Secret information processing system and secret information processing method

Abstract

To provide a system and a method for executing information processing related to data representing information while keeping the information secret by encryption.SOLUTION: In a secret information processing system including a registration machine, an analyzer, and a providing server connected via a network, the registration machine derives a data key by using a plaintext word, creates encrypted data obtained by encrypting plaintext data by using the derived data key, distributes the data key to a plurality of shares, and creates an encrypted word by encrypting the plaintext word and the shares by searchable encryption. The analyzer encrypts a plaintext query with searchable encryption to create an encrypted query, and the provision server acquires an encrypted word and encrypted data, registers the encrypted word and the encrypted data in a database, acquires the encrypted query, compares the encrypted query with the registered encrypted word, acquires a share when a comparison result is a match, restores a data key when the acquired share is a certain number or more, and decrypts the encrypted data into plaintext data using the restored data key.SELECTED DRAWING: Figure 7

Description

[Technical Field]

[0001] The present invention relates to a technique for processing secret information. [Background technology]

[0002] Cloud computing technology, which provides users with computer resources consisting of multiple computers, servers, etc. connected to each other via a network so that data can be transmitted between them, via a network primarily based on the Internet, has many advantages and is therefore widely used for a variety of purposes today.

[0003] However, due to its nature, cloud computing technology is inherently susceptible to the risk of information leakage when used. Therefore, today, various technologies have been proposed that enable various information processing operations to be performed while keeping the information confidential by using encryption technology, for example, when performing various information processing operations in a computer system (hereinafter also referred to as a "cloud computing system") built on a cloud infrastructure based on cloud computing technology (for example, Non-Patent Documents 1 and 2). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Reza Curtmola,Juan A.Garay,Seny Kamara,Rafail Ostrovsky:Searchable Symmetric encryption:Improved definitions and efficient constructions. J.Computer.Security. 19(5):895-934(2011). [Non-patent document 2] Raluca Ada Popa,Catherine MSRedfield,Nickolai Zeldovich, and Hari Balakrishnan. CryptDB:.Protecting Confidentiality with Encrypted Query Processing.In Proceedings of the 23rd ACM Symposium on Operating Systems Principles(2011). Summary of the Invention [Problem to be solved by the invention]

[0005] Non-Patent Document 1 describes a technology that enables searching data in its encrypted state. However, the use of this technology described in Non-Patent Document 1 is limited to searching encrypted data. Therefore, even if the technology described in Non-Patent Document 1 is used, other advanced information processing cannot be performed on the cloud.

[0006] Furthermore, Non-Patent Document 2 describes a technology that, when a search result is determined to be a HIT (matching the search), can extract a data key for decrypting encrypted data that matches the search result. However, in this technology described in Non-Patent Document 2, the data is encrypted multiple times in advance, and even after decryption, it is not possible to decrypt the encrypted state that allows only special operations. Therefore, even if the technology described in Non-Patent Document 2 is used, the information processing that can be performed on the cloud is significantly limited, and attempts to avoid this situation will result in the disclosure of more plaintext than necessary, which could lead to information leakage.

[0007] The present invention has been made in consideration of the above-mentioned problems, and aims to provide a technology that enables various information processing to be performed on data representing encrypted information while ensuring the confidentiality of the encrypted information, without disclosing plaintext more than necessary. [Means for solving the problem]

[0008] The confidential information processing system according to the present invention is a system that performs information processing on data representing information while keeping the information confidential through encryption, and includes a registration machine, an analyzer, and a provision server, each of which is composed of a computer having at least a processor and a storage device, and which are connected to each other via a network so as to be able to communicate data. The registration machine derives a data key using a plaintext word representing an unencrypted word, encrypts the plaintext data representing the unencrypted data using the derived data key to create encrypted data, distributes the data key among multiple shares, and encrypts the plaintext word and shares with a searchable cipher to create an encrypted word. The analyzer encrypts a plaintext query representing an unencrypted query with a searchable cipher to create an encrypted query. The provision server acquires the created encrypted word and the created encrypted data and registers them in a database, acquires the created encrypted query and compares it with the registered encrypted word, and acquires the share if the comparison results match. If the acquired shares are a certain number or more, a data key corresponding to a plurality of shares including the certain number or more shares is restored using the certain number or more shares, and the encrypted data is decrypted using the restored data key.

[0009] Other problems and solutions disclosed in the present application will be made clear in the detailed description and drawings. [Effects of the Invention]

[0010] According to the present invention, various information processes can be performed on data representing encrypted information while ensuring the confidentiality of the encrypted information, without disclosing plaintext more than necessary. [Brief explanation of the drawings]

[0011] [Figure 1] 1 is a diagram illustrating an example of the overall configuration of a system including a secret information processing system according to first and second embodiments. [Figure 2]FIG. 2 is a diagram illustrating an example of a hardware configuration of various devices that configure the secret information processing system. [Figure 3] FIG. 2 is a diagram illustrating an example of functional blocks of various devices that configure the secret information processing system according to the first and second embodiments. [Figure 4] FIG. 2 is a sequence diagram illustrating an example of an overall flow of processing executed by the secret information processing system according to the first and second embodiments. [Figure 5A] FIG. 2 is a diagram illustrating an example of the configuration of a medical treatment table stored in a database in the provision server according to the first embodiment. [Figure 5B] FIG. 10 is a diagram showing, as a comparative example, the configuration of a medical care table in the case where all ciphertexts are displayed in plaintext. [Figure 6] 10 is a flowchart illustrating an example of a procedure in which a registration device registers a pair of plaintext word and plaintext data in the registration phase of the secret information processing system according to the first to third embodiments. [Figure 7] FIG. 2 is a diagram illustrating an example of an image of a procedure in which the registration device 100 registers a pair of plaintext word and plaintext data in the registration phase of the secret information processing system according to the first to third embodiments. [Figure 8] 10 is a flowchart illustrating an example of a procedure in which an analyzer requests a search for one plaintext query in the search phase of the secret information processing system according to the first to third embodiments. [Figure 9] 10 is a flowchart illustrating an example of a procedure from when a provider server is requested by an analyzer to search one encrypted query until the provider server sends out the search result in the search phase of the secret information processing system according to the first and second embodiments. [Figure 10] FIG. 10 is a diagram illustrating an image of a procedure from when a provider server is requested by an analyzer to search one encrypted query to when the provider server sends out the search results in the search phase of the secret information processing system according to the first and second embodiments. [Figure 11A] FIG. 10 is a diagram showing an example of the configuration of a medical care table (when all ciphertexts are displayed in plaintext) stored in a database in a provider server according to the second and third embodiments. [Figure 11B]FIG. 10 is a diagram showing an example of the configuration of a care table (when all ciphertexts are displayed as plaintexts) stored in a database in a provider server according to second and third embodiments. [Figure 12] 10 is a flowchart illustrating an example of a procedure in which a providing server compares one encrypted query with search indexes in a plurality of designated tables and sends out output data in a search phase of the secret information processing system according to the second embodiment. [Figure 13] FIG. 10 is a diagram illustrating an example of the process in which the provision server compares one encrypted query with the search indexes of the specified medical treatment table and care table and decrypts the plaintext data PD in the search phase of the secret information processing system of Example 2. [Figure 14] FIG. 11 is a diagram illustrating an example of the overall configuration of a system including a secret information processing system according to a third embodiment. [Figure 15] FIG. 10 is a diagram illustrating an example of functional blocks of various devices that configure the secret information processing system according to the third embodiment. [Figure 16] FIG. 11 is a sequence diagram illustrating an example of an overall flow of processing executed by a secret information processing system according to a third embodiment. [Figure 17] FIG. 11 is a sequence diagram illustrating an example of a procedure in a search phase of the secret information processing system according to the third embodiment, in which a providing server is requested to search one encrypted query and cooperates with a DB server to send out search results. DETAILED DESCRIPTION OF THE INVENTION

[0012] Various embodiments of the present invention will be described in detail below with reference to the accompanying drawings. However, the present invention is not limited to the contents of the embodiments exemplified below. Examples in which the specific configuration is modified are also included within the scope of the idea or purpose of the present invention. For example, the following embodiments are intended to provide a detailed description of the present invention, and are not necessarily limited to those having all of the configurations included in the description.

[0013] In the configuration of the invention described below, the same parts and / or elements, or parts and / or elements having similar functions, will be denoted by the same symbols in different drawings, and duplicate explanations may be omitted.

[0014] Furthermore, when there are multiple identical parts and / or elements, or parts and / or elements with similar functions, the same reference numerals may be used with different subscripts to distinguish between the multiple parts and / or elements. On the other hand, when there is no need to distinguish between the multiple parts and / or elements, the subscripts may be omitted.

[0015] The designations "first," "second," "third," etc. in this specification are used to identify components and do not necessarily limit the number, order, or content thereof. Furthermore, numbers used to identify components are used in different contexts, and numbers used in one context do not necessarily indicate the same configuration in another context. Furthermore, this does not prevent a component identified by a certain number from also serving the function of a component identified by another number.

[0016] To facilitate understanding of the invention, the position, size, shape, range, etc. of each component shown in this specification and / or the drawings may not represent the actual position, size, shape, range, etc. Therefore, the present invention is not necessarily limited to the position, size, shape, range, etc. disclosed in this specification and / or the drawings.

[0017] As used herein, elements referred to in the singular are intended to include the plural unless the context clearly indicates otherwise.

[0018] Also, in the following description, an "interface apparatus" may refer to one or more interface devices, which may be at least one of the following: One or more I / O (Input / Output) interface devices. The I / O (Input / Output) interface devices are interface devices for at least one of an I / O device and a remote display computer. The I / O interface device for the display computer may be a communications interface device. The at least one I / O device may be a user interface device, for example, either an input interface device such as a keyboard and pointing device, or an output interface device such as a display device. One or more communication interface devices. The one or more communication interface devices may be one or more communication interface devices of the same type (e.g., one or more NICs (Network Interface Cards)) or two or more communication interface devices of different types (e.g., a NIC and an HBA (Host Bus Adapter)). Note that the network that the communication interface device accesses for communication may be the Internet, a LAN (Local Area Network), a WAN (Wide Area Network), a mobile phone network, etc., but is not limited to these.

[0019] In the following description, "memory" refers to one or more memory devices, which are an example of one or more storage devices, and may typically be a primary storage device. At least one memory device in the memory may be a volatile memory device or a non-volatile memory device.

[0020] In the following description, "storage" may refer to one or more persistent storage devices, which are an example of one or more storage devices. A persistent storage device may typically be a non-volatile storage device (e.g., an auxiliary storage device), and specifically may be, for example, a hard disk drive (HDD), a solid state drive (SSD), a non-volatile memory express (NVMe) drive, or a storage class memory (SCM).

[0021] In the following description, the "memory device" may be at least a memory, including memory and storage.

