Verification device, verification method, and verification program

Abstract

To provide a verification device, a verification method and a verification program which can verify validity of an actual algorithm that derives a processing result for the processing result provided on the basis of input from a user.SOLUTION: A verification server 1 comprises: a reception unit 11 which receives from each terminal 3 of a user who acquires a result processed by an execution server on the basis of input data of the user, the result and the input data being the source of the result in a state of being encrypted in a homomorphic encryption method; a determination unit 12 which executes a processing algorithm of the execution server 2 that has been defined in advance on the basis of the input data in the homomorphic encryption method and calculates determination information in which a value indicating whether the execution result matches with the received result is encrypted; and a transmission unit 13 which transmits the determination information to the terminal 3 and causes the terminal 3 to decrypt the determination information to notify whether the processing algorithm of the execution server 2 is valid.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a system for verifying the authenticity of a service based on an input from a user. [Background technology]

[0002] The optimization problem of matching in a bipartite graph has long been studied as a mathematical model of the job matching problem for allocating workers to jobs. Matching that optimizes overall satisfaction is reduced to a minimum flow problem in a weighted minimal complete bipartite graph. The stable marriage problem in Non-Patent Document 1 is a problem that adopts the concept of stability to this matching, and stable matching can be found in O(n 2 An algorithm has been proposed to find the

[0003] Various extension problems have been considered for the stable marriage problem, and fairness is one area of ​​extension problems. The stable matching found by the algorithm in Non-Patent Document 1 is the optimal matching for either the man or the woman, and the optimization of the overall cost was not taken into consideration. Therefore, optimization problems that extend the stable marriage problem, such as minimum-cost stable matching, minimum-regret stable matching (Non-Patent Document 2), and gender-equality stable matching (Non-Patent Document 3), have been studied. These problems aim for fairness in the sense of global optimization. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] D. Gale and LS Shapley. College admissions and the stability of marriage. The American Mathematical Monthly, Vol. 69, pp. 9-15, 1962. [Non-Patent Document 2] RW Irving, P. Leather, and D. Gusfield. An efficient algorithm for the "optimal" stable marriage. Journal of the ACM, Vol. 34, No. 3, pp. 532-543, 1987. [Non-Patent Document 3] A. Kato. Complexity of the sex-equal stable marriage problem. Japan Journal of Industrial and Applied Mathematics, Vol. 10, pp. 1-19, 1993. [Non-Patent Document 4] Zvika Brakerski and Renen Perlman. Lattice-based fully dynamic multi-key FHE with short ciphertexts. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Vol. 9814, No. 468, pp. 190-213, 2016. Summary of the Invention [Problem to be solved by the invention]

[0005] Although the above fairness problems have in common the sense of global optimization, different fairness criteria are defined for each problem. It is also possible to define fairness in an individualistic sense that is not necessarily stable overall.

[0006] For example, when a matching service employing some evaluation criterion is provided, even if the service's policy is presented, the user has no way of being sure of what policy the matching results he or she is receiving are based on. Similarly, it has been difficult to verify whether the actual processing algorithms of any service based on user input, not limited to matching services, violate any policy presented in advance.

[0007] An object of the present invention is to provide a verification device, a verification method, and a verification program that can verify the validity of an actual algorithm that derives a processing result provided based on an input from a user. [Means for solving the problem]

[0008] The verification device of the present invention comprises a receiving unit that receives, from each user terminal that has obtained the results processed by an execution server based on user input data, the results and the input data on which the results are based, in a state encrypted using a homomorphic encryption method; a judgment unit that uses the homomorphic encryption method to execute a pre-defined processing algorithm of the execution server based on the input data and calculates judgment information in the form of an encrypted value indicating whether the execution result matches the received result; and a transmitting unit that transmits the judgment information to the user terminal and has the user terminal decrypt the judgment information, thereby notifying whether the processing algorithm of the execution server is legitimate or not.

[0009] The processing algorithm may be a matching algorithm in which the input data is the preference order of each of the users, and the determination information may be an encrypted value indicating whether or not the matching result based on the preference order is the result of execution of a legitimate algorithm.

[0010] The verification method of the present invention is carried out by a computer, and includes the steps of: receiving, from each user terminal that has obtained results processed by an execution server based on user input data, the results and the input data on which the results are based, in a state encrypted using a homomorphic encryption method; executing a pre-defined processing algorithm of the execution server based on the input data using the homomorphic encryption method, and calculating judgment information in the form of an encrypted value indicating whether the execution result matches the received result; and transmitting the judgment information to the user terminal and having the user terminal decrypt the judgment information, thereby notifying whether the processing algorithm of the execution server is legitimate.

