Verification device, verification method, verification program, and verification system that perform calculation in accordance with privacy protection protocol for verifying result of stable matching problem

Abstract

To provide an efficient privacy protection verification protocol of a stable matching problem in setting of a malicious adversary, and a verification device, a verification method, a verification program and a verification system for performing calculation according to the verification protocol.SOLUTION: A verification device for performing computations in accordance with a privacy preserving protocol for verifying a result of a stable matching problem in a plurality of clients, the protocol defining a procedure to be executed between the plurality of clients and the verification device, the protocol functioning even in the setting of a malicious adversary, the protocol comprising two private Conditional Secret Disclosure (CDS) schemes.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to the field of stable matching problems, and more particularly to the field of a verification device, verification method, verification program, and verification system that perform calculations in accordance with a privacy-preserving protocol to verify the results of stable matching problems. [Background technology]

[0002] For the stable matching problem, we consider a set A(A={a1,…,a n}) and set B(B={b1,…,b n}) for each member a of set A. i is the preference order (b i_1 ,…,b i_n ) and each member b of set B j is the preference order (a j_1 ,…,a j_n ) The preference order (also called "preference") represents an order of preference for members of the other set, i.e., members that appear earlier in the preference order are preferred over members that appear later.

[0003] A matching M is a biprojection between sets A and B. (a i ,b j ) is a pair of matching M, then M(a i )=b j , M(b j )=a i In the stable matching problem, the goal is to find a stable matching between set A and set B according to the following definition:

[0004] Definition 1 (Blocking Pair): Given sets A and B, the preference order of each member in sets A and B, and a matching M, the pair (a i ,b j ) become a blocking pair (also called an "unstable pair") if the following two conditions are met: (1)a i is M(a i ) than bj I prefer. (2)b j is M(b j ) than a i I prefer.

[0005] Definition 2 (Stable Matching): Given sets A and B and the preference ordering of each member in sets A and B, a matching M is stable (a stable matching) if there are no blocking pairs.

[0006] Non-Patent Document 1 considers the following setting for the stable matching problem: There are 2n clients, each representing a member of set A or set B. Each client has a preference order and assigned pairs. The clients want to verify that the matching is stable.

[0007] Non-Patent Document 1 proposes a verification protocol for stable matching that uses the Conditional Disclosure of Secrets (CDS) scheme disclosed in Non-Patent Document 3 as a component. In the protocol of Non-Patent Document 1, each client generates a CDS message from its preference order and the assigned pairs and sends it to the verification server. The verification server calculates the CDS message according to the CDS scheme and returns the result of the CDS scheme to each client. The client can know the verification result of stable matching by analyzing the result of the CDS scheme. This protocol does not require encryption and works even in a malicious adversary setting that does not assume the behavior of the verification server (different from a semi-honest adversary setting that assumes the verification server follows the protocol correctly). [Prior art documents] [Non-patent literature]

[0008] [Non-Patent Document 1] Kittiphop Phalakarn, Toru Nakamura, “Verification Protocol for Stable Matching from Conditional Disclosure of Secrets”, Proceedings of the 22nd International Conference on Applied Cryptography and Network Security (ACNS 2024), Springer, Cham, March 1, 2024, pp. 119-134

[0009] [Non-Patent Document 2] D. Gale, L.S. Shapley, “College Admissions and the Stability of Marriage”, The American Mathematical Monthly, Mathematical Association of America, January 1962, Vol. 69, No. 1, pp. 9-15

[0010] [Non-Patent Document 3] Rishabh Bhadauria, Carmit Hazay, “Multi-clients Verifiable Computation via Conditional Disclosure of Secrets”, Proceedings of the 12th International Conference on Security and Cryptography for Networks (SCN 2020), Springer, Cham, September 7, 2020, vol. 12238, pp. 150-171

[0011] [Non-Patent Document 4] Adi Shamir, “How to Share a Secret”, Communications of the ACM, November 1979, Volume 22, Number 11, pp. 612-613 Summary of the Invention [Problem to be solved by the invention]

[0012] The main drawback of the verification protocol in [1] is that it does not protect privacy. Each client's preference order and assigned pairs are publicly disclosed to the verification server. The verification server has all inputs at the beginning of the protocol and can use them to recover the secret.

[0013] In contrast, the present invention preserves privacy: each client's preference order and assigned pairs are unknown to the verification server, and the verification server can recover the secret without using any of the inputs. The present invention aims to provide an efficient privacy-preserving verification protocol for verifying stable matching problems in a setting with a malicious adversary, as well as a verification device, verification method, and verification program that perform calculations in accordance with the privacy-preserving verification protocol. [Means for solving the problem]

[0014] This invention is a privacy-preserving verification protocol for the stable matching problem that works in a malicious adversary setting. Here, we consider a multi-client verifiable computation (MVC) setting with 2n clients and a verification server, similar to [1]. The main difference from [1] is that two conditional secret disclosure (CDS) schemes for unstable matching and stable matching are improved into privacy-preserving versions called private CDS schemes.

