Secret cluster calculation system, secret cluster calculation device, secret cluster calculation method, and program

Abstract

Provided is technology for performing highly accurate secure k-means computation while keeping data secret. The present invention includes: a centroid table initialization means that sets, as the initial value of a centroid table, a table that includes, as a jth record, a combination of a share of a cluster ID j and a share of the centroid of cluster ID j; a distance table computation means that computes a distance table that includes, as an M(j-1)+ith record, a combination of a share of a data ID i, a share of cluster ID j, and a share of the distance dij between the data of data ID i and the centroid of cluster ID j; a cluster ID table computation means that computes a cluster ID table that includes, as an ith record, a combination of a share of data ID i and a share of a cluster ID k(i) for the cluster of the data of data ID i; and a centroid table computation means that computes the centroid table.

Description

[Technical field]

[0001] The present invention relates to a secure computation technology, and more particularly to a technology for performing secure computation on the k-means algorithm. [Background technology]

[0002] As a technique for classifying a plurality of data, there is a technique for classifying similar data into one cluster (hereinafter referred to as a clustering technique). As a clustering technique, for example, there is the k-means method described in Non-Patent Document 1. As a conventional method for performing secure computation on this k-means method, there is a method described in Non-Patent Document 2.

[0003] Secure computation is a method of obtaining the result of a specified computation without restoring an encrypted numerical value (see, for example, Reference Non-Patent Document 1). In the method of Reference Non-Patent Document 1, encryption is performed by distributing a plurality of pieces of information that can restore a numerical value to three secure computing devices, and the results of addition / subtraction, constant sum, multiplication, constant multiplication, logical operations (negation, logical product, logical sum, exclusive logical sum), and data format conversion (integer, binary number) can be held in a distributed state, i.e., encrypted state, in the three secure computing devices without restoring the numerical value. In general, the number of shares is not limited to 3 and can be W (W is a predetermined constant equal to or greater than 3), and a protocol that realizes secure computation by cooperative computation by W secure computing devices is called a multi-party protocol.

[0004] (Reference Non-Patent Document 1: Koji Senda, Hiroki Hamada, Dai Igarashi, Katsumi Takahashi, “Rethinking Lightweight Verifiable Three-Party Secure Function Computation,” In CSS, 2010.) [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] John A Hartigan and Manchek A Wong, “Algorithm AS 136: A K-Means Clustering Algorithm,” Journal of the Royal Statistical Society. Series C(Applied Statistics), Vol.28, No.1, pp.100-108, 1979. [Non-Patent Document 2] Jaideep Vaidya and Chris Clifton, “Privacy-preserving k-means clustering over vertically partitioned data,” In Proceedings of the ninth ACM SIGKDD international conference on Knowledge discovery and data mining, pp.206-215, 2003. Summary of the Invention [Problem to be solved by the invention]

[0006] However, the method described in Non-Patent Document 2 has problems with calculation accuracy, in that the results obtained differ from those obtained when the data is in plain text because the data is difficult to calculate when it is encrypted, and security problems, in that the data is decrypted and then calculated halfway through.

[0007] Therefore, an object of the present invention is to provide a technology for securely computing the k-means algorithm with high accuracy while keeping data secret. [Means for solving the problem]

[0008] In one aspect of the present invention, M (M is an integer of 1 or more) is the number of data, K (K is an integer of 1 or more) is the number of clusters, N (N is an integer of 1 or more) is the dimension of the data, (x i1 , …, x iN) (i=1, …, M) is the data of data ID i, and the system is composed of three or more secret cluster calculation devices and has M data (x i1 , …, x iN ) share([[x i1 ]], …, [[x iN A secret cluster calculation system that calculates a share [[k(i)]] of a cluster ID k(i) (where k(i) satisfies 1≦k(i)≦K) of a cluster to which data of data ID i belongs from a cluster of data IDs k(i) (i=1, …, M), the system calculates a share [[k(i)]] of a cluster ID k(i) of a cluster to which data of data ID i belongs from a cluster of data IDs k(i) (where k(i) satisfies 1≦k(i)≦K) from a cluster of data IDs k(i) (i=1, …, M), the system calculates a share [[k(i)]] of a cluster ID k(i) of a cluster to which data of data ID ... i1 , …, x iN ) share([[x i1 ]], …, [[x iN ]]) as the i-th record (i = 1, …, M), and the share [[j]] of cluster ID j and the centroid (c j1 , …, c jN ) share ([[c j1 ]], …, [[c jN a centroid table initialization means for initializing a centroid table to a table including a set of the j-th record (j=1, ..., K) of the data ID i, the share [[i]] of the cluster ID j, and the data (x i1 , …, xiN ) and the centroid of cluster ID j (c j1 , …, c jN ) and the distance d ij Share of [[d ij a distance table calculation means for calculating a distance table including a pair of share [[i]] of data ID i and share [[k(i)]] of cluster ID k(i) of the cluster to which the data of data ID i belongs as the i-th record (i=1, ..., M) using the distance table; and a centroid table calculation means for calculating a centroid table using the data table and the cluster ID table. Effect of the Invention

[0009] According to the present invention, it is possible to perform secure calculation of the k-means algorithm with high accuracy while keeping data secret. [Brief description of the drawings]