[0011] A verification program according to the present invention causes a computer to function as the verification device. Effect of the Invention

[0012] According to the present invention, for a processing result provided based on an input from a user, the validity of the actual algorithm that derived this processing result can be verified. [Brief description of the drawings]

[0013] [Figure 1] 1 is a diagram showing an overall configuration of a verification system that implements a verification method in an embodiment, and an overview of the service. [Diagram 2] FIG. 2 is a diagram illustrating a functional configuration of a validation server according to an embodiment. [Diagram 3] 1 is a sequence diagram showing a verification method performed by a verification system in an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] An example of an embodiment of the present invention will now be described. In this embodiment, a male-female matching service is exemplified as a service used by a user. For example, if a service presents itself as being an individualistically fair matching service, but actually outputs results based on a different policy, such as globally optimal matching or stable matching, the verification method of this embodiment detects a violation of the policy.

[0015] The verification method of the present embodiment can also be applied to similar matching services such as job matching, or to use cases other than matching, where a user provides input and the processing on the server is a deterministic algorithm.

[0016] Here, totalitarian fairness and individualistic fairness in the matching service handled in this embodiment are defined as follows: Note that it is assumed that the preference order of each of the two sets (male set, female set) to be matched is specified by the other set.

[0017] First, there are a set of men M and a set of women W of the same size n, and their matching is called X. For simplicity, we will only consider the case where there are n one-to-one pairs. Each person has a preference order for all members of the other gender.

[0018] In matching X, when male m and female w are a pair, let X(m)=w, X(w)=m. Also, for male m and female w, P m Let (w) be the rank of w in m's preference ordering, and similarly, P w Let (m) be the ranking of m in w's preference ordering.

[0019] In this case, the overall satisfaction of the matching can be evaluated, for example, by the following cost function C, and holistic fairness can be defined as follows:

[0020] Definition 1.Let X be a matching that minimizes C(X) and is holistically fair. C(X)=Σ (m,w)∈X (P m (w)+Pw (m)

[0021] In contrast, individualistic fairness can also be considered as follows: G(m)=Σ wi∈W P wi Let (m) be the excellence of m. The smaller the value of the excellence G(m), the higher the evaluation from the female group W. Similarly, G(w) = Σ mi∈M P mi Let (w) be the superiority of w. Let O(m) be the rank of man m when the set of men M is sorted in ascending order of their superiority G(m), and call this the superiority rank. Similarly, let O(w) be the superiority rank of woman w when the set of women W is sorted in ascending order of their superiority G(w). Here, for a set H, let us define a subset with a lower ranking than p as H <p Then, individualistic fairness can be defined as follows:

[0022] Definition 2. For all m ∈ M and w ∈ W, (1) For all m′∈M <O(m) About P m (X(m))≦P m′ (X(m′)) (2) For all w′∈W <O(w) About P w (X(w))≦P w′ (X(w′)) If this holds, then we say that the matching X is individualistically fair.

[0023] However, an individualistically fair matching that satisfies the conditions of Definition 2 does not necessarily exist for any preference ordering. In addition, there may be a matching that satisfies individualistic fairness but significantly impairs global optimality. Therefore, it is possible to relax the conditions and define it as follows, such as allowing a person who is within the bottom k rankings of oneself to be matched with a person who is ranked higher in the preference order than oneself, or, if the difference in the preference order between two people and their matched partner is l or less, then it is considered that there is no difference and is acceptable.

[0024] Definition 3. For all m ∈ M and w ∈ W, (1) For all m′∈M <O(m)+k About P m (X(m))≦P m′ (X(m′))+l (2) For all w′∈W <O(w)+k About P w (X(w))≦P w′ (X(w′))+l If this holds, then we say that the matching X is (k, l)-individualistically fair.

[0025] In the definitions 1 and 2, the conditions are defined to include the case where the rankings in the preference order are equal, but the conditions are not limited to this and may be stricter conditions that exclude the case where the rankings are equal (changing ≦ to <). In this case, too, the conditions can be relaxed by appropriately setting k or l in the definition 2.

[0026] The requirements for detecting a policy violation using the verification method of this embodiment are as follows. If the matching process performed by the matching server does not match the presented policy, the user can detect it. - The user's preference order is not known to anyone other than the matching server.

[0027] FIG. 1 is a diagram showing the overall configuration of a verification system 100 that implements a verification method according to this embodiment, and an overview of the service. The verification system 100 includes a verification server 1, an execution server 2 that provides a matching service, and a terminal 3 for each of a plurality of users.