[0015] The verification device of the present invention is a verification device that performs calculations in accordance with a privacy-preserving protocol for verifying the results of a stable matching problem among multiple clients, the protocol defining procedures to be executed between the multiple clients and the verification device, functioning even in the case of a malicious adversary, and consisting of two private conditional secret disclosure (CDS) schemes.

[0016] Furthermore, the multiple clients may be members of either set A or set B, which have the same number of members, and if they are members of set A, they may have a preference order for each member of set B, and if they are members of set B, they may have a preference order for each member of set A, and may transmit to the verification device information indicating the preference order and the matching pair, as well as coded outputs of a common secret and randomness.

[0017] Furthermore, the two private conditional secret disclosure (CDS) schemes may be a private CDS scheme for unstable matching and a private CDS scheme for stable matching, and the verification device may output a value equal to the common secret when executing a procedure in the private CDS scheme for unstable matching only if matching between the multiple clients is unstable, and when executing a procedure in the private CDS scheme for stable matching only if matching between the multiple clients is stable.

[0018] In addition, the verification method of the present invention is a verification method that has a verification device perform calculations in accordance with a privacy-preserving protocol for verifying the results of a stable matching problem among multiple clients, wherein the protocol defines procedures to be executed between the multiple clients and the verification device, functions even in the case of a malicious adversary, and consists of two private conditional secret disclosure (CDS) schemes.

[0019] In addition, the verification program of the present invention is a verification program that causes a computer to perform calculations in accordance with a privacy-preserving protocol for verifying the results of a stable matching problem among multiple clients, wherein the protocol defines procedures to be executed between the multiple clients and the computer, functions even in the case of a malicious adversary, and is composed of two private conditional secret disclosure (CDS) schemes.

[0020] Furthermore, the verification system of the present invention is a verification system that performs processing and calculations in accordance with a privacy-preserving protocol for verifying the results of a stable matching problem among multiple clients, the verification system comprising multiple client terminals operated by the multiple clients and a verification server, the protocol defining procedures to be executed between the multiple client terminals and the verification server, functioning even in the case of a malicious adversary, and consisting of two private conditional secret disclosure (CDS) schemes. [Effects of the Invention]

[0021] Our invention consists of a private CDS scheme, which allows us to verify the results of stable matching problems while preserving the privacy of the inputs. Because the secret of the CDS scheme is considered a witness for verification, our invention also works in the setting of a malicious adversary. [Brief explanation of the drawings]

[0022] [Figure 1] 1 is a conceptual diagram illustrating an overall privacy protection verification system according to an embodiment. [Figure 2] FIG. 1 illustrates a private CDS scheme for unstable matching of an embodiment. [Figure 3] FIG. 1 illustrates a private CDS scheme for stable matching of an embodiment. [Figure 4] FIG. 1 illustrates a privacy-preserving verification protocol for stable matching of an embodiment. [Figure 5]FIG. 10 is a diagram illustrating a specific example of calculation according to the privacy-preserving verification protocol of the embodiment (Case 1 where the matching M is an unstable matching). [Figure 6] FIG. 10 is a diagram illustrating a continuation of the above specific example (Case 1). [Figure 7] FIG. 10 is a diagram illustrating a continuation of the above specific example (Case 1). [Figure 8] FIG. 10 is a diagram illustrating a continuation of the above specific example (Case 1). [Figure 9] FIG. 10 is a diagram illustrating a continuation of the above specific example (Case 1). [Figure 10] FIG. 10 is a diagram illustrating a continuation of the above specific example (Case 1). [Figure 11] FIG. 10 is a diagram illustrating a specific example of calculation in accordance with the privacy-preserving verification protocol of the embodiment (Case 2 where the matching M is a stable matching). [Figure 12] FIG. 10 is a diagram illustrating a continuation of the above specific example (Case 2). [Figure 13] FIG. 10 is a diagram illustrating a continuation of the above specific example (Case 2). [Figure 14] FIG. 10 is a diagram illustrating a continuation of the above specific example (Case 2). [Figure 15] FIG. 10 is a diagram illustrating a continuation of the above specific example (Case 2). [Figure 16] FIG. 10 is a diagram illustrating a continuation of the above specific example (Case 2). DETAILED DESCRIPTION OF THE INVENTION

[0023] An overview of the verification system 1 is shown in Figure 1. Figure 1(A) shows the execution of the algorithm in the private CDS scheme for unstable matching, and Figure 1(B) shows the execution of the algorithm in the private CDS scheme for stable matching. Details of these two private CDS schemes will be described later.

[0024] Each client 10 that is a member of set A or set B selects a preference order (a i_1 ,…,a i_n ) or (b j_1 ,…,bj_n ), matching result M(a i ) or M(b j ), the coded output of the common secret s and the randomness r is sent to the verification server 20. The verification server 20 performs calculations according to the verification protocol described below and outputs the results. The verification protocol uses two private CDS schemes as building blocks: a private CDS scheme for unstable matching and a private CDS scheme for stable matching. In the following description, the output of the validation server 20 when executing the algorithm in the private CDS scheme for unstable matching is referred to as s1', and the output of the validation server 20 when executing the algorithm in the private CDS scheme for stable matching is referred to as s2'.

