Secret random number calculation system, secret random number calculation device, secret random number calculation method, secret cluster calculation system, secret cluster calculation device, secret cluster calculation method, and program

Abstract

The present invention provides a technology for secretly calculating a random number generation method that uses a weighted probability with high precision and with data obfuscated. The present invention includes: a first vector calculation means that uses a prefix sum to calculate a share ([[p'1]], …, [[p'L]]) from a share ([[p1]], …, [[pL]]); a uniform random number generation means that generates a share ([[q1]], …, [[qS]]) of a vector (q1, …, qS) having uniform random numbers as elements (where qi(i=1, …, S) are uniform random numbers, and satisfy 0 ≤ qi ≤ 1); and a random number calculation means that uses secret bulk mapping to calculate a share ([[r1]], …, [[rS]]) of a vector (r1, …, rS) having output values as elements from a share ([[p'1]], …, [[p'L]]), a share ([[x1]], …, [[xL]]), and a share ([[q1]], …, [[qS]]).

Description

[Technical field]

[0001] The present invention relates to a secure computation technique, and more particularly to a technique for securely computing random numbers that can be used in the k-means++ algorithm. [Background technology]

[0002] As a technique for classifying multiple data, there is a technique for classifying similar data into one cluster (hereinafter referred to as a clustering technique). Examples of clustering techniques include the k-means method described in Non-Patent Document 1 and the k-means++ method described in Non-Patent Document 2.

[0003] Secure computation is a method of obtaining the result of a specified computation without restoring an encrypted numerical value (see, for example, Reference Non-Patent Document 1). In the method of Reference Non-Patent Document 1, encryption is performed by distributing a plurality of pieces of information that can restore a numerical value to three secure computing devices, and the results of addition / subtraction, constant sum, multiplication, constant multiplication, logical operations (negation, logical product, logical sum, exclusive logical sum), and data format conversion (integer, binary number) can be held in a distributed state, i.e., encrypted state, in the three secure computing devices without restoring the numerical value. In general, the number of shares is not limited to 3 and can be W (W is a predetermined constant equal to or greater than 3), and a protocol that realizes secure computation by cooperative computation by W secure computing devices is called a multi-party protocol.

[0004] (Reference Non-Patent Document 1: Koji Senda, Hiroki Hamada, Dai Igarashi, Katsumi Takahashi, “Rethinking Lightweight Verifiable Three-Party Secure Function Computation,” In CSS, 2010.) [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] John A Hartigan and Manchek A Wong, “Algorithm AS 136: A K-Means Clustering Algorithm,” Journal of the Royal Statistical Society. Series C(Applied Statistics), Vol.28, No.1, pp.100-108, 1979. [Non-Patent Document 2] David Arthur and Sergei Vassilvitskii, “k-means++: the advantages of careful seeding,” Technical report, Stanford University, 2006. Summary of the Invention [Problem to be solved by the invention]

[0006] It is said that the generation of clusters in the k-means method is highly dependent on how the initial values ​​are given. Therefore, if completely random initial values ​​are given to generate clusters, desirable results may not be obtained. Therefore, in the plaintext k-means method, initial values ​​are generated using the k-means++ method, which is more likely to obtain better results than if completely random initial values ​​were given.

[0007] However, no method has been proposed to perform secure computation of the k-means++ algorithm, because no random number generation method using a weighted probability distribution that can be used with the k-means++ algorithm has been proposed.

[0008] Therefore, an object of the present invention is to provide a technique for securely computing a random number generation method using a highly accurate weighted probability distribution while keeping data secret. [Means for solving the problem]

[0009] In one aspect of the present invention, L and S are integers equal to or greater than 1, and the system is configured with three or more secret random number calculation devices, and a vector (x1, ..., x L ) shares ([[x1]], …, [[x L ]]) and a vector (p1, …, p L ) (where p i (i=1, …, L) is the output candidate value x i is the output probability, and Σp i =1) ([[p1]], …, [[p L ]]) to a vector (r1, …, r S ) (where r i (i=1, …, S) are the output candidate values ​​x1, …, x L ) share ([[r1]], …, [[r S A secret random number calculation system for computing a vector (p1, …, p L ) shares ([[p1]], …, [[p L ]]) to ([[p'1]], …, [[p' L ]])=prefix_sum(([[p1]], …, [[p L ]])) gives the vector (p'1, …, p' L ) shares ([[p'1]], …, [[p' L a first vector calculation means for calculating a vector (q1, …, q S ) (where q i (i=1, …, S) are uniform random numbers, 0≦q i ≦1) of shares ([[q1]], …, [[q S A uniform random number generator generating a vector (p'1, …, p' L ) shares ([[p'1]], …, [[p' L ]]) and vector (x1, …, x L ) shares ([[x1]], …, [[x L ]]) and vector (q1, …, q S ) share ([[q1]], …, [[q S]]), so ([[r1]], …, [[r S ]]) = map(([[p'1]], …, [[p' L ]]), ([[x1]], …, [[x L ]]), ([[q1]], …, [[q S ]])) to generate a vector (r1, …, r S ) shares ([[r1]], …, [[r S and a random number calculation means for calculating a random number Effect of the Invention

[0010] According to the present invention, it is possible to perform secure computation of a random number generation method using a weighted probability distribution with high accuracy while keeping data secret. [Brief description of the drawings]

[0011] [Figure 1] FIG. 13 is a diagram illustrating a groupBySum operation. [Diagram 2] FIG. 13 is a diagram illustrating a groupByCount operation. [Diagram 3] FIG. 13 is a diagram illustrating an example of a cluster ID table. [Figure 4] FIG. 13 is a diagram illustrating an example of a data table. [Diagram 5] FIG. 13 is a diagram illustrating an example of a centroid table. [Figure 6] FIG. 11 is a diagram illustrating an example of a distance table. [Figure 7] 1 is a block diagram showing a configuration of a secret random number calculation system 10. FIG. [Figure 8] FIG. 2 is a block diagram showing a configuration of a secret random number calculation device 100i. [Figure 9] 4 is a flowchart showing the operation of the secret random number calculation system 10. [Figure 10] FIG. 2 is a block diagram showing the configuration of a secret cluster calculation system 20. [Figure 11] FIG. 2 is a block diagram showing the configuration of a secret cluster computing device 200i. [Figure 12]4 is a flowchart showing the operation of the secret cluster computing system 20. [Figure 13] FIG. 2 is a block diagram showing a configuration of a centroid table initialization unit 210i. [Figure 14] 13 is a flowchart showing the operation of the centroid table initialization means 210. [Figure 15] FIG. 2 is a diagram illustrating an example of a functional configuration of a computer that realizes each device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the present invention will be described in detail. Note that components having the same functions are given the same reference numbers and duplicated explanations will be omitted.

[0013] Before describing each embodiment, the notation used in this specification will be described.

[0014] ^ (caret) represents a superscript. For example, x y^z Yes z is a superscript to x, and x y^z Yes z is a subscript to x. Also, _ (underscore) represents a subscript. For example, x y_z Yes z is a superscript to x, and x y_z Yes z is a subscript on x.

[0015] The superscripts "^" and "~" such as ^x and ~x for a certain letter x should actually be written directly above the "x", but due to the constraints of the description in the specification, they are written as ^x and ~x.

[0016] <Technical background> <<Secure calculation>> The secure computation in the present invention is constructed by combining existing secure computation operations. The operations required for this secure computation are concealment, addition, subtraction, multiplication, division, logical operations (negation, logical AND, logical OR, exclusive OR), comparison operations (=, <, >, ≦, ≧), secure sorting, secure unique check, Group-by operation, prefix_sum, and secure batch mapping. Some of the operations, including their notations, will be explained below.

[0017] [Redacted] Let [[x]] be the value of x concealed by secret sharing (hereafter, called the share of x). Any method can be used for the secret sharing method. For example, in GF(2 61 -1) Shamir secret sharing on Z2 and replication secret sharing on Z2 can be used.

[0018] A single algorithm may use multiple secret sharing methods in combination. In this case, they will be converted between each other as appropriate.

[0019] Also, N-dimensional vector → x=(x1, …, x N ), [[ → x]]=([[x1]], …, [[x N ]]). That is, [[ → x]] is → The nth element of x n Share[[x n Similarly, M×N matrix A=(a m,n )(1≦m≦M, 1≦n≦N), [[A]] is the (m, n)th element a of A. m,n Share of [[a m,n Let ]] be the (m, n)th element of the matrix.

[0020] Note that x is called the plaintext of [[x]].

[0021] Specific examples of a method for obtaining [[x]] from x (concealment) and a method for obtaining x from [[x]] (restoration) are described in Reference Non-Patent Document 1 and Reference Non-Patent Document 2.

