Calculation system, calculation method, and program

Abstract

To increase security.SOLUTION: A first apparatus comprises a first acquisition unit for acquiring first public information and third secret information such that the product of the first public information and the third secret information becomes first secret information, and a first transmission unit for transmitting the first public information to a second apparatus. The second apparatus comprises a first receiving unit for receiving the first public information from the first apparatus, a second acquisition unit for acquiring first calculation information and fourth secret information such that the product of the first calculation information and the fourth secret information becomes second secret information, a first public product calculation unit for calculating a first public product that is the product of the first calculation information and the first public information, and a second transmission unit for transmitting the first public product to the first apparatus. The first apparatus further includes a second receiving unit for receiving the first public product from the second apparatus. Based on the first public product, the third secret information, and the fourth secret information, a secret product that is the product of the first secret information and the second secret information is calculated with the first secret information and the second secret information being managed in secret.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present disclosure relates to a computing system, a computing method, and a program. [Background technology]

[0002] Conventionally, techniques for preventing leakage of information secretly managed by a device have been considered. For example, Non-Patent Document 1 describes a federated learning method for creating a learning model using a machine learning method without consolidating training data at one location. In federated learning, it is known that each of a plurality of devices can execute learning of a learning model without transmitting information secretly managed by itself to other devices. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Qinbin Li, Zeyi Wen, Zhaomin Wu, Sixu Hu, Naibo Wang, Yuan Li, Xu Liu, Bingsheng He, “A Survey on Federated Learning Systems: Vision, Hype and Reality for Data Privacy and Protection”, Internet, retrieved March 16, 2023, https: / / arxiv.org / abs / 1907.09693 Summary of the Invention [Problem to be solved by the invention]

[0004] For example, in associative learning such as that described in non-patent literature, there is a demand for calculating a secret product of first secret information secretly managed by a first device and second secret information secretly managed by a second device in order to learn a learning model. In fields other than associative learning, there is a similar demand when a secret product, which is a product of multiple pieces of information secretly managed, is calculated. In this case, however, when the second device calculates the secret product of the first secret information and the second secret information, if the first device transmits the first secret information to the second device, the first secret information is transmitted over a network, and security is not sufficient. Even if the first secret information is encrypted, there is a possibility that it can be decrypted by a third party. The same applies when the first device calculates the secret product.

[0005] One goal of this disclosure is to increase security. [Means for solving the problem]

[0006] A computing system according to the present disclosure includes a first device that secretly manages first secret information, and a second device that secretly manages second secret information, wherein the first device includes a first acquisition unit that acquires first public information and third secret information such that a product of first public information made public to the second device and third secret information secretly managed in the first device becomes the first secret information, and a first transmission unit that transmits the first public information to the second device, wherein the second device includes a first reception unit that receives the first public information from the first device, first calculation information for which a product of the first public information and third secret information is calculated, and a fourth calculation unit that is secretly managed in the second device. the first device further includes a second receiving unit that receives the first public product from the second device, and a secret product that is a product of the first secret information and the second secret information is calculated based on the first public product, the third secret information, and the fourth secret information, with the first secret information and the second secret information being managed in secret. Effect of the Invention

[0007] The present disclosure provides increased security. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 illustrates an example of federated learning performed in a computing system. [Diagram 2] FIG. 13 is a diagram illustrating an example of a calculation formula in associative learning. [Diagram 3] FIG. 3 is a diagram showing a specific example of the problem in the table of FIG. 2. [Figure 4] FIG. 2 is a diagram illustrating an example of a hardware configuration of a computing system according to a first embodiment. [Diagram 5] FIG. 2 is a diagram illustrating an example of functions realized by the computing system of the first embodiment. [Figure 6] FIG. 2 is a diagram illustrating an example of a process executed in the computing system of the first embodiment. [Figure 7] FIG. 11 is a diagram illustrating an example of a method for calculating first public information and third secret information. [Figure 8] FIG. 11 is a diagram illustrating an example of functions realized by a computing system according to a second embodiment. [Figure 9] FIG. 11 is a diagram illustrating an example of a process executed in the computing system of the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] [1. Overview of the computing system in the first embodiment] A first embodiment, which is an example of an embodiment of a computing system according to the present disclosure, will be described. In the first embodiment, a case where a computing system is used for federated learning in machine learning will be taken as an example. Federated learning is a learning method that is executed in a distributed manner by multiple devices. Any one of the multiple devices aggregates learning results from the other devices to create a learning model.

[0010] In conventional learning, a device that performs learning of a learning model needs to collect training data from other devices. This raises security concerns because there is a possibility that the training data may be leaked to a third party. In this regard, in federated learning, each device does not, in principle, send training data to other devices, but only the learning results, which is useful from a security perspective. For example, if the training data includes personal information, federated learning can prevent the leakage of personal information.

