Information processing device and method, and program

Abstract

This invention provides an information processing device, method, and program that reduce the computational load of pre-calculations and the amount of data to be stored. [Solution] In a computation outsourcing system, the computing device has a processor that internally decrypts and decrypts data using an internally held key, and a commissioned computation processing device that receives a commission from the processor and performs computation processing on the data to be computed. The computing device performs computation processing on a plurality of randomly generated mask generation data, stores the processing results and each mask generation data, masks the data to be computed using mask generation data randomly selected from the stored mask generation data, commissions the computation processing on the masked data to be computed

Description

[Technical Field]

[0001] The present invention relates to an information processing device and method, and is particularly suitable for application to a computing device that performs AI (Artificial Intelligence) inference (prediction) using a network such as a DNN (Deep Neural Network). [Background technology]

[0002] Modern AI often uses networks such as DNNs, where linear and nonlinear layers alternate, for learning and prediction. Furthermore, these networks have become larger in scale in recent years, leading to the creation of highly advanced AI.

[0003] However, when training and making predictions for large-scale AI networks, a typical CPU (Central Processing Unit) requires a significant amount of processing time, leading to problems such as training not being completed or real-time predictions being impossible. Therefore, auxiliary computers such as GPUs (Graphical Processing Units), which are specifically designed for this purpose, are often used for calculating the linear layers of the network.

[0004] On the other hand, when providing AI prediction functions as a service using external computing resources such as cloud servers, data must be transmitted externally, and if that data includes confidential information such as personal information, a data protection mechanism is necessary. In recent years, Trusted Execution Environments (TEEs), which are secure execution environments using hardware mechanisms, have attracted attention as such a mechanism.

[0005] In a TEE (Transactional Enterprise), unauthorized individuals cannot access the data handled within it. Data holders encrypt their data and send it to an external TEE. The data is then decrypted within the TEE, processed, and the results are sent back to the data holder or users of that data.

[0006] Incidentally, some TEEs only have CPUs available as processors, and when using such TEEs for the aforementioned AI training and prediction, it is sometimes necessary to use a GPU provided outside the TEE. However, GPUs typically lack data protection mechanisms, which increases the risk of data leakage when computations are entrusted to a GPU.

[0007] To eliminate this risk, Non-Patent Document 1 discloses a method in which data is masked with random numbers when the computation is outsourced, and the mask is removed when the computation result is returned to the TEE. This method has the advantage of allowing computation to be safely outsourced to the GPU. [Prior art documents] [Non-patent literature]

[0008] [Non-Patent Document 1] F. Tramer, D. Boneh, SLALOM: FAST,VERIFIABLE AND PRIVATE EXECUTIONOF NEURAL NETWORKS IN TRUSTED HARDWARE, International Conference on LearningRepresentations(ICLR) 2018, available at https: / / arxiv.org / abs / 1806.03287 [Overview of the project] [Problems that the invention aims to solve]

[0009] However, the method disclosed in Non-Patent Document 1 requires that the mask used when sending data from the TEE (SGX (Software Guard eXtension) in Non-Patent Document 1) to the GPU, and the determinant for removing the mask from the calculation results sent from the GPU to the TEE, be calculated and stored in advance for the same number of times the TEE is entrusted with calculations from the GPU.

[0010] Therefore, according to the method disclosed in Non-Patent Document 1, there was a problem in that the number of pre-calculations, such as the generation of masks and the matrix for mask removal, and the amount of data that needed to be stored (the amount of data for mask data and the matrix formula for mask removal) increased in proportion to the number of times the TEE was delegated computation to the GPU.

[0011] This invention was made in consideration of the above points, and aims to propose an information processing device, method, and program that can reduce the amount of computation required for pre-calculation and the amount of data to be stored. [Means for solving the problem]

[0012] To solve these problems, the present invention provides an information processing device that performs a predetermined arithmetic processing, comprising: a processor that internally holds a key for encryption and decryption and uses the key to internally encrypt and decrypt data; and a commissioned calculation processing device that, upon receiving a commission from the processor, performs a predetermined calculation processing on data to be calculated on. The processor applies the calculation processing performed by the commissioned calculation processing device to a plurality of randomly generated mask generation data, stores the processing result of the calculation processing for each mask generation data, and stores each of the mask generation data. The processor randomly selects one or more of the mask generation data from the stored mask generation data, uses each of the selected mask generation data to mask the data to be calculated on. The calculation processing on the masked data to be calculated on is commissioned to the commissioned calculation processing device. The processing result of the calculation processing for each of the stored mask generation data is used to remove the mask from the processing result of the calculation processing on the data to be calculated on the data to be calculated on the commissioned calculation device transmitted from the commissioned calculation processing device.

[0013] Furthermore, the present invention provides an information processing method to be performed in an information processing device that performs a predetermined arithmetic processing, wherein the information processing device includes a processor that internally holds a key for encryption and decryption and uses the key to internally encrypt and decrypt data, and a commissioned calculation processing device that, upon receiving a commission from the processor, performs a predetermined calculation processing on data to be commissioned for calculation, and comprises a first step in which the processor applies the calculation processing to a plurality of randomly generated mask generation data, and stores the processing result of the calculation processing for each mask generation data and each mask generation data; a second step in which the processor randomly selects one or more mask generation data from the stored mask generation data, uses each selected mask generation data to mask the data to be commissioned for calculation, and commissions the commissioned calculation processing on the masked data to be commissioned for calculation to the commissioned calculation processing device; and a third step in which the processor uses the processing result of the calculation processing for each mask generation data stored to remove the mask from the processing result of the calculation processing on the data to be commissioned for calculation transmitted from the commissioned calculation processing device.

[0014] Furthermore, in the present invention, an information processing device is provided that includes a processor which internally holds a key for encryption and decryption and uses the key to internally encrypt and decrypt data, and a commissioned calculation processing device which, upon receiving a request from the processor, performs a predetermined calculation process on data to be computed. The processor is provided with a program which causes it to execute a process comprising: a first step of applying the calculation process performed by the commissioned calculation processing device to a plurality of randomly generated mask generation data, and storing the processing result of the calculation process for each mask generation data and each mask generation data; a second step of randomly selecting one or more mask generation data from the stored mask generation data, masking the data to be computed using each selected mask generation data, and commissioning the commissioned calculation processing on the masked data to be computed to be computed to the commissioned calculation processing device; and a third step of removing the mask from the processing result of the calculation process for the data to be computed to be computed that has been transmitted from the commissioned calculation processing device, using the processing result of the calculation process for each mask generation data that has been stored.

