Secret calculation system and secret calculation method

Abstract

To provide a secret calculation method and system capable of efficiently calculating an approximation of an inner product, using homomorphic encryption.SOLUTION: In a secret calculation system, a client and a server share an integer value S. The client sequentially divides each element xi of an integer vector x that it holds by Sw+1, ..., S to divide it into a set of integers (ai1, ai2, ..., aiw+1), and sends a ciphertext Enc(aij) in which the set of integers (ai1, ai2, ..., aiw+1) is encrypted by homomorphic encryption. The server sequentially divides each element yi of a vector y by Sw+1, ..., S to divide it into a set of integers (ai1', ai2', ..., aiw+1'), calculates a ciphertext cx'y, which is an approximation of an inner product of the integer vector x and the integer vector y, using the ciphertext Enc(aij) (1≤j≤w+1) and the set of integers (ai1', ai2', ..., aiw+1'), and sends the ciphertext cx'y to the client.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present disclosure relates to a secure computation system and a secure computation method. [Background technology]

[0002] Homomorphic encryption is a public key encryption method that allows calculations on encrypted data without a secret key (Non-Patent Document 1). By using homomorphic encryption, it is possible to perform inner product calculations while the data remains encrypted. For example, assume that there are two parties, client A and server B, and client A holds vector x and server B holds vector y. In this case, by using homomorphic encryption, client A can obtain the calculation result of the inner product x·y without providing server B with the plaintext of vector x. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Shigeo Mitsunari, "Future Cryptographic Technologies Supporting Cloud Computing," Hidewa Systems, 2015. Summary of the Invention [Problem to be solved by the invention]

[0004] However, inner product calculations using homomorphic encryption require many multiplications, which can increase the data size.

[0005] The present disclosure has been made in view of the above points, and aims to efficiently calculate an approximation of an inner product by using homomorphic encryption. [Means for solving the problem]

[0006] A secure computation system according to one embodiment of the present disclosure includes an integer-valued element x i(where D is a predetermined integer of 1 or more, and i is an integer value of 0 to D-1) and a first information processing device having an integer vector x composed of an element y i (where i is an integer value between 0 and D-1 inclusive), and a second information processing device that possesses an integer vector y composed of the integer vector x, wherein the first information processing device calculates each element x of the integer vector x by using an integer value S shared with the second information processing device. i S w+1 ,···,S (where w is a predetermined integer greater than or equal to 1) to obtain a set of integers (a i1 ,a i2 ,···,a iw+1 ) and divide the integer set (a i1 ,a i2 ,···,a iw+1 ) are encrypted by homomorphic encryption to obtain the ciphertext Enc(a ij ) (1≦j≦w+1) to the second information processing device, and the second information processing device uses the integer value S to calculate each element y of the integer vector y. i S w+1 ,···,S is divided into a set of integers (a i1 ',a i2 ',···,a iw+1 ') and the ciphertext Enc(a ij )(1≦j≦w+1) and the integer set (a i1 ',a i2 ',···,a iw+1 ') to generate a ciphertext c of an approximation of the inner product of the integer vector x and the integer vector y. x 'y, and x 'y to the first information processing device. [Effects of the Invention]

[0007] Homomorphic encryption can be used to efficiently compute an approximation of the dot product. [Brief explanation of the drawings]

[0008] [Figure 1]1 is a diagram illustrating an example of the overall configuration of a secure computing system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram illustrating an example of a functional configuration of a client according to the present embodiment. [Figure 3] FIG. 2 is a diagram illustrating an example of a functional configuration of a server according to the present embodiment. [Figure 4] FIG. 10 is a sequence diagram illustrating an example of a secure computation process according to the first embodiment. [Figure 5] FIG. 10 is a sequence diagram illustrating an example of a secure computation process according to the second embodiment. [Figure 6] FIG. 11 is a sequence diagram illustrating an example of a secure computation process according to the third embodiment. [Figure 7] FIG. 13 is a sequence diagram illustrating an example of a secure computation process according to the fourth embodiment. [Figure 8] FIG. 2 illustrates an example of a hardware configuration of a computer. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0010] <Conventional technology and its issues> ≪Homomorphic encryption≫ Homomorphic encryption (HE) is a homomorphic encryption method that has the property that when two ciphertexts are given, operations can be performed without plaintext or a secret key, and the operation results can be decrypted correctly. Homomorphic encryption is basically composed of a key generation function Gen, an encryption function Enc, a decryption function Dec, and a homomorphic operation function Eval.

[0011] The key generation function Gen is a preparatory function that outputs a pair of the public key pk and private key sk of the user who executed the function. However, depending on the homomorphic encryption method, the key generation function Gen may also output a key called an evaluation key ek. The evaluation key ek is a key used when performing homomorphic operation functions.

[0012] The encryption function Enc receives plaintext m to be transmitted and a public key pk as input, and outputs ciphertext C.

[0013] The decryption function Dec receives the secret key sk and the ciphertext C as input, and outputs the plaintext m or the symbol ⊥ indicating that decryption is not possible.

[0014] The homomorphic computation function Eval is a function that performs a predetermined operation on multiple ciphertexts encrypted with the same public key pk. Let m1 and m2 be plaintexts, and C1 and C2 be their corresponding ciphertexts. In this case, the homomorphic computation function Eval takes the ciphertexts C1 and C2 as input, and outputs a homomorphic computation result C or a symbol ⊥ indicating that a homomorphic computation is not possible. When the decryption function Dec is executed using this homomorphic computation result C as input, the following computation result is obtained by performing a predetermined operation on plaintext m1 and plaintext m2.

[0015]

number

[0016] Homomorphic encryption can be classified into Fully Homomorphic Encryption (FHE), Leveled Fully Homomorphic Encryption (LHE), and Partially Homomorphic Encryption (PHE) depending on the type of operations that can be performed without plaintext or secret key and whether or not there is a limit on the number of operations. Fully homomorphic encryption is an encryption method that is homomorphic for both additive and multiplicative operations. Fully homomorphic encryption that is homomorphic for both additive and multiplicative operations but has a limit on the number of operations is called Leveled Fully Homomorphic Encryption. Furthermore, Additive Homomorphic Encryption (AHE) and Multiplicative Homomorphic Encryption (MHE) are collectively called Partially Homomorphic Encryption. Additive homomorphic encryption and multiplicative homomorphic encryption are encryption methods that are homomorphic only in additive and multiplicative operations, respectively, and have lower computational costs than fully homomorphic encryption.

[0017] <<Vector Encryption>> Let x={x0,x1,...,x D-1}, y={y0,y1,···,y D-1}. Assume that there are two parties, client A and server B, where client A holds vector x and server B holds vector y. In this case, we consider using homomorphic encryption to allow client A to obtain the calculation result of the dot product x·y without providing vector x (its plaintext) to server B.