[0010] [Figure 1] FIG. 13 is a diagram illustrating a groupBySum operation. [Diagram 2] FIG. 13 is a diagram illustrating a groupByCount operation. [Diagram 3] FIG. 13 is a diagram illustrating an example of a cluster ID table. [Figure 4] FIG. 13 is a diagram illustrating an example of a data table. [Diagram 5] FIG. 13 is a diagram illustrating an example of a centroid table. [Figure 6] FIG. 11 is a diagram illustrating an example of a distance table. [Figure 7] FIG. 1 is a block diagram showing a configuration of a secret cluster computation system 10. [Figure 8] FIG. 2 is a block diagram showing the configuration of a secret cluster computing device 100i. [Figure 9] 4 is a flowchart showing the operation of the secret cluster computing system 10. [Figure 10] FIG. 2 is a diagram illustrating an example of a functional configuration of a computer that realizes each device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of the present invention will be described in detail. Note that components having the same functions are given the same reference numbers and duplicated explanations will be omitted.

[0012] Before describing each embodiment, the notation used in this specification will be described.

[0013] ^ (caret) represents a superscript. For example, x y^z Yes z is a superscript to x, and x y^z Yes z is a subscript to x. Also, _ (underscore) represents a subscript. For example, x y_z Yes z is a superscript to x, and x y_z Yes z is a subscript on x.

[0014] The superscripts "^" and "~" such as ^x and ~x for a certain letter x should actually be written directly above the "x", but due to the constraints of the description in the specification, they are written as ^x and ~x.

[0015] <Technical background> <<Secure calculation>> The secure computation in the present invention is constructed by combining existing secure computation operations. The operations required for this secure computation are concealment, addition, subtraction, multiplication, division, logical operations (negation, logical AND, logical OR, exclusive OR), comparison operations (=, <, >, ≦, ≧), secure sorting, secure unique check, and group-by operation. Some operations, including notation, will be explained below.

[0016] [Redacted] Let [[x]] be the value of x concealed by secret sharing (hereafter, called the share of x). Any method can be used for the secret sharing method. For example, in GF(2 61 -1) Shamir secret sharing on Z2 and replication secret sharing on Z2 can be used.

[0017] A single algorithm may use multiple secret sharing methods in combination. In this case, they will be converted between each other as appropriate.

[0018] Also, N-dimensional vector → x=(x1, …, x N ), [[ → x]]=([[x1]], …, [[x N ]]). That is, [[ → x]] is → The nth element of x n Share[[x n Similarly, M×N matrix A=(a m,n )(1≦m≦M, 1≦n≦N), [[A]] is the (m, n)th element a of A. m,n Share of [[a m,n Let ]] be the (m, n)th element of the matrix.

[0019] Note that x is called the plaintext of [[x]].

[0020] Specific examples of a method for obtaining [[x]] from x (concealment) and a method for obtaining x from [[x]] (restoration) are described in Reference Non-Patent Document 1 and Reference Non-Patent Document 2.

[0021] (Reference non-patent document 2: Shamir, A., “How to share a secret”, Communications of the ACM, Vol. 22, No. 11, pp. 612-613, 1979.) [Addition, Subtraction, Multiplication, Division] Secure addition [[x]]+[[y]] takes [[x]] and [[y]] as input and outputs [[x+y]]. Secure subtraction [[x]]-[[y]] takes [[x]] and [[y]] as input and outputs [[xy]]. Secure multiplication [[x]]×[[y]] (sometimes expressed as mul([[x]], [[y]])) takes [[x]] and [[y]] as input and outputs [[x×y]]. Secure division [[x]] / [[y]] (sometimes expressed as div([[x]], [[y]])) takes [[x]] and [[y]] as input and outputs [[x / y]].

[0022] Specific methods for addition, subtraction, multiplication, and division include those described in Reference Non-Patent Documents 3 and 4.

[0023] (Reference non-patent document 3: Ben-Or, M., Goldwasser, S. and Wigderson, A., “Completeness theorems for non-cryptographic fault-tolerant distributed computation”, Proceedings of the twentieth annual ACM symposium on Theory of computing, ACM, pp. 1-10, 1988.) (Reference Non-Patent Document 4: Gennaro, R., Rabin, MO and Rabin, T., “Simplified VSS and fast-track multiparty computations with applications to threshold cryptography”, Proceedings of the seventeenth annual ACM symposium on Principles of distributed computing, ACM, pp.101-111, 1998.) N-dimensional vector → x=(x1, …, x N ) share [[ →x]]=([[x1]], …, [[x N ]]), an N-dimensional vector → y = (y1, …, y N ) share [[ → y]]=([[y1]], …, [[y N ]]), division by secret computation [[ → x]] / [[ → y]] to [[ → x / → y]]=([[x1 / y1]], …, [[x N / y N ]]). Note that [[ → x]] / [[ → y]] to [[ → x]] to [[ → It is also called the value divided by y.

[0024] [Logical operations] Secure negation not[[x]] takes [[x]] as input and outputs [[not(x)]]. Secure logical conjunction and([[x]], [[y]]) takes [[x]], [[y]] as input and outputs [[and(x, y)]]. Secure logical sum or([[x]], [[y]]) takes [[x]], [[y]] as input and outputs [[or(x, y)]]. Secure exclusive OR xor([[x]], [[y]]) takes [[x]], [[y]] as input and outputs [[xor(x, y)]].

[0025] Incidentally, logical operations can be easily implemented by combining addition, subtraction, multiplication, and division.