[0011] FIG. 1 is a diagram showing an example of federated learning executed in a computing system. In the example of FIG. 1, a case is shown in which four services 0 to 3 cooperate with each other to execute federated learning. For example, service 0 is an information management service provided by a management company that manages various information related to users. service 1 is a financial service provided by a bank. service 2 is a financial service provided by a securities company. service 3 is an insurance service provided by an insurance company.

[0012] For example, computers in each of services 0 to 3 cooperate with each other to perform federated learning. In Fig. 1, the computers are omitted. Hereinafter, for the sake of simplicity in Fig. 1, the explanation will be given assuming that the executing entities that execute the processing in the federated learning are services 0 to 3, but in reality, the executing entities are the computers in each of services 0 to 3. Hereinafter, when there is no need to distinguish between services 0 to 3, the reference numerals will be omitted and they will be referred to as services.

[0013] For example, in federated learning, each service initializes its own learning model. Each service executes learning of its own learning model based on training data managed by itself. In principle, the training data is not disclosed to third parties. The training data is managed confidentially by each service. In the first embodiment, a case where a learning model that estimates a user's annual income is created by federated learning is taken as an example, but a learning model may be created for any other purpose. For example, a learning model that estimates attributes other than annual income, a learning model used in image processing, a learning model used in natural language processing, or other learning models may be created by federated learning.

[0014] For example, the training data includes demographic information that is considered to be correlated with annual income, payment history in the service, web page browsing history, or other information. Each service manages the training data independently, and does not transmit the training data to the outside in principle. In the first embodiment, a case is taken as an example in which the training data indicates the characteristics of a user who uses all of services 1 to 3, but it is sufficient that the training data indicates the characteristics of a user who uses at least one of services 1 to 3.

[0015] FIG. 2 is a diagram showing an example of a formula in federated learning. For example, service 1 executes learning of a learning model M1 that estimates a user's annual income based on training data indicating user characteristics x1 that are secretly managed by a bank. Service 2 executes learning of a learning model M2 that estimates a user's annual income based on training data indicating user characteristics x2 that are secretly managed by a securities company. Service 3 executes learning of a learning model M3 that estimates a user's annual income based on training data indicating user characteristics x3 that are secretly managed by an insurance company.

[0016] In the example of Figure 2, a concept that includes features x1, x2, and x3 is described as feature X. Feature X is in the form of an n x m matrix, where n and m are any natural numbers. For example, service 0 manages label y, which is the correct answer for annual income. In the example of Figure 2, y is an n x 1 matrix (a so-called column vector). Service 0 collects the local learning results from each of services 1 to 3, and executes learning of a learning model M0 that estimates the user's annual income.

[0017] In the example of FIG. 2, the service 0 creates a learning model M0 that estimates the user's annual income y based on the estimation result y1 by the learning model M1, the estimation result y2 by the learning model M2, and the estimation result y3 by the learning model M3. That is, the estimation results y1 to y3 are input to the learning model M0. The learning model M0 calculates features based on the estimation results y1 to y3, and outputs the user's annual income y as an estimation result according to the features. The learning model M0 can be said to be a model in stacking learning, which is a type of ensemble learning that uses the estimation results y1 to y3 of the learning models M1 to M3.

[0018] For example, the learning model M0 includes weighting coefficients w0 to w4 as parameters adjusted by learning. The learning model M0 may include parameters other than the weighting coefficients w0 to w4 (e.g., bias). In FIG. 2, i is a numerical value indicating an individual user. As shown in FIG. 2, the correct label y i and the estimation result y of the learning model M0 i (In Figure 2, a symbol is added at the top) and the loss L is calculated based on the difference between them. Service 0 performs training of the learning model M0 so that the loss L becomes small.

[0019] For example, service 0 transmits the learning results of learning model M0 to each of services 1 to 3. Service 1 updates learning model M1 based on the learning results of learning model M0. Service 2 updates learning model M2 based on the learning results of learning model M0. Service 3 updates learning model M3 based on the learning results of learning model M0. Each of services 1 to 3 transmits new learning results to service 0. In the same manner, the sharing of learning results between service 0 and each of services 1 to 3 is repeated, and improvement of learning models M0 to M3 is expected.

[0020] In FIG. 1, lines are omitted for simplicity, but in the first embodiment, services 1 to 3 share each other's learning results. For example, service 1 acquires the learning results of learning models M2 and M3 from services 2 and 3, and updates learning model M1. Service 2 acquires the learning results of learning models M1 and M3 from services 1 and 3, and updates learning model M2. Service 3 acquires the learning results of learning models M1 and M2 from services 1 and 2, and updates learning model M3.