[0018] The following is the simplest possible configuration for using homomorphic encryption to obtain the calculation result of the inner product x·y without client A providing vector x to server B. However, homomorphic encryption must be homomorphic at least with respect to addition.

[0019] Step a. Client A generates an encryption key pair (public key pk and private key sk) using a key generation function Gen.

[0020] Step b. Client A encrypts vector x using public key pk with encryption function Enc, and generates encrypted vector c x =Enc(x):={Enc(x0),Enc(x1),...,Enc(x D-1 )}.

[0021] Step c. Client A receives the encrypted vector c x is sent to Server B.

[0022] Step d. Server B receives the encrypted vector c x Calculate the dot product of the plaintext vector y and the encrypted dot product value c x Create y.

[0023] Step e. Server B encrypts the dot product value c x Send y to client A.

[0024] Step f. Client A uses the secret key sk to decrypt the inner product value c using the decryption function Dec. x Decode y and obtain the calculation result of the dot product x·y.

[0025] <<Converting a value to an integer and calculating the product of that value and the encrypted integer>> Below, each element x of vector x i and each element y of vector y i is a real value, and both vector x and vector y are normalized. In this case, the decimal value x i and y i can be converted to an integer by multiplying by R. Unless otherwise specified, the integerized x i and y i Also, x i and y i It will be written as follows.

[0026] By the above integer conversion, client A can obtain Enc(x)={Enc(x0),Enc(x1),...,Enc(xD-1 )} to server B, server B obtains Enc(x i )y i =Enc(x i y i ) to calculate Enc(x y).

[0027] <Challenges> When calculating Enc(x y) on server B, i )y i It is necessary to perform the multiplication of Enc(x) D times, which may increase the data size. Note that when calculating plaintexts, the data size can be reduced by, for example, removing the least significant bit, but when calculating encrypted values, the least significant bits cannot be simply removed. For this reason, Enc(x i )y i The absolute value of the multiplication result needs to be reduced.

[0028] <Proposed method> Therefore, below, we propose a method for reducing the data size of Enc(x).

[0029] ≪Proposed method 1≫ Instead of doubling the amount of communication from client A to server B, an approximation of Enc((x·y) / S) is performed, where S is a predetermined integer greater than or equal to 2.

[0030] Specifically, for each i=0, ,D-1, x i =a i S+b i , y i =a i 'S+b i ' where a i x i The quotient when divided by S is a i ' is y i is the quotient when b is divided by S. i x i The remainder when dividing by S, b i ' is y iThe remainder when divided by S, and the absolute value of each is (sufficiently) smaller than S. In this case, x i y i =a i a i 'S 2 +(a i b i '+a i 'b i )S+b i b i ', so x i y i / S is a i a i 'S+(a i b i '+a i 'b i )=a i y i +b i (y i / S). As a result, client A can approximate Enc(x) by {(Enc(a0),Enc(b0)),(Enc(a1),Enc(b1)),...,(Enc(a D-1 ),Enc(b D-1 ))} to Server B, Server B receives x i y i The sum of the ciphertexts of the approximation values ​​of x·y / S can be calculated as the ciphertext of the approximation value of x·y / S. Therefore, client A can obtain the approximation value of the inner product value x·y by decrypting the ciphertext received from server B (ciphertext of the approximation value of x·y / S) and multiplying it by S. As a result, proposed method 1 can reduce the size of the ciphertext by 1 / S.

[0031] ≪Proposed method 2≫ Instead of tripling the amount of communication from client A to server B, we use Enc((x y) / S 2 ) is calculated approximately.

[0032] Specifically, for each i=0, ,D-1, x i =a i S 2 +b i S+c i , y i=a i 'S 2 +b i 'S+c i ' where a i x i S 2 The quotient when divided by a i ' is y i S 2 This is the quotient when divided by b. i x i S 2 The remainder when divided by b i ' is y i S 2 The absolute values ​​of each are S 2 Furthermore, it is assumed that c i is b i The remainder when dividing by S is c i ' is b i The remainder when divided by S, and the absolute value of each is (sufficiently) smaller than S. In this case, x i y i =a i a i 'S 4 +(a i b i '+a i 'b i )S 3 +(a i c i +b i b i '+a i 'c i ')S 2 +(b i c i '+b i 'c i )S+c i c i '. Therefore, x i y i / S 2 is a i a i 'S 2 +(a i b i '+a i 'b i )S+(a i c i +b i bi '+a i 'c i ')=a i y i +b i (y i / S)+c i (y i / S 2 ) can be approximated by the above. Therefore, instead of Enc(x), client A can use {(Enc(a0),Enc(b0),Enc(c0)),(Enc(a1),Enc(b1),Enc(c1)),...,(Enc(a D-1 ),Enc(b D-1 ),Enc(c D-1 ))} to Server B, Server B receives x i y i / S 2 The sum of the ciphertexts of the approximate values ​​of x y / S 2 Therefore, client A receives the ciphertext (x y / S 2 Decrypt the ciphertext (approximate value of S 2 By multiplying x by y, we can obtain an approximation of the inner product x·y. This makes it possible to reduce the size of the ciphertext in proposed method 2.

[0033] ≪Proposed method 3≫ The above proposed method 1 is x i (a i ,b i ), y i (a i ',b i Since the number of divisions is 2, it can be said that this is a method for calculating an approximation of the inner product x·y. Similarly, the above proposed method 2 is x i (a i ,b i ,c i ), y i (a i ',b i ',c i Since the number of divisions is three, it can be said that this is a method for calculating an approximation of the dot product x·y.

[0034] Therefore, as a more generalized version of the above proposed methods 1 and 2, we can consider a method of calculating an approximation of the inner product x·y with the division number w+1, where w is an integer greater than or equal to 1. That is, S w+1 ,S w ,···,Using S, x i and y i By dividing each, x i (a i1 ,a i2 ,···,a iw+1 ), y i (a i1 ',a i2 ',···,a iw+1 '), and then, as in the above proposed methods 1 and 2, (x y) / S w+1 can be approximated, where a i1 x i S w+1 The quotient when divided by a i2 x i S w+1 The remainder when divided by a i3 is a i2 S w The quotient when divided by a i4 is a i2 S w This is the remainder when divided by a. The rest can be considered in the same way. i1 ',a i2 ',···,a iw+1 The same is true for '.

[0035] This allows us to multiply the amount of communication from client A to server B by w times by Enc((x y) / S w+1 ) can be approximated.

