Policy violation detection device, policy violation detection method, and policy violation detection program

Abstract

To provide a policy violation detection device capable of determining whether or not an allocation result satisfies fairness without compromising the privacy of participants.SOLUTION: A verification server 1 comprises: a reception unit 11 that receives, from each terminal of participants, an allocation result and evaluation values serving as the basis of the allocation result in a state where they are encrypted by a homomorphic encryption scheme; a determination unit 12 that executes an algorithm for determining whether or not the allocation result is fair and calculates a value indicating a determination result in an encrypted state; and a transmission unit 13 that notifies of the calculated value in an encrypted state. The algorithm executes, without conditional branching, a step of obtaining a satisfaction level for each participant by calculating an inner product between a vector indicating an evaluation value for each of a plurality of resources and a one-hot vector indicating allocated resources in the allocation result, and a step of calculating, as the determination result, a logical product of all combinations of participants, with a case where satisfaction levels are equal as a value of 1 and a case where satisfaction levels are different as a value of 0.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a policy violation detection device, a policy violation detection method, and a policy violation detection program for detecting whether a processing result in an allocation problem violates a policy presented in advance. [Background technology]

[0002] Conventionally, fair allocation problems have been studied with the aim of realizing a certain kind of fair allocation (see, for example, Non-Patent Documents 1 and 2). Regarding fairness in allocation problems, many concepts have been proposed, such as proportionality and envy-freeness. With some fairness concepts, when a server that executes allocation processing falsely claims to be fair and presents an unfair allocation result, it is difficult to detect the false claim unless each participant's preference is made public.

[0003] For example, in the case of a matching problem, Patent Document 1 discloses a method for determining whether or not a policy has been violated when the matching algorithm is public, without disclosing one's preferences to other participants. Also, Patent Document 2 discloses a method for determining whether or not a policy has been violated when the matching algorithm is private but an algorithm for determining whether or not a policy has been violated exists, without disclosing one's preferences to other participants. Furthermore, Patent Document 3 discloses a method for detecting whether or not there is a policy violation in a server that provides stable matching without disclosing one's preferences to other participants. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2023-055512 [Patent Document 2] Patent Application No. 2022-152630 Specification [Patent Document 3] Patent Application No. 2023-177036 [Non-patent literature]

[0005] [Non-Patent Document 1] Sylvain Bouveret, Yann Chevaleyre, Nicolas Maudet, and Herve Moulin, "Fair Allocation of Indivisible Goods", 2016. [Non-patent document 2] Ariel D Procaccia, "Cake Cutting Algorithms", 2016. [Non-patent document 3] Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan, "(Leveled) Fully Homomorphic Encryption without Bootstrapping", ACM Transactions on Computation Theory (TOCT), 6(3):1-36, 2014. [Non-patent document 4] Zvika Brakerski and Vinod Vaikuntanathan, "Efficient Fully Homomorphic Encryption from (Standard) LWE", 2011 IEEE 52nd Annual Symposium on Foundations of Computer Science, pp. 97-106, 2011. [Non-patent document 5] Abbas Acar, Hidayet Aksu, A Selcuk Uluagac, and Mauro Conti, "A Survey on Homomorphic Encryption Schemes: Theory and Implementation", ACM Computing Surveys (Csur), 51(4):1-35, 2018. Summary of the Invention [Problem to be solved by the invention]

[0006] In the prior art, a method for detecting policy violations using homomorphic encryption has been proposed for privacy protection in the matching problem. Fully homomorphic encryption generally uses lattice cryptography, such as the BGV scheme described in Non-Patent Document 3. In lattice cryptography, an increase in noise when multiplication is performed becomes a problem, and correct decryption becomes impossible when the amount of noise exceeds a certain level. The BGV scheme is a type of homomorphic encryption known as leveled homomorphic encryption, which allows the number of times multiplication can be performed on one ciphertext to be set using parameters set in advance. Increasing the number of times multiplication can be performed generally increases the size of the ciphertext and the processing time. In addition, HELib, a library that provides an implementation of the BGV method, provides functions that perform various basic operations while keeping the data encrypted. One of the basic operations is the OR operation of bit strings, but this operation increases noise in the same way as multiplication.