[0022] Furthermore, in the following description, a "processor" which is an arithmetic unit may be one or more processor devices. The at least one processor device may typically be a microprocessor device such as a CPU (Central Processing Unit), but may also include other types of processor devices such as a GPU (Graphics Processing Unit). The at least one processor device may be a single-core or multi-core. The at least one processor device may be a processor core. The at least one processor device may also be a processor device in a broader sense, such as a hardware circuit that performs part or all of the processing (e.g., an FPGA (Field-Programmable Gate Array), a CPLD (Complex Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit)).

[0023] In the following description, information that provides an output in response to an input may be described using expressions such as "xxx database" or "xxx table." However, this information may be data of any structure (for example, structured data or unstructured data), or may be a learning model such as a neural network, genetic algorithm, or random forest that generates an output in response to an input. Therefore, "xxx database" or "xxx table" can be referred to as "xxx information." In the following description, the structure of each database or table is merely an example, and one database or table may be divided into two or more databases or tables, or all or part of two or more databases or tables may be one database or table.

[0024] In the following description, processing may be described using a "program" as the subject. However, because a program is executed by a processor to perform a predetermined process using a storage device and / or an interface device, etc., as appropriate, the subject of the process may also be the processor (or a device such as a controller having the processor). A program may be installed in a device such as a computer from a program source. The program source may be, for example, a program distribution server or a computer-readable (e.g., non-transitory) recording medium. In the following description, two or more programs may be realized as one program, or one program may be realized as two or more programs.

[0025] Furthermore, in the following description, the "secret information processing system" may be a system (e.g., a cloud computing system) realized on a group of physical computing resources (e.g., a cloud infrastructure), or a system (e.g., an on-premise system) composed of one or more physical computers. When the secret information processing system "displays" the display information, it may mean that the display information is displayed on a display device possessed by the computer, or that the computer transmits the display information to a display computer (in the latter case, the display information is displayed by the display computer).

[0026] <Terminology> First, definitions of terms used in the following description of the embodiments and modifications of the present invention will be explained with reference to FIGS.

[0027] Fig. 1 is a diagram illustrating an example of the overall configuration of a system including a secret information processing system 1000 according to Examples 1 and 2. Fig. 14 is a diagram illustrating an example of the overall configuration of a system including a secret information processing system 1000 according to Example 3.

[0028] (1) Plaintext This refers to information before it is encrypted. The plaintext data PD, plaintext word PW, and plaintext query PQ handled by the secret information processing system 1000 according to the present invention are all plaintext.

[0029] (2) Ciphertext This refers to information after it has been encrypted. The encrypted data ED, the encrypted word EW, and the encrypted query EQ handled by the secret information processing system 1000 according to the present invention are all ciphertexts.

[0030] (3) key It is information used for operations such as encryption and decryption. The word key WK, query key QK, data key DK, and key generation key KK handled by the secret information processing system 1000 according to the present invention are all keys.

[0031] (4) Registration machine This refers to any or all of the registration devices 100a, 100b, 100c, 100n (hereinafter, when referring to them collectively or when no distinction is made, they will be referred to as "registration device 100"). A registered user 1 operates the registration device 100 and properly manages and uses keys and plaintext as appropriate.

[0032] (5) Analyzer This refers to any or all of the analyzers 200a, 200b, 200c, 200n (hereinafter, when referring to them collectively or when no distinction is made, they will be referred to as "analyzers 200"). An analysis user 2 operates the analyzer 200 and properly manages and uses keys and plaintexts as appropriate.

[0033] (6) Provisioning Server In the present invention, ciphertexts are managed in consideration of the risk of information leakage from the server administrator 3 or an unauthorized intruder. After a search, if the number of search hits exceeds a certain number, only the ciphertext related to the search result is allowed to be converted into plaintext and manipulated.

[0034] (7) Distribution Server The key is distributed in cooperation with the registration device 100 and the analysis device 200. The key for distribution is generated in advance or deposited and managed securely. The role of the distribution server 500 may be performed by any or all of the registration device 100, the analysis device 200, and the provision server 300. For example, the registration device 100 may generate, distribute, and manage keys. For example, a trusted area such as a secure Trusted Execution Environment (TEE) may be set within the provision server 300, and the distribution server 500 may generate, distribute, and manage keys. For example, the registration device 100 and the analysis device 200 may each generate, distribute, and manage keys.

[0035] (8) Common key encryption It has encryption and decryption functions to generate keys and encrypt and decrypt data. Typical common key encryption methods include the AES encryption and 3DES encryption. References for AES encryption: NIST FIPS 197-upd1, Advanced Encryption Standard (AES), https: / / nvlpubs.nist.gov / nistpubs / FIPS / NIST.FIPS.197.pdf Reference for 3DES cipher: NIST Special Publication (SP) 800-67 Revision 2, Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher. https: / / nvlpubs.nist.gov / nistpubs / SpecialPublications / NIST.SP.800-67r2.pdf The encryption function takes plaintext and a key as input and outputs ciphertext. The decryption function takes ciphertext and a key as input and outputs plaintext.

[0036] (9) Searchable Encryption It has functions for word encryption, query encryption, and comparison. In addition to the method proposed by Reza Curtmola below, many other methods are known. References: Reza Curtmola, Juan A.Garay, Seny Kamara, Rafail Ostrovsky: Searchable Symmetric encryption: improved definitions and efficient constructions. https: / / web.cs.ucla.edu / ~rafail / PUBLIC / 74.pdf The word encryption function takes a plaintext word PW and a word key WK as input and outputs an encrypted word EW. The query encryption function takes a plaintext query PQ and a query key QK as input and outputs an encrypted query EQ. The comparison function takes the encrypted word EW and the encrypted query EQ as input, and outputs 1 if PW=PQ, and 0 if PW≠PQ. If 1 is output, it is determined that the encrypted word EW and the encrypted query EQ match, and if 0, it is determined that they do not match. Theoretically, there is a possibility that 1 will be output even when PQ≠PQ, but since this possibility is sufficiently small, we will not consider it in this paper. When generating the encryption word EW, a similar comparison can be performed using a plaintext other than the plaintext word PW. If the encryption word EW and the encrypted query EQ match, the plaintext embedded in the encryption word EW can be decrypted. The comparison result is output as either a 1 indicating a match and the corresponding plaintext, or a 0 indicating a mismatch and a random number. The word key WK and the query key QK may be the same key.

[0037] (10)Secret sharing It has the functions of polynomial generation, share generation, and restoration. In addition to the method proposed by Adi Shamir below, many other methods are known. References: Adi Shamir, “How to Share a Secret,” Commun.ACM, vol. 22, no. 11, pp. 612-613, 1979. The polynomial generation function takes secret information C and a threshold value t as input, and outputs a t-dimensional polynomial P that conceals the secret information. The share generation function generates an arbitrary number of shares S from a polynomial P. The recovery function takes t or more shares S with different values ​​and a polynomial P as input and recovers the secret information C. It should be noted that the polynomial generation function does not necessarily have to be included. [Example]

[0038] <System configuration example> Next, a configuration example of a secret information processing system 1000 according to a first embodiment (and a second embodiment, which will be described later) will be described with reference to FIGS.

[0039] (Example of the overall system configuration) The secret information processing system 1000 according to the first embodiment is a computer system that entrusts management of ciphertexts to a third party organization such as a cloud service, and that discloses plaintexts and can execute any information processing only when a certain number of searches or more hits are found on a server operated by the third party organization, and is realized by a plurality of computers or servers each having the configurations described below. Note that if the number of hits is less than the certain number, the information remains encrypted and is not disclosed, and the ciphertext maintains its confidentiality.

[0040] The technology provided by this secret information processing system 1000 is effective, for example, in providing recommendation services using specific dates such as birthdays. By securely managing users' birthdays and determining that users with a certain number of registered users have a low risk of being identified, services can be provided, such as giving commemorative gifts or certificates of commendation based on their birthdays, or encouraging them to purchase products as gifts. Furthermore, for users with an insufficient number of registered users with the same birthday, encryption is maintained to protect their privacy until a certain number of users with the same birthday are registered.

[0041] Furthermore, the technology provided by this secret information processing system 1000 is effective, for example, in providing a recommendation service using movement history. User location information is managed securely, and recommendation services using movement history can be provided to users who have registered a certain number of pieces of location information. Furthermore, users who have not registered enough pieces of location information cannot use the recommendation service, but in return, their location information is not disclosed, so the user's privacy is protected.

[0042] Furthermore, the technology provided by this confidential information processing system 1000 is effective, for example, in providing a recommendation service using medical history. It securely manages the date, time, and examination results of patients, and makes it possible to provide a recommendation service using medical history to patients who have more than a certain number of examination results. Furthermore, patients whose number of days of examination does not meet a threshold cannot receive the recommendation service, but the patient's privacy is also protected.

[0043] As illustrated in FIG. 1, the secret information processing system 1000 is configured to include at least a registration device 100 operated by a registered user 1 at a registration company 10, a provision server 300 operated by a server administrator 3 as a service provider 30, and an analysis device 200 operated by an analysis user 2 at an analysis company 20. As illustrated in FIG. 1, the secret information processing system 1000 preferably includes a distribution server 500 operated by a key administrator 5 of a key management authority 50. The following description will be given assuming that the secret information processing system 1000 is configured to include one or more registration devices 100, one or more provision servers 300, one or more analysis devices 200, and one or more distribution servers 500. In this case, the registration device 100, the provision server 300, the analysis device 200, and the distribution server 500 are each connected to each other so as to be able to communicate data with each other via an appropriate communication network 600 such as the Internet or a dedicated line (hereinafter simply referred to as a "network"), as illustrated in FIG. 1. The registration device 100, the provision server 300, the analysis device 200, and the distribution server 500 are connected to the network 600 by wire via well-known communication devices (not shown), but may also be connected wirelessly.

[0044] Furthermore, various devices such as other computers and servers (hereinafter also referred to as "other devices") may be connected to the registration machine 100, the provision server 300, the analyzer 200, and / or the distribution server 500 so as to be able to perform data communications via a network 600. In this case, the other devices and the network 600 may be connected by wire or wirelessly via well-known communication equipment (not shown).

[0045] In the following explanation, registered businesses 10a, 10b, 10c,..., 10n will be referred to collectively as "registered business 10" when referring to them collectively or when no distinction is made between them. Similarly, registered users 1a, 1b, 1c,..., 1n will be referred to collectively as "registered user 1" when referring to them collectively or when no distinction is made between them. Similarly, analysis businesses 20a, 20b, 20c,..., 20n will be referred to collectively as "analysis business 20" when referring to them collectively or when no distinction is made between them. Similarly, analysis users 2a, 2b, 2c,..., 2n will be referred to collectively as "analysis user 2" when referring to them collectively or when no distinction is made between them.

[0046] (Example of hardware configuration) Next, an example of the hardware configuration of each of the devices (100, 200, 300, 500) constituting the secret information processing system 1000 according to the first embodiment will be described with reference to FIG.

