Encrypted data comparison system, encrypted data comparison method, program set, and data comparison machine

Abstract

This process allows for comparison of encrypted data without decryption, while simultaneously reducing the size of the encrypted data. [Solution] For each i (1≦i≦n), the system calculates the first exclusive OR of a compact second hash value based on the nth bit to the ith bit of the registered value, the secret key, and a random number, and the ith bit. For each j (1≦j≦n), it obtains a third hash value from the bit sequence obtained by inverting the jth bit of the nth bit to the jth bit of the comparison value, and the secret key. For each k (1≦k≦n), it calculates the second exclusive OR of a compact fourth hash value obtained from the kth third hash value of the encrypted query containing each third hash value, the random number, and the kth first exclusive OR of the encrypted data containing each first exclusive OR. Based on the second exclusive OR, the system determines the magnitude of the registered value and the comparison value.

Description

[Technical Field]

[0001] The present invention relates to an encrypted data comparison system, an encrypted data comparison method, a program set, and a data comparison machine. [Background technology]

[0002] As background technology in this field, there is Japanese Patent Publication No. 2020-204731 (Patent Document 1). This publication states that "a data comparison device holds first encrypted data in which a first plaintext is encrypted, and second encrypted data in which a second plaintext is encrypted. The first encrypted data is generated by encrypting each of the multiple blocks of the first plaintext, which is divided into multiple blocks, and shuffling the multiple blocks. The second encrypted data is generated by encrypting each of the multiple blocks of the second plaintext, which is divided into multiple blocks. The plaintext values ​​are embedded in at least one of the first encrypted data and the second encrypted data as values ​​indicating the result of a comparison of magnitudes. Based on the embedded values, the data comparison device compares the blocks at the same position in the first encrypted data and the second encrypted data before shuffling to determine the magnitude relationship between the first plaintext and the second plaintext." (See abstract). [Prior art documents] [Patent Documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2020-204731 [Overview of the project] [Problems that the invention aims to solve]

[0004] The technology described in Patent Document 1 compares first encrypted data obtained by encrypting the first plaintext with second encrypted data obtained by encrypting the second plaintext, and outputs a comparison result regarding the magnitude of the values ​​of the first and second plaintexts without decryption.

[0005] Specifically, the technology described in Patent Document 1 inverts a specific bit in either the first or second plaintext, then converts each bit of the first and second plaintexts into a hash value, and performs a comparison based on this exact match. Furthermore, in the technology described in Patent Document 1, SHA-256 is given as an example of a hash function due to its properties such as irreversibility and collision resistance.

[0006] However, the hash value of SHA (Secure Hash Algorithm)-256 is 256 bits, and when each bit of the plaintext is converted to a 256-bit hash value, the first encrypted data and the second encrypted data become at least 256 times larger than the original plaintext. Thus, the technology described in Patent Document 1 has room for improvement in terms of the data size of the encrypted data.

[0007] Therefore, one aspect of the present invention realizes a process that compares encrypted data without decrypting it, while suppressing the size of the encrypted data. [Means for solving the problem]

[0008] To solve the above problems, one aspect of the present invention adopts the following configuration. The encrypted data comparison system comprises a registerer, a viewer, and a data comparer, wherein the registerer holds a numerical value to be registered and a secret key, the viewer holds a numerical value to be compared and the secret key, the numerical value to be registered and the numerical value to be compared are represented by n bits with or without a predetermined padding operation, the processor of the registerer obtains a pseudorandom number and performs an encryption process on each of the i-th bits of the numerical value to be registered, and in the encryption process on the i-th bit, among the n bits representing the numerical value to be registered Extract the first bit sequence from the nth bit to the ith bit, obtain a first hash value for the value based on the extracted first bit sequence and the secret key using a first hash function, obtain a second hash value for the value based on the first hash value and the pseudorandom number using a second hash function that outputs a hash value of less than or equal to a predetermined number of bits or a predetermined value, calculate the first exclusive OR of the second hash value and the ith bit of the registered numerical value, and then combine the pseudorandom number and the calculated first exclusive OR, respectively. The system generates encrypted data to be registered, transmits the encrypted data to be registered to the data comparator, the data comparator stores the encrypted data to be registered, the processor of the viewer extracts a second bit sequence from the nth bit to the jth bit of the n bits representing the comparison number for each jth bit of the comparison number, obtains a third bit sequence by inverting the jth bit of the second bit sequence, obtains a third hash value for the value based on the obtained third bit sequence and the secret key using the first hash function, generates an encrypted query including each of the obtained third hash values, transmits the generated encrypted query to the data comparator, the processor of the data comparator performs a comparison process for each variable k between 1 and n, and in the comparison process for the variable k, obtains a fourth hash value for the value based on the third hash value stored at the kth position of the encrypted query and the pseudo-random number stored in the encrypted data to be registered using the second hash function, and obtains the obtained fourth hash value and,The first exclusive OR stored at the k-th position of the encrypted data to be registered is used to calculate the second exclusive OR of the first exclusive OR and the second exclusive OR. Based on the second exclusive OR, a comparison result showing the magnitude relationship between the registered numerical value and the comparison numerical value is output. [Effects of the Invention]

[0009] According to one aspect of the present invention, it is possible to perform a process that compares encrypted data without decrypting it, while suppressing the size of the encrypted data.

[0010] Other issues, configurations, and effects not mentioned above will be clarified by the following description of the embodiments. [Brief explanation of the drawing]

[0011] [Figure 1] This is a block diagram showing an example configuration of the encrypted data comparison system in Example 1. [Figure 2A] This figure shows an example of the data structure of the medical data in Example 1. [Figure 2B] This figure shows an example of the data structure of standard encrypted data in Example 1. [Figure 2C] This figure shows an example of the data structure of the encrypted data used for comparison in Example 1. [Figure 2D] This figure shows an example of the data structure of the standard encrypted data to be sent in Example 1. [Figure 2E] This figure shows an example of the data structure of the decoded medical data in Example 1. [Figure 3A] This block diagram shows an example of the hardware configuration of the computers that make up the registration machine, viewing machine, management machine, and distribution machine in Example 1. [Figure 3B] This is a block diagram showing an example of the functional configuration of the registered machine in Example 1. [Figure 3C] This is a block diagram showing an example of the functional configuration of the viewing device in Example 1. [Figure 3D] This is a block diagram showing an example of the functional configuration of the control machine in Example 1. [Figure 3E]This is a block diagram showing an example of the functional configuration of the distribution machine in Example 1. [Figure 4] This is a sequence diagram showing an example of the data registration process in Example 1. [Figure 5] This is a sequence diagram showing an example of the data comparison process in Example 1. [Figure 6] This flowchart shows an example of the process for generating encrypted data for comparison in Example 1. [Figure 7] This is an explanatory diagram showing a specific example of the comparison encryption data generation process in Example 1. [Figure 8] This flowchart shows an example of the encryption query generation process in Example 1. [Figure 9] This is an explanatory diagram showing a specific example of the encryption query generation process in Example 1. [Figure 10] This flowchart shows an example of the comparison process between the encrypted data for comparison and the encrypted query in Example 1. [Figure 11] This is an explanatory diagram illustrating a specific example of the comparison process between the encrypted data for comparison and the encrypted query in Example 1. [Modes for carrying out the invention]

[0012] Embodiments of the present invention will be described in detail below with reference to the drawings. However, the present invention is not limited thereto. In the embodiments, the same reference numerals are generally used for the same components, and repeated descriptions are omitted.

[0013] The technology described in Patent Document 1 involves inverting a specific bit in either the first or second plaintext, then converting each bit of the first and second plaintexts into a hash value, and performing a comparison based on this exact match.

[0014] Therefore, in the technology described in Patent Document 1, if the value of the first plaintext differs from the value of the second plaintext after a specific bit has been inverted, the hash value of the first plaintext must not be the same as the hash value of the second plaintext or a value that differs by only the least significant bit (the value with the least significant bit inverted).

[0015] This is due to the process described in Patent Document 1, where, in "step S3704" of Patent Document 1, the difference between the first encrypted data, which consists of the hash value of the first plaintext, and the second encrypted data, which consists of the hash value of the second plaintext, is calculated using the exclusive OR operation. In "step S3707" of Patent Document 1, if the value of the exclusive OR operation is 1, it is determined that "the plaintext (first plaintext) is greater than the query (second plaintext)", if the value of the exclusive OR operation is 0, it is determined that "the plaintext (first plaintext) is less than the query (second plaintext)", and otherwise it is determined that "the plaintext (first plaintext) is equal to the query (second plaintext)".

[0016] Therefore, the "comparison processing unit" in Patent Document 1 is required to use a hash function with a large output length of collision-hardened hash values, such as SHA (Secure Hash Algorithm)-256, so that if the value of the first plaintext differs from the value of the second plaintext, the first encrypted data and the second encrypted data will be different.

[0017] The data encryption comparison system of this embodiment uses a compact hash function, described later, to suppress the data size of the encrypted data while performing an evaluation process, described later, to avoid hash value collisions.

[0018] The following definitions are used in this embodiment.

[0019] (1) Pseudorandom function A pseudorandom function is a function that, given a specific input, outputs a sequence of unpredictable numbers that are statistically indistinguishable from random numbers. In this embodiment, a hash function or a compact hash function is used as an example of a pseudorandom function, but alternative methods to these hash functions may be used to implement a pseudorandom function.

[0020] (2) Hash function A hash function is a compression function that outputs a fixed-length data from input data of arbitrary length. The data output by a hash function is called a hash value. In particular, this embodiment uses a cryptographic hash function that is irreversible and collision-hard. Irreversibility is the property that it is difficult to obtain the input data from the hash value. Collision-hardness is the property that it is difficult to find any input data that has the same hash value. SHA-256 and SHA-3 are examples of hash functions that are both irreversible and collision-hard.

[0021] Generally, the shorter the length of the hash value of a hash function, the easier it is for the same hash value to be output from different input values. A hash function that does not have collision resistance is called a compact hash function in this embodiment. For example, a hash function that outputs only hash values ​​of a predetermined number of bits or less (e.g., 80 bits or less) (however, it is preferable that it be 2 bits or more), and a hash function that outputs only hash values ​​of a predetermined value or less are both examples of compact hash functions.

