Secret calculation system and secret calculation method

Abstract

To provide a secret calculation method and a secret calculation system capable of improving efficiency of argmax computation using homomorphic encryption.SOLUTION: In a secret computation process, a client generates a ciphertext array c[0]=Enc(v[0]), ..., c[N-1]=Enc(v[N-1]) in which an input array v[0], ..., v[N-1] is encrypted, and sends the ciphertext array c[0], ..., c[N-1] to a server. The server calculates c=Enc(H(v[i]-v[j])) using the ciphertext array c[0], ..., c[N-1] and EOHV(v[i]-v[j]), calculates Enc(argmax(v[i],v[j])) using f((c,ik,jk))=sel(c,ik,jk) by Enc(f((c,ik,jk))), and returns Enc(ik) when sel(c,ik,jk) is c=Enc(1) for bit values ik,jk, and Enc(jk) when it is c=Enc(0).SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] The present disclosure relates to a secure computation system and a secure computation method. [Background technology]

[0002] When a and b are real numbers, which of them is larger can be found by max(a, b) = max(ab, 0) + b. This can also be applied when the input is a homomorphic ciphertext by using an encrypted vector (Non-Patent Document 1) in which each element of a vector in which only one element is 1 and the other elements are 0 is encrypted. Hereinafter, an encrypted vector in which each element of a vector in which only one element is 1 and the other elements are 0 is encrypted will be referred to as an EOHV (Encrypted One Hot Vector).

[0003] Furthermore, a function called a selection function is used to calculate the index of the array with the maximum value (i.e., calculate argmax) among the arrays encrypted by homomorphic encryption. Note that a selection function is a function that takes as input c, which takes 0 or 1, and real numbers a and b, and returns a when c=1, and b when c=0. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] K. Nuida, S. Ohata, S. Mitsunari, and N. Attrapadung., "Arbitrary univariate function evaluation and re-encryption protocols over lifted-elgamal type ciphertexts.", Cryptology ePrint Archive, Report 2019 / 1233, 2019. https: / / eprint.iacr.org / 2019 / 1233. Summary of the Invention

Problems to be Solved by the Invention

[0005] However, in order to implement the selection function using an additive homomorphic cipher, conversion to a one-variable function is required. In this case, there is a problem that the efficiency deteriorates because the size of the EOHV is proportional to the square of the size of the array index.

[0006] The present disclosure has been made in view of the above points, and an object thereof is to improve the efficiency of argmax calculation using a homomorphic cipher.

Means for Solving the Problems

[0007] A secret calculation system according to an aspect of the present disclosure includes a first information processing device having an input array v[0], ···, v[N-1] that takes integer values, and the input array v[0], ···, v[N-1]. A secret calculation system including a second information processing device that calculates a ciphertext of an index that gives the maximum value of, wherein the first information processing device encrypts each of the input arrays v[0], ···, v[N-1] with a homomorphic cipher. A ciphertext array c[0]=Enc(v[0]), ···, c[N-1]=Enc(v[N-1]) is generated, the ciphertext array c[0], ···, c[N-1] is transmitted to the second information processing device, and the second information processing device uses the ciphertext array c[0], ···, c[N-1] and EOHV(v[i]-v[j]) (where i, j ∈ {0, ···, N-1}, i < j) to calculate c=Enc(H(v[i]-v[j])) (where H(x) returns 1 when x≧0 and 0 when x<0), f((c,i k ,j k ))=sel(c,i k ,j k ) is used to calculate Enc(argmax(v[i],v[j])) by Enc(f((c,i k ,j k ))), and the sel(c,i k ,j k ) is the k-bit bit value i when i and j are each expressed in binary k ,jk For c=Enc(1), Enc(i k ), if c=Enc(0), then Enc(j k ) is a function that returns [Effects of the Invention]