[0047] FIG. 2 is a diagram showing an example of the hardware configuration of the registration device 100, the provision server 300, the analysis device 200, and the distribution server 500 that constitute the secret information processing system 1000 according to the first embodiment (and the second and third embodiments described later).

[0048] The registration device 100, provision server 300, analyzer 200, and distribution server 500 constituting the secret information processing system 1000 are all realized by a computer having at least a storage device including a memory 102 and a storage 103, an interface device including at least a communication device 108, and a processor 101 connected thereto, as illustrated in Fig. 2. In addition, in this secret information processing system 1000, the interface device may include an input device 105, an output device 106, and / or a reading / writing device 107.

[0049] The following explanation will be given assuming that the registration device 100, provision server 300, analysis device 200 and distribution server 500 constituting the confidential information processing system 1000 are each realized by a single general-purpose computer having one or more processors 101, one or more memories 102, one or more storages 103, one or more communication devices 108, one or more input devices 105, one or more output devices 106, one or more reading / writing devices 107, and a bus 104 connecting them to each other.

[0050] The storage 103 is an auxiliary storage device made up of a nonvolatile storage element such as a flash memory. Specific examples of the storage 103 include a solid state drive (SSD) and a hard disk drive (HDD). The storage 103 stores at least various computer programs for implementing functions required for the secret information processing system 1000.

[0051] The above-mentioned various programs are provided to the devices (100, 200, 300, 500) from various removable media (not shown) such as CD-ROMs and flash memories or via a network 600, and are stored in a non-volatile storage 103, which is a non-transitory storage medium. Therefore, as described above, it is preferable that the registration device 100, the provision server 300, the analysis device 200, and the distribution server 500 constituting the confidential information processing system 1000 each have a reading / writing device 107 for reading data from the removable media.

[0052] The various programs described above may also be installed from a program source. The program source may be, for example, a computer from which the program is distributed or a computer-readable recording medium. The various programs described above may also be configured by a device driver, an operating system, various application programs located at higher levels than these, or libraries that provide common functions to these programs. Furthermore, two or more programs may be realized as a single program, or one program may be realized as two or more programs.

[0053] The storage 103 also stores data representing various types of information.

[0054] The memory 102 is a main storage device mainly made up of volatile storage elements such as RAM (Random Access Memory). The memory 102 also includes a ROM made up of nonvolatile storage elements. The ROM stores unchanging programs (e.g., BIOS) and the like. The memory 102 temporarily stores data representing various information read from the storage 103 and various data acquired via the communication device 108, the input device 105, and / or the reading / writing device 107.

[0055] Furthermore, when various programs are executed by the processor 101, these programs stored in the storage 103 are read into the memory 102 and temporarily stored therein.

[0056] The processor 101 is a processor device such as a CPU (Central Processing Unit) and various co-processors. The processor 101 loads various computer programs into the memory 102 and executes them to perform overall control of the device (100, 200, 300, 500) itself, and also controls a control unit (not shown) that performs various processes such as calculation processing and determination processing.

[0057] In addition to the reading / writing device 107 described above, the interface device includes a communication device 108 that controls the communication section (not shown) described below, an input device 105 that controls the input section (100A, 200A, 300B, 500B) described below, and an output device 106 that controls the output section (100D, 200C, 300H, 500D) described below.

[0058] The communication device 108 is a network interface device that controls communication with other devices via the network 600 in accordance with a predetermined protocol.

[0059] The input device 105 is any of various input interface devices that receive input from a user, such as a keyboard, a mouse, or a touch screen.

[0060] The output device 106 is, for example, any of various display devices (not shown), such as a liquid crystal display or a touch screen, or any of various output interface devices, such as a speaker or a printer, that output the results of program execution in a format that can be recognized by the user.

[0061] As mentioned above, the processor 101, memory 102, storage 103, input device 105, output device 106, reading / writing device 107, and communication device 108 are connected by a bus 104, and data and programs are transmitted between them via the bus 104.

[0062] The registration device 100, the provision server 300, the analysis device 200, and the distribution server 500 that constitute the secret information processing system 1000 may be independent devices or may be built-in devices.

[0063] (Example of function block) Next, an example of blocks of various functions provided in each of the devices (100, 200, 300, 500) constituting the secret information processing system 1000 according to the first embodiment will be described with reference to Fig. 3. Note that each block described below does not represent a hardware-based configuration but represents a functional-based block.

[0064] FIG. 3 is a diagram showing an example of functional blocks of various devices (100, 200, 300, 500) constituting a secret information processing system 1000 according to the first embodiment (and a second embodiment described later).

[0065] The registration device 100 includes the following functional blocks: a memory unit (not shown), an input unit 100A, a control unit (not shown), a communication unit (not shown), and an output unit 100D. The input unit 100A mainly executes processes for accepting various input operations from the registered user 1 and for reading plaintext data PD and plaintext word PW. The control unit includes the functional blocks of a share generation unit 100B and an encryption unit 100C. The share generation unit 100B executes various processes for generating shares S (described in detail below). The encryption unit 100C executes processes for converting plaintext data PD into encrypted data ED and plaintext word PW into an encryption word EW using a designated key. The communication unit is responsible for communication processes with other devices, such as the provision server 300, the analysis machine 200, and the distribution server 500, via the network 600. The output unit 100D mainly executes processes for sending out encrypted data ED and encryption word EW.

[0066] The analysis device 200 includes the following functional blocks: a storage unit (not shown), an input unit 200A, a control unit (not shown), a communication unit (not shown), and an output unit 200C. The input unit 200A mainly executes processing to accept various input operations from the analysis user 2 and to read the plaintext query PQ. The control unit has an encryption unit 200B as a functional block. The encryption unit 200B executes processing to convert the plaintext query PQ into an encrypted query EQ using a specified key. The communication unit is responsible for communication processing with other devices, such as the registration device 100, the provision server 300, and the distribution server 500, via the network 600. The output unit 200C mainly executes processing to send out the encrypted query EQ.

[0067] The provision server 300 includes the following functional blocks: a memory unit (not shown), an input unit 300B, a control unit (not shown), a communication unit (not shown), and an output unit 300H. The memory unit stores at least a database 300A. The database 300A manages any number of tables. Each table is composed of a search index that manages the encryption passphrase EW and a data management table that manages the encrypted data ED. The input unit 300B mainly performs processing to accept various input operations from the server administrator 3 and to read the encrypted data ED, the encryption passphrase EW, and the encrypted query EQ. The control unit includes the following functional blocks: a registration unit 300C, a comparison unit 300D, a restoration unit 300E, a decryption unit 300F, and a processing unit 300G. The registration unit 300C performs processing to register the encryption passphrase EW and the encrypted data ED in the database 300A. The comparison unit 300D performs processing to compare the encryption passphrase EW with the encrypted query EQ. The restoration unit 300E executes a process to restore secret information from the share S. The decryption unit 300F executes a process to convert the encrypted data ED into plaintext data PD. The processing unit 300G executes a process to create data for output based on the plaintext data PD. The communication unit is responsible for communication processing with other devices such as the registration machine 100, the analysis machine 200, and the distribution server 500 via the network 600. The output unit 300H mainly executes a process to send out data for output.

[0068] The distribution server 500 includes the following functional blocks: a memory unit (not shown), an input unit 500B, a control unit (not shown), a communication unit (not shown), and an output unit 500D. The memory unit stores at least a database 500A. The database 500A manages keys. The input unit 500B mainly executes processes of accepting various input operations from the key manager 5, accepting commands such as distribution requests, and reading keys. The control unit includes a registration unit 500C as a functional block. The registration unit 500C executes processes of generating keys and registering sent keys in the database 500A. The communication unit is responsible for communication processes with other devices, such as the registration machine 100, the analysis machine 200, and the provision server 300, via the network 600. The output unit 500D mainly executes processes of sending keys from the database 500A.

[0069] That is, the registration device 100, analysis device 200, provision server 300 and distribution server 500 that constitute the confidential information processing system 1000 are each configured to have at least the following functional blocks: a control unit (not shown) realized mainly by the aforementioned processor 101, a memory unit (not shown) realized by the aforementioned memory devices (102, 103), a communication unit (not shown) realized by the aforementioned communication device 108, and a user interface unit (not shown) realized by the aforementioned input device 105 and output device 106.

[0070] The control unit executes various data processing operations based on the programs and data stored in the storage unit and the data acquired by the communication unit. The control unit also functions as an interface between the storage unit and the communication unit.

[0071] The control unit is configured using a processor 101, and can realize each of the above-mentioned functional blocks by executing the corresponding programs. Note that the control unit may be configured using a logic circuit such as an FPGA (Field-Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit) instead of the processor 101. The control unit may also be configured by combining the processor 101 and a logic circuit.

[0072] The memory unit is configured using a storage device consisting of, for example, memory 102 and storage 103, and stores a program that supplies various processing commands to the control unit, and data representing various information used in the processing executed by the control unit.

[0073] As described above, the storage units of the provision server 300 and the distribution server 500 store at least the corresponding databases (300A, 500A), respectively.

[0074] The control units of the provision server 300 and the distribution server 500 can execute various processes by reading and writing data representing various information managed by the databases (300A, 500A) in the storage units.

[0075] As described above, the communication unit is responsible for communication processing with other devices via the network 600. The communication unit is configured using, for example, a NIC (Network Interface Card) or an HBA (Host Bus Adapter).

[0076] The user interface unit includes the functional blocks of input units (100A, 200A, 300B, 500B) and output units (100D, 200C, 300H, 500D).

[0077] The input units (100A, 200A, 300B, 500B) are responsible for input-related processing, such as accepting input operations from the user, among other processes related to the user interface. The input units (100A, 200A, 300B, 500B) are configured using input devices 105, such as a keyboard, mouse, touch screen, etc., and detect various operations by the user.

[0078] The output units (100D, 200C, 300H, 500D) are responsible for output-related processes such as displaying various screens on a display device and outputting audio, among other processes related to the user interface. The output units (100D, 200C, 300H, 500D) are configured using various display devices, such as a liquid crystal display or a touch screen.

[0079] Note that, for example, when remotely logging in to the device (100, 200, 300, 500) from another external device, when receiving input information from an external device via a communication unit, or when providing output information to an external device, the inclusion of the input unit (100A, 200A, 300B, 500B) and / or the output unit (100D, 200C, 300H, 500D) is not essential. In this case, the device (100, 200, 300, 500) may have a web server function and receive access from an external device using a predetermined protocol.

[0080] That is, each component of the secret information processing system 1000, including the registration device 100, the analysis device 200, the provision server 300, and the distribution server 500, is realized by hardware including a processor 101, storage devices such as a memory 102 and a storage 103, a bus 104 that connects them, and interface devices (105, 106, 107, 108), and software stored in the storage devices (102, 103) that supplies processing instructions to the arithmetic unit (processor 101).