[0022] Compact hash functions can be created using existing hash functions. For example, the output bit length of the hash function SHA-256 is 256 bits. By using a value obtained by extracting 64 bits from the 256-bit output as the hash value, a compact hash function that outputs a 64-bit value can be constructed. Alternatively, by using a value obtained by extracting 32 bits from the 256-bit output as the hash value, a compact hash function that outputs a 32-bit value can be constructed. Furthermore, the result of a modulo operation, as described later, may also be used as the hash value.

[0023] Hereafter, a compact hash function will also be referred to as CH (Compact Hash function). Furthermore, when it is not necessary to distinguish between compact and non-compact hash functions, they will simply be called hash functions.

[0024] (3) Encryption key The key used to encrypt data is also called the encryption key. The encryption key includes the secret key, which will be discussed later.

[0025] (4) Private key There is a secret key used as input to the hash function, and another secret key used to decrypt encrypted data. Hereafter, the secret key will also be referred to as sk (secret key) without distinction.

[0026] (5) Data Data to be encrypted is also called plaintext data or simply data. Encrypted plaintext data is also called encrypted data.

[0027] (6) Query In this embodiment, the data being compared is also referred to as the query. The query before encryption is also referred to as the plaintext query or simply the query. The encrypted query is also referred to as the encrypted query.

[0028] (7) Exclusive OR The exclusive OR of two bits is denoted as XOR. Since bit values ​​are either 0 or 1, the exclusive OR of bit values ​​is one of the following: 0 xor 0 = 0, 0 xor 1 = 1, 1 xor 0 = 1, or 1 xor 1 = 0. In this embodiment, the exclusive OR is also called the XOR operation.

[0029] (8) Remainder The calculation of finding the remainder when an integer is divided by an integer p is denoted as modulo p. For example, since the integers between 0 and 3 (exclusive) are 0, 1, or 2, when p is 3, the result of the modulo calculation is either 0, 1, or 2. This modulo calculation is also called modulo arithmetic.

[0030] By treating the value of a standard hash function such as SHA-256 as an integer and using the remainder when that integer is divided by p as the hash value, the aforementioned compact hash function can be designed. [Examples]

[0031] Figure 1 is a block diagram showing an example configuration of an encrypted data comparison system. The encrypted data comparison system includes, for example, a distribution machine 400 owned by the scheme management authority, registration machines 100 owned by one or more business entities A1 to An (i.e., managing the hardware), a management machine 300 owned by business entity B (an example of a data comparison machine), and a viewing machine 200 owned by business entity C, with each device connected to the others via a network 600 such as the Internet.

[0032] This section describes an example of applying the encrypted data comparison system in this embodiment to a health checkup business. Below, we assume that each of the multiple business entities A1 to An is a "medical institution" (an example of the first user), business entity B is a "cloud service provider" (an example of the second user, and a different user from the first user), and business entity C is a "medical researcher."

[0033] Medical institutions operate by entrusting their information to a management unit 300 (i.e., management unit 300 is an example of a cloud server) provided by a cloud service provider. Therefore, medical data acquired by medical institutions is entrusted to management unit 300. Since medical data includes sensitive personal information held by medical institutions, it must be handled carefully to prevent leakage to others.

[0034] Therefore, the registration device 100 encrypts the data of items specified by the medical institution in the entered medical data using an encryption key issued by the scheme management device 400, and then deposits the encrypted data of the specified items with the management device 300 of the cloud service provider. The encrypted data of the medical data items is kept confidential from the cloud service provider. The management device 300 of the cloud service provider manages the medical data in an encrypted state.

[0035] When medical researchers need clinical data, they use the viewing device 200 to request the data from the cloud service provider's management device 300. The viewing device 200 generates an encrypted query to search for the required clinical data and includes this encrypted query in the request. The cloud service provider's management device 300 compares the encrypted data with the encrypted query and extracts the encrypted data required by the medical researchers based on the comparison results.

[0036] Furthermore, some of the devices included in the encrypted data comparison system may be integrated. Specifically, for example, one or more registered devices 100 may be integrated with the management device 300. Communication between such integrated terminals is omitted.

[0037] Furthermore, if the various keys, hash functions, algorithms, and parameters required by the registration device 100, the viewing device 200, and the management device 300 are provided in advance, the encrypted data comparison system does not need to include the distribution device 400.

[0038] Specific examples of the data handled in Example 1 are shown in Figures 2A, 2B, 2C, 2D, and 2E.

[0039] Figure 2A shows an example of the data structure of medical data 111 registered in the registration device 100 by a medical institution. Medical data 111 stores the values ​​of each item in plain text. The data in each row of medical data 111 is also called "individual medical data". A "-" in the data indicates a missing value or blank space.

[0040] The encrypted data created by encrypting the medical data 111 includes standard encrypted data 313 and comparison encrypted data 314.

[0041] Figure 2B shows an example of the data structure of standard encrypted data 313. The standard encrypted data 313 in Figure 2B is data in which the values ​​of each item in the medical data 111 in Figure 2A have been encrypted using a predetermined encryption method. In this embodiment, a public-key cryptography or symmetric-key cryptography standardized by a public institution or organization is used as the predetermined encryption method, but any encryption method can be adopted as the predetermined encryption method. Hereinafter, standardized public-key cryptography and standardized symmetric-key cryptography will also be simply referred to as standard encryption.

[0042] The scheme management unit's distribution machine 400 issues encryption keys, and the medical institution's registration machine 100 generates standard encrypted data 313 by encrypting individual medical data using the issued encryption keys. However, the registration machine 100 does not need to encrypt missing or blank portions in the medical data 111.

[0043] Furthermore, in the example in Figure 2B, all values ​​except for missing or blank portions are encrypted. However, the registration device 100 does not need to encrypt some of the values ​​in the medical data 111 when generating the standard encrypted data 313. Specifically, for example, when generating the standard encrypted data 313, the registration device 100 only needs to encrypt the values ​​of the items or cells specified by the user (medical institution) of the registration device 100 from among the values ​​contained in the medical data 111.

[0044] Furthermore, for example, when the registration device 100 generates the standard encrypted data 313, it may change any value in the medical data 111 that is neither missing nor blank (for example, the value of an item or cell specified by the user (medical institution) of the registration device 100) to a missing or blank value.

[0045] The data in each row of the standard encrypted data 313 is also called "individual medical data encrypted with standard encryption." In Figure 2B, SE is an abbreviation for Standard Encryption. SE(x) indicates the value x encrypted with standard encryption.

[0046] Figure 2C shows an example of the data structure of the comparison encrypted data 314. The comparison encrypted data 314 in Figure 2C is data in which the values ​​of each item in the medical data 111 in Figure 2A have been encrypted using a comparable encryption method.

[0047] Each row of data in the comparison encrypted data 314 is also called "individual medical data encrypted with a comparable encryption." CE is an abbreviation for Comparable Encryption. CE(x) indicates that the value x is encrypted with a comparable encryption. Note that because it is encrypted with a comparable encryption, the magnitude of the value x can be compared in its encrypted state using CE(x).

[0048] Furthermore, in the example in Figure 2C, all values ​​except for missing or blank portions are encrypted. However, the registration device 100 does not need to encrypt some of the values ​​in the medical data 111 when generating the standard encrypted data 313. Specifically, for example, when generating the standard encrypted data 313, the registration device 100 only needs to encrypt the values ​​of the items or cells specified by the user (medical institution) of the registration device 100 from among the values ​​contained in the medical data 111.

[0049] Furthermore, for example, when the registration device 100 generates the standard encrypted data 313, it may change any value in the medical data 111 that is neither missing nor blank (for example, the value of an item or cell specified by the user (medical institution) of the registration device 100) to a missing or blank value. In the example in Figure 2C, the comparison encrypted data 314 does not contain the ciphertext of the name.

[0050] The standard encrypted data 313 and the comparative encrypted data 314 described above are merely examples, and may be generated by combining multiple encryption methods as needed. For example, the standard encrypted data 313 and the comparative encrypted data 314 may be generated by encrypting each item of the medical data 111 using different methods such as block cipher, searchable cipher, and public-key cipher.

[0051] Figure 2D shows an example of the data structure of the standard encrypted data 315 for transmission extracted by the management unit 300. The management unit 300 performs a comparison judgment between the encrypted query generated by the viewing unit 200 and the comparison encrypted data 314 for items specified by the user (medical researcher) of the viewing unit 200, and extracts records that satisfy the search conditions indicated by the encrypted query from the standard encrypted data 313 according to the result of the comparison judgment. The standard encrypted data 315 for transmission in Figure 2D consists of records extracted from the standard encrypted data 313 in this way.

[0052] Furthermore, the management unit 300 may store information that allows it to associate records in the standard encrypted data 313 and records in the comparison encrypted data 314, which are generated from the same plaintext. This allows the management unit 300 to use the results of the comparison judgment between the encrypted query generated by the viewing unit 200 and the comparison encrypted data 314 to extract records from the comparison encrypted data 314 that satisfy the search conditions indicated by the encrypted query, and then easily extract records corresponding to the extracted records from the standard encrypted data 313.

[0053] In the example in Figure 2D, records with a date of birth of 1980 or later or a hospital stay of 20 days or more were selected through comparison, and the disease code, date of birth, medical institution code, and hospital stay duration were extracted from those records.

[0054] Figure 2E shows an example of the data structure of the decrypted medical data 213 decrypted by the viewing device 200. The decrypted medical data 213 in Figure 2E is an example of the standard encrypted data 315 for transmission shown in Figure 2D being decrypted. The viewing device 200 outputs (for example, displays) the decrypted medical data 213, thereby providing the decrypted medical data 213 to medical researchers.

[0055] Figure 3A is a block diagram showing an example of the hardware configuration of the computers that make up the registration machine 100, the viewing machine 200, the management machine 300, and the distribution machine 400, respectively. Computer 500 has, for example, a CPU (Central Processing Unit) 501, memory 502, auxiliary storage device 503, communication device 504, input device 505, output device 506, and read / write device 507, which are connected to each other by internal communication lines such as a bus.

[0056] The CPU 501 is an example of a processor and executes the program stored in memory 502. While the CPU 501 and GPU (Graphics Processing Unit) are examples of processors, other semiconductor devices that perform the specified processing may also be used.