[0025] Note that client 10 is both a member (person) of set A or set B and a terminal (client terminal) operated by the client as a person. However, since it would be cumbersome to distinguish between the two terms each time, hereafter they will be collectively referred to as client 10.

[0026] Our private CDS scheme follows Definition 3 (see Non-Patent Document 3), and our verification protocol follows Definition 4 of Multi-Client Verifiable Computation (MVC) (see Non-Patent Document 3). i Let be the domain of each input, S be the domain of secrets, and R be the domain of randomness.

[0027] Definition 3 (Private CDS (see Non-Patent Document 3)): For k senders (clients) and one receiver (server), f:X1×…×X k Let {0,1} be the condition, s be a secret from set S, and r be a randomness from set R chosen randomly with uniform distribution. Enc i Let be a probabilistic polynomial-time encoding algorithm (for all 1≦i≦k) and Dec be a deterministic decoding algorithm. The correctness and privacy of the CDS must be as follows:

[0028] Correctness: f(x1,…,x k )=1, X1×…×X k All inputs (x1,…,x k ), Dec(Enc1(x1,s,r),…,Enc k (x k ,s,r))=s

[0029] privacy: X1×…×X k Input from (x1,…,x k ), and for a secret s from set S and randomness r from set R, there exists a polynomial-time algorithm Sim (simulator) such that the distributions are indistinguishable. Simulate (f(x1,...,x k ))}={Enc1(x1,s,r),…,Enc k (x k ,s,r)} for f(x1,…,x k )=0 Simulate (f(x1,...,x k ),s)}={Enc1(x1,s,r),…,Enc k (x k ,s,r)} for f(x1,…,x k )=1

[0030] If the input satisfies the conditions of the blocking pair, the server can compute secret s. If the input does not satisfy the conditions of the blocking pair, the server cannot compute anything about secret s. In either case, the server cannot compute anything about the input, either directly or indirectly.

[0031] Definition 4 (MVC (see non-patent document 3)): Each i-th client receives input α i have f(α1,…,α k Consider a setup with k clients whose goal is to compute the following four algorithms:

[0032] δ←Setup: The algorithm Setup generates a randomness δ that is common to all clients.

[0033] (α i ´,τ i )←Input(α i ,δ,1 λ ): The algorithm Input is the input α i , common randomness δ, and security parameter 1 λ Using the coding input α i ´ and the decryption secret τ i Generate.

[0034] (β1,…,β k )←Compute(f,α1´,…,α k ´): The algorithm Compute is a description of a function f and a coded input α1´,…,α k ', the coded output β1,...,β k Generate.

[0035] y←Verify(β i ,τ i ): The algorithm Verify checks the encoded output β i and the decryption secret τ i produces a result y, which is ⊥ if the protocol is aborted.

[0036] MVC health is defined as follows: Health: All inputs (α1,…,α k ) and for malicious servers, δ←Setup,(α i ´,τ i )←Input(α i ,δ,1 λ ), (β1,…,β k )←Compute(f,α1´,…,α k ´) and for all 1≦i≦k, y→Verify(β i ,τi )).

[0037] Pr[y≠f(α1,…,α k )∧y≠⊥]≦negl(λ) must hold, where negl is a negligible function, which in the limit grows much more slowly than any polynomial.

[0038] The probability that the server will successfully output an incorrect result is negligible in any case.

[0039] Furthermore, we use Shamir secret shares (see Non-Patent Document 4) as a building block of a private CDS scheme for stable matching (Fig. 3). To generate shares, we first randomly generate a polynomial p(x) of degree t in a specific prime field with a secret s as a constant term. For each 1≦i≦k, the i-th share can be generated as p(i). The reconstruction process is performed by interpolating the polynomial p(x) of degree t, so t+1 shares p(i) are required. (x1, y1=p(x1))...(x t+1 ,y t+1 =p(x t+1 )), the secret s can be found by calculating the following formula:

[0040]

number

[0041] A private CDS scheme for unstable matching: A private conditional secret disclosure (CDS) scheme for unstable matching is proposed in Figure 2. The goal of this private CDS scheme is to allow the verification server to compute the secret s without leaking any input from the client to the verification server if and only if the matching M is unstable.

[0042] Each client 10 that is a member of set A or set B selects a preference order (a i_1 ,…,ai_n ) or (b j_1 ,…,b j_n ), matching result M(a i ) or M(b j ), the common secret s and the common randomness r = (r p ,(r i,j ) 1≦i,j≦n ,(u k i,j ) 1≦i,j≦n,k∈AUB ,(v k i,j ) 1≦i,j≦n,k∈AUB ), where for all i,j, Σ k∈AUB (u k i,j )=Σ k∈AUB (v k i,j )=0. Nothing has been input to the verification server 20.

