Secret calculation instrument

Abstract

To provide an instrument capable of safely executing secret calculation by a person with simple operation.SOLUTION: A secret calculation instrument includes a plurality of input value components whose states of front and back are associated with 0 and 1. The plurality of input value components can be combined in a state in which the front and back cannot be distinguished. A combined structure in which the plurality of input value components are combined is configured to be reflection-symmetrical with respect to a reference line, and the front and back cannot be distinguished. An observation state is defined by randomly rotating, in an invisible state, the combined structure in an input state that is arranged in a state in which the input value component indicates an input value or bit inversion of the input value and in a state in which the front and back are concealed. An output state is defined by observing the front and back of the predetermined input value components in the observation state and inverting the front and back of the combined structure by reflection conversion with respect to a reference line based on observation results. In the output state, a state of the predetermined input value component is defined as an output value of a logical calculation.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to a secure computing device for performing logical operations while keeping inputs secret. [Background technology]

[0002] Secure computation is a computation in which a desired function is calculated using secret information held by each of multiple participants as input, while keeping each participant's information secret from the other participants. Typically, secure computation is performed by a computer, but research is underway into secure computation that can be physically performed by humans. For example, Non-Patent Documents 1-2 disclose a method of secure computation using a physical deck of cards (card-based encryption). Also, Non-Patent Documents 3-4 disclose a method of secure computation using a PEZ (candy) dispenser (PEZ protocol). [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Takaaki Mizuki, https: / / www.jstage.jst.gojp / article / essfr / 9 / 3 / 9_179 / _pdf / -char / ja, "Secure Calculation Using Card Decks," 2016 [Non-patent document 2] Takaaki Mizuki, "Recent Trends in Card-Based Cryptography," https: / / www.ieice.org / ess / sita / forum / article / 2019 / 201903231330.pdf, 2018 [Non-patent document 3] Jozsef Balogh, J´anos A. Csirik, Yuval Ishai, Eyal Kushilevitz, http: / / www.csirik.net / universal.pdf, “Private computation using a PEZ dispenser”, 2001 [Non-patent document 4] Soma Murata, Daiki Miyahara, Takaaki Mizuki2, Hideaki Sone, https: / / www.tains.tohoku.ac.jp / netlab / mizuki / conf / pezand_isc2020_web.pdf, "Public-PEZ Cryptography", 2020 Summary of the Invention [Problem to be solved by the invention]

[0004] However, card-based cryptography requires shuffling the cards, which makes the operation complicated and leaves room for improvement in terms of randomness (i.e., the security of the secret).In addition, the PEZ protocol generally has the problem that the input size (the number of PEZs) tends to be large, and since the initial settings and execution of each participant cannot be made public, there is no way to prevent fraud.

[0005] Therefore, an object of a first aspect of the present disclosure is to provide an appliance that enables a human to safely perform secure computation with simpler operations. [Means for solving the problem]

[0006] A first aspect of the present disclosure is a secure computing device for performing a logical operation on an input having a value of 0 or 1 while keeping the input secret, the device comprising: The device is provided with a plurality of input value components whose front and back states correspond to 0 and 1, and the plurality of input value components can be combined in a state in which the front and back cannot be distinguished, the combined structure formed by combining the plurality of input value components is configured to be mirror-symmetrical with respect to a reference line, and the front and back cannot be distinguished; The combined structure in the input state, in which the input value component indicates the input value or the bit inversion of the input value and the front and back are concealed, is rotated randomly in an invisible state to become an observed state, observing the front and back of a predetermined input value component in the observation state, and based on the observation result, inverting the front and back of the combined structure by mirror transformation about the reference line to obtain an output state; The state of a predetermined input value component in the output state is set as an output value of a logical operation. It is a secret calculation device. [Effects of the Invention]

[0007] According to the first aspect, secure computation can be safely performed by a human using simple operations. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is an overall perspective view showing an example of the configuration of a secure computing device according to a first embodiment. [Figure 2] 1 is a plan view showing an integrated structure of a secure computing device according to a first embodiment. [Figure 3] FIG. 2 is an exploded perspective view of an input value part according to the first embodiment. [Figure 4] 3A and 3B are side views for explaining the front and back of the input value component according to the first embodiment. [Figure 5] FIG. 10 is a diagram showing the flow of a logical product calculation using a secure computing device according to the first embodiment. [Figure 6] FIG. 10 is a plan view showing a combined structure in an input state in a logical AND operation. [Figure 7] FIG. 1 is a plan view (1) showing the combined structure in the observation state. [Figure 8] This is a plan view (2) showing the combined structure in the observation state. [Figure 9] FIG. 1 is a plan view (1) showing the combined structure in the output state. [Figure 10] FIG. 2 is a plan view (2) showing the combined structure in the output state. [Figure 11] FIG. 10 is a diagram showing the flow of a logical sum calculation using a secure computation device according to the first embodiment. [Figure 12] FIG. 10 is a plan view showing a combined structure of input states in a logical OR operation. [Figure 13] 10 is a plan view showing an integrated structure of a secure computing device according to a first modified example of the first embodiment. FIG. [Figure 14] FIG. 10 is a diagram showing the flow of a replication computation using a secure computation appliance according to a first modification of the first embodiment. [Figure 15] FIG. 10 is a plan view showing a combined structure of input states in a replication operation. [Figure 16] 10 is a plan view showing an integrated structure of a secure computing device according to a second modification of the first embodiment. FIG. [Figure 17] FIG. 10 is a diagram showing the flow of an exclusive OR operation using a secure computing appliance according to a second modification of the first embodiment. [Figure 18] FIG. 10 is a plan view showing a combined structure of input states in an exclusive OR operation. [Figure 19] FIG. 10 is a plan view showing an integrated structure of a secure computing device according to a second embodiment. [Figure 20] FIG. 10 is a side view of an input value part according to the second embodiment. [Figure 21] FIG. 10 is an exploded view of an input value component according to the second embodiment. [Figure 22] FIG. 10 is a plan view of a combination part according to a second embodiment. [Figure 23] 10 is a side view showing an integrated structure of a secure computing device according to a first modification of the second embodiment. FIG. [Figure 24] 10 is a side view showing an integrated structure of a secure computing device according to a second modification of the second embodiment. FIG. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, embodiments of a secure computing device according to the present disclosure will be described, but the configurations of the following embodiments are merely examples, and the present disclosure is not limited to the configurations of the embodiments.

[0010] The secure computation device according to the present disclosure is a device for physically performing secure computation by a human being. Specifically, secure computation is a logical operation (bit operation) performed on input bits having a value of 0 or 1 while keeping the input bits secret. In the logical operation, 0 represents a false logical value, and 1 represents a true logical value. Furthermore, when the value of the input bit (input value) is

number

number

[0011] The secure computation device according to the present disclosure utilizes the symmetry of an object to enable a desired logical operation to be performed using secret information held by each of multiple participants as input values ​​while keeping each participant's input value secret from the other participants. The embodiments described below are capable of performing logical operations such as a logical product operation (AND), a logical sum operation (OR), a negation operation (NOT), a copy operation (m-COPY), and an exclusive OR operation (XOR), as examples of logical operations. However, the logical operations to which the secure computation device according to the present disclosure is applicable are not limited to those described above.

[0012] In this specification, "mirror symmetry," when used with respect to an object, means that the shape of the object is symmetrical with respect to a reference line. Furthermore, "mirror transformation," when used with respect to an object, means rotating the object 180 degrees around the reference line as the rotation axis and flipping the front and back of the object. Furthermore, in this specification, "symmetry" is sufficient as long as it is symmetrical at least in appearance (external shape), and does not require that the internal structure of the object be symmetrical as well. Furthermore, "indistinguishable" is sufficient as long as it is indistinguishable by participants when using the secure computing device. From the perspective of ensuring confidentiality, it is sufficient that the front and back of the object cannot be distinguished at least visually (appearance). However, from the perspective of increasing randomness, it is more preferable that the front and back of the object cannot be distinguished even when the object is moved.

[0013] <Embodiment 1> [Overall configuration] FIG. 1 is an overall perspective view showing an example of the configuration of the secure computing device 100 according to the first embodiment. FIG. 2 is a plan view showing an integrated structure of the secure computing device 100 according to the first embodiment. During a logical operation using the secure computing device 100, the secure computing device 100 may be turned upside down. However, the up-down and left-right directions shown in FIG. 1 are determined based on a state in which the secure computing device 100 is viewed along a fixed, predetermined observation direction (hereinafter, referred to as the observation direction view). However, these directions are merely set for the convenience of explanation to determine the relative positional relationships of the elements of the secure computing device 100, and do not limit the present disclosure. Furthermore, a reference line of the secure computing device 100, indicated by the symbol R1, is provided on a plane perpendicular to the observation direction. In FIGS. 1 and 2, the secure computing device 100 is illustrated in a state in which the extension direction of the reference line R1 coincides with the up-down direction and the corner indicated by the symbol 201 is positioned on the upper side. FIG. 2 also illustrates the combined structure of the secure computing device 100 as viewed along the observation direction.