[0057] Memory 502 includes non-volatile memory elements such as ROM (Read Only Memory) and volatile memory elements such as RAM (Random Access Memory). ROM stores immutable programs (e.g., BIOS). RAM is a high-speed, volatile memory element such as DRAM (Dynamic Random Access Memory) and temporarily stores programs executed by the CPU 501 and data used during program execution.

[0058] The auxiliary storage device 503 is a high-capacity, non-volatile storage device such as a magnetic storage device (HDD) or flash memory (SSD), and stores the program executed by the CPU 501 and the data used when the program is executed. In other words, the program is read from the auxiliary storage device 503, loaded into memory 502, and executed by the CPU 501.

[0059] The input device 505 is a device that receives input from the operator, such as a keyboard or mouse. The output device 506 is a device that outputs the program execution results in a format that the operator can see, such as a display device or printer.

[0060] The communication device 504 is a network interface device that controls communication with other devices according to a predetermined protocol. The communication device 504 may also include a serial interface such as USB (Universal Serial Bus).

[0061] The read / write device 507 reads data from removable media (such as CD-ROMs and flash memory) and writes data to removable media. The program executed by the CPU 501 is provided to the computer 500 via removable media or the network 600 and stored in the non-volatile auxiliary storage device 503, which is a non-temporary storage medium.

[0062] Each device included in the encrypted data comparison system is provided with a program set containing, for example, one or more programs executed by the CPU of that device. This program set may include a common program executed by some or all of the devices included in the encrypted data comparison system, or it may include programs specific to each device. Specifically, for example, the program set may include a first program for the registration machine 100, a second program for the viewing machine 200, and a third program for the management machine 300. Alternatively, for example, the program set may include a first common program executed by the registration machine 100, the viewing machine 200, and the management machine 300. Alternatively, for example, the program set may include a second common program executed by two of the devices among the registration machine 100, the viewing machine 200, and the management machine 300, and a program for the remaining device (i.e., one of the first program, the second program, or the third program).

[0063] The registration machine 100, the viewing machine 200, the management machine 300, and the distribution machine 400 are each computer systems configured on one physical computer 500, or on multiple logically or physically configured computers 500, and may operate in separate threads on the same computer 500, or may operate on virtual computers built on multiple physical computer resources.

[0064] In this embodiment, the data used by the encrypted data comparison system is independent of the data structure and may be represented in any data structure. For example, a data structure appropriately selected from tables, lists, databases, or queues can store the data. Furthermore, some or all of the data used by each device included in the encrypted data comparison system may be stored in an external device connected to that device.

[0065] Figure 3B is a block diagram showing an example of the functional configuration of the registration device 100. The registration device 100 includes, for example, a scheme management unit 101 and an encrypted data generation unit 102, both of which are functional units. The scheme management unit 101 and the encrypted data generation unit 102 are included, for example, in the CPU 501 of the computer 500 that constitutes the registration device 100.

[0066] The scheme management unit 101 manages encryption keys and other information for encrypting data. The encrypted data generation unit 102 generates encrypted data from plaintext data.

[0067] The CPU 501 of the computer 500 that constitutes the registration machine 100 functions as a scheme management unit 101 by operating according to a scheme management program loaded into the memory 502 of the computer 500 that constitutes the registration machine 100, and functions as an encrypted data generation unit 102 by operating according to an encrypted data generation program loaded into the memory 502 of the computer 500 that constitutes the registration machine 100. The relationship between the functional units, the CPU 501 and the programs of other devices included in the encrypted data comparison system is similar.

[0068] Furthermore, some or all of the functions of the functional units of the devices included in the encrypted data comparison system may be implemented by dedicated hardware such as ASICs (Application Specific Integrated Circuits) or FPGAs (Field-Programmable Gate Arrays).

[0069] The registration device 100 holds, for example, medical data 111, an encryption key database 112, and a parameter database 113. The medical data 111, the encryption key database 112, and the parameter database 113 are stored in the memory 502 and / or auxiliary storage device 503 of the computer 500 that constitutes the registration device 100.

[0070] The medical data 111 contains plaintext data to be encrypted. The encryption key database 112 holds the encryption keys received from the distributor 400. The parameter database 113 holds the parameters received from the distributor 400.

[0071] Figure 3C is a block diagram showing an example of the functional configuration of the viewing device 200. The viewing device 200 includes, for example, a scheme management unit 201, an encryption query generation unit 202, and a decryption processing unit 203, all of which are functional units. The scheme management unit 201, the encryption query generation unit 202, and the decryption processing unit 203 are included in the CPU 501 of the computer 500 that constitutes the viewing device 200.

[0072] The scheme management unit 201 manages encryption keys, etc. The encryption query generation unit 202 generates encryption queries for comparison with encrypted data. The decryption processing unit 203 decrypts the encrypted data received from the management unit 300.

[0073] The viewing device 200 holds, for example, an encryption key database 211 and a parameter database 212. The encryption key database 211 and the parameter database 212 are stored in the memory 502 and / or auxiliary storage device 503 of the computer 500 that constitutes the viewing device 200. The encryption key database 211 holds encryption keys received from the distributor 400. The parameter database 212 holds parameters received from the distributor 400.

[0074] Figure 3D is a block diagram showing an example of the functional configuration of the management unit 300. The management unit 300 includes, for example, an encrypted data registration unit 301 and an encrypted data comparison unit 302, both of which are functional units. The encrypted data registration unit 301 and the encrypted data comparison unit 302 are included in the CPU 501 of the computer 500 that constitutes the management unit 300.

[0075] The encrypted data registration unit 301 registers the encrypted data received from the registration device 100 in the encrypted database 311. The encrypted data comparison unit 302 compares the comparison encrypted data 314 received from the registration device 100 with the encrypted query received from the viewing device 200. After the comparison, the encrypted data comparison unit 302 extracts the corresponding data from the standard encrypted data 313 as the standard encrypted data 315 for transmission and provides it to the viewing device 200.

[0076] The management unit 300 maintains, for example, an encrypted database 311. The encrypted database 311 is stored in the memory 502 and / or auxiliary storage device 503 of the computer 500 that constitutes the management unit 300. The encrypted database 311 maintains one or more encrypted data 312. The encrypted data 312 includes standard encrypted data 313 and comparison encrypted data 314.

[0077] Figure 3E is a block diagram showing an example of the functional configuration of the distribution unit 400. The distribution unit 400 includes, for example, a scheme management unit 401, which is a functional unit. The scheme management unit 401 is included in the CPU 501 of the computer 500 that constitutes the distribution unit 400. The scheme management unit 401 manages the encryption keys and parameters used for the generation of comparison encrypted data, the generation of encryption queries, and the comparison processing between the comparison encrypted data and the encryption queries in the encryption key database 411 and the parameter database 412, respectively.

[0078] The distributor 400 maintains an encryption key database 411 and a parameter database 412. The encryption key database 411 and the parameter database 412 are stored in the memory 502 and / or auxiliary storage device 503 of the distributor 400. The encryption key database 411 holds various encryption keys (and decryption keys). The parameter database 412 manages parameters for cryptographic primitives, such as hash functions, for each scheme.

[0079] In the example shown in Figure 3E, the parameter database 412 holds the scheme list 413. The scheme list 413 manages the combination of parameters used to generate comparison encrypted data for each scheme number. In the scheme list 413, the length of the plaintext data, the length of the hash value, the length of the random number, and the average number of encryption steps are defined for each scheme number.

[0080] The length of the plaintext data in Scheme List 413 indicates the length of the plaintext data encrypted in the comparison encrypted data generation process described later. The length of the hash value in Scheme List 413 indicates the length of the hash value output by the compact hash function used in the comparison encrypted data generation process. The length of the random number in Scheme List 413 indicates the length of the random number generated in the comparison encrypted data generation process. The average number of encryption operations in Scheme List 413 indicates the average number of encryption operations performed in the comparison encrypted data generation process.

[0081] Although not shown in the diagram, the parameter database 412 stores the encryption methods and parameters used for standard encrypted data.

[0082] In the scheme described above, the shorter the length of the plaintext data, and the longer the length of the hash value (length of the random number) obtained by the compact hash function, the smaller the average number of encryption operations. On the other hand, the longer the length of the plaintext data, the greater the amount of information that can be represented by a single plaintext, and the shorter the length of the compact hash value, the smaller the data size of the encrypted data used for comparison.

[0083] The following describes an example of processing performed by the encrypted data comparison system. Processing by the encrypted data comparison system includes data registration processing and data comparison determination processing.

[0084] Figure 4 is a sequence diagram showing an example of the data registration process. The scheme management unit 101 of the registration machine 100 requests the distribution machine 400 to send encryption keys (an encryption key used for the standard encrypted data generation process and an encryption key used for the comparison encrypted data generation process) and parameters (S110).

[0085] In step S110, for example, the scheme management unit 401 of the distributor 400 may send the scheme list 413 to the registerer 100, and the scheme management unit 101 of the registerer 100 may display the scheme list 413 on the output device 506 of the registerer 100, select a scheme according to the input to the input device 505 of the registerer 100, and request the transmission of comparison encryption parameters corresponding to the selected scheme. This allows the registerer 100 to select a scheme that meets the needs of the user.

[0086] Alternatively, the registration device 100 may not select a scheme, and a predetermined scheme may be used. In this case, various necessary algorithms and hash functions are shared in advance between the registration device 100, the viewing device 200, and the management device 300.

[0087] The scheme management unit 401 of the distribution unit 400 obtains encryption keys (encryption keys used for standard encrypted data generation processing and encryption keys used for comparison encrypted data generation processing) from the encryption key database 211 and parameters (schemes for generating comparison encrypted data and parameters for generating standard encrypted data) from the parameter database 212, in accordance with the request in step S110, and sends the obtained encryption keys and parameters to the registration unit 100 (S410).

[0088] In step S410, the scheme management unit 101 of the registration device 100 stores the received encryption key and parameters in the encryption key database 112 and the parameter database 113, respectively. The encryption key and scheme sent to the registration device 100 may be determined according to the input to the input device 505 of the distribution device 400, or they may be predetermined.

[0089] The encrypted data generation unit 102 of the registration device 100 specifies the items (comparison items) to be encrypted in the medical data 111 (S120). Specifically, for example, the encrypted data generation unit 102 specifies the items to be encrypted according to the input to the input device 505 of the registration device 100. In the example of medical data 111 in Figure 2A described above, the encrypted data generation unit 102 specifies, for example, "date of birth" and "number of days hospitalized" as comparison items to be encrypted. The data to be encrypted is an example of numerical data to be registered.