[0026] [Comparison operation] Equality determination by secret calculation =([[x]], [[y]]) (sometimes denoted as equal([[x]], [[y]])) takes [[x]] and [[y]] as inputs and outputs [[1]] if x = y, and [[0]] otherwise. Comparison by secret calculation <([[x]], [[y]]) takes [[x]] and [[y]] as inputs and outputs [[1]] if x < y, and [[0]] otherwise. Comparison by secret calculation >([[x]], [[y]]) takes [[x]] and [[y]] as inputs and outputs [[1]] if x > y, and [[0]] otherwise. Comparison by secret calculation ≦([[x]], [[y]]) takes [[x]] and [[y]] as inputs and outputs [[1]] if x ≦ y, and [[0]] otherwise. Comparison by secret calculation ≧([[x]], [[y]]) takes [[x]] and [[y]] as inputs and outputs [[1]] if x ≧ y, and [[0]] otherwise.

[0027] Note that the comparison operation can be easily constructed by combining logical operations.

[0028] [Secret Sort] Secret sort takes an N-dimensional vector → x=(x1, …, x N )'s shares → x]] as inputs, and → sorts the elements [[x1]], …, [[x N of [[x]] in ascending order to obtain a vector sort( → x]]):=([[x i_1 , …, [[x i_N )(where x i_1 , …, x i_N satisfies x i_1 ≦x i_2 ≦ … ≦x i_N and outputs it. Also, for a table T where each element of an arbitrary attribute is encrypted, the table obtained by secretly sorting table T with the attribute α of table T as the key is defined as the table where the values of the elements of attribute α are rearranged for each record in ascending order from the first record.

[0029] A specific method for secret sorting is described in Reference Non-Patent Document 5.

[0030] (Reference Non-Patent Document 5: Dai Igarashi, Hiroki Hamada, Ryo Kikuchi, Koji Senda, “Design and Implementation of Ultra-High-Speed ​​Secure Computation Sorting: The Day Secure Computation Stands on Top of Scripting Languages,” Computer Security Symposium (CSS), 2017.) [Secret Unique Check] The secret unique check is an N-dimensional vector → x=(x1, …, x N ) share [[ → x]] as input, [[ → x]]'s elements [[x1]], …, [[x N If the same value appears more than once in [[ ]], the first occurrence is replaced with [[1]], and the second and subsequent occurrences are replaced with [[0]]. → x]]):=([[x i_1 ]], …, [[x i_N ]]) (where x i_1 , …, x i_N is either 1 or 0). For example, performing a secret unique check on the vector ([[1]], [[2]], [[2]], [[3]], [[3]], [[3]]) yields ([[1]], [[1]], [[0]], [[1]], [[0]], [[0]]).

[0031] Note that the secret unique check can be easily implemented by combining secret sorting and comparison operations.

[0032] [Group-by operation] The Group-by operation is an operation that, when a table has key attributes (e.g., gender) and value attributes (e.g., height), and each element of any attribute in the table is anonymized, obtains statistical values (e.g., average height for each gender) grouped by the value of each element of the key attribute. When the statistical value to be calculated is a sum, it is the groupBySum operation, and when the statistical value to be calculated is a frequency, it is the groupByCount operation.

[0033] Figure 1 is a diagram showing an example of the groupBySum operation. As can be seen from the example in Figure 1, in the table representing the result of the groupBySum operation, the values of the elements of the key attribute are sorted in ascending order from the first record, and for each value of the element of the key attribute, the sum of the elements of value attribute 1 and the sum of the elements of value attribute 2 are obtained. Figure 2 is a diagram showing an example of the groupByCount operation. As can be seen from the example in Figure 2, in the table representing the result of the groupByCount operation, the values of the key attribute are sorted in ascending order from the first record, and for each value of the element of the key attribute, the number of elements of value attribute 1 and the number of elements of value attribute 2 are obtained.

[0034] As a specific method of the Group-by operation, there is a method described in Non-Patent Document 6.

[0035] (Non-Patent Document 6: Ryo Kikuchi, Hiroki Hamada, Dai Igarashi, Motohiro Takahashi, Katsumi Takahashi, "Let's Try Cross-Flow Analysis with Secure Computation", Symposium on Cryptography and Information Security 2020, 3C2-1, 2020.) The Group-by operation disclosed in Non-Patent Document 6 efficiently performs various Group-by operations by using an operation called groupByCommon.

[0036] <<k-means method>> The k-means method is one of the machine learning methods classified as unsupervised learning. In supervised learning such as regression analysis and classification, the goal is to prepare a desired output (called training data) and build a model that reproduces that output with high accuracy, whereas in unsupervised learning such as clustering, the desired output is not determined in advance.

[0037] In clustering, the distance between multiple given data is calculated, and data with close distances is grouped into clusters as similar data. There are two types of clustering: non-hierarchical methods, such as the k-means method, in which the number of clusters to be generated is determined in advance, and hierarchical methods, in which the number of clusters to be generated is not determined in advance and data is clustered in order starting with the most similar (i.e., the smallest distance). Compared to hierarchical methods, the k-means method has the advantage that the amount of calculations required is less likely to become large, even when clustering large-scale data, so it is often used for data that cannot be handled by hierarchical methods.

[0038] The processing flow for the k-means method is as follows.