[0007] When building an algorithm that assumes the use of homomorphic encryption, these issues must be taken into consideration and individually designed, and a simple combination will not solve the problem. However, the conventional technique uses homomorphic encryption to detect policy violations for matching problems, and therefore cannot be applied to allocation problems.

[0008] The present invention focuses on equitability in allocation problems and aims to provide a policy violation detection device, a policy violation detection method, and a policy violation detection program that can determine whether an allocation result satisfies equitability without compromising the privacy of participants. [Means for solving the problem]

[0009] The policy violation detection device of the present invention comprises a receiving unit that receives, from each of the terminals of the participants that have acquired allocation results of multiple resources to the participants, processed by an allocation server based on the evaluation values ​​of each of the multiple resources for each participant, the allocation results and the evaluation values ​​on which the allocation results are based, in an encrypted state using a homomorphic encryption method; a determining unit that executes an algorithm that determines whether the allocation results are equal or not based on the encrypted allocation results and the evaluation values ​​using the homomorphic encryption method, and calculates an encrypted value indicating the determination result; and a transmitting unit that transmits the encrypted value calculated by the determining unit to the terminal and has the terminal decrypt the value, thereby notifying whether the allocation results are equal or not.The algorithm causes the determining unit to execute the following steps without conditional branching: determining the satisfaction level of each of the participants by taking the inner product of a vector indicating the evaluation value for each of the multiple resources and a one-hot vector indicating the allocated resource in the allocation result; and calculating the logical product of all combinations of participants as the determination result, where 1 is set if the satisfaction levels are equal and 0 is set if the satisfaction levels are different.

[0010] The policy violation detection method of the present invention is carried out by a computer, which performs the following steps: a receiving step of receiving, from each of the terminals of the participants that has acquired an allocation result of a plurality of resources to the participant, the allocation result and the evaluation value on which the allocation result is based, in a state encrypted by a homomorphic encryption method; a determination step of executing, using the homomorphic encryption method, an algorithm for determining whether the allocation result is equal or not, based on the encrypted allocation result and the evaluation value, and calculating an encrypted value indicating the determination result; and a transmission step of sending the value calculated in the determination step to the terminal in an encrypted state and having the terminal decrypt the value, thereby notifying whether the allocation result is equal or not, wherein, in the determination step, the computer performs the steps of: determining the satisfaction level of each of the participants by taking the dot product of a vector indicating the evaluation value for each of the plurality of resources and a one-hot vector indicating the allocated resource in the allocation result; and calculating the logical product of all combinations of the participants as the determination result, with 1 being the satisfaction level if the satisfaction levels are equal and 0 being the satisfaction levels if the satisfaction levels are different, without conditional branching.

[0011] A policy violation detection program according to the present invention is for causing a computer to function as the policy violation detection device. [Effects of the Invention]

[0012] According to the present invention, it is possible to determine whether the allocation result satisfies equality without compromising the privacy of the participants. [Brief explanation of the drawings]

[0013] [Figure 1] 1 is a diagram showing the overall configuration of a detection system that implements a policy violation detection method according to an embodiment, and an overview of the service. [Figure 2] FIG. 2 is a diagram illustrating a functional configuration of a validation server according to an embodiment. [Figure 3]FIG. 2 is a sequence diagram showing a flow of processing performed by a detection system according to an embodiment. [Figure 4] FIG. 10 illustrates allocation with equality in an embodiment. [Figure 5] FIG. 10 is a diagram illustrating an equality determination algorithm that can be executed in fully homomorphic encryption according to an embodiment. [Figure 6] FIG. 10 is a diagram illustrating an example of calculation by an equality determination algorithm in the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0014] An example of an embodiment of the present invention will be described below. In this embodiment, a service for allocating resources (products) to multiple participants is taken as an example of a service used by participants. If the service presents itself as implementing equal allocation but actually outputs results based on different policies, the policy violation detection method of this embodiment will detect the policy violation.

[0015] FIG. 1 is a diagram showing the overall configuration of a detection system 100 that implements a policy violation detection method according to this embodiment, and an overview of the service. The detection system 100 includes a verification server 1 (policy violation detection device), an allocation server 2 that provides an allocation service, and a terminal 3 for each of a plurality of participants that use the service.