[0090] The encryption data generation unit 102 of the registration device 100 generates encrypted data including standard encrypted data and comparison encrypted data using the encryption key sent in step S110 (S130). The standard encrypted data is generated when the medical data 111 is encrypted using a standard public-key cryptosystem such as RSA (Rivest-Shamir-Adleman) or ECC (Elliptic Curve Cryptography), or a standard symmetric-key cryptosystem such as AES (Advanced Encryption Standard).

[0091] In step S130, the encrypted data generation unit 102 generates standard encrypted data according to the parameters for standard encrypted data generation received in step S110, and using the encryption key for standard encrypted data generation received in step S110. Details of the comparison encrypted data generation process performed in step S130 will be described later with reference to Figures 6 and 7.

[0092] The encrypted data generation unit 102 sends the encrypted data, including the comparison encrypted data and standard encrypted data, generated in step S130, to the management unit 300 (S140). The encrypted data registration unit 301 of the management unit 300 registers the encrypted data sent in step S140 into the encrypted database 311 (S310). The encrypted data registration unit 301 sends the result of the registration process in step S310 (including, for example, information indicating whether the registration was successful or not) to the registration unit 100 (S320). The registration unit 100 receives the result of the registration process sent in step S320 (S150).

[0093] The above-described data registration procedure is merely an example, and the order and content of the processing may be changed as needed. For example, if the registration device 100 and the distribution device 400 belong to the same entity or are integrated devices, some processing may be omitted, such as the registration device 100 already possessing the encryption key, without the distribution device 400 sending the encryption key to the registration device 100.

[0094] Figure 5 is a sequence diagram showing an example of data comparison processing. The scheme management unit 201 of the viewing device 200 requests an encryption key from the distribution device 400 (S210). The encryption key requested in step S210 includes the encryption key used to generate the comparison encrypted data and the decryption key for decrypting the standard encrypted data (which is the same as the encryption key in the case of symmetric-key cryptography).

[0095] The scheme management unit 401 of the distribution unit 400 selects an encryption key from the encryption key database 411 in accordance with the request in step S210 and sends it to the viewing unit 200 (S460). In step S460, the scheme management unit 201 of the viewing unit 200 stores the received encryption key in the encryption key database 211.

[0096] The encryption query generation unit 202 of the viewing device 200 specifies the items and magnitudes of the encrypted medical data, for example, according to the input to the input device 505 of the viewing device 200 (S220). For example, in step S220, conditions relating to the magnitude of attributes and numerical values ​​are specified for the example medical data 111 shown in Figure 2A, which includes items such as "date of birth" and "number of days hospitalized". The query to be encrypted is an example of numerical values ​​to be compared.

[0097] The encryption query generation unit 202 generates request data that requests the magnitude of the items and numerical values ​​specified in step S220, and encrypts the request data using the encryption key and parameters sent in step S460 (S230). Details of the encryption query generation process in step S230 will be described later with reference to Figures 8 and 9. Hereinafter, the request data generated in step S230 will also be referred to as a query, and the encrypted query will also be referred to as an encrypted query. The encryption query generation unit 202 sends the encrypted query generated in step S230 to the management unit 300 (S240).

[0098] The encrypted data comparison unit 302 of the management unit 300 searches for the items specified in the encrypted query from the comparison encrypted data in the encrypted data stored in the encrypted database 311 (S360). For example, in the example in Figure 2A, if items such as "date of birth" and "number of days hospitalized" are specified, the encrypted data comparison unit 302 extracts the comparison encrypted data related to "date of birth" and "number of days hospitalized" as the comparison target for the encrypted query.

[0099] The encrypted data comparison unit 302 compares the encrypted data for comparison with the encrypted query for the medical data items specified in the encrypted query, and obtains a comparison result that indicates the magnitude of the encrypted data for comparison and the encrypted query for those items (S370).

[0100] The encrypted data comparison unit 302 extracts encrypted data corresponding to the comparison between the items and numerical values ​​specified by the encryption query, based on the comparison result of step S370 (S380). At this time, the encrypted data comparison unit 302 may extract both the comparison encrypted data and the standard encrypted data corresponding to the items and numerical values ​​specified by the encryption query, or it may extract only the standard encrypted data corresponding to the items and numerical values ​​specified by the encryption query.

[0101] For example, if the encrypted query requests the extraction of data where the number of days hospitalized is "20 days or more" or the date of birth is "1970 or later," the encrypted data comparison unit 302 extracts the standard encrypted data for sending shown in Figure 2D from the encrypted comparison data 314 shown in Figure 2C, in accordance with the request. The details of the data comparison process in step S370 will be described later using Figures 10 and 11.

[0102] The encrypted data comparison unit 302 sends the encrypted data extracted in step S380 to the viewing unit 200 (S390). The decryption processing unit 203 of the viewing unit 200 decrypts the standard encrypted data sent in step S460 using the decryption key (S250). Through the above process, the viewing unit 200 can obtain the desired data without revealing the plaintext of the medical data 111 to the management unit 300.

[0103] In the example described above, the reader 200 decrypts the standard encrypted data, but it may also decrypt the comparison encrypted data. However, since the standard encrypted data has a smaller data size than the comparison encrypted data, the reader 200 can decrypt it at a faster speed.

[0104] The above-described data comparison procedure is merely an example, and the processing order and content may be changed as needed. For example, if the reader 200 and the distributor 400 belong to the same entity or are integrated devices, some processing may be omitted, such as the reader 200 already possessing the encryption key, without the distributor 400 sending the encryption key to the reader 200.

[0105] Figure 6 is a flowchart showing an example of the process for generating encrypted data for comparison in step S130. First, the data is set to n bits, and the n bits of data are represented by a symbol (m n m n-1 ...represented by m1). n m1 is the most significant bit of the data, and m1 is the least significant bit of the data. The value of each bit of the data is either 0 or 1. If the number of bits of the data is less than n bits, the encrypted data generation unit 102 converts the data to n bits by performing a predetermined padding operation (for example, zero padding) beforehand.

[0106] The encrypted data generation unit 102 generates a (pseudo) random number r (e.g., 128 bits) (S1300). The encrypted data generation unit 102 initializes the value of variable i to n (S1301). The encrypted data generation unit 102 then generates m of the data. n From m i Extract up to (S1302).

[0107] The encrypted data generation unit 102 is m n m n-1 …m i The hash value (an example of the first bit sequence) is obtained by concatenating the encryption key received from the distributor 400 in step S410 (hereinafter referred to as the secret key sk) and inputting this value into a hash function (S1303).

[0108] Note that the hash function in step S1303 is, for example, shared in advance among the registration device 100, the viewing device 200, and the management device 300. Alternatively, for example, usable hash functions in step S1303 may be defined in the scheme list 413, and the hash function selected by the registration device 100 in step S410 may be shared among the registration device 100, the viewing device 200, and the management device 300.

[0109] Note that the processes from step S1302 to step S1313 are looped and executed one or more times, and the same hash function is used each time in step S1303 executed in each loop. This loop corresponds to the i-th bit m of the data to be encrypted i is an example of the encryption processing for . Further, the hash function (an example of the first hash function) used in step S1303 may be a compact hash function or a non-compact hash function. Further, the hash function used in step S1303 may be the same as or different from the hash function (an example of the second hash function) used in step S1304.

[0110] The encrypted data generation unit 102 inputs a value obtained by concatenating the hash value obtained in the most recent step S1303 and the random number r generated in the most recent step S1300 into the compact hash function CH, thereby obtaining a hash value (an example of a second hash value) (S1304).

[0111] Note that, for example, compact hash functions usable in step S1304 are defined in the scheme list 413 in association with hash value lengths, and the hash function corresponding to the hash value length indicated by the scheme selected by the registration device 100 in step S410 is shared between the registration device 100 and the management device 300.

[0112] Note that the processes from step S1302 to step S1313 are looped and executed one or more times, and the same compact hash function CH is used each time in step S1304 executed in each loop.

[0113] Steps S1305 to S1309 are evaluation processes performed to determine whether the hash value generated in step S1304 is appropriate. If the hash value generated by the compact hash function in step S1304 is evaluated as inappropriate in step S1309, the process returns to step S1300. This process is repeated until a new hash value is generated using the compact hash function and evaluated as appropriate in step S1309.

[0114] As mentioned above, there is a possibility that the process will loop back from step S1309 to step S1300, and the processing from step S1300 onwards may be repeated. The average number of times this series of processes starting from step S1300 is executed is the "average number of encryption steps" shown in the scheme list 413 of Figure 3E.

[0115] The encrypted data generation unit 102 is m i Calculate xor 1 (i.e., m i The bit value of is inverted, and the original m i (If it is 0, it changes to 1; if it is 1, it changes to 0), and the calculated value is m i Save as '(S1305).

[0116] The encrypted data generation unit 102 is m n m n-1 …m i The hash value (an example of a fifth hash value) is obtained by concatenating the fourth bit string (an example of a fourth bit string) with the secret key sk received from the distributor 400 in step S410 and inputting this value into the hash function used in step S1303 (S1306).

[0117] The encrypted data generation unit 102 calculates a hash value (an example of the sixth hash value) by inputting the concatenated value obtained in the most recent step S1306 and the random number r generated in the most recent step S1300 into a compact hash function CH (S1307). Note that the processing in steps S1302 to S1313 is performed one or more times in a loop, but the same compact hash function is used in steps S1304 and S1307, which are executed in each loop.

[0118] The encrypted data generation unit 102 calculates the exclusive OR (an example of a third exclusive OR) of the hash value obtained in the most recent step S1304 and the hash value obtained in the most recent step S1307 (S1308).

[0119] The encrypted data generation unit 102 determines whether the value of the exclusive OR calculated in step S1308 is 0 or 1 (0 or 1 of an integer (or natural number), that is, a bit sequence in which the value of all bits is 0, or a bit sequence in which only the value of the least significant bit is 1 and the values ​​of all other bits are 0) (S1309).

[0120] If the encrypted data generation unit 102 determines that the value of the exclusive OR calculated in step S1308 is 0 or 1 (S1309: YES), it returns to step S1302. If the encrypted data generation unit 102 determines that the value of the exclusive OR calculated in step S1308 is neither 0 nor 1 (S1309: NO), it proceeds to step S1310.