[0014] As shown in Fig. 1, the secure computation device 100 according to the first embodiment includes a plurality of input value components 10 and a combination component 20, and the plurality of input value components 10 are combined via the combination component 20 to form a combined structure as shown in Fig. 2. As will be described in detail later, the secure computation device 100 includes at least three input value components 10 and is capable of executing logical operations such as logical product operations (AND) and logical sum operations (OR). Each element of the secure computation device 100 according to the first embodiment will be described below.

[0015] [Input value parts] Fig. 3 is an exploded perspective view of the input value component 10 according to the first embodiment. Fig. 3 illustrates the input value component 10 in a front state. Fig. 4 is a side view for explaining the front and back of the input value component 10 according to the first embodiment. Fig. 4(A) illustrates the input value component 10 in a front state, and Fig. 4(B) illustrates the input value component 10 in a back state.

[0016] As shown in FIGS. 3 and 4, the input value component 10 includes a convex member 1 and a concave member 2, which can be combined. The convex member 1 has a disk-shaped main body 11 and a convex portion 12, which is a protrusion formed in the center of the main body 11. The concave member 2 has a disk-shaped main body 21 and a concave portion 22, which is a depression formed in the center of the main body 21. The main body 11 of the convex member 1 and the main body 21 of the concave member 2 have the same shape. More specifically, the main body 11 and the main body 21 have the same outer diameter and thickness. Furthermore, the convex portion 12 can be fitted into the concave portion 22. By combining the convex member 1 and the concave member 2 so that the convex portion 12 is fitted into the concave portion 22, the input value component 10 is formed into an integrated disk-shaped component. In the combined structure of the secure computing device 100, the input value component 10 is arranged so that the extension direction of its central axis coincides with the observation direction.

[0017] As shown in FIGS. 4A and 4B , the input value component 10 can be in two states in the observation direction: one in which the convex portion 12 faces toward the front side, and one in which the convex portion 12 faces toward the back side. Hereinafter, as an example, the state of the input value component 10 in which the convex portion 12 faces toward the front side will be referred to as the “front side,” and the state in which the convex portion 12 faces toward the back side will be referred to as the “back side.” The input value component 10 can have different shapes on the front and back sides, allowing the front and back states to be associated (labeled) with 0 and 1. This makes it possible to represent the input value b according to the state of the input value component 10. In this embodiment, the input value encoding rule is defined such that the input value component 10 indicates a value of “0” when in the front state and a value of “1” when in the back state. However, the encoding rule is not limited to this, and may be reversed, for example. In other words, the input value component 10 may indicate a value of “1” when in the front state and a value of “0” when in the back state.

[0018] Here, when the convex member 1 and the concave member 2 are combined, the convex portion 12 is hidden by the concave member 2, and therefore the state of the convex portion 12 cannot be seen from the outside. Furthermore, because the main body portion 11 and the main body portion 21 have the same shape, it is impossible to distinguish between the main body portion 11 of the convex member 1 and the main body portion 21 of the concave member 2. Therefore, when the convex member 1 and the concave member 2 are combined, it is impossible to distinguish between the front and back of the input value component 10 (i.e., the input value b). Therefore, by disassembling the input value component 10 into the convex member 1 and the concave member 2 and observing the orientation of the convex portion 12, it is possible to distinguish between the front and back of the input value component 10.

[0019] Furthermore, by flipping the input value component 10 over, the input value component 10 becomes in a state that indicates the bit inversion of the input value b (Equation 2), thereby realizing a negation operation (NOT).

[0020] [Combination parts] The combining part 20 is a plate-shaped member, and as shown in FIG. 2, by connecting multiple input value components 10, it is integrated with the multiple input value components 10 to form a combined structure. As shown in FIG. 2, the combining part 20 has a pentagonal outer shape that is mirror-symmetrical with respect to the reference line R1. Furthermore, the front and back of the combining part 20 cannot be distinguished in the observation direction. The combining part 20 has a corner 201 on the reference line R1. This corner 201 functions as a mark (sign) for identifying the orientation of the combined structure in the extension direction of the reference line R1. Furthermore, the combining part 20 has multiple fitting holes 20a that penetrate along the observation direction. Three fitting holes 20a are formed in the combining part 20, corresponding to the number of input value components 10. One of the three fitting holes 20a is formed on the reference line R1. The remaining two fitting holes 20a are formed on both sides of the reference line R1 in a direction perpendicular to the extension direction of the reference line R1 when viewed from the observation direction (the left-right direction in this embodiment). An input value component 10 can be fitted into these fitting holes 20a. By fitting an input value component 10 into each fitting hole 20a, the multiple input value components 10 and the combination component 20 are combined to form the combined structure shown in FIG.

[0021] [Combined structure] As shown in FIG. 2, the combined structure in which the input value component 10 is fitted into the combination component 20 has a pentagonal outer shape that is mirror-symmetrical with respect to the reference line R1, similar to the combination component 20. Furthermore, since the front and back of the input value component 10 and the combination component 20 cannot be distinguished in the observation direction, the front and back of the combined structure cannot be distinguished in the observation direction either. However, the shape of the combined structure is not limited to a pentagon. The combined structure may be configured so that it is mirror-symmetrical with respect to the reference line R1 and the front and back cannot be distinguished. Note that, due to the formation of the corners 201, the combined structure of the secure computing device 100 is asymmetrical (not mirror-symmetrical) in the extension direction of the reference line R1 (the up-and-down direction in this embodiment).

[0022] In the combined structure, the multiple input value components 10 are respectively disposed at a first position P1, a second position P2, and a third position P3, which are positions determined in the observation direction. As shown in FIG. 2, in the observation direction, the second position P2 is a position on a reference line R1, and the first position P1 and the third position P3 are positions on both sides of the second position P2 in a direction perpendicular to the extension direction of the reference line R1 (in the left-right direction in this embodiment). In other words, the first position P1 and the third position P3 are symmetrical positions on opposite sides of the reference line R1 in a direction perpendicular to the reference line R1 in the observation direction. In this embodiment, the position to the left of the reference line R1 is defined as the first position P1, and the position to the right of the reference line R1 is defined as the third position P3. Since the positional relationship between the first position P1 to the third position P3 is determined based on the observation direction, the positional relationship between the first position P1 to the third position P3 remains unchanged even if the combined structure is mirror-transformed with respect to the reference line R1. The positional relationship between the first position P1 to the third position P3 is not limited to the above. For example, the first position P1 may be a position to the right of the reference line R1 when viewed in the observation direction, and the third position P3 may be a position to the left of the reference line R1.

[0023] [Logical product calculation using a secure computing device] Next, a method of logical product operation (AND) using the secure computation device 100 according to embodiment 1 will be described. Fig. 5 is a diagram showing the flow of logical product operation using the secure computation device 100 according to embodiment 1. Below, a case will be described in which the logical product operation of the following input values ​​b1 and b2 held by two participants A1 and A2, respectively, is performed while the participants A1 and A2 keep the input values ​​b1 and b2 secret from each other.

number

number

[0024] As a preparation step for a logical product operation using the secure computing device 100, three input value components 10 and a combination component 20 are prepared. The input value components 10 are not embedded in the combination component 20, but are in a state where they are disassembled into a convex member 1 and a concave member 2.

[0025] First, in step S10, the input value encoding rule is shared with each participant. Here, the input value encoding rule is defined such that when the input value component 10 is in the face-up state, it indicates "0," and when the input value component 10 is in the face-down state, it indicates "1."

[0026] Next, in step S20, the input value components 10 indicating input values ​​b1 and b2 are placed at the first position P1 and the second position P2 with their front and back sides concealed. Each participant inputs the input values ​​b1 and b2 by fitting the input value component 10, which is a combination of the convex member 1 and the concave member 2, into the combination component 20 with its front and back sides concealed. As a result, the secure computing device 100 becomes a combined structure in which the input value component 10 and the combination component 20 are combined. Hereinafter, the operation of placing the input value component 10 to input an input value is referred to as an input operation. Furthermore, the state in which the input value component 10 is placed by the input operation in a state indicating an input value with its front and back sides concealed is referred to as an input state. FIG. 6 is a plan view showing the combined structure in the input state in a logical AND operation. FIG. 6 illustrates the combined structure as viewed from the observation direction. 6, the input operation is performed in a state where the combination part 20 is positioned so that the extension direction of the reference line R1 and the up-down direction coincide with each other when viewed from the observation direction and the corner 201 is positioned on the upper side. Note that, to prevent fraud, the input operation in step S20 is performed in a public situation where all participants can see it.