[0021] Hereinafter, when the learning models M0 to M4 are not distinguished from each other, they are simply referred to as the learning model M. The learning method of the learning model M may be a known method, and for example, the gradient descent method or the backpropagation method may be used. In the first embodiment, the type and the learning method of the learning models M are the same as each other, but at least one of the type and the learning method of the learning models M may be different from each other. For example, the learning model M0 may be a neural network, the learning model M1 may be a support vector machine, the learning model M2 may be a gradient boosting regression tree, and the learning model M3 may be a linear regression model. The learning method may be a method according to these types.

[0022] In the first embodiment, a case is taken as an example where the learning model M is a neural network and the learning method of the learning model M is gradient descent. The gradient descent method iteratively updates the parameters of the learning model M, calculates the gradient (slope) of the loss, and updates the parameters in the direction in which the gradient falls the most. For example, when gradient descent is used in learning the learning model M0, a differential calculation formula as shown in FIG. 2 is used. When gradient descent is used in learning the learning models M1 to M3, a similar calculation formula is used. Since the gradient descent method itself is a known technology, details of the calculation formula in FIG. 2 are omitted.

[0023] For example, the underlined part in the formula in Figure 2 is the inner product of the column vector related to service 1 and the column vector related to service 2. When services 1 and 2 execute learning of learning models M1 and M2, respectively, they need to obtain similar information. In this case, services 1 and 2 are required to obtain the inner product underlined in the formula in Figure 2 without transmitting information that should be kept secret between each other. Table C1 in Figure 2 generalizes the problem of satisfying such a requirement. If the computing system can solve the problem in Table C1, it can obtain the inner product without transmitting information that should be kept secret between the services.

[0024] FIG. 3 is a diagram showing a specific example of the problem of Table C1 in FIG. 2. For example, a first device A of a certain service secretly manages an m-dimensional vector a. A second device B of another service secretly manages an m-dimensional vector b. For example, an element included in the m-dimensional vector indicates some characteristic of an individual user. The second device B is required to have high security. From the viewpoint of security, each of the first device A and the second device B has a constraint that some integrated information is transmitted, instead of the vector a and the vector b.

[0025] For example, as in Table C2, if the second device B can obtain the inner product a·b of vector a and vector b without obtaining vector a from the first device A, this is useful for learning the learning model M managed by the second device B. In the first embodiment, an example of this technique is described. Conversely, as in Table C3, if the first device A can obtain the inner product a·b of vector a and vector b without obtaining vector b from the second device B, this is useful for learning the learning model M managed by the first device A. In the second embodiment described later, an example of this technique is described.

[0026] [2. Hardware Configuration of the Computing System in the First Embodiment] 4 is a diagram illustrating an example of a hardware configuration of a computing system in the first embodiment. For example, the computing system 10 includes a first device A that secretly manages first secret information y described below, and a second device B that secretly manages second secret information x described below. Each of the first device A and the second device B is connected to a network N such as the Internet or a LAN.

[0027] The first device A is a computer for the first service. In the first embodiment, the first service is taken as an example to be service 1 in FIG. 1 (a service provided by a bank), but the first service may be any other service. For example, the first service may be service 0, 2, or 3 in FIG. 1, or may be another service not shown in FIG. 1. The other service may be a communication service, an electronic commerce service, a travel reservation service, an electronic payment service, or a point management service.

[0028] For example, the first device A is a server computer, a personal computer, a tablet, or a smartphone. The first device A includes a control unit A11, a storage unit A12, and a communication unit A13. The control unit A11 includes at least one processor. The storage unit A12 includes a volatile memory such as a RAM, and a non-volatile memory such as a flash memory. The communication unit A13 includes at least one of a communication interface for wired communication and a communication interface for wireless communication.

[0029] The second device B is a computer of the second service. For example, the second device B is a server computer, a personal computer, a tablet, or a smartphone. The second device B includes a control unit B11, a storage unit B12, and a communication unit B13. The hardware configurations of the control unit B11, the storage unit B12, and the communication unit B13 may be similar to those of the control unit A11, the storage unit A12, and the communication unit A13, respectively.

[0030] In the first embodiment, the second service is taken as an example to be service 2 in FIG. 1 (a service provided by a securities company), but the second service may be any other service. For example, the second service may be the same as the first service. When the second service is different from the first service, the second service may be a service other than the first service among the services exemplified in the description of the first service. The first device A and the second device B may be devices used for private or other purposes, regardless of any service.

[0031] In the first embodiment, a case is taken as an example where higher security is required for the second device B than for the first device A. For example, limiting the data that can be transmitted to the network N corresponds to high security. When the second device B transmits the same data as the first device A to the outside, the second device B needs to process the data more than the first device A. For example, the first device A can transmit data in matrix format to the network N without changing the number of rows, but the second device B needs to change the number of rows of the data in matrix format before transmitting it to the network N.