[0008] It is possible to make argmax calculations more efficient using homomorphic encryption. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 10 is a diagram illustrating an example of an algorithm for calculating argmax. [Figure 2] FIG. 10 is a diagram illustrating an example of a secure computation algorithm for argmax. [Figure 3] 1 is a diagram illustrating an example of the overall configuration of a secure computing system according to an embodiment of the present invention. [Figure 4] FIG. 2 is a diagram illustrating an example of a functional configuration of a client according to the present embodiment. [Figure 5] FIG. 2 is a diagram illustrating an example of a functional configuration of a server according to the present embodiment. [Figure 6] FIG. 10 is a sequence diagram illustrating an example of a secure computation process according to an embodiment. [Figure 7] FIG. 2 illustrates an example of a hardware configuration of a computer. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0011] <Conventional technology and its issues> <Preparing notation and functions> First, we prepare some notations and functions.

[0012] For an integer m greater than or equal to 0, the bit length of m is expressed as L:=len(m). Also, the binary expansion of m is expressed as m=m02 0 +m12 1 +···+mL-1 2 L-1 (However, for i=0, ,L-1, m i ∈{0,1}), then bin(m):=[m L-1 :···:m1:m0]. Furthermore, selecting one element x uniformly at random from the set D is called x← R I'll write it as D.

[0013] Let H(x) be a function that returns 1 when x≧0 and 0 when x<0. Also, let ReLU(x):=xH(x). Furthermore, let sel(c,x,y)=cx+(1-c)y. sel is a function that returns x when c=1 and y when c=0, and is also called a selection function.

[0014] ≪Homomorphic encryption≫ Homomorphic encryption (HE) is a homomorphic encryption method that has the property that when two ciphertexts are given, operations can be performed without plaintext or a secret key, and the operation results can be decrypted correctly. Homomorphic encryption is basically composed of a key generation function Gen, an encryption function Enc, a decryption function Dec, and a homomorphic operation function Eval.

[0015] The key generation function Gen is a function that serves as a preliminary preparation, and outputs a pair of the public key pk and the private key sk of the user who executed the function.

[0016] The encryption function Enc receives plaintext m to be transmitted and a public key pk as input, and outputs ciphertext c.

[0017] The decryption function Dec receives the secret key sk and the ciphertext c as input, and outputs the plaintext m or the symbol ⊥ indicating that decryption is not possible.

[0018] The homomorphic computation function Eval is a function that performs a predetermined computation between multiple ciphertexts encrypted with the same public key pk. Let m1 and m2 be plaintexts, and c1 and c2 be their corresponding ciphertexts. In this case, the homomorphic computation function Eval takes ciphertexts c1 and c2 as input, and outputs a homomorphic computation result c or a symbol ⊥ indicating that a homomorphic computation is not possible. When the decryption function Dec is executed using this homomorphic computation result c as input, it obtains a computation result m1○m2 obtained by performing a predetermined computation ○ on plaintext m1 and plaintext m2.

[0019] In the following, we will assume that homomorphic encryption is Lifted-ElGamal encryption (Reference 1), which is based on an additive cyclic group G of prime order p. In the following, we will denote the addition and subtraction of ciphertexts c1 and c2 in Lifted-ElGamal encryption as c1±c2, and the operation of multiplying ciphertext c by an integer a in Lifted-ElGamal encryption as ac. Furthermore, since the encryption function Enc in Lifted-ElGamal encryption selects a random number r and uses it to encrypt plaintext m, we will use the expression Enc(m;r) to explicitly indicate that random number r is used to encrypt plaintext m. However, the random number r may also be omitted and simply expressed as Enc(m).

[0020] <Two-party protocol using Lifted-ElGamal encryption> Consider a vector in which only the m-th element of X is 1 and the remaining elements are 0 for a finite set X and its elements m∈X. m can be any real number, but for simplicity, m is assumed to be an integer greater than or equal to 0. In this case, a vector in which only the m-th element of X is 1 and the remaining elements are 0 is OHV(m):=(0, ,1, ,0)=(δ mi ) i∈X is called the OHV (One Hot Vector) of m. And, EOHV(m):=(Enc(δ mi )) i∈X is called the EOHV (Encrypted OHV) of m. Here, δ ij is the Kronecker delta which is 1 when i=j and 0 otherwise.