[0027] In step S20, participants A1 and A2 are each given one input value component 10 for inputting a secret input bit. Each participant sets the input value component 10 to a state corresponding to their own input value without being seen by the other participants. Then, the input value component 10 is fitted into the fitting hole 20a of the combination component 20. This input operation is performed in a state visible to all participants, so it may be performed by either participant A1 or A2, or by a third party. The input value component 10 representing participant A1's input value b1 is placed in the first position P1 with its front and back sides concealed, and the input value component 10 representing participant A2's input value b2 is placed in the second position P2 with its front and back sides concealed. For example, when input value b1=0, the input value component 10 set to the heads-up state (see FIG. 4(A)) is fitted into the fitting hole 20a corresponding to the first position P1. Conversely, when b1 = 1, the input value component 10 in the back state (see FIG. 4(B)) is fitted into the fitting hole 20a corresponding to the first position P1. The same applies to the input value b2. As described above, when the convex member 1 and the concave member 2 are combined, it is impossible to distinguish between the front and back sides of the input value component 10. Therefore, unless the input value component 10 is removed from the combined structure, disassembled, and observed, it is impossible to know whether the input value component 10 is in the front or back state. Note that, for example, the input value component 10 may be provided with a sliding window so that the state (front or back) of the input value component 10 can be confirmed by opening the window. In this way, the value indicated by the input value component 10 can be observed without removing the input value component 10 from the combined structure (i.e., even while it is fitted into the combination component 20).

[0028] Furthermore, in step S20, in order to realize a logical product operation, the input value component 10 in a state indicating 1 as an input value is placed at the third position P3. Specifically, the input value component 10 in a backside state is fitted into the fitting hole 20a corresponding to the third position P3. The fact that the input value component 10 placed at the third position P3 is in a state indicating 1 is not kept secret and is shared with all participants. This input operation is performed in a situation where all participants can see it, so it may be performed by one of the participants A1 or A2, or by a third party.

[0029] Hereinafter, for convenience, the input value component 10 placed at the first position P1 in the input state may be referred to as the first input value component 101, the input value component 10 placed at the second position P2 in the input state may be referred to as the second input value component 102, and the input value component 10 placed at the third position P3 in the input state may be referred to as the third input value component 103. In other words, the first input value component 101 is the input value component 10 for inputting the input value b1 of participant A1, the second input value component 102 is the input value component 10 for inputting the input value b2 of participant A2, and the third input value component 103 is the input value component 10 for inputting 1 as the input value for the logical product operation. In the input state, the front and back of the first input value component 101 and the second input value component 102 are kept secret, but the front and back of the third input value component 103 are not kept secret.

[0030] Here, the value indicated by each input value component 10 in the combined structure of the secure computing device 100 is

number

number

[0031] Next, in step S30, the combined structure in the input state is randomly rotated in an invisible state. For example, by placing the combined structure in the input state in a box (black box) whose contents cannot be seen from the outside and randomly shaking the box, the combined structure can be randomly rotated in an invisible state. In step S30, the combined structure is randomly rotated in a state in which the front and back of the combined structure can be reversed when viewed from the observation direction. The random rotation operation in step S30 may be performed by one of participants A1 and A2, or by a third party.

[0032] Here, the state after the combined structure has been randomly rotated is referred to as the observation state. Figures 7 and 8 are plan views showing the combined structure in the observation state. Figure 7 shows a state in which the front and back of the combined structure in the observation state are not reversed relative to the input state (observation state 1), and Figure 8 shows a state in which the front and back of the combined structure in the observation state are reversed relative to the input state (observation state 2). Figures 7 and 8 show the combined structure as viewed from the observation direction.

[0033] As shown in Figures 7 and 8, in the observation state, the secure computing device 100 is positioned so that the corner 201 is positioned on the upper side, thereby making the orientation of the combined structure in the direction of extension of the reference line R1 coincide with the orientation in the input state. Due to the random rotation in step S30, the combined structure in the observation state can take either a state where the front and back are not reversed relative to the input state (Figure 7: Observation State 1) or a state where the front and back are reversed (Figure 8: Observation State 2), each with a probability of 1 / 2. Observation State 1 is

number

number

[0034] Next, in step S40, the front and back of a predetermined input value component 10 are observed in the observation state to obtain an observation value. Specifically, the input value component 10 placed in the second position P2 is observed to see whether it is in the front or back state. In step S40, it is determined whether the input value component 10 (i.e., the second input value component 102) in the second position P2 is in a state indicating 0 (i.e., the heads state). If the input value component 10 in the second position P2 indicates 0 in the observation state (step S40: Yes), proceed to step S50. Note that, to prevent cheating, the observation in step S40 is performed in a situation where all participants can confirm it.

[0035] In step S50, based on the observation results of step S40, a mirror transformation is performed on the combined structure with respect to the reference line R1, thereby inverting the front and back of the combined structure with respect to the observed state. The state in which the front and back of the combined structure are inverted with respect to the observed state is set as the output state, and the process proceeds to step S60.

[0036] Returning to step S40, if the input value component 10 at the second position P2 in the observed state is not in a state indicating 0 (step S40: No), that is, if the input value component 10 is in a state indicating 1 (that is, in a back state), the mirror transformation of step S50 is not performed, and the front and back of the combined structure are not reversed with respect to the observed state, but are set as the output state. In other words, the state in which the front and back of the combined structure are the same as in the observed state is set as the output state, and the process proceeds to step S60.

[0037] In step S60, the state of a predetermined input value component 10 in the output state is set as the output value. Specifically, the value indicated by the state of the input value component 10 placed in the first position P1 becomes the output value of the logical AND operation of b1 and b2. The reason for this will be explained below.

[0038] 9 and 10 are plan views showing the combined structure in the output state. Fig. 9 shows a state in which the front and back of the combined structure in the output state are not reversed relative to the input state (output state 1), and Fig. 10 shows a state in which the front and back of the combined structure in the output state are reversed relative to the input state (output state 2). Figs. 9 and 10 show the combined structure as viewed from the observation direction.

[0039] By the random rotation in step S30, the combined structure in the output state can take either a state in which the front and back are not reversed relative to the input state (Fig. 9: Output State 1) or a state in which the front and back are reversed (Fig. 10: Output State 2) with a probability of 1 / 2. The output state 1, like the input state and the observation state 1, can be

number

number

[0040] Depending on whether the input value b2 is 0 or 1 and whether the observed state is the state of the above formula 7 or formula 8, the logical value correspondence table for the four cases shown in Table 1 below can be obtained. [Table 1]

[0041] In Table 1, the "Input value b2" column indicates the input value b2 input to the secure computation device 100. The "State of input value component" column in the "Observed state" column indicates the state of each input value component 10 in the observed state. The "Observed value at second position" column in the "Observed state" column indicates the value indicated by the input value component 10 at the second position P2 in the observed state. The "Whether or not a mirror transformation was performed" column indicates the presence or absence of a mirror transformation operation based on the observation result at the second position P2. The "State of input value component" column in the "Output state" column indicates the state of each input value component 10 in the output state. The "Output value at first position" column in the "Output state" column indicates the value indicated by the input value component 10 at the first position P1 in the output state.

[0042] As shown in Table 1, the value indicated by the input value component 10 at the first position P1 in the output state is 0 regardless of b1 when the input value b2 is 0 (cases 1 and 2), and is the input value b1 when the input value b2 is 1 (cases 3 and 4). Here, the logical product of b1 and b2 can be expressed as follows:

number

[0043] Here, in step S40, the front and back of the second input value component 102 at the second position P2 in the observation state are observed. However, because the combined structure is randomly rotated in step S30, the second input value component 102 in the observation state is in a state that indicates b2 or a bit inversion of b2 with a probability of 1 / 2. Therefore, information about the input value b2 is not leaked. In other words, it is information-theoretically secure. For example, even if the observation value at the second position P2 is 0, if the observation state is Case 1 of Table 1, b2 = 0, and if the observation state is Case 4 of Table 1, b2 = 1. Therefore, the value of the input value b2 cannot be inferred from the observation value. Similarly, even if the observation value at the second position P2 is 1, if the observation state is Case 2 of Table 1, b2 = 0, and if the observation state is Case 3 of Table 1, b2 = 1. Therefore, the value of the input value b2 cannot be inferred from the observation value.

[0044] As described above, by using the secure computing appliance 100 according to the first embodiment, it is possible to perform a logical product operation (AND) on the input values ​​b1 and b2 while keeping the input values ​​b1 and b2 secret.

[0045] In the above-mentioned logical product operation, in step S20, the input state is

number

[0046] In Table 2, the column "Output value at third position" in the "Output state" indicates the value indicated by the input value component 10 at the third position P3 in the output state.

[0047] As shown in Table 2, the value indicated by the input value component 10 at the third position P3 in the output state is 0 when the input value b2 is 0 (cases 1 and 2), and is b1 when the input value b2 is 1 (cases 3 and 4), which matches the result of the above formula 11. Therefore, when an input operation is performed as shown in the above formula 12, the value indicated by the input value component 10 at the third position P3 in the output state is equal to the output value of the logical AND operation of b1 and b2.