[0032] Hereinafter, when the first device A and the second device B are not distinguished from each other, they are simply referred to as devices and the reference numerals are omitted. When the control units A11 and B11, the storage units A12 and B12, and the communication units A13 and B13 are not distinguished from each other, they are respectively referred to as control unit 11, storage unit 12, and communication unit 13 and the alphabet at the beginning of the reference numerals is omitted. The program stored in the storage unit 12 may be supplied to the device via the network N. In addition, the program stored in a computer-readable information storage medium may be supplied to the device via a reading unit (e.g., an optical disk drive or a memory card slot) that reads the information storage medium, or an input / output unit (e.g., a USB port) that inputs and outputs data to and from an external device.

[0033] In addition, in the computing system 10, each of a plurality of devices including the first device A, the second device B, and other devices may be capable of communication. That is, the computing system 10 may include other devices other than the first device A and the second device B. For example, the other devices are a server computer, a personal computer, a tablet, or a smartphone. The computing system 10 may include a plurality of other devices. When there are four services as in FIG. 1, the computing system 10 includes the first device A, the second device B, and at least two other devices.

[0034] For example, when the computing system 10 includes other devices, the second device B is required to have relatively high security among the multiple devices. The other devices may have a function similar to the first device A or the second device B. When the other devices have a function similar to the first device A, the inclusion of the first device A and the other devices in the computing system 10 means that the computing system 10 includes a plurality of first devices A. When the other devices have a function similar to the second device B, the inclusion of the second device B and the other devices in the computing system 10 means that the computing system 10 includes a plurality of second devices B.

[0035] [3. Functions realized by the computing system of the first embodiment] 5 is a diagram showing an example of functions realized by the computing system 10 of the first embodiment. For example, the first device A includes a first data storage unit A100, a first acquisition unit A101, a first transmission unit A102, a second open product calculation unit A103, a third transmission unit A104, and a second reception unit A105. The first data storage unit A100 is realized by the storage unit A12. The first acquisition unit A101, the first transmission unit A102, the second open product calculation unit A103, and the third transmission unit A104 are realized by the control unit A11.

[0036] For example, the second device B includes a second data storage unit B100, a second acquisition unit B101, a first receiving unit B102, a first public product calculation unit B103, a second transmission unit B104, a third receiving unit B105, and a first secret product calculation unit B106. The second data storage unit B100 is realized by the storage unit B12. The second acquisition unit B101, the first receiving unit B102, the first public product calculation unit B103, the second transmission unit B104, the third receiving unit B105, and the first secret product calculation unit B106 are realized by the control unit B11.

[0037] [First data storage unit] The first data storage unit A100 stores data necessary for processing executed by the first device A. For example, the first data storage unit A100 stores a first learning model AM and first secret information y. The first learning model AM is a learning model M managed by the first device A. The first device A executes learning of the first learning model AM using an associative learning technique.

[0038] For example, the first data storage unit A100 stores first secret information y. The first secret information y is information that is managed in secret by the first device A. In principle, the first secret information y is not transmitted to devices other than the first device A. The first secret information y is information indicating one numerical value or information including multiple numerical values. In the first embodiment, a case where the first secret information y is in a vector format is taken as an example, but the first secret information y may be any information whose product can be calculated, and may be, for example, one numerical value, multiple numerical values, a matrix, an array, a data frame, or other information.

[0039] In the first embodiment, the first device A calculates the first secret information y in the learning process of the first learning model AM in the associative learning. For example, the first device A may acquire a part of the parameters of the first learning model AM as the first secret information y, or may acquire information calculated from the part as the first secret information y. For example, the first secret information y is a value obtained by multiplying a part of the parameters of the current first learning model AM by the estimation result of the current first learning model AM.

[0040] In addition, the first secret information y may be information about each of a plurality of users in the first service. For example, the first secret information y may include a value obtained by multiplying a part of the parameters of the current first learning model AM by an estimated result of the annual income of each of the plurality of users by the current first learning model AM. In this case, the number of dimensions of the first secret information y is the number of users. For another example, the first secret information y may be information in which personal information such as the user's age group or gender is quantified (quantified). The first secret information y may be information in which each of a plurality of personal information of the user is quantified.

[0041] In addition, the user identification information of each of the multiple users in the first service and the user identification information of each of the multiple users in the second service may be the same. The user identification information is information that can identify a user. For example, a login account, an email address, or a phone number corresponds to the user identification information. In the first embodiment, a case in which the user identification information is common to the first service and the second service is taken as an example, but the user identification information may be different between the first service and the second service. In this case, it is assumed that data exists that defines the correspondence between the user identification information in the first service and the user identification information in the second service for each user. It is assumed that this data is stored in the first data storage unit A100, the second data storage unit B100, or other locations.