[0039] (1) Input the number of clusters to be generated, K, and M pieces of data to be clustered. Each piece of data is represented as an N-dimensional vector. Each dimension represents a feature of the data.

[0040] (2) Set the initial values ​​of K centroids. Here, a centroid is the center of gravity of the data contained in a cluster. Methods for setting the initial values ​​include the Forgy method, which uses K pieces of data randomly selected from M pieces of data as centroids, and the k-means++ method.

[0041] (3) For each pair of data and centroid, calculate the distance, for example, using the Euclidean distance.

[0042] (4) For each data item, the cluster that has the smallest distance from the centroid is assigned as the cluster to which the data item belongs.

[0043] (5) For each cluster, calculate the centroid.

[0044] (6) If a predetermined termination condition is satisfied, output the cluster assignment result for the data obtained in (4), i.e., information indicating the cluster to which the data belongs, otherwise execute the processes of (3) to (5). Here, the predetermined termination condition is, for example, a condition as to whether each of the K centroids has converged to a certain position, or a condition as to whether the processes of (3) to (5) have been executed a predetermined number of times.

[0045] <<Secret k-means method>> The secret k-means algorithm is a method of secretly calculating the k-means algorithm, and all information except for the number of data M and the number of clusters K is kept secret. In addition, when the convergence determination condition as described above is used as the termination condition, it is necessary to decrypt one bit of information indicating "whether each of the K centroids has converged to a certain position" for each convergence determination, but all other information is processed while remaining confidential. For example, the M pieces of data, the K centroids, the distance between the data and the centroid, information indicating the cluster to which the data belongs, and the number of data included in the cluster are processed while remaining confidential.

[0046] Next, the tables handled by the secret k-means algorithm are explained. In the k-means algorithm, it is necessary to handle information indicating the cluster to which the data belongs. Here, as shown in FIG. 3, the data IDs of M data items are managed in a one-to-one correspondence with the cluster IDs of K clusters (hereinafter referred to as the cluster ID table). Note that all IDs are assigned in order starting from 1. The M data items are managed using a table as shown in FIG. 4 in which the data IDs are associated with the data of the data IDs (hereinafter referred to as the data table). Furthermore, the K centroids are managed using a table as shown in FIG. 5 in which the cluster IDs are associated with the centroids of the clusters of the cluster IDs (hereinafter referred to as the centroid table). Of the above three tables, the data table is not rewritten during processing, whereas the cluster ID table and the centroid table are rewritten as appropriate.

[0047] The process flow of the secret k-means algorithm is the same as that of the k-means algorithm, and the only difference is whether or not secret calculation is performed. Below, we will explain how the processes (3) to (5) are executed using the above three tables.

[0048] [Calculating the distance between the data and the centroid] Here, we will explain the process of (3). In this process, the data table and centroid table are used to calculate the distance between the data of the data ID and the centroid of the cluster of the cluster ID for all combinations of data ID and cluster ID. However, to make the subsequent processes easier, the calculation results are summarized in a distance table as shown in Figure 6.

[0049] [Cluster assignment] Here, the process of (4) will be explained. In this process, the cluster ID table is updated using the distance table obtained in the process of (3) so that each data is paired with the cluster that has the smallest distance from the centroid. In other words, in the cluster ID table, the cluster ID that is paired with a data ID is the cluster ID of the cluster that includes the centroid that has the smallest distance from the data of the data ID. To achieve this, the cluster ID of the cluster that has the smallest distance from the data of the data ID is extracted from the distance table for each data ID. Specifically, the following process is executed.

[0050] (4-1) The distance table is sorted secretly using the distance attribute as a key.

[0051] (4-2) A secret unique check is performed on the element string of the data ID attribute of the table generated in (4-1), and a table is generated in which the element string obtained as a result of the secret unique check is added to the table generated in (4-1) as a checked data ID attribute.

[0052] (4-3) Extract only the records whose element value of the checked data ID attribute of the table generated in (4-2) is equal to [[1]], and generate a table consisting of these records.

[0053] (4-4) Secretly sort the table generated in (4-3) using the data ID attribute as a key.

[0054] The table obtained by extracting the element strings of the data ID attribute and the element strings of the cluster ID attribute from the table generated in (4-4) becomes a cluster ID table in which each data is paired with the cluster that has the smallest distance from the centroid.

[0055] [Centroid calculation] Here, the process of (5) will be explained. In this process, the centroid table is updated using the cluster ID table obtained in the process of (4). The centroid is the average of the data contained in each cluster. Therefore, if the sum of the data contained in each cluster and the number of data contained in the cluster can be calculated, the centroid can be calculated. Since each data is expressed as a vector, the centroid can be calculated efficiently by using the groupBySum operation and the groupByCount operation. Specifically, the following process is executed.

[0056] (5-1) An element string of the cluster ID attribute of the cluster ID table is extracted, and the element string of the data ID attribute of the data table is replaced with the element string.

[0057] (5-2) For the table created in (5-1), perform a groupBySum operation using the data ID attribute as the key.

[0058] (5-3) For the table created in (5-1), execute a groupByCount operation using the data ID attribute as a key.

[0059] (5-4) Divide the element value of the data attribute of each record of the table generated in (5-2) by the element value of the data attribute of each record of the table generated in (5-3).

[0060] The value obtained in (5-4) becomes the centroid of each cluster.