[0015] According to the information processing device, method, and program of this embodiment, there is no need to pre-generate and store a set of vectors equal to the number of times the processor will delegate computation to the delegated computation processing device. [Effects of the Invention]

[0016] According to the present invention, it is possible to realize an information processing device, method, and program that can reduce the amount of computation required for pre-calculation and the amount of data to be stored. [Brief explanation of the drawing]

[0017] [Figure 1] This is a block diagram showing the overall configuration of the computing outsourcing system according to the first and second embodiments. [Figure 2] (A) and (B) are conceptual diagrams used to explain a calculation method for inference (prediction) using a network in which linear and nonlinear layers appear alternately. [Figure 3]This is a block diagram showing the configuration of the user terminal. [Figure 4] This is a block diagram showing the configuration of the computing device according to the first embodiment. [Figure 5] This is a flowchart showing the processing procedure for the pre-calculation process according to the first embodiment. [Figure 6] This is a sequence diagram showing the processing flow between the user terminal and the computing unit. [Figure 7] This is a sequence diagram showing the processing flow within the arithmetic unit. [Figure 8] This flowchart shows the processing procedure for generating a pseudo-random mask, etc., according to the first embodiment. [Figure 9] This is a flowchart showing the processing procedure for mask removal according to the first embodiment. [Figure 10] This is a block diagram showing the configuration of the computing device according to the second embodiment. [Figure 11] This flowchart shows the processing procedure for the pre-calculation process according to the second embodiment. [Figure 12] This flowchart shows the processing procedure for generating a pseudo-random mask, etc., according to the second embodiment. [Figure 13] This is a flowchart showing the processing procedure for mask removal according to the second embodiment. [Modes for carrying out the invention]

[0018] An embodiment of the present invention will be described in detail below with reference to the drawings.

[0019] (1) First embodiment (1-1) Configuration of the computing outsourcing system according to this embodiment In Figure 1, 1 represents a secure computing delegation system to which the present invention is applied as a whole. This computing delegation system 1 comprises one or more user terminals 2 and a computing device 4 connected via a network 3.

[0020] In the following, the arithmetic unit 4 will have a linear layer LL as shown in Figure 2(A). i (i=1,2,……) and nonlinear layer NLL i The system maintains a trained network (e.g., a DNN) in which (i=1,2,……) alternates, uses this network to perform AI inference (prediction) based on data commissioned from user terminal 2, and transmits the inference (prediction) results to user terminal 2.

[0021] As shown in Figure 3, the user terminal 2 is composed of a general-purpose computer device comprising a CPU 11, memory 12, storage device 13, input device 14, output device 15, and communication device 16, which are interconnected via an internal communication line 10.

[0022] The CPU 11 is a processor that controls the operation of the entire user terminal 2. The memory 12 is composed of, for example, volatile semiconductor memory and is used as the working memory of the CPU 11. In this embodiment, the memory 12 stores an encryption / decryption processing program 17 for encrypting and decrypting data when exchanging data with the arithmetic unit 4.

[0023] The storage device 13 consists of, for example, a large-capacity non-volatile storage device such as a hard disk drive or an SSD (Solid State Drive), and is used to store various programs and data that needs to be stored for a long period of time.

[0024] The program stored in the storage device 13 is read into memory 12 when the user terminal 2 is started or when necessary, and the CPU 11 executes the program read into memory 12, thereby executing various processes for the user terminal 2 as a whole. However, the program stored in an external storage device (not shown) may also be read into memory 12 and executed by the CPU 11.

[0025] In this embodiment, the storage device 13 is provided with a data recording area 13A and a parameter recording area 13B. Data (vector data in this embodiment) 18 to be entrusted to the arithmetic unit 4 for calculation is stored in the data recording area 13A, and a decryption key 19 for encrypting and exchanging various data, including the data 18, with the arithmetic unit 4 is stored and held in the parameter recording area 13B.

[0026] The input device 14 is hardware used by the user to perform various operations and input information to the user terminal 2, and consists of, for example, a keyboard, mouse, or touch panel. The output device 15 is a display device that presents necessary screens and information to the user, and consists of, for example, a liquid crystal display or an organic EL (Electro-Luminescence) display. However, the output device 15 may also be a speaker or printer or other device capable of providing information to the user other than a display device.

[0027] The communication device 16 consists of a NIC (Network Interface Card) and other components, and performs protocol control during communication with the computing device 4 via the network 3.

[0028] On the other hand, as shown in Figure 4, the arithmetic unit 4 consists of a general-purpose server device equipped with a CPU 21, memory 22, storage device 23, outsourced computing processing unit 24, input device 25, output device 26, and communication device 27, all of which are interconnected via an internal communication line 20.

[0029] The CPU 21 is a processor that controls the operation of the entire arithmetic unit 4. The CPU 21 is equipped with SGX functionality and holds an encryption / decryption key 28 internally. This encryption / decryption key 28 is used to encrypt data written to memory 22 and to decrypt data read from memory 22 in order to prevent third parties from eavesdropping on signals flowing through the memory 22 or internal communication lines 20. However, if there is no risk of third parties eavesdropping on the data written to memory 22, the CPU 21 does not need to hold this encryption / decryption key 28.

[0030] The CPU 21 executes the calculation process shown in Figure 2(A) based on the data 18 (Figure 3) provided by the user terminal 2, including the nonlinear layer NLL as shown in Figure 2(B). i Perform the calculations for (i=1,2,……,p) yourself, and create a linear sheath LL i The calculation of (i=1,2,……,q) is entrusted to the delegated computing device 24.

[0031] Memory 22 is composed of, for example, volatile semiconductor memory and is used as the working memory of the CPU 21. In this embodiment, memory 22 stores the pre-calculation program 29 and the secure processing program 30, which will be described later.

[0032] The storage device 23 consists of a large-capacity non-volatile storage device such as a hard disk drive or SSD, and is used to store various programs and data that needs to be stored for a long period of time. Similar to the user terminal 2, programs such as the pre-calculation program 29 and the secure processing program 30 stored in the storage device 23 are read into memory 22 when the user terminal 2 is started or when necessary, and the CPU 21 executes the programs read into memory 22, thereby executing various processes for the entire arithmetic unit 4.