[0048] In the above-mentioned logical product operation, in step S20, the input state is

number

[0049] As shown in Table 3, the value indicated by the input value component 10 at the first position P1 in the output state is 0 regardless of b1 when the input value b2 is 0 (cases 1 and 2), and is b1 when the input value b2 is 1 (cases 3 and 4), which matches the result of the above formula 11. Therefore, when an input operation is performed as shown in the above formula 13, the value indicated by the input value component 10 at the first position P1 in the output state is equal to the output value of the logical AND operation of b1 and b2.

[0050] In the above-mentioned logical product operation, in step S20, the input state is

number

[0051] As shown in Table 4, the value indicated by the input value component 10 at the third position P3 in the output state is 0 when the input value b2 is 0 (cases 1 and 2) regardless of b1, and is b1 when the input value b2 is 1 (cases 3 and 4), which matches the result of the above formula 11. Therefore, when an input operation is performed as shown in the above formula 14, the value indicated by the input value component 10 at the first position P1 in the output state is equal to the output value of the logical AND operation of b1 and b2.

[0052] As described above, in the logical AND operation, in the input state, input value components 10 in a state indicating the input value or a bit inversion of the input value are placed in the first position P1 and the second position P2 with their front and back sides concealed, and input value components 10 in a state indicating a value of 0 or 1 are placed in the third position P3. In addition, in the observation state, the front and back sides of the input value components 10 placed in the second position P2 are observed, and based on the observation results, the front and back sides of the combined structure are reversed by a mirror transformation about the reference line R1, thereby placing the combined structure in the output state. Then, in the output state, the state of the input value components 10 placed in the first position P1 or the third position P3 becomes the output value of the logical AND operation.

[0053] [Logical OR operation using a secure computing device] By using the secure computation device 100 according to the first embodiment, it is possible to perform a logical OR operation on input values ​​b1 and b2 held by two participants A1 and A2, while keeping the input values ​​b1 and b2 secret from each other. A method for performing a logical OR operation (OR) using the secure computation device 100 according to the first embodiment will be described below. Fig. 11 is a diagram showing the flow of a logical OR operation using the secure computation device 100 according to the first embodiment. Note that steps in Fig. 11 with the same numbers as those in Fig. 5 are substantially the same as those in Fig. 5, and therefore detailed description thereof will be omitted except for the differences.

[0054] Step S10 of the logical sum operation (sharing of encoding rules) is the same as the step explained in FIG. 5. In the logical sum operation, in step S201, the input state is

number

[0055] Step S30 (random rotation) of the logical sum operation is the same as the step explained in FIG. 5. In the logical sum operation, in step S401, it is determined whether the input value component 10 (i.e., the second input value component 102) at the second position P2 in the observed state is in a state indicating 1 (i.e., in a back state). If the input value component 10 at the second position P2 in the observed state is in a state indicating 1 (step S401: Yes), the process proceeds to step S50, where the front and back of the combined structure are reversed by a mirror transformation about the reference line R1, and the combined structure is set to the output state. If the input value component 10 at the second position P2 in the observed state is not in a state indicating 1 (step S401: No), that is, if the input value component 10 is in a state indicating 0 (i.e., in a front state), the mirror transformation of step S50 is not performed, and the combined structure is not reversed, and is set to the output state. The observed state in the logical sum operation is

number

number

[0056] In step S601 of the logical sum operation, the state of the input value component 10 located at the first position P1 in the output state is set as the output value. In other words, the value indicated by the state of the input value component 10 located at the first position P1 in the output state becomes the output value of the logical sum operation of b1 and b2. The reason for this will be explained below.

[0057] In the logical sum operation, depending on whether the input value b2 is 0 or 1 and whether the observed state is the state of the above formula 16 or formula 17, a logical value correspondence table for four cases shown in Table 5 below can be obtained. [Table 5]

[0058] As shown in Table 5, the value indicated by the input value component 10 at the first position P1 in the output state is the input value b1 when the input value b2 is 0 (cases 1 and 2), and is 1 regardless of b1 when the input value b2 is 1 (cases 3 and 4). Here, the logical sum of b1 and b2 can be expressed as follows:

number

[0059] Here, in step S401, the front and back of the second input value part 102 at the second position P2 in the observation state are observed, but as with the logical product operation, the combined structure is randomly rotated in step S30, so no information about the input value b2 is leaked, and it is information theoretically safe.

[0060] As described above, by using the secure computation appliance 100 according to the first embodiment, it is possible to perform a logical sum (OR) operation on the input values ​​b1 and b2 while keeping the input values ​​b1 and b2 secret.

[0061] In the above-mentioned logical sum operation, in step S201, the input state is

number

[0062] As shown in Table 6, the value indicated by the input value component 10 in the third position P3 in the output state is b1 when the input value b2 is 0 (cases 1 and 2), and is 1 regardless of b1 when the input value b2 is 1 (cases 3 and 4), which matches the result of the above formula 18. Therefore, when an input operation is performed as shown in the above formula 19, the value indicated by the input value component 10 in the third position P3 in the output state is equal to the output value of the logical OR operation of b1 and b2.

[0063] In the above-mentioned logical sum operation, in step S201, the input state is

number

[0064] As shown in Table 7, the value indicated by the input value component 10 at the first position P1 in the output state is b1 when the input value b2 is 0 (cases 1 and 2), and is 1 regardless of b1 when the input value b2 is 1 (cases 3 and 4), which matches the result of the above formula 18. Therefore, when an input operation is performed as shown in the above formula 20, the value indicated by the input value component 10 at the first position P1 in the output state is equal to the output value of the logical OR operation of b1 and b2.

[0065] In the above-mentioned logical sum operation, in step S201, the input state is

number

[0066] As shown in Table 8, the value indicated by the input value component 10 in the third position P3 in the output state is b1 when the input value b2 is 0 (cases 1 and 2), and is 1 regardless of b1 when the input value b2 is 1 (cases 3 and 4), which matches the result of the above formula 18. Therefore, when an input operation is performed as shown in the above formula 21, the value indicated by the input value component 10 in the third position P3 in the output state is equal to the output value of the logical OR operation of b1 and b2.

[0067] As described above, in the logical OR operation, in the input state, input value components 10 in a state indicating the input value or a bit inversion of the input value are placed in the first position P1 and the second position P2 with their front and back sides concealed, and input value components 10 in a state indicating a value of 0 or 1 are placed in the third position P3. In addition, in the observation state, the front and back sides of the input value components 10 placed in the second position P2 are observed, and based on the observation results, the front and back sides of the combined structure are reversed by a mirror transformation about the reference line R1, thereby placing the combined structure in the output state. Then, in the output state, the state of the input value components 10 placed in the first position P1 or the third position P3 becomes the output value of the logical OR operation.

[0068] Furthermore, in logical AND and OR operations using the secure computing device 100, the second input value component 102 is fixed to the second position P2, and the first input value component 101 is always located at either the first position P1 or the third position P3, so even if one of the participants A1 or A2 secretly commits fraud by, for example, changing the center of gravity of the input value component 10, it is easy to identify who committed the fraud. Therefore, fraud can be prevented.

[0069] [Modification of the first embodiment] The following describes a modified example of embodiment 1. In the following description, differences from the secure computing device 100 described in Figures 1 to 12 will be mainly described, and similar configurations and steps will be assigned the same numbers and detailed description will be omitted.

[0070] [Variation 1] Fig. 13 is a plan view showing an integrated structure of the secure computing device 100A according to Modification 1 of Embodiment 1. Fig. 13 shows the secure computing device 100A as viewed along the observation direction, with the extension direction of the reference line R1 and the left-right direction coinciding and the corner indicated by reference numeral 202 positioned on the left side.

[0071] As shown in Fig. 13, a secure computation device 100A according to a first modification of the first embodiment includes a plurality of input value components 10 and a combination component 20A, and the plurality of input value components 10 are combined via the combination component 20A to form a combined structure as shown in Fig. 13. The secure computation device 100A according to the first modification includes at least n (n = m + 1, m is a natural number) input value components 10. The secure computation device 100A is capable of executing a copy operation (m-COPY) that copies an input value b m times while keeping the input value b secret.

[0072] The combination part 20A according to the first modification of the first embodiment differs from the combination part 20 described above in the arrangement of the multiple fitting holes 20a. The combination part 20A has a pentagonal outer shape that is mirror-symmetrical with respect to the reference line R1. Furthermore, the front and back of the combination part 20A cannot be distinguished from each other in the observation direction. The combination part 20A has corners 202 on the reference line R1. The corners 202 function as markers (signs) for identifying the orientation of the combined structure in the extension direction of the reference line R1. Furthermore, the combination part 20A has n fitting holes 20a formed therein, corresponding to the number of input value parts 10. The n fitting holes 20a are formed on the reference line R1 and are arranged side by side along the extension direction of the reference line R1. By fitting the input value components 10 into the fitting holes 20a, the n input value components 10 and the combination component 20A are combined to form the combined structure shown in FIG.