[0016] The verification server 1 determines whether the result of the allocation process in the allocation server 2 violates the fairness policy presented in advance, and notifies the terminals 3 of the participants. Here, since the allocation algorithm is confidential, the verification server 1 does not verify whether the processing results match the results of executing the same algorithm as the allocation server 2, but rather determines whether the equality conditions presented as a policy are met.

[0017] Let n be the number of participants. Each participant receives a private input x1,…,x n and the private input of participant i is xi Let ∈X. In this case, the input x1,…,x n Suppose a participant (terminal 3) requests the allocation server 2 to provide a result y∈Y that satisfies a requirement L. L can be written as L⊆X×…×X×Y. That is, the participant's requirement is (x1,…,x n , y)∈L.

[0018] Allocation server 2 selects and provides y to participants. Allocation server 2 selects (x1,...,x n ,y)∈L, but if allocation server 2 is malicious, then (x1,…,x n , y') may choose y' that does not belong to L. The participant's terminal 3 communicates with the allocation server 2 and a third-party server, the verification server 1 (verifier), to execute the protocol and obtain from the verification server 1 the verification result that determines whether the allocation result satisfies equality. Here, the input is (x1,…,x n ,y), then (x1,…,x n Suppose there exists a decision algorithm that outputs 1 if y∈L, and 0 otherwise.

[0019] The requirements for the policy violation detection protocol in this embodiment are as follows: 1. Verifiability: Participants can choose x1,…,x n For the result y for (x1,…,x n Accept y if and only if ,y)∈L. 2. Privacy: The protocol ensures that participants' private inputs are not revealed to other participants or verifiers. 3. Selectability: The allocation server 2 can select any y∈Y.

[0020] The participants (terminals 3) and the verifier (verification server 1) are assumed to be semi-honest and are interested in the order of preference of the participants, but will not perform any processing other than the predetermined processing.

[0021] The terminal 3 sends information about the participants' preferences to the allocation server 2 (1). The allocation server 2 selects allocation results based on the received preferences of each participant and sends them to the terminal 3 of each participant (2). The terminal 3 that receives the allocation result sends the preference and allocation result encrypted using fully homomorphic encryption to the verification server 1 (3). The verification server 1 executes a judgment algorithm using homomorphic operations based on the encrypted preference data and the encrypted allocation result (4), and sends the encrypted verification result to the participant's terminal 3 (5).

[0022] Here, fully homomorphic encryption is encryption that allows arbitrary calculations to be performed while the data remains encrypted, and is defined as follows (see, for example, Non-Patent Documents 4 and 5).

[0023] Definition 1: Fully homomorphic encryption (HE) is a quintuple of algorithms (Setup, Keygen, Enc, Dec, Eval) that satisfy correctness, simplicity, and security. Setup param←Setup(1 λ ): Outputs the public parameter param. ·Key generation (pk,sk)←Keygen(param): It outputs the public encryption key pk and the private decryption key sk. ·Encryption c←Enc(pk,μ): Encrypt message μ∈{0,1} using public key pk and output ciphertext c. ·Decoding μ←Dec(sk,c): Decrypt the ciphertext c using the secret key sk and output the message μ. ·Homomorphic operation c^←Eval(C,(c1,…,c l ),pk): Using the public key pk, c1,...,c l For any circuit C:{0,1} l →Apply {0,1} and output the ciphertext c^.

[0024] Note that correctness is the property that ciphertext obtained by an encryption algorithm and a homomorphic computation algorithm can be correctly decrypted. Simplicity is the property that the size of the ciphertext after homomorphic computation does not depend on the size of the circuit used for the computation. Security is the property that the probability of a successful attack by an arbitrary attacker is negligibly small. It is obvious that if homomorphic operations are possible for any circuit, then fully homomorphic encryption can be constructed that is homomorphic operations for any algorithm. Therefore, we will redefine fully homomorphic encryption as follows. Hereafter, when we refer to fully homomorphic encryption, the following definition will be applied.

[0025] Definition 2 Fully homomorphic encryption HE is a quintuple of algorithms (Setup, Keygen, Enc, Dec, Eval) that satisfy correctness, simplicity, and security. Setup param←Setup(1 λ ): Outputs the public parameter param. ·Key generation (pk,sk)←Keygen(param): It outputs the public encryption key pk and the private decryption key sk. ·Encryption c←Enc(pk,μ): Encrypt any message μ using the public key pk and output the ciphertext c. ·Decoding μ←Dec(sk,c): Decrypt the ciphertext c using the secret key sk and output the message μ. ·Homomorphic operation c^←Eval(A,(c1,…,c n ),d,pk): Public key pk and ciphertext c1,...,c n Using and d, calculate an arbitrary algorithm A:X×…×X×Y→{0,1} and output the ciphertext ĉ.