[0021] In this case, when the client generates a key for Lifted-ElGamal encryption and the server has Enc(m), the server can obtain EOHV(m) using a protocol (hereinafter referred to as EOHV protocol) consisting of the following steps a to e (Non-Patent Document 1). Note that the server does not know the value of m.

[0022] Step a. The server generates |X| random numbers r for c = Enc(m). i ← R Take [0,p-1] and (r i (c-Enc(i))) i∈X and then shuffle them into |X| ciphertext vectors (c i ').

[0023] Step b. The server receives the ciphertext vector (c i ') to the client.

[0024] Step c. The client i ') for each c i ', and if the decryption result is 0, it is Enc(1), otherwise it is Enc(0) i '').

[0025] Step d. The client generates the ciphertext vector (c i '') to the server.

[0026] Step e. The server (c i '') to obtain EOHV(m) by performing the reverse shuffling operation performed in step a above.

[0027] In the above EOHV protocol, both the server and the client send |X| ciphertexts to each other. Therefore, it is important to keep |X| small. Hereafter, |X| is called the size of EOHV(m).

[0028] Let f:X→Z be any one-variable integer-valued function on X. Z is the set of all integers. Then, Σ i∈X f(i)Enc(δ mi )=f(m)Enc(1)=Enc(f(m)). This is written as eval(f,EOHV(m)):=Enc(f(m)).

[0029] The number of Enc(0) and Enc(1) required by the client is predetermined if X is fixed, so it can be calculated and prepared in advance. i It should also be noted that since it is only necessary to know whether ' is 0 or not, there is no need to solve the discrete logarithm problem required for decrypting a normal Lifted-ElGamal cipher.

[0030] <<Basic form of argmax>> Let S be a set of intervals of integer values. Then, let v1,...,v be a set of N elements of S. N For {v i}, one of the i that gives the maximum value of argmax i v i If there are multiple maximum values, it does not matter which i that gives the maximum value is selected.

[0031] argmax i v i A naive algorithm for calculating is to repeat the max function N-1 times as shown in Figure 1. The algorithm shown in Figure 1, when given N arrays v[0],...,v[N-1] as input, initializes idx=0 and max=v[0] (lines 3-4), and then for i=1 to N-1, if v[i]>max, it repeats the process of setting max=v[i] and idx=i (lines 5-8). This outputs one of the i's that gives the maximum value of the N arrays v[0],...,v[N-1] (line 9).

[0032] <Argmax Concealment> We consider modifying the argmax calculation algorithm shown in Figure 1 so that it can be applied even in an encrypted state.

[0033] The function max(x,y), which returns the larger of x and y, is max(x,y) = max(xy,0) + y = ReLU(xy) + y. Therefore, if you find EOHV(xy) for Enc(xy), you can calculate eval(ReLU,EOHV(xy)) + Enc(y) = Enc(max(xy,0)) + Enc(y) = Enc(max(x,y)).

[0034] Next, prepare to find argmax. Let i,j be the index of the array, and x i ,x j are the values ​​of the elements corresponding to i and j. In this case, sel(H(x i -x j ),i,j) is x i ≧x j If i, x i <x j If so, return j. Since sel is a three-variable function, the EOHV protocol cannot be applied as is. Also, if sel(c,x,y)=cx+(1-c)y, level 2 homomorphic encryption is required. Therefore, the domain of definition is expanded to make it a one-variable function.

[0035] Since the range of array indexes is 0 to N, let D:={0, ,N-1}. In this case, let X:={0, 1}×D×D, and define a one-variable function on X called f((c, i, j)):=sel(c, i, j), and the EOHV protocol can be applied.