[0022] (Reference non-patent document 2: Shamir, A., “How to share a secret”, Communications of the ACM, Vol. 22, No. 11, pp. 612-613, 1979.) [Addition, Subtraction, Multiplication, Division] Secure addition [[x]]+[[y]] takes [[x]] and [[y]] as input and outputs [[x+y]]. Secure subtraction [[x]]-[[y]] takes [[x]] and [[y]] as input and outputs [[xy]]. Secure multiplication [[x]]×[[y]] (sometimes expressed as mul([[x]], [[y]])) takes [[x]] and [[y]] as input and outputs [[x×y]]. Secure division [[x]] / [[y]] (sometimes expressed as div([[x]], [[y]])) takes [[x]] and [[y]] as input and outputs [[x / y]].

[0023] Specific methods for addition, subtraction, multiplication, and division include those described in Reference Non-Patent Documents 3 and 4.

[0024] (Reference non-patent document 3: Ben-Or, M., Goldwasser, S. and Wigderson, A., “Completeness theorems for non-cryptographic fault-tolerant distributed computation”, Proceedings of the twentieth annual ACM symposium on Theory of computing, ACM, pp. 1-10, 1988.) (Reference Non-Patent Document 4: Gennaro, R., Rabin, MO and Rabin, T., “Simplified VSS and fast-track multiparty computations with applications to threshold cryptography”, Proceedings of the seventeenth annual ACM symposium on Principles of distributed computing, ACM, pp.101-111, 1998.) N-dimensional vector → x=(x1, …, x N ) share [[ → x]]=([[x1]], …, [[x N ]]), an N-dimensional vector → y = (y1, …, y N ) share [[ → y]]=([[y1]], …, [[y N ]]), division by secret computation [[ → x]] / [[ → y]] to [[ → x / → y]]=([[x1 / y1]], …, [[x N / y N ]]). Note that [[ → x]] / [[ → y]] to [[ → x]] to [[ → It is also called the value divided by y.

[0025] [Logical operations] The secret calculation of negation not[[x]] takes [[x]] as input and outputs [[not(x)]]. The secret calculation of logical conjunction and([[x]], [[y]]) takes [[x]], [[y]] as input and outputs [[and(x, y)]]. The secret calculation of logical disjunction or([[x]], [[y]]) takes [[x]], [[y]] as input and outputs [[or(x, y)]]. The secret calculation of exclusive disjunction xor([[x]], [[y]]) takes [[x]], [[y]] as input and outputs [[xor(x, y)]].

[0026] Note that logical operations can be easily constructed by combining addition, subtraction, multiplication, and division.

[0027] [Comparison Operations] The secret calculation of equality check =([[x]], [[y]]) (sometimes denoted as equal([[x]], [[y]])) takes [[x]], [[y]] as input and outputs [[1]] if x = y, and [[0]] otherwise. The secret calculation of comparison <([[x]], [[y]]) takes [[x]], [[y]] as input and outputs [[1]] if x < y, and [[0]] otherwise. The secret calculation of comparison >([[x]], [[y]]) takes [[x]], [[y]] as input and outputs [[1]] if x > y, and [[0]] otherwise. The secret calculation of comparison ≦([[x]], [[y]]) takes [[x]], [[y]] as input and outputs [[1]] if x ≦ y, and [[0]] otherwise. The secret calculation of comparison ≧([[x]], [[y]]) takes [[x]], [[y]] as input and outputs [[1]] if x ≧ y, and [[0]] otherwise.

[0028] Note that comparison operations can be easily constructed by combining logical operations.

[0029] [Secret Sorting] Secret sorting is for N-dimensional vectors → x=(x1, …, x N) share [[ → x]] as input, [[ → x]]'s elements [[x1]], …, [[x N Vector sort([[ → x]]):=([[x i_1 ]], …, [[x i_N ]]) (where x i_1 , …, x i_N x i_1 ≦x i_2 ≦ … ≦x i_N In addition, for a table T in which each element of an arbitrary attribute is concealed, a table obtained by secretly sorting table T using attribute α of table T as a key is defined as a table in which the values ​​of the elements of attribute α are rearranged for each record so that they are in ascending order starting from the first record.

[0030] A specific method for secret sorting is described in Reference Non-Patent Document 5.

[0031] (Reference Non-Patent Document 5: Dai Igarashi, Hiroki Hamada, Ryo Kikuchi, Koji Senda, “Design and Implementation of Ultra-High-Speed ​​Secure Computation Sorting: The Day Secure Computation Stands on Top of Scripting Languages,” Computer Security Symposium (CSS), 2017.) [Secret Unique Check] The secret unique check is an N-dimensional vector → x=(x1, …, x N ) share [[ → x]] as input, [[ → x]]'s elements [[x1]], …, [[x N If the same value appears more than once in [[ ]], the first occurrence is replaced with [[1]], and the second and subsequent occurrences are replaced with [[0]]. → x]]):=([[x i_1 ]], …, [[x i_N ]]) (where x i_1 , …, x i_Nis either 1 or 0). For example, performing a secret unique check on the vector ([[1]], [[2]], [[2]], [[3]], [[3]], [[3]]) yields ([[1]], [[1]], [[0]], [[1]], [[0]], [[0]]).

[0032] Note that the secret unique check can be easily implemented by combining secret sorting and comparison operations.

[0033] [Group-by operation] A group-by operation is an operation that obtains a statistical value (e.g. average height by gender) grouped by the element values ​​of the key attribute when a table has a key attribute (e.g. gender) and a value attribute (e.g. height) and each element of any attribute of the table is masked. A groupBySum operation is when the statistical value calculated is a total, and a groupByCount operation is when the statistical value calculated is a frequency.

[0034] FIG. 1 is a diagram showing an example of a groupBySum operation. As can be seen from the example in FIG. 1, in a table showing the results of a groupBySum operation, the element values ​​of the key attribute are sorted in ascending order from the first record, and for each element value of the key attribute, the sum of the elements of value attribute 1 and the sum of the elements of value attribute 2 are calculated. FIG. 2 is a diagram showing an example of a groupByCount operation. As can be seen from the example in FIG. 2, in a table showing the results of a groupByCount operation, the element values ​​of the key attribute are sorted in ascending order from the first record, and for each element value of the key attribute, the number of elements of value attribute 1 and the number of elements of value attribute 2 are calculated.

[0035] A specific method of the Group-by operation is described in Non-Patent Document 6.

[0036] (Reference Non-Patent Document 6: Ryo Kikuchi, Hiroki Hamada, Dai Igarashi, Hajime Takahashi, Katsumi Takahashi, "Let's try cross-sectional movement analysis using secret computation", 2020 Symposium on Cryptography and Information Security, 3C2-1, 2020.) The Group-by operation disclosed in Reference Non-Patent Document 6 efficiently performs various Group-by operations by using an operation called groupByCommon.

[0037] [prefix_sum] prefix_sum is an N-dimensional vector → x=(x1, …, x N ) share [[ → x]] is the input, and → y share [[ → y]]=([[y1]], …, [[y N ]]) (where y i =Σ j=1 i x j ) to output.

[0038] [Secret Bulk Map] The secret batch map is a function that calculates a lookup table, and the two vectors used to define the lookup table can be determined arbitrarily. Since the secret batch map processes on a vector basis, it has the property of being efficient when performing the same processing on multiple inputs. The secret batch map is a function map defined as follows:

[0039] The secret lump map is the vector → a = (a1, …, a K ) share [[ → a]]=([[a1]], …, [[a K ]]) and vector → b = (b1, …, b K ) share [[ → b]]=([[b1]], …, [[b K ]]) (where a1, …, a K , b1, …, b K are real numbers, and a1<… K ) and the vector → x=(x1, …, x N ) share [[ → x]]=([[x1]], …, [[x​N ) and → map the shares of each element of the vector p x, that is, for 1 ≤ n ≤ N, a n ≤ x p+1 and y n = b p such that → y]] := ([[y1]], …, [[y N ) is output. At this time, → y]] = map( → a]], → b]], → x]]). Note that the vector → a and the vector → b are two vectors used in the definition of the lookup table. For example, if the shares of the two vectors → a, → b used in the definition of the lookup table are ([[]50]], [

[80] ], [

[0100] ]), ([[1]], [[2]], [[3]]) respectively, then map(([

[50] ], [

[80] ], [

[0100] ]), ([[1]], [[2]], [[3]]), ([[5]], [

[68] ], [

[91] ])) = ([[1]], [[2]], [[3]]).

[0040] As the batch secret mapping, for example, the algorithm described in Reference Non-Patent Document 7 can be used.