[0061] As can be seen from the above, by performing cluster assignment using secret sorting and secret unique checking, and performing centroid computation using groupBySum and groupByCount operations, k-means can be computed securely and efficiently.

[0062] First Embodiment The secret cluster computation system 10 will be described below with reference to Figs. 7 to 9. Fig. 7 is a block diagram showing the configuration of the secret cluster computation system 10. The secret cluster computation system 10 includes W (W is a predetermined integer equal to or greater than 3) secret cluster computation devices 1001, ..., 100 W Secret cluster calculation devices 1001, ..., 100 W are connected to a network 800 and can communicate with each other. The network 800 may be, for example, a communication network such as the Internet or a broadcast communication path. FIG. 8 shows the secret cluster computing device 100. i 9 is a block diagram showing a configuration where 1≦i≦W. FIG. 9 is a flow chart showing the operation of the secret cluster computing system 10.

[0063] As shown in FIG. 8, the secret cluster calculation device 100 i The centroid table initialization unit 110 i and the distance table calculation unit 120 i and the cluster ID table calculation unit 130 i and the centroid table calculation unit 140 i and the end condition determination unit 150 i and recording unit 190 i Recording unit 190 i Secret cluster computing device 100 i Each component of is configured to be able to execute operations required for secure computation, that is, at least among concealment, addition, subtraction, multiplication, division, logical operations (negation, logical AND, logical OR, exclusive OR), comparison operations (=, <, >, ≦, ≧), secret sorting, secret unique check, and Group-by operation, that are necessary to realize the function of each component. In the present invention, a specific functional configuration for realizing each operation is sufficient if it is a configuration capable of executing existing algorithms including the algorithms disclosed in each of the reference non-patent documents 1 to 6, and since these are conventional configurations, detailed description will be omitted. Also, the recording unit 190 i The secret cluster computing device 100 i For example, the recording unit 190 is a component that records information necessary for the processing of the iA data table representing data to be clustered is recorded in advance.

[0064] W secret cluster computing devices 100 i By the cooperative calculation by the above, the secret cluster calculation system 10 realizes the secure calculation of the k-means method, which is a multi-party protocol. Therefore, the centroid table initialization means 110 (not shown) of the secret cluster calculation system 10 includes centroid table initialization units 1101, ..., 110 W The distance table calculation means 120 (not shown) is composed of distance table calculation units 1201, . . . , 120 W The cluster ID table calculation means 130 (not shown) is made up of cluster ID table calculation units 1301, . . . , 130 W The centroid table calculation means 140 (not shown) is composed of centroid table calculation units 1401, . . . , 140 W The end condition determination means 150 (not shown) is composed of end condition determination units 1501, . . . , 150 W It is composed of:

[0065] The secret cluster calculation system 10 defines M (M is an integer equal to or greater than 1) as the number of data, K (K is an integer equal to or greater than 1) as the number of clusters, N (N is an integer equal to or greater than 1) as the dimension of the data, (x i1 , …, x iN ) (i=1, …, M) is the data of data ID i, and M pieces of data (x i1 , …, x iN ) share([[x i1 ]], …, [[x iN]]) (i=1, …, M), the share [[k(i)]] of cluster ID k(i) (where k(i) satisfies 1≦k(i)≦K) of the cluster to which the data of data ID i belongs is calculated. Here, the cluster ID table is a table that includes the data ID and the cluster ID of the cluster to which the data of the data ID belongs as attributes (hereinafter referred to as the data ID attribute and the cluster ID attribute), the data table is a table that includes the data ID and the data of the data ID as attributes (hereinafter referred to as the data ID attribute and the data attribute), the centroid table is a table that includes the cluster ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the cluster ID attribute and the centroid attribute), the distance table is a table that includes the data ID, the cluster ID, and the distance between the data of the data ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the data ID attribute, the cluster ID attribute, and the distance attribute), and the data table is a table that includes the share [[i]] of data ID i and the data of data ID i (x i1 , …, x iN ) share([[x i1 ]], …, [[x iN ]]) as the i-th record (i = 1, ..., M).

[0066] The operation of the secret cluster computing system 10 will be described below with reference to FIG.

[0067] In S110, the centroid table initialization means 110 calculates the share [[j]] of cluster ID j and the centroid (c j1 , …, c jN ) share ([[c j1 ]], …, [[c jN ]]) (where the share is calculated by a predetermined method) as the j-th record (j=1, ..., K) and set it as the initial value of the centroid table. The centroid table initialization means 110 sets the shares [[i1]], ..., [[i K]] is randomly selected, and the share [[j]] of cluster ID j and the data ID i j Data (x i_j1 , …, x i_jN ) share([[x i_j1 ]], …, [[x i_jN ]]) as the initial value of the j-th record (j = 1, …, K) of the centroid table.

[0068] In S120, the distance table calculation means 120 calculates the share [[i]] of data ID i, the share [[j]] of cluster ID j, and the data (x i1 , …, x iN ) and the centroid of cluster ID j (c j1 , …, c jN ) and the distance d ij Share of [[d ij A distance table is calculated that includes the set of [j-1]] as the M(j-1)+i record (i=1, ..., M, j=1, ..., K). Note that the centroid table calculated in S110 is used when S120 is executed the first time, and the centroid table calculated in S140 is used when S120 is executed the second time or later.