[0026] FIG. 2 is a diagram showing the functional configuration of the validation server 1 in this embodiment. The validation server 1 is a server device that includes a control unit 10, a storage unit 20, various data input / output devices, communication devices, etc., but can be replaced by various information processing devices (computers) such as a personal computer.

[0027] The control unit 10 is a part that controls the entire validation server 1, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

[0028] The storage unit 20 is a storage area for various programs for causing the hardware group to function as the validation server 1, various data, and the like, and may be a ROM, RAM, flash memory, hard disk drive (HDD), or the like. Specifically, the memory unit 20 stores a program (policy violation detection program) for causing the control unit 10 to execute each function of this embodiment, as well as encrypted data such as verification request data and verification results from the participant's terminal 3.

[0029] The control unit 10 includes a receiving unit 11, a determining unit 12, and a transmitting unit 13. The receiving unit 11 receives, from each terminal 3 that has obtained the allocation results of multiple resources to participants, processed by the allocation server 2 based on the evaluation values ​​for each of the multiple resources of each participant, the allocation results and the evaluation values ​​on which the allocation results are based, in a state encrypted using a homomorphic encryption method.

[0030] The determination unit 12 executes the algorithm described below, which determines whether or not equality, the processing policy of the allocation server 2, is satisfied using the homomorphic encryption method, based on the encrypted allocation result and the encrypted evaluation value, and calculates a value indicating the determination result in an encrypted state.

[0031] The transmitting unit 13 transmits the value calculated by the determining unit 12 to the terminal 3 in an encrypted state, and by having the terminal 3 decrypt this value, notifies the terminal 3 of whether the allocation result by the allocation server 2 is fair or not as a verification result.

[0032] FIG. 3 is a sequence diagram showing the flow of processing performed by the detection system 100 in this embodiment. Here, the input (x1,…,x n ,y), for (x1,…,x n Assume that there exists a decision algorithm V that outputs 1 if y(y, y)∈L and 0 otherwise, and that V is homomorphically operandiable.

[0033] In step S1, the terminal 3A of the participant representative i'∈{1,...,n} executes Setup(1 λ ) to get the parameter param and publish it.

[0034] In step S2, terminal 3A executes Keygen(param) to obtain (pk, sk). Terminal 3A publishes the public key pk and distributes and shares the private key sk to the terminals 3 of all participants.

[0035] In step S3, the terminal 3 of each participant i transmits x i ∈X to allocation server 2.

[0036] In step S4, the allocation server 2 selects an arbitrary matching result yεY and transmits it to the terminal 3 of each participant.

[0037] In step S5, the terminal 3 of each participant i i 1 ←Enc(pk,x i ) and c 2 ←Enc(pk,y) is sent to the verification server 1 using a secure communication channel. 2 may be transmitted by only one arbitrary participant (for example, the terminal 3A of the representative i').

[0038] In step S6, the validation server 1 executes r'←Eval(V,(c1 1 ,…,c n 1 ),c 2, pk) and transmits the encrypted verification result r' to the terminal 3 of each participant.

[0039] In step S7, the terminal 3 of each participant i executes r←Dec(r',sk), and accepts the matching result y if r=1, and rejects it otherwise.

[0040] Below, we will explain the decision algorithm V for verifying the equality of allocation results and its specific implementation method using fully homomorphic encryption.

[0041] [Definition of Equality] Let N = {1, 2, ..., n} be a set of n participants, and M = {1, 2, ..., m} be a set of m products. For all participants i ∈ N, product preferences are expressed as a value function v i In general, the value function is a monotonic set function2 on the set of commodities. M →R.

[0042] For a bundle S ⊆ M, v i (S) represents the evaluation value of participant i for bundle S. Many existing documents assume the additivity of the value function, and in this embodiment, for any S ⊆ M, v i (S)=Σ j∈S v i ({j}). For simplicity, we will use v i ({j}) to v ij This will be expressed as follows.

