HED1 and the encrypted data HED2 as input, performs an operation on the plaintext data d1 and the plaintext data d2, and obtains the encrypted data HEDprd as a result. HE.Mul(HED1,HED2)→ HEDprd = Enc(hek,d1×d2)

[0028] In the above example, the above-mentioned ID-based encryption IBE, searchable encryption SSE, and homomorphic encryption HE are described as schemes using different keys, but the keys do not necessarily need to be separated, and the same key may be used. Hereinafter, this embodiment will be specifically described. In this embodiment, the above-mentioned matters, for example, "encrypted data HED" and the like are simplified in expression, and when there is no particular need to specify, "HED" and the like may be omitted and written simply as "encrypted data" and the like.

[0029] (1-6) Specific example of the first embodiment 1 is a system configuration diagram showing an example of the configuration of a confidential statistical processing system according to the first embodiment. The confidential statistical processing system according to the first embodiment includes at least registration machines 100a-100n used by registrants 1a-1n at registration businesses 10a-10n, a provider machine 200 that provides data as a service business 20, and analysis machines 300a-300n used by analysts 3a-3n at analysis businesses 30a-30n, and preferably includes a distribution machine 500 of a key management authority 50.

[0030] The registration machines 100a to 100n, the provider machine 200, the analyzers 300a to 300n, and the distribution machine 500 are connected to one another via a network 400. In the following, as an example, the distribution machine 500 will be described as distributing each key to a distribution destination, but instead, each key may be distributed to the distribution destination in advance.

[0031] In this embodiment, when there is no need to distinguish between the registration businesses 10a-10n, they will simply be referred to as the registration business 10, when there is no need to distinguish between the registration machines 100a-100n, they will simply be referred to as the registration machine 100, when there is no need to distinguish between the analysis businesses 30a-30n, they will simply be referred to as the analysis business 30, and when there is no need to distinguish between the analysis machines 300a-300n, they will simply be referred to as the analysis machine 300.

[0032] 2 is a block diagram showing an example of the hardware configuration of the registration machine 100, the provision machine 200, the analysis machine 300, and the distribution machine 500. The registration machine 100, the provision machine 200, the analysis machine 300, and the distribution machine 500 are, for example, computers, and are configured with substantially similar hardware, so the registration machine 100 will be described below as an example.

[0033] The registration device 100 includes a CPU 101, a memory 102, a storage device 103, an input device 105, an output device 106, a reading / writing device 107, and a communication device 108. The CPU 101, the memory 102, the storage device 103, the input device 105, the output device 106, the reading / writing device 107, and the communication device 108 are connected by an internal signal line 104, and data and programs are exchanged among them via the internal signal line 104. The storage device 103 stores programs and data. The programs are loaded from the storage device 103 to the memory 102 and executed by the CPU 101. The programs may be stored in an external storage device (not shown).

[0034] 3 is a block diagram showing an example of the software configuration of the private statistical processing system according to the first embodiment. The distribution machine 500 includes a key database 500A and a distribution unit 500B. The key database 500A manages, for example, a private key for common key encryption, a key for searchable encryption, and a key for homomorphic encryption. In response to a request, the distribution machine 500 distributes, for example, a private key, a key for searchable encryption, and a key for homomorphic encryption to a request source.

[0035] The registration device 100 comprises a plaintext database 100A, a plaintext extraction unit 100B, and an encryption processing unit 100C. Plaintext data is stored in the plaintext database 100A. The plaintext extraction unit 100B extracts plaintext data including at least one of name, alma mater, annual salary, and years of service as examples of attributes to be encrypted from the plaintext database 100A. Hereinafter, these are referred to as a "plaintext data group." The plaintext extraction unit 100B (data encryption processing unit) specifies plaintext data to be encrypted from the plaintext data group.

[0036] The encryption processing unit 100C encrypts the specified plaintext data using the common key of the common key encryption, and converts it into encrypted data. In this embodiment, for example, encrypted data obtained by encrypting plaintext data "University A" is represented as "E(···)", such as "E(University A)". In this embodiment, the encrypted data of a specified plaintext data group is also represented as an "encrypted data group".

[0037] Here, in the registration device 100, the encryption processing unit 100C (data encryption processing unit) encrypts the plaintext data (or encrypted data) using homomorphic encryption. The encrypted data encrypted using homomorphic encryption has a feature that it is possible to perform calculations on the data even though the data is kept secret by the encryption.

[0038] In the registration device 100, the encryption processing unit 100C is an example of a data encryption processing unit, and uses a private key of the common key encryption to encrypt plain data (e.g., "University A") with the common key encryption to generate encrypted data (e.g., "E (University A)"). Note that the private key may be generated by the encryption processing unit 100C itself.

[0039] That is, in the registration device 100, the encryption processing unit 100C (data encryption processing unit) re-encrypts the encrypted data encrypted by the homomorphic encryption by the common key encryption to generate encrypted data.

[0040] The encryption processing unit 100C of the registration device 100 is an example of an encrypted data creation unit, and creates encrypted data by encrypting a private key and encrypted data with a searchable cipher. The encryption processing unit 100C transmits a set of an encrypted data group consisting of a plurality of encrypted data as described below, and an attribute, for example, at least one of name, alma mater, annual salary, and years of service, to the provider device 200 on the cloud, for example.