[0036] ≪Proposed method 4≫ Binary expansion Constant S=2 n (where n is a non-negative integer). For a non-negative integer a, the quotient a by S is n :=floor(a / S) (where floor(·) is the floor function) and the remainder a mod S is expanded into binary numbers (a i ) i=0,···,n-1The concatenation of [a n :a n-1 :···:a0], which is called the binary expansion notation of a. n Note that for a negative integer a, after concatenating the quotient and the binary expansion of the remainder for -a, each element a i (i=0, ,n) and invert the sign of [a n :a n-1 :···:a0]=a02 0 +···+a n 2 n Note also that = a holds. Therefore, for each a i (i=0,···,n) may be called coefficients etc.

[0037] The above a i (i=0, ,n) is obtained by the following calculation for i=0, ,n when a non-negative integer a and a non-negative integer n are given.

[0038] v[ni]=floor(x / 2 (n-i) ) x=xv[ni]×2 (n-i) This allows v[0], ,v[n] to be a0, ,a n is obtained as:

[0039] Approximating the product of integers using binary expansion In proposed method 1, the approximation of the dot product value always involves truncation, which biases the results of the approximation toward smaller values. While increasing the number of divisions improves the approximation accuracy, it also creates the problem that the amount of communication from client A to server B increases in proportion to the number of divisions. In addition, the cost of calculation processing on server B also increases in proportion to the number of divisions.

[0040] Therefore, in proposed method 4, we use binary expansion to i y i The approximate value of / S is calculated as follows:

[0041] For example, let n=2. i =[x i,2 :x i,1 :x i,0 ], y i =[y i,2 :y i,1 :y i,0 ], then x i y i =(x i,2 [y i,2 :y i,1 :y i,0 ]+x i,1 [y i,2 :y i,1 ]+x i,0 y i,2 )·2 2 +(x i,1 y i,0 +x i,0 y i,1 )·2 1 +x i,0 y i,0 This becomes:

[0042] So, x i y i As an approximation of / S, x i,2 [y i,2 :y i,1 :y i,0 ]+x i,1 [y i,2 :y i,1 ]+x i,0 y i,2 Use.

[0043] This allows Enc(x i '):=(Enc(x i,2 ),Enc(x i,1 ),Enc(x i,0 )), then client A can use {Enc(x0'),Enc(x1'),...,Enc(x D-1 ')} to server B.

[0044] On the other hand, Server B is H (Enc(x i '),y i ):=Enc(x i,2 )[y i,2:y i,1 :y i,0 ]+Enc(x i,1 )[y i,2 :y i,1 ]+Enc(x i,0 )y i,2 To find Enc(x i y i / S) is an approximation of the mul H (Enc(x i '),y i ) can be calculated as the ciphertext of the approximate value of x y / S. i,2 :y i,1 ]=floor(y i / 2), y i,2 =floor(y i / 2 2 )

[0045] More generally, x i =[x i,n :x i,n-1 :···:x i,0 ], client A uses {Enc(x0'),Enc(x1'),···,Enc(x D-1 ')} to server B. However, Enc(x i '):=(Enc(x i,n ),Enc(x i,n-1 ),···,Enc(x i,0 )) is.

[0046] On the other hand, Server B is H (Enc(x i '),y i ):=Enc(x i,n )y i +Enc(x i,n-1 )foor(y i / 2 1 )+···+Enc(x i,0 )foor(y i / 2 n ) to find Enc(x i y i / S). Similarly, server B can calculate the mul H (Enc(x i '),y i ) can be calculated as the ciphertext of the approximate value of x y / S.

[0047] ≪Proposed method 5≫ In order to obtain a more accurate approximation than proposed method 4, the binary expansion is modified. Specifically, the parts that use floor functions in the normal binary expansion are changed to round functions. Hereafter, the binary expansion that has been modified in this way will be called the modified binary expansion. The round function is a function that outputs the result of rounding off its argument.

[0048] Modified binary expansion Constant S=2 n (where n is a non-negative integer). For a non-negative integer a, the quotient a by S is n :=round(a / S) (where round(·) is the round function) and the remainder a mod S is expanded into binary numbers (a i ) i=0,···,n-1 The concatenation of [a n :a n-1 :···:a0]', which is called the modified binary expansion notation of a. n Note that for a negative integer a, after concatenating the quotient and the binary expansion of the remainder for -a, each element a i (i=0, ,n) and invert the sign of [a n :a n-1 :···:a0]'=a02 0 +···+a n-1 2 n-1 +a n 2 n Note also that = a holds. Therefore, for each a i (i=0, ,n) may be called coefficients, etc. However, unlike the usual binary expansion, a n-1 ,···,a0 can take the values ​​0, 1, and -1.

[0049] The above ai (i=0, ,n) is obtained by the following calculation for i=0, ,n when a non-negative integer a and a non-negative integer n are given.

[0050] v[ni]=round(x / 2 (n-i) ) x=xv[ni]×2 (n-i) This allows v[0], ,v[n] to be a0, ,a n is obtained as:

[0051] In the modified binary expansion, [a n :a n-1 When only the top t items of [a :···:a0]' are extracted, n :···:a n+1-t ]'=round(a / 2 n+1-t For example, when n=3, the corrected binary expansion notation for a=0,...,8 is as shown in Table 1 below.

[0052] [Table 1] When a and b are moved within the range of 0 to 3000, the ab / 2 n Approximation of and modified binary expansion of round(ab / 2 n The results of examining the average absolute value of the difference and the maximum error are shown in Table 2 below.

[0053] [Table 2] Here, the numbers in parentheses in Table 2 above represent the maximum error. As shown in Table 2 above, the modified binary expansion has less error than the normal binary expansion.

[0054] Approximation of products of integers using modified binary expansion mul L (Enc(x i '),y i ):=Enc(x i,0 )yi,n-1 +Enc(x i,1 )y i,n-2 +···+Enc(x i,n-1 )y i,0 Let's say.

[0055] Server B uses Enc(x i ') and y i For mul H (Enc(x i '),y i ) and sum them. Similarly, Enc(x i ') and y i For mul L (Enc(x i '),y i ) and take the sum of them. H and c L are defined below, respectively.

[0056] c H :=mul H (Enc(x0'),y0)++mul H (Enc(x D-1 '),y D-1 ) c L :=mul L (Enc(x0'),y0)++mul L (Enc(x D-1 '),y D-1 ) And c L From c L / 2, Enc(x y / S) ≒ c H +c L / 2. This means that c H c L This means that the value corrected by / 2 is used as an approximation of Enc(x y / S). L The " / 2" in / 2 represents the process of dividing the plaintext by 2 as an integer and rounding it.

[0057] Therefore, x i =[x i,n :x i,n-1 :···:x i,0]', client A uses {Enc(x0'),Enc(x1'),···,Enc(x D-1 ')} to server B. However, Enc(x i '):=(Enc(x i,n ),Enc(x i,n-1 ),···,Enc(x i,0 )) is.

[0058] On the other hand, server B is H and c L After calculating L Find / 2 and c H +c L Let / 2 be an approximation of Enc(x·y / S).