[0042] The data stored in the first data storage unit A100 is not limited to the above example. The first data storage unit A100 can store any data. For example, the first data storage unit A100 stores training data of the first learning model AM. The training data includes an input portion input to the first learning model AM and an output portion corresponding to the input portion. The output portion corresponds to a correct answer during learning. The first device A performs local learning of the first learning model AM based on the training data stored in the first data storage unit A100. The first device A adjusts the parameters of the first learning model AM so that the output portion of the training data is output when the input portion of the training data is input.

[0043] In this embodiment, since a first learning model AM that estimates the user's annual income is created, the input part of the training data is some information about the user. For example, the characteristics of the user's demographic information in the first service correspond to the input part of the training data. The output part of the training data is the user's annual income. The annual income corresponding to the output part of the training data may be the annual income registered by the user in the first service, or the annual income registered by the user in another service. The annual income corresponding to the output part of the training data may be the annual income specified by the creator of the first learning model AM. The first device A may update the first learning model AM that has been locally learned by using a federated learning technique. This process will be described in the second embodiment. For example, the first data storage unit A100 may store various information described in the first embodiment in addition to the data described above.

[0044] [Second data storage unit] The second data storage unit B100 stores data necessary for processing executed by the second device B. For example, the second data storage unit B100 stores a second learning model BM and second secret information x. The second learning model BM is a learning model M managed by the second device B. The second device B executes learning of the second learning model BM using an associative learning technique.

[0045] For example, the second data storage unit B100 stores second secret information x. The second secret information x is information that is managed in secret by the second device B. In principle, the second secret information x is not transmitted to devices other than the second device B. The second secret information x is information indicating one numerical value or information including multiple numerical values. In the first embodiment, the second secret information x is in a vector format as an example, but the second secret information x may be any information whose product can be calculated, and may be, for example, one numerical value, multiple numerical values, a matrix, an array, a data frame, or other information.

[0046] In the first embodiment, the second device B calculates the second secret information x in the learning process of the second learning model BM in the associative learning. For example, the second device B may acquire a part of the parameters of the second learning model BM as the second secret information x, or may acquire information calculated from the part as the second secret information x. For example, the second secret information x is a value obtained by multiplying a part of the parameters of the current second learning model BM by the estimation result of the current second learning model BM.

[0047] In addition, the second secret information x may be information about each of the multiple users in the second service. For example, the second secret information x may include a value obtained by multiplying a part of the parameters of the current second learning model BM by the estimated annual income of each of the multiple users by the current second learning model BM. In this case, the number of dimensions of the second secret information x is the number of users. For another example, the second secret information x may be information in which personal information such as the user's age group or gender is quantified. The second secret information x may be information in which each of the user's multiple personal information is quantified.

[0048] The data stored in the second data storage unit B100 is not limited to the above example. The second data storage unit B100 can store any data. For example, the second data storage unit B100 stores training data of the second learning model BM. The training data includes an input portion input to the second learning model BM and an output portion corresponding to the input portion. The output portion corresponds to the correct answer during learning. The second device B performs local learning of the second learning model BM based on the training data stored in the second data storage unit B100. The second device B adjusts the parameters of the second learning model BM so that the output portion of the training data is output when the input portion of the training data is input.

[0049] In this embodiment, since the second learning model BM that estimates the user's annual income is created, the input part of the training data is some information about the user. For example, the characteristics of the user's demographic information in the second service correspond to the input part of the training data. The output part of the training data is the user's annual income. The annual income corresponding to the output part of the training data may be the annual income registered by the user in the second service, or the annual income registered by the user in another service. The annual income corresponding to the output part of the training data may be the annual income specified by the creator of the second learning model BM. The second device B may update the second learning model BM that has been locally learned using a federated learning technique. This process will be described in the second embodiment. For example, the second data storage unit B100 may store various information described in the first embodiment in addition to the data described above.

[0050] Fig. 6 is a diagram showing an example of a process executed in the computing system 10 of the first embodiment. The first device A executes a program stored in the first data storage unit A100, and the second device B executes a program stored in the second data storage unit B100, thereby executing the process of Fig. 6. Hereinafter, with reference to Fig. 6, the first acquisition unit A101, the first transmission unit A102, the second public product calculation unit A103, and the third transmission unit A104 of the first device A, and the second acquisition unit B101, the first reception unit B102, the first public product calculation unit B103, the second transmission unit B104, the third reception unit B105, and the first private product calculation unit B106 of the second device B will be described in detail.