[0043] The procedure (algorithm) executed between the client 10 and the verification server 20 in the private CDS scheme for unstable matching includes the following three steps. In the first step, member a i For each client 10 representing a_i and D a_i Generate (size n×n) M(a i ) each member b k About C a_i i,k = 1, and D a_i i,k =sr i,k The other cells are filled with 0. Next, the client 10 a_i =perm(r p ,C a_i +U a_i ) and F a_i =perm(r p ,D a_i +V a_i ) is calculated. a_i and F a_i Enc a_i and sent to the verification server 20. Here, perm(r p,C) is a seed value for the cells of matrix C. p is a function that sorts according to

[0044] In the second step, member b j For each client 10 representing b_j and D b_j Generate (size n×n) M(b j ) each member a k About C b_j k,j = 1, and D b_j k,j =r k,j The other cells are filled with 0. Next, the client 10 b_j =perm(r p ,C b_j +U b_j ) and F b_j =perm(rp,D b_j +V b_j ) is calculated. b_j and F b_j Enc b_j and sent to the validation server 20.

[0045] In the third step, for the decryption algorithm, the verification server 20 calculates the matrix G=Σ k∈AUB (E k ) and H=Σ k∈AUB (F k ) is calculated. G i,j If there exists i and j such that =2, then H i,j Otherwise, the validation server 20 outputs a random value.

[0046] A private CDS scheme for stable matching: A private conditional secret disclosure (CDS) scheme for stable matching is proposed in Figure 3. The goal of this private CDS scheme is to allow the verification server to compute the secret s without leaking any input from the client to the verification server if and only if the matching M is a stable matching.

[0047] Each client 10 selects a preference order (a i_1 ,…,a i_n ) or (b j_1 ,…,b j_n ), matching result M(a i ) or M(b j ), common secret s, common randomness r=(r p ,(r k ) 1≦k≦2n^2-1 ,(u k i,j ) 1≦i,j≦2n,k∈AUB ,(v k i,j ) 1≦i,j≦2n,k∈AUB ) where, for all i,j, Σ k∈AUB (u k i,j )=Σ k∈AUB (v k i,j )=0. Nothing has been input to the verification server 20.

[0048] The procedure (algorithm) executed between the client 10 and the verification server 20 in the private CDS scheme for stable matching includes the following four steps. In the first step, all clients 10 2 -1 polynomial p(x)=Σ i=1 to 2n^2-1 r i x i +s=r (2n^2-1) x (2n^2-1) +…+r1x 1 Generate +s.

[0049] In the second step, member a i For each client 10 representing a_i and D a_i Generate M(a i ) each member b k About C a_i i,k = PRF(i,k), D a_i i,k =p(PRF(i,k)). M(a i ) each member b in the following order of priorityz About C a_i n+i,z =PRF(n+i,z), D a_i n+i,z =p(PRF(n+i,z)). Fill other cells with 0. Here, PRF(x,k) is a pseudorandom function that generates a random value from input x and key k. Next, the client 10 calculates the matrix E a_i =perm(r p ,C a_i +U a_i ) and F a_i =perm(r p ,D a_i +V a_i ) is calculated. a_i and F a_i Enc a_i and sent to the validation server 20.

[0050] In the third step, member b j For each client 10 representing b_j and D b_j Generate M(b j ) each member a k About C b_j k,j =-PRF(k,j), D b_j k,j =-p(PRF(k,j)). M(b j ) each member a in the following order of priority z About C b_j z,n+j = PRF(z,n+j), D b_j z,n+j = p(PRF(z, n+j)). Fill other cells with 0. Next, the client 10 calculates the matrix E b_j =perm(r p ,C b_j +U b_j ) and F b_j =perm(r p ,D b_j +V b_j ) is calculated. b_j and F b_j Enc b_jand sent to the validation server 20.

[0051] In the fourth step, for the decryption algorithm, the verification server 20 calculates the matrix G=Σ k∈AUB (E k ) and H=Σ k∈AUB (F k ) is calculated. There are 2n cells in matrix G that are equal to 1. 2 If there are any, select (G i,j ,H i,j ) and outputs the secret s. Otherwise, the verification server 20 outputs a random value.

[0052] Privacy-preserving verification protocols for stable matching: A privacy-preserving verification protocol for stable matching is proposed in Figure 4. The goal is to allow each client to calculate whether the matching result is stable without leaking any input from each client to the server.

[0053] This privacy-preserving verification protocol uses as its building block the private CDS scheme shown in Figures 2 and 3. Even if a malicious server attempts to change the verification result by returning (outputting) a random value, the probability that the random value happens to match the secret value (and thus successfully change the verification result) is negligibly low.

[0054] Each client 10 selects a preference order (a i_1 ,…,a i_n ) or (b j_1 ,…,b j_n ) and the matching result M(a i ) or M(b j ) Nothing has been input to the verification server 20. The procedure (algorithm) defined by the verification protocol includes the following four steps:

[0055] The first step is the Setup algorithm: δ = (s1, s2, r1, r2) ← Setup. The client 10 obtains the common secret (s1, s2) and the common randomness (r1, r2) from a multi-party protocol or a common randomness source. The verification server 20 does not know these values.