[0081] The above description of the functions of the registration device 100, the analysis device 200, the provision server 300, and the distribution server 500 that constitute the secret information processing system 1000 has been given assuming that each function of the devices (100, 200, 300, 500) is integrally realized by a single computer. However, each of these functions may be realized by multiple computers and / or servers connected to each other. Furthermore, the devices (100, 200, 300, 500) may be configured to include a general-purpose computer such as a laptop PC with a web browser installed thereon, or may be configured to include a web server or various portable devices.

[0082] The registration device 100, the analysis device 200, the provision server 300, and the distribution server 500 that constitute the secret information processing system 1000 are computer systems that are configured on a single physical computer or on multiple logically or physically configured computers, and may operate on a virtual computer constructed on multiple physical computer resources. For example, each of the above functional units may operate on a separate physical or logical computer, or multiple units may be combined to operate on a single physical or logical computer.

[0083] Furthermore, the above description of each function is merely an example, and multiple functions may be combined into one function, or one function may be divided into multiple functions.

[0084] Furthermore, the registration device 100, the analysis device 200, the provision server 300, and the distribution server 500 constituting the secret information processing system 1000 may each have other functions in addition to the above-mentioned functions. For example, each of the devices (100, 200, 300, 500) may be configured to include some of the various functions of the other devices, as described above.

[0085] In the secret information processing system 1000, the distribution server 500 generates a key generation key KK, a word key WK, and a query key QK in accordance with predetermined security parameters and registers them in a database 500A. The distribution server 500 then distributes the key generation key KK and word key WK to the registration device 100 and the query key QK to the analysis device 200, and the registration device 100 and the analysis device 200 complement these keys.

[0086] The registration device 100 or the user device may generate the key on behalf of the user and pass the key to the distribution server 500 .

[0087] Furthermore, the distribution server 500 may not have the database 500A, and may instead generate and distribute a key in response to each request for a key each time the request is received.

[0088] <System operation example> Next, the process after the distribution server 500 has distributed the keys to the registration device 100 and the analysis device 200 will be described.

[0089] FIG. 4 is a sequence diagram showing an example of the overall flow of processing executed in the secret information processing system 1000 according to the first embodiment (and the second embodiment described later).

[0090] As shown in FIG. 4, the processing executed by the secret information processing system 1000 is roughly composed of a registration phase and a search phase.

[0091] In the registration phase of step S410, the registration device 100 converts plaintext into ciphertext and requests the provision server 300 to register the ciphertext (step S411). The provision server 300 registers the ciphertext in the database 300A (step S412) and returns the registration result to the registration device 100 (step S413). The registration device 100 acquires this (step S414).

[0092] In the search phase of step S420, the analyzer 200 converts plaintext into ciphertext and requests a search from the provision server 300 (step S421). The provision server 300 searches the database 300A (step S422), processes the search results, and returns them to the analyzer 200 (step S423). The analyzer 200 acquires them (step S424).

[0093] The registration phase of step S410 and the search phase of step S420 are repeated as many times as necessary.

[0094] FIG. 5A shows a medical treatment table consisting of attributes such as name, treatment date and time, medical institution, name of illness or injury, and medical procedure as an example of a table in the database 300A managed by the provider server 300. The name in the medical treatment table is managed as a search index, and other attributes are managed in a data management table. Each element of the medical treatment table, except for the attributes, is encrypted and is indistinguishable from a random number. For reference, FIG. 5B shows the medical treatment table before encryption.

[0095] (Example of operation of registration device 100) 6 and 7 show a procedure in which the registration device 100 registers a pair of plaintext word PW and plaintext data PD in the registration phase of the secret information processing system 1000.

[0096] In step S600, the control unit of registration device 100 executes a process to specify the table to which registration is to be made via input unit 100A. This specifies the table to which registration is to be made. When the process in step S600 is completed, the control unit of registration device 100 proceeds to step S610.

[0097] In step S610, the control unit of the registration device 100 executes a process of reading the plaintext data PD and the plaintext word PW from the table specified in step S600 via the input unit 100A. As a result, the plaintext data PD and the plaintext word PW are read from the table. When the process in step S610 is completed, the control unit of the registration device 100 proceeds to step S620.

[0098] In step S620, the control unit of the registration device 100 causes the share generation unit 100B to input the plaintext word PW and the key generation key KK to the following function F, and executes processing to generate a polynomial key PK and a data key DK.

[0099] F (PW, KK) → PK, DK

[0100] Function F generates the same output value from the same input value. Therefore, as long as the same key generation key KK is input, the same values ​​of polynomial key PK and data key DK will be obtained from the same plaintext word PW. Furthermore, the output of function G is a pseudo-random number that is indistinguishable from a random number. Therefore, it is impossible to guess the plaintext word PW input to function F from PK and DK. Note that function F that satisfies this property can be designed using, for example, a cryptographic hash function. A typical cryptographic hash function known is SHA2, as shown below. SHA2 Reference: NIST FIPS PUB 180-4, Secure Hash Standard (SHS) https: / / nvlpubs.nist.gov / nistpubs / FIPS / NIST.FIPS.180-4.pdf

[0101] As a result, a polynomial key PK and a data key DK are generated. Upon completion of the process in step S620, the control unit of the registration device 100 proceeds to step S630.

[0102] In step S630, the control unit of the registration device 100 executes a process in which the encryption unit 100C receives the data key DK and converts the plaintext data PD into encrypted data ED. At this time, a common key cipher is used for encryption. As a result, the plaintext data PD is converted into encrypted data ED. When the process in step S630 is completed, the control unit of the registration device 100 proceeds to step S640.

[0103] In step S640, the control unit of the registration device 100 inputs the polynomial key PK and the threshold value t into the following function G by the share generation unit 100B, and executes a process of generating t random number sequences r1, r2, ... rt.

[0104] G(PK, t) → r1, r2 · · · rt

[0105] This random number sequence r1, r2...rt depends on PK and threshold value t. Therefore, as long as the same value of key generation key KK is input, the same random number sequence r1, r2...rt can be generated from the same plaintext word PW. In this way, t random number sequences r1, r2...rt are generated. When the processing in step S640 is completed, the control unit of the registration device 100 proceeds to step S650.

[0106] In step S650, the control unit of the registration device 100 executes a process to generate the following t-dimensional polynomial P(x) by the share generation unit 100B, where the data key DK is a constant, the coefficient of the i-th degree variable x is a random number ri, and the modulus (divisor) is an integer z.

[0107] P(x)=DK+r1 x+r2 x2+...+rt xt(mod z)

[0108] As a result, the t-th order polynomial P(x) is generated. After completing the process in step S650, the control unit of the registration device 100 proceeds to step S660.

[0109] In step S660, the control unit of the registration device 100 causes the share generation unit 100B to generate a random number u, input the random number u into the variable x of the t-dimensional polynomial P(x), and execute a process of setting the output value as the share S.

[0110] S=P(u)

[0111] This generates a share S. Note that this share S depends on the random number u. Therefore, even if the polynomial P is the same, if the random number space is sufficiently wide, a different value will be output each time. Therefore, even if the plaintext word PW has the same value, a different share S will be generated in step S660. When the control unit of the registration device 100 completes the processing in step S660, it proceeds to step S670.

[0112] In step S670, the control unit of the registration device 100 executes a process in which the encryption unit 100C converts the plaintext word PW and the share S using the word key WK to obtain the encrypted word EW. At this time, searchable encryption is used for encryption. Therefore, the encrypted word EW and the encrypted query EQ can be compared to determine whether the plaintext word PW and the plaintext query PQ are identical in the encrypted state. This results in the encrypted word EW. When the control unit of the registration device 100 completes the process in step S670, it proceeds to step S680.

[0113] In step S680, the control unit of the registration device 100 executes a process of sending the encrypted password EW, the encrypted data ED, and information specifying the registration table as output data via the output unit 100D. This causes the information to be sent as output data. When the process in step S680 is completed, the control unit of the registration device 100 ends the process shown in the flowchart of FIG.

[0114] The above process is a procedure for registering one pair of plaintext word PW and plaintext data PD in the registration device 100. Any number of plaintext data PD and plaintext word PW can be registered by the same process. When registering multiple plaintext data PD and plaintext word PW, the process of specifying the table in step S600 may be performed only once, or multiple encrypted word EW and encrypted data ED may be output together in step S680 instead of being output sequentially.

[0115] The above-described processing procedure is an example, and the processing order and processing contents may be changed as necessary.

[0116] In addition, in the encryption, other encryption methods such as public key encryption or searchable encryption may be used instead of common key encryption.

[0117] Through the above-described processing, the encrypted password EW and encrypted data ED transmitted by the output unit 100D of the registration device 100 are received by the input unit 300B of the provision server 300 via the network 600 (step S411). The registration unit 300C of the provision server 300 registers the encrypted password EW in the search index of the specified table in the database 300A and the encrypted data ED in the data management table (step S412). The output unit 300H of the provision server 300 sends the registration result via the network 600 (step S413), and the input unit 100A of the registration device 100 receives the registration result (step S414).

[0118] (Example of operation of analyzer 200) FIG. 8 shows a procedure in which the analyzer 200 requests a search for one plaintext query PQ in the search phase of the secret information processing system 1000.

[0119] In step S800, the control unit of analyzer 200 executes a process for specifying a table to be searched via input unit 200A. This specifies the table to be searched. When the process in step S800 is completed, the control unit of analyzer 200 proceeds to step S810.

[0120] In step S810, the control unit of the analyzer 200 executes a process of reading the plaintext query PQ via the input unit 200A. As a result, the plaintext query PQ is read in. When the process in step S810 is completed, the control unit of the analyzer 200 proceeds to step S820.

[0121] In step S820, the control unit of the analyzer 200 executes a process in which the encryption unit 200B receives the query key QK and the plaintext query PQ as input and generates the encrypted query EQ. Here, searchable encryption is used for encryption. In this way, the encrypted query EQ is generated. When the process in step S820 is completed, the control unit of the analyzer 200 proceeds to step S830.

[0122] In step S830, the control unit of the analyzer 200 executes a process of sending, via the output unit 200C, information specifying the encrypted query EQ and the comparison table as output data. This causes the information to be sent as output data. Upon completing the process in step S830, the control unit of the analyzer 200 ends the process shown in the flowchart of FIG. 8.

[0123] The above-described processing procedure is an example, and the processing order and processing contents may be changed as necessary. There is no limit to the number of tables, and multiple tables may be specified.

[0124] In addition, in the encryption, instead of searchable encryption, other encryption methods that allow calculations to be performed in the encrypted state, such as functional encryption or homomorphic encryption, may be used.

[0125] (Example of operation of provision server 300) 9 and 10 show the procedure in the search phase of the secret information processing system 1000, from when the provision server 300 is requested by the analyzer 200 to search for one encrypted query EQ to when the provision server 300 sends out the data for output.

[0126] In step S900, the control unit of the provision server 300 executes a process of receiving the encrypted query EQ and information specifying a table via the input unit 300B. This acquires the information. When the process in step S900 is completed, the control unit of the provision server 300 proceeds to step S910.