[0073] As shown in FIG. 13 , the combined structure according to Modification 1 of Embodiment 1 has a pentagonal outer shape that is mirror-symmetric with respect to the reference line R1. Furthermore, the front and back of the combined structure cannot be distinguished from each other in the observation direction. However, due to the formation of corners 202, the combined structure according to Modification 1 is asymmetric (not mirror-symmetric) in the extension direction of the reference line R1. In the combined structure, n input value components 10 are disposed at n positions on the reference line R1 that is determined when viewed from the observation direction. For convenience, in Modification 1 of Embodiment 1, the extension direction of the reference line R1 is aligned with the left-right direction, and the n positions are referred to as a first position P1, a second position P2, ..., an nth position Pn, from the left. However, the positional relationship between the first position P1 to the nth position Pn is not limited to this. For example, the positions may be the first position P1, the second position P2, ..., the n-th position Pn from the right, and the first position P1 does not have to be the end position.

number

[0074] [Duplicate calculation using a secure computing device] Next, a method of duplication calculation (m-COPY) using the secure computation appliance 100A according to Modification 1 of Embodiment 1 will be described. Fig. 14 is a diagram showing the flow of duplication calculation using the secure computation appliance 100A according to Modification 1 of Embodiment 1. Below, a case will be described in which a duplication calculation of an input value b held by a participant A is executed while keeping the input value b secret.

[0075] Step S10 of the duplication operation (sharing of encoding rules) is the same as the step described in FIG. 5. In the duplication operation, in step S202, the input state is

number

[0076] Step S30 (random rotation) of the duplication calculation is the same as the step described in FIG. 5. In the observation state of Modification 1, the secure computation device 100A is positioned so that the corner 202 is located on the left side, thereby making the orientation of the combined structure in the extension direction of the reference line R1 coincide with the orientation in the input state. As described above, in Modification 1, the n input value components 10 are placed on the reference line R1, and the orientation of the combined structure in the extension direction of the reference line R1 coincides between the input direction and the observation state. Therefore, in Modification 1, even if the front and back of the input value components 10 are reversed between the input state and the observation state after random rotation, the positions of the input value components 10 when viewed from the observation direction do not change. The observation state in the duplication calculation is

number

number

[0077] In the replication calculation, in step S402, it is determined whether the input value component 10 (i.e., the first input value component 101) at the first position P1 in the observed state is in a state indicating 1 (i.e., in a back state). If the first input value component 101 indicates 1 in the observed state (step S402: Yes), the process proceeds to step S50, where the front and back of the combined structure are reversed by mirror transformation about the reference line R1, and the combined structure is set to the output state. If the first input value component 101 is not in a state indicating 1 in the observed state (step S402: No), that is, if the first input value component 101 is in a state indicating 0 (i.e., in a front state), the mirror transformation of step S50 is not performed, and the combined structure is not reversed and is set to the output state.

[0078] In step S602 of the replication operation, the states of the m input value components 10 arranged at the second position P2 to the n-th position Pn in the output state are set as output values. In other words, the m values ​​indicated by the states of the second input value component 102 to the n-th input value component 10n in the output state become the output values ​​of the replication operation of b. The reason for this will be explained below.

[0079] In the replication operation, depending on whether the input value b is 0 or 1 and whether the observed state is the state of the above formula 24 or formula 25, a logical value correspondence table for four cases shown in Table 9 below can be obtained. [Table 9]

[0080] In Table 9, the "input value b" column indicates the input value b input to the secure computation appliance 100A. The "observed value of the first input value component" column in the "observed state" indicates the value indicated by the first input value component 101 in the observed state. The "output values ​​of the second input value component to the nth input value component" column in the "output state" indicates the values ​​indicated by the second input value component 102 to the nth input value component 10n in the output state.

[0081] As shown in Table 9, the values ​​indicated by the second input value component 102 to the n-th input value component 10n in the output state are 0 when the input value b is 0 (cases 1 and 2), and 1 when the input value b is 1 (cases 3 and 4). Here, the duplication of b can be expressed as follows:

number

[0082] Here, in step S402, the front and back of the first input value part 101 are observed in the observation state, but since the combined structure is rotated randomly in step S30, information about the input value b is not leaked, and it is information theoretically safe.

[0083] As described above, by using the secure computation appliance 100A according to the first modification of the first embodiment, it is possible to execute a copy operation (m-COPY) on the input value b while keeping the input value b secret.

[0084] In the above-mentioned replication calculation, in step S202, the input state is

number

[0085] In the above-mentioned replication operation, in step S202, the input state is

number

[0086] As shown in Table 10, the values ​​indicated by the second input value component 102 to the nth input value component 10n in the output state are 0 when the input value b is 0 (cases 1 and 2), and are 1 when the input value b is 1 (cases 3 and 4), which matches the result of the above formula 26. Therefore, even when an input operation is performed as shown in the above formula 28, the m values ​​indicated by the states of the second input value component 102 to the nth input value component 10n in the output state are equal to a copy of b.

[0087] As described above, in the replication operation, in the input state, the first input value component 101, which is one of the n input value components 10, is arranged in a state in which it indicates an input value and its front and back are concealed, and all of the other m input value components 10 are arranged in a unified state of either a state in which it indicates a value of 0 or a state in which it indicates a value of 1. Then, in the observation state, the front and back of the first input value component 101 are observed, and if it is in the other state of either a state in which it indicates a value of 0 or a state in which it indicates a value of 1, the front and back of the combined structure are reversed by a mirror transformation about the reference line R1, and if it is in either state, the front and back of the combined structure are not reversed, thereby setting the combined structure to the output state.

[0088] Furthermore, in the replication computation using the secure computation appliance 100A according to the first modification of the first embodiment, the first input value component 101 is fixed at the first position P1, so even if participant A secretly commits fraud with the first input value component 101, it is easy to identify that participant A has committed fraud. Therefore, fraud can be prevented.

[0089] [Variation 2] Fig. 16 is a plan view showing an integrated structure of the secure computing device 100B according to Modification 2 of Embodiment 1. Fig. 16 shows the secure computing device 100B as viewed along the observation direction, with the secure computing device 100B positioned so that the extension direction of the reference line R1 coincides with the left-right direction and the corner indicated by reference numeral 203 is located on the left side.

[0090] As shown in Fig. 16, a secure computation device 100B according to a second modification of the first embodiment includes a plurality of input value components 10 and a combination component 20B, and the plurality of input value components 10 are combined via the combination component 20B to form a combined structure as shown in Fig. 16. The secure computation device 100B according to the second modification includes at least two input value components 10. The secure computation device 100B is capable of performing an exclusive OR operation (XOR) on input values ​​b1 and b2 while keeping the input values ​​b1 and b2 secret.

[0091] The combination part 20B according to the second modification of the first embodiment has a pentagonal outer shape that is mirror-symmetrical with respect to the reference line R1 when viewed from the observation direction. The front and back of the combination part 20B cannot be distinguished from each other when viewed from the observation direction. The combination part 20B has corners 203 on the reference line R1. The corners 203 function as markers (signs) for identifying the orientation of the combined structure in the direction in which the reference line R1 extends. The combination part 20B has two fitting holes 20a formed therein, corresponding to the number of input value parts 10. The two fitting holes 20a are formed on the reference line R1 and are arranged side by side along the direction in which the reference line R1 extends. By fitting an input value part 10 into each fitting hole 20a, the two input value parts 10 and the combination part 20B are combined to form the combined structure shown in FIG. 16 .

[0092] As shown in FIG. 16, the combined structure according to Modification 2 of Embodiment 1 has a pentagonal outer shape that is mirror-symmetric with respect to the reference line R1. Furthermore, the front and back of the combined structure cannot be distinguished from each other in the observation direction. However, due to the formation of the corners 202, the combined structure according to Modification 2 is asymmetric (not mirror-symmetric) in the extension direction of the reference line R1. In the combined structure, the two input value components 10 are disposed at two positions on the reference line R1 that is determined when viewed from the observation direction. For convenience, in Modification 2, the extension direction of the reference line R1 is aligned with the left-right direction, and the left position of the two positions is designated as the first position P1 and the right position is designated as the second position P2. However, the positional relationship between the first position P1 and the second position P2 is not limited to this and may be reversed. Furthermore, the values ​​indicated by the input value components 10 in the combined structure of the secure computing appliance 100B are

number

[0093] [Exclusive OR operation using a secure computing device] Next, a method of exclusive OR calculation (XOR) using the secure computation device 100B according to Modification 2 of Embodiment 1 will be described. Fig. 17 is a diagram showing the flow of the exclusive OR calculation using the secure computation device 100B according to Modification 2 of Embodiment 1. Below, a case will be described in which an exclusive OR calculation is performed on input values ​​b1 and b2 held by two participants A1 and A2 while the participants A1 and A2 keep the input values ​​b1 and b2 secret from each other.