[0033] In this embodiment, the storage device 23 stores a user shared key 33, which is the encryption / decryption key used when sending and receiving data 18 with the user terminal 2, in addition to the processing parameters 31 and pre-calculated parameters 32 described later. The user shared key 33 is encrypted with the encryption / decryption key 28 and stored in the storage device 23. When it is needed, the CPU 21 reads it internally and decrypts it with the encryption / decryption key 28.

[0034] The delegated computing device 24 consists of a GPU and other components designed specifically for linear computation. The delegated computing device 24 performs a predetermined linear transformation calculation (in this case, matrix multiplication) on the data to be computed and returns the calculation result to the CPU 21.

[0035] The input device 25, the output device 26, and the communication device 27 each have the same functions as the corresponding input device 14, output device 15, or communication device 16 of the user terminal 2, so the description here is omitted.

[0036] (1-2) Secure functions implemented in the arithmetic unit Next, the secure functions implemented in the arithmetic unit 4 will be described. This secure function is a function that can perform a linear mapping calculation on the entrusted calculation processing device 24 in a secure environment while reducing the calculation amount and the amount of stored data in the preprocessing before making an inference (prediction) based on the data 18 given from the user terminal 2 compared to the prior art.

[0037] In practice, in the case of this arithmetic unit 4, as preprocessing in the phase of making an inference (prediction) (hereinafter referred to as the inference (prediction) phase) based on the data 18 from the user terminal 2, in the CPU 21, a plurality (hereinafter referred to as t) of random vectors r j (j = 1, 2,..., t) of the same dimension as the data 18 are each generated as mask generation data.

[0038] Also, the CPU 21 calculates the calculation results R j for these vectors r

Equation

[0039] Then, in the prediction phase that follows the preprocessing phase, first, within the CPU 21, the following equation

number

[0040] Then CPU21 proceeds with the i-th linear layer LL i When entrusting the calculation to the delegated computing device 24, the above-mentioned random bit string h (i) Using the following equation

number

[0041] Specifically, CPU21 generates a random bit sequence h (i) Each bit (h1 (i) ,h2 (i) ,……,h t (i) ) and each vector r j A pseudo-random mask S is created by sequentially multiplying (j=1,2,……,t) and summing up all the results. (i) This calculation calculates the random bit string h (i) The vector r is multiplied by the bit "1". j The sum of the pseudo-random mask S (i) It is calculated as follows.

[0042] Furthermore, CPU21 is given by the following formula

number

[0043] Specifically, CPU21 generates a random bit sequence h (i) Each bit and each R j (i) The mask removal matrix T is created by sequentially multiplying (j=1,2,……,t) and summing up all the results. (i) This calculation calculates the random bit string h (i) R is multiplied by the "1" bit. j (i) The sum of the matrix T for mask removal is (i) It is calculated as follows. CPU21 also calculates the mask removal matrix T. (i) The data is either stored internally or encrypted using the encryption / decryption key 28 (Figure 4) and then stored in memory 22 (Figure 4).

[0044] Furthermore, the CPU 21 provides the linear layer LL to the delegated computing processing unit 24. i The data to which the linear transformation calculation in (Figure 2(B)) is to be outsourced (hereinafter referred to as the data to be outsourced) x i For the following equation

number

[0045] This masked data x is subject to commissioned computation. i Upon receiving ', the commissioned computing processing unit 24 processes the following equation

number

[0046] Then CPU21 calculates this masked result y i Upon receiving, the following equation

number

[0047] According to the secure function of this embodiment, the number of vectors r equal to the number of times the CPU 21 delegates computation to the delegated computation processing unit 24 j Yes, pseudo-random mask S (i) and the matrix T for mask removal (i) This has the advantage of not requiring pre-calculation and storage of the data.

[0048] As a means to realize the secure function of this embodiment as described above, as shown in Figure 4, the memory 22 of the arithmetic unit 4 stores a pre-calculation program 29 and a secure processing program 30.

[0049] The pre-calculation program 29 is a program that performs the following processes during the pre-calculation phase. (A) Data generation process for mask generation. This process generates multiple random vectors r j This process generates (j=1,2,……,t) as data for mask generation. (B) Execution of linear transformation calculations for each mask generation data. This process involves each generated vector r j And each linear layer LL stored in the storage device 23 as processing parameters 31 in advance i Matrix A i R expressed by equation (1) using and j (i)This process calculates the result for all combinations of "j" and "i". (C) Storage process. This process involves each vector r generated in process (A). j And all R calculated in process (B) j (i) This process involves storing and saving the data as pre-calculated parameters 32 in the storage device 23. These processes (A) to (C) will be explained in detail later using a flowchart.

[0050] The secure processing program 30 is a program that performs the following processes during the inference (prediction) phase. (A) Pseudo-random mask generation process. This process generates a random bit sequence h as shown in equation (2) above. (i) Generate a random bit string h (i) Based on this, the pseudo-random mask S shown in equation (3) (i) And the mask removal matrix T shown in equation (4) (i) This process calculates and respectively. This process will be explained later using a flowchart. (B) Mask removal process. This process removes a pseudo-random mask S. (i) Data x to be used for outsourced calculations i After masking and sending to the outsourced computing device 24, the calculation result sent from the outsourced computing device 24 is used to obtain the mask removal matrix T. (i) This process removes the mask using the method shown in equation (7). This process will also be explained later using the flowchart.

[0051] (1-3) Flow of various processes related to the secure function of this embodiment Next, the flow of various processes executed in the computing outsourcing system 1 in relation to the secure function of the embodiment described above will be explained. In the following, the processing entity of various processes may be described as the pre-calculation program 29 or the secure processing program 30, but in practice, it goes without saying that the CPU 21 of the computing device 4 executes the process based on the pre-calculation program 29 or the secure processing program 30.

[0052] (1-3-1) Pre-calculation process Figure 5 shows the flow of a series of processes (hereinafter referred to as pre-calculation processes) executed by the pre-calculation program 29 during the pre-calculation phase. The pre-calculation program 29 starts the pre-calculation processes shown in Figure 5 at a predetermined timing.