[0127] In step S910, the control unit of the provision server 300 executes a process to select a table to search in accordance with the specified information. As a result, the table to search is selected. After completing the process in step S910, the control unit of the provision server 300 proceeds to step S920.

[0128] In step S920, the control unit of the provision server 300 executes a process of reading a search index from the selected table via the input unit 300B. As a result, the search index is read. When the process in step S920 is completed, the control unit of the provision server 300 proceeds to step S930.

[0129] In step S930, the control unit of the provision server 300 executes a process of determining whether or not there are any encrypted phrases EW that have not yet been compared in the search index read in step S920. If it is determined in step S930 that all of the encrypted phrases EW in the search index have been compared and there are no encrypted phrases EW that have not yet been compared (step S930: YES), the process proceeds to step S960. On the other hand, if it is determined in step S930 that there are any encrypted phrases EW that have not yet been compared in the search index (step S930: NO), the process proceeds to step S940.

[0130] In step S940, the control unit of the provision server 300 executes a process of reading, from the search index, encrypted passwords EW that have not yet been read, via the input unit 300B. As a result, encrypted passwords EW that have not yet been read are read from the search index. When the process in step S940 is completed, the control unit of the provision server 300 proceeds to step S950.

[0131] In step S950, the control unit of the provision server 300 causes the comparison unit 300D to execute a process of comparing the encrypted query EQ and the encryption passphrase EW using the searchable encryption comparison function. If the comparison results in a match, the embedded share S is decrypted. As a result, the encrypted query EQ and the encryption passphrase EW are compared, and if the comparison results in a match, the embedded share S is decrypted. After completing the process in step S950, the control unit of the provision server 300 proceeds to step S960.

[0132] In step S960, the control unit of the provision server 300 executes a process in which the restoration unit 300E determines whether or not t or more shares S have been collected. If it is determined in step S960 that t or more shares S have been collected (step S960: YES), the process proceeds to step S970. On the other hand, if it is determined in step S960 that t or more shares S have not been collected (step S960: NO), the process shown in the flowchart in FIG. 9 ends.

[0133] In step S970, the control unit of the provision server 300 causes the restoration unit 300E to execute processing to restore the data key DK using the t shares S as input. As a result, the data key DK is restored. When the processing in step S970 is completed, the control unit of the provision server 300 proceeds to step S980.

[0134] In step S980, the control unit of the provision server 300 executes a process of reading, via the input unit 300B, all of the encrypted data ED related to the encrypted password EW determined to match the comparison result. As a result, all of the encrypted data ED is read. When the process of step S980 is completed, the control unit of the provision server 300 proceeds to step S990.

[0135] In step S990, the control unit of the provision server 300 executes a process of decrypting all of the read encrypted data ED into plaintext data PD using the data key DK by the decryption unit 300F. As a result, all of the encrypted data ED is decrypted into plaintext data PD. When the process in step S990 is completed, the control unit of the provision server 300 proceeds to step S1000.

[0136] In step S1000, the control unit of the provision server 300 causes the processing unit 300G to perform arbitrary information processing based on the plaintext data PD decrypted in step S990, and executes processing to create data for output. As an example of information processing, the processing unit 300G may calculate statistics of the plaintext data PD and create data for output. Alternatively, for example, the processing unit 300G may analyze the plaintext data PD using machine learning and create data for output. Alternatively, for example, the processing unit 300G may create an AI model that has learned from the plaintext data PD and use the AI ​​model as data for output. Alternatively, for example, the processing unit 300G may perform conversion such as formatting or anonymization on the plaintext data PD to create data for output. In this way, data for output is created. Upon completing the processing in step S1000, the control unit of the provision server 300 proceeds to step S1010.

[0137] In step S1010, the control unit of the provision server 300 executes a process of sending out the output data created in step S1000 via the output unit 300H. As a result, the output data is sent out. Upon completing the process in step S1010, the control unit of the provision server 300 ends the process shown in the flowchart of FIG.

[0138] The above processing is a procedure for comparing one encrypted query EQ in the provision server 300 with the encrypted phrase EW in the search index. Note that the same processing can be used when comparing with some of the encrypted phrases EW in the search index. Also, the encrypted query EQ and the encrypted phrase EW may be compared across multiple search indexes. Also, the same processing can be used when comparing any number of encrypted queries EQ and encrypted phrases EW.

[0139] The above-described processing procedure is an example, and the processing order and processing contents may be changed as necessary.

[0140] Furthermore, in decryption, other encryption methods such as public key encryption or searchable encryption may be used instead of common key encryption.

[0141] Through the above-described process, the encrypted query EQ sent by the output unit 200C of the analyzer 200 as a search request (step S421) is received by the input unit 300B of the provision server 300 via the network 600. The comparison unit 300D of the provision server 300 compares the encrypted query EQ with the encrypted password EW in the search index of the specified table in the database 300A, and the decryption unit 300F of the provision server 300 decrypts the shares S based on the comparison result. The restoration unit 300E of the provision server 300 collects the decrypted shares S and restores the data key DK, and the decryption unit 300F of the provision server 300 uses the data key DK to decrypt the read encrypted data ED into plaintext data PD (step S422). The provision server 300 processes the plaintext data PD and sends it as output data via the network 600 (step S423), and the input unit 200A of the analysis device 200 receives the output data (step S424).

[0142] As described above, in the confidential information processing system 1000 according to the first embodiment, management of the encrypted search index and the data management table is entrusted to a third party organization such as a cloud service represented by the provision server 300, and as long as there are search hits equal to or greater than the number determined by the threshold value on the provision server 300, the related encrypted data ED can be decrypted into plaintext data PD and any processing can be performed. If there are no search hits, for example, if the number of hits does not reach the threshold value, the encrypted data ED on the provision server 300 is not decrypted, and its confidentiality is maintained.

[0143] In the secret information processing system 1000 according to the first embodiment, the registration device 100 may anonymize the plaintext data PD in advance, convert it into encrypted data ED, and register it in the provision server 300. For example, if the plaintext data PD is an individual's date of birth, the anonymization may involve deleting the date and encrypting only the year of birth. When a search hits more than the number determined by a threshold on the provision server 300 and the related encrypted data ED is decrypted, only the year of birth is disclosed to the provision server 300. Because only the year of birth is disclosed, the risk of identifying an individual is lower than when the date of birth is used.

[0144] In the secret information processing system 1000 according to the first embodiment, the registration device 100 may anonymize the plaintext data PD in advance using multiple methods, convert the plaintext data PD and the plaintext data PD into encrypted data ED, and register the encrypted data ED in the provision server 300. As an example, consider the secret information processing system 1000 in which an individual's birthday is registered in the provision server 300. When an individual's date of birth is registered as the plaintext data PD, anonymization is performed to remove the day and extract the date and month of birth, and anonymization is performed to remove the month and month and extract only the year of birth, and the plaintext data PD, which is the date of birth, is converted into encrypted data ED. The plaintext data PD from which the date of birth is registered as is is highly sensitive, so a high threshold value such as "10" is set. The anonymized data from which the date and month of birth has been extracted is less sensitive than the plaintext data PD, so a medium threshold value such as "5" is set. The anonymized data from which the year of birth has been extracted is the least sensitive, so a low threshold value such as "3" is set. Because the threshold values ​​are different for each data, appropriate data can be disclosed depending on the number of search hits on the provision server 300. For example, if 10 or more search results are found, the date of birth will be disclosed, but if only 3 search results are found, only the year of birth will be disclosed.

[0145] In the secret information processing system 1000 according to the first embodiment, the registration device 100 may convert the plaintext data PD in advance into intermediate encrypted data using an encryption method that allows only specific operations, and then further convert this intermediate encrypted data and register it as final encrypted data in the provision server 300. When a search result equal to or greater than the number determined by a threshold is found on the provision server 300 and the related final encrypted data is decrypted, the intermediate encrypted data is disclosed instead of the raw plaintext data PD, so that the specific operation can be processed on the provision server 300 without disclosing the raw data on the provision server 300.

[0146] In the secret information processing system 1000 according to the first embodiment, the registration device 100 may convert the plaintext data PD into anonymized data, and the plaintext data PD into encrypted data ED, and register the anonymized data and the encrypted data ED in the provision server 300. By setting a threshold for each anonymization and encryption method, it is possible to disclose appropriate anonymized data and encrypted data ED according to the number of search hits on the provision server 300.

[0147] The secret information processing system 1000 according to the first embodiment has been described above. [Example]

[0148] Next, a secret information processing system 1000 according to a second embodiment will be described, focusing on the differences from the secret information processing system 1000 according to the first embodiment.

[0149] In the secret information processing system 1000 according to the second embodiment, management of ciphertexts is entrusted to a third party organization such as a cloud service, and multiple tables are searched on a server operated by the third party organization. Only when a certain number of searches or more hits are found in all or some of the tables, related plaintext is disclosed, and any information processing across multiple tables, including name matching processing, can be performed. Furthermore, when the number of hits is less than a certain number, the information remains encrypted and is not disclosed, and the confidentiality of the ciphertext is maintained.

[0150] The technology provided by Example 2 is effective, for example, in providing a medical collaboration service using data related to a patient's medical history and level of nursing care required. Electronic medical records, which record a patient's medical history and are individually managed by a hospital, and nursing care receipts, which are managed by the National Federation of National Health Insurance Organizations, can be securely and centrally managed on the cloud, enabling a service to recommend an application for a level of nursing care required based on the severity of the patient's illness or injury. Furthermore, a service can be provided that designs rehabilitation programs for patients, taking into account both the symptoms of the illness or injury and the level of nursing care required. Furthermore, encrypted data ED, which is registered in only one of the electronic medical records or nursing care receipts, cannot be decrypted, maintaining its confidentiality.

[0151] The configuration of the secret information processing system 1000 according to the second embodiment is the same as that of the secret information processing system 1000 according to the first embodiment. In addition, the hardware configurations and functional block configurations of the registration device 100, the provision server 300, the analysis device 200, and the distribution server 500 constituting the secret information processing system 1000 according to the second embodiment are also the same as those of these devices (100, 300, 200, 500) constituting the secret information processing system 1000 according to the first embodiment.

[0152] The processing procedure of the secret information processing system 1000 according to the second embodiment is composed of a registration phase and a search phase, similar to that of the first embodiment, except that the database 300A managed by the provision server 300 is composed of one or more tables.

[0153] 11A and 11B show examples of tables in the database 300A managed by the provider server 300. The examples include a medical treatment table consisting of attributes such as the Individual Number, consultation date and time, medical institution, name of illness or injury, and medical procedure, and a nursing care table consisting of the Individual Number, national health insurance number, nursing care insured person number, level of nursing care required, and date of nursing care qualification acquisition. The Individual Number is an attribute common to both the medical treatment table and the nursing care table, and is managed as a search index for both tables. Other attributes are managed as data management tables for the respective tables.