[0059] A secure computation system 1 that calculates an approximation of the inner product of two vectors x and y using the above-mentioned proposed method 1, proposed method 2, proposed method 3, proposed method 4, or proposed method 5 will be described below.

[0060] <Overall configuration example of secure computing system 1> An example of the overall configuration of a secure computation system 1 according to this embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the overall configuration of a secure computation system 1 according to this embodiment.

[0061] 1, a secure computation system 1 according to this embodiment includes a client 10 and a server 20. The client 10 and the server 20 are communicably connected via a communication network 30 including, for example, the Internet.

[0062] The client 10 is an information processing device (computer) that holds a vector x and wants to obtain the calculation result of the dot product x·y without providing the vector x (plaintext) to the server 20. Note that the vector x is normalized, and each element x i (i=0, ,D-1) takes real values.

[0063] The server 20 holds a vector y and calculates (x y) / S (or (x y) / S 2 ya(x·y) / S w+1 ) is a type of information processing device (computer) that calculates the ciphertext of the approximate value of the vector y. i (i=0, ,D-1) takes real values.

[0064] Note that the overall configuration of the secure computing system 1 shown in Fig. 1 is an example and is not limited to this. For example, only one client 10 is shown in the example shown in Fig. 1, but there may be multiple clients 10. Similarly, only one server 20 is shown in the example shown in Fig. 1, but there may be multiple servers 20.

[0065] <Example of functional configuration of the client 10 and the server 20 included in the secure computation system 1> Client 10 An example of the functional configuration of the client 10 according to this embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the functional configuration of the client 10 according to this embodiment.

[0066] 2, the client 10 according to this embodiment includes a communication unit 101 and a calculation unit 102. These units are realized, for example, by processing executed by a calculation device such as a CPU (Central Processing Unit) by one or more programs installed in the client 10. The client 10 according to this embodiment also includes a storage unit 103. The storage unit 103 is realized by a storage area of ​​a storage device such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory.

[0067] The communication unit 101 transmits various data to the server 20 and receives various data from the server 20 .

[0068] The calculation unit 102 calculates each element x of the vector x.i is converted to an integer, or each element x is calculated using a predetermined S. i or divide each element x of vector x i to binary expansion notation or modified binary expansion notation, and perform various homomorphic encryption functions.

[0069] The storage unit 103 stores a vector x and S, which is an integer equal to or greater than 2 and is shared with the server 20. The storage unit 103 also stores each element x of the vector x. i Also memorize R to convert into an integer.

[0070] <Server 20> An example of the functional configuration of the server 20 according to this embodiment will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the functional configuration of the server 20 according to this embodiment.

[0071] 3, the server 20 according to this embodiment includes a communication unit 201 and a calculation unit 202. These units are realized, for example, by a process in which one or more programs installed in the server 20 are executed by a calculation device such as a CPU. The server 20 according to this embodiment also includes a storage unit 203. The storage unit 203 is realized, for example, by a storage area of ​​a storage device such as an HDD, an SSD, or a flash memory.

[0072] The communication unit 201 receives various data from the client 10 and transmits various data to the client 10 .

[0073] The calculation unit 202 calculates each element y of the vector y. i is converted to an integer, or each element y is calculated using a predetermined S. i or (x y) / S or (x y) / S 2 , (x·y) / S w+1 Or calculate the ciphertext of an approximate value of .

[0074] The storage unit 203 stores a vector y and S, which is an integer equal to or greater than 2 and is shared with the client 10. The storage unit 203 also stores each element y of the vector y. iAlso store R for integerization.

[0075] <Example> Hereinafter, an example of the secret calculation process executed by the secret calculation system 1 according to the present embodiment will be described. In the following Examples 1 to 4, let S = 2 n be represented by a certain natural number n. In the following Examples 1 to 4, the elliptic Lifted ElGamal encryption method is used as the homomorphic encryption, but this is just an example, and the following Examples 1 to 4 can also be applied to homomorphic encryption other than the elliptic Lifted ElGamal encryption method. More precisely, in the following Examples 1 to 4, any homomorphic encryption having at least additive homomorphic property can be used.

[0076] ≪Elliptic Lifted ElGamal Encryption Method≫ In the following Examples 1 to 4, the elliptic Lifted ElGamal encryption method (Non-Patent Document 1) is used as an example of an encryption method having additive homomorphic property. The elliptic Lifted ElGamal encryption method is composed of the following key generation function Gen, encryption function Enc, decryption function Dec, and homomorphic operation function Eval.

[0077] · Key Generation Function Gen Let G = 〈P〉 be a cyclic group on an elliptic curve with a prime number of digits p. Here, P is a generator of the cyclic group G. At this time, let s be an integer of 0 ≦ s < p, and the key generation function Gen outputs s as the secret key and sP as the public key. <000105-2>

[0078] · Encryption Function Enc Let the plaintext be m. At this time, the encryption function Enc selects a random number r from 0 ≦ r < p with the plaintext m and the public key sP as inputs, and outputs Enc(m) = (mP + rsP, rP).

[0079] · Decryption Function Dec Let C = (C1, C2). In this case, the decryption function Dec takes the secret key s and the ciphertext C as input, calculates C1-sC2 = (mP+rsP)-s(rP) = mP, and then outputs the plaintext m by solving the discrete logarithm problem (DLP).

[0080] Homomorphic operation function Eval Let C1 = Enc(m1) and C2 = Enc(m2) be the ciphertexts corresponding to two plaintexts m1 and m2, respectively. In this case, the homomorphic operation function Eval adds each component of the two ciphertexts C1 and C2 and outputs the result as the homomorphic operation result C.

[0081] Furthermore, since Enc(m1)+Enc(m2)=(m1P+r1sP,r1P)+(m2P+r2sP,r2P)=((m1+m2)P+(r1+r2)sP,(r1+r2)P)=Enc(m1+m2), additive homomorphism can be confirmed.

[0082] <Secrecy computation process (Example 1)> A case where secure computation processing is performed by the above-mentioned proposed method 1 will be described with reference to Fig. 4. Fig. 4 is a sequence diagram showing an example of secure computation processing in the first embodiment.

[0083] The calculation unit 102 of the client 10 calculates each element x of the vector x stored in the storage unit 103. i By multiplying by R, each element x i is converted into an integer (step S101). i Also x i In addition, each element x of vector x is i The integer conversion of may be performed in advance.

[0084] The calculation unit 102 of the client 10 generates a public key sP and a private key s using a key generation function Gen (step S102).

[0085] The calculation unit 102 of the client 10 calculates each element x of the vector x using S stored in the storage unit 103.i (a i ,b i ) (Step S103). i =a i S+b i a i x i The quotient when dividing by S, b i x i is the remainder when divided by S, and b i The absolute value of is assumed to be sufficiently smaller than S. Note that each element x of vector x i The division may have been performed in advance.