[0121] The encrypted data generation unit 102 uses the hash value obtained in the most recent step S1304 and m i (The value of the least significant bit is m i An XOR operation is performed between the bit string (where the bit is such that all other bits are 0) and the encrypted data for comparison (i.e., the result of the comparison between the plaintext data and the plaintext query is embedded in the encrypted data for comparison beforehand), and the result of the XOR operation (an example of the first exclusive OR) is stored (S1310).

[0122] The encrypted data generation unit 102 converts the output value in the most recent step S1310 to c j The data is saved as (S1311). The encrypted data generation unit 102 decrements the value of variable i by 1 (S1312). The encrypted data generation unit 102 determines whether the value of variable i after decrementing is less than 1 (S1313).

[0123] If the encrypted data generation unit 102 determines that the value of the variable i after decrementing is 1 or greater (S1313: NO), it returns to step S1302. If the encrypted data generation unit 102 determines that the value of the variable i after decrementing is less than 1 (S1313: YES), it uses the random number r generated in the most recent step S1300 and the n c created in the most recent n steps S1311. j And, encrypted data for comparison (rc n c n-1 ...c1) Generate and output (S1314), and terminate the process of generating encrypted data for comparison.

[0124] In the process shown in Figure 6, a compact hash function is used to generate the comparison encrypted data, thus reducing the data size of the comparison encrypted data. On the other hand, the use of a compact hash function may increase the likelihood of hash value collisions compared to the case where a non-compact hash function is used, potentially reducing search accuracy. Here, reduced search accuracy means that the probability of extracting encrypted data that does not match the conditions indicated by the encryption query increases.

[0125] Therefore, in the evaluation process of steps S1305 to S1309, the encrypted data generation unit 102 performs m n m n-1 …m i And, m n m n-1 …m i '(m iThe bit sequence obtained by bit-inverting the bit string is compared with the hash values ​​calculated using the same method for each bit using a compact hash function to evaluate whether collisions (including a shift in the least significant bit) can be avoided. For all i, the encrypted data generation unit 102 evaluates that collisions can be avoided in step S1309. i By generating encrypted data for comparison using (and a random number r), the decrease in search accuracy described above can be suppressed. Although the evaluation process in steps S1305 to S1309 improves search accuracy, the evaluation process in steps S1305 to S1309 may be omitted.

[0126] Figure 7 is an explanatory diagram showing a specific example of the comparison encrypted data generation process described in Figure 6. It explains an example of the process for generating comparison encrypted data for the decimal integer 11. The decimal integer 11 can be represented as 4 bits of data (1011).

[0127] Furthermore, in cases where the loop process is performed multiple times, for example, the first step S1302 will be written as step S1302a, the second step S1302 as step S1302b, the third step S1302 as step S1302c, the fourth step S1302 as step S1302d, and the other steps will follow suit.

[0128] First, the encrypted data generation unit 102 generates a random number r (S1300). The encrypted data generation unit 102 initializes the variable i to 4 (S1301). Subsequently, the processes from step S1302 to step S1313 are executed in order from the most significant bit.

[0129] The encrypted data generation unit 102 extracts the value of m4, which is 1, from the data (S1302a). The encrypted data generation unit 102 then generates a hash value H of the concatenation of the value of m4 (1) and the secret key sk. sk (1) is calculated (S1303a). The encrypted data generation unit 102 calculates the hash value H obtained in step S1303. sk(1) and a random number r are concatenated and input into a compact hash function CH to obtain the hash value H r (H sk (1)) is calculated (S1304a).

[0130] The encrypted data generation unit 102 calculates m4xor 1 (=0) and stores 0 as m4' (S1305a). The encrypted data generation unit 102 then generates a hash value H of the concatenation of the value of m4' (0) and the secret key sk. sk (0) is calculated (S1306a). The encrypted data generation unit 102 calculates the hash value H obtained in step S1306a. sk By inputting the concatenated value of (0) and a random number r into the compact hash function CH, the hash value H is obtained. r (H sk (0)) is calculated (S1307a).

[0131] The encrypted data generation unit 102 performs an XOR operation on the hash value obtained in step S1304a and the hash value obtained in step S1307a (S1308a). If the encrypted data generation unit 102 determines that the value obtained in step S1308a is equal to 0 or 1, it returns to step S1300 (S1309a).

[0132] If the encrypted data generation unit 102 determines that the value obtained in step S1308a is neither 0 nor 1, it proceeds to step S1310a. The following describes the case where the process proceeds to step S1310a.

[0133] The encrypted data generation unit 102 performs an XOR operation between the hash value obtained in step S1304a and the value of m4, 1, and H r (H sk (1)) XOR 1 is calculated (S1310a). The encrypted data generation unit 102 stores the value obtained in step S1310a as c4 (S1311a). The encrypted data generation unit 102 reduces the value of variable i from 4 to 3 (S1312a). Since the value after decrementing is 1 or greater, the process proceeds to step S1302b.

[0134] The encrypted data generation unit 102 extracts the value of m4, which is 1, and the value of m3, which is 0, from the data (S1302b). The encrypted data generation unit 102 then generates a hash value H obtained by concatenating m4m3 (=10) and the secret key sk. sk (10) is calculated (S1303b). The encrypted data generation unit 102 calculates the hash value H obtained in step S1303. sk (10) and a random number r are concatenated and input into a compact hash function CH to obtain the hash value H r (H sk (10)) is calculated (S1304b).

[0135] The encrypted data generation unit 102 calculates m3xor 1 (=1) and stores 1 as m3' (S1305b). The encrypted data generation unit 102 then hashs the value H obtained by concatenating m4m3' (=11) and the secret key sk. sk (11) is calculated (S1306b). The encrypted data generation unit 102 calculates the hash value H obtained in step S1306b. sk (11) and a random number r are concatenated and input into a compact hash function CH to obtain the hash value H r (H sk (11)) is found (S1307b).

[0136] The encrypted data generation unit 102 performs an XOR operation on the hash value obtained in step S1304b and the hash value obtained in step S1307b (S1308b). If the encrypted data generation unit 102 determines that the value obtained in step S1308b is equal to 0 or 1, it returns to step S1300 (S1309b).

[0137] If the encrypted data generation unit 102 determines that the value obtained in step S1308b is neither 0 nor 1, it proceeds to step S1310b. The following describes the case where the process proceeds to step S1310b.

[0138] The encrypted data generation unit 102 performs an XOR operation on the hash value obtained in step S1304b and the value of m3, which is 0. r (H sk(10)) XOR 0 is calculated (S1310b). The encrypted data generation unit 102 stores the value obtained in step S1310b as c3 (S1311b). The encrypted data generation unit 102 reduces the value of variable i from 3 to 2 (S1312b). Since the value after decrementing is 1 or greater, the process proceeds to step S1302c.

[0139] The encrypted data generation unit 102 extracts the values ​​of m4 (1), m3 (0), and m2 (1) from the data (S1302c). The encrypted data generation unit 102 then generates a hash value H obtained by concatenating m4m3m2 (=101) and the secret key sk. sk (S1303c) calculates (101). The encrypted data generation unit 102 calculates the hash value H obtained in step S1303. sk By inputting the concatenated value of (101) and a random number r into the compact hash function CH, the hash value H is obtained. r (H sk (101)) is calculated (S1304c).

[0140] The encrypted data generation unit 102 calculates m2xor 1 (=0) and stores 0 as m2' (S1305c). The encrypted data generation unit 102 then generates a hash value H obtained by concatenating m4m3m2' (=100) and the secret key sk. sk (S1306c) calculates (100). The encrypted data generation unit 102 calculates the hash value H obtained in step S1306c. sk By concatenating (100) and a random number r, and inputting this result into a compact hash function CH, the hash value H is obtained. r (H sk (S1307c) calculates (100).

[0141] The encrypted data generation unit 102 performs an XOR operation on the hash value obtained in step S1304c and the hash value obtained in step S1307c (S1308c). If it is determined that the value obtained in step S1308c is equal to 0 or 1, the process returns to step S1300 (S1309c).

[0142] If the encrypted data generation unit 102 determines that the value obtained in step S1308c is neither 0 nor 1, it proceeds to step S1310c. The following describes the case where the process proceeds to step S1310c.

[0143] The encrypted data generation unit 102 performs an XOR operation on the hash value obtained in step S1304c and the value of m2, which is 1. r (H sk (101)) XOR 1 is calculated (S1310c). The encrypted data generation unit 102 stores the value obtained in step S1310c as c2 (S1311c). The encrypted data generation unit 102 reduces the value of variable i from 2 to 1 (S1312c). Since the value after decrementing is 1 or greater, the process proceeds to step S1302b.

[0144] The encrypted data generation unit 102 extracts the values ​​of m4 (1), m3 (0), m2 (1), and m1 (1) from the data (S1302d). The encrypted data generation unit 102 then generates a hash value H obtained by concatenating m4m3m2m1 (=1011) with the secret key sk. sk (S1303d) calculates (1011). The encrypted data generation unit 102 calculates the hash value H obtained in step S1303. sk By inputting the concatenated value of (10¹¹) and a random number r into the compact hash function CH, the hash value H r (H sk (1011)) is calculated (S1304d).

[0145] The encrypted data generation unit 102 calculates m1xor 1 (=0) and stores 0 as m1' (S1305d). The encrypted data generation unit 102 then generates a hash value H obtained by concatenating m4m3m3m1' (=1010) and the secret key sk. sk (S1306d) calculates (1010). The encrypted data generation unit 102 calculates the hash value H obtained in step S1306d. sk By inputting the concatenated value of (1010) and a random number r into the compact hash function CH, the hash value H is obtained. r (H sk(S1307d) calculates (1010).

[0146] The encrypted data generation unit 102 performs an XOR operation on the hash value obtained in step S1304d and the hash value obtained in step S1307d (S1308d). If the encrypted data generation unit 102 determines that the value obtained in step S1308d is equal to 0 or 1, it returns to step S1300 (S1309d).

[0147] If the encrypted data generation unit 102 determines that the value obtained in step S1308d is neither 0 nor 1, it proceeds to step S1310d. The following describes the case where the process proceeds to step S1310d.