[0094] Step S10 of the exclusive OR operation (sharing of encoding rules) is the same as the step explained in FIG. 5. In the exclusive OR operation, in step S203, the input state is

number

[0095] Step S30 (random rotation) of the exclusive OR operation is the same as the step explained in FIG. 5. In the observation state of Modification 2, the secure computing device 100B is positioned so that the corner 203 is located on the left side, thereby making the orientation of the combined structure in the extension direction of the reference line R1 consistent with the orientation in the input state. As described above, in Modification 2, the two input value components 10 are positioned on the reference line R1, and the orientation of the combined structure in the extension direction of the reference line R1 is consistent between the input direction and the observation state. Therefore, in Modification 2, even if the front and back of the input value components 10 are reversed between the input state and the observation state after random rotation, the position of the input value components 10 when viewed from the observation direction is not swapped. Note that, from the viewpoint of obtaining the output value of the exclusive OR operation, it is not essential to make the orientation of the combined structure in the extension direction of the reference line R1 consistent between the input state and the observation state. The observation state in the exclusive OR operation is

number

number

[0096] In the exclusive OR operation, in step S403, it is determined whether the input value component 10 (i.e., the first input value component 101) at the first position P1 in the observed state is in a state indicating 1 (i.e., in a back state). If the first input value component 101 is in a state indicating 1 in the observed state (step S403: Yes), the process proceeds to step S50, where the front and back of the combined structure are reversed by a mirror transformation about the reference line R1, and the combined structure is set to the output state. If the first input value component 101 is not in a state indicating 1 in the observed state (step S403: No), that is, if the first input value component 101 is in a state indicating 0 (i.e., in a front state), the mirror transformation of step S50 is not performed, and the combined structure is set to the output state without being reversed.

[0097] In step S603 of the exclusive OR operation, the state of the input value component 10 (i.e., the second input value component 102) located at the second position P2 in the output state is set as the output value. In other words, the value indicated by the state of the second input value component 102 in the output state becomes the output value of the exclusive OR operation of b1 and b2. The reason for this will be explained below.

[0098] In the exclusive OR operation, depending on whether the input value b1 is 0 or 1 and whether the observed state is the state of the above formula 31 or formula 32, a logical value correspondence table for four cases shown in Table 11 below can be obtained. [Table 11]

[0099] In Table 11, the "Input value b1" column indicates the input value b1 input to the secure computation appliance 100B. The "Output value of second input value component" column in the "Output state" column indicates the value indicated by the second input value component 102 in the output state.

[0100] As shown in Table 11, the value indicated by the second input value component 102 in the output state is the input value b2 when the input value b1 is 0 (cases 1 and 2), and is the bit inversion of the input value b2 when the input value b1 is 1 (cases 3 and 4). Here, the exclusive OR of b1 and b2 can be expressed as follows:

number

[0101] Here, in step S403, the front and back of the first input value part 101 are observed in the observation state, but since the combined structure is rotated randomly in step S30, information regarding the input value b1 is not leaked, and it is information theoretically safe.

[0102] As described above, by using the secure computation appliance 100B according to the second modification of the first embodiment, it is possible to perform an exclusive OR operation (XOR) on the input values ​​b1 and b2 while keeping the input values ​​b1 and b2 secret.

[0103] In the above-mentioned exclusive OR operation, in step S203,

number

[0104] Furthermore, in the above-mentioned exclusive OR operation, in step S403, it is determined whether the second input value component 102 in the observation state is in a state indicating 1 (i.e., a table state), and if it indicates 1, the mirror transformation in step S50 is performed to determine the output state, and if it is not in a state indicating 1, the mirror transformation in step S50 may be omitted to determine the output state. By doing so, in step S603, the value indicated by the state of the first input value component 101 in the output state becomes the output value of the exclusive OR operation of b1 and b2. In this case, depending on whether the input value b2 is 0 or 1 and whether the observation state is in the state of the above-mentioned Formula 31 or Formula 32, a logical value correspondence table for four cases shown in Table 12 below can be obtained. [Table 12]

[0105] In Table 12, the "Input value b2" column indicates the input value b2 input to the secure computation appliance 100B. The "Observed value of second input value component" column in the "Observed state" indicates the value indicated by the second input value component 102 in the observed state. The "Output value of first input value component" column in the "Output state" indicates the value indicated by the first input value component 101 in the output state.

[0106] Furthermore, the exclusive OR of b1 and b2 can also be expressed as follows:

number

[0107] In the above-mentioned exclusive OR operation, in step S203, the input state is

number

number

[0108] As shown in Table 13, the value indicated by the second input value component 102 in the output state is the input value b2 when the input value b1 is 0 (cases 1 and 2), and is the bit inversion of the input value b2 when the input value b1 is 1 (cases 3 and 4), which matches the result of the above formula 33. Therefore, even when an input operation is performed as shown in the above formula 37, the value indicated by the state of the second input value component 102 in the output state is equal to the output value of the exclusive OR operation of b1 and b2.

[0109] As described above, in the exclusive OR operation, in the input state, two input value components 10 in a state indicating the input value or the bit inversion of the input value are arranged with their front and back sides concealed. Also, in the observation state, the front and back sides of one of the two input value components 10 are observed, and based on the observation result, the front and back sides of the combined structure are inverted by a mirror transformation about the reference line R1, thereby placing the combined structure in the output state. Then, in the output state, the state of the other of the two input value components 10 becomes the output value of the exclusive OR operation.

[0110] Furthermore, in the exclusive OR operation using the secure computation appliance 100B according to the second modification, the first input value component 101 is fixed to the first position P1, and the second input value component 102 is fixed to the second position P2, so even if one of the participants A1 and A2 secretly commits fraud with the input value component 10, it is easy to identify who committed the fraud. Therefore, fraud can be prevented.

[0111] [Effects of the First Embodiment] As described above, the secure computation appliances 100 to 100B according to the first embodiment can ensure the security of secrets by simple random rotation by utilizing the symmetry of the combined structure. Furthermore, since the input value components 10 can be combined in a state in which the front and back cannot be distinguished, logical operations can be performed with the operations of each participant public, making it easy to prevent fraud. As described above, the secure computation appliances 100 to 100B according to the first embodiment enable humans to safely perform secure computations with simple operations.

[0112] Furthermore, in the first embodiment, the combined structure is asymmetric in the extension direction of the reference line R1. This makes it possible to determine the orientation of the combined structure in the extension direction of the reference line R1. Therefore, it is easy to align the orientation of the combined structure in the extension direction of the reference line R1 between the input state, the observation state, and the output state. This makes it easy to identify the input value component 10 to be observed in the observation state and the input value component 10 that indicates the output value in the output state. Note that, for example, when the combined structure is randomly rotated in a situation where only rotation around the reference line R1 is allowed and the orientation in the extension direction of the reference line R1 does not change, an operation to align the orientation of the combined structure is not necessary, and therefore the combined structure may be symmetric in the extension direction of the reference line R1.

[0113] The secure computing devices 100 to 100B according to the first embodiment can be implemented by producing each component using, for example, a 3D printer.

[0114] <Embodiment 2> The following describes a secure computing device 200 according to embodiment 2. In the following description, differences from embodiment 1 described with reference to Figures 1 to 18 will be mainly described, and similar configurations and steps will be assigned the same numbers and detailed descriptions will be omitted.

[0115] [Overall configuration] Fig. 19 is a plan view showing an integrated structure of the secure computation device 200 according to embodiment 2. Fig. 19 shows the secure computation device 200 as viewed along the observation direction, with the extension direction of the reference line R1 and the vertical direction coinciding and the input value component 30 attached to the convex portion indicated by reference numeral 403 positioned on the upper side.

[0116] 19, the secure computation device 200 according to the second embodiment includes a plurality of input value components 30 and a combination component 40, and forms a combined structure by combining the plurality of input value components 30 via the combination component 40. Like the secure computation device 100 according to the first embodiment, the secure computation device 200 includes at least three input value components 30 and is capable of performing logical operations such as logical product operations (AND) and logical sum operations (OR).

[0117] [Input value parts] Fig. 20 is a side view of the input value component 30 according to embodiment 2. Fig. 21 is an exploded view of the input value component 30 according to embodiment 2. Figs. 20 and 21 show the input value component 30 in a front view. The input value component 30 includes a main body block 3 and a pair of cover blocks 4, 4, which can be combined.

[0118] As shown in FIG. 21 , the main body block 3 has a main body 31 having a cubic outer shape, protrusions 32, 33, and 34 that are protrusions formed on the main body 31, and a recess 35 that is a depression formed on the main body 31. The protrusions 32 and 33 are provided on the side surfaces of the main body 31 that are opposite to each other in the observation direction. The protrusion 34 and the recess 35 are provided on the side surfaces of the main body 31 that are opposite to each other in a direction perpendicular to the observation direction. The protrusion 34 of another main body block 3 can be fitted into the recess 35. This makes it possible to connect multiple input value components 30, as in the modified example described below.