[0086] The calculation unit 102 of the client 10 uses the public key sP to encrypt the divided encrypted vector c by the encryption function Enc. x ={(Enc(a0),Enc(b0)),(Enc(a1),Enc(b1)),...,(Enc(a D-1 ),Enc(b D-1 ))} is generated (step S104).

[0087] The communication unit 101 of the client 10 receives the divided encrypted vector c x is transmitted to the server 20 (step S105).

[0088] On the other hand, the calculation unit 202 of the server 20 calculates each element y of the vector y stored in the storage unit 203. i By multiplying by R, each element y i is converted into an integer (step S106). i Also i In addition, each element y of vector y is i The integer conversion of may be performed in advance.

[0089] The calculation unit 202 of the server 20 calculates each element y of the vector y using S stored in the storage unit 203. i (a i ',b i (Step S107). i =a i 'S+b i'. Also, a i Yes i The quotient when dividing by S, b i ' is y i is the remainder when divided by S, and b i The absolute value of ' is assumed to be sufficiently smaller than S. Note that each element y of vector y i The division may have been performed in advance.

[0090] The calculation unit 202 of the server 20 calculates each b i ' for b i ' / S is calculated (step S108). i The calculation of ' / S may be performed in advance.

[0091] The calculation unit 202 of the server 20 calculates the divided encrypted vector c received from the client 10. x and vector y and each a i ' and b i ' / S(i=0, ,D-1) and encrypt the ciphertext of the approximate value of x·y / S by the approximate inner product c x 'y (step S109). That is, the calculation unit 202 calculates the divided encrypted vector c x and vector y and each a i ' and b i ' / S, for each i=0,...,D-1, Enc(a i )y i +Enc(b i )(y i / S)=Enc(a i )y i +Enc(b i )a i '+Enc(b i )(b i ' / S), and their sum is the encrypted approximate inner product c x Calculate as 'y.

[0092] The communication unit 201 of the server 20 receives the encrypted approximate inner product c x 'y is sent to the client 10 (step S110).

[0093] The calculation unit 102 of the client 10 calculates the encrypted approximate inner product c received from the server 20 using the private key s. x 'y is decrypted and multiplied by S (step S111). This provides an approximation of the inner product x·y. However, for example, if the server 20 wants to obtain an encrypted text of the approximation of the inner product, the calculation unit 202 may use the encrypted approximate inner product c x 'You can multiply y by S.

[0094] <Secrecy computation process (Example 2)> A case where secure computation processing is performed by the above-mentioned proposed method 2 will be described with reference to Fig. 5. Fig. 5 is a sequence diagram showing an example of secure computation processing in the second embodiment.

[0095] The calculation unit 102 of the client 10 calculates each element x of the vector x stored in the storage unit 103. i By multiplying by R, each element x i is converted into an integer (step S201). i Also x i In addition, each element x of vector x is i The integer conversion of may be performed in advance.

[0096] The calculation unit 102 of the client 10 generates a public key sP and a private key s using a key generation function Gen (step S202).

[0097] The calculation unit 102 of the client 10 calculates each element x of the vector x using S stored in the storage unit 103. i (a i ,b i ,c i ) (Step S203). i =a i S 2 +b i S+c i a i x i S 2 The quotient when divided by b i x i S 2is the remainder when divided by b i The absolute value of is S 2 Also, c i is b i is the remainder when divided by S, and its absolute value is sufficiently smaller than S. Note that each element x of vector x is i The division may have been performed in advance.

[0098] The calculation unit 102 of the client 10 uses the public key sP to encrypt the divided encrypted vector c by the encryption function Enc. x ={(Enc(a0),Enc(b0),Enc(c0)),(Enc(a1),Enc(b1),Enc(c1)),...,(Enc(a D-1 ),Enc(b D-1 ),Enc(c D-1 ))} is generated (step S204).

[0099] The communication unit 101 of the client 10 receives the divided encrypted vector c x is transmitted to the server 20 (step S205).

[0100] On the other hand, the calculation unit 202 of the server 20 calculates each element y of the vector y stored in the storage unit 203. i By multiplying by R, each element y i is converted into an integer (step S206). i Also i In addition, each element y of vector y is i The integer conversion of may be performed in advance.

[0101] The calculation unit 202 of the server 20 calculates each element y of the vector y using S stored in the storage unit 203. i (a i ',b i ',c i ') (step S207). i =a i 'S 2 +b i 'S+c i ' is. a i' is y i S 2 The quotient when divided by b i ' is y i S 2 is the remainder when divided by b i The absolute value of ' is S 2 Also, c i ' is b i The remainder when ' is divided by S, and its absolute value is sufficiently smaller than S. Note that each element y of vector y i The division may have been performed in advance.

[0102] The calculation unit 202 of the server 20 calculates each b i 'vs. b i ' / S, each c i ' for c i ' / S and c i ' / S 2 (Step S208). i ' / S,c i ' / S and c i ' / S 2 The calculation of may be performed in advance.

[0103] The calculation unit 202 of the server 20 calculates the divided encrypted vector c received from the client 10. x and vector y and each a i ', b i ', b i ' / S,c i ' / S and c i ' / S 2 (i=0, ,D-1) and x y / S 2 Encrypt the ciphertext of the approximate value of c x 'y (step S209). That is, the calculation unit 202 calculates the divided encrypted vector c x and vector y and each a i ', b i ', b i ' / S,c i ' / S and c i ' / S 2 and for each i=0, ,D-1, Enc(a i )yi +Enc(b i )(y i / S)+Enc(c i )(y i / S 2 ) and sum them to the encrypted approximate inner product c x Calculate as 'y.

[0104] The communication unit 201 of the server 20 receives the encrypted approximate inner product c x 'y is sent to the client 10 (step S210).

[0105] The calculation unit 102 of the client 10 calculates the encrypted approximate inner product c received from the server 20 using the private key s. x After decrypting 'y, S 2 In this way, an approximation of the inner product x·y is obtained. However, for example, when the server 20 wants to obtain an encrypted text of the approximation of the inner product, the calculation unit 202 calculates the encrypted approximate inner product c x 'y to S 2 You can double it.

[0106] Note that, although the above example 1 describes one example of proposed method 1, and example 2 describes one example of proposed method 2, proposed method 3 is a generalized version of proposed methods 1 and 2, and therefore the secure computing system 1 according to this embodiment can similarly implement proposed method 3.

[0107] <Secrecy computation process (Example 3)> A case where secure computation processing is performed by the above-mentioned proposed method 4 will be described with reference to Fig. 6. Fig. 6 is a sequence diagram showing an example of secure computation processing in the third embodiment.