[0051] [First acquisition part] The first acquisition unit A101 acquires the first secret information y stored in the first data storage unit A100 (S100). By the process of S100, the first secret information y is read and expanded in a storage area of ​​a non-volatile memory. If the first secret information y has been expanded in the storage area in advance, the process of S100 does not need to be executed. The first acquisition unit A101 acquires the first public information Y and the third secret information v such that the product of the first public information Y disclosed to the second device B and the third secret information v managed in secret by the first device A becomes the first secret information y (S101).

[0052] In the first embodiment, a case is taken as an example in which the first acquisition unit A101 acquires the first public information Y and the third secret information v by calculating the first public information Y and the third secret information v by itself. Therefore, acquiring the first public information Y and the third secret information v has the same meaning as calculating the first public information Y and the third secret information v. The first acquisition unit A101 may acquire the first public information Y and the third secret information v calculated externally, instead of calculating the first public information Y and the third secret information v by itself. In this case, the first device A has a function of calculating the first public information Y and the third secret information v separately from the first acquisition unit A101. The calculation method by this function may be the same as the method described below.

[0053] FIG. 7 is a diagram showing an example of a method for calculating the first public information Y and the third secret information v. In the first embodiment, the first public information Y and the third secret information v are each in a matrix format, but the first public information Y and the third secret information v may be any information whose product can be calculated, and are not limited to a matrix format. For example, the first public information Y and the third secret information v may be one numerical value, multiple numerical values, a matrix, an array, a data frame, or other information. Similarly, in the first embodiment, the first part Y' and the second part y' described below are each in a matrix format, but may be in other formats.

[0054] For example, the first acquisition unit A101 acquires the first public information Y and the third secret information v based on at least one random number. In the first embodiment, a case is exemplified in which the random number for acquiring the first public information Y and the random number for acquiring the third secret information v are different, but these random numbers may be the same. That is, the first acquisition unit A101 may acquire each of the first public information Y and the third secret information v based on the same random number. A publicly known algorithm may be used as the algorithm for generating the random number. For example, the first acquisition unit A101 may generate the random number based on a linear congruential method, a multiplicative congruential method, an M-sequence method, or a Mersenne Twister method. The first acquisition unit A101 may not generate the random number by itself, but may acquire a random number that has been generated in advance and stored in the first data storage unit A100.

[0055] For example, the first acquisition unit A101 acquires a first portion Y', which is a part of the first public information Y, based on the first random number. In the example of FIG. 7, the first secret information y is a matrix (column vector) of n (n is a natural number) × 1. The first public information Y is a matrix of n × k (k is a natural number). The first portion Y' is a matrix of n × (k-1). That is, the first portion Y' has one less column than the first public information Y. For example, the first portion Y' is a portion from the 1st column to the k-1th column of the first public information Y. The first acquisition unit A101 generates n × (k-1) first random numbers that are different from each other based on a random number generation algorithm, and acquires them as individual elements (components) constituting the first portion Y'. The same second random numbers may coincidentally exist among the n × (k-1) numerical values.

[0056] For example, the first acquisition unit A101 acquires third secret information v (in the example of FIG. 7, v′ and v k ) is obtained. In the example of FIG. 7, the third secret information v is a k×1 matrix (column vector). The first acquisition unit A101 generates k second random numbers that are different from each other based on a random number generation algorithm, and acquires them as individual elements (components) that make up the third secret information v. The same second random number may happen to exist among the k numerical values. The first acquisition unit A101 acquires the second part y', which is the remaining part of the first public information Y, based on the first part Y' and the third secret information v.

[0057] For example, the first acquisition unit A101 acquires the second part y' such that the product of the first public information Y obtained by combining the second part y' with the first part Y' and the third secret information v becomes the first secret information y. In the example of FIG. 7, the first acquisition unit A101 acquires the product of the first part Y' and a part v' (e.g., a (k-1)×1 matrix) of the third secret information v and the remaining part v of the third secret information v. k The second part y' is obtained so that the product of v' (e.g., a scalar value) and the second part y' is the first secret information y. This calculation may be performed using an inverse matrix. In this manner, the first obtaining unit A101 generates the first part Y', which is a free random number, and obtains the first part v', which is a free random number, and the remaining part v k to obtain the second part y' in FIG.

[0058] In addition, the first acquisition unit A101 may acquire the first public information Y without being based on the first random number. For example, the first acquisition unit A101 may acquire the first public information Y such that the product of the third secret information v generated based on the second random number and the first public information Y becomes the first secret information y. In this case, the first random number is not used. Conversely, the first acquisition unit A101 may acquire the third secret information v without being based on the second random number. For example, the first acquisition unit A101 may acquire the third secret information v such that the product of the first public information Y generated based on the first random number and the third secret information v becomes the first secret information y. In this case, the second random number is not used. In these cases, the first acquisition unit A101 acquires the first public information Y without acquiring a plurality of parts such as the first part Y' and the second part y'.