[0041] The providing device 200 includes a secret database 200A, a registration unit 200B, and a comparison unit 200C. The registration unit 200B registers pairs of encrypted data groups and attributes received from the registration device 100 in the secret database 200A. The secret database 200A manages encrypted data encrypted with a searchable cipher. Details of the secret database 200A will be described later.

[0042] The comparison unit 200C is an example of a comparison unit, and has a function of comparing the encrypted data with the encrypted query. The comparison unit 200C will be described in detail later.

[0043] The analysis device 300 includes a cryptographic processor 300A and an analysis unit 300C. The cryptographic processor 300A is an example of an encrypted query creation unit, and creates an encrypted query by encrypting a plaintext query to be analyzed with a searchable cipher. That is, the cryptographic processor 300A has a function of converting an attribute value of the plaintext query to be analyzed into an encrypted query. Details of the cryptographic processor 300A will be described later.

[0044] The provider 200 includes a calculation unit 200D, which is an example of a private key acquisition unit, and compares the encrypted data with the encrypted query using the comparison unit 200C, and acquires a private key from the encrypted data if the encrypted data encrypted with a searchable cipher is identical to the encrypted query (e.g., "E (A University)") encrypted with a searchable cipher. The calculation unit 200D is also an example of a data acquisition unit, and uses the acquired private key to decrypt the encrypted data and acquire plaintext data.

[0045] The encryption processing unit 100C of the registration device 100 is an example of a data encryption processing unit, and generates encrypted data by encrypting data encrypted by homomorphic encryption with common key encryption.

[0046] The providing machine 200 includes a calculation unit 200D, which is an example of a private key acquisition unit, and compares the encrypted data with the searchable encrypted query by the comparison unit 200C, and acquires a private key from the encrypted data if the encrypted data encrypted with the searchable encryption is identical to the encrypted query (e.g., "E (A University)"). The calculation unit 200D of the providing machine 200 is also an example of a data acquisition unit, which decrypts the encrypted data with the private key and acquires the encrypted data encrypted with homomorphic encryption.

[0047] In the provider 200, the calculation unit 200D (calculation result providing unit) performs calculation processing on the encrypted data encrypted by homomorphic encryption and provides the calculation result data to the analyzer 300. In the analyzer 300, the analysis unit 300C (statistics acquisition unit) decrypts the calculation result data provided from the provider 200 with the homomorphic encryption key to acquire statistics.

[0048] In the provider 200, the analysis unit 300C (computation result provider) acquires, as the computation result data, for example, one or more of the sum (addition), average, variance, and standard deviation, and provides the data to the analyzer 300. The analysis unit 300C will be described in detail later.

[0049] The registration machine 100 obtains the secret key of the common key encryption, the key of the searchable encryption, and the key of the homomorphic encryption from the distribution machine 500, and the analysis machine 300 obtains the key of the searchable encryption and the key of the homomorphic encryption from the distribution machine 500.

[0050] The registration machine 100 obtains the searchable encryption key and the homomorphic encryption key from the distribution machine 500. The analysis machine 300 obtains the searchable encryption key and the homomorphic encryption key from the distribution machine 500.

[0051] 4A shows an example of a plaintext database 100A managed by the registration device 100. The plaintext database 100A manages a plaintext data group 101A for registration. The plaintext data group 101A manages attributes such as nomination, alma mater, annual salary, and years of service. In this embodiment, the attribute value of any of these attributes may be collectively referred to as "data (plaintext data)."

[0052] 4B shows an example of the secret database 200A managed by the provider device 200. The secret database 200A manages an encrypted data group 201A for registration received from the registration device 100. Note that the encrypted data E(d) represents encrypted plaintext data d (e.g., "University A").

[0053] 4C shows an example of a plaintext query created by the analyzer 300. Here, the analyzer 300 creates a plaintext query of "University A" for the attribute "University".

[0054] 4D shows an example of an encrypted query created by the analysis device 300. Here, the analysis device 300 creates an encrypted query "E (University A)" as an encrypted query by encrypting the attribute "University" of the above plaintext data with query encryption as an example of searchable encryption.

[0055] In the initial setting of the confidential statistical processing system according to this embodiment, the distribution machine 500 sets the following necessary keys. Specifically, the distribution machine 500 generates, for example, a secret key sk_q of ID-based encryption IBE, which is a common key encryption, an encryption key sek of searchable encryption SSE, a query encryption key sek of query encryption, and an encryption key hek and a decryption key hdk of homomorphic encryption, and registers them in the key database 500A, according to a predetermined security parameter λ. Note that the distribution machine 500 may generate other keys for each encryption (for example, a decryption key of searchable encryption SSE, a query decryption key of query encryption, etc.) in accordance with the security parameter λ, register them in the key database 500A, and make them available.

[0056] In this embodiment, it is not essential that the distribution machine 500 generates a key and registers the key in the key database 500A. The distribution machine 500 may generate a key, for example, every time a request for a key is received. The distribution machine 500 may deliver all keys to the registration machine 100 and the analysis machine 300 in advance, and may not have the key database 500A. In the following, for the sake of simplicity, an example will be described in which the distribution machine 500 stores keys in the key database 500A in advance as a rule.