[0053] The pre-calculation program 29 then first processes each linear layer LL stored in the memory device 23 as processing parameters 31. i Matrix A i This is obtained by reading all of them (S1). Note that each linear layer LL i Matrix A i This was obtained through machine learning up to that point.

[0054] Next, the pre-computation program 29 randomly generates t vectors r j Generate (j=1,2,...t) (S2). Note that the value of "t" is arbitrary, for example, around 100 to 300.

[0055] Next, the pre-calculation program 29 calculates each matrix A obtained in step S1. i And each vector r generated in step S2 j The result of multiplication with R j (i) This is calculated for all combinations of "i" and "t" (S3).

[0056] Then the pre-calculation program 29 uses each vector r generated in step S2. j And each R calculated in step S3 j (i) After encrypting the data using a decryption key, these are stored in the storage device 23 as pre-calculated parameters 32 (S4). The pre-calculation program 29 then terminates this pre-calculation process.

[0057] (1-3-2) Processing flow in the prediction phase FIG. 6 shows the processing flow between the user terminal 2 and the computing device 4 in the inference (prediction) phase. Here, the user terminal 2 and the secure processing program 30 (FIG. 4) of the computing device 4 share a user shared key 33 (FIG. 4) for pre-decryption in advance, and in the computing device 4, this user shared key 33 is encrypted with the decryption key 28 (FIG. 4) and stored in the storage device 23. Note that as a method for sharing the user shared key 33, a method of sending the public keys of both the user terminal 2 and the computing device 4 to each other may be used, or a Diffie Hellman key sharing method or the like may be used.

[0058] First, the user terminal 2 generates a ciphertext obtained by encrypting the data 18 to be transmitted to the computing device 4 with the decryption key 19 (FIG. 3), and transmits the generated ciphertext to the computing device 4 (S10). Also, when the communication device receives this ciphertext (S11), the computing device 4 executes a predetermined inference (prediction) process (S12).

[0059] Then, when the computing device 4 finishes such an inference (prediction) process, it encrypts the inference (prediction) result obtained by the inference (prediction) process with the user shared key 33, and then transmits it to the user terminal 2, which is the transmission source of the above-mentioned ciphertext (S13). Thus, when this user terminal 2 receives this inference (prediction) result (S14), it decrypts the received processing result and this series of processes ends.

[0060] (1-3-3) Processing flow in the computing device FIG. 7 shows the flow of a series of processes executed in the computing device 4 in step S12 of FIG. 6. In the following, the computing device 4 performs an inference (prediction) based on the data 18 from the user terminal 2 by executing the calculation processes of each linear layer LL i and each non-linear layer NLL i only once (for one loop) each.

[0061] The process shown in FIG. 7 starts when the communication device 27 (FIG. 4) of the arithmetic unit 4 receives the ciphertext transmitted from the user terminal 2. First, the communication device 27 (FIG. 4) delivers the received ciphertext to the secure processing program 30 (FIG. 4) (S20).

[0062] In addition, the secure processing program 30 to which the ciphertext has been delivered decrypts the ciphertext and extracts the data 18 (FIG. 3) (S21). Note that, thereafter, the secure processing program 30 may encrypt the decrypted data 18 using the decryption key 28 (FIG. 4) and temporarily store it in the memory 22 (FIG. 4).

[0063] Subsequently, the secure processing program 30 starts the calculation entrustment to the entrusted calculation processing device 24. First, it sets the variable “i” to “1” (S22). Also, the secure processing program 30 generates the random bit sequence h (i) described above for the formula (2), and uses the generated random bit sequence h (i) to generate the pseudo-random mask S (i) described above for the formula (3), and the mask removal matrix T (i) described above for the formula (4) respectively (S23).

[0064] Next, the secure processing program 30 masks the entrusted calculation target data x (i) (initially the data 18 decrypted in step S21) by adding the pseudo-random mask S i generated in step S23 as described above for the formula (5), and delivers the masked entrusted calculation target data x i (the masked entrusted calculation target data x i ´) to the entrusted calculation processing device 24 (S24).

[0065] The entrusted calculation processing device 24 executes a linear mapping calculation process of multiplying the received masked entrusted calculation target data x i ´ by the matrix A i of the corresponding linear layer LL i as described above for the formula (6) (S25), and the masked calculation result y which is the calculation resulti Send ' to CPU21 (S26).

[0066] This masked calculation result y i When the CPU 21 receives ', the secure processing program 30, as described above for equation (7), receives the masked calculation result y from the delegated calculation processing unit 24. i The mask removal matrix T generated in step S23 from ' (i) The mask is removed by subtracting, and the i-th linear layer LL from which the mask was removed is thus obtained. i The calculation result y i Obtain (S27).

[0067] Next, the secure processing program 30 increases the value of variable "i" by "1" (S28), and the value of variable "i" is used to delegate the calculation to the delegated calculation processing device 24. i It is determined whether the result is smaller than the total number "q" (S29). If the secure processing program 30 obtains a positive result in this determination, it returns to step S23, and thereafter repeats the processing from step S23 to step S29 until it obtains a negative result in step S29.

[0068] During this time, the CPU 21 will process the calculation result y obtained by the secure processing program 30 in step S27. i Based on the nonlinear layer NLL i The calculation is performed, and the result is used as the data to be commissioned for processing in the next steps S23 to S29. i+1 In step S24, the following pseudo-random mask S (i+1) The data is masked using the provided format and sent to the outsourced computing device 24.

[0069] Then, the secure processing program 30 obtains a negative result in step S29 because the value of variable "i" eventually becomes greater than "q", and finally obtains the calculation result y i The data is encrypted with the user-shared key 33 and handed over to the communication device 27 (S30). This completes the series of processes.

[0070] The calculation result y was handed over to the communication device 27. i Subsequently, as described above regarding step S13 in Figure 6, the communication device 27 transmits the ciphertext received by the arithmetic unit 4 in step S11 of Figure 6 to the user terminal 2, which is the source of the transmission.

[0071] (1-3-4) Pseudo-random mask generation process Figure 8 shows the specific processing details of the series of processes executed by the secure processing program 30 in step S23 of Figure 7 (hereinafter referred to as the pseudo-random mask generation process).