[0043] Assuming the additivity of the value function, the value function can be determined simply by specifying the participant's evaluation value for each product. In other words, participant i's preference is expressed as an m-dimensional vector v i ={v i1 ,v i2 ,…,v im} can be expressed as In this embodiment, we focus on only the case where all products are allocated to participants (no overlaps or remainders). That is, the product allocation function for participants is π:N→2 Mwhere π(i) is the bundle assigned to participant i, and π(i)∩π(j)=φ,∪ i∈N π(i)=M.

[0044] Definition 3 (Equality) For an assignment Π, for any i, j∈N, v i (π(i))=v j (π(j)) When , Π has equality.

[0045] FIG. 4 is a diagram illustrating allocation with equality in this embodiment. It is assumed that participants 1 to 3 have preferences for products 1 to 5, respectively (for example, evaluation values ​​1 to 9), and that each participant is assigned a product framed in a bold frame. In this case, the evaluation value for the bundle (products 4 and 5) assigned to participant 1 is 1 + 8 = 9. Similarly, the evaluation value for the bundle (products 1 and 2) assigned to participant 2 and the evaluation value for the bundle (product 3) assigned to participant 3 are both 9.

[0046] Therefore, in this case, the allocation π has equality, but each participant cannot determine whether it has equality unless they know the value functions of the other participants. Therefore, each participant determines equality based on the verification results by the verification server 1.

[0047] [Implementation using fully homomorphic encryption] Open source software such as HElib that handles basic operations implemented using homomorphic encryption is available. A major issue with implementations using homomorphic libraries is that the results of conditional branching expressions cannot be known by the user due to encryption. Therefore, in this embodiment, an equality determination algorithm without conditional branching is constructed using only the basic operations provided in the public library. The functions used are as follows: 1. Addition of two integers: ADD(x,y) adds integer x and integer y and outputs the result x+y. 2. Multiplication of an integer and a bit: MULT(x,y) outputs the integer x when bit y=1 and the integer 0 when y=0. 3. Testing the equality of two integers: EQUAL(x,y) outputs 1 when integer x = integer y, and 0 when x ≠ y. 4. AND is the logical product of bits.

[0048] As a preliminary step to constructing an equality determination algorithm that can be implemented using homomorphic encryption, the value function, which is the private input of each participant, is converted into a list of valuations for the goods. That is, the list of participant i is X i =(x i1 ,x i2 ,…,x im ) would be written as The allocation result π is expressed in an n × m table format, and indicates that participant i has been allocated product j when π(i,j) = 1. In other words, the i-th row of π is a one-hot vector that indicates the product allocated to participant i. Encryption is performed for each element.

[0049] FIG. 5 is a diagram showing an equality determination algorithm that can be executed in fully homomorphic encryption according to this embodiment.

[0050] First, the determination unit 12 initializes the output value (result←1) (line 1), and then performs a loop process to calculate evaluation values ​​the number of times equal to the number of participants (n) (lines 2 to 8). The determination unit 12 initializes (sum[i]←0) the evaluation value for the bundle, which is the presented allocation result, for the i-th participant (line 3), and then calculates the evaluation value for the bundle by taking the inner product of the list of evaluation values ​​for each product and the i-th row of the allocation result π, i.e., by multiplying each element and adding them together (lines 4 to 7).

[0051] Next, the determination unit 12 performs a loop process to compare the evaluation values ​​for all combinations of participants (lines 9 to 14). The judgment unit 12 compares the evaluation values ​​between the i (1 to n-1)th participant and each j (i+1 to n)th participant (line 11), and sequentially calculates the logical product (line 12) of the results (1 if equal, 0 if different). As a result, the determination unit 12 outputs whether the allocation result is equal (result=1) or not (result=0).

[0052] This algorithm is a simple and efficient (O(mn)) equality checking algorithm that can be implemented using only ADD, MULT, EQUAL, and AND. It should be noted that the range of i on the 9th line (1 to n-1) and the range of j on the 10th line (i+1 to n) may both be simply set to 1 to n.