[0056] The second step is the Input algorithm: (α i ´,τ i )←Input(α i ,δ,1 λ ) The client 10 executes a private CDS scheme for unstable matching (Fig. 2) using secret s1 and randomness r1. It also executes a private CDS scheme for stable matching (Fig. 3) using secret s2 and randomness r2. For each i in A∪B, α i contains all inputs of i, and α i ´ contains all private CDS messages of i, and τ i =(s1,s2).

[0057] The third step is the Compute algorithm: i ) i in A∪B ←Compute(f,{α i ´} i in A∪B ) The verification server 20 calculates the output values ​​s1′ and s2′ based on the two private CDS schemes, where for each i in A∪B, β i =(s1´,s2´).

[0058] The fourth step is the Verify algorithm: y←Verify(β i ,τ i ) If s1'=s1, all clients 10 output "not a stable matching (unstable matching)". If s2'=s2, all clients 10 output "stable matching". Otherwise, they output ⊥.

[0059] This protocol preserves input privacy because it uses the private CDS schemes in Figures 2 and 3 as building blocks. Even if a malicious server attempts to change the verification result by returning random values, the probability that the server will succeed in outputting an incorrect result is negligible.

[0060] 5 to 10 and 11 to 16 are diagrams showing specific examples of calculations in accordance with the privacy-preserving verification protocol. In this example, a group of clients a1, a2, and a3, and a group of clients b1, b2, and b3, each with n=3 members, are members of set A and set B, respectively. That is, 2n=6, A={a1, a2, a3}, B={b1, b2, b3}.

[0061] The order of preference for each client is as follows: a1:(b2,b1,b3), a2:(b3,b2,b1), a3:(b1,b3,b2) b1:(a2,a1,a3), b2:(a3,a2,a1), b3:(a1,a3,a2)

[0062] <Case 1: Matching M is an unstable matching> Figures 5 to 10 are specific examples of Case 1 where matching M is an unstable matching, and show the output of the verification server 20 in a private CDS scheme for an unstable matching, the output of the verification server 20 in a private CDS scheme for a stable matching, and the output of the client 10 in the privacy-preserving verification protocol.

[0063] In case 1 of FIGS. 5 to 10, matching M is M={(a1, b2), (a2, b1), (a3, b3)}. In matching M of case 1, M(a2)=b1, but according to the preference order of client a2, client a2 prefers client b2 to client b1 (condition (1)). Also, in matching M of case 1, M(b2)=a1, but according to the preference order of client b2, client b2 prefers client a2 to client a1 (condition (2)). In other words, since conditions (1) and (2) for a blocking pair are satisfied, in matching M of case 1, (a2, b2) is a blocking pair, and matching M is an unstable matching.

[0064] In a private CDS scheme for unstable matching, all clients 10 share a common secret s1 and a common randomness (r i,j ) 1≦i,j≦n , (u k i,j ) 1≦i,j≦n,k∈AUB and (v k i,j ) 1≦i,j≦n,k∈AUB Here, the common secret is s1=7. Also, the common randomness r i,j , u k i,j and v k i,j shall be as shown in Tables 1 to 5, respectively. [Table 1]

[0065] [Table 2]

[0066] [Table 3]

[0067] [Table 4]

[0068] [Table 5]

[0069] For all i, j, Σ k∈AUB (u k i,j )=Σ k∈AUB (v k i,j ) = 0. For example, for i = 1, j = 1, (u a_1 1,1 +u a_2 1,1 +u a_3 1,1 +u b_1 1,1 +u b_2 1,1 +u b_3 1,1 ) mod 97=(90+67+57+55+25+94) mod 97=0.

[0070] Furthermore, perm(r p , ) is a function that rearranges the cells of a matrix as shown in Table 6. In this example, the rearrangement function perm(r p , ) swaps rows so that the matrix to the left of the arrow becomes the matrix to the right, as shown in Table 6. [Table 6]

[0071] a1, a2, a3 generate the values ​​(matrices C, D, E and F) in Tables 7-10 below. In matrix C (Table 7), a cell (i,j) with a value of 1 indicates that i prefers j to M(i). The matrix C is the condition (M(a i ) is preferred to member b k ) indicates cells that match Matrix D is the cell value s1-r that meets the above conditions. i,j Includes: Matrices E and F are masked versions of matrices C and D. [Table 7]

[0072] [Table 8]

[0073] [Table 9]

[0074] [Table 10]

[0075] b1, b2, b3 generate the values ​​(matrices C, D, E and F) in Tables 11-14 below. In matrix C (Table 11), cell (i,j) with value 1 indicates that j prefers i to M(j). The matrix C is the condition (M(b j ) is preferred to member a k ) indicates cells that match Matrix D is the cell value r that meets the above conditions. i,j Includes: Matrices E and F are masked versions of matrices C and D. [Table 11]

[0076] [Table 12]

[0077] [Table 13]

[0078] [Table 14]

[0079] All matrices E and F (masked values) are sent to the verification server 20. The verification server 20 calculates the matrices G and H shown in Table 15 below as the sum of matrices E and F. For example, for all matrices E, i.e., matrix E a_1 , E a_2 , E a_3 , E b_1 , E b_2 and E b_3 The remainder of the sum of the cell values ​​in the first row and second column of the matrix G modulo 97 is (33+48+40+62+94+16) mod 97=2, so the value in the first row and second column of the matrix G is 2. Also, for all matrices F, i.e., matrix F a_1 , F a_2 , F a_3 , F b_1 , F b_2 and F b_3 The remainder of the sum of the cell values ​​in the first row and second column of the matrix H modulo 97 is (50+17+11+4+39+80) mod 97=7, so the cell value in the first row and second column of the matrix H is 7.