[0041] (Reference Non-Patent Document 7: Hiroki Hamada, Dai Igarashi, Koji Chida, "Batch Mapping Algorithm for Secure Computation", Transactions of the Institute of Electronics, Information and Communication Engineers A, Vol. J96-A, No. 4, pp. 157-165, 2013.) <<k-means method>> The k-means method is one of the machine learning methods classified as unsupervised learning. In supervised learning such as regression analysis and classification, the goal is to prepare a desired output (called training data) and build a model that reproduces that output with high accuracy, whereas in unsupervised learning such as clustering, the desired output is not determined in advance.

[0042] In clustering, the distance between multiple given data is calculated, and data with close distances is grouped into clusters as similar data. There are two types of clustering: non-hierarchical methods, such as the k-means method, in which the number of clusters to be generated is determined in advance, and hierarchical methods, in which the number of clusters to be generated is not determined in advance and data is clustered in order starting with the most similar (i.e., the smallest distance). Compared to hierarchical methods, the k-means method has the advantage that the amount of calculations required is less likely to become large, even when clustering large-scale data, so it is often used for data that cannot be handled by hierarchical methods.

[0043] The processing flow for the k-means method is as follows.

[0044] (1) Input the number of clusters to be generated, K, and M pieces of data to be clustered. Each piece of data is represented as an N-dimensional vector. Each dimension represents a feature of the data.

[0045] (2) Set the initial values ​​of K centroids. Here, a centroid is the center of gravity of the data contained in a cluster. Methods for setting the initial values ​​include the Forgy method, which uses K pieces of data randomly selected from M pieces of data as centroids, and the k-means++ method.

[0046] (3) For each pair of data and centroid, calculate the distance, for example, using the Euclidean distance.

[0047] (4) For each piece of data, assign the cluster with the minimum distance to the centroid as the cluster to which the data belongs.

[0048] (5) Calculate the centroid for each cluster.

[0049] (6) When a predetermined termination condition is satisfied, output the cluster assignment result for the data obtained in (4), that is, the information indicating the cluster to which the data belongs. Otherwise, execute the processes in (3) to (5). Here, the predetermined termination condition is, for example, a condition as to whether each of the K centroids has converged to a certain position, or a condition as to whether the number of executions of the processes in (3) to (5) has reached a predetermined number.

[0050] <<k-means++ method>> The k-means++ method sets the initial value of the centroid based on the idea that the centroids selected from the data as the initial values should be as far apart from each other as possible.

[0051] The flow of the process in the k-means++ method is as follows.

[0052] (1) Use one piece of data randomly selected from the M pieces of data as the first centroid.

[0053] (2) For the data not selected as the centroid, calculate the distance to each centroid, and calculate the square of the distance to the centroid with the minimum distance to the data.

[0054] (3) For the square of the distance calculated in (2), obtain the value obtained by dividing the square of the distance by the sum of the squares of the distances, and generate a vector with the divided value as an element.

[0055] (4) Using a random number generation method using a weighted probability distribution, from a vector whose elements are the data IDs of the data not selected as the centroid and the vector generated in (3), select one data ID of the data not selected as the centroid, and set the data with the selected data ID as the centroid.

[0056] (5) Repeat steps (2) to (4) until K centroids are selected.

[0057] <<Random number generation using weighted probability distribution>> In the random number generation method using a weighted probability distribution, the output candidate values ​​are expressed as vectors (x1, …, x L ) and a vector (p1, …, p L ) (where p i (i=1, …, L) is the output candidate value x i is the output probability, and Σp i =1) and the output values ​​are the elements of the vector (r1, …, r S ) (where r i (i=1, …, S) are the output candidate values ​​x1, …, x L where r i (i=1, …, S) are selected according to the distribution of output probabilities. For example, if you generate random numbers using vector (1, 2, 3) whose elements are output candidate values ​​and vector (0.5, 0.3, 0.2) whose elements are output probabilities, 1 will be output with a probability of 0.5, 2 with a probability of 0.3, and 3 with a probability of 0.2.

[0058] <<Secret k-means method>> The secret k-means algorithm is a method of secretly calculating the k-means algorithm, and all information except for the number of data M and the number of clusters K is kept secret. In addition, when the convergence determination condition as described above is used as the termination condition, it is necessary to decrypt one bit of information indicating "whether each of the K centroids has converged to a certain position" for each convergence determination, but all other information is processed while remaining confidential. For example, the M pieces of data, the K centroids, the distance between the data and the centroid, information indicating the cluster to which the data belongs, and the number of data included in the cluster are processed while remaining confidential.

[0059] Next, the tables handled by the secret k-means algorithm are explained. In the k-means algorithm, it is necessary to handle information indicating the cluster to which the data belongs. Here, as shown in FIG. 3, the data IDs of M data items are managed in a one-to-one correspondence with the cluster IDs of K clusters (hereinafter referred to as the cluster ID table). Note that all IDs are assigned in order starting from 1. The M data items are managed using a table as shown in FIG. 4 in which the data IDs are associated with the data of the data IDs (hereinafter referred to as the data table). Furthermore, the K centroids are managed using a table as shown in FIG. 5 in which the cluster IDs are associated with the centroids of the clusters of the cluster IDs (hereinafter referred to as the centroid table). Of the above three tables, the data table is not rewritten during processing, whereas the cluster ID table and the centroid table are rewritten as appropriate.

[0060] The process flow of the secret k-means algorithm is the same as that of the k-means algorithm, and the only difference is whether or not secret calculation is performed. Below, we will explain how the processes (3) to (5) are executed using the above three tables.

[0061] [Calculating the distance between the data and the centroid] Here, we will explain the process of (3). In this process, the data table and centroid table are used to calculate the distance between the data of the data ID and the centroid of the cluster of the cluster ID for all combinations of data ID and cluster ID. However, to make the subsequent processes easier, the calculation results are summarized in a distance table as shown in Figure 6.

[0062] [Cluster assignment] Here, the process of (4) will be explained. In this process, the cluster ID table is updated using the distance table obtained in the process of (3) so that each data is paired with the cluster that has the smallest distance from the centroid. In other words, in the cluster ID table, the cluster ID that is paired with a data ID is the cluster ID of the cluster that includes the centroid that has the smallest distance from the data of the data ID. To achieve this, the cluster ID of the cluster that has the smallest distance from the data of the data ID is extracted from the distance table for each data ID. Specifically, the following process is executed.

[0063] (4-1) The distance table is sorted secretly using the distance attribute as a key.

[0064] (4-2) A secret unique check is performed on the element string of the data ID attribute of the table generated in (4-1), and a table is generated in which the element string obtained as a result of the secret unique check is added to the table generated in (4-1) as a checked data ID attribute.

[0065] (4-3) Extract only the records whose element value of the checked data ID attribute of the table generated in (4-2) is equal to [[1]], and generate a table consisting of these records.

[0066] (4-4) Secretly sort the table generated in (4-3) using the data ID attribute as a key.

[0067] The table obtained by extracting the element strings of the data ID attribute and the element strings of the cluster ID attribute from the table generated in (4-4) becomes a cluster ID table in which each data is paired with the cluster that has the smallest distance from the centroid.

[0068] [Centroid calculation] Here, the process of (5) will be explained. In this process, the centroid table is updated using the cluster ID table obtained in the process of (4). The centroid is the average of the data contained in each cluster. Therefore, if the sum of the data contained in each cluster and the number of data contained in the cluster can be calculated, the centroid can be calculated. Since each data is expressed as a vector, the centroid can be calculated efficiently by using the groupBySum operation and the groupByCount operation. Specifically, the following process is executed.

[0069] (5-1) An element string of the cluster ID attribute of the cluster ID table is extracted, and the element string of the data ID attribute of the data table is replaced with the element string.

[0070] (5-2) For the table created in (5-1), perform a groupBySum operation using the data ID attribute as the key.

[0071] (5-3) For the table created in (5-1), execute a groupByCount operation using the data ID attribute as a key.

[0072] (5-4) Divide the element value of the data attribute of each record of the table generated in (5-2) by the element value of the data attribute of each record of the table generated in (5-3).

[0073] The value obtained in (5-4) becomes the centroid of each cluster.

[0074] As can be seen from the above, by performing cluster assignment using secret sorting and secret unique checking, and performing centroid computation using groupBySum and groupByCount operations, k-means can be computed securely and efficiently.