[0036] As a result, when c = Enc(H(v[i]-v[j])) is obtained, Enc(f((c,i,j))) is applied to c = Enc(H(v[i]-v[j])) to obtain Enc(i) if c = Enc(1), and Enc(j) if c = Enc(0). Therefore, by repeating this N-1 times, Enc(argmax(v[i])) can be obtained.

[0037] <Challenges> The EOHV protocol can be applied by defining a one-variable function on X called f((c,i,j)):=sel(c,i,j). In this case, the size of EOHV is |X|=2|D| 2 This results in poor efficiency.

[0038] <Proposed method> Therefore, we propose a method to reduce the size of the EOHV below.

[0039] ≪Proposed method 1≫ Let L be the smallest integer equal to or greater than log2(N). In this case, the indexes 0,...,N-1 of the array can be expressed in L bits. Also, when selecting an index using a selection function, the values ​​of each bit in the index are independent of each other. Therefore, you can select the value of each bit position for c. That is, bin(i)=[i L-1 :···:i1:i0], bin(j)=[j L-1 :···:j1:j0], and instead of sel(c,i,j), we use L sel(c,i k ,j k ) (k=0, ,L-1) is used.

[0040] Each i k ,j k is 1 bit, so the size of EOHV is 2 2 2 = 8. Also, L sel(c,i k ,j k ), the total size of the EOHV is 8L. Therefore, 2|D| 2 =2N 2 This allows for a significant reduction in the size of the EOHV compared to the conventional method.

[0041] ≪Proposed method 2≫ Based on the above proposed method 1, we propose a method that can perform argmax secret calculation more efficiently.

[0042] The 2ith and 2i+1th indices are the same except for the least significant bit. In other words, the 0th and 1st indices are the same except for the least significant bit, and similarly the 2nd and 3rd indices are the same except for the least significant bit, and so on. Therefore, first, select the bit value of the least significant bit for the indices that are the same except for the least significant bit. In this case, since it is only necessary to select the bit value of the lowest 1 bit, the size of the EOHV of sel(c,2i,2i+1) can be 2 × 2 × 2 = 8.

[0043] Of the indexes selected from the indexes with the same least significant bit, the 2i-th and 2i+1-th indexes are the same except for the lowest two bits. Next, of the indexes selected from the indexes with the same least significant bit, the bit values ​​of the lowest two bits are selected for the 2i-th and 2i+1-th indexes. In this case, since only the bit values ​​of the lowest two bits need to be selected, the size of the EOHV can be 8 × 2 = 16.

[0044] Of the indexes selected from the indexes with the same lower two bits, the 2i-th and 2i+1-th indexes are the same except for the lower three bits. Next, of the indexes selected from the indexes with the same lower two bits, the bit values ​​of the lower three bits are selected for the 2i-th and 2i+1-th indexes. In this case, since only the bit values ​​of the lower three bits need to be selected, the size of the EOHV can be 8 × 3 = 24.

[0045] Thereafter, the selection function sel is similarly executed on only the parts of the selected indexes whose lower bits are different.

[0046] By the way, in the first sel, the index is not encrypted, so when EOHV(xy) is evaluated with 1-H, it becomes eval(1-H,EOHV(x i -x j ))=Enc(1-H(x i -x j ))=sel(x i ≧x j,0,1) gives the choice of index and there is no need to run the EOHV protocol.

[0047] Therefore, the total size of the EOHV is 8(N / 2) + 8 × 2(N / 2 2 )+8×3(N / 2 3 ) + + 8 × L(N / 2 L ) which is approximately (3 / 2)N.

[0048] In proposed method 1, which repeats the selection of an L-bit index N-1 times, the size of the EOHV is 8L(N-1), so in proposed method 2, the size of the EOHV can be reduced to approximately 3 / (16L) compared to proposed method 1.

[0049] Below, we consider a more efficient algorithm for securely computing argmax. When x, y ∈ S, there are 2|S|-1 possible values ​​for xy, so the size of the EOHV of Enc(xy) is 2|S|-1. Once EOHV(xy) is found, Enc(max(x,y)) and Enc(H(xy)) can be found simultaneously by applying ReLU and H. Then, the argmax ciphertext can be found by repeating the above index selection for c = Enc(H(xy)). In this case, the total number of ciphertext exchanges required is (2|S|-1)N+(3 / 2)N=(2|S|+1 / 2)N.