[0059] For example, the first acquisition unit A101 may acquire the first public information Y and the third secret information v without being based on a random number. For example, the first acquisition unit A101 may acquire the first public information Y such that the product of the third secret information v generated without being based on a random number and the first public information Y becomes the first secret information y. In this case, the third secret information v may be information designated by an administrator or other person of the computing system 10, or may be information generated using an algorithm other than a random number. Conversely, the first public information Y may be information not based on a random number, but since the first public information Y is transmitted over the network N, in the first embodiment, the first public information Y is assumed to be information in which a random number is directly or indirectly used.

[0060] [Second acquisition part] The second acquisition unit B101 acquires the second secret information x stored in the second data storage unit B100 (S102). By the process of S102, the second secret information x is read and expanded in a storage area of ​​a non-volatile memory. If the second secret information x has been expanded in the storage area in advance, the process of S102 does not need to be executed. The second acquisition unit B101 acquires the first calculation information X and the fourth secret information u, which is managed secretly in the second device B, so that the product of the first calculation information X, the product of which is calculated with the first public information Y, and the fourth secret information u becomes the second secret information x (S103).

[0061] In the first embodiment, the second acquisition unit B101 acquires the first calculation information X and the fourth secret information u by calculating the first calculation information X and the fourth secret information u by itself. Therefore, acquiring the first calculation information X and the fourth secret information u has the same meaning as calculating the first calculation information X and the fourth secret information u. The second acquisition unit B101 may acquire the first calculation information X and the fourth secret information u calculated externally, instead of calculating the first calculation information X and the fourth secret information u by itself. In this case, the second device B has a function of calculating the first calculation information X and the fourth secret information u separately from the second acquisition unit B101. The calculation method by this function may be the same as the method described below.

[0062] In the first embodiment, the calculation method of the first calculation information X and the fourth secret information u is the same as the calculation method of the first public information Y and the third secret information v, but these calculation methods may be different from each other. Furthermore, in the first embodiment, the calculation method of the first calculation information X and the fourth secret information u is in a matrix format, but the first calculation information X and the fourth secret information u may be information whose product can be calculated, and are not limited to the matrix format. For example, the first calculation information X and the fourth secret information u may be one numerical value, multiple numerical values, a matrix, an array, a data frame, or other information. Similarly, in the first embodiment, the calculation method of the third part X' and the fourth part x' described later is in a matrix format, but may be in other formats.

[0063] For example, the second acquisition unit B101 acquires the first calculation information X and the fourth secret information u based on at least one random number. In the first embodiment, a case is exemplified in which the random number for acquiring the first calculation information X is different from the random number for acquiring the fourth secret information u, but these random numbers may be the same. That is, the second acquisition unit B101 may acquire each of the first calculation information X and the fourth secret information u based on the same random number. A publicly known algorithm may be used as an algorithm for generating random numbers. For example, the second acquisition unit B101 may generate random numbers based on a linear congruential algorithm, a multiplicative congruential algorithm, an M-sequence algorithm, or a Mersenne Twister algorithm. The second acquisition unit B101 may not generate random numbers by itself, but may acquire random numbers that have been generated in advance and stored in the first data storage unit A100.

[0064] For example, the second acquisition unit B101 acquires a third part X', which is a part of the first calculation information X, based on the third random number. The second secret information x is an n×1 matrix (column vector). For example, the first calculation information X is an n×j (j is a natural number smaller than k) matrix. The third part X' is an n×(j-1) matrix. That is, the third part X' has one less column than the first calculation information X. For example, the third part X' is a part from the 1st column to the j-1th column of the first calculation information X. The second acquisition unit B101 generates n×(j-1) third random numbers that are different from each other based on a random number generation algorithm, and acquires them as individual elements (components) constituting the third part X'. The same fourth random number may coincidentally exist among the n×(j-1) numerical values.

[0065] For example, the second acquisition unit B101 acquires the fourth secret information u based on the fourth random number. In the example of FIG. 7, the fourth secret information u is a j×1 matrix (column vector). The second acquisition unit B101 generates j mutually different fourth random numbers based on a random number generation algorithm and acquires them as individual elements (components) constituting the fourth secret information u. The same fourth random number may coincidentally exist among the j numerical values. The second acquisition unit B101 acquires the fourth part x', which is the remaining part of the first calculation information X, based on the third part X' and the fourth secret information u.