[0080] [Table 15]

[0081] Since matrix G has a cell with a value equal to 2, the verification server 20 outputs 7 as s1' from the corresponding cell of matrix H. When the private CDS scheme for the unstable matching is executed with the input of the unstable matching, the output s1' is equal to the secret s1, indicating that a blocking pair exists (matching M is unstable).

[0082] On the other hand, in the private CDS scheme for stable matching, each client 10 shares a common secret s2 and a common randomness r p , (r k ) 1≦k≦2n^2-1 , (u ki,j ) 1≦i,j≦2n,k∈AUB and (v k i,j ) 1≦i,j≦2n,k∈AUB Here, the common secret is s2=9. Also, the common randomness (u k i,j ) 1≦i,j≦2n,k∈AUB and (v k i,j ) 1≦i,j≦2n,k∈AUB is as shown in Table 16 below (note that other matrices U a_2 , V a_2 , U a_3 , V a_3 , U b_1 , V b_1 , U b_2 , V b_2 , U b_3 and V b_3 is omitted.)

[0083] [Table 16] Also, in the first step of the private CDS scheme for stable matching, all clients 10 have a degree 2n 2 -1=17 polynomial p(x)=Σ i=1 to 2n^2-1 x i +s2=x 17 +...+x 1 Has +9.

[0084] Furthermore, perm(r p , ) is a function that rearranges the cells of a matrix as shown in Table 17. In this example, the rearrangement function perm(r p , ) swaps rows so that the matrix to the left of the arrow becomes the matrix to the right, as shown in Table 17.

[0085] [Table 17]

[0086] a1 generates the values ​​(matrices C, D, E and F) in Tables 18 and 19 below. In matrices C and D (Table 18), cells (i,j) with non-zero values ​​represent Shamir shares according to each member's preference order. Matrices E and F are masked versions of matrices C and D, and the remaining matrices E and F are omitted. [Table 18]

[0087] [Table 19]

[0088] a2 generates the values ​​(matrices C and D) in Table 20 below (matrix E a_2 and F a_2 is omitted.) [Table 20]

[0089] a3 generates the values ​​(matrices C and D) in Table 21 below (matrix E a_3 and F a_3 are omitted). [Table 21]

[0090] b1 generates the values ​​(matrices C and D) in Table 22 below (matrix E b_1 and F b_1 is omitted.) [Table 22]

[0091] b2 generates the values ​​(matrices C and D) in Table 23 below (matrix E b_2 and F b_2 is omitted.) [Table 23]

[0092] b3 generates the values ​​(matrices C and D) in Table 24 below (matrix E b_3 and F b_3 is omitted.) [Table 24]

[0093] All matrices E and F (masked values) are sent to the verification server 20. The verification server 20 calculates the matrices G and H shown in Table 25 below as the sum of matrices E and F. [Table 25]

[0094] Matrices G and H only have 17 unique cell values ​​(the number of non-zero cells in matrices G and H), making interpolation impossible. This is because the presence of blocking pairs causes some of the inputs to be overlaid (placed in the same position), resulting in the lack of one piece of information, which is insufficient to recover the secret. Therefore, the verification server 20 outputs a random value of 67 as s2'. When the private CDS scheme for stable matching is executed on the unstable matching input, the output s2' = 67 is not equal to the secret s2 = 9, which means that it is not stable.

[0095] Each client 10 recognizes that s1' = s1 (= 7) and (67 =)s2' ≠ s2 (= 9), which are output by the verification server 20 according to the two private CDS schemes of the verification protocol. As a result, the client 10 concludes that the matching M is unstable.

[0096] <Case 2: Matching M is a stable matching> Figures 11 to 16 are specific examples of Case 2 where matching M is a stable matching, and show the output of the verification server 20 in a private CDS scheme for unstable matching, the output of the verification server 20 in a private CDS scheme for stable matching, and the output of the client 10 in the privacy-preserving verification protocol.

[0097] The preference order of each client is the same as that of Case 1 in FIGS. a1:(b2,b1,b3), a2:(b3,b2,b1), a3:(b1,b3,b2) b1:(a2,a1,a3), b2:(a3,a2,a1), b3:(a1,a3,a2)

[0098] However, unlike Case 1 in Figures 5 to 10, in Case 2 in Figures 11 to 16, the matching M is M = {(a1, b1), (a2, b2), (a3, b3)}. In the matching M of Case 2, M(a1) = b1, but according to the preference order of client a1, client a1 prefers client b2 to client b1 (condition (1)). However, in the matching M of Case 2, M(b2) = a2, but according to the preference order of client b2, client b2 prefers client a3 to client a2, but does not prefer a1, so condition (2) is not satisfied. By examining similarly, it can be seen that there is no pair (blocking pair) that satisfies both conditions (1) and (2).