[0050] To summarize the above, the algorithm for secretly calculating argmax using EOHV according to Proposed Method 2 can be written as shown in Figure 2. The algorithm shown in Figure 2 repeats lines 5 to 13 (line 4) for i = 1 to L when N ciphertext sequences c[i] = Enc(v[i]) are given as input, and in this repetition, j = 0 to N / 2. (i-1)Lines 6 to 13 are then repeated for v[2j] (line 5). In the repetition of lines 6 to 13, we first calculate t = EOHV(v[2j] - v[2j+1]) (line 6), and then calculate c[j] = eval(ReLU,t) (line 7). This assigns Enc(max(v[2j],v[2j+1])) to c[j].

[0051] Next, when i=1, a[j]=eval(1-H,t) is calculated (lines 8-9). On the other hand, when i=1, t=eval(H,t) is first calculated (line 11). As a result, Enc(H(v[2j]-v[2j+1])) is assigned to t. After that, an index is selected by a[j]=sel(t,a[2j],a[2j+1]) (lines 10-13). As a result, Enc(argmax(v[2j],v[2j+1])) is assigned to a[j].

[0052] As a result of the above, Enc(max(v[i])) is ultimately stored in c[0] and Enc(argmax(v[i])) is stored in a[0].

[0053] As an example, a secure computation system 1 that calculates argmax using the above-mentioned proposed method 1 will be described below. However, the secure computation system 1 described below may also calculate argmax using the above-mentioned proposed method 2.

[0054] <Overall configuration example of secure computing system 1> An example of the overall configuration of the secure computation system 1 according to this embodiment will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the overall configuration of the secure computation system 1 according to this embodiment.

[0055] 3, the secure computation system 1 according to this embodiment includes a client 10 and a server 20. The client 10 and the server 20 are communicably connected via a communication network 30 including, for example, the Internet.

[0056] The client 10 is an information processing device (computer) that holds an input array v[i] (i = 0,...,N-1) and wants to obtain the maximum value of the input array v[i] and its index at that time without providing the input array v[i] (plain text) to the server 20.

[0057] The server 20 is an information processing device (computer) that calculates Enc(max(v[i])) and Enc(argmax(v[i])).

[0058] Note that the overall configuration of the secure computing system 1 shown in Fig. 3 is an example and is not limited to this. For example, only one client 10 is shown in the example shown in Fig. 3, but there may be multiple clients 10. Similarly, only one server 20 is shown in the example shown in Fig. 3, but there may be multiple servers 20.

[0059] <Example of functional configuration of the client 10 and the server 20 included in the secure computation system 1> Client 10 An example of the functional configuration of the client 10 according to this embodiment will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the functional configuration of the client 10 according to this embodiment.

[0060] 4, the client 10 according to this embodiment includes a communication unit 101 and a calculation unit 102. These units are realized, for example, by processing executed by a calculation device such as a CPU (Central Processing Unit) by one or more programs installed in the client 10. The client 10 according to this embodiment also includes a storage unit 103. The storage unit 103 is realized by a storage area of ​​a storage device such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory.

[0061] The communication unit 101 transmits various data to the server 20 and receives various data from the server 20 .

[0062] The calculation unit 102 executes various functions of the Lifted-ElGamal encryption and performs various calculations.

[0063] Storage unit 103 stores input arrays v[i] (i=0, , N-1) etc., where v[i]∈X, where X is a finite set. It is assumed that each input array v[i] is an integer equal to or greater than 0.

[0064] <Server 20> An example of the functional configuration of the server 20 according to this embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of the functional configuration of the server 20 according to this embodiment.