[0057] Fig. 5 is a sequence diagram showing an example of the procedure of data registration processing by the confidential statistical processing system according to the first embodiment, and Fig. 6 is a flowchart showing an example of the detailed procedure of step S430 shown in Fig. 5. Fig. 7A is a diagram showing an example of the configuration of the confidential database 200A. The registration machine 100, the provision machine 200, the analysis machine 300, and the distribution machine 500 shown in Fig. 5 perform the following processing via the network 400.

[0058] Specifically, in step S410, the registration machine 100 issues a key request (hereinafter also referred to as a "key request") to the distribution machine 500 for a key to encrypt a plaintext data group. In step S411, the distribution machine 500 receives the key request from the registration machine 100. In step S412, the distribution machine 500 selects a key corresponding to the key request from the key database 500A. In step S413, the distribution machine 500 transmits the key to the registration machine 100. In step S413, the registration machine 100 receives the key from the distribution machine 500.

[0059] In step S420, the plaintext extraction unit 100B of the registration device 100 selects at least one plaintext data from the plaintext database 100A and creates a plaintext data group consisting of multiple plaintext data. For example, as shown in Fig. 4A, the plaintext extraction unit 100B extracts plaintext data as one or more attribute values ​​consisting of name, alma mater, annual salary, and years of service as examples of attributes from the plaintext database 100A, and obtains a plaintext data group 101A consisting of these multiple plaintext data.

[0060] In step S430, in the registration device 100, the encryption processing unit 100C designates plaintext data to be encrypted from the plaintext data group 101A. The encryption processing unit 100C encrypts the designated plaintext data using a key to generate encrypted data. In this embodiment, for example, encrypted data obtained by encrypting plaintext data "A University" is expressed as "E (A University)". In this embodiment, the designated plaintext data repeatedly converted into encrypted data is also collectively referred to as "encrypted data group". FIG. 4B shows an encrypted data group 201A in which all plaintext data in the plaintext data group is converted into encrypted data. Hereinafter, the specific contents of step S430 will be specifically described with reference to FIG. 6.

[0061] First, the cryptographic processing unit 100C of the registration device 100 generates a value r corresponding to the above-mentioned plaintext data and a secret key sk of the common key cryptography SE (step S4301 in FIG. 6). SE.Gen(λ) → sk The private key sk may be obtained from the distributor 500 as described above.

[0062] The cryptographic processing unit 100C regards the data obtained by concatenating the value r and the secret key sk as plaintext data, and obtains encrypted data IED by encrypting the plaintext query q with ID-based encryption IBE, which is a common key cipher (step S4302). IBE.Enc(q,r||sk) → IED

[0063] In the registration device 100, the encryption processing unit 100C regards the encrypted element specified in step S4302 as plaintext data d, and encrypts it using the homomorphic encryption HE with the encryption key hek of the homomorphic encryption HE to obtain encrypted data HED that can be calculated while remaining encrypted (step S4303). HE.Enc(hek,d) → HED

[0064] In the registration device 100, the encryption processing unit 100C uses the private key sk to encrypt this encrypted data HED with the common key cipher SE, and obtains encrypted data ED encrypted with the common key cipher using the private key sk (step S4304). SE.Enc(sk,HED) →ED

[0065] In the registration device 100, if the encryption processing unit 100C finds that there is plaintext data that has not yet been encrypted, it returns to the above-mentioned step S4301 and executes the steps that follow, and performs the processing of steps S4301 to S4304 on all of the specified plaintext data (step S4305).

[0066] In the registration device 100, the encryption processing unit 100C further encrypts with a searchable encryption to obtain encrypted data (IED, r, ED), and obtains an encrypted data group 201A including a set of encrypted data (IED, r, ED) (step S4306).

[0067] In the process of creating the encrypted data group 201A, it is not necessary to perform all of the above-mentioned steps S4301 to S4306. For example, if the plaintext data is a "name", encryption and search are sufficient, and since it is not a numerical value, no arithmetic processing is required. In this case, the cryptographic processing unit 100C may generate only encrypted data (IED, r) so as to be compatible with encryption and search, and omit the process of generating encrypted data ED for arithmetic processing. In this case, the encrypted data ED is treated as null data.

[0068] Similarly, for example, when the plaintext data is "annual income", encryption and calculation are necessary, but search is not necessary. In that case, the encrypted data (IED, r) is omitted, and only the generation of encrypted data ED for calculation processing is performed. However, at this time, the common key cipher sk for encrypting the encrypted data ED reuses the secret key sk embedded in another encrypted data IED in the same row in the secret database 200A. This allows the encrypted data ED to be transferred to the retrievable encrypted data HED using the secret key sk obtained from the search result of another column.

[0069] In this embodiment, the encryption processing unit 100C may generate multiple encrypted data ED by encrypting one plaintext data with a common key cipher using a secret key sk. For example, in order to correspond to different operations such as addition and multiplication, different encrypted data ED1, ED2,..., EDn may be prepared for each operation, and encrypted data (IED,r,ED1,...,EDn) may be generated.