[0075] <<Secure computation of random number generation method using weighted probability distribution>> The inputs and outputs in the secure computation of the random number generation method using weighted probability distribution are as follows:

[0076] (input) (1) A vector (x1, …, x L ) shares ([[x1]], …, [[x L ]]) (2) A vector (p1, …, p L ) (where p i (i=1, …, L) is the output candidate value x i is the output probability, and Σp i =1) ([[p1]], …, [[p L ]]) (3) Number of output values ​​S (output) (1) A vector (r1, …, r S ) (where r i (i=1, …, S) are the output candidate values ​​x1, …, x L ) share ([[r1]], …, [[r S ]]) Here, the number S of output values ​​may remain in plain text.

[0077] This secure computation is very similar in terms of processing structure to the secure batch mapping, which is calculated using two vectors to define a lookup table. Therefore, we will realize the secure computation using the secure batch mapping. The processing flow will be explained below.

[0078] (1) Vector (p1, …, pL ) shares ([[p1]], …, [[p L ]]) to ([[p'1]], …, [[p' L ]])=prefix_sum(([[p1]], …, [[p L ]])) gives the vector (p'1, …, p' L ) shares ([[p'1]], …, [[p' L Calculate shares([[p'1]], …, [[p' L ]]) is the share in the secret batch mapping [[ → a]] corresponds to

[0079] (2) A vector (q1, …, q S ) (where q i (i=1, …, S) are uniform random numbers, 0≦q i ≦1) of shares ([[q1]], …, [[q S ]]).

[0080] (3) Vector (p'1, …, p' L ) shares ([[p'1]], …, [[p' L ]]) and vector (x1, …, x L ) shares ([[x1]], …, [[x L ]]) and vector (q1, …, q S ) share ([[q1]], …, [[q S ]]), so ([[r1]], …, [[r S ]]) = map(([[p'1]], …, [[p' L ]]), ([[x1]], …, [[x L ]]), ([[q1]], …, [[q S ]])) to generate a vector (r1, …, r S ) shares ([[r1]], …, [[r S ]]).

[0081] Output values ​​r1, …, r Sis a random number generated using a weighted probability distribution.

[0082] If ([[x1]], [[x2]], [[x3]])=([[1]], [[2]], [[3]]), ([[p1]], [[p2]], [[p3]])=([[0.5]], [[0.3]], [[0.2]]), then ([[p'1]], [[p'2]], [[p'3]])=([[0.5]], [[0.8]], [[1.0]]). q i 0≦q i Since it is a uniform random number that satisfies ≦1, the uniform random number q i is in the interval [0, 0.5] with a probability of 0.5, in the interval [0.5, 0.8] with a probability of 0.3, and in the interval [0.8, 1.0] with a probability of 0.2. map(([[p'1]], [[p'2]], [[p'3]]), ([[x1]], [[x2]], [[x3]]), ([[q1]], …, [[q S ]]))=map([[0.5]], [[0.8]], [[1.0]]), ([[1]], [[2]], [[3]]), ([[q1]], …, [[q S ]])) gives the share of random numbers ([[r1]], …, [[r S ]]) is obtained.

[0083] In general, a vector (p1, …, p L Since each element of the vector (p1, ..., p L ) and vector (q1, …, q S The computational cost of the above secure computation can be reduced by converting each element of (a) to an integer, for example by multiplying it by 100, and then performing the secure computation.

[0084] As can be seen from the above, by using the secret lump mapping, it is possible to perform secure computation of a random number generation method using a weighted probability distribution in a safe and efficient manner.

[0085] <<Secret k-means++ method>> In the k-means++ method, the process that uses a weighted probability distribution is (4), and the other processes can be realized by basic operations such as addition, subtraction, multiplication, division, etc. Therefore, here we will briefly explain the process (4).

[0086] A vector (k1, …, k) whose elements are the data IDs of the data not selected as centroids. M-j ) shares ([[k1]], …, [[k M-j Let (d k_1 2 / Σd k_m 2 , …, d k_(M-j) 2 / Σd k_m 2 ) (where d k_m is the centroid identified by the first record in the centroid table to the centroid identified by the jth record in the centroid table, with data ID k m The share of the distance between the centroid and the data of the smallest distance ([[d k_1 2 / Σd k_m 2 ]], …, [[d k_(M-j) 2 / Σd k_m 2 Let ]]) be a vector whose elements are the output probabilities. Furthermore, let the number of output values ​​be one.

[0087] Using these values ​​as inputs, a secret random number generation method using a weighted probability distribution is used to generate an output value i that is equal to one of the data IDs of the data that is not selected as the centroid. j+1 Share[[i j+1 That is, data ID i j+1 Data (x i_(j+1)1 , …, x i_(j+1)N ) share([[x i_(j+1)1 ]], …, [[x i_(j+1)N ]]) is the newly obtained centroid share.

[0088] As can be seen from the above, by using the random number generation method using the weighted probability distribution described above, the k-means++ algorithm can be calculated securely and efficiently.

[0089] First Embodiment The secret random number calculation system 10 will be described below with reference to Figs. 7 to 9. Fig. 7 is a block diagram showing the configuration of the secret random number calculation system 10. The secret random number calculation system 10 includes W (W is a predetermined integer equal to or greater than 3) secret random number calculation devices 1001, ..., 100 W The secret random number calculation device 1001, ..., 100 W are connected to a network 800 and can communicate with each other. The network 800 may be, for example, a communication network such as the Internet or a broadcast communication path. i 9 is a block diagram showing a configuration for (1≦i≦W) Fig. 9 is a flow chart showing the operation of the secret random number calculation system 10.

[0090] As shown in FIG. 8, the secret random number calculation device 100 i is the first vector calculation unit 110 i and the uniform random number generator 120 i and the random number calculation unit 130 i and recording unit 190 i Recording unit 190 i Secret random number calculation device excluding 100 i Each of the components is configured to be able to execute operations required for secure computation, that is, at least among concealment, addition, subtraction, multiplication, division, prefix_sum, and secure batch mapping, that are required to realize the functions of each component. In the present invention, a specific functional configuration for realizing each operation is sufficient if it is a configuration capable of executing existing algorithms including the algorithms disclosed in each of the reference non-patent documents 1 to 4 and 7, and since these are conventional configurations, detailed description will be omitted. In addition, the recording unit 190 i The secret random number calculation device 100 iFor example, the recording unit 190 is a component that records information necessary for the processing of the i is a vector (x1, …, x L ) shares ([[x1]], …, [[x L ]]) or a vector (p1, …, p L ) (where p i (i=1, …, L) is the output candidate value x i is the output probability, and Σp i =1) ([[p1]], …, [[p L ]]) may also be recorded.

[0091] W secret random number calculation devices 100 i By the collaborative calculation by the above, the secure random number calculation system 10 realizes secure calculation of the random number generation method using weighted probability distribution, which is a multi-party protocol. Therefore, the first vector calculation means 110 (not shown) of the secure random number calculation system 10 includes first vector calculation units 1101, ..., 110 W The uniform random number generating means 120 (not shown) is composed of uniform random number generating units 1201, ..., 120 W The random number calculation means 130 (not shown) is composed of random number calculation units 1301, ..., 130 W It is composed of:

[0092] The secret random number calculation system 10 calculates a vector (x1, ..., x L ) shares ([[x1]], …, [[x L ]]) and a vector (p1, …, p L ) (where p i (i=1, …, L) is the output candidate value x i is the output probability, and Σp i =1) ([[p1]], …, [[p L ]]) to a vector (r1, …, r S ) (where r i (i=1, …, S) are the output candidate values ​​x1, …, xL ) share ([[r1]], …, [[r S ]]).

[0093] The operation of the secret random number calculation system 10 will be described below with reference to FIG.

[0094] In S110, the first vector calculation means 110 calculates the vector (p1, ..., p L ) shares ([[p1]], …, [[p L ]]) to ([[p'1]], …, [[p' L ]])=prefix_sum(([[p1]], …, [[p L ]])) gives the vector (p'1, …, p' L ) shares ([[p'1]], …, [[p' L ]]).

[0095] In S120, the uniform random number generating means 120 generates a vector (q1, ..., q S ) (where q i (i=1, …, S) are uniform random numbers, 0≦q i ≦1) of shares ([[q1]], …, [[q S ]]).

[0096] In S130, the random number calculation means 130 calculates the vector (p'1, ..., p' L ) shares ([[p'1]], …, [[p' L ]]) and vector (x1, …, x L ) shares ([[x1]], …, [[x L ]]) and the vector (q1, …, q S ) share ([[q1]], …, [[q S ]]), so ([[r1]], …, [[r S ]]) = map(([[p'1]], …, [[p' L ]]), ([[x1]], …, [[x L]]), ([[q1]], …, [[q S ]])) to generate a vector (r1, …, r S ) shares ([[r1]], …, [[r S ]]).