[0108] The calculation unit 102 of the client 10 calculates each element x of the vector x stored in the storage unit 103. i By multiplying by R, each element x i is converted into an integer (step S301). i Also x i In addition, each element x of vector x is iThe integer conversion of may be performed in advance.

[0109] The calculation unit 102 of the client 10 generates a public key sP and a private key s using a key generation function Gen (step S302).

[0110] The calculation unit 102 of the client 10 calculates each element x of the vector x. i is expressed in binary expansion notation x i =[x i,n :x i,n-1 :···:x i,0 ] (step S303). i The binary expansion of may be performed beforehand.

[0111] The calculation unit 102 of the client 10 uses the public key sP to encrypt the divided encrypted vector c by the encryption function Enc. x ={Enc(x0'),Enc(x1'),...,Enc(x D-1 where Enc(x ')} is generated (step S304). i '):=(Enc(x i,n ),Enc(x i,n-1 ),···,Enc(x i,0 )) is.

[0112] The communication unit 101 of the client 10 receives the divided encrypted vector c x is transmitted to the server 20 (step S305).

[0113] On the other hand, the calculation unit 202 of the server 20 calculates each element y of the vector y stored in the storage unit 203. i By multiplying by R, each element y i is converted into an integer (step S306). i Also i In addition, each element y of vector y is i The integer conversion of may be performed in advance.

[0114] The calculation unit 202 of the server 20 calculates each element y of the vector y. i is expressed as binary expansion yi =[y i,n :y i,n-1 :···:y i,0 ] (step S307). i The binary expansion of may be performed beforehand.

[0115] The calculation unit 202 of the server 20 calculates mul H (Enc(x i '),y i ) is calculated as the encrypted approximate inner product c x 'y is calculated (step S308).

[0116] The communication unit 201 of the server 20 receives the encrypted approximate inner product c x 'y is sent to the client 10 (step S309).

[0117] The calculation unit 102 of the client 10 calculates the encrypted approximate inner product c received from the server 20 using the private key s. x 'y is decrypted and multiplied by S (step S310). This provides an approximation of the inner product x·y. However, for example, if the server 20 wants to obtain an encrypted text of the approximation of the inner product, the calculation unit 202 may use the encrypted approximate inner product c x 'You can multiply y by S.

[0118] <Secrecy computation process (Example 4)> A case where secure computation processing is performed by the above-mentioned proposed method 5 will be described with reference to Fig. 7. Fig. 7 is a sequence diagram showing an example of secure computation processing in the fourth embodiment.

[0119] The calculation unit 102 of the client 10 calculates each element x of the vector x stored in the storage unit 103. i By multiplying by R, each element x i is converted into an integer (step S401). i Also x i In addition, each element x of vector x is i The integer conversion of may be performed in advance.

[0120] The calculation unit 102 of the client 10 generates a public key sP and a private key s using a key generation function Gen (step S402).

[0121] The calculation unit 102 of the client 10 calculates each element x of the vector x. i Corrected binary expansion notation x i =[x i,n :x i,n-1 :···:x i,0 ]' (step S403). i A modified binary expansion of may be performed beforehand.

[0122] The calculation unit 102 of the client 10 uses the public key sP to encrypt the divided encrypted vector c by the encryption function Enc. x ={Enc(x0'),Enc(x1'),...,Enc(x D-1 where Enc(x ')} is generated (step S504). i '):=(Enc(x i,n ),Enc(x i,n-1 ),···,Enc(x i,0 )) is.

[0123] The communication unit 101 of the client 10 receives the divided encrypted vector c x is transmitted to the server 20 (step S405).

[0124] On the other hand, the calculation unit 202 of the server 20 calculates each element y of the vector y stored in the storage unit 203. i By multiplying by R, each element y i is converted into an integer (step S406). i Also i In addition, each element y of vector y is i The integer conversion of may be performed in advance.

[0125] The calculation unit 202 of the server 20 calculates each element y of the vector y. i Corrected binary expansion notation y i =[y i,n:y i,n-1 :···:y i,0 ]' (step S407). i A modified binary expansion of may be performed beforehand.

[0126] The calculation unit 202 of the server 20 calculates H and c L After calculating L Find / 2 and c H +c L / 2 is encrypted using the approximate inner product c x 'y is calculated (step S408).

[0127] The communication unit 201 of the server 20 receives the encrypted approximate inner product c x 'y is sent to the client 10 (step S409).

[0128] The calculation unit 102 of the client 10 calculates the encrypted approximate inner product c received from the server 20 using the private key s. x 'y is decrypted and multiplied by S (step S410). This provides an approximation of the inner product x·y. However, for example, if the server 20 wants to obtain an encrypted text of the approximation of the inner product, the calculation unit 202 may use the encrypted approximate inner product c x 'You can multiply y by S.

[0129] <Secrecy computation processing (application example)> As an application example of the above-mentioned first embodiment, an application example to a confidential image search system using CLIP (Contrastive Language-Image Pre-training) (Reference 1) will be described. CLIP is a machine learning model that is pre-trained using images and their corresponding text as training data. In the following, it is assumed that images matching a search word are searched for while the search word is kept confidential.

[0130] CLIP is trained using a large amount of training data represented by (image, text) pairs. The image and text encoders that make up CLIP are trained simultaneously so that the cosine similarity between images and text in the same pair is high, and the cosine similarity between irrelevant images and text is low.

[0131] Hereinafter, the storage unit 203 of the server 20 stores the image I (n) (n=0, ,N-1) and these images I (n) The image vectors y (n) (n=0, ,N-1) are stored. In this case, the search word vector x, which is obtained by vectorizing the search word using a text encoder, is kept secret. (n) The process of searching for the search word vector x and each image vector y is realized by the following steps 1 to 12. (n) In both cases, D=512 and they are normalized.

[0132] Step 1: The calculation unit 102 of the client 10 generates a search word vector x from a search word using the text encoder of CLIP.

[0133] Step 2: The calculation unit 102 of the client 10 calculates each element x of the search word vector x in the same way as in step S101 of FIG. i is converted to an integer. Hereafter, the element x after the conversion is i Also x i I will write it as follows.

[0134] Step 3: The calculation unit 102 of the client 10 generates the public key sP and the private key s using the key generation function Gen, similar to step S102 in FIG.

[0135] Step 4: The calculation unit 102 of the client 10 calculates each element x of the search word vector x in the same way as in step S103 of FIG. i (a i ,b i ) into

[0136] Step 5: The calculation unit 102 of the client 10 uses the public key sP to encrypt the divided encrypted vector c using the encryption function Enc, as in step S104 of FIG. x ={(Enc(a0),Enc(b0)),(Enc(a1),Enc(b1)),...,(Enc(a D-1 ),Enc(b D-1 ))}.

[0137] Step 6: The communication unit 101 of the client 10 receives the divided encrypted vector c in the same manner as in step S105 of FIG. x is sent to the server 20.