[0065] 5, the server 20 according to this embodiment includes a communication unit 201 and a calculation unit 202. These units are realized, for example, by a process in which one or more programs installed in the server 20 are executed by a calculation device such as a CPU. The server 20 according to this embodiment also includes a storage unit 203. The storage unit 203 is realized, for example, by a storage area of ​​a storage device such as an HDD, an SSD, or a flash memory.

[0066] The communication unit 201 receives various data from the client 10 and transmits various data to the client 10 .

[0067] The calculation unit 202 executes various functions of the Lifted-ElGamal encryption and performs various calculations.

[0068] The storage unit 203 stores information (for example, the public key pk generated by the client 10) required to calculate Enc(max(v[i])) and Enc(argmax(v[i])).

[0069] <Example> An example of the secure computation process executed by the secure computation system 1 according to this embodiment will be described below with reference to Fig. 6. Fig. 6 is a sequence diagram showing an example of the secure computation process in one example. Note that L is the smallest integer equal to or greater than log2(N), and X={0,1}×{0,1}×{0,1}.

[0070] The calculation unit 102 of the client 10 generates a public key pk and a secret key sk using a key generation function Gen of the Lifted-ElGamal cryptography (step S101).

[0071] The calculation unit 102 of the client 10 generates a ciphertext array c[i] by encrypting the input array v[i] with the encryption function Enc of the Lifted-ElGamal encryption using the public key pk (step S102), where c[i] = Enc(v[i]) for i = 0,...,N-1.

[0072] The communication unit 101 of the client 10 transmits the ciphertext array c[i] (i=0, . . . , N-1) to the server 20 (step S103).

[0073] The calculation unit 202 of the server 20 executes the above procedure a for c = c[i] - c[j] = Enc(v[i] - v[j]) to generate |X| ciphertext sequences c'[i'] (i'∈X) (step S104).

[0074] The communication unit 201 of the server 20 transmits |X| ciphertext sequences c'[i'] to the client 10 (step S105).

[0075] The calculation unit 102 of the client 10 executes the above procedure c using the private key sk to generate |X| ciphertext sequences c''[i'] (i'∈X) (step S106).

[0076] The communication unit 101 of the client 10 transmits the ciphertext sequence c''[i'] to the server 20 (step S107).

[0077] The calculation unit 202 of the server 20 generates EOHV(v[i] - v[j]) by performing the reverse operation of the shuffle executed in the above step S104 on each ciphertext array c''[i'] (i' ∈ X) (step S108).

[0078] The calculation unit 202 of the server 20 calculates Enc(max(v[i], v[j])) and Enc(argmax(v[i], v[j])) using EOHV(v[i] - v[j]) (step S109). Here, Enc(max(v[i], v[j])) can be calculated by eval(ReLU, EOHV(v[i] - v[j])). Also, Enc(argmax(v[i], v[j])) is calculated by first calculating eval(H, EOHV(v[i] - v[j])) = Enc(H(v[i] - v[j])), and then calculating it for c = Enc(H(v[i] - v[j])) using Enc(f((c, i k , j k ))). However, for k = 0, ···, L - 1, f((c, i k , j k )) = sel(c, i k [[ID=!4]], j k ).

[0079] For example, with i = 0 and j = 1 as initial values, by repeatedly executing the above steps S104 to S109 for i < j, Enc(max ! i (v[i])) and Enc(argmax i (v[i])) are obtained.

[0080] The communication unit 201 of the server 20 transmits Enc(max i (v[i])) and Enc(argmax i (v[i])) to the client 10 (step S110).

[0081] The calculation unit 102 of the client 10 decrypts Enc(max i (v[i])) and Enc(argmax i (v[i])) using the secret key sk (step S111). Thereby, maxi (v[i] and argmax i (v[i]) is obtained.

[0082] <Application example> As an application example of the above embodiment, an application example to a confidential image search system using CLIP (Contrastive Language-Image Pre-training) (Reference 2) will be described. CLIP is a machine learning model that is pre-trained using images and their corresponding text as training data. In the following, we will assume a case where images matching a search word are searched for while the search word is kept confidential.