[0072] When the secure processing program 30 proceeds to step S23 in Figure 7, it starts the pseudo-random mask generation process shown in Figure 8, first generating the i-th data x of the data to be computed. i The data is obtained (S40). As described above, in step S23 of the first step S23 to step S29, the data 18 decoded in step S21 in Figure 7 is the data to be commissioned for calculation x i Therefore, in step S23 of the second and subsequent steps S23 to S29, the nonlinear layer NLL calculated by the CPU 21 immediately before that step is used. i-1 The calculation result is the data x to be commissioned for calculation. i This is the result.

[0073] Next, the secure processing program 30 uses the random bit sequence h described above for equation (2). (i) (S41) generates a random bit string h using a hash function. (i) That is also acceptable.

[0074] Next, the secure processing program 30 generates a random bit sequence h (i) And each vector r stored in the memory device 23 as pre-calculated parameters 32 (Figure 4) j The inner product with (j=1,2,……,t) is the pseudo-random mask S mentioned above for equation (3). (i) It is calculated as follows (S42).

[0075] Next, the secure processing program 30 processes a random bit sequence h (i) Each bit and each R stored in the storage device 23 as a pre-calculated parameter 32 j (i) The inner product with (j=1,2,……,t) is the mask removal matrix T mentioned above for equation (4). (i) It is calculated and saved as (S43).

[0076] The secure processing program 30 then terminates this pseudo-random mask generation process.

[0077] (1-3-5) Mask removal process Figure 9 shows the specific processing details of the process executed by the secure processing program 30 in step S27 of Figure 7 (hereinafter referred to as the mask removal process).

[0078] When the secure processing program 30 proceeds to step S27 in Figure 7, it starts the mask removal process shown in Figure 9, and, as described above, for equation (7), the masked calculation result y transmitted from the commissioned calculation processing device 24 i From ', the mask removal matrix T stored in step S43 of the pseudo-random mask generation process described above for Figure 8. (i) The mask is removed by subtracting (S50).

[0079] The secure processing program 50 then terminates this mask removal process.

[0080] (1-4) Effects of this embodiment According to the computation outsourcing system 1 of this embodiment having the above configuration, the data to be outsourced for computation x is transmitted between the CPU 21 and the outsourced computation processing device 24. i or the data subject to the commissioned calculation x i The result of the linear transformation calculation y i This allows for secure transmission and reception of data. Furthermore, this computation outsourcing system 1 enables secure execution of linear transformation calculations in the outsourced computation processing unit 24.

[0081] In addition, in this computation outsourcing system 1, when the CPU 21 outsources linear transformation calculations to the outsourced computation processing unit 24, the data to be outsourced calculation x i Add mask S to (i) This is a pre-generated fixed number of vectors r j From (j=1,2,……,t), a random number (random bit sequence h) is selected. (i) A randomly selected vector r using ) j Since it is generated as a sum, there is no need to pre-generate and store a set of vectors for the number of times the CPU 21 will outsource the calculation to the outsourced calculation processing unit 24, as in conventional technology. Therefore, this calculation outsourcing system 1 can reduce the amount of pre-calculation and the amount of data to be stored.

[0082] (2) Second embodiment (2-1) Configuration of the computing outsourcing system according to this embodiment In Figure 1, 40 as a whole represents the computing outsourcing system according to the second embodiment. This computing outsourcing system 40 is similar to the computing outsourcing system 1 of the first embodiment in that the user terminal 41 encrypts data and transmits it to the computing device 42 of this embodiment, the computing device 42 performs predetermined calculation processing on this data, encrypts the calculation result and transmits it back to the user terminal 41 that sent the data.

[0083] However, in the first embodiment of the computation outsourcing system 1, the CPU 21 of the arithmetic unit 4 outsourced linear transformation calculations to the outsourcing computation processing unit 24, whereas in this computation outsourcing system 40, the CPU 43 outsources homomorphic function calculations to the outsourcing computation processing unit 44, which is a difference from the computation outsourcing system 1 of the first embodiment.

[0084] Here, a homomorphism is a function whose input is an element of the group (G,*) and whose output is an element of the group (G',·), ​​and for any elements x, x', the following equation holds:

number

[0085] Figure 10, which uses the same reference numerals as Figure 4 to indicate corresponding parts, shows the configuration of the arithmetic unit 42 of the computing outsourcing system 40. The arithmetic unit 42 has the same hardware configuration as the arithmetic unit 4 of the first embodiment, except for the configuration of the CPU 43 and the outsourced computing processing unit 44. However, the CPU 43 is the same as the CPU 21 of the first embodiment in that it is equipped with SGX functionality and holds the encryption / decryption key 28 internally.

[0086] In this embodiment, the CPU 43 performs the predetermined calculations that are sequentially and alternately repeated, and the homomorphic function calculations, performing the former itself and delegating the latter to the delegated calculation processing unit 44. For this reason, the delegated calculation processing unit 44 is composed of a GPU or the like that is specifically designed for the corresponding homomorphic function calculations. The delegated calculation processing unit 44 receives the data x to be delegated from the CPU 43. i For (i=1,2,……,t), a given homomorphism F i The calculation (i=1,2,……,t) is performed and the result is returned to CPU43.

[0087] (2-1) Secure functions implemented in the arithmetic unit Next, the secure function implemented in the arithmetic unit 42 of this embodiment will be described. Similar to the first embodiment, this secure function is a function for entrusting homomorphic function calculations to the delegated calculation processing unit 44 in a secure environment, while reducing the amount of computation and data to be stored in the pre-calculation phase compared to the prior art.

[0088] In practice, in the case of this arithmetic unit 42, as part of the pre-calculation phase processing, the CPU 43 generates a group of multiple (hereinafter referred to as t) random elements r that will be the basis of the group composed of multiple mask generation data. j This generates (j=1,2,……,t). In other words, these elements r j This is the data used for mask generation.

[0089] Furthermore, CPU43 uses these original r j Based on the following formula

number

[0090] Then, in the computation delegation phase in which the CPU 43 actually delegates the computation of homomorphic functions to the delegated computation processing unit 44, first, within the CPU 43, the following equation

number

[0091] Then, in the subsequent computation delegation phase, when CPU 43 delegates the calculation of the i-th homomorphic function to the delegation computation processing unit 44, it uses the following equation

number

number

[0092] Specifically, CPU43 generates a random bit sequence h (i) Each bit (h1 (i),h2 (i) ,……,h t (i) All elements r) corresponding to the bit whose value is "1" j A pseudo-random mask S is created by multiplying (synthesizing) the results. (i) This calculation calculates the random bit string h (i) And all elements r corresponding to the bit "1" j The result of the multiplication is a pseudo-random mask S (i) It is calculated as follows.