[0138] Step 7: Meanwhile, the calculation unit 202 of the server 20 calculates each image vector stored in the storage unit 203 in the same manner as in step S106 of FIG. (n) (n=0, ,N-1) i (n) The element y after integerization is i (n) Also i (n) In addition, each image vector y (n) Each element y i (n) The integer conversion of may be performed in advance.

[0139] Step 8: As in step S107 of FIG. 4, the calculation unit 202 of the server 20 calculates each image vector using S stored in the storage unit 203. (n) Each element y i (n) (a i (n) ',b i (n) ') where each image vector y (n) Each element y i (n) The division may have been performed in advance.

[0140] Step 9: The calculation unit 202 of the server 20 calculates each b i(n) ' for b i (n) ' / S is calculated. i (n) The calculation of ' / S may be performed in advance.

[0141] Step 10: The calculation unit 202 of the server 20 calculates the divided encrypted vector c received from the client 10. x and each image vector y (n) and each a i (n) ' and b i (n) ' / S(i=0, ,D-1) and x y (n) / S approximate ciphertext is encrypted using approximate inner product c x 'y (n) That is, the calculation unit 202 calculates the encrypted approximate inner product c x 'y (n) , respectively. This allows us to calculate N encrypted approximate inner products c x 'y (0) ,···,c x 'y (N-1) Here, ||x||=||y (n) ||=R 2 Therefore, the encryption approximate inner product c x 'y (n) The larger the value, the larger the search word vector x and image vector y (n) Note that the cosine similarity to

[0142] Step 11: The calculation unit 202 of the server 20 calculates the encrypted approximate inner product c x 'y (n) (n=0, ,N-1) x 'y (n) After identifying the index n for which is the largest, image I (n) is obtained from the storage unit 203. Here, the encrypted approximate inner product c x 'y (n) The index n at which argmax is largest (i.e., n←argmax n c x'y (n) ) can be determined by any existing method. For example, by repeatedly applying a function that takes two ciphertexts Enc(a) and Enc(b) as input and outputs the ciphertext with the larger value of the original plaintexts a and b, the encrypted approximate inner product c x 'y (n) Alternatively, for example, we can use EOHV (Encrypted One Hot Vector) (Reference 2) and a selection function sel(c, x, y) that returns x when c = 1 and y when c = 0 to find the encrypted approximate inner product c x 'y (n) It is also possible to identify the index n at which maxima

[0143] Step 12: The communication unit 201 of the server 20 receives the image I acquired in step 11 above. (n) This allows the client 10 to retrieve images I that match the search word. (n) can be obtained.

[0144] Although the above description concerns a secure image retrieval system using CLIP as an application example of the first embodiment, the second to fourth embodiments can also be applied to a secure image retrieval system. However, when the fourth embodiment is applied to a secure image retrieval system, not only additive homomorphism but also multiplicative homomorphism is required. Therefore, for example, when an elliptic curve Lifted ElGamal encryption method or the like is used, EOHV must be used for multiplication.

[0145] As an example, when the fourth embodiment is applied to a secure image search system, a comparison of data sizes will be described using an elliptic Lifted ElGamal encryption scheme with additive homomorphism as the encryption scheme and EOHV for the multiplication part. L The size of EOHV required to find / 2 is |x0y n-1 +···+x n-1 y0|D=nD. S=2 n+1 In c L The approximate value when corrected by / 2 is S=2 n In cL If the approximation is better than the approximation without the correction by / 2, then the size of the entire EOHV including argmax can be reduced as a result (however, if R is the maximum possible absolute value of the plaintext (a positive integer), then 2R 2 ≧(s+1)D. Specifically, S=2 n In c L If no correction by / 2 is made, the data size of the entire EOHV is (2R 2 / 2 n )N, S=2 n+1 In c L When correction is made by / 2, the data size of the entire EOHV is (2R 2 / 2 n+1 +(n+1)D)N, where N is the number of images.

[0146] <Example of hardware configuration of client 10 and server 20> The client 10 and the server 20 according to this embodiment can be realized, for example, by the hardware configuration of a computer 500 shown in Fig. 8. Fig. 8 is a diagram showing an example of the hardware configuration of the computer 500.

[0147] 8 includes an input device 501, a display device 502, an external I / F 503, a communication I / F 504, a RAM (Random Access Memory) 505, a ROM (Read Only Memory) 506, an auxiliary storage device 507, and a processor 508. Each of these pieces of hardware is connected to each other via a bus 509 so as to be able to communicate with each other.

[0148] The input device 501 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 502 is, for example, a display, a display panel, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502, for example.

[0149] The external I / F 503 is an interface with an external device such as a recording medium 503a. Examples of the recording medium 503a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0150] The communication I / F 504 is an interface for connecting to a communication network. The RAM 505 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 506 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 507 is a non-volatile storage device such as an HDD, SSD, or flash memory. The processor 508 is, for example, a CPU or other computing device.

[0151] 8 is an example, and the hardware configuration of the computer 500 is not limited to this. For example, the computer 500 may have multiple auxiliary storage devices 507 or multiple processors 508, may not have some of the hardware shown in the figure, or may have various types of hardware other than the hardware shown in the figure.

[0152] <Summary> As described above, in the secure computation system 1 according to this embodiment, the client 10 can obtain an approximation of the inner product x·y between the client 10 and the vector y held by the server 20, without providing the plaintext of the vector x held by the client 10 to the server 20. Moreover, at this time, the data size of the ciphertext of the vector x can be reduced, so that the server 20 can efficiently calculate the ciphertext of the approximate value.

[0153] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0154] [References] Reference 1: Alec Radford and Jong Wook Kim and Chris Hallacy and Aditya Ramesh and Gabriel Goh and Sandhini Agarwal and Girish Sastry and Amanda Askell and Pamela Mishkin and Jack Clark and Gretchen Krueger and Ilya Sutskever, "Learning Transferable Visual Models From Natural Language Supervision", Proceedings of the 38th International Conference on Machine Learning, PMLR 139 : 8748-8763, 2021, https: / / proceedings. mlr.press / v139 / radford21a.html. Reference 2: K. Nuida, S. Ohata, S. Mitsunari, and N. Attrapadung., "Arbitrary univariate function evaluation and re-encryption protocols over lifted-elgamal type ciphertexts.", Cryptology ePrint Archive, Report 2019 / 1233, 2019. https: / / eprint.iacr.org / 2019 / 1233. [Explanation of symbols]

[0155] 1. Secure Computing System 10 clients 20 servers 30 Communication Network 101 Communications Department 102 Calculation section 103 Storage section 201 Communications Department 202 Calculation Department 203 Storage section 500 computers 501 Input Device 502 Display device 503 External I / F 503a Recording media 504 Communication I / F 505 RAM 506 ROM 507 Auxiliary storage 508 processor 509 Bus