[0097] According to an embodiment of the present invention, it is possible to perform secure computation of a random number generation method using a weighted probability distribution with high accuracy while keeping data secret.

[0098] <Second embodiment> The secret cluster calculation system 20 will be described below with reference to Figs. 10 to 12. Fig. 10 is a block diagram showing the configuration of the secret cluster calculation system 20. The secret cluster calculation system 20 includes W (W is a predetermined integer equal to or greater than 3) secret cluster calculation devices 2001, ..., 200 W Secret cluster computing devices 2001, ..., 200 W are connected to a network 800 and can communicate with each other. The network 800 may be, for example, a communication network such as the Internet or a broadcast communication path. FIG. 11 shows the secret cluster computing device 200. i 12 is a block diagram showing a configuration where 1≦i≦W. FIG. 12 is a flow chart showing the operation of the secret cluster computation system 20.

[0099] As shown in FIG. 11, the secret cluster calculation device 200 i The centroid table initialization unit 210 i and the distance table calculation unit 220 i and the cluster ID table calculation unit 230 i and the centroid table calculation unit 240 i and the end condition determination unit 250 i and recording unit 290 i Recording unit 290 i Secret cluster computing device 200 iEach component of is configured to be able to execute operations required for secure computation, that is, at least among concealment, addition, subtraction, multiplication, division, logical operations (negation, logical AND, logical OR, exclusive OR), comparison operations (=, <, >, ≦, ≧), secret sorting, secret unique check, Group-by operation, prefix_sum, and secret batch mapping, that are necessary to realize the functions of each component. In the present invention, a specific functional configuration for realizing each operation is sufficient to be a configuration capable of executing existing algorithms including, for example, the algorithms disclosed in each of the reference non-patent documents 1 to 7, and as these are conventional configurations, detailed description will be omitted. Also, the recording unit 290 i The secret cluster computing device 200 i For example, the recording unit 290 is a component that records information necessary for the processing of the i A data table representing data to be clustered is recorded in advance.

[0100] W secret cluster computing devices 200 i By the cooperative calculation by the multiple parties, the secret cluster calculation system 20 realizes the secure calculation of the k-means method or the k-means++ method, which are multi-party protocols. Therefore, the centroid table initialization means 210 (not shown) of the secret cluster calculation system 20 includes the centroid table initialization units 2101, ..., 210 W The distance table calculation means 220 (not shown) is composed of distance table calculation units 2201, . . . , 220 W The cluster ID table calculation means 230 (not shown) is composed of cluster ID table calculation units 2301, . . . , 230 W The centroid table calculation means 240 (not shown) is composed of centroid table calculation units 2401, . . . , 240 W The end condition determination means 250 (not shown) is composed of end condition determination units 2501, . . . , 250 W It is composed of:

[0101] The secret cluster calculation system 20 defines M (M is an integer equal to or greater than 1) as the number of data, K (K is an integer equal to or greater than 1) as the number of clusters, N (N is an integer equal to or greater than 1) as the dimension of the data, (x i1 , …, x iN ) (i=1, …, M) is the data of data ID i, and M pieces of data (x i1 , …, x iN ) share([[x i1 ]], …, [[x iN ]]) (i=1, …, M), the share [[k(i)]] of cluster ID k(i) (where k(i) satisfies 1≦k(i)≦K) of the cluster to which the data of data ID i belongs is calculated. Here, the cluster ID table is a table that includes the data ID and the cluster ID of the cluster to which the data of the data ID belongs as attributes (hereinafter referred to as the data ID attribute and the cluster ID attribute), the data table is a table that includes the data ID and the data of the data ID as attributes (hereinafter referred to as the data ID attribute and the data attribute), the centroid table is a table that includes the cluster ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the cluster ID attribute and the centroid attribute), the distance table is a table that includes the data ID, the cluster ID, and the distance between the data of the data ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the data ID attribute, the cluster ID attribute, and the distance attribute), and the data table is a table that includes the share [[i]] of data ID i and the data of data ID i (x i1 , …, x iN ) share([[x i1 ]], …, [[x iN ]]) as the i-th record (i = 1, ..., M).

[0102] The operation of the secret cluster computing system 20 will be described below with reference to FIG.

[0103] In S210, the centroid table initialization means 210 calculates the share [[j]] of cluster ID j and the centroid (c j1 , …, c jN ) share ([[cj1 ]], …, [[c jN ]]) (where the share is calculated by a predetermined method) as the j-th record (j=1, ..., K) and set it as the initial value of the centroid table. The centroid table initialization means 210 sets the shares [[i1]], ..., [[i K ]] is randomly selected, and the share [[j]] of cluster ID j and the data ID i j Data (x i_j1 , …, x i_jN ) share([[x i_j1 ]], …, [[x i_jN ]]) as the initial value of the j-th record (j = 1, …, K) of the centroid table.

[0104] In S220, the distance table calculation means 220 calculates the share [[i]] of data ID i, the share [[j]] of cluster ID j, and the data (x i1 , …, x iN ) and the centroid of cluster ID j (c j1 , …, c jN ) and the distance d ij Share of [[d ij A distance table is calculated that includes the set of [j-1]] as the M(j-1)+i-th record (i=1, ..., M, j=1, ..., K). Note that the centroid table calculated in S210 is used when S220 is executed the first time, and the centroid table calculated in S240 is used when S220 is executed the second time or later.

[0105] In S230, the cluster ID table calculation means 230 uses the distance table to calculate a cluster ID table that includes the pair of the share [[i]] of data ID i and the share [[k(i)]] of cluster ID k(i) of the cluster to which the data of data ID i belongs as the i-th record (i = 1, ..., M). The cluster ID table calculation means 230, for example, calculates a first intermediate table by secretly sorting the distance table using the distance attribute of the distance table as a key, calculates a second intermediate table by adding a column obtained by secretly checking the element column of the data ID attribute of the first intermediate table using the first intermediate table as a checked data ID attribute to the first intermediate table, calculates a third intermediate table using the second intermediate table including records in which the element value of the checked data ID attribute of the second intermediate table is [[1]], and calculates a cluster ID table by using the third intermediate table to set the element column of the data ID attribute and the element column of the cluster ID attribute of the table obtained by secretly sorting the third intermediate table using the data ID attribute of the third intermediate table as the element column of the data ID attribute and the element column of the cluster ID attribute of the cluster ID table, respectively. Here, the first intermediate table is a table including a data ID attribute, a cluster ID attribute, and a distance attribute, the second intermediate table is a table including a checked data ID attribute, a data ID attribute, a cluster ID attribute, and a distance attribute, and the third intermediate table is a table including a checked data ID attribute, a data ID attribute, a cluster ID attribute, and a distance attribute. Furthermore, the first intermediate table includes MK records, the second intermediate table includes MK records, and the third intermediate table includes M records.

[0106] In S240, the centroid table calculation means 240 calculates the centroid table using the data table and the cluster ID table. For example, the centroid table calculation means 240 calculates a fifth intermediate table by replacing an element string of the data ID attribute of the data table with an element of the cluster ID attribute of the cluster ID table using the data table and the cluster ID table, calculates a sixth intermediate table by a groupBySum operation using the fifth intermediate table with the data ID attribute of the fifth intermediate table as a key, calculates a seventh intermediate table by a groupByCount operation using the fifth intermediate table with the data ID attribute of the fifth intermediate table as a key, and calculates the centroid table by dividing the value of the element of the data attribute of the jth record of the sixth intermediate table by the value of the element of the data attribute of the jth record of the seventh intermediate table using the sixth and seventh intermediate tables, thereby calculating the centroid table. Here, the fifth intermediate table is a table including a data ID attribute and a data attribute, the sixth intermediate table is a table including a data ID attribute and a data attribute, and the seventh intermediate table is a table including a data ID attribute and a data attribute. Furthermore, the fifth intermediate table includes M records, the sixth intermediate table includes K records, and the seventh intermediate table includes K records.

[0107] In S250, the end condition determination means 250 ends the process if a predetermined end condition is satisfied, and returns to the process of S220 otherwise. That is, the secret cluster computation system 20 repeats the processes of S220 to S240. If the predetermined end condition is the number of times the processes of S220 to S240 are executed, the share [[T]] of the number of times T is executed is assumed to be given in advance, and the centroid table initialization means 210 initializes the value of the counter t to the share [[0]]. Then, the end condition determination means 250 updates the value of the counter t to t+[[1]], and ends the process if the value of =([[t>T]], [[1]]) is [[1]], and returns to the process of S220 otherwise.