[0148] The encrypted data generation unit 102 performs an XOR operation on the hash value obtained in step S1304d, the value of m1 (1), and m, and H r (H sk (1011)) XOR 1 is calculated (S1310d). The encrypted data generation unit 102 stores the value obtained in step S1310a as c1 (S1311d).

[0149] The encrypted data generation unit 102 decrements the value of variable i from 1 to 0. Since the value after decrementing is less than 1, the process proceeds to step S1313. The encrypted data generation unit 102 outputs (rc4c3c2c1) as encrypted data for comparison (S1314).

[0150] In addition, although the encrypted data generation unit 102 used exclusive OR in step S1305, instead of exclusive OR, m i Algebraic operations may be used to invert the bit values ​​of m. That is, the encrypted data generation unit 102 performs m i Instead of calculating xor 1, 1-m i Calculate m i It may be saved as '. Also, in step S1305, the encrypted data generation unit 102 may use other methods to m i You can also invert the bits.

[0151] Note that although the encrypted data generation unit 102 uses exclusive OR in step S1308, for example, the following algebraic operation may be used. For example, let the hash value obtained in step S1304 be h i , and let the hash value obtained in step S1307 be h i ’ , the encrypted data generation unit 102 may calculate h i xor h i ’ ) as an output value of step S1308 instead of exclusive OR, and proceed to step S1309. Alternatively, the encrypted data generation unit 102 may use other methods in step S1308. i and h i ’ as integers, and calculate the difference of h i minus h i ’ as the output value of step S1308, then proceed to step S1309. In addition, the encrypted data generation unit 102 may use other methods in step S1308.

[0152] Note that although the encrypted data generation unit 102 uses exclusive OR in step S1310, for example, the following algebraic operation may be used. For example, the encrypted data generation unit 102 may treat the value h i obtained in step S1304 as an integer, and store the sum of (h i +m i ) as the output value in step S1310. In addition, the encrypted data generation unit 102 may use other methods in step S1310.

[0153] Figure 8 is a flowchart illustrating an example of the encrypted query generation process in step S230. First, the query is assumed to be n-bit data, and the n-bit query is represented by the symbol (w n w n-1 ...w1). w n is the most significant bit of the query, and w1 is the least significant bit of the query. The value of each bit of the query is 0 or 1. When the number of bits of the query is less than n bits, the encrypted query generation unit 202 converts the query into n-bit data in advance by, for example, performing a predetermined padding operation (for example, 0 padding).

[0154] The encrypted query generation unit 202 initializes the value of variable i to n (S2400). The encrypted query generation unit 202 extracts w n to w i from the query (S2401). w n ···w i is an example of the second bit string. The encrypted query generation unit 202 calculates w i xor 1 (that is, the bit of w i is inverted, changing the original w i from 0 to 1 and from 1 to 0), and stores the result as w i ' (S2402).

[0155] The encrypted query generation unit 202 obtains a hash value (an example of the third hash value) of a value obtained by concatenating w n w n-1 …w i+1 w i ' (an example of the third bit string) and the encryption key (that is, the secret key sk) received from the distribution machine 400 in step S460 (S2403). Note that the secret key sk used in step S1303 and step S2403 is the same. Further, the hash function used in step S2403 is the same as the hash function used in step S1303.

[0156] The encrypted query generation unit 202 stores the hash value obtained in step S2403 as q j (S2404). The encrypted query generation unit 202 decrements the value of variable i by 1 (S2405). The encrypted query generation unit 202 determines whether or not the value of variable i after decrement is 1 or less (S2406).

[0157] When the encrypted query generation unit 202 determines that the value after decrement is 1 or more (S2406: NO), the process returns to step S2401. When the encrypted query generation unit 202 determines that the value after decrement is less than 1 (S2406: YES), the unit outputs the n generated q j as an encrypted query (q n q n-1 …q1) (S2407), and ends the encrypted query generation process.

[0158] Figure 9 is an explanatory diagram showing a specific example of the encryption query generation process described in Figure 8. It explains an example of creating an encryption query for the decimal integer 10. The decimal integer 10 can be represented as a 4-bit query (1010).

[0159] In the following cases where multiple loop operations are performed, for example, the first step S2402 will be written as step S2402a, the second step S2402 as step S2402b, the third step S2402 as step S2402c, the fourth step S2402 as step S2402d, and the other steps will follow suit.

[0160] The encryption query generation unit 202 extracts the value of w4, which is 1, from the query (S2401a). The encryption query generation unit 202 calculates w4xor 1 (=0) and stores 0 as w4' (S2402a). The encryption query generation unit 202 then generates a hash value H obtained by concatenating the value of w4' (0) and the secret key sk. sk Find (0) (S2403a).

[0161] The encryption query generation unit 202 generates the hash value H obtained in step S2403a. sk (0) is saved as q4 (S2404a). The encryption query generation unit 202 reduces the value of variable i from 4 to 3 (S2405a). Since the value after decrementing is 1 or greater, the process proceeds to step S2401b.

[0162] The encryption query generation unit 202 extracts the value of w4, which is 1, and the value of w3, which is 0, from the query (S2401b). The encryption query generation unit 202 calculates w3xor 1 (=1) and stores 1 as w3' (S2402b). The encryption query generation unit 202 generates a hash value H of the concatenation of w4w3' (=11) and the secret key sk. sk (11) is found (S2403b).

[0163] The encryption query generation unit 202 uses the hash value H obtained in step S2403b.sk (11) is saved as q3 (S2404b). The encryption query generation unit 202 reduces the value of variable i from 3 to 2 (S2405c). Since the value after decrementing is 1 or greater, the process proceeds to step S2401c.

[0164] The encryption query generation unit 202 extracts the values ​​of w4 (1), w3 (0), and w2 (1) from the query (S2401c). The encryption query generation unit 202 calculates w2xor 1 (=0) and stores 0 as w2' (S2402c). The encryption query generation unit 202 generates a hash value H obtained by concatenating w4w3w2' (=100) and the secret key sk. sk Find (100) (S2403c).

[0165] The encryption query generation unit 202 generates the hash value H obtained in step S2403c. sk (100) is saved as q2 (S2404c). The encryption query generation unit 202 reduces the value of variable i from 2 to 1 (S2405c). Since the value after decrementing is 1 or greater, the process proceeds to step S2401d.

[0166] The encryption query generation unit 202 extracts the values ​​of w4 (1), w3 (0), w2 (1), and w1 (0) from the query (S2401d).

[0167] The encryption query generation unit 202 calculates w1xor 1 (=1) and stores 1 as w1' (S2402d). The encryption query generation unit 202 then generates a hash value H obtained by concatenating w4w3w2w1'=(1011) with the secret key sk. sk (S2403d) find (1011).

[0168] The encryption query generation unit 202 generates the hash value H obtained in step S2403d. sk(1011) is saved as q1 (S2404d). The encryption query generation unit 202 decrements the value of variable i from 1 to 0. Since the value after decrementing is less than 1, the encryption query generation unit 202 outputs q4q3q2q1 as the encryption query (S2406a).

[0169] Figure 10 is a flowchart showing an example of the comparison process between the encrypted data for comparison and the encrypted query in step S370. The encrypted data comparison unit 302 initializes the value of variable i to n (S3700). The encrypted data comparison unit 302 extracts a random number r from the encrypted data for comparison (S3701). The encrypted data comparison unit 302 extracts c from the encrypted data for comparison. i From the encrypted query q i Remove (S3702).

[0170] The encrypted data comparison unit 302 is q i By concatenating the random number r with the hash value H, the hash value H is obtained. r (q i The compact hash function CH used in step S3703 is the same as the compact hash function CH used in step S1304. The encrypted data comparison unit 302 compares the hash value obtained in step S3703 (an example of the fourth hash value) with c i Find the exclusive OR of (an example of a second exclusive OR) of (S3704).

[0171] The encrypted data comparison unit 302 determines whether the value obtained in step S3074 is 1 or 0 (an integer (or natural number) of 0 or 1, that is, a bit sequence in which all bits are 0, or a bit sequence in which only the least significant bit is 1 and all other bits are 0) (S3075). If the encrypted data comparison unit 302 determines that the value obtained in step S3074 is either 1 or 0 (S3075: YES), it outputs the comparison processing result corresponding to the value obtained in step S3704 (S3708) and terminates the data comparison process.

[0172] If the encrypted data comparison unit 302 determines that the value obtained in step S3074 is neither 1 nor 0 (S3705: NO), it decrements the value of variable i by 1 (S3706). The encrypted data comparison unit 302 then determines whether the value of variable i after decrementing is less than 1 (S3707).

[0173] If the encrypted data comparison unit 302 determines that the value of variable i after decrementing is 1 or greater (S3706: NO), it returns to step S3702. If the encrypted data comparison unit 302 determines that the value of variable i after decrementing is less than 1 (S3706: YES), it executes the process in step S3708 and terminates the data comparison process.

[0174] In step S3708, the encrypted data comparison unit 302 determines that if the value obtained in step S3704 is 1, the plaintext is greater than the query; if the value is 0, the plaintext is less than the query; and if the value is any other value (i.e., a random number appears), the plaintext is equal to the query.

[0175] In step S3704, the encrypted data comparison unit 302 used an exclusive OR operation, but it may also use an algebraic operation such as the following. For example, the encrypted data comparison unit 302 uses the hash value H obtained in step S3703. r (q i ) and C i Treat and as integers, and instead of exclusive OR, C i -H r (q i The result of calculating () may be used as the output value of step S3704, and the process may proceed to step S3705. Alternatively, in step S3704, the encrypted data comparison unit 302 may use other methods.

[0176] Figure 11 is an explanatory diagram illustrating a specific example of the comparison process between the encrypted data for comparison and the encrypted query described in Figure 10. Figure 7 shows the encryption process of data (1011), and Figure 9 shows the encryption process of query (1010). Figure 11 shows an example of the process of comparing the encrypted data for comparison obtained in the example of Figure 7 with the encrypted query obtained in the example of Figure 9. Since 1011 > 1010, in the example of Figure 11, the comparison result that ultimately determines the data is larger than the query is output.

[0177] First, the encrypted data comparison unit 302 initializes the variable i to 4 (S3700). The encrypted data comparison unit 302 then extracts a random number r from the encrypted data for comparison (S3701). Subsequently, steps S3701 to S3707 are executed in order from the most significant bit.