[0154] The distribution server 500 in the second embodiment generates a key generation key KK, a word key WK, and a query key QK in accordance with predetermined security parameters, as in the first embodiment, and registers them in the database 500A. Thereafter, the distribution server 500 distributes the key generation key KK and the word key WK to the registration device 100 and the query key QK to the analysis device 200, and the registration device 100 and the analysis device 200 complement these keys.

[0155] The registration device 100 or the user device may generate the key on behalf of the registration device 100 or the user device and pass the key to the distribution server 500. Alternatively, the distribution server 500 may generate and distribute the key each time it receives a key request, and may not have the database 500A. The following describes the processing that occurs after the distribution server 500 has distributed the keys to the registration device 100 and the analysis device 200.

[0156] The processing of the registration phase according to the second embodiment is the same as that of the first embodiment, and therefore the description thereof will be omitted.

[0157] In the search phase of the secret information processing system 1000 according to the second embodiment, the procedure in which the analyzer 200 requests a search for one plaintext query PQ is almost the same as that in the first embodiment.

[0158] In step S800, the control unit of analyzer 200 executes a process of specifying multiple tables to be searched from a database (not shown) via input unit 200A. As a result, multiple tables to be searched are specified from the database. When the process in step S800 is completed, the control unit of analyzer 200 proceeds to step S810.

[0159] In step S810, the control unit of the analyzer 200 executes a process of reading the plaintext query PQ via the input unit 200A. As a result, the plaintext query PQ is read in. When the process in step S810 is completed, the control unit of the analyzer 200 proceeds to step S820.

[0160] In step S820, the control unit of the analyzer 200 executes a process in which the encryption unit 200B receives the query key QK and the plaintext query PQ as input and generates the encrypted query EQ. Here, searchable encryption is used for encryption. In this way, the encrypted query EQ is generated. When the process in step S820 is completed, the control unit of the analyzer 200 proceeds to step S830.

[0161] In step S830, the control unit of the analyzer 200 executes a process of sending, via the output unit 200C, information specifying the encrypted query EQ and multiple tables to be searched as output data. This causes the information to be sent as output data. Upon completing the process in step S830, the control unit of the analyzer 200 ends the process shown in the flowchart of FIG. 8.

[0162] The above-described processing procedure is an example, and the processing order and processing contents may be changed as necessary. There is no limit to the number of tables, and one table may be specified.

[0163] In addition, in the encryption, instead of searchable encryption, other encryption methods that allow calculations to be performed in the encrypted state, such as functional encryption or homomorphic encryption, may be used.

[0164] FIG. 12 shows the procedure in the search phase of the secret information processing system 1000, in which the provision server 300 compares one encrypted query EQ with search indexes in multiple specified tables and sends out output data.

[0165] In step S1120, the provision server 300 performs the processes of steps S900 to S950 in the first embodiment. That is, in step S900, the input unit 300B of the provision server 300 receives the encrypted query EQ and information specifying a table. In step S910, the input unit 300B of the provision server 300 selects a table to search according to the specified information. In step S920, the input unit 300B of the provision server 300 reads a search index from the selected table. In step S930, the input unit 300B of the provision server 300 checks whether there is an encrypted passphrase EW that has not yet been compared from the search index. If there is not, the process proceeds to step S1130. In step S940, the input unit 300B of the provision server 300 reads an encrypted passphrase EW that has not yet been read from the search index. In step S950, the comparison unit 300D of the provision server 300 uses the function of comparing searchable encryption to compare the encrypted query EQ and the encrypted passphrase EW. If the comparison results in a match, the embedded share S is decrypted.

[0166] In step S1130, the processing unit 300G of the provision server 300 checks whether there are any tables that have not been searched based on the information specifying the tables. If there are any tables, the process returns to step S1120.

[0167] In step S1140, the provision server 300 performs the processes of steps S960 to S1010 in the first embodiment. That is, in step S960, the provision server 300 checks whether t or more shares S have been collected, and if not, ends the process. In step S970, if t or more shares S have been collected, the data key DK is restored. In step S980, all encrypted data ED associated with the encryption passphrase EW determined to match as a result of the comparison is read. In step S990, the read encrypted data ED is decrypted into plaintext data PD using the data key DK. In step S1000, any information processing is performed based on the decrypted plaintext data PD to create and send output data. As information processing, for example, statistics of the plaintext data PD may be calculated to create output data. Alternatively, the plaintext data PD may be analyzed using machine learning to create output data. Furthermore, an AI model trained on the plaintext data PD may be created, and the AI ​​model may be used as output data. Furthermore, the plaintext data PD may be subjected to conversion such as formatting and anonymization to generate output data. In step S1010, the output data is sent out.

[0168] The procedure in which the provision server 300 compares one encrypted query EQ with search indexes in multiple specified tables and sends out output data is shown.

[0169] 13 illustrates an example of a processing procedure in which the provision server 300 compares one encrypted query EQ with the search indexes of the medical treatment table and the nursing care table and decrypts the plaintext data PD in the search phase of the secret information processing system 1000. Here, the threshold value t is set to "2."

[0170] Assume that in steps S910 to S950, the provision server 300 compares the encrypted query EQ with the search indexes of the medical examination table and the nursing care table, and finds one hit for each. Because the provision server 300 obtains two shares S, in step S960 it determines that it has obtained shares S equal to or greater than the threshold. In step S970, the provision server 300 restores the data key DK from the two shares S. In step S980, the provision server 300 reads the encrypted data ED in the same row as the encryption passphrase EW that the comparison results determine to be a match. In step S990, the provision server 300 restores the encrypted data ED using the data key DK to obtain plaintext data PD1 and plaintext data PD2. In step S1000, arbitrary information processing is performed on the plaintext data PD1 and plaintext data PD2. For example, both plaintext data (PD1, PD2) may be combined, trained by an AI together with the encrypted query EQ, and an AI model may be output. In this combining, the encrypted query EQ or the encrypted password EW may be included in the combined result as a common key, or other information may be used. In addition to matching, for example, statistics of the combined plaintext data PD may be calculated and output. In step S1010, the provision server 300 sends out data for output.

[0171] As described above, in the secret information processing system 1000 according to the second embodiment, management of a plurality of encrypted tables is entrusted to a third party organization such as a cloud service represented by the provision server 300, and each table is searched on the provision server 300. If the number of hits in the search for each table is equal to or greater than a threshold value, the related encrypted data ED is decrypted into plaintext data PD, thereby enabling information processing across a plurality of tables. Furthermore, if the number of hits in the search for each table is less than the threshold value, the encrypted data ED, which is difficult to process across a plurality of tables, is not decrypted, and its confidentiality is maintained.

[0172] In the secret information processing system 1000 according to the second embodiment, the management of a plurality of tables may be entrusted to the provision server 300, and a search may be performed on each table on the provision server 300. A threshold value may be set for each table, and the share S may be restored as long as a search result equal to or greater than the threshold value set for each table is found. This allows different threshold values ​​to be set for each table when the sensitivity of each table is different.

[0173] The secret information processing system 1000 according to the second embodiment has been described above. [Example]

[0174] Next, a secret information processing system 1000 according to a third embodiment will be described, focusing on the differences from the secret information processing system 1000 according to the first and / or second embodiment.

[0175] In the secret information processing system 1000 according to the third embodiment, while entrusting the management of ciphertexts to a third party organization such as a cloud service, a search for the ciphertexts can be requested via a proxy server operated by another external organization. Only when a certain number of search hits are found on the server operated by the third party organization, the information is disclosed in plaintext on the proxy server, allowing any information processing to be performed. Furthermore, when the number of hits is less than the certain number, the information remains encrypted and is not disclosed, thereby maintaining its confidentiality.

[0176] The technology provided by Example 3 assumes that tables are not centrally managed, and each table is managed by a different organization or under a different policy. For example, suppose that a hospital independently manages electronic medical records recording patients' medical history, and the National Federation of National Health Insurance Organizations independently manages nursing care receipts. In this case, a proxy server can handle inquiries to each organization and provide a medical collaboration service using data related to the patient's medical history and level of nursing care required. Ciphertexts corresponding to the search are aggregated on the proxy server, but if the search results after aggregation are found to be below a certain number, the information remains encrypted on the proxy server and is not disclosed, maintaining its confidentiality.

[0177] 14 shows an example of the configuration of a secret information processing system 1000 according to Example 3. The secret information processing system 1000 according to Example 3 includes at least a registration device 100 operated by a registered user 1 at a registration business 10, a provision server 300 operated by a server manager 3 as a service business 30, an analysis device 200 operated by an analysis user 2 at an analysis business 20, and a DB server 400 operated by a DB manager 4 as a DB management business 40, and preferably includes a distribution server 500 operated by a key manager 5 at a key management authority 50.

[0178] In the following description of Example 3, the registered businesses 10a, 10b, 10c,..., 10n will be referred to collectively as "registered businesses 10" when referring to them collectively or when no distinction is made between them. Similarly, the registered users 1a, 1b, 1c,..., 1n will be referred to collectively as "registered users 1" when referring to them collectively or when no distinction is made between them. Similarly, the registered devices 100a, 100b, 100c,..., 100n will be referred to collectively as "registered devices 100" when referring to them collectively or when no distinction is made between them. Similarly, the analysis businesses 20a, 20b, 20c,..., 20n will be referred to collectively or when no distinction is made between them. Similarly, the analysis users 2a, 2b, 2c,..., 2n will be referred to collectively or when no distinction is made between them. Similarly, when referring to the analyzers 200a, 200b, 200c...200n collectively or when no distinction is made, they are collectively referred to as "analyzers 200." Similarly, when referring to the DB management providers 40a, 40b, 40c...40n collectively or when no distinction is made, they are collectively referred to as "DB management providers 40." Similarly, when referring to the DB administrators 4a, 4b, 4c...4n collectively or when no distinction is made, they are collectively referred to as "DB administrators 4." Similarly, when referring to the DB servers 400a, 400b, 400c...400n collectively or when no distinction is made, they are collectively referred to as "DB servers 400."

[0179] The registration device 100, the provision server 300, the analysis device 200, the distribution server 500, and the DB server 400 are connected to each other via a network 600 so as to be able to communicate data with each other.

[0180] The hardware configurations of the registration device 100, the provision server 300, the analysis device 200, the distribution server 500, and the DB server 400 in the third embodiment are the same as those in the first embodiment. The registration device 100, the provision server 300, the analysis device 200, the distribution server 500, and the DB server 400 are, for example, computers, and are all configured with substantially the same hardware as those of these devices (100, 300, 200, 500) in the first and second embodiments.

[0181] FIG. 15 illustrates an example of functional blocks of a secret information processing system 1000 according to the third embodiment.

[0182] The functional block configurations of the registration device 100, the analysis device 200, and the distribution server 500 in the third embodiment are the same as those in the first and second embodiments.