[0119] When the input value component 30 is disassembled into the main body block 3 and the cover block 4, the convex portion 32 and the convex portion 33 can be distinguished from each other. In this embodiment, the convex portion 32 and the convex portion 33 are distinguished from each other by using different colors for the convex portion 32 and the convex portion 33. However, the convex portion 32 and the convex portion 33 may also be distinguished from each other by using other methods, such as different shapes for the convex portion 32 and the convex portion 33.

[0120] 20, the pair of cover blocks 4, 4 combine with the main body block 3 to conceal the protrusions 32, 33. The cover block 4 is formed with recesses 41 into which the protrusions 32, 33 can be fitted. By attaching the cover blocks 4 to the cover block protrusions 32, 33, respectively, the main body block 3 and the pair of cover blocks 4, 4 combine.

[0121] The input value component 30 can be in two states in the observation direction: one in which the convex portion 32 faces toward the front (i.e., the convex portion 33 faces toward the rear), and the other in which the convex portion 32 faces toward the rear (i.e., the convex portion 33 faces toward the front). For example, the state in which the convex portion 32 faces toward the front is designated as "front," and the state in which the convex portion 32 faces toward the rear is designated as "back." The front and back states of the input value component 30 can be associated (labeled) with 0 and 1. This makes it possible to represent the input value b according to the state of the input value component 30. For example, as shown in FIG. 20 , an encoding rule for the input value may be defined such that "0" is represented when the input value component 30 is in the front state, and "1" is represented when the input value component 30 is in the back state. However, the encoding rule is not limited to this.

[0122] Here, when the body block 3 and the pair of cover blocks 4, 4 are combined, the convex portions 32, 33 are hidden by the cover block 4, making it impossible to visually identify the orientation of the body block 3 from the outside. Furthermore, because the pair of cover blocks 4, 4 cannot be distinguished, the front and back of the input value component 30 (i.e., the input value) cannot be distinguished when the body block 3 and the pair of cover blocks 4, 4 are combined. By disassembling the input value component 30 into the body block 3 and the cover block 4 and checking the orientation of the convex portion 32 or the convex portion 33, it is possible to distinguish the front and back of the input value component 30. Note that the input value component 30 according to the second embodiment has an overall shape, including not only the external shape but also the internal shape, that is symmetrical in the observation direction, so the distribution of materials in the observation direction is symmetrical. As a result, the front and back of the input value component 30 cannot be distinguished visually, and it is also impossible to distinguish the front and back even when the input value component 30 is held in the hand or moved. This further enhances confidentiality.

[0123] [Combination parts] FIG. 22 is a plan view of a combination component 40 according to the second embodiment. The combination component 40 connects multiple input value components 30 together to form a combined structure. The shape of the combination component 40 is the same as the shape of the main body block 3 of the input value component 30. The combination component 40 has a main body 401 having a cubic outer shape, convex portions 402, 403, and 404 that are protrusions formed on the main body 401, and a concave portion 405 that is a depression formed on the main body 401. The convex portions 402 and 404 are provided on the side surfaces of the main body 401 that are opposite to each other in a direction perpendicular to the extension direction of the reference line R1. The convex portion 403 and the concave portion 405 are provided on the side surfaces of the main body 401 that are opposite to each other in the extension direction of the reference line R1. The protrusions 402, 403, and 404 can be fitted into the recesses 35 of the input value component 30. This allows the input value component 30 to be attached to the protrusions 402, 403, and 404.

[0124] [Combined structure] As shown in Figure 19, the combined structure in which the input value component 30 is attached to the combination component 40 has an external shape that is mirror-symmetrical with respect to the reference line R1 when viewed in the observation direction. Furthermore, the front and back of the combined structure cannot be distinguished in the observation direction. Note that, by attaching the input value component 30 to the convex portion 403, the combined structure of the secure computing device 200 is asymmetric in the extension direction of the reference line R1. The input value component 30 attached to the convex portion 403 functions as a mark (indicator) for identifying the orientation of the combined structure in the extension direction of the reference line R1.

[0125] The combined structure of the secure computing device 200 according to the second embodiment has a symmetrical overall shape, not just the outer shape, in the observation direction, so that the distribution of materials in the observation direction is symmetrical. As a result, the front and back of the combined structure cannot be distinguished not only by visual inspection but also by picking it up or moving it. This further enhances secrecy. Furthermore, when the combined structure is randomly rotated, each of the front and back sides appears with a probability of exactly 50%, which further enhances randomness (security of secrets).

[0126] 19, in the combined structure of the secure computation device 200 according to embodiment 2, the positions at which the three input value components 30 are arranged are designated as first position P1 to third position P3, respectively. The first position P1 to third position P3 correspond to the protrusions 402 to 404 of the combining component 40, respectively. When viewed from the observation direction, the second position P2 is a position on the reference line R1, and the first position P1 and the third position P3 are positions on both sides of the second position P2 in a direction perpendicular to the extension direction of the reference line R1 (the left-right direction in this embodiment).

[0127] [Logical product operation / logical sum operation] 5 and 11, the secure computing device 200 can output the results of a logical AND operation or a logical OR operation of input values ​​b1 and b2, as in the first embodiment. Specifically, in the input state, input value components 30 representing the input value or a bit inversion of the input value are placed at the first position P1 and the second position P2 with their front and back sides concealed, and input value components 30 representing 1 or 0 are placed at the third position P3, and the combined structure is randomly rotated. Then, the orientation of the combined structure in the extension direction of the reference line R1 is aligned with the orientation in the input state to create the observation state, and a mirror transformation about the reference line R1 is performed based on the observation result of the input value component 30 at the second position P2. As a result, the value represented by the input value component 30 at the first position P1 in the output state becomes the output value of the logical AND operation or the logical OR operation.

[0128] [Modification of the second embodiment] The following describes a modification of the second embodiment, focusing on the differences from the secure computing appliance 200 described with reference to FIGS.

[0129] [Variation 1] Fig. 23 is a side view showing a combined structure of a secure calculation device 200A according to Modification 1 of Embodiment 2. Fig. 23 shows a state in which the secure calculation device 200A is positioned so that the extension direction of the reference line R1 and the left-right direction coincide with each other and the convex portion 34 of the input value component 30 is located on the left side. As shown in Fig. 23, the secure calculation device 200A according to Modification 1 does not include a combining component 40, and the input value components 30 are directly combined with each other to form a combined structure.

[0130] The secure computation appliance 200A according to the first modification of the second embodiment includes at least n (n=m+1, m is a natural number) input value components 30. Like the secure computation appliance 100A according to the first modification of the first embodiment, the secure computation appliance 200A is capable of executing a copy operation (m-COPY) that copies an input value b m times.

[0131] As shown in FIG. 23, the combined structure according to the first modification of the second embodiment has n input value components 30 arranged side by side along the extension direction (left-right direction) of the reference line R1. Adjacent input value components 30, 30 are connected to each other by fitting the convex portion 34 of one into the concave portion 35 of the other. The combined structure according to the first modification of the second embodiment has an outer shape that is mirror-symmetrical with respect to the reference line R1. Furthermore, the front and back of the combined structure cannot be distinguished from each other in the observation direction. Note that, by providing the convex portion 34, the combined structure of the secure computing device 200A is asymmetric in the extension direction of the reference line R1. The convex portion 34 functions as a mark (indicator) for identifying the orientation of the combined structure in the extension direction of the reference line R1.

[0132] 23, in the combined structure of the secure computing appliance 200A, the n positions on the reference line R1 at which the n input value components 30 are arranged are, from the left, referred to as a first position P1, a second position P2, ..., an n-th position Pn. Furthermore, the input value components 30 arranged at the first position P1 to the n-th position Pn in the input state are referred to as a first input value component 301 to an n-th input value component 30n, respectively.

[0133] [Replication operation] 14, a duplication operation of an input value b can be performed, as in the first embodiment, by using the secure computation appliance 200A. Specifically, in the input state, the first input value component 301 representing the input value b is placed at the first position P1 with its front and back concealed, and all of the other m input value components 30 are placed at the second position P2 to the n-th position Pn, unifying them into either a state representing a value of 0 or a state representing a value of 1, and are randomly rotated. Then, the orientation of the combined structure in the extension direction of the reference line R1 is made to coincide with the orientation in the input state to form an observation state, and a mirror transformation about the reference line R1 is performed based on the observation result of the first input value component 301. As a result, the m values ​​represented by the second input value component 302 to the n-th input value component 30n in the output state become the output values ​​of the duplication operation.