[0070] In step S440, the registration device 100 transmits a pair of the encrypted data group 201A and the attribute to the provision device 200. In step S441, the provision device 200 receives the pair of the encrypted data group 201A and the attribute from the registration device 100. In step S442, the registration unit 200B of the provision device 200 registers the pair of the encrypted data group 201A and the attribute in the secret database 200A, as shown in Fig. 7A. Note that in the secret database 200A, each attribute value of each attribute included in the encrypted data group 201A is managed in a manner that can be calculated by homomorphic encryption, and is managed in a state that can be searched using an encrypted query by searchable encryption, as described later.

[0071] In step S443, the providing machine 200 transmits the result of the registration process to the registration machine 100. In step S444, the providing machine 200 receives the result of the registration process. In step S450, the providing machine 200 deletes the key.

[0072] The above-mentioned processing procedure is merely an example, and the processing order and processing contents may be changed as necessary. For example, after the registration machine 100 obtains the key from the distribution machine 500, the registration machine 100 stores the key, and the processing of steps S410 to S413 can be omitted. Also, the distribution machine 500 is not necessarily required, and any one of the registration machine 100, the analysis machine 300, and the provision machine 200 may serve the same role. For example, if the registration machine 100 and the distribution machine 500 are the same, the processing of steps S410 to S413 can be omitted.

[0073] Fig. 8 is a sequence diagram showing an example of the procedure of data acquisition processing of the private statistical processing system according to this embodiment. Hereinafter, a description will be given with reference to Fig. 1 etc. In step S710 of Fig. 8, in the analyzer 300, the analysis unit 300C specifies an attribute for analysis and creates a plaintext query for analysis that specifies an attribute value of the attribute for analysis.

[0074] In the analysis device 300, when the analysis unit 300C selects "University" as an attribute for analysis, it selects one of the universities (for example, "University A") from the attribute values ​​("University A", "University B", ..., "University N"). In this embodiment, it is assumed that "University A" selected by the analysis unit 300C of the analysis device 300 in this manner is the plaintext query for analysis.

[0075] In step S720, the analysis machine 300 requests the distribution machine 500 for a secret key sk_q of a common key cryptography for generating an encrypted query corresponding to the plaintext query for analysis. In step S721, the distribution machine 500 receives the request.

[0076] In step S722, the distributor 500 sends the requested private key sk_q to the analyzer 300. In step S723, the analyzer 300 receives the private key sk_q. In step S730, the analyzer 300 generates an encrypted query with a searchable cipher from the plaintext query for analysis.

[0077] In step S740, the analysis machine 300 transmits a pair of the encrypted query and the attribute to the providing machine 200. In step S741, the providing machine 200 receives the pair of the encrypted query and the attribute. In step S742, the comparison unit 200C of the providing machine 200 searches the secret database 200A using the encrypted query (see FIG. 7B). Details of step S742 will be described later.

[0078] In step S743, the comparison unit 200C of the provider device 200 performs statistical processing on the secret database 200A. The details of the statistical processing will be described separately.

[0079] In step S744, the provider 200 executes the statistical processing and then transmits the calculation result data, which is the result of the statistical processing, to the analyzer 300. The calculation result data is encrypted by homomorphic encryption. In step S745, the analyzer 300 receives the calculation result data. In step S750, the analyzer 300 decrypts the calculation result data using the (decryption) key of the homomorphic encryption, and obtains the plaintext calculation result data having the sum value as its value. Note that steps S743, S744, S745, and S750 will be described later in detail.

[0080] The above-mentioned process procedure is an example, and the process order and process contents may be changed as necessary. For example, after the analysis machine 300 obtains the private key from the distribution machine 500, the analysis machine 300 may store the private key, and steps S720 to S723 may be omitted. As described above, the distribution machine 500 is not necessarily required, and any one of the registration machine 100, the analysis machine 300, and the provision machine 200 may serve as the distribution machine 500. For example, if the analysis machine 300 also serves as the distribution machine 500, steps S720 to S723 may be omitted.

[0081] Fig. 9 is a flowchart mainly showing the details of the processing procedure of steps S741 to S743 shown in Fig. 8. Step S741 has already been explained, so the explanation will be omitted. The details of steps S742 and S743 will be explained below.

[0082] The provider device 200 uses the encrypted query received from the analyzer device 300 as described above to search for matching attributes in the secret database 200A as shown in FIG. 7B (step S7421).

[0083] If there is no matching attribute in step S7421, the providing machine 200 executes step S744. In step S744, the providing machine 200 transmits to the analyzing machine 300, as calculation result data, a message indicating that statistical processing was not possible.

[0084] On the other hand, if there is a matching attribute (the part marked as "hit" in FIG. 7B) in step S7421, the providing machine 200 reads the corresponding encrypted data IED from the secret database 200A (step S7422). The providing machine 200 decrypts the encrypted data IED using the private key sk_q (step S7423). IBE.Dec(sk_q,IED) →r'||sk'

[0085] In the providing device 200, the comparing unit 200C compares the plaintext data r' obtained by decrypting the encrypted data IED with the value r in the secret database 200A while referring to the secret database 200A. If the plaintext data r' ≠ value r, the comparing unit 200C determines that the search did not hit, and executes step S7427. On the other hand, if the plaintext data r' = value r, the comparing unit 200C determines that the search hit. In the providing device 200, the comparing unit 200C reads the encrypted data ED in the same row as the encrypted data IED read in the above-mentioned step S7422, as shown in FIG. 7B (step S7425).