[0093] Furthermore, CPU43 is given by the following formula

number

[0094] Specifically, CPU43 generates a random bit sequence h (i) All R corresponding to the bit whose value is "1" among all bits j (i) Multiply them together (total product) to get the original T for mask removal (i) This calculation calculates the random bit string h (i) All R corresponding to bits whose value is "1" j (i) The result of the multiplication is the original T for mask removal. (i) It is calculated as follows. Furthermore, CPU43 uses the calculated original T for mask removal. (i) The data is either stored internally or encrypted using the encryption / decryption key 28 (Figure 10) and then stored in memory 22 (Figure 10).

[0095] The CPU 43 then delegates the calculation of the data x to be computed to the delegated computing processing unit 44. i For the following equation

number

[0096] Furthermore, the outsourced computing processing unit 44 uses masked outsourced computing target data x i Based on ', the following equation

number

[0097] Then CPU43 calculates this masked result y i Upon receiving, the following equation

number

[0098] As a means to realize the secure function according to the embodiment described above, as shown in Figure 10, the memory 22 of the arithmetic unit 42 stores a pre-calculation program 45 and a secure processing program 46.

[0099] The pre-calculation program 45 is a program that performs the following processes during the pre-calculation phase. (A) Data generation process for mask generation. This process generates data from multiple random sources. j This process generates (j=1,2,……,t) as data for mask generation. (B) Execution of homomorphic function calculation for each mask generation data. This process is performed for each generated element r jThen, each homomorphic function F that is executed by the commissioned computing processing unit 44, which is stored in the storage device 23 as processing parameters 47 in advance, is executed. i R can be expressed by equation (9) using (i=1,2,……,q). j (i) This process calculates the result for all combinations of "j" and "i". (C) Storage process. This process involves each element r generated in process (A) j And all R calculated in process (B) j (i) This process involves storing and saving the data as pre-calculated parameters 48 in the storage device 23. These processes (A) to (C) will be explained in detail later using a flowchart.

[0100] The secure processing program 46 is a program that performs the following processes in the calculation outsourcing phase, which is executed after the pre-calculation processing by the pre-calculation program 45 is completed. (A) Pseudo-random mask generation process. This process generates a random bit sequence h as shown in equation (10) above. (i) Generate a random bit string h (i) Based on this, the pseudo-random mask S shown in equation (12) (i) And, the mask removal element T shown in equation (13) (i) This process calculates and respectively. This process will be explained later using a flowchart. (B) Mask removal process. This process removes a pseudo-random mask S. (i) Data x to be used for outsourced calculations i After masking and sending to the outsourced computing device 44, the original T for mask removal is obtained from the calculation results sent from the outsourced computing device 44. (i) This process removes the mask using the method shown in equation (16). This process will also be explained later using the flowchart.

[0101] (2-2) Flow of various processes related to the secure function of this embodiment (2-2-1) Pre-calculation process Figure 11 shows the pre-calculation process performed by the pre-calculation program 45 during the pre-calculation phase. The pre-calculation program 45 starts this pre-calculation process at a predetermined timing and first randomly generates r j The numbers (j=1,2,……,t) are generated (S60).

[0102] Next, the pre-calculation program 45 calculates the i-th element r as described above for equation (9). j The i-th homomorphism function F i R obtained by substituting into this equation j (i) This is calculated for all combinations of "j" and "i" (S61). The pre-calculation program 45 also calculates each R j (i) And each element r j These values ​​are stored in the storage device 23 as pre-calculated parameters 48 (Figure 10) (S62), and then this pre-calculation process is terminated.

[0103] (2-2-2) Pseudo-random mask generation process Next, we will describe the pseudo-random mask generation process executed by the secure processing program 46 during the computation outsourcing phase. Note that the processing flow between the user terminal 2 and the computing device 4 described above in Figure 5, and the processing flow within the computing device 4 described above in Figure 7, are the same in the second embodiment, so we will omit their explanation here. This pseudo-random mask generation process is the process executed in step S23 of Figure 6.

[0104] Figure 12 shows the specific processing details of the pseudo-random mask generation process performed by the secure processing program 46 in step S23 of Figure 6.

[0105] When the secure processing program 46 proceeds to step S23 in Figure 6, it starts the pseudo-random mask generation process shown in Figure 12, first generating the i-th data x of the data to be computed. iThe data is obtained (S70). As described above, in step S23 of the iterative processing of the first steps S23 to S29, the data sent from the user terminal 2 that was decoded in step S21 is the data to be calculated by the commissioned computer (x). i Therefore, in step S23 of the repeated processing from step S23 to step S29 from the second time onward, the calculation result of the predetermined calculation performed by the CPU 43 immediately before is the data to be commissioned for calculation x i This is the result.

[0106] Next, the secure processing program 46 uses the random bit sequence h mentioned above for equation (10). (i) This generates the random bit string h, and then, as described above for equation (11), the generated random bit string h (i) The set of bits whose value is "1" in the set B{h (i) (S71) Note that a hash function is used, and the pseudo-random bit sequence resulting from the output of the hash function is called the random bit sequence h (i) That is also acceptable.

[0107] Next, the secure processing program 46, as described above, uses the original r stored in the storage device 23 as a pre-calculated parameter 48 (Figure 10) for equation (12). j (j=1,2,……,t) and the set B{h (i) The product of} is a pseudo-random mask S (i) It is calculated as follows (S72).

[0108] Next, the secure processing program 46, as described above for equation (13), uses each R stored in the storage device 23 as a pre-calculated parameter 48. j (i) (j=1,2,……,t) and the set B{h (i) The product of} is the original T for mask removal (i) It is calculated as follows. The secure processing program 46 then uses the calculated original T for mask removal. (i) The data is either stored internally in the CPU 43 or encrypted using the encryption / decryption key 28 and then stored in the memory 22 (S73).