[0069] In S130, the cluster ID table calculation means 130 uses the distance table to calculate a cluster ID table that includes the pair of the share [[i]] of data ID i and the share [[k(i)]] of cluster ID k(i) of the cluster to which the data of data ID i belongs as the i-th record (i = 1, ..., M). The cluster ID table calculation means 130, for example, calculates a first intermediate table by secretly sorting the distance table using the distance attribute of the distance table as a key, calculates a second intermediate table by using the first intermediate table to add a column obtained by secretly checking the element column of the data ID attribute of the first intermediate table as a checked data ID attribute to the first intermediate table, calculates a third intermediate table using the second intermediate table including records in which the element value of the checked data ID attribute of the second intermediate table is [[1]], and calculates a cluster ID table by using the third intermediate table to set the element column of the data ID attribute and the element column of the cluster ID attribute of the table obtained by secretly sorting the third intermediate table using the data ID attribute of the third intermediate table as the element column of the data ID attribute and the element column of the cluster ID attribute of the cluster ID table, respectively. Here, the first intermediate table is a table including a data ID attribute, a cluster ID attribute, and a distance attribute, the second intermediate table is a table including a checked data ID attribute, a data ID attribute, a cluster ID attribute, and a distance attribute, and the third intermediate table is a table including a checked data ID attribute, a data ID attribute, a cluster ID attribute, and a distance attribute. Furthermore, the first intermediate table includes MK records, the second intermediate table includes MK records, and the third intermediate table includes M records.

[0070] In S140, the centroid table calculation means 140 calculates the centroid table using the data table and the cluster ID table. For example, the centroid table calculation means 140 calculates a fifth intermediate table by replacing an element string of the data ID attribute of the data table with an element of the cluster ID attribute of the cluster ID table using the data table and the cluster ID table, calculates a sixth intermediate table by a groupBySum operation using the fifth intermediate table with the data ID attribute of the fifth intermediate table as a key, calculates a seventh intermediate table by a groupByCount operation using the fifth intermediate table with the data ID attribute of the fifth intermediate table as a key, and calculates the centroid table by dividing the value of the element of the data attribute of the jth record of the sixth intermediate table by the value of the element of the data attribute of the jth record of the seventh intermediate table using the sixth and seventh intermediate tables, thereby calculating the centroid table. Here, the fifth intermediate table is a table including a data ID attribute and a data attribute, the sixth intermediate table is a table including a data ID attribute and a data attribute, and the seventh intermediate table is a table including a data ID attribute and a data attribute. Furthermore, the fifth intermediate table includes M records, the sixth intermediate table includes K records, and the seventh intermediate table includes K records.

[0071] In S150, the end condition determination means 150 ends the process if a predetermined end condition is satisfied, and returns to the process of S120 otherwise. That is, the secret cluster computation system 10 repeats the processes of S120 to S140. If the predetermined end condition is the number of times the processes of S120 to S140 are executed, the share [[T]] of the number of times T is executed is assumed to be given in advance, and the centroid table initialization means 110 initializes the value of the counter t to the share [[0]]. Then, the end condition determination means 150 updates the value of the counter t to t+[[1]], and ends the process if the value of =([[t>T]], [[1]]) is [[1]], and returns to the process of S120 otherwise.

[0072] According to an embodiment of the present invention, it is possible to perform secure calculation of the k-means algorithm with high accuracy while keeping data secret.

[0073] <Additional Notes> 10 is a diagram showing an example of the functional configuration of a computer that realizes each of the above-mentioned devices. The processing in each of the above-mentioned devices can be performed by having a recording unit 2020 load a program for causing a computer to function as each of the above-mentioned devices, and having the control unit 2010, input unit 2030, output unit 2040, etc. operate.

[0074] The device of the present invention has, as a single hardware entity, an input section to which a keyboard or the like can be connected, an output section to which a liquid crystal display or the like can be connected, a communication section to which a communication device (e.g., a communication cable) capable of communicating with the outside of the hardware entity can be connected, a CPU (which may also have a central processing unit, cache memory, registers, etc.), memories such as RAM and ROM, an external storage device such as a hard disk, and buses connecting the input section, output section, communication section, CPU, RAM, ROM, and external storage device so that data can be exchanged between them. If necessary, the hardware entity may also be provided with a device (drive) capable of reading and writing a recording medium such as a CD-ROM. A physical entity equipped with such hardware resources is, for example, a general-purpose computer.

[0075] The external storage device of the hardware entity stores the programs required to realize the above-mentioned functions and the data required in the processing of these programs (not limited to the external storage device, but for example the programs may be stored in a ROM, which is a read-only storage device). Data obtained by the processing of these programs is stored appropriately in the RAM, the external storage device, etc.

[0076] In the hardware entity, each program stored in an external storage device (or ROM, etc.) and the data required to process each program are loaded into memory as necessary, and interpreted, executed, and processed by the CPU as appropriate, so that the CPU realizes a predetermined function (each of the components represented as the above, "units," "means," etc.).

[0077] The present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit of the present invention. In addition, the processes described in the above-described embodiment are not limited to being executed in chronological order according to the order described, but may be executed in parallel or individually depending on the processing capacity of the device that executes the processes or as necessary.

[0078] As described above, when the processing functions of the hardware entities (the devices of the present invention) described in the above embodiments are realized by a computer, the processing contents of the functions that the hardware entities should have are described by a program. Then, by executing this program on a computer, the processing functions of the hardware entities are realized on the computer.