[0086] In the provider 200, the comparison unit 200C decrypts the encrypted data ED using the private key sk' to obtain encrypted data HED that can be calculated while still being encrypted (step S7426). If there is encrypted data IED that has not yet been read in step S7422, the encryption processing unit 300A returns to step S7422 and executes this, whereas if there is no encrypted data IED that has not yet been read in step S7422, the encryption processing unit 300A executes statistical processing in step S743 as follows (step S7427).

[0087] In step S743, the comparison unit 200C of the providing device 200 first reads all (here, m pieces) of encrypted data HED stored in step S7426 (step S7431). In the providing device 200, the analysis unit 300C performs an addition operation on the read m pieces of encrypted data HED, and obtains the encrypted data HEDsum as the sum (step S7432). Here, m is an integer of 2 or more. HE.Add(HED1, HED2,...,HEDm) →HEDsum

[0088] In step S744, the calculation unit 200D of the providing device 200 transmits the encrypted data HEDsum and the number m as calculation result data that is the result of the statistical processing to the analysis device 300. In step S745, the analysis device 300 receives the encrypted data HEDsum and the number m.

[0089] In step S750, the analysis unit 300C of the analysis machine 300 decrypts the encrypted data HEDsum using the decryption key hdk through homomorphic encryption to obtain operation result data (d1+d2+··dm) having the sum as its value. HED.Dec(hdk,HEDsum)→d1+d2+··dm

[0090] Furthermore, the analysis section 300C of the analyzer 300 divides this data (d1+d2+··dm) by m to obtain calculation result data having the average value (d1+d2+··dm) / m as a value.

[0091] It should be noted that the statistical processing in this embodiment is not limited to the average and sum as described above, and various other statistical processing is possible, for example, variance and standard deviation.

[0092] Specifically, following the above-mentioned step S7432, in step S7433, the analysis unit 300C in the analysis device 300 calculates the inner product of the m pieces of encrypted data HED that have been read, to obtain encrypted data HEDpro (step S7433), where m is an integer equal to or greater than 3. HE.Add(HE.mul(HED1,HED1), HE.mul(HED2,HED2),...,HE.mul(HEDm,HEDm)) →HEDsum2

[0093] Next, in step S744, the provider machine 200 transmits HEDsum, HEDsum2, and the number m to the analyzer machine 300 as calculation result data that is the result of the statistical processing.

[0094] In step S750, the analysis unit 300C of the analysis machine 300 receives the encrypted data HEDsum and HEDsum2 and the number m. In this step S750, the analysis unit 300C of the analysis machine 300 decrypts the encrypted data HEDsum and HEDsum2 by homomorphic encryption using the decryption key hdk, and obtains operation result data (d1+d2+··dm) having a sum as a value and operation result data (d1^2+d2^2+··dm^2) having a sum of squares as a value (step S7501). HED.Dec(hdk,HEDsum)→d1+d2+··dm HED.Dec(hdk,HEDsum2)→d1^2+d2^2+··dm^2

[0095] Furthermore, the analysis unit 300C of the analyzer 300 divides the data (d1+d2+··dm) by m to obtain calculation result data having the average value (d1+d2+··dm) / m as a value. The analysis unit 300C of the analyzer 300 also divides the above-mentioned data (d1^2+d2^2+··dm^2) by m and subtracts the square of the average value (d1+d2+··dm) / m to obtain calculation result data Var having the variance as a value (step S7502). (d1^2+d2^2+··dm^2) / m - ((d1+d2+···dm) / m)^2 → Var

[0096] Furthermore, the analysis section 300C of the analyzer 300 can derive the standard deviation by calculating the square root of this calculation result data Var.

[0097] As described above, the statistical processing in this embodiment is not limited to the average and the sum, and various statistical processing such as variance and standard deviation are possible. In addition, in the above-mentioned statistical processing, a method using addition and multiplication in homomorphic encryption is exemplified, but either addition or multiplication may be used. For example, in the above-mentioned step S4303, the encryption processing unit 100C of the registration device 100 may encrypt the plaintext data d with the common key encryption SE to obtain encrypted data ED, and may also encrypt the plaintext data d^2 obtained by squaring the data d with the common key encryption SE to obtain encrypted data ED'. In that case, in step S4305, the encrypted data group is composed of (IED, r, ED, ED'). As a result, in the above-mentioned step S7502, the calculation result data Var having the variance as a value as well as the average value is obtained.

[0098] In generating the encrypted data set, it is not necessary to perform all of the processes from step S4301 to step S4306. For example, if the encrypted data ED for arithmetic processing does not exist or is null data, the corresponding process may be omitted.