[0178] In the following cases where multiple loop operations are performed, for example, the first step S3702 will be written as step S3702a, the second step S3702 as step S3702b, the third step S3702 as step S3702c, the fourth step S3702 as step S3702d, and the other steps will follow suit.

[0179] The encrypted data comparison unit 302 extracts q4 from the encrypted query (S3702a). q4 is the hash value H sk (0). The encrypted data comparison unit 302 is H of q4. sk By inputting the concatenated value of (0) and a random number r into the compact hash function CH, the hash value H is obtained. r (H sk (0)) is calculated (S3703a).

[0180] The encrypted data comparison unit 302 extracts c4 from the encrypted data for comparison, and c4 = H r (H sk (1) XOR 1 and the hash value H obtained in step S3703a r (H sk(0)) and the XOR operation is performed (S3704a). Here, the hash value for value 1 and the hash value for value 0 are unlikely to overlap as long as an appropriate hash function is used, so the result of this XOR operation is a random number obtained by XORing two different hash values.

[0181] Therefore, in step S3705a, the encrypted data comparison unit 302 determines that the value output in step S3704a is neither 1 nor 0. The encrypted data comparison unit 302 reduces the value of variable i from 4 by 1 (S3706a), making it 3. Since the value after decrementing is 1 or greater, the process proceeds to step S3702b.

[0182] The encrypted data comparison unit 302 extracts q3 from the encrypted query (S3702b). q3 is a hash value H sk (11) The encrypted data comparison unit 302 has q3=H sk (11) and a random number r are concatenated and input into a compact hash function CH to obtain the hash value H r (H sk (11)) is calculated (S3703b).

[0183] The encrypted data comparison unit 302 extracts c3 from the encrypted data for comparison, and c3 = H r (H sk (10) XOR 0 and the hash value H obtained in step S3703b r (H sk (11)) and perform the XOR operation (S3704b). Since the values ​​input to the hash function are different for 10 and 11, a random number will be output as the result of this XOR operation, as long as an appropriate hash function is used.

[0184] Therefore, in step S3705b, the encrypted data comparison unit 302 determines that the value output in step S3704b is neither 1 nor 0. The encrypted data comparison unit 302 reduces the value of variable i from 3 by 1 (S3706b), making it 2. Since the value after decrementing is 1 or greater, the process proceeds to step S3702c.

[0185] The encrypted data comparison unit 302 extracts q2 from the encrypted query (S3702c). q2 is the hash value H sk (100). The encrypted data comparison unit 302 is the value of q2 H sk By inputting the concatenated value of (100) and a random number r into the compact hash function CH, the hash value H r (H sk (S3703c) calculates (100).

[0186] The encrypted data comparison unit 302 extracts c2 from the encrypted data for comparison, and c2 = H r (H sk (101)) xor 1 and the hash value H obtained in step S3703c r (H sk (100)) and the XOR operation is performed (S3704c). Since the values ​​input to the hash function are different (101 and 100), a random number will be output as the result of this XOR operation, as long as an appropriate hash function is used.

[0187] Therefore, in step S3705c, the encrypted data comparison unit 302 determines that the value output in step S3704c is neither 1 nor 0. The encrypted data comparison unit 302 reduces the value of variable i from 2 to 1 (S3706c). Since the value after decrementing is 1 or greater, the process proceeds to step S3702d.

[0188] The encrypted data comparison unit 302 extracts q1 from the encrypted query (S3702d). q1 is the hash value H sk (1011). The encrypted data comparison unit 302 is the value of q1 H sk By inputting the concatenated value of (10¹¹) and a random number r into the compact hash function CH, the hash value H r (H sk (1011)) is calculated (S3703d).

[0189] The encrypted data comparison unit 302 extracts c1 from the encrypted data for comparison, and c1 = H r (H sk(1011)) xor 1 and the hash value H obtained in step S3703d r (H sk The XOR operation is performed on (1011) (S3704d). Since the values ​​input to the hash function are both 1011 and are equal, the hash value is also the same. Therefore, the result of the XOR operation is 1.

[0190] The encrypted data comparison unit 302 proceeds to step S3708 (S3705d) because the value output in step S3704d is 1. The encrypted data comparison unit 302 outputs a comparison result (S3708) stating that the encrypted data for comparison is greater than the encrypted query because the value output in step S3704d is 1.

[0191] In this way, the encrypted data comparison unit 302 can obtain a greater-than / less-than relationship, such as determining that data (1011) is greater than query (1010), by comparing the encrypted comparison data and the encrypted query while keeping them encrypted.

[0192] In this embodiment, a one-bit comparison is performed in step S3705, and a random number is output in step S3704 until the comparison is determined. The result of the comparison is determined by the appearance of 1 or 0. Therefore, the encrypted data comparison unit 302 can obtain the result of the comparison while concealing the similarity between the encrypted data for comparison and the original value of the encrypted query.

[0193] Furthermore, for example, in conventional technology, if data is encrypted and the result of a comparison of magnitudes is determined without decrypting the encrypted data, it may be possible to determine the similarity between encrypted data from the result of the comparison of magnitudes between encrypted data.

[0194] Therefore, in step S1303, the encrypted data comparison system of this embodiment performs m n ···m iIn step S1304, a first hash value is calculated for the value obtained by concatenating the secret key sk with m, and in step S1310, a second hash value is calculated using a compact hash function for the value obtained by concatenating the random number r with the first hash value, and in step S1310, the second hash value and m i The exclusive OR of (the least significant bit of the data) is calculated. Even if there is some statistical trend in the first hash value, especially the least significant bit of the first hash value, the encrypted data comparison system will, as described above, m i Before performing the XOR operation using the least significant bit, we calculate a second hash value using random numbers, m i This can reduce the risk of statistically inferring the value, and consequently, the risk of inferring similarity between encrypted data.

[0195] Furthermore, because hash functions are irreversible, although the management unit 300 stores the random number r, the random number r and c i Furthermore, it is not possible to generate a second hash value from this. In addition, since the random number r is not shared with the viewing device 200, updating the random number is easy, which also reduces the risk of similarity between encrypted data being inferred.

[0196] Furthermore, as mentioned above, the encrypted data comparison system of this embodiment uses a compact hash function (a function that outputs a short hash value) in step S1304, which reduces the data size of the encrypted data and consequently enables high-speed processing.

[0197] As mentioned above, a compact hash function may also be used in step S2403, in which case the data size of the encrypted query can also be reduced.

[0198] Furthermore, as mentioned above, using a compact hash function increases the likelihood of hash value collisions. However, the encrypted data comparison system of this embodiment can generate encrypted data using hash values ​​that have been evaluated as being able to avoid collisions through the evaluation process in steps S1305 to S1309, thereby improving search accuracy.

[0199] Furthermore, because multiple schemes are defined as shown in Scheme List 413, users can adjust the magnitude of the hash value and appropriately adjust the average number of encryption iterations in the data encryption process.

[0200] Assuming that both the data and the query are 1 bit each, and that the output of the hash function is an integer between 0 and t (exclusive), and that the output of the hash function follows an ideal uniform distribution, an error occurs when the hash values ​​are identical or differ by only the least significant bit. Therefore, the probability of a comparison error is given by 2 / t. Consequently, the probability that the comparison is correct is (1-2 / t), excluding the probability of an error, and the expected number of encryption iterations is given by the reciprocal of (1-2 / t).

[0201] Similarly, if the data and query are n bits each, it is desirable that the comparison is correct for all bits. The probability that the comparison is correct is (1-2 / t)^n, and its reciprocal is the expected number of iterations of the encryption process. Therefore, by adjusting the magnitude of the hash value, the average number of encryption iterations in the data encryption process can be suppressed or increased.

[0202] For example, if an average of three encryption attempts is allowed, then when the plaintext length is 8 bits, it is sufficient to simply convert each bit of the plaintext into a 4-bit hash value. Similarly, for plaintexts of 16 bits, 32 bits, and 64 bits, each bit of the plaintext should be converted into a 5-bit, 6-bit, and 7-bit hash value, respectively.

[0203] Furthermore, if you want to limit the number of repetitions to around two, you can convert each bit of the plaintext into a hash value of 5 bits (plaintext is 8 bits), 6 bits (plaintext is 16 bits), 7 bits (plaintext is 32 bits), or 8 bits (plaintext is 64 bits). If you want to complete the encryption process in just one step, add 1 bit to the length of each hash value. In any case, the size of encrypted data and encrypted queries will only increase by a few times at most compared to the plaintext.

[0204] It should be noted that the present invention is not limited to the embodiments described above, and various modifications are included. For example, the embodiments described above are described in detail to make the present invention easier to understand, and are not necessarily limited to those having all the configurations described. It is also possible to replace parts of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add configurations from other embodiments to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace parts of the configuration of each embodiment with other configurations.

[0205] Furthermore, each of the above configurations, functions, processing units, and processing means may be implemented in hardware, either partially or entirely, by designing them as integrated circuits, for example. Alternatively, each of the above configurations and functions may be implemented in software by having the processor interpret and execute programs that implement each function. Information such as programs, tables, and files that implement each function can be stored in memory, a hard disk, an SSD (Solid State Drive), or other recording media, such as an IC card, SD card, or DVD.