[0079] The program describing the processing contents can be recorded on a computer-readable recording medium. The computer-readable recording medium may be, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or any other suitable recording medium. Specifically, for example, a hard disk drive, a flexible disk, a magnetic tape, or the like can be used as the magnetic recording device, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only Memory), a CD-R (Recordable) / RW (ReWritable), or the like can be used as the optical disk, an MO (Magneto-Optical disc), or the like can be used as the magneto-optical recording medium, and an EEP-ROM (Electronically Erasable and Programmable-Read Only Memory) or the like can be used as the semiconductor memory.

[0080] The program may be distributed, for example, by selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of a server computer and transferring the program from the server computer to other computers via a network.

[0081] A computer that executes such a program, for example, first stores the program recorded on a portable recording medium or the program transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored in its own storage device and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from the portable recording medium and execute a process according to the program, or may execute a process according to the received program each time a program is transferred from the server computer to the computer. The server computer may not transfer the program to the computer, but may execute the above-mentioned process by a so-called ASP (Application Service Provider) type service that realizes the processing function only by issuing an execution instruction and obtaining the result. Note that the program in this embodiment includes information used for processing by an electronic computer that is equivalent to a program (data that is not a direct instruction to the computer but has a nature that specifies the processing of the computer, etc.).

[0082] In addition, in this embodiment, a hardware entity is configured by executing a specific program on a computer, but at least a part of the processing contents may be realized by hardware.

Claims

1. M (M is an integer greater than or equal to 1) is the number of data, K (K is an integer greater than or equal to 1) is the number of clusters, N (N is an integer greater than or equal to 1) is the dimension of the data, (x i1 , …, x iN ) (i=1, …, M) is the data of data ID i, It is composed of three or more secret cluster calculation devices, and M data (x i1 , …, x iN ) share([[x i1 ]], …, [[x iN ]]) (i=1, …, M), a secret cluster calculation system that calculates a share [[k(i)]] of a cluster ID k(i) (where k(i) satisfies 1≦k(i)≦K) of a cluster to which data of data ID i belongs, A table that contains a data ID and the cluster ID of the cluster to which the data of the data ID belongs as attributes (hereinafter referred to as the data ID attribute and the cluster ID attribute) is called a cluster ID table, a table that contains a data ID and the data of the data ID as attributes (hereinafter referred to as the data ID attribute and the data attribute) is called a data table, a table that contains a cluster ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the cluster ID attribute and the centroid attribute) is called a centroid table, and a table that contains a data ID, a cluster ID, and the distance between the data of the data ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the data ID attribute, the cluster ID attribute, and the distance attribute) is called a distance table. The data table is the share of data ID i [[ i]] and data (x i1 , …, x iN ) share([[x i1 ]], …, [[x iN< / sub >]]) as the i-th record (i = 1, …, M), The share of cluster ID j, [[j]], and the centroid of cluster ID j (c j1 , …, c jN ) share ([[c j1 ]], …, [[c jN a centroid table initialization means for setting a table including a j-th record (j=1, ..., K) of the set of j, j = 1, ..., K, where the share is calculated by a predetermined method, as an initial value of the centroid table; Using the data table and centroid table, the share of data ID i [[ i]] and cluster ID j's share [[j]] and data ID i's data (x i1 , …, x iN ) and the centroid of cluster ID j (c j1 , …, c jN ) and the distance d ij Share of [[d ij a distance table calculation means for calculating a distance table including the pair of []] as the M(j-1)+i-th record (i=1, ..., M, j=1, ..., K); Using the distance table, the share of data ID i [[ a cluster ID table calculation means for calculating a cluster ID table including a set of a share [[k(i)]] of a cluster ID k(i) of a cluster to which the data of data ID i belongs as an i-th record (i=1, ..., M); a centroid table calculation means for calculating a centroid table using the data table and the cluster ID table; A secret cluster computing system comprising:

2. 2. The secret cluster computing system of claim 1, The cluster ID table calculation means Using the distance table, a first intermediate table is calculated by secretly sorting the distance table using the distance attribute of the distance table as a key; calculating a second intermediate table by adding a column obtained by performing a secret unique check on an element column of a data ID attribute of the first intermediate table to the first intermediate table as a checked data ID attribute; Using the second intermediate table, a third intermediate table is calculated that includes records in which the element value of the checked data ID attribute in the second intermediate table is [[1]]; A cluster ID table is calculated by using the third intermediate table to secretly sort the third intermediate table using the data ID attribute of the third intermediate table as a key, and using the element string of the data ID attribute and the element string of the cluster ID attribute of the table obtained as the element string of the data ID attribute and the element string of the cluster ID attribute of the cluster ID table, respectively. A secret cluster calculation system comprising:

3. 2. The secret cluster computing system of claim 1, The centroid table calculation means Using the data table and the cluster ID table, calculate a fifth intermediate table by replacing the element string of the data ID attribute of the data table with the elements of the cluster ID attribute of the cluster ID table; Using the fifth intermediate table, calculate the sixth intermediate table by a groupBySum operation using the data ID attribute of the fifth intermediate table as a key; Using the fifth intermediate table, calculate the seventh intermediate table by a groupByCount operation using the data ID attribute of the fifth intermediate table as a key; Using the sixth intermediate table and the seventh intermediate table, the centroid table is calculated by dividing the value of the element of the data attribute of the jth record in the sixth intermediate table by the value of the element of the data attribute of the jth record in the seventh intermediate table, and setting the result as the value of the element of the centroid attribute of the jth record in the centroid table. A secret cluster calculation system comprising:

4. M (M is an integer greater than or equal to 1) is the number of data, K (K is an integer greater than or equal to 1) is the number of clusters, N (N is an integer greater than or equal to 1) is the dimension of the data, (x i1 , …, x iN ) (i=1, …, M) is the data of data ID i, M data (x i1 , …, x iN ) share([[x i1 ]], …, [[x iN A secret cluster computation device in a secret cluster computation system composed of three or more secret cluster computation devices, which calculates a share [[k(i)]] of a cluster ID k(i) (where k(i) satisfies 1≦k(i)≦K) of a cluster to which data of data ID i belongs from among the cluster IDs k(i) (i=1, …, M), A table that contains a data ID and the cluster ID of the cluster to which the data of the data ID belongs as attributes (hereinafter referred to as the data ID attribute and the cluster ID attribute) is called a cluster ID table, a table that contains a data ID and the data of the data ID as attributes (hereinafter referred to as the data ID attribute and the data attribute) is called a data table, a table that contains a cluster ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the cluster ID attribute and the centroid attribute) is called a centroid table, and a table that contains a data ID, a cluster ID, and the distance between the data of the data ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the data ID attribute, the cluster ID attribute, and the distance attribute) is called a distance table. The data table is the share of data ID i [[ i]] and data (x i1 , …, x iN ) share([[x i1 ]], …, [[x iN< / sub >]]) as the i-th record (i = 1, …, M), The share of cluster ID j, [[j]], and the centroid of cluster ID j (c j1 , …, c jN ) share ([[c j1 ]], …, [[c jN a centroid table initialization unit that sets a table including a j-th record (j=1, ..., K) of the set of j, j = 1, ..., K, where the share is calculated by a predetermined method, as an initial value of the centroid table; Using the data table and centroid table, the share of data ID i [[ i]] and cluster ID j's share [[j]] and data ID i's data (x i1 , …, x iN ) and the centroid of cluster ID j (c j1 , …, c jN ) and the distance d ij Share of [[d ij a distance table calculation unit for calculating a distance table including the pair of []] as the M(j-1)+i-th record (i=1, ..., M, j=1, ..., K); Using the distance table, the share of data ID i [[ a cluster ID table calculation unit that calculates a cluster ID table including a set of the share [[k(i)]] of the cluster ID k(i) of the cluster to which the data of the data ID i belongs as the i-th record (i=1, ..., M); a centroid table calculation unit for calculating a centroid table using the data table and the cluster ID table; A secret cluster computing device including:

5. M (M is an integer greater than or equal to 1) is the number of data, K (K is an integer greater than or equal to 1) is the number of clusters, N (N is an integer greater than or equal to 1) is the dimension of the data, (x i1 , …, x iN ) (i=1, …, M) is the data of data ID i, A secret cluster calculation system consisting of three or more secret cluster calculation devices is i1 , …, x iN ) share([[x i1 ]], …, [[x iN ]]) (i=1, …, M), a secret cluster calculation method for calculating a share [[k(i)]] of a cluster ID k(i) (where k(i) satisfies 1≦k(i)≦K) of a cluster to which data of data ID i belongs, comprising: A table that contains a data ID and the cluster ID of the cluster to which the data of the data ID belongs as attributes (hereinafter referred to as the data ID attribute and the cluster ID attribute) is called a cluster ID table, a table that contains a data ID and the data of the data ID as attributes (hereinafter referred to as the data ID attribute and the data attribute) is called a data table, a table that contains a cluster ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the cluster ID attribute and the centroid attribute) is called a centroid table, and a table that contains a data ID, a cluster ID, and the distance between the data of the data ID and the centroid of the cluster of the cluster ID as attributes (hereinafter referred to as the data ID attribute, the cluster ID attribute, and the distance attribute) is called a distance table. The data table is the share of data ID i [[ i]] and data (x i1 , …, x iN ) share([[x i1 ]], …, [[x iN< / sub >]]) as the i-th record (i = 1, …, M), The secret cluster calculation system calculates the share [[j]] of cluster ID j and the centroid (c j1 , …, c jN ) share ([[c j1 ]], …, [[c jN a centroid table initialization step of setting a table including a j-th record (j=1, …, K) of the set of j=1, …, K) (where the share is calculated by a predetermined method) as an initial value of the centroid table; The secret cluster calculation system uses the data table and the centroid table to find the share of data ID i [[ i]] and cluster ID j's share [[j]] and data ID i's data (x i1 , …, x iN ) and the centroid of cluster ID j (c j1 , …, c jN ) and the distance d ij Share of [[d ij a distance table calculation step of calculating a distance table including the pair of []] as the M(j-1)+i-th record (i=1, ..., M, j=1, ..., K); The secret cluster calculation system uses the distance table to calculate the share of data ID i [[ a cluster ID table calculation step of calculating a cluster ID table including a set of the share [[k(i)]] of the cluster ID k(i) of the cluster to which the data of data ID i belongs as the i-th record (i=1, ..., M); a centroid table calculation step in which the secret cluster calculation system calculates a centroid table using a data table and a cluster ID table; A secret cluster calculation method comprising:

6. A program for causing a computer to function as the secret cluster calculation device according to claim 4.

Images