Claims

1. Integer-valued element x ｉ (where D is a predetermined integer of 1 or more, and i is an integer value of 0 to D-1) and an element y ｉ (where i is an integer value between 0 and D-1), and a second information processing device that possesses an integer vector y composed of The first information processing device Using the integer value S shared with the second information processing device, each element x of the integer vector x is ｉ S ｗ＋１ , ..., S (where w is a predetermined integer of 1 or more) to obtain a set of integers (a ｉ１ , a ｉ２ , ..., a ｉｗ＋１ ) and The set of integers (a ｉ１ , a ｉ２ , ..., a ｉｗ＋１ ) are encrypted by homomorphic encryption to obtain ciphertext Enc(a ｉｊ ) (1≦j≦w+1) to the second information processing device; The second information processing device Using the integer value S, each element y of the integer vector y is ｉ S ｗ＋１ , ..., S to obtain the set of integers (a ｉ１ ', a ｉ２ ', ..., a ｉｗ＋１ ') and The ciphertext Enc(a ｉｊ ) (1≦j≦w+1) and the integer set (a ｉ１ ', a ｉ２ ', ..., a ｉｗ＋１ '), the ciphertext c of the approximation of the inner product of the integer vector x and the integer vector y is obtained. ｘ 'Calculate y, The ciphertext c ｘ 'y to the first information processing device; Secret computing system.

2. The second information processing device x ｉ y ｉ / S ｗ＋１ The sum of the approximation values ​​of the ciphertexts for i is ｘ The secure computing system according to claim 1, wherein the secure computing system calculates the value of y as 'y'.

3. The second information processing device S ｗ＋１ , . . . , S, and further use the pre-computed values ​​of x ｉ y ｉ / S ｗ＋１ The sum of the approximation values ​​of the ciphertexts for i is ｘ 3. The secure computing system according to claim 1, wherein the secure computing system calculates the value of y as 'y'.

4. Integer-valued element x ｉ (where D is a predetermined integer of 1 or more, and i is an integer value of 0 to D-1) and an element y ｉ (where i is an integer value between 0 and D-1), and a second information processing device that possesses an integer vector y composed of The first information processing device Each element x of the integer vector x ｉ By expanding into binary numbers, the coefficient {x ｉｊ } ｊ＝０，・・・，ｎ Calculate The coefficient {x ｉｊ } ｊ＝０，・・・，ｎ are encrypted by homomorphic encryption to produce ciphertext Enc(x ｉｊ ) (0≦j≦n) to the second information processing device; The second information processing device Each element y of the integer vector y ｉ By expanding into binary numbers, the coefficient {y ｉｊ } ｊ＝０，・・・，ｎ Calculate The coefficient {y ｉｊ } ｊ＝０，・・・，ｎ and the ciphertext Enc(x ｉｊ ) (0≦j≦n) and x·y / 2 ｎ The ciphertext c of the approximate value of ｘ 'Calculate y, The ciphertext c ｘ 'y to the first information processing device; Secret computing system.

5. The first information processing device Each element x of the integer vector x ｉ is expanded into a modified binary number using a round function to obtain the coefficients {x ｉｊ } ｊ＝０，・・・，ｎ Calculate The second information processing device Each element y of the integer vector y ｉ is expanded into the modified binary number to obtain the coefficients {y ｉｊ } ｊ＝０，・・・，ｎ Calculate The coefficient {y ｉｊ } ｊ＝０，・・・，ｎ and the ciphertext Enc(x ｉｊ ) (0≦j≦n) and mul for i=0,...,D-1 Ｈ (Enc(x ｉ '), y ｉ ): = Enc(x ｉ，ｎ ) y ｉ +Enc(x ｉ，ｎ－１ ) for (y ｉ / 2 １ )+...+Enc(x ｉ，０ ) for (y ｉ / 2 ｎ ) sum c Ｈ , D−1. Ｌ (Enc(x ｉ '), y ｉ ): = Enc(x ｉ，０ ) y ｉ，ｎ－１ +Enc(x ｉ，１ ) y ｉ，ｎ－２ +...+Enc(x ｉ，ｎ－１ ) y ｉ，０ The sum of Ｌ By correcting with a value based on x·y / 2 ｎ The ciphertext c of the approximate value of ｘ The secure computation system according to claim 4, wherein 'y is calculated.

6. Integer-valued element x ｉ (where D is a predetermined integer of 1 or more, and i is an integer value of 0 to D-1) and an element y ｉ (where i is an integer value between 0 and D-1), and a second information processing device that possesses an integer vector y composed of The first information processing device, Using the integer value S shared with the second information processing device, each element x of the integer vector x is ｉ S ｗ＋１ , ..., S (where w is a predetermined integer of 1 or more) to obtain a set of integers (a ｉ１ , a ｉ２ , ..., a ｉｗ＋１ ) The set of integers (a ｉ１ , a ｉ２ , ..., a ｉｗ＋１ ) are encrypted by homomorphic encryption to obtain ciphertext Enc(a ｉｊ ) (1≦j≦w+1) to the second information processing device; The second information processing device, Using the integer value S, each element y of the integer vector y is ｉ S ｗ＋１ , ..., S to obtain the set of integers (a ｉ１ ', a ｉ２ ', ..., a ｉｗ＋１ '), The ciphertext Enc(a ｉｊ ) (1≦j≦w+1) and the integer set (a ｉ１ ', a ｉ２ ', ..., a ｉｗ＋１ '), the ciphertext c of the approximation of the inner product of the integer vector x and the integer vector y is obtained. ｘ Calculating 'y; The ciphertext c ｘ and transmitting 'y to the first information processing device. Confidential calculation method.

7. Integer-valued element x ｉ (where D is a predetermined integer of 1 or more, and i is an integer value of 0 to D-1) and an element y ｉ (where i is an integer value between 0 and D-1), and a second information processing device that possesses an integer vector y composed of The first information processing device, Each element x of the integer vector x ｉ By expanding into binary numbers, the coefficient {x ｉｊ } ｊ＝０，・・・，ｎ and calculating The coefficient {x ｉｊ } ｊ＝０，・・・，ｎ are encrypted by homomorphic encryption to produce ciphertext Enc(x ｉｊ ) (0≦j≦n) to the second information processing device; The second information processing device, Each element y of the integer vector y ｉ By expanding into binary numbers, the coefficient {y ｉｊ } ｊ＝０，・・・，ｎ and calculating The coefficient {y ｉｊ } ｊ＝０，・・・，ｎ and the ciphertext Enc(x ｉｊ ) (0≦j≦n) and x·y / 2 ｎ The ciphertext c of the approximate value of ｘ Calculating 'y; The ciphertext c ｘ and transmitting 'y to the first information processing device. Confidential calculation method.

Images