[0134] [Variation 2] Fig. 24 is a side view showing a combined structure of a secure calculation device 200B according to Modification 2 of Embodiment 2. Fig. 24 shows a state in which the secure calculation device 200B is positioned so that the extension direction of the reference line R1 and the left-right direction coincide with each other and the convex portion 34 of the input value component 30 is located on the left side. As shown in Fig. 24, the secure calculation device 200B according to Modification 2 does not include a combining component 40, as with the secure calculation device 200A according to Modification 1, and the input value components 30 are directly combined together to form a combined structure.

[0135] The secure computation appliance 200B according to the second modification of the second embodiment includes at least two input value components 30. Like the secure computation appliance 100B according to the second modification of the first embodiment, the secure computation appliance 200B is capable of performing an exclusive OR operation (XOR) on input values ​​b1 and b2.

[0136] As shown in FIG. 24, the combined structure according to the second modification of the second embodiment has two input value components 30 arranged side by side along the extension direction (left-right direction) of the reference line R1. The two input value components 30 are connected to each other by fitting the convex portion 34 of one into the concave portion 35 of the other. The combined structure according to the second modification of the second embodiment has an external shape that is mirror-symmetrical with respect to the reference line R1 when viewed in the observation direction. Furthermore, the front and back of the combined structure cannot be distinguished from each other in the observation direction. Note that the convex portion 34 makes the combined structure of the secure computing device 200B asymmetric in the extension direction of the reference line R1.

[0137] 24, in the combined structure of the secure computation appliance 200B, the two positions on the reference line R1 where the two input value components 30 are arranged are defined as a first position P1 on the left side and a second position P2 on the right side. In addition, the input value component 30 arranged at the first position P1 in the input state is defined as a first input value component 301, and the input value component 30 arranged at the second position P2 is defined as a second input value component 302.

[0138] [Exclusive OR operation] 17, an exclusive OR operation of input values ​​b1 and b2 can be performed, as in the first embodiment. Specifically, in the input state, input value components 30 representing the input value or a bit inversion of the input value are placed at the first position P1 and the second position P2 with their front and backs concealed, and are randomly rotated. Then, the orientation of the combined structure in the direction of extension of the reference line R1 is made to coincide with the orientation in the input state to create the observation state, and a mirror transformation about the reference line R1 is performed based on the observation result of observing one of the two input value components 30. As a result, the value represented by the other of the two input value components 30 in the output state becomes the output value of the exclusive OR operation.

[0139] [Effects of Embodiment 2] The secure computation appliances 200 to 200B according to the second embodiment can provide the same operational effects as those of the first embodiment. That is, it becomes possible for a person to safely perform secure computation with a simple operation.

[0140] The secure computation devices 200 to 200B according to the second embodiment can be implemented, for example, by combining commercially available block toys.

[0141] <Other> Although the embodiments of the present disclosure have been described above, the configuration of the present disclosure is not limited to the above-described embodiments and various modifications are possible. The above-described embodiments can be appropriately combined as much as possible and implemented.

[0142] For example, by placing multiple combined structures in a black box and randomly shaking them, it is possible to achieve parallel random rotation. In other words, multiple logical operations can be performed in parallel. As a result, multiple secure computations can be performed efficiently. In this case, for combined structures that are identical in shape and indistinguishable from one another, random permutation between the combined structures can also be achieved. This is useful, for example, when multiple exclusive OR operations are performed in parallel using multiple combined structures, and the Hamming weight calculation result is obtained based on the output values ​​obtained from each combined structure while concealing the input path to each combined structure.

[0143] Furthermore, the output value of a logical operation output by a secure computing device may be observed immediately after the logical operation is performed, or may be kept secret without being observed and used as a secret input value for the next logical operation. For example, another logical operation may be performed using an input value component without observing the state of the input value component that indicates the output value in the output state.

[0144] The secure computation device according to the above-described embodiment is expected to be useful in, for example, the fields of information education, entertainment, and disaster security. From the perspective of information education, the use of the secure computation device allows users to perform secure computation in an intuitive and easy-to-understand manner, allowing users to enjoyably learn about cryptography, circuits, and security. From the perspective of entertainment, it becomes possible to perform various secure computations while playing. For example, the secure computation device can be used in a game in which a favorite person in a group is kept secret and only pairs that are matched are revealed while keeping this information secret. From the perspective of disaster security, the use of the secure computation device allows humans to physically perform cryptographic computations even in situations where electricity is unavailable during a disaster. [Explanation of symbols]

[0145] 1: Convex member 2: Concave member 3: Body block 4: Cover Block 10,30: Input value parts 20,40: Combination parts 100,200: Secret calculation equipment P1: 1st position P2: 2nd position P3: 3rd position Pn: nth position R1: Reference line

Claims

1. A secure computing device for performing a logical operation while keeping secret an input having a value of 0 or 1, a plurality of input value components whose front and back states correspond to 0 and 1, and the plurality of input value components can be combined in a state in which the front and back cannot be distinguished; the combined structure formed by combining the plurality of input value components is configured to be mirror-symmetrical with respect to a reference line, and the front and back cannot be distinguished; The combined structure in the input state, in which the input value component indicates the input value or the bit inversion of the input value and the front and back are concealed, is rotated randomly in an invisible state to become an observed state, observing the front and back of a predetermined input value component in the observation state, and based on the observation result, inverting the front and back of the combined structure by mirror transformation about the reference line to obtain an output state; The state of a predetermined input value component in the output state is set as an output value of a logical operation. Instrument for secret calculations.

2. At least three of said input value components; the combined structure is capable of arranging the input value components at a first position, a second position, and a third position that are determined when viewed from a predetermined observation direction; When viewed from the predetermined observation direction, the second position is a position on the reference line, and the first position and the third position are positions on both sides of the second position in a direction perpendicular to an extension direction of the reference line, In the input state, the input value components in a state indicating an input value or a bit inversion of the input value are arranged in the first position and the second position with their front and back sides concealed, and the input value components in a state indicating a value of 0 or 1 are arranged in the third position; The combined structure in the input state is rotated randomly in an invisible state, and the orientation of the combined structure in the extension direction of the reference line is made to coincide with the orientation in the input state, thereby becoming the observed state; In the observation state, the front and back of the input value component arranged at the second position are observed, and based on the observation result, the front and back of the combined structure are inverted by a mirror transformation about the reference line, thereby putting the combined structure into the output state; In the output state, the state of the input value component placed in the first position or the third position is set as an output value of a logical AND operation. The secure computing device according to claim 1 .

3. At least three of said input value components; the combined structure is capable of arranging the input value components at a first position, a second position, and a third position that are determined when viewed from a predetermined observation direction; When viewed from the predetermined observation direction, the second position is a position on the reference line, and the first position and the third position are positions on both sides of the second position in a direction perpendicular to an extension direction of the reference line, In the input state, the input value components in a state indicating an input value or a bit inversion of the input value are arranged in the first position and the second position with their front and back sides concealed, and the input value components in a state indicating a value of 0 or 1 are arranged in the third position; The combined structure in the input state is randomly rotated in an invisible state, and the orientation of the combined structure in the extension direction of the reference line is made to coincide with the orientation in the input state, thereby becoming the observed state; In the observation state, the front and back of the input value component arranged at the second position are observed, and based on the observation result, the front and back of the combined structure are inverted by a mirror transformation about the reference line, thereby putting the combined structure into the output state; In the output state, the state of the input value component placed in the first position or the third position is set as an output value of a logical OR operation. The secure computing device according to claim 1 .

4. At least n (n=m+1, m is a natural number) of input value components are provided; the combined structure is capable of arranging the n input value components at positions on the reference line; In the input state, a first input value component that is one of the n input value components is arranged in a state in which the first input value component indicates an input value and the front and back are concealed, and all of the other m input value components are arranged in a unified state of either a state in which the first input value component indicates a value of 0 or a state in which the other input value component indicates a value of 1; In the observation state, the front and back of the first input value component are observed, and if the state is the other of a state showing a value of 0 and a state showing a value of 1, the front and back of the combined structure are reversed by a mirror transformation about the reference line, and if the state is one of the above, the front and back of the combined structure are not reversed, thereby setting the combined structure to the output state; In the output state, the states of the other m input value components are set as output values ​​of the replication operation. The secure computing device according to claim 1 .

5. At least two of said input value components are provided; the combined structure is capable of arranging the two input value components at positions on the reference line; In the input state, the two input value components in a state indicating an input value or a bit inversion of the input value are arranged in a state in which the front and back are concealed; In the observed state, the front and back of one of the two input value components is observed, and based on the observation result, the front and back of the combined structure is inverted by a mirror transformation about the reference line, thereby bringing the combined structure into the output state; In the output state, the state of the other of the two input value components is set as an output value of an exclusive OR operation. The secure computing device according to claim 1 .

6. a combination component that combines the plurality of input value components to form the combination structure together with the plurality of input value components, 6. A secure computing device according to claim 1.

Images