[0099] Furthermore, the processing procedure of steps S4301 to S4306 may be changed. For example, when the encrypted data (IED, r) does not exist, the encrypted data ED for arithmetic processing may be decrypted by reusing the secret key sk embedded in another encrypted data IED in the same row in the secret database 200A.

[0100] Furthermore, when a plurality of encrypted data ED are created for one plaintext data, for example, each of the encrypted data ED1, ED2, . . . , EDn may be decrypted.

[0101] As described above, in the private statistical processing system according to this embodiment, the enrollment device 100 has the encryption processing unit 100C encrypt plaintext data with a common key cipher using a private key of the common key cipher to create encrypted data (data encryption processing unit), and encrypts the private key and the encrypted data with a searchable cipher to create encrypted data (encrypted data creation unit). Also, the provision device 200 manages the encrypted data.

[0102] By using such searchable encryption, it becomes possible to extract desired data at any time using the search function using the encrypted query described above while entrusting management of the data to a third party organization such as a cloud while keeping the data encrypted. Since the key for decrypting the data does not need to be passed to the provider 200 on the cloud, for example, the data can be maintained in an encrypted state, so that confidentiality of the data can be ensured while entrusting management to a third party organization, for example. According to the present embodiment, since a general-purpose encryption algorithm can be used, the provider 200 can provide encrypted data while ensuring confidentiality of the data without worrying that the alternative encryption algorithm may be compromised.

[0103] The confidential statistical processing system according to this embodiment includes an analysis machine 300 having an encrypted query creation unit that creates an encrypted query by encrypting a plaintext query for analysis with searchable encryption, and the providing machine 200 has a comparison unit 200C that compares the encrypted data with the encrypted query. In this way, the analysis machine 300 can obtain encrypted data corresponding to the encrypted query from the providing machine 200 while ensuring the confidentiality of the data.

[0104] In this embodiment, the provider 200 uses the comparison unit 200C to compare the encrypted data with the encrypted query, and if the encrypted data encrypted with the searchable code is identical to the encrypted query, the calculation unit 200D obtains a private key from the encrypted data (private key obtaining unit), and uses the obtained private key to decrypt the encrypted data and obtain plaintext data (data obtaining unit). In this way, it is possible to provide desired data while ensuring the confidentiality of the data using the encrypted query.

[0105] In this embodiment, in the registration device 100, the encryption / decryption processing unit 100C (data encryption / decryption processing unit) encrypts plaintext data using homomorphic encryption. In this way, it is possible to perform calculations while ensuring the confidentiality of the data.

[0106] In this embodiment, in the registration device 100, the encryption processing unit 100C (data encryption processing unit) re-encrypts encrypted data encrypted by homomorphic encryption with common key encryption to generate encrypted data. In this way, encrypted data can be generated while ensuring the confidentiality of the data by common key encryption.

[0107] In this embodiment, the provider 200 includes a calculation unit 200D (private key acquisition unit) that compares the encrypted data and the encrypted query by the comparison unit 200C, and acquires a private key from the encrypted data if the encrypted data encrypted with the searchable encryption is identical to the encrypted query, and the calculation unit 200D (data acquisition unit) decrypts the encrypted data with the acquired private key and acquires the encrypted data encrypted with the homomorphic encryption. In this way, it is possible to perform statistical calculations using the encrypted data encrypted with the homomorphic encryption.

[0108] In this embodiment, the provider 200 has a calculation unit 200D (calculation result provider) that provides the analysis machine 300 with calculation result data obtained by performing calculation processing on encrypted data encrypted by homomorphic encryption, and the analysis machine 300 has an analysis unit 300C (statistics acquisition unit) that decrypts the calculation result data provided from the provider 200 by homomorphic encryption to acquire statistics. In this way, it is possible to perform statistical calculations using encrypted data encrypted by homomorphic encryption to acquire statistics.

[0109] In the present embodiment, in the provider 200, the calculation unit 200D (calculation result provider) acquires one or more of the sum, the average, the variance, and the standard deviation as the calculation result data, and provides them to the analyzer 300. In this way, the calculation result data can be provided while ensuring the confidentiality of the data.

[0110] In this embodiment, the registration machine 100 obtains the secret key of the common key encryption, the key of the searchable encryption, and the key of the homomorphic encryption from the distribution machine 500, and the analysis machine 300 obtains the key of the searchable encryption and the key of the homomorphic encryption from the distribution machine 500. In this manner, the analysis machine 300 does not need to generate keys by itself, and the processing load is accordingly reduced.

[0111] In this embodiment, the registration machine 100 obtains a key for searchable encryption and a key for homomorphic encryption from the distribution machine 500, and the analysis machine 300 obtains a key for searchable encryption and a key for homomorphic encryption from the distribution machine 500. In this manner, the analysis machine 300 does not need to generate keys by itself, and therefore the processing burden is reduced accordingly.

[0112] (2) Second embodiment In the second embodiment, the description of the configuration and operation similar to those of the first embodiment will be omitted, and the following description will focus on the differences. In the above-mentioned first embodiment, a private statistical processing system using a common key encryption, an ID-based encryption IBE, and a homomorphic encryption HE is illustrated, whereas in the second embodiment, a private statistical processing system using a searchable encryption as an alternative to the ID-based encryption IBE is illustrated.