[0083] CLIP is trained using a large amount of training data represented by (image, text) pairs. The image and text encoders that make up CLIP are trained simultaneously so that the cosine similarity between images and text in the same pair is high, and the cosine similarity between irrelevant images and text is low.

[0084] Hereinafter, the storage unit 203 of the server 20 stores the image I (i) (i=0, ,N-1) and these images I (i) The image vectors y (i) (i=0, ,N-1) are stored. In this case, the search word vector x={x0, ,x D-1} is hidden, and images I that match the search word are (i) Suppose we want to search for:

[0085] In this case, client 10 uses Enc(x)={Enc(x0), ,Enc(x D-1 )} is sent to the server 20, and the server 20 (i) ) and then calculate the maximum value Enc(max n (x y (i) )) and the index that gives the maximum value i'=Enc(argmax n (x y(i) )) is calculated by applying the above embodiment. Here, Enc(max i (x y (i) )) and i'=Enc(argmax i (x y (i) When the server 20 calculates Enc(x·y (i) )(i=0, ,N-1) is sent to client 10, and client 10 calculates the dot product v[i]:=x y (i) (i=0, , N-1) is obtained, and the above embodiment is applied. As a result, the server 20 obtains the image I corresponding to the search word. (i') can be sent to the client 10.

[0086] <Example of hardware configuration of client 10 and server 20> The client 10 and the server 20 according to this embodiment can be realized, for example, by the hardware configuration of a computer 500 shown in Fig. 7. Fig. 7 is a diagram showing an example of the hardware configuration of the computer 500.

[0087] 7 includes an input device 501, a display device 502, an external I / F 503, a communication I / F 504, a RAM (Random Access Memory) 505, a ROM (Read Only Memory) 506, an auxiliary storage device 507, and a processor 508. Each of these pieces of hardware is connected to each other via a bus 509 so as to be able to communicate with each other.

[0088] The input device 501 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 502 is, for example, a display, a display panel, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502, for example.

[0089] The external I / F 503 is an interface with an external device such as a recording medium 503a. Examples of the recording medium 503a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0090] The communication I / F 504 is an interface for connecting to a communication network. The RAM 505 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 506 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 507 is a non-volatile storage device such as an HDD, SSD, or flash memory. The processor 508 is, for example, a CPU or other computing device.

[0091] 7 is an example, and the hardware configuration of the computer 500 is not limited to this. For example, the computer 500 may have multiple auxiliary storage devices 507 or multiple processors 508, may not have some of the hardware shown in the figure, or may have various hardware other than the hardware shown in the figure.

[0092] <Summary> As described above, in the secure computation system 1 according to this embodiment, the server 20 can calculate the ciphertext of the maximum value of the input array v[i] and the ciphertext of the index at that time, without providing the plaintext of the input array v[i] (i=0, , N-1) held by the client 10 to the server 20. Moreover, in this case, the size of the EOHV can be set to |X|=8L, which makes it possible to significantly reduce the amount of communication between the client 10 and the server 20 compared to the conventional technology.

[0093] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0094] [References] Reference 1: Shigeo Mitsunari, "Future Cryptographic Technology Supporting the Cloud," Hidewa Systems, 2015. Reference 2: Alec Radford and Jong Wook Kim and Chris Hallacy and Aditya Ramesh and Gabriel Goh and Sandhini Agarwal and Girish Sastry and Amanda Askell and Pamela Mishkin and Jack Clark and Gretchen Krueger and Ilya Sutskever, "Learning Transferable Visual Models From Natural Language Supervision", Proceedings of the 38th International Conference on Machine Learning, PMLR 139 : 8748-8763, 2021, https: / / proceedings. mlr.press / v139 / radford21a.html. [Explanation of symbols]

[0095] 1. Secure Computing System 10 clients 20 servers 30 Communication Network 101 Communications Department 102 Calculation section 103 Storage section 201 Communications Department 202 Calculation Department 203 Storage section 500 computers 501 Input Device 502 Display device 503 External I / F 503a Recording media 504 Communication I / F 505 RAM 506 ROM 507 Auxiliary storage 508 processor 509 Bus