[0099] In a private CDS scheme for unstable matching, all clients 10 share a common secret s1 and a common randomness (r i,j ) 1≦i,j≦n , (u k i,j ) 1≦i,j≦n,k∈AUB and (v k i,j ) 1≦i,j≦n,k∈AUB Here, the common secret is s1=7. Also, the common randomness r i,j , u ki,j and v k i,j shall be as shown in Tables 26 to 30, respectively.

[0100] [Table 26]

[0101] [Table 27]

[0102] [Table 28]

[0103] [Table 29]

[0104] [Table 30]

[0105] Furthermore, perm(r p , ) is a function that rearranges the cells of a matrix as shown in Table 31. In this example, the rearrangement function perm(r p , ) swaps rows so that the matrix to the left of the arrow becomes the matrix to the right, as shown in Table 31. [Table 31]

[0106] a1, a2, a3 generate the values ​​(matrices C, D, E and F) in Tables 32 to 35 below. In matrix C (Table 32), a cell (i,j) with a value of 1 indicates that i prefers j to M(i). The matrix C is the condition (M(a i ) is preferred to member b k ) indicates cells that match Matrix D is the cell value s1-r that meets the above conditions. i,j Includes: Matrices E and F are masked versions of matrices C and D.

[0107] [Table 32]

[0108] [Table 33]

[0109] [Table 34]

[0110] [Table 35]

[0111] b1, b2, b3 generate the values ​​(matrices C, D, E and F) in Tables 36 to 39 below. In matrix C (Table 36), a cell (i,j) with a value of 1 indicates that j prefers i to M(j). The matrix C is the condition (M(b j ) is preferred to member a k ) indicates cells that match Matrix D is the cell value r that meets the above conditions. i,j Includes: Matrices E and F are masked versions of matrices C and D.

[0112] [Table 36]

[0113] [Table 37]

[0114] [Table 38]

[0115] [Table 39]

[0116] All matrices E and F (masked values) are sent to the verification server 20. The verification server 20 calculates the matrices G and H shown in Table 40 below as the sum of matrices E and F. For example, for all matrices E, i.e., matrix E a_1 , E a_2 , E a_3 , E b_1 , E b_2 and E b_3 The remainder of the sum of the cell values ​​in the first row and first column of each of the above matrix G modulo 97 is (39+85+2+53+33+80) mod 97=1, so the value in the first row and first column of matrix G is 1. Also, for all matrices F, i.e., matrix F a_1 , F a_2 , F a_3 , F b_1 , F b_2 and F b_3 The remainder of the sum of the cell values ​​in the first row and first column of the matrix H modulo 97 is (28+92+42+78+96+56) mod 97=4, so the cell value in the first row and first column of the matrix H is 4.

[0117] [Table 40] Since matrix G has no cells with a value equal to 2 (i.e., no blocking pairs), verification server 20 outputs a random value 38. Running the private CDS scheme for unstable matching on the stable matching input showed that the output s1' was not equal to secret s1, indicating that matching M is stable.

[0118] On the other hand, in the private CDS scheme for stable matching, each client 10 shares a common secret s2 and a common randomness rp , (r k ) 1≦k≦2n^2-1 , (u k i,j ) 1≦i,j≦2n,k∈AUB and (v k i,j ) 1≦i,j≦2n,k∈AUB Here, the common secret is s2=9. Also, the common randomness (u k i,j ) 1≦i,j≦2n,k∈AUB and (v k i,j ) 1≦i,j≦2n,k∈AUB is as shown in Table 41 below (note that other matrices U a_2 , V a_2 , U a_3 , V a_3 , U b_1 , V b_1 , U b_2 , V b_2 , U b_3 and V b_3 is omitted.)

[0119] [Table 41] Also, in the first step of the private CDS scheme for stable matching, all clients 10 have a degree 2n 2 -1=17 polynomial p(x)=Σ i=1 to 2n^2-1 x i +s2=x 17 +...+x 1 Has +9.

[0120] Furthermore, perm(r p , ) is a function that rearranges the cells of a matrix as shown in Table 42. In this example, the rearrangement function perm(r p , ) swaps rows so that the matrix to the left of the arrow becomes the matrix to the right, as shown in Table 42. [Table 42]

[0121] a1 generates the values ​​(matrices C, D, E and F) in Tables 43 and 44 below. In matrices C and D (Table 43), cells (i,j) with non-zero values ​​represent Shamir shares according to each member's preference order. Matrices E and F are masked versions of matrices C and D, and the remaining matrices E and F are omitted. [Table 43]

[0122] [Table 44]

[0123] a2 generates the values ​​(matrices C and D) in Table 45 below (matrix E a_2 and F a_2 is omitted.) [Table 45]