[0113] (2-1) Encryption method used in the second embodiment In the following, we use SSE2, a modified version of SSE. The features of SSE2 are as follows: (2-2) Secure Searchable Encryption 2 (SSE2) It handles key generation, data encryption, query encryption, and comparison. The key generation function Gen takes a security parameter λ as input and outputs an encryption key sek and a query encryption key sqk. SSE2.Gen(lambda) → sek,sqk

[0114] The encryption function Enc receives the encryption key sek, the plaintext data d, and the plaintext data as input, and outputs encrypted data SED. SSE2.Enc(sek,d,r) → SED

[0115] The query encryption function Query takes a query encryption key sqk and a plaintext query q as input, and outputs an encrypted query SEQ. SSE2.Qeury(sqk,q) → SEQ

[0116] The comparison function Cmp receives the encrypted query SEQ and the encrypted data SED as input, and outputs 1 and the data r if d=q, and outputs 0 if d≠q. SSE2.Cmp(SEQ,SED) → 1||r (when d=q) or 0 (when d≠q)

[0117] (2-2) Specific Example of the Second Embodiment The sequence of the data registration process according to the second embodiment is almost the same as the sequence of the data registration process according to the first embodiment described above (see FIG. 5), so a description of the similar points will be omitted. Regarding the data registration process of the confidential statistical processing system according to the second embodiment, a process in which the statistical process is sum and average will be described. In the second embodiment, the process in step S430 is partially different, so it will be described below.

[0118] Fig. 10 is a flowchart showing an example of the procedure of the encrypted data group creation process of the confidential statistical processing system in the second embodiment. Note that the contents omitted in Fig. 10 are the same as those in the first embodiment (see Fig. 6).

[0119] In step S430, similarly to the first embodiment, the registration device 100 encrypts each of the designated plaintext data to generate an encrypted data set. The registration device 100 generates a secret key sk of the common key encryption SE (step S4301). SE.Gen(λ) → sk

[0120] In the registration device 100, the encryption processing unit 100C encrypts the data concatenated with the plaintext data d' corresponding to the attribute value of the above-mentioned attribute and the secret key sk using the searchable encryption SSE2 with the encryption key sek, and obtains encrypted data SED (step S4302a). SSE2.Enc(sek,d'||sk) → SED

[0121] In the enrollment device 100, the encryption processing unit 100C regards the element to be encrypted designated in step S430 as plaintext data d, and encrypts it with the homomorphic encryption HE using the encryption key hek to obtain encrypted data HED (step S4303). HE.Enc(hek,d) → HED

[0122] In the registration device 100, the encryption processing unit 100C uses the private key sk to encrypt the encrypted data HED with the common key encryption SE to obtain encrypted data ED (step S4304). SE.Enc(sk,HED) →ED

[0123] In the enrollment device 100, if the cryptographic processing unit 100C has unencrypted plaintext data, the cryptographic processing unit 100C returns to step S4301 and executes the subsequent steps (step S4305). The enrollment device 100 executes steps S4301 to S4305 for all elements to be encrypted, and obtains an encrypted data set consisting of a set of encrypted data (SED, ED) (step S4306).

[0124] The sequence of the data acquisition process of the confidential statistical processing system according to the second embodiment is similar to the sequence of the data acquisition process of the confidential statistical processing system according to the first embodiment (see FIG. 8). Below, a case where the statistical processing is sum and average in the data acquisition process of the confidential statistical processing system according to the second embodiment will be described. In the second embodiment, the processing in steps S720 to S743 is partially different, and will be described below. The processing where a description is omitted is similar to the first embodiment.

[0125] In step S720, the analysis unit 300C of the analysis machine 300 requests the query encryption key sqk from the distribution machine 500. In step S721, the distribution machine 500 receives the request. In step S722, the distribution machine 500 sends the query encryption key sqk to the analysis machine 300. In step S723, the analysis machine 300 receives the query encryption key sqk. In step S730, the analysis machine 300 creates an encrypted query SEQ by encrypting the plaintext query q using the query encryption key sqk with a searchable cipher.

[0126] The process from step S741 to step S743 will be described below. Fig. 11 is a flowchart mainly showing the details of the process from step S741 to step S743 shown in Fig. 8.

[0127] In step S741, the providing machine 200 receives the attribute and the encrypted query SEQ. The specific processing content of step S742 is as follows. The comparison unit 200C of the providing machine 200 searches for a matching attribute from the secret database (step S7421). If there is no matching attribute in step S7421, the comparison unit 200C of the providing machine 200 executes step S744 and transmits a message to the analyzing machine 300 that the statistical processing was impossible as a result of the statistical processing result, while if there is a matching attribute in step S7421, the comparison unit 200C of the providing machine 200 reads the corresponding encrypted data SED from the secret database 200A (step S7422). The comparison unit 200C of the providing machine 200 compares the encrypted query SEQ with the encrypted data SED (step S7423). SSE.Cmp(SEQ,SED) → 1||sk (when d'=q) or 0 (when d'≠q)

[0128] In the provider 200, the comparison unit 200C, when the comparison result is 0, regards it as a non-match (no hit) in the search and executes step S7427, whereas when the result is 1||sk, regards it as a match (hit) in the search. The comparison unit 200C reads the encrypted data ED in the same row as the encrypted data SED read in step S7422 (step S7425). The comparison unit 200C decrypts the encrypted data ED using the secret key sk and stores the output encrypted data HED (step S7426). When there is encrypted data SED that has not yet been read in step S7422, the comparison unit 200C returns to step S7422 and executes the following steps, whereas when there is no encrypted data SED that has not yet been read in step S7422, the comparison unit 200C executes the statistical processing of step S743 (step S7427).