[0108] <<Setting the initial value using the secret k-means++ method>> Hereinafter, the centroid table initialization means 210 will be described with reference to Figs. 13 and 14. Fig. 13 shows the centroid table initialization unit 210. i 14 is a block diagram showing the configuration of the centroid table initialization unit 210 (1≦i≦W). FIG. 14 is a flow chart showing the operation of the centroid table initialization unit 210. As shown in FIG. i is the first initial value setting unit 211 i and the first vector calculation unit 212 i and the second initial value setting unit 213 i and the end condition determination unit 214 i Includes.

[0109] The first initial value setting means 211 (not shown) of the centroid table initialization means 210 includes first initial value setting units 2111, . . . , 211 W The first vector calculation means 212 (not shown) is composed of first vector calculation units 2121, . . . , 212 W The second initial value setting means 213 (not shown) is composed of second initial value setting units 2131, . . . , 213 W The end condition determination means 214 (not shown) is composed of end condition determination units 2141, . . . , 214 W It is composed of:

[0110] The operation of the centroid table initialization means 210 will be described below with reference to FIG.

[0111] In S211, the first initial value setting means 211 randomly selects a share [[i1]] of a data ID from the shares [[1]], ..., [[M]], and calculates a relationship between the share [[1]] of cluster ID 1 and the data (x i_11 , …, x i_1N ) share([[x i_11 ]], …, [[x i_1N ]]) as the initial value of the first record in the centroid table. The first initial value setting means 211 also initializes the value of a counter t to the share [[0]].

[0112] In S212, the first vector calculation means 212 uses the data ID k m of the data (x k_11 , …, x k_(M-j)N )(where k m (m = 1, …, M - j, and j satisfies 1 ≦ j < K) is the data ID of the data not selected as the centroid) to calculate the share ([[x k_11 , …, [[x k_(M-j)N ) and uses it to calculate the vector (d k_1 2 / Σd k_m 2 , …, d k_(M-j) 2 / Σd k_m 2 )(where d k_m is the distance between the data with the data ID k m and the centroid with the minimum distance among the centroids specified by the first record of the centroid table and the centroids specified by the j-th record of the centroid table) to calculate the share ([[d k_1 2 / Σd k_m 2 , …, [[d k_(M-j) 2 / Σd k_m 2 ). The first vector calculation means 212 may execute a process similar to the processes of S220 and S230, for example, to calculate the share ([[d k_1 2 / Σd k_m 2 , …, [[d k_(M-j) 2 / Σd k_m 2 ).

[0113] In S213, the second initial value setting means 213 uses the secret random number calculation system of the first embodiment to calculate the share ([[k1]], …, [[k M-j ) of the vector (k1, …, k M-j ) having the data IDs of the data not selected as the centroid as elements, and the vector (dk_1 2 / Σd k_m 2 , …, d k_(M-j) 2 / Σd k_m 2 ) share ([[d k_1 2 / Σd k_m 2 ]], …, [[d k_(M-j) 2 / Σd k_m 2 ]]) to obtain one output value i j+1 (i j+1 are the data IDs k1, …, k of the data not selected as centroids. M-j (equal to either j+1 ]], and calculate the share [[j+1]] of cluster ID j+1 and data ID i j+1 Data (x i_(j+1)1 , …, x i_(j+1)N ) share([[x i_(j+1)1 ]], …, [[x i_(j+1)N ]]) as the initial value of the j+1-th row of the centroid table.

[0114] In S214, the termination condition determination means 214 updates the value of the counter t by t+[[1]], and terminates the process if the value of =([[t>K]], [[1]]) is [[1]], otherwise returns to the process of S212. In other words, the centroid table initialization means 210 repeats the processes of S212 to S213.

[0115] According to an embodiment of the present invention, it is possible to perform secure calculations of the k-means algorithm or the k-means++ algorithm with high accuracy while keeping data secret.

[0116] <Additional Notes> 15 is a diagram showing an example of the functional configuration of a computer that realizes each of the above-mentioned devices. The processing in each of the above-mentioned devices can be performed by having a recording unit 2020 load a program for causing a computer to function as each of the above-mentioned devices, and having the control unit 2010, input unit 2030, output unit 2040, etc. operate.

[0117] The device of the present invention has, as a single hardware entity, an input section to which a keyboard or the like can be connected, an output section to which a liquid crystal display or the like can be connected, a communication section to which a communication device (e.g., a communication cable) capable of communicating with the outside of the hardware entity can be connected, a CPU (which may also have a central processing unit, cache memory, registers, etc.), memories such as RAM and ROM, an external storage device such as a hard disk, and buses connecting the input section, output section, communication section, CPU, RAM, ROM, and external storage device so that data can be exchanged between them. If necessary, the hardware entity may also be provided with a device (drive) capable of reading and writing a recording medium such as a CD-ROM. A physical entity equipped with such hardware resources is, for example, a general-purpose computer.

[0118] The external storage device of the hardware entity stores the programs required to realize the above-mentioned functions and the data required in the processing of these programs (not limited to the external storage device, but for example the programs may be stored in a ROM, which is a read-only storage device). Data obtained by the processing of these programs is stored appropriately in the RAM, the external storage device, etc.

[0119] In the hardware entity, each program stored in an external storage device (or ROM, etc.) and the data required to process each program are loaded into memory as necessary, and interpreted, executed, and processed by the CPU as appropriate, so that the CPU realizes a predetermined function (each of the components represented as the above, "units," "means," etc.).

[0120] The present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit of the present invention. In addition, the processes described in the above-described embodiment are not limited to being executed in chronological order according to the order described, but may be executed in parallel or individually depending on the processing capacity of the device that executes the processes or as necessary.

[0121] As described above, when the processing functions of the hardware entities (the devices of the present invention) described in the above embodiments are realized by a computer, the processing contents of the functions that the hardware entities should have are described by a program. Then, by executing this program on a computer, the processing functions of the hardware entities are realized on the computer.

[0122] The program describing the processing contents can be recorded on a computer-readable recording medium. The computer-readable recording medium may be, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or any other suitable recording medium. Specifically, for example, a hard disk drive, a flexible disk, a magnetic tape, or the like can be used as the magnetic recording device, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only Memory), a CD-R (Recordable) / RW (ReWritable), or the like can be used as the optical disk, an MO (Magneto-Optical disc), or the like can be used as the magneto-optical recording medium, and an EEP-ROM (Electronically Erasable and Programmable-Read Only Memory) or the like can be used as the semiconductor memory.

[0123] The program may be distributed, for example, by selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of a server computer and transferring the program from the server computer to other computers via a network.

[0124] A computer that executes such a program, for example, first stores the program recorded on a portable recording medium or the program transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored in its own storage device and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from the portable recording medium and execute a process according to the program, or may execute a process according to the received program each time a program is transferred from the server computer to the computer. The server computer may not transfer the program to the computer, but may execute the above-mentioned process by a so-called ASP (Application Service Provider) type service that realizes the processing function only by issuing an execution instruction and obtaining the result. Note that the program in this embodiment includes information used for processing by an electronic computer that is equivalent to a program (data that is not a direct instruction to the computer but has a nature that specifies the processing of the computer, etc.).

[0125] In addition, in this embodiment, a hardware entity is configured by executing a specific program on a computer, but at least a part of the processing contents may be realized by hardware.

Claims

1. Let L and S be integers of 1 or more. It is composed of three or more secret random number calculation devices, and is a vector (x 1 , …, x L ) share([[x 1 ]], …, [[x L ]]) and a vector with output probabilities as elements (p 1 , …, p L ) (where p i (i=1, …, L) is the output candidate value x i is the output probability, and Σp i =1) ([[p 1 ]], …, [[p L ]]) to a vector (r 1 , …, r S ) (where r i (i=1, …, S) is the output candidate value x 1 , …, x L (equal to either [[r 1 ]], …, [[r S ]]), comprising: Vector (p 1 , …, p L ) share ([[p 1 ]], …, [[p L ]]) to ([[p' 1 ]], …, [[p' L ]])=prefix_sum(([[p 1 ]], …, [[p L ]])) gives the vector (p' 1 , …, p' L ) share ([[p' 1 ]], …, [[p' L a first vector calculation means for calculating A vector (q 1 , …, q S ) (where q i (i=1, …, S) are uniform random numbers, 0≦q i ≦1) share ([[q 1 ]], …, [[q S A uniform random number generating means for generating a uniform random number Vector (p' 1 , …, p' L ) share ([[p' 1 ]], …, [[p' L ]]) and vector(x 1 , …, x L ) share([[x 1 ]], …, [[x L ]]) and vector (q 1 , …, q S ) share ([[q 1 ]], …, [[q S ]]) and then ([[r 1 ]], …, [[r S ]])=map(([[p' 1 ]], …, [[p' L ]]), ([[x 1 ]], …, [[x L ]]), ([[q 1 ]], …, [[q S ]])) to generate a vector (r 1 , …, r S ) share ([[r 1 ]], …, [[r S ]]), A secret random number calculation system including