[0028] In this verification method, a verification server 1 is provided to verify the processing algorithm. The verification server 1 is assumed to be semi-honest and is interested in the user's preference order, but will not perform any processing other than the predetermined processing. The purpose of the malicious execution server 2 is to perform a matching process that differs from the presented policy without being detected by the user. It is also assumed that the users do not include malicious individuals and will not perform any processing other than the predetermined processing, such as providing false input.

[0029] A user (terminal 3) sends his / her preference order to the execution server 2 (1). The execution server 2 sends matching results based on the received preference order to each user's terminal 3 (2). The user's terminal 3 that has received the matching result sends the encrypted preference order and the matching result by fully homomorphic encryption to the verification server 1 (3). The verification server 1 performs the presented matching process on the encrypted preference order, compares the result with the encrypted matching result received from the user, and sends the encrypted comparison result to the user's terminal 3 (4).

[0030] Here, fully homomorphic encryption is encryption that allows arbitrary calculations to be performed while keeping the data encrypted, and is defined as follows (see, for example, Non-Patent Document 4).

[0031] Definition 4: Fully homomorphic encryption HE is a quintuple of algorithms (Setup, Keygen, Enc, Dec, Eval) that satisfy correctness, simplicity, and security. Setup param←Setup(1 λ ): Output the public parameter param. ·Key generation (pk,sk)←Keygen(param): Output the public encryption key pk and the private decryption key sk. ·Encryption c←Enc(pk,μ): Encrypt message μ∈{0,1} using public key pk and output ciphertext c. ·Decoding μ←Dec(sk,c): Decrypt the ciphertext c using the private key sk and output the message μ. ·Homomorphic operation c^←Eval(C,(c1,…,c l ),pk): Using the public key pk, c1,…,c l For any circuit C:{0,1} l →Apply {0,1} and output the ciphertext c^.

[0032] Note that correctness refers to the property that ciphertext obtained by an encryption algorithm and a homomorphic computation algorithm can be correctly decrypted. Simplicity refers to the property that the size of the ciphertext after homomorphic computation does not depend on the size of the circuit. Security refers to the property that the success rate of an attack by an arbitrary attacker is negligibly small. It is obvious that if homomorphic operations are possible for any circuit, then it is possible to construct fully homomorphic encryption that is homomorphic for any algorithm. Therefore, we will redefine fully homomorphic encryption as follows. Hereinafter, when we talk about fully homomorphic encryption, the following definition will apply.

[0033] Definition 5. Fully homomorphic encryption HE is a quintuple of algorithms (Setup, Keygen, Enc, Dec, Eval) that satisfy correctness, simplicity, and security. Setup param←Setup(1 λ ): Output the public parameter param. ·Key generation (pk,sk)←Keygen(param): Output the public encryption key pk and the private decryption key sk. ·Encryption c←Enc(pk,μ): Encrypt an arbitrary message μ using the public key pk and output the ciphertext c. ·Decoding μ←Dec(sk,c): Decrypt the ciphertext c using the private key sk and output the message μ. ·Homomorphic operation c^←Eval(A,(c1,…,c l ),pk): Using the public key pk, c1,…,c l Apply any algorithm A to , and output the ciphertext c^.

[0034] FIG. 2 is a diagram showing a functional configuration of the validation server 1 (validation device) in this embodiment. The validation server 1 is a server device equipped with a control unit 10, a storage unit 20, various data input / output devices, communication devices, etc., but can be replaced with various information processing devices (computers) such as a personal computer.

[0035] The control unit 10 is a part that controls the entire validation server 1, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

[0036] The storage unit 20 is a storage area for various programs for causing the hardware group to function as the validation server 1, various data, and the like, and may be a ROM, a RAM, a flash memory, a hard disk drive (HDD), or the like. Specifically, the storage unit 20 stores a program (verification program) for causing the control unit 10 to execute each function of this embodiment, as well as encrypted data such as verification request data from a user and verification results.

[0037] Here, the verification program may be pre-installed with the matching algorithm to be executed by the execution server 2. Alternatively, data specifying the algorithm may be stored separately and referenced by the verification program. In this case, the data is appropriately rewritten or selected according to the matching policy (e.g., holistic fairness, individualistic fairness, etc.), thereby providing versatility that can be used with a variety of services.

[0038] The control unit 10 includes a receiving unit 11, a determining unit 12, and a transmitting unit 13. The receiving unit 11 receives from each terminal 3 (user terminal) that has obtained the results processed by the execution server 2 based on the user's input data, the results and the input data on which the results were derived, in a state encrypted using a homomorphic encryption method.

[0039] The judgment unit 12 executes a predefined processing algorithm of the execution server 2 based on the received input data using a homomorphic encryption method, and calculates judgment information in the form of an encrypted value indicating whether the execution result matches the received result.