[0206] Furthermore, the control lines and information lines shown are those deemed necessary for explanatory purposes, and not all control lines and information lines are necessarily shown in the actual product. In reality, it is safe to assume that almost all components are interconnected. [Explanation of Symbols]

[0207] 100 Registration unit, 102 Encrypted data generation unit, 111 Medical data, 112 Encryption key database, 113 Parameter database, 200 Viewing unit, 202 Encryption query generation unit, 203 Decryption processing unit, 211 Encryption key database, 212 Parameter database, 300 Management unit, 302 Encrypted data comparison unit, 311 Encryption database, 312 Encrypted data, 313 Standard encrypted data, 314 Encrypted data for comparison, 400 Distribution unit, 401 Scheme management unit, 411 Encryption key database, 412 Parameter database, 500 Computer, 501 CPU, 502 Memory, 503 Auxiliary storage device, 504 Communication device

Claims

1. An encrypted data comparison system, It includes a registration machine, a viewing machine, and a data comparison machine. The registration device holds the numerical value to be registered and the secret key. The aforementioned viewing device holds the comparison target numerical value and the secret key, The aforementioned registered numerical value and the aforementioned comparison numerical value are represented by n bits with or without a predetermined padding operation. The processor of the aforementioned registered machine is Obtain a pseudo-random number, The encryption process is performed on each of the i-th bits of the aforementioned number to be registered. In the encryption process for the i-th bit, From the n bits representing the numerical value to be registered, the first bit sequence from the nth bit to the ith bit is extracted. A first hash value is obtained for the value based on the extracted first bit sequence and the secret key, using a first hash function. A second hash value for the value based on the first hash value and the pseudo-random number is obtained using a second hash function that outputs a hash value of less than or equal to a predetermined number of bits or a predetermined value. The first exclusive OR of the second hash value and the i-th bit of the number to be registered is calculated. The registered encrypted data is generated, including the aforementioned pseudo-random numbers and the first exclusive OR calculated above. The encrypted data to be registered is transmitted to the data comparison device. The aforementioned data comparator stores the encrypted data to be registered, The processor of the aforementioned viewing device is For each of the j-th bits of the aforementioned numerical value to be compared, From the n bits representing the comparison target value, extract the second bit sequence from the nth bit to the jth bit. Obtain the third bit sequence obtained by inverting the j-th bit of the second bit sequence, The third hash value for the value based on the acquired third bit sequence and the secret key is obtained using the first hash function. An encrypted query is generated that includes each of the third hash values ​​obtained above. The generated encrypted query is sent to the data comparator. The processor of the aforementioned data comparator is Perform a comparison process for each variable k that is between 1 and n (inclusive). In the comparison process for the variable k, A fourth hash value is obtained using the second hash function, based on the third hash value stored at the k-th position of the encryption query and the pseudo-random number stored in the encryption data to be registered. The second exclusive OR of the obtained fourth hash value and the first exclusive OR stored at the k-th position of the encrypted data to be registered is calculated. An encrypted data comparison system that outputs a comparison result showing the magnitude relationship between the registered numerical value and the comparison numerical value based on the second exclusive OR operation.

2. The encrypted data comparison system according to claim 1, The processor of the aforementioned registered machine is In the encryption process for the i-th bit, Obtain the fourth bit sequence obtained by inverting the i-th bit of the first bit sequence, A fifth hash value is obtained for the value based on the acquired fourth bit sequence and the secret key, using the first hash function. The sixth hash value for the value based on the fifth hash value and the pseudorandom number is obtained using the second hash function. The third exclusive OR of the second hash value for the i-th bit and the sixth hash value is calculated. If the third exclusive OR is neither 0 nor 1, the first exclusive OR for the i-th bit is calculated. If the third exclusive OR is 0 or 1, the encryption process for the i-th bit is terminated. An encrypted data comparison system that, if the encryption process is aborted, re-acquires pseudorandom numbers and uses the re-acquired pseudorandom numbers to re-execute the encryption process for each of the i-th bits of the registered numerical value.

3. The encrypted data comparison system according to claim 1, The registration device holds the encryption key, The processor of the aforementioned registered machine is Standard encrypted data is generated by encrypting the registered numerical value using the encryption key based on a predetermined encryption method. The standard encrypted data is transmitted to the data comparator. The aforementioned data comparison device is an encrypted data comparison system that stores the aforementioned standard encrypted data.

4. The encrypted data comparison system according to claim 3, The aforementioned encryption query indicates the conditions for comparing the registered numerical value and the comparison numerical value, The processor of the aforementioned registered machine is Based on the comparison results, encrypted data that satisfies the above conditions is extracted from the standard encrypted data. The extracted encrypted data is transmitted to the viewing device. The viewing device holds a decryption key corresponding to the encryption key, The processor of the viewing machine is an encrypted data comparison system that decrypts encrypted data received from the data comparison machine using the decryption key.

5. The encrypted data comparison system according to claim 1, Each of the registration devices holds information indicating a list of schemes that show the bit length of the numerical value to be registered, the bit length of the second hash value, and the number of times the encryption process is performed until the encrypted data to be registered is generated. The processor of the aforementioned registered machine is Data is generated to display the information shown in the aforementioned list. The system accepts input for selecting the scheme included in the above list. Select a scheme from the list according to the input above. An encrypted data comparison system that uses the second hash function based on the selected scheme, comprising the processor of the registration machine and the processor of the data comparison machine.

6. The encrypted data comparison system according to claim 1, The first hash function is a function that outputs a hash value less than or equal to a predetermined number of bits or less than or equal to a predetermined value, in this encrypted data comparison system.

7. The encrypted data comparison system according to claim 1, The processor of the aforementioned data comparator is In the comparison process for the variable k, If it is determined that the value of the second exclusive OR corresponding to the variable k is neither 1 nor 0, the value of the variable k is changed, and the comparison process is performed on the changed variable k. If it is determined that the value of the second exclusive OR corresponding to the variable k is 1 or 0, or if it is determined that the comparison process has been performed for all values ​​of k between 1 and n that are neither 1 nor 0, then the comparison process is terminated. If the value of the second exclusive OR calculated when the comparison process is completed is 1, the comparison result is generated indicating that the registered numerical value is greater than the comparison numerical value. If the value of the second exclusive OR calculated when the comparison process is completed is 0, the comparison result is generated indicating that the registered numerical value is greater than the comparison numerical value. An encrypted data comparison system that generates a comparison result indicating that the registered numerical value and the comparison numerical value are equal, if the value of the second exclusive OR calculated when the comparison process is completed is neither 1 nor 0.

8. The encrypted data comparison system according to claim 1, The aforementioned data comparison device is a cloud server, The hardware of the data comparison machine includes memory and is managed by a second user different from the first user of the registration machine, and is an encrypted data comparison system.

9. A method for comparing encrypted data using an encrypted data comparison system, The aforementioned encrypted data comparison system comprises a registration device, a viewing device, and a data comparison device. The registration device holds the numerical value to be registered and the secret key. The aforementioned viewing device holds the comparison target numerical value and the secret key, The aforementioned registered numerical value and the aforementioned comparison numerical value are represented by n bits with or without a predetermined padding operation. The aforementioned encrypted data comparison method is: The processor of the registration machine acquires a pseudo-random number, The processor of the registration machine performs encryption processing on each of the i-th bits of the numerical value to be registered. In the encryption process for the i-th bit, The processor of the registration machine extracts the first bit sequence from the nth bit to the ith bit of the n bits representing the numerical value to be registered, The processor of the registration machine obtains a first hash value for the value based on the extracted first bit sequence and the secret key using a first hash function. The processor of the registration device obtains a second hash value for a value based on the first hash value and the pseudo-random number using a second hash function that outputs a hash value of a predetermined number of bits or less or a predetermined value or less. The processor of the registration machine calculates the first exclusive OR of the second hash value and the i-th bit of the number to be registered. The processor of the registration machine generates the encrypted data to be registered, which includes the pseudo-random number and the first exclusive OR calculated. The processor of the registration machine transmits the encrypted data to be registered to the data comparison machine. The aforementioned data comparator stores the encrypted data to be registered, For each of the j-th bits of the aforementioned numerical value to be compared, The processor of the viewing device extracts the second bit sequence from the nth bit to the jth bit of the n bits representing the numerical value to be compared, The processor of the viewing device obtains a third bit sequence obtained by inverting the j-th bit of the second bit sequence, The processor of the browsing device obtains a third hash value for the value based on the acquired third bit sequence and the secret key, using the first hash function. The processor of the viewing device generates an encrypted query that includes each of the acquired third hash values. The processor of the viewing machine transmits the generated encrypted query to the data comparator. The processor of the data comparator performs a comparison process for each variable k that is between 1 and n, In the comparison process for the variable k, The processor of the data comparator obtains a fourth hash value for a value based on the third hash value stored at the k-th position of the encryption query and the pseudo-random number stored in the encrypted data to be registered, using the second hash function. The processor of the data comparator calculates the second exclusive OR of the acquired fourth hash value and the first exclusive OR stored at the k-th position of the encrypted data to be registered. An encrypted data comparison method wherein the processor of the data comparator outputs a comparison result showing the magnitude relationship between the registered numerical value and the comparison numerical value based on the second exclusive OR.

10. A program set comprising one or more programs that cause the encrypted data comparison system to execute the encrypted data comparison method described in claim 9, The first common program is executed on the registration machine, the viewing machine, and the data comparison machine, A second common program that runs on two of the devices among the registration machine, the viewing machine, and the data comparator, and a program for the remaining device among the registration machine, the viewing machine, and the data comparator, or A program set comprising a first program for the registration machine, a second program for the viewing machine, and a third program for the data comparison machine.

11. A data comparison machine, Equipped with a processor and memory, The memory holds the encrypted data to be registered, generated from the numerical value to be registered, and the encrypted query generated from the numerical value to be compared. The aforementioned registered numerical value and the aforementioned comparison numerical value are represented by n bits with or without a predetermined padding operation. In generating the encrypted data to be registered, encryption processing is performed on each of the i-th bits of the numerical value to be registered. In the encryption process for the i-th bit, Of the n bits representing the numerical value to be registered, the first bit sequence from the nth bit to the ith bit is extracted. A first hash value for the value based on the extracted first bit sequence and a predetermined secret key is obtained using a first hash function. The second hash value for the value based on the first hash value and a pseudorandom number is obtained using a second hash function that outputs a hash value of less than or equal to a predetermined number of bits or a predetermined value. The first exclusive OR of the second hash value and the i-th bit of the number to be registered is calculated. The encrypted data to be registered includes the pseudo-random number and the first exclusive OR calculated, In generating the aforementioned encryption query, for each of the j-th bits of the numerical value to be compared, Of the n bits representing the comparison target value, the second bit sequence from the nth bit to the jth bit is extracted. The third bit sequence is obtained by inverting the j-th bit of the second bit sequence. A third hash value for the value based on the acquired third bit sequence and the secret key is obtained using the first hash function. The encryption query includes each of the obtained third hash values, The aforementioned processor, Perform a comparison process for each variable k that is between 1 and n (inclusive). In the comparison process for the variable k, A fourth hash value is obtained using the second hash function, based on the third hash value stored at the k-th position of the encryption query and the pseudo-random number stored in the encryption data to be registered. The second exclusive OR of the obtained fourth hash value and the first exclusive OR stored at the k-th position of the encrypted data to be registered is calculated. A data comparator that outputs a comparison result showing the magnitude relationship between the registered numerical value and the comparison numerical value, based on the second exclusive OR operation.

Images