2. Let L and S be integers of 1 or more. Vector (x 1 , …, x L ) share([[x 1 ]], …, [[x L ]]) and a vector with output probabilities as elements (p 1 , …, p L ) (where p i (i=1, …, L) is the output candidate value x i is the output probability, and Σp i =1) ([[p 1 ]], …, [[p L ]]) to a vector (r 1 , …, r S ) (However, r i (i=1, …, S) is the output candidate value x 1 , …, x L (equal to either [[r 1 ]], …, [[r S A secret random number calculation device in a secret random number calculation system, which is composed of three or more secret random number probability distribution calculation devices, calculates Vector (p 1 , …, p L ) share ([[p 1 ]], …, [[p L ]]) to ([[p' 1 ]], …, [[p' L ]])=prefix_sum(([[p 1 ]], …, [[p L ]])) gives the vector (p' 1 , …, p' L ) share ([[p' 1 ]], …, [[p' L A first vector calculation unit for calculating A vector (q 1 , …, q S ) (where q i (i=1, …, S) are uniform random numbers, 0≦q i ≦1) share ([[q 1 ]], …, [[q S A uniform random number generator that generates a random number Vector (p' 1 , …, p' L ) share ([[p' 1 ]], …, [[p' L ]]) and vector(x 1 , …, x L ) share([[x 1 ]], …, [[x L ]]) and vector (q 1 , …, q S ) share ([[q 1 ]], …, [[q S ]]) and then ([[r 1 ]], …, [[r S ]])=map(([[p' 1 ]], …, [[p' L ]]), ([[x 1 ]], …, [[x L ]]), ([[q 1 ]], …, [[q S ]])) to generate a vector (r 1 , …, r S ) share ([[r 1 ]], …, [[r S A random number calculation unit that calculates A secret random number calculation device including:

3. A secret random number calculation system consisting of three or more secret random number calculation devices calculates a vector (x 1 , …, x L ) share([[x 1 ]], …, [[x L ]]) and a vector with output probabilities as elements (p 1 , …, p L ) (where p i (i=1, …, L) is the output candidate value x i is the output probability, and Σp i =1) ([[p 1 ]], …, [[p L ]]) to a vector (r 1 , …, r S ) (However, r i (i=1, …, S) is the output candidate value x 1 , …, x L (equal to either [[r 1 ]], …, [[r S A method for calculating a secret random number, comprising the steps of: The secret random number calculation system is a vector (p 1 , …, p L ) share ([[p 1 ]], …, [[p L ]]) to ([[p' 1 ]], …, [[p' L ]])=prefix_sum(([[p 1 ]], …, [[p L ]])) gives the vector (p' 1 , …, p' L ) share ([[p' 1 ]], …, [[p' L a first vector calculation step of calculating The secret random number calculation system calculates a vector (q 1 , …, q S ) (where q i (i=1, …, S) are uniform random numbers, 0≦q i ≦1) share ([[q 1 ]], …, [[q S A uniform random number generation step for generating a uniform random number The secret random number calculation system is a vector (p' 1 , …, p' L ) share ([[p' 1 ]], …, [[p' L ]]) and vector(x 1 , …, x L ) share([[x 1 ]], …, [[x L ]]) and vector (q 1 , …, q S ) share ([[q 1 ]], …, [[q S ]]) and then ([[r 1 ]], …, [[r S ]])=map(([[p' 1 ]], …, [[p' L ]]), ([[x 1 ]], …, [[x L ]]), ([[q 1 ]], …, [[q S ]])) to generate a vector (r 1 , …, r S ) share ([[r 1 ]], …, [[r S a random number calculation step for computing A method for calculating secret random numbers.

4. M (M is an integer greater than or equal to 1) is the number of data, K (K is an integer greater than or equal to 1) is the number of clusters, N (N is an integer greater than or equal to 1) is the dimension of the data, (x i1 , …, x iN ) (i=1, …, M) is the data of data ID i, It is composed of three or more secret cluster calculation devices, and M data (x i1 , …, x iN ) share([[x i1 ]], …, [[x iN ]]) (i=1, …, M), a secret cluster calculation system that calculates a share [[k(i)]] of a cluster ID k(i) (where k(i) satisfies 1≦k(i)≦K) of a cluster to which data of data ID i belongs, A table that contains a data ID and the cluster ID of the cluster to which the data of the data ID belongs as attributes (hereinafter referred to as the data ID attribute and the cluster ID attribute) is called a cluster ID table, a table that contains a data ID and the data of the data ID as attributes (hereinafter referred to as the data ID attribute and the data attribute) is called a data table, a table that contains a cluster ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the cluster ID attribute and the centroid attribute) is called a centroid table, and a table that contains a data ID, a cluster ID, and the distance between the data of the data ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the data ID attribute, the cluster ID attribute, and the distance attribute) is called a distance table. The data table is the share of data ID i [[ i]] and data (x i1 , …, x iN ) share([[x i1 ]], …, [[x iN< / sub >]]) as the i-th record (i = 1, …, M), The share of cluster ID j, [[j]], and the centroid of cluster ID j (c j1 , …, c jN ) share ([[c j1 ]], …, [[c jN a centroid table initialization means for setting a table including a j-th record (j=1, ..., K) of the set of j, j = 1, ..., K, where the share is calculated by a predetermined method, as an initial value of the centroid table; Using the data table and centroid table, the share of data ID i [[ i]] and cluster ID j's share [[j]] and data ID i's data (x i1 , …, x iN ) and the centroid of cluster ID j (c j1 , …, c jN ) and the distance d ij Share of [[d ij a distance table calculation means for calculating a distance table including the pair of []] as the M(j-1)+i-th record (i=1, ..., M, j=1, ..., K); Using the distance table, the share of data ID i [[ a cluster ID table calculation means for calculating a cluster ID table including a set of a share [[k(i)]] of a cluster ID k(i) of a cluster to which the data of data ID i belongs as an i-th record (i=1, ..., M); a centroid table calculation means for calculating a centroid table using the data table and the cluster ID table; Including, The centroid table initialization means Among shares [[1]], …, [[M]], select the data ID share [[i 1< / sub >]] is randomly selected, and the share [[1]] of cluster ID 1 and data ID i 1 Data (x i_11 , …, x i_1N ) share([[x i_11 ]], …, [[x i_1N< / sub a first initial value setting means for setting the pair of (>]]) as an initial value of a first record of the centroid table; Data ID k m of the data (x k_11 , …, x k_(M-j)N ), where k m (m = 1, …, M - j, where j satisfies 1 ≦ j < K) is the data ID of the data not selected as the centroid) share ([x k_11 , …, [[x k_(M-j)N< / sub >]]) to find the vector (d k_1 2 / Σd k_m 2 , …, d k_(M-j) 2 / Σd k_m 2 ) (where d k_m is the centroid identified by the first record in the centroid table to the centroid identified by the jth record in the centroid table, with data ID k m The share of the distance between the centroid and the data of the smallest distance ([[d k_1 2 / Σd k_m 2 ]], …, [[d k_(M-j) 2 / Σd k_m 2 a first vector calculation means for calculating Using the secret random number calculation system according to claim 1, a vector (k 1 , …, k M-j ) share ([[k 1 ]], …, [[k M-j ]]) and vector (d k_1 2 / Σd k_m 2 , …, d k_(M-j) 2 / Σd k_m 2 ) share ([[d k_1 2 / Σd k_m 2 ]], …, [[d k_(M-j) 2 / Σd k_m 2 ]]) to obtain one output value i j+1 (i j+1 is the data ID k of the data that is not selected as the centroid 1 , …, k M-j (equal to either j+1< / sub Calculate the share [[j+1]] of cluster ID j+1 and data ID i j+1 Data (x i_(j+1)1 , …, x i_(j+1)N ) share([[x i_(j+1)1< / sub >]], …, [[x i_(j+1)N< / sub a second initial value setting means for setting the pair (j+1) of the centroid table as an initial value of the j+1-th row; A secret cluster computing system comprising:

5. M (M is an integer greater than or equal to 1) is the number of data, K (K is an integer greater than or equal to 1) is the number of clusters, N (N is an integer greater than or equal to 1) is the dimension of the data, (x i1 , …, x iN ) (i=1, …, M) is the data of data ID i, M data (x i1 , …, x iN ) share([[x i1 ]], …, [[x iN A secret cluster computation device in a secret cluster computation system composed of three or more secret cluster computation devices, which calculates a share [[k(i)]] of a cluster ID k(i) (where k(i) satisfies 1≦k(i)≦K) of a cluster to which data of data ID i belongs from among the cluster IDs k(i) (i=1, …, M), A table that contains a data ID and the cluster ID of the cluster to which the data of the data ID belongs as attributes (hereinafter referred to as the data ID attribute and the cluster ID attribute) is called a cluster ID table, a table that contains a data ID and the data of the data ID as attributes (hereinafter referred to as the data ID attribute and the data attribute) is called a data table, a table that contains a cluster ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the cluster ID attribute and the centroid attribute) is called a centroid table, and a table that contains a data ID, a cluster ID, and the distance between the data of the data ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the data ID attribute, the cluster ID attribute, and the distance attribute) is called a distance table. The data table is the share of data ID i [[ i]] and data (x i1 , …, x iN ) share([[x i1 ]], …, [[x iN< / sub >]]) as the i-th record (i = 1, …, M), The share of cluster ID j, [[j]], and the centroid of cluster ID j (c j1 , …, c jN ) share ([[c j1 ]], …, [[c jN a centroid table initialization unit that sets a table including a j-th record (j=1, ..., K) of the set of the jth record (j=1, ..., K) (where the share is calculated by a predetermined method) as an initial value of the centroid table; Using the data table and centroid table, the share of data ID i [[ i]] and cluster ID j's share [[j]] and data ID i's data (x i1 , …, x iN ) and the centroid of cluster ID j (c j1 , …, c jN ) and the distance d ij Share of [[d ij a distance table calculation unit for calculating a distance table including the pair of []] as the M(j-1)+i-th record (i=1, ..., M, j=1, ..., K); Using the distance table, the share of data ID i [[ a cluster ID table calculation unit that calculates a cluster ID table including a set of a share [[k(i)]] of a cluster ID k(i) of a cluster to which the data of data ID i belongs as the i-th record (i=1, ..., M); a centroid table calculation unit for calculating a centroid table using the data table and the cluster ID table; Including, The centroid table initialization unit Among shares [[1]], …, [[M]], select the data ID share [[i 1< / sub >]] is randomly selected, and the share [[1]] of cluster ID 1 and data ID i 1 Data (x i_11 , …, x i_1N ) share([[x i_11 ]], …, [[x i_1N< / sub a first initial value setting unit that sets the pair of (>]]) as an initial value of a first record of the centroid table; Data ID k m of the data (x k_11 , …, x k_(M-j)N )(where k m (m = 1, …, M - j, j satisfies 1 ≦ j < K) is the data ID of the data not selected as the centroid) share ([[x k_11 , …, [[x k_(M-j)N< / sub >]]) to find the vector (d k_1 2 / Σd k_m 2 , …, d k_(M-j) 2 / Σd k_m 2 ) (where d k_m is the centroid identified by the first record in the centroid table to the centroid identified by the jth record in the centroid table, with data ID k m The share of the distance between the centroid and the data of the smallest distance ([[d k_1 2 / Σd k_m 2 ]], …, [[d k_(M-j) 2 / Σd k_m 2 A first vector calculation unit for calculating Using the secret random number calculation device according to claim 2, a vector (k 1 , …, k M-j ) share ([[k 1 ]], …, [[k M-j ]]) and vector (d k_1 2 / Σd k_m 2 , …, d k_(M-j) 2 / Σd k_m 2 ) share ([[d k_1 2 / Σd k_m 2 ]], …, [[d k_(M-j) 2 / Σd k_m 2 ]]) to obtain one output value i j+1 (i j+1 is the data ID k of the data that is not selected as the centroid 1 , …, k M-j (equal to either j+1< / sub Calculate the share [[j+1]] of cluster ID j+1 and data ID i j+1 Data (x i_(j+1)1 , …, x i_(j+1)N ) share([[x i_(j+1)1< / sub >]], …, [[x i_(j+1)N< / sub a second initial value setting unit that sets the pair (j+1) of the centroid table as an initial value of the j+1-th row of the centroid table; A secret cluster computing device including:

6. M (M is an integer greater than or equal to 1) is the number of data, K (K is an integer greater than or equal to 1) is the number of clusters, N (N is an integer greater than or equal to 1) is the dimension of the data, (x i1 , …, x iN ) (i=1, …, M) is the data of data ID i, A secret cluster calculation system consisting of three or more secret cluster calculation devices is i1 , …, x iN ) share([[x i1 ]], …, [[x iN ]]) (i=1, …, M), a secret cluster calculation method for calculating a share [[k(i)]] of a cluster ID k(i) (where k(i) satisfies 1≦k(i)≦K) of a cluster to which data of data ID i belongs, comprising: A table that contains a data ID and the cluster ID of the cluster to which the data of the data ID belongs as attributes (hereinafter referred to as the data ID attribute and the cluster ID attribute) is called a cluster ID table, a table that contains a data ID and the data of the data ID as attributes (hereinafter referred to as the data ID attribute and the data attribute) is called a data table, a table that contains a cluster ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the cluster ID attribute and the centroid attribute) is called a centroid table, and a table that contains a data ID, a cluster ID, and the distance between the data of the data ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the data ID attribute, the cluster ID attribute, and the distance attribute) is called a distance table. The data table is the share of data ID i [[ i]] and data (x i1 , …, x iN ) share([[x i1 ]], …, [[x iN< / sub >]]) as the i-th record (i = 1, …, M), The secret cluster calculation system calculates the share [[j]] of cluster ID j and the centroid (c j1 , …, c jN ) share ([[c j1 ]], …, [[c jN a centroid table initialization step of setting a table including a j-th record (j=1, …, K) of the set of j=1, …, K) (where the share is calculated by a predetermined method) as an initial value of the centroid table; The secret cluster calculation system uses the data table and the centroid table to find the share of data ID i [[ i]] and cluster ID j's share [[j]] and data ID i's data (x i1 , …, x iN ) and the centroid of cluster ID j (c j1 , …, c jN ) and the distance d ij Share of [[d ij a distance table calculation step of calculating a distance table including the pair of []] as the M(j-1)+i-th record (i=1, ..., M, j=1, ..., K); The secret cluster calculation system uses the distance table to calculate the share of data ID i [[ a cluster ID table calculation step of calculating a cluster ID table including a set of the share [[k(i)]] of the cluster ID k(i) of the cluster to which the data of data ID i belongs as the i-th record (i=1, ..., M); a centroid table calculation step in which the secret cluster calculation system calculates a centroid table using a data table and a cluster ID table; Including, The centroid table initialization step includes: Among shares [[1]], …, [[M]], select the data ID share [[i 1< / sub >]] is randomly selected, and the share [[1]] of cluster ID 1 and data ID i 1 Data (x i_11 , …, x i_1N ) share([[x i_11 ]], …, [[x i_1N< / sub a first initial value setting step of setting the pair (>]]) as an initial value of a first record in the centroid table; Data ID k m of the data (x k_11 , …, x k_(M-j)N ) (where k m (m = 1, …, M - j, where j satisfies 1 ≦ j < K) is the data ID of the data not selected as a centroid) share ([x k_11 , …, [[x k_(M-j)N< / sub >]]) to find the vector (d k_1 2 / Σd k_m 2 , …, d k_(M-j) 2 / Σd k_m 2 ) (where d k_m is the centroid identified by the first record in the centroid table to the centroid identified by the jth record in the centroid table, with data ID k m The share of the distance between the centroid and the data of the smallest distance ([[d k_1 2 / Σd k_m 2 ]], …, [[d k_(M-j) 2 / Σd k_m 2 a first vector calculation step of calculating Using the method for calculating secret random numbers according to claim 3, a vector (k 1 , …, k M-j ) share ([[k 1 ]], …, [[k M-j ]]) and vector (d k_1 2 / Σd k_m 2 , …, d k_(M-j) 2 / Σd k_m 2 ) share ([[d k_1 2 / Σd k_m 2 ]], …, [[d k_(M-j) 2 / Σd k_m 2 ]]) to obtain one output value i j+1 (i j+1 is the data ID k of the data that is not selected as the centroid 1 , …, k M-j (equal to either j+1< / sub Calculate the share [[j+1]] of cluster ID j+1 and data ID i j+1 Data (x i_(j+1)1 , …, x i_(j+1)N ) share([[x i_(j+1)1< / sub >]], …, [[x i_(j+1)N< / sub a second initialization step of setting the pair (j+1) of the centroid table as an initial value of the j+1-th row of the centroid table; A secret cluster calculation method comprising:

7. A program for causing a computer to function as the secret random number calculation device according to claim 2.

8. A program for causing a computer to function as the secret cluster calculation device according to claim 5.

Images