[0040] The transmission unit 13 transmits the determination information calculated by the determination unit 12 to the terminal 3, and causes the terminal 3 to decode the determination information, thereby notifying the terminal 3 of whether the processing algorithm of the execution server 2 is valid or not.

[0041] FIG. 3 is a sequence diagram showing a verification method performed by the verification system 100 in this embodiment. Here, the processing of the execution server 2 is not limited to matching, but is generalized to any predefined processing.

[0042] n users {u1,…,u n} is using the service of execution server 2. Each user can use the inputs {m1,…,m n}. Note that the algorithm A to be executed by the execution server 2 is given in advance, and A is a deterministic algorithm.

[0043] In step S1, a user representative (any terminal 3A) executes Setup(1 λ ) to get the parameter param and publish it.

[0044] In step S2, terminal 3A executes Keygen(param) and obtains (pk, sk). Terminal 3A publishes pk and distributes sk to terminals 3 of all users.

[0045] In step S3, each user ui Terminal 3 of m i is sent to execution server 2 using a secure communication channel.

[0046] In step S4, the execution server 2 calculates r′←A′(m1, ..., m n ) and sends r' to all users' terminals 3.

[0047] In step S5, each user u i Terminal 3 of c i ←Enc(pk,m i ∥r′) is sent to the verification server 1 using a secure communication channel, where ∥ represents the concatenation of strings.

[0048] In step S6, the validation server 1 executes the following: x←Eval(A V ,(c1,…,c n ), pk) and send x to all users' terminals 3. Here, Algorithm A V is as follows: (a)m i Divide r′ and r′. (b) r = A(m1,…,m n ) to run (c) If r = r', output 1; if r ≠ r', output 0.

[0049] In step S7, each user u i The terminal 3 executes Dec(x,sk), and if it is 1, the user can be sure that the execution server 2 has executed the algorithm A.

[0050] In the matching process, the preference order, matching algorithm, and matching result of each user are encoded as m, A, and r, respectively. This procedure allows users to detect policy violations.

[0051] According to this embodiment, the verification system 100 encrypts the processing result provided to the user from the execution server 2 together with the input data on which the result was derived using homomorphic encryption and transmits the encrypted result to the verification server 1. The verification server 1 outputs determination information in the form of an encrypted value obtained by comparing the result of a correct processing algorithm executed based on the input data using homomorphic encryption with the received processing result. The terminal 3 can verify whether the processing result of the execution server 2 is valid by decrypting this determination information. Therefore, the verification server 1 can provide the terminal 3 with judgment information capable of verifying the validity of the actual algorithm that derived the processing result provided by the execution server 2 based on the user's input. As a result, if the processing performed by the execution server 2 does not match the presented policy, the user can detect this. At this time, by using homomorphic encryption, the user's input data is not known to anyone other than the execution server 2.

[0052] This will enable, for example, a third party to verify the legitimacy of services provided over the Internet, making it possible to contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "Build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0053] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0054] The verification method by the verification server 1 is realized by software. When realized by software, a program constituting this software is installed in an information processing device (computer). These programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded. [Explanation of symbols]

[0055] 1. Verification server (verification device) 2. Execution Server 3. Terminal (user terminal) 10 Control section 11 Receiving section 12 Judgment section 13 Transmitter 20 Memory section 100 Verification System

Claims

1. a receiving unit that receives, from each user terminal that has acquired a result of processing performed by the execution server based on user input data, the result and the input data on which the result is based, in a state encrypted by a homomorphic encryption method; a determination unit that executes a predefined processing algorithm of the execution server based on the input data by the homomorphic encryption method and calculates determination information in which a value indicating whether or not an execution result matches the received result is encrypted; a transmission unit that transmits the determination information to the user terminal and causes the user terminal to decode the determination information, thereby notifying the user terminal of whether or not the processing algorithm of the execution server is valid.

2. the processing algorithm is a matching algorithm in which the input data is a preference order of each of the users; 2. The verification device according to claim 1, wherein the determination information is an encrypted value indicating whether or not the matching result based on the preference order is a result of execution by a legitimate algorithm.

3. A computer comprising: a receiving unit receiving, from each user terminal that has acquired a result of processing performed by the execution server based on user input data, the result and the input data on which the result is based, in a state encrypted by a homomorphic encryption scheme; a determination unit that executes a predefined processing algorithm of the execution server based on the input data by the homomorphic encryption method, and calculates determination information in which a value indicating whether or not an execution result matches the received result is encrypted; A verification method in which a transmission unit transmits the determination information to the user terminal and causes the user terminal to decode the determination information, thereby notifying the user terminal of whether or not the processing algorithm of the execution server is valid.

4. A verification program for causing a computer to function as the verification device according to claim 1 or 2.

Images