Claims

1. A secure computation system including a first information processing device that has an input array v[0], ..., v[N-1] that takes integer values, and a second information processing device that calculates a ciphertext of an index that gives the maximum value of the input array v[0], ..., v[N-1], The first information processing device The input arrays v[0], ..., v[N-1] are encrypted using homomorphic encryption to generate ciphertext arrays c[0]=Enc(v[0]), ..., c[N-1]=Enc(v[N-1]), respectively; transmitting the ciphertext array c[0], ..., c[N-1] to the second information processing device; The second information processing device Using the ciphertext array c[0], ..., c[N-1] and EOHV(v[i]-v[j]) (where i, j∈{0, ..., N-1}, i<j), calculate c=Enc(H(v[i]-v[j])) (where H(x) is a function that returns 1 if x≧0 and 0 if x<0), f((c,i ｋ , j ｋ ))=sel(c,i ｋ , j ｋ ) to Enc(f((c,i ｋ , j ｋ ))) to calculate Enc(argmax(v[i],v[j])), The sel(c,i ｋ , j ｋ ) is the k-th bit value i when i and j are expressed in binary. ｋ , j ｋ For c = Enc(1), Enc(i ｋ ), if c=Enc(0), then Enc(j ｋ ), which is a function that returns Secret computing system.

2. The homomorphic encryption is a Lifted-ElGamal encryption based on an additive cyclic group G of prime order p, The second information processing device For X:={0,1}×{0,1}×{0,1}, |X| random numbers r ｉ' ← Ｒ Select [0, p-1] and (r ｉ' ((c[i]-c[j])-Enc(i'))) ｉ'∈Ｘ transmits |X| ciphertext arrays c′[i′] obtained by shuffling the above to the first information processing device; The first information processing device decrypting the ciphertext array c'[i'] using the homomorphic encryption, and transmitting the ciphertext array c''[i'] to the first information processing device as Enc(1) if the decryption result is 0 or as Enc(0) if the decryption result is not 0; The second information processing device 2. The secure computation system according to claim 1, wherein the EOHV(v[i]-v[j]) is generated by performing an inverse shuffling operation on |X| ciphertext sequences c''[i'].

3. The second information processing device log ２ Let L be the smallest integer equal to or greater than (N), and for k = 0, ..., L-1, ｋ , j ｋ 3. The secure computing system according to claim 1, wherein Enc(argmax(v[i], v[j])) is calculated by calculating Enc(argmax(v[i], v[j])).

4. A secure computation method used in a secure computation system including a first information processing device that has an input array v[0], ..., v[N-1] that takes integer values, and a second information processing device that calculates a ciphertext of an index that gives a maximum value of the input array v[0], ..., v[N-1], The first information processing device, The input arrays v[0], ..., v[N-1] are encrypted using homomorphic encryption to generate ciphertext arrays c[0]=Enc(v[0]), ..., c[N-1]=Enc(v[N-1]), respectively; transmitting the ciphertext array c[0], ..., c[N-1] to the second information processing device; The second information processing device, Using the ciphertext array c[0], ..., c[N-1] and EOHV(v[i]-v[j]) (where i, j∈{0, ..., N-1}, i<j), calculate c=Enc(H(v[i]-v[j])) (where H(x) is a function that returns 1 if x≧0 and 0 if x<0), f((c,i ｋ , j ｋ ))=sel(c,i ｋ , j ｋ ) to Enc(f((c,i ｋ , j ｋ ))) to calculate Enc(argmax(v[i],v[j])), The sel(c,i ｋ , j ｋ ) is the k-th bit value i when i and j are expressed in binary. ｋ , j ｋ For c = Enc(1), Enc(i ｋ ), if c=Enc(0), then Enc(j ｋ ), which is a function that returns Confidential calculation method.

Images