[0053] FIG. 6 is a diagram showing an example of calculation by the equality determination algorithm in this embodiment. Here, the number of participants is n = 3 and the number of products is m = 5. The value function of each participant is set as a list of evaluation values ​​for products 1 to 5: X1 = (2, 3, 4, 1, 5), X2 = (3, 4, 2, 5, 1), and X3 = (5, 1, 4, 2, 3). In this case, the allocation result π by the allocation server 2 is given in the form of a 3x5 table, and it is assumed that participant 1 is allocated product {3,4}, participant 2 is allocated product {2,5}, and participant 3 is allocated product {1}.

[0054] The satisfaction of each participant i is X i and the ith row of π. For example, participant 1's satisfaction level s1 is s1=2·0+3·0+4·1+1·1+5·0=5. Similarly, s2=3·0+4·1+2·0+5·0+1·1=5, and s3=5·1+1·0+4·0+2·0+3·0=5.

[0055] The verification server 1 compares s1 and s2, s1 and s3, and s2 and s3, respectively, and determines that they are equal if they are all equal, and unequal if they are not. In this example, s1=s2=s3=5, which is an allocation with equality.

[0056] According to this embodiment, the verification server 1 realizes an equality determination algorithm including a conditional branch using only basic operations (ADD, MULT, EQUAL, ADD) that do not include a conditional branch, and implements it using fully homomorphic encryption. Therefore, even if the allocation processing algorithm is not made public, the validation server 1 can determine whether the allocation result satisfies equality without disclosing the private inputs of the participants, and notify the participants of the result.

[0057] This will also enable third parties to verify the legitimacy of services provided over the Internet, which will contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "Build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0058] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0059] The policy violation detection method by the verification server 1 is realized by software. When realized by software, the programs constituting this software are installed in an information processing device (computer). These programs may be recorded on removable media such as CD-ROMs and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a web service via a network without being downloaded. [Explanation of symbols]

[0060] 1. Verification Server 2 Allocation Server 3. Terminal 3A terminal 10 Control Unit 11 Receiving unit 12 Judgment section 13 Transmitter 20 Memory section 100 Detection System

Claims

1. a receiving unit that receives, from each of the terminals of the participants that have acquired allocation results of the plurality of resources to the participants, the allocation results being processed by an allocation server based on the evaluation values ​​of each of the plurality of resources of each participant, the allocation results and the evaluation values ​​on which the allocation results are based, in a state encrypted by a homomorphic encryption method; a determination unit that executes an algorithm for determining whether the allocation result is equal or not based on the encrypted allocation result and the evaluation value by the homomorphic encryption method, and calculates a value indicating the determination result in an encrypted state; a transmitting unit that transmits the value calculated by the determining unit to the terminal in an encrypted state and notifies the terminal of whether the allocation result is equal or not by causing the terminal to decrypt the value; The algorithm is: calculating a satisfaction level of each of the participants by taking an inner product of a vector indicating an evaluation value for each of the plurality of resources and a one-hot vector indicating the allocated resources in the allocation result; a step of calculating the logical product of all combinations of participants as a judgment result, where the satisfaction levels of the combinations of participants are set to 1 if they are equal and 0 if they are different, and a policy violation detection device that causes the judgment unit to execute this step without conditional branching.

2. a receiving step of receiving, from each of the terminals of the participants that have acquired allocation results of the plurality of resources to the participants, the allocation results being processed by an allocation server based on the evaluation values ​​of each of the plurality of resources of each participant, the allocation results and the evaluation values ​​on which the allocation results are based, in a state encrypted by a homomorphic encryption scheme; a determination step of executing an algorithm for determining whether the allocation result is equal or not based on the encrypted allocation result and the evaluation value by the homomorphic encryption method, and calculating an encrypted value indicating the determination result; a transmitting step of transmitting the value calculated in the determining step to the terminal in an encrypted state and notifying the terminal of whether the allocation result is equal or not by having the terminal decrypt the value, In the determining step, calculating a satisfaction level of each of the participants by taking an inner product of a vector indicating an evaluation value for each of the plurality of resources and a one-hot vector indicating the allocated resources in the allocation result; A policy violation detection method that executes the above steps without conditional branching: calculating the logical product of all combinations of participants as a judgment result, with 1 being assigned if the satisfaction levels of the combinations of participants are equal and 0 being assigned if the satisfaction levels are different.

3. A policy violation detection program for causing a computer to function as the policy violation detection device according to claim 1.

Images