[0183] The provision server 300 in the third embodiment includes the following functional blocks: a memory unit (not shown), an input unit 300B, a control unit (not shown), a communication unit (not shown), and an output unit 300H. The memory unit stores at least a database 300A. The database 300A manages ciphertexts in a table. The input unit 300B mainly performs processing to accept various input operations from the server administrator 3 and to read encrypted data ED, an encrypted password EW, an encrypted query EQ, and temporary output data. The control unit includes the following functional blocks: a restoration unit 300E, a decryption unit 300F, and a processing unit 300G. The restoration unit 300E performs processing to restore secret information from the secret sharing shares S. The decryption unit 300F performs processing to restore the encrypted data ED to plaintext data PD. The processing unit 300G performs processing to create data for final output based on the plaintext data PD. The communication unit is responsible for communication processing with other devices such as the registration machine 100, the analysis machine 200, the DB server 400, and the distribution server 500 via the network 600. The output unit 300H mainly executes processing to send out the final output data, the encrypted data ED, the encrypted password EW, and the encrypted query EQ.

[0184] The DB server 400 in the third embodiment includes the following functional blocks: a storage unit (not shown), an input unit 400B, a control unit (not shown), a communication unit (not shown), and an output unit 400E. The storage unit stores at least a database 400A. The database 400A manages ciphertexts in tables. Each table is composed of a search index that manages the encryption passphrase EW and a data management table that manages the encrypted data ED. The input unit 400B mainly executes a process of accepting various input operations from the DB administrator 4 and a process of reading the encrypted data ED, the encryption passphrase EW, and the encrypted query EQ. The control unit includes the functional blocks of a registration unit 400C and a comparison unit 400D. The registration unit 400C executes a process of registering the encryption passphrase EW and the encrypted data ED in the database 400A. The comparison unit 400D executes a process of comparing the encryption passphrase EW with the encrypted query EQ. The communication unit is responsible for communication processing with other devices such as the registration machine 100, the analysis machine 200, the provision server 300, and the distribution server 500 via the network 600. The output unit 400E mainly creates temporary output data based on the comparison results and sends it out.

[0185] The distribution server 500 in the third embodiment generates a key generation key KK, a word key WK, and a query key QK in accordance with predetermined security parameters, as in the first embodiment, and registers them in the database 500A. Thereafter, the distribution server 500 distributes the key generation key KK and the word key WK to the registration device 100 and the query key QK to the analysis device 200, and the registration device 100 and the analysis device 200 complement these keys.

[0186] The registration device 100 or the user device may generate the key on behalf of the registration device 100 or the user device and pass the key to the distribution server 500. Alternatively, the distribution server 500 may generate and distribute the key each time it receives a key request, and may not have the database 500A. The following describes the processing that occurs after the distribution server 500 has distributed the keys to the registration device 100 and the analysis device 200.

[0187] The processing procedure of the secret information processing system 1000 consists of a registration phase and a search phase, which is shown in FIG.

[0188] In the registration phase of step S1610, the registration device 100 converts plaintext into ciphertext and requests the DB server 400 to register the ciphertext (step S1611). The DB server 400 registers the ciphertext in the database 400A (step S1612) and returns the registration result (step S1613), which the registration device 100 receives (step S1614).

[0189] In the search phase of step S1620, the analyzer 200 converts plaintext into ciphertext and requests a search from the provision server 300 (step S1621). The provision server 300 re-requests a search from the DB server 400 (step S1622). The DB server 400 searches the database 400A in accordance with this re-request (step S1623) and sends the search results to the provision server 300 (step S1624). The provision server 300 processes the received search results and sends them to the analyzer 200 (step S1625), and the analyzer 200 acquires them (step S1626).

[0190] The registration phase of step S1610 and the search phase of step S1620 are repeated as many times as necessary.

[0191] In the registration phase of the secret information processing system 1000 according to the third embodiment, the DB server 400 takes charge of the processing of the provision server 300 in the registration phase according to the first embodiment. The contents of the processing performed by the registration device 100 and the DB server 400 are the same as those in the first embodiment, and therefore, the description thereof will be omitted.

[0192] In the search phase of the secret information processing system 1000 according to the third embodiment, the procedure in which the analyzer 200 requests a search for one plaintext query PQ is the same as that in the first embodiment, and therefore a description thereof will be omitted.

[0193] FIG. 17 shows the procedure in the search phase of the secret information processing system 1000, from when the provision server 300 is requested to search one encrypted query EQ to when it cooperates with the DB server 400 and sends out output data.

[0194] In step S1700, the control unit of the provision server 300 executes a process of receiving the encrypted query EQ and information specifying a table via the input unit 300B. This acquires the information. When the process in step S1700 is completed, the control unit of the provision server 300 proceeds to step S1710.

[0195] In step S1710, the control unit of the provision server 300 causes the processing unit 300G to execute processing to select the DB server 400 that holds the specified table. As a result, the DB server 400 that holds the specified table is selected. When the processing in step S1710 is completed, the control unit of the provision server 300 proceeds to step S1720.

[0196] In step S1720, the control unit of the provision server 300 executes processing to transmit the encrypted query EQ and information specifying the table to the DB server 400 selected in step S1710 via the output unit 300H. As a result, the encrypted query EQ and the information specifying the table are transmitted to the DB server 400. Upon completing the processing in step S1720, the control unit of the provision server 300 waits in step S1750 until it receives the share S and the encrypted data ED from the DB server 400.

[0197] In step S1730, the DB server 400 sequentially executes the processes of steps S900 to S950 in FIG. 9 that were performed by the provision server 300 in the first embodiment. That is, the control unit of the DB server 400 executes a process equivalent to step S900 in FIG. 9 to receive the encrypted query EQ and information specifying a table via the input unit 400B. This acquires the information. Next, the control unit of the DB server 400 executes a process equivalent to step S910 in FIG. 9 to select a table to search in accordance with the specified information. This selects the table to search. Next, the control unit of the DB server 400 executes a process equivalent to step S920 in FIG. 9 to read a search index from the selected table via the input unit 400B. This loads the search index. Next, the control unit of the DB server 400 executes a process equivalent to step S930 in FIG. 9 to determine whether or not there is an encrypted passphrase EW that has not yet been compared in the search index read in the process equivalent to step S920. If it is determined in this process that all encrypted phrases EW in the search index have been compared and that there are no encrypted phrases EW that have not yet been compared (step S930: YES), the process proceeds to step S1740. On the other hand, if it is determined in this process that there are encrypted phrases EW in the search index that have not yet been compared (step S930: NO), the process proceeds to a process equivalent to step S940. Next, the control unit of the DB server 400 executes a process equivalent to step S940 in FIG. 9 to read encrypted phrases EW that have not yet been read from the search index via the input unit 400B. This reads encrypted phrases EW that have not yet been read from the search index. Next, the control unit of the DB server 400 executes a process equivalent to step S950 in FIG. 9 to compare the encrypted query EQ with the encrypted phrase EW using the searchable encryption comparison function with the comparison unit 400D. If the comparison results in a match, the embedded share S is decrypted. This allows the encrypted query EQ to be compared with the encrypted word EW, and if the comparison results in a match, the embedded share S is decrypted.When the control unit of the DB server 400 completes this series of processes, the process proceeds to step S1740.

[0198] In step S1740, the control unit of the DB server 400 executes processing to send, via the output unit 400E, the share S and the encrypted data ED associated with the encrypted password EW that is determined to match as a result of the comparison to the provision server 300. As a result, the share S and the encrypted data ED are sent to the provision server 300. When the processing in step S1740 is completed, the processing performed by the DB server 400 among the processing shown in the flowchart of FIG. 17 ends.

[0199] In step S1750, the control unit of the provision server 300 executes a process of receiving, via the input unit 300B, the share S and the encrypted data ED sent by the DB server 400 in step S1740. As a result, the share S and the encrypted data ED are acquired. Upon completing the process in step S1750, the control unit of the provision server 300 proceeds to step S1760.

[0200] In step S1760, the provision server 300 sequentially executes the processes of steps S960 to S1010 of FIG. 9, which were performed in the first embodiment. That is, the control unit of the provision server 300 executes a process equivalent to step S960 of FIG. 9, in which the restoration unit 300E determines whether or not t or more shares S have been collected. If it is determined in this process that t or more shares S have been collected (step S960: YES), the process proceeds to a process equivalent to step S970. On the other hand, if it is determined in this process that t or more shares S have not been collected (step S960: NO), the process shown in the flowchart of FIG. 17 ends. Next, the control unit of the provision server 300 executes a process equivalent to step S970 of FIG. 9, in which the restoration unit 300E receives the t shares S as input and restores the data key DK. As a result, the data key DK is restored. Next, the control unit of the provision server 300 executes a process equivalent to step S980 of FIG. 9 , in which all encrypted data ED related to the encrypted password EW determined to match the comparison result is read via the input unit 300B. As a result, all of the encrypted data ED is read. When the process of step S980 is completed, the control unit of the provision server 300 proceeds to step S990. Next, as a process equivalent to step S990 of FIG. 9 , the control unit of the provision server 300 executes a process in which the decryption unit 300F uses the data key DK to decrypt all of the read encrypted data ED into plaintext data PD. As a result, all of the encrypted data ED is decrypted into plaintext data PD. Next, as a process equivalent to step S1000 of FIG. 9 , the control unit of the provision server 300 executes a process in which the processing unit 300G performs arbitrary information processing on the plaintext data PD decrypted by the process equivalent to step S990 to create data for output. As an example of information processing, the processing unit 300G may calculate statistics of the plaintext data PD and create output data. Furthermore, for example, the processing unit 300G may analyze the plaintext data PD using machine learning and create output data. Furthermore, for example, the processing unit 300G may create an AI model that has learned the plaintext data PD and use the AI ​​model as output data.Furthermore, for example, the processing unit 300G may perform conversion such as formatting or anonymization on the plaintext data PD to create data for output. In this way, the data for output is created. Next, the control unit of the provision server 300 executes a process equivalent to step S1010 in FIG. 9, via the output unit 300H, to send out the data for output created in a process equivalent to step S1000. In this way, the data for output is sent out. When the control unit of the provision server 300 completes the process equivalent to step S1010, it ends the process shown in the flowchart of FIG. 17.

[0201] The above processing is a procedure for comparing one encrypted query EQ in the provision server 300 with the encrypted phrase EW in the search index. Note that the same processing can be performed when comparing any number of encrypted queries EQ with the encrypted phrase EW.

[0202] The above-described processing procedure is an example, and the processing order and processing contents may be changed as necessary.

[0203] Furthermore, in decryption, other encryption methods such as public key encryption or searchable encryption may be used instead of common key encryption.