[0129] The present invention is not limited to the above-mentioned embodiment, and various modifications are possible within the scope of the spirit of the present invention. For example, although detailed description of the request and distribution of keys between the distribution machine 500 and the registration machine 100, the provision machine 200, and the analysis machine 300 is omitted, in the above-mentioned embodiment, the distribution machine 500 can receive key requests from the registration machine 100, the provision machine 200, and the analysis machine 300, and distribute the necessary keys to the registration machine 100, the provision machine 200, and the analysis machine 300 as appropriate. Also, for example, the above-mentioned embodiment has been described in detail to explain the present invention in an easy-to-understand manner, and is not necessarily limited to those having all of the described configurations. Also, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Also, it is possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.

[0130] In addition, the above-mentioned configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. In addition, the above-mentioned configurations, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information such as the program, table, file, etc. that realizes each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD (Digital Versatile Disc).

[0131] In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and not all control lines and information lines in the product are necessarily shown. In reality, it can be considered that almost all components are connected to each other. [Industrial Applicability]

[0132] The present invention can be applied to a confidential statistical processing system relating to a technique for performing statistical processing while ensuring the confidentiality of data. [Explanation of symbols]

[0133] 100……Registration machine, 200……Analysis machine, 300……Provision machine, 500……Distribution machine

Claims

1. a data encryption processing unit that generates encrypted data by encrypting plaintext data with a common key cipher using a secret key of the common key cipher; an encrypted data creation unit that creates encrypted data by encrypting the private key and encrypted data with a searchable cipher; A registration machine having a provider that manages encrypted data encrypted with the searchable encryption; A confidential statistical processing system comprising:

2. an analysis machine having an encrypted query creation unit that creates an encrypted query by encrypting a plaintext query for analysis with the searchable encryption; The providing machine is a comparison unit for comparing the encrypted query with the encrypted data; 2. The confidential statistical processing system according to claim 1 .

3. The providing machine is a private key acquisition unit that compares the encrypted query with the encrypted data by the comparison unit, and acquires the private key from the encrypted data when the encrypted data encrypted with the searchable encryption is identical to the encrypted query; a data acquisition unit that acquires plaintext data by decrypting encrypted data using the acquired private key; 3. The confidential statistical processing system according to claim 2, further comprising:

4. In the registration machine, The data encryption processing unit encrypts the plaintext data using homomorphic encryption.

4. The confidential statistical processing system according to claim 3.

5. In the registration machine, The data encryption processing unit re-encrypts the encrypted data encrypted by the homomorphic encryption with the common key encryption to generate encrypted data.

5. The confidential statistical processing system according to claim 4.

6. The providing machine is a private key acquisition unit that compares the encrypted query with the encrypted data by the comparison unit, and acquires the private key from the encrypted data when the encrypted data encrypted with the searchable encryption is identical to the encrypted query; The data acquisition unit is Decrypting the encrypted data with the obtained private key, and obtaining the encrypted data encrypted by the homomorphic encryption.

6. The confidential statistical processing system according to claim 5.

7. The providing machine is a calculation result providing unit that provides the analyzer with calculation result data obtained by performing calculation processing on the encrypted data encrypted by the homomorphic encryption; The analyzer comprises: a statistics acquisition unit that acquires statistics by decrypting the computation result data provided by the provider using the homomorphic encryption; 7. The confidential statistical processing system according to claim 6.

8. In the providing machine, The calculation result providing unit obtains one or more of the sum, the average, the variance, and the standard deviation as the calculation result data and provides the data to the analyzer.

8. The confidential statistical processing system according to claim 7.

9. The registration machine includes: Obtaining a secret key for the common key encryption, a key for the searchable encryption, and a key for the homomorphic encryption from the distributor; The analyzer comprises: Obtaining a key for the searchable encryption and a key for the homomorphic encryption from the distributor.

9. The confidential statistical processing system according to claim 8.

10. The registration machine includes: Obtaining a key for the searchable encryption and a key for the homomorphic encryption from the distributor; The analyzer comprises: Obtaining a key for the searchable encryption and a key for the homomorphic encryption from the distributor.

10. The confidential statistical processing system according to claim 9.

11. a data encryption processing step in which a data encryption processing unit of the registration device encrypts plaintext data with a common key cipher using a secret key of the common key cipher to generate encrypted data; an encrypted data creating step in which an encrypted data creating unit of the registration device creates encrypted data by encrypting the private key and the encrypted data with a searchable cipher; a management step in which the provider manages the encrypted data encrypted with the searchable encryption; A confidential statistical processing method comprising:

Images