[0109] Furthermore, the secure processing program 46, as described above for equation (14), the data to be commissioned for calculation x i And the pseudo-random mask S calculated in step S72 (i) Multiply by the data x to be used for outsourced calculations. i Pseudo-random mask S (i) Masked data for commissioned calculations (masked data for commissioned calculations) x i The value of ' is calculated (S74), and after this, the pseudo-random mask generation process is terminated. Note that the masked data x is the data subject to commissioned calculation. i The following is sent from the CPU 43 to the delegated computing processing unit 44, as described above for step S24 in Figure 7.

[0110] (2-2-3) Pseudo-random mask removal process Figure 13 shows the specific processing details of the process executed by the secure processing program 46 of this embodiment in step S27 of Figure 7 (hereinafter referred to as the pseudo-random mask removal process).

[0111] When the secure processing program 46 proceeds to step S27 in Figure 7, it starts the mask removal process shown in Figure 13, and, as described above, for equation (16), the masked calculation result y sent from the commissioned calculation processing device 44 i ' and the original T for mask removal stored in memory device 23 as pre-calculated parameter 48 (i) Multiply by the inverse of (masked calculation result y) i ' is the original T for mask removal (i) The mask is removed by dividing by (S80). The secure processing program 46 then terminates this mask removal process.

[0112] Furthermore, if the inverse operation in step S80 incurs computational costs, in step S61 of the pre-calculation process described above for Figure 11, the following equation

number

[0113] (2-3) Effects of this embodiment According to the computation outsourcing system 40 of this embodiment having the above configuration, the data to be outsourced for computation x is transmitted between the CPU 43 and the outsourced computation processing unit 44. i or the data subject to the commissioned calculation x i The calculation result y of the homomorphism function for i This allows for secure transmission and reception of data. Furthermore, this computation outsourcing system 1 enables secure execution of homomorphic function calculations in the outsourced computation processing unit 44.

[0114] In addition, in this computation outsourcing system 40, when the CPU 43 outsources the computation of homomorphic functions to the outsourced computation processing unit 44, the data x to be outsourced is... i Add mask S to (i) This is a fixed number of elements r generated in advance. j From (j=1,2,……,t), a random number (random bit sequence h) is selected. (i) ) randomly selected element r j Since it is generated as the sum of the results, there is no need to pre-generate and store a set of vectors for the number of times the CPU 43 is entrusted with computation to the entrusted computation processing unit 44, as in conventional technology. Therefore, this computation entrustment system 40 can reduce the amount of computation required for pre-computation and the amount of data to be stored.

[0115] Furthermore, this computation delegation method according to this embodiment can be applied to calculations such as powers of fixed exponents used in public-key cryptography and digital signatures, and scalar multiplication of points on an elliptic curve (when the scalar is fixed).

[0116] (3) Other embodiments In the first and second embodiments described above, the arithmetic units 4 and 41 were configured from a single computer device (server device). However, the present invention is not limited to this, and may be configured from multiple computer devices that constitute a distributed computing system.

[0117] Furthermore, while the first embodiment described above describes the case in which the present invention is applied to a computing device 4 that performs AI inference (prediction) using a network such as a DNN, the present invention is not limited to this and can be broadly applied to various other computing devices that perform computational processing other than AI inference (prediction).

[0118] Furthermore, in the first embodiment described above, in Figure 7, the arithmetic unit 4 controls each linear layer LL shown in Figure 2(B). i and each nonlinear layer NLL i The present invention has described a case in which the calculation process is performed only once for each linear layer LL, and inference (prediction) is made based on the data 18 from the user terminal 2. However, the present invention is not limited to this, and each linear layer LL i and each nonlinear layer NLL i The present invention can also be similarly applied when making inferences (predictions) by performing each of the calculation processes multiple times.

[0119] Furthermore, in the second embodiment described above, examples of the application of the calculation delegation method of the present invention were given as calculations of powers of fixed exponents and calculations of scalar multiplication of points on an elliptic curve. However, the present invention is not limited to these examples and can be broadly applied to calculations other than those exemplified.

[0120] Furthermore, in the second embodiment described above, with respect to equation (12), each element r j And, set B{h (i) The product of} is a pseudo-random mask S (i) The present invention has described the case in which the calculation is performed as follows, but the present invention is not limited to this, and similar to the first embodiment, each element r j And the random bit sequence h shown in equation (10) (i) The inner product of the two is a pseudo-random mask S (i) It may also be calculated as follows.

[0121] In practice, linear transformation calculations are a type of homomorphism calculation, and for this type of homomorphism calculation, a pseudo-random mask S can be generated using a method similar to that of the first embodiment. (i) And, original T for mask removal(i) The calculated pseudo-random mask S (i) Add the following to the data x subject to outsourced calculation i The masked calculation result y sent from the commissioned calculation processing unit 44 is masked. i Original T for mask removal from ' (i) The calculation result y of the i-th homomorphism function is obtained by subtracting the mask. i You can obtain it. [Industrial applicability]

[0122] The present invention can be applied to an information processing apparatus having a processor that internally holds a key for encryption and decryption and uses the key to internally encrypt and decrypt data, and a delegated computation processing apparatus that, upon receiving a request from the processor, performs a predetermined computation process on data subject to delegated computation. [Explanation of Symbols]

[0123] 1,40... Computation outsourcing system, 2,41... User terminal, 4,42... Arithmetic unit, 18... Data, 21,43... CPU, 24,44... Outsourced computing processing unit, 29,45... Pre-calculation program, 30,46... Secure processing program, 31,47... Processing parameters, 32,48... Pre-calculation parameters.

Claims

1. In an information processing device that performs a predetermined arithmetic process, A processor that internally holds a key for encryption and decryption and uses that key to internally encrypt and decrypt data, A commissioned computing processing device that, upon receiving a request from the aforementioned processor, performs predetermined computational processing on the data subject to the commissioned computation, Equipped with, The aforementioned processor, The calculation process performed by the commissioned computing device is applied to each of the randomly generated mask generation data, and the processing results of the calculation process for each mask generation data, along with each of the mask generation data, are stored. From the stored mask generation data, one or more mask generation data are randomly selected, the data to be commissioned for calculation is masked using each of the selected mask generation data, and the calculation processing on the masked data to be commissioned for calculation is commissioned to the commissioned calculation processing device. Using the processing results of the calculation process for each of the stored mask generation data, remove the mask from the processing results of the calculation process for the data to be calculated by the outsourced calculation processing device that has been sent from the outsourced calculation processing device. An information processing device characterized by the following:

2. In the information processing apparatus according to claim 1, The aforementioned outsourced computing processing unit is As the calculation process for the data subject to the outsourced calculation, a predetermined linear mapping calculation is performed. The data for generating the mask is a vector, The aforementioned processor, One or more vectors are randomly selected from the stored vectors, a first sum is calculated which is the sum of each selected vector, and a second sum is calculated which is the sum of the results of the linear transformation calculation for each selected vector, and the data to be commissioned for calculation is masked by adding the first sum to the data to be commissioned for calculation. The mask is removed from the processing result of the calculation process for the data to be calculated by subtracting the second sum from the calculation result of the linear transformation calculation for the data to be calculated that has been transmitted from the commissioned calculation processing device. An information processing device characterized by the following:

3. In the information processing apparatus according to claim 1, The aforementioned outsourced computing processing unit is As the calculation process for the data subject to the outsourced calculation, a predetermined homomorphic function calculation is performed, The aforementioned data for mask generation is the source, The aforementioned processor, From the stored elements, one or more elements are randomly selected, a first product which is the sum of the selected elements, and a second product which is the sum of the calculation results of the homomorphic function calculations for each selected element are calculated, and the data to be commissioned for calculation is masked by multiplying it by the first product. The mask is removed from the processing result of the calculation process for the data to be calculated by the data to be calculated by the commissioned calculation processing device by dividing the calculation result of the homomorphic function calculation on the data to be calculated by the commissioned calculation processing device by the second product. An information processing device characterized by the following:

4. An information processing method performed in an information processing device that performs a predetermined arithmetic processing, The aforementioned information processing device is A processor that internally holds a key for encryption and decryption and uses that key to internally encrypt and decrypt data, A commissioned computing processing device that, upon receiving a request from the aforementioned processor, performs predetermined computational processing on the data subject to the commissioned computation, It has, The first step involves the processor performing the calculation process executed in the outsourced computing device on each of the randomly generated mask generation data, and storing the processing result of the calculation process for each of the mask generation data and each of the mask generation data. A second step in which the processor randomly selects one or more mask generation data from the stored mask generation data, uses each of the selected mask generation data to mask the data to be computed, and delegates the computation processing of the masked data to the computed processing device. A third step in which the processor uses the processing results of the calculation process for each of the stored mask generation data to remove the mask from the processing results of the calculation process for the data to be calculated by the commissioned calculation device transmitted from the commissioned calculation device. An information processing method characterized by comprising:

5. In the information processing method described in claim 4, The aforementioned outsourced computing processing unit is As the calculation process for the data subject to the outsourced calculation, a predetermined linear mapping calculation is performed. The data for generating the mask is a vector, In the second step described above, the processor, One or more vectors are randomly selected from the stored vectors, a first sum is calculated which is the sum of each selected vector, and a second sum is calculated which is the sum of the results of the linear transformation calculation for each selected vector, and the data to be commissioned for calculation is masked by adding the first sum to the data to be commissioned for calculation. In step 3 above, the processor, The mask is removed from the processing result of the calculation process for the data to be calculated by subtracting the second sum from the calculation result of the linear transformation calculation for the data to be calculated that has been transmitted from the commissioned calculation processing device. An information processing method characterized by the following:

6. In the information processing method described in claim 4, The aforementioned outsourced computing processing unit is As the calculation process for the data subject to the outsourced calculation, a predetermined homomorphic function calculation is performed, The aforementioned data for mask generation is the source, In the second step described above, the processor, From the stored elements, one or more elements are randomly selected, a first product which is the sum of the selected elements, and a second product which is the sum of the calculation results of the homomorphic function calculations for each selected element are calculated, and the data to be commissioned for calculation is masked by multiplying it by the first product. In step 3 above, the processor, The mask is removed from the processing result of the calculation process for the data to be calculated by the data to be calculated by the commissioned calculation processing device by dividing the calculation result of the homomorphic function calculation on the data to be calculated by the commissioned calculation processing device by the second product. An information processing method characterized by the following:

7. The information processing device has a processor that internally holds a key for encryption and decryption and uses the key to internally encrypt and decrypt data, and a delegated computation processing device that, upon receiving a request from the processor, performs a predetermined computation process on the data to be computed. A first step involves applying the calculation process performed by the commissioned computing device to each of the randomly generated mask generation data, and storing the processing result of the calculation process for each mask generation data and each of the mask generation data. A second step is to randomly select one or more mask generation data from the stored mask generation data, use each of the selected mask generation data to mask the data to be outsourced for calculation, and outsource the calculation processing of the masked data to be outsourced for calculation to the outsourced calculation processing device. A third step involves using the processing results of the calculation process for each of the stored mask generation data to remove the mask from the processing results of the calculation process for the data to be calculated on the outsourced calculation sent from the outsourced calculation processing device. A program characterized by causing a process to be performed that includes the following.

8. In the program described in claim 7, The aforementioned outsourced computing processing unit is As the calculation process for the data subject to the outsourced calculation, a predetermined linear mapping calculation is performed. The data for generating the mask is a vector, In the second step described above, One or more vectors are randomly selected from the stored vectors, a first sum is calculated which is the sum of each selected vector, and a second sum is calculated which is the sum of the results of the linear transformation calculation for each selected vector, and the data to be commissioned for calculation is masked by adding the first sum to the data to be commissioned for calculation. In step 3 above, The mask is removed from the processing result of the calculation process for the data to be calculated by subtracting the second sum from the calculation result of the linear transformation calculation for the data to be calculated that has been transmitted from the commissioned calculation processing device. A program characterized by causing the processor to perform the processing.

9. In the processor according to claim 7, The aforementioned outsourced computing processing unit is As the calculation process for the data subject to the outsourced calculation, a predetermined homomorphic function calculation is performed, The aforementioned data for mask generation is the source, In the second step described above, From the stored elements, one or more elements are randomly selected, a first product which is the sum of the selected elements, and a second product which is the sum of the calculation results of the homomorphic function calculations for each selected element are calculated, and the data to be commissioned for calculation is masked by multiplying it by the first product. In step 3 above, The mask is removed from the processing result of the calculation process for the data to be calculated by the data to be calculated by the commissioned calculation processing device by dividing the calculation result of the homomorphic function calculation on the data to be calculated by the commissioned calculation processing device by the second product. A program characterized by causing the processor to perform the processing.

Images