[0204] Through the above-described processing, the output unit 200C of the analyzer 200 sends the encrypted query EQ sent for the search request and information specifying the table (step S1621), which are received by the input unit 300B of the provision server 300 via the network 600. The provision server 300 re-requests a search to the DB server 400 that holds the specified table (step S1622), the comparison unit 400D of the DB server 400 compares the encrypted query EQ with the encrypted word EW in the search index of the specified table in the database 400A, and the decryption unit (not shown) of the DB server 400 decrypts the share S from the comparison result (step S1623). The output section 400E of the DB server 400 sends the encrypted data ED related to the share S and the encrypted password EW that was determined to match the comparison result to the provision server 300 as the search result (step S1624), and the provision server 300 processes the search result and sends it to the analysis machine 200 (step S1625), and the analysis machine 200 acquires it (step S1626).

[0205] As described above, in the confidential information processing system 1000 according to the third embodiment, each organization represented by the DB server 400 manages its own encrypted tables, and according to instructions requested via the provision server 300, a search is performed on each table on the DB server 400, and if the number of hits in the search for each table is equal to or greater than a threshold value, the provision server 300 decrypts the associated encrypted data ED into plain data PD, thereby enabling information processing.

[0206] In the secret information processing system 1000 according to the third embodiment, the provision server 300 substitutes for queries to the DB server 400 that manages tables in the database 400A, so that the analysis device 200 only needs to process the provision server 300, thereby reducing the processing load on the analysis device 200. Furthermore, the encrypted data ED sent from the DB server 400 to the provision server 300 is decrypted as plaintext data PD only if there are search hits equal to or greater than a threshold value. If the number of search hits across multiple organizations is less than the number set by the threshold value, the encrypted data ED is not decrypted, and confidentiality is maintained.

[0207] The secret information processing system 1000 according to the third embodiment has been described above.

[0208] The above-described embodiment of the present invention can be summarized as follows.

[0209] (1) The confidential information processing system 1000 is a system that performs information processing on data representing information while keeping the information confidential through encryption, and includes a registration device 100, an analysis device 200, and a provision server 300, each of which is composed of a computer having at least a processor 101 and a storage device (102, 103), and is connected to each other via a network 600 so as to be able to communicate data. The registration device 100 derives a data key DK using a plaintext word PW representing an unencrypted word, encrypts plaintext data PD representing unencrypted data using the derived data key DK to create encrypted data ED, distributes the data key DK among a plurality of shares S, and combines the plaintext word PW and the shares S to create encrypted data ED. The analyzer 200 encrypts the plaintext query PQ, which represents an unencrypted query, with the searchable cipher to create an encrypted query EQ. The provision server 300 acquires the created encrypted query EW and the created encrypted data ED and registers them in the database 300A. The provision server 300 acquires the created encrypted query EQ and compares it with the registered encrypted query EW. If the comparison results in a match, the provision server 300 acquires the shares S. If the acquired shares S are a certain number or more, the provision server 300 restores a data key DK corresponding to multiple shares S including the certain number or more of shares S using the certain number or more of shares S, and decrypts the encrypted data ED to plaintext data PD using the restored data key DK. That is, the confidential information processing system 1000 compares the encrypted query EW obtained by encrypting the plaintext word PW with the encrypted query EQ obtained by encrypting the plaintext query PQ, counts the number of times the encrypted query EW and the encrypted query EQ are evaluated to be identical, and decrypts the encrypted data ED to acquire the plaintext data PD only if this number is equal to or greater than a threshold. As a result, the confidential information processing system 1000 can perform various information processing operations on the data representing the encrypted information (encrypted data ED) while ensuring the confidentiality of the encrypted information, without disclosing plain text more than necessary.

[0210] (2) The registration device 100 encrypts the word key WK and the plaintext word PW to create an encrypted word EW, and the analysis device 200 encrypts the query key QK and the plaintext query PQ to create an encrypted query EQ.

[0211] (3) If the provision server 300 evaluates that the encrypted password EW and the encrypted query EQ are identical, it obtains shares S from the encrypted data ED, and if there are shares S greater than or equal to a predetermined threshold, it restores the data key DK from the shares S.

[0212] (4) The registration device 100 generates a share S in which the data key DK is embedded using the plaintext word PW.

[0213] (5) The enrollment device 100 generates a polynomial P using the plaintext word PW.

[0214] (6) The provision server 300 collects shares S for each specified table.

[0215] (7) The provision server 300 uses the common attributes for each table to collate the plain text data PD.

[0216] (8) A threshold value is set for each table, and the provision server 300 acquires the shares S from the encrypted data ED for each table, and if there are shares S equal to or greater than the threshold value for each table, restores the confidential information.

[0217] (9) The provision server 300 is configured to include at least a first provision server 300a and a second provision server 300b, and if the first provision server 300a evaluates that the encrypted password EW and the encrypted query EQ are identical, it obtains a share S from the encrypted data ED, and the second provision server 300b restores the data key DK from the share S.

[0218] The present invention is not limited to the above-described embodiments, and can be implemented using any components without departing from the spirit of the present invention.

[0219] The above-described embodiments are merely examples, and the present invention is not limited to these embodiments as long as the features of the invention are not impaired. Furthermore, although various embodiments have been described above, the present invention is not limited to these embodiments, and not all of these embodiments are necessarily essential to the solution of the present invention. Other embodiments conceivable within the scope of the technical idea of ​​the present invention are also included within the scope of the present invention.

[0220] In the above figures, the control lines and information lines shown are those that are considered necessary for explanation, and do not necessarily show all the control lines and information lines that are necessary for implementation. For example, it can be assumed that in reality, almost all components are interconnected.

[0221] The above-described arrangement of the functional units of the secret information processing system 1000 is merely an example, and the arrangement of the functional units may be changed to an optimal arrangement in terms of the performance, processing efficiency, communication efficiency, etc. of the hardware and software included in the secret information processing system 1000.

[0222] Furthermore, some or all of the configurations, functions, processing units, processing means, etc. of the secret information processing system 1000 described above may be realized in hardware, for example, by designing them as integrated circuits, or may be realized in software by the processor 101 interpreting and executing programs that realize the respective functions. Information such as programs, tables, and files that realize the respective functions may be stored in a storage device including the memory 102 or storage 103 such as a hard disk or SSD, or in a recording medium such as an IC card, SD card, or DVD (Digital Versatile Disc). [Explanation of symbols]

[0223] 1000...Secret information processing system 100...Registration machine, 200...Analysis machine, 300...Provision server, 400...DB server, 500...Distribution server, 600...Network

Claims

1. A confidential information processing system that performs information processing on data representing information while keeping the information confidential by encryption, The system comprises a registration device, an analyzer, and a provision server, each of which is a computer having at least a processor and a storage device, and which are connected to each other via a network so as to be able to communicate data with each other; The registration machine is deriving a data key using a plaintext word representing an unencrypted word; generating encrypted data by encrypting plaintext data representing unencrypted data using the derived data key; Distributing the data key into a plurality of shares; encrypting the plaintext word and the share with a searchable cipher to create an encrypted word; The analyzer comprises: Encrypting a plaintext query representing an unencrypted query with a searchable cipher to create an encrypted query; The providing server The created encryption passphrase and the created encrypted data are acquired and registered in a database; acquiring the created encrypted query and comparing it with the registered encrypted phrase, and if the comparison results in a match, acquiring the share; If the acquired shares are equal to or greater than a certain number, the data key corresponding to the plurality of shares including the certain number or more of shares is restored using the certain number or more of shares; decrypting the encrypted data into the plaintext data using the recovered data key; Confidential information processing system.

2. 2. The secret information processing system according to claim 1, the registration machine encrypts the word key and the plaintext word to generate the encrypted word; the analyzer encrypts a query key and the plaintext query to create the encrypted query; Confidential information processing system.

3. 2. The secret information processing system according to claim 1, A confidential information processing system in which, if the providing server evaluates that the encrypted word and the encrypted query are identical, it obtains shares from the encrypted data, and if there are shares greater than or equal to a predetermined threshold, it restores the data key from the shares.

4. 2. The secret information processing system according to claim 1, The registration device generates a share in which the data key is embedded using the plaintext word.

5. 2. The secret information processing system according to claim 1, The enrollment device generates a polynomial using the plaintext word.

6. 2. The secret information processing system according to claim 1, The provider server collects the shares for each designated table.

7. 7. The secret information processing system according to claim 6, The providing server uses a common attribute for each table to identify the plain text data.

8. 7. The secret information processing system according to claim 6, A threshold value is set for each of the tables, The providing server obtaining the shares from the encrypted data for each of the tables; If the number of shares is equal to or greater than the threshold value for each table, the secret information is restored. Confidential information processing system.

9. 2. The secret information processing system according to claim 1, the provision server is configured to include at least a first provision server and a second provision server; the first providing server acquires a share from the encrypted data when the encrypted phrase and the encrypted query are evaluated to be identical; the second provider server recovers the data key from the share; Confidential information processing system.

10. A confidential information processing method for performing information processing on data representing information while keeping the information confidential by encryption, comprising: The process is carried out by an information processing system including a registration device, an analyzer, and a provision server, each of which is a computer having at least a processor and a storage device, and which are connected to each other via a network so as to be able to communicate data with each other, The registration machine is deriving a data key using a plaintext word representing an unencrypted word; a process of generating encrypted data by encrypting plaintext data representing unencrypted data using the derived data key; distributing the data key into a plurality of shares; encrypting the plaintext word and the share with a searchable cipher to create an encrypted word; At a minimum, The analyzer comprises: The process of creating an encrypted query by encrypting a plaintext query that represents an unencrypted query with a searchable cipher At a minimum, The providing server A process of acquiring the created encryption passphrase and the created encrypted data and registering them in a database; acquiring the created encrypted query and comparing it with the registered encrypted phrase, and acquiring the share if the comparison results are a match; If the acquired number of shares is equal to or greater than a certain number, a process of restoring the data key having a correspondence relationship with a plurality of shares including the acquired number of shares or more, using the acquired number of shares or more; decrypting the encrypted data into the plaintext data using the restored data key; At a minimum, Confidential information processing method.

11. A computer system including a registration machine, an analyzer, and a provision server, each of which is a computer having at least a processor and a storage device, and which are connected to each other via a network so as to be able to communicate data with each other, deriving a data key using a plaintext word representing an unencrypted word; generating encrypted data by encrypting plaintext data representing unencrypted data using the derived data key; Distributing the data key into a plurality of shares; Encrypting the plaintext word and the share with a searchable cipher to create an encrypted word causing the registration machine to execute the above; Create an encrypted query by encrypting a plaintext query that represents an unencrypted query with a searchable cipher causing the analyzer to execute the above; The created encryption passphrase and the created encrypted data are acquired and registered in a database; acquiring the created encrypted query and comparing it with the registered encrypted phrase, and if the comparison results in a match, acquiring the share; If the acquired shares are equal to or greater than a certain number, the data key corresponding to the plurality of shares including the certain number or more of shares is restored using the certain number or more of shares; The encrypted data is decrypted into the plaintext data using the recovered data key. causing the providing server to execute the above. Computer program.

Images