[0124] a3 generates the values ​​(matrices C and D) in Table 46 below (matrix E a_3 and F a_3 are omitted). [Table 46]

[0125] b1 generates the values ​​(matrices C and D) in Table 47 below (matrix E b_1 and F b_1 is omitted.) [Table 47]

[0126] b2 generates the values ​​(matrices C and D) in Table 48 below (matrix E b_2 and F b_2 is omitted.) [Table 48]

[0127] b3 generates the values ​​(matrices C and D) in Table 49 below (matrix E b_3 and F b_3 is omitted.) [Table 49]

[0128] All matrices E and F (masked values) are sent to the verification server 20. The verification server 20 calculates the matrices G and H shown in Table 50 below as the sum of matrices E and F. [Table 50]

[0129] Since there are 18 unique cell values ​​in matrices G and H (the number of non-zero cells in matrices G and H), the interpolation calculation yields p(x)=Σ i=1 to 17 r i x i It is possible to recover +s2'. This is because there are no blocking pairs, so there are no overlaid (co-located) inputs, and all the information necessary to recover the secret is available. The verification server 20 then outputs the recovered 9 as s2' to each client 10. As a result of executing the private CDS scheme for stable matching with the stable matching input, the output s2' = 9 is equal to the secret s2 = 9, which means that the matching M is stable.

[0130] Each client 10 recognizes that (38 =) s1' ≠ s1 (= 7) and s2' = s2 (= 9), which are output by the verification server 20 according to the two private CDS schemes of the verification protocol. As a result, each client 10 concludes that the matching M is stable.

[0131] Furthermore, in the case of a malicious adversary configuration, the verification server 20 does not perform calculations in accordance with the verification protocol, and therefore outputs appropriate values ​​(random values) for both s1' and s2'. When s1' and s2' are both random values, the probability that the random values ​​happen to match s1 and / or s2 is negligibly low, so s1' ≠ s1 and s2' ≠ s2. Therefore, if the case where s1' ≠ s1 and s2' ≠ s2 is treated as an error, it is possible to prevent the verification server 20 from outputting fraudulent verification results in the case of a malicious adversary configuration.

[0132] Furthermore, this invention does not require encryption, works even in a malicious adversary setting, and can correctly verify the results of stable matching problems, making it possible to contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization, and foster innovation."

[0133] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most typical effects resulting from the present invention, and the effects of the present invention are not limited to the effects described in the embodiments.

[0134] The verification of the result of the stable matching problem by the verification server (verification device) 20 is realized by calculations in accordance with a verification protocol. This calculation is executed by commands from a verification program installed on the verification server (verification device) 20. This verification program may be distributed by being recorded on removable media such as CD-ROM or DVD-ROM, or may be distributed by being downloaded to the server via a network. Furthermore, this verification program may be provided to the verification server 20 as a web service via a network without being downloaded. [Explanation of symbols]

[0135] 1. Verification System 10 clients 20 Verification server (verification device)

Claims

1. A verification device that performs calculations in accordance with a privacy-preserving protocol to verify results of a stable matching problem among multiple clients, comprising: The protocol comprises: defining a procedure to be executed between the plurality of clients and the verification device; It works even in a malicious adversary setting, It consists of two private conditional disclosure (CDS) schemes: Verification device.

2. The plurality of clients is a member of either set A or set B, which have the same number of members, If a member of set A, then it has a preference order for each member of set B, and if a member of set B, then it has a preference order for each member of set A; transmitting to the verification device the preference order and information indicating the matching pair partners, as well as a coded output of the common secret and randomness; The verification device according to claim 1 .

3. The two private conditional disclosure (CDS) schemes are a private CDS scheme for unstable matchings and a private CDS scheme for stable matchings, The verification device When executing a procedure in the private CDS scheme for unstable matching, outputting a value equal to the shared secret if and only if the matching between the plurality of clients is unstable; When executing the procedure in the private CDS scheme for stable matching, output a value equal to the shared secret only if matching among the multiple clients is stable. The verification device according to claim 2 .

4. A verification method for verifying a result of a stable matching problem among multiple clients, the method comprising: causing a verification device to perform a calculation in accordance with a privacy-preserving protocol; The protocol comprises: defining a procedure to be executed between the plurality of clients and the verification device; It works even in a malicious adversary setting, It consists of two private conditional disclosure (CDS) schemes: Verification method.

5. A verification program that causes a computer to perform calculations in accordance with a privacy-preserving protocol for verifying results of a stable matching problem among multiple clients, comprising: The protocol comprises: defining a procedure to be executed between the plurality of clients and the computer; It works even in a malicious adversary setting, It consists of two private conditional disclosure (CDS) schemes: Verification program.

6. A verification system that performs processing and calculations in accordance with a privacy-preserving protocol for verifying results of a stable matching problem among multiple clients, comprising: the verification system includes a plurality of client terminals operated by the plurality of clients and a verification server; The protocol comprises: defining a procedure to be executed between the plurality of client terminals and the verification server; It works even in a malicious adversary setting, It consists of two private conditional disclosure (CDS) schemes: Verification system.

Images