[0066] For example, the second acquisition unit B101 acquires the fourth portion x' such that the product of the first calculation information X obtained by combining the third portion X' with the fourth portion x' and the fourth secret information u becomes the second secret information x. The second acquisition unit B101 acquires the product of the third portion X' and a part u' (e.g., a (j-1)×1 matrix) of the fourth secret information u and the remaining part u of the fourth secret information u. j The fourth portion x' is obtained such that the product of the second secret information x and the fourth portion x' (e.g., a scalar value) is the second secret information x. This calculation may be performed using an inverse matrix.

[0067] In addition, the second acquisition unit B101 may acquire the first calculation information X without being based on the third random number. For example, the second acquisition unit B101 may acquire the first calculation information X such that the product of the fourth secret information u generated based on the fourth random number and the first calculation information X becomes the second secret information x. In this case, the third random number is not used. Conversely, the second acquisition unit B101 may acquire the fourth secret information u without being based on the fourth random number. For example, the second acquisition unit B101 may acquire the fourth secret information u such that the product of the first calculation information X generated based on the third random number and the fourth secret information u becomes the second secret information x. In this case, the fourth random number is not used. In these cases, the second acquisition unit B101 acquires the first calculation information X without acquiring multiple parts such as the third part X' and the fourth part x'.

[0068] For example, the second acquisition unit B101 may acquire the first calculation information X and the fourth secret information u without using a random number. For example, the second acquisition unit B101 may acquire the first calculation information X such that the product of the fourth secret information u generated without using a random number and the first calculation information X becomes the second secret information x. In this case, the fourth secret information u may be information designated by the administrator of the calculation system 10 or other person, or may be information generated using an algorithm other than a random number. On the other hand, the first calculation information X may be information not based on a random number, but since the first calculation information X is transmitted over the network N, in the first embodiment, the first calculation information X is assumed to be information using a random number directly or indirectly.

[0069] [First transmission section] The first transmission unit A102 of the first device A transmits the first public information Y to the second device B (S104). In the first embodiment, a case is exemplified in which the first transmission unit A102 encrypts the first public information Y based on a predetermined encryption algorithm and then transmits it to the second device B, but the first transmission unit A102 may transmit the first public information Y to the second device B in plain text without encrypting it.

[0070] [First receiving section] The first receiving unit B102 of the second device B receives the first public information Y from the first device A (S105). In the first embodiment, since the first public information Y is encrypted, the first receiving unit B102 decrypts the first public information Y received from the first device A. When the first public information Y is transmitted in plaintext, the first receiving unit B102 does not perform decryption.

[0071] [1st Public Product Calculation Department] The first public product calculation unit B103 of the second device B calculates the first public product X, which is the product of the first calculation information X and the first public information Y. T In S106, the first public product calculation unit B103 may calculate the product of the first calculation information X and the first public information Y based on a known calculation method for calculating the product of matrices. The first public product calculation unit B103 calculates the number of rows of the second secret information x and the first public product X T The first public product X is such that the number of rows of Y is different from T Y may be calculable. When a product of a matrix and another matrix is ​​calculated, the two matrices have a number of rows and a number of columns that allow the product of each matrix to be calculated. This also applies to the calculation of the product in processes other than S106.

[0072] [Second transmission section] The second transmitting unit B104 of the second device B transmits the first open product X T In the first embodiment, the second transmission unit B104 transmits the first public product X based on a predetermined encryption algorithm. T In the example shown, Y is encrypted and then transmitted to the first device A. The second transmission unit B104 transmits the first public product X T Y may be sent in the clear without being encrypted.

[0073] [Second receiving section] The second receiving unit A105 of the first device A receives the first open product X T In the first embodiment, the first open product X T Since Y is encrypted, the second receiving unit A105 receives the first public product X TThe second receiving unit A105 decrypts Y. When the first public information Y is transmitted in plaintext, the second receiving unit A105 does not perform decryption.

[0074] [Second Public Product Calculation Department] The second open product calculation unit A103 calculates the first open product X T The second public product (X T In S109, the second public product calculation unit A103 calculates the first public product X T The product of Y and the third secret information v may be calculated.

[0075] [Third Transmission Unit] The third transmission unit A104 of the first device A transmits the second public product X T Send Yv (S110). X T Yv is (X T Y) v, and (X T Calculation results of Y)·v are shown in FIG. 1. In the first embodiment, an example is given in which the third transmission unit A104 encrypts the first public information Y based on a predetermined encryption algorithm and then transmits it to the second device B, but the first transmission unit A102 may transmit the first public information Y to the second device B in plain text without encrypting it.

[0076] [Third receiving section] The third receiving unit B105 receives the second open product X from the first device A. T In the first embodiment, the second open product X T Since Yv is encrypted, the third receiving unit B105 receives the second public product X T Decrypt Yv. Second public product X T If Yv is transmitted in plain text, the third receiving unit B105 does not perform decryption.

[0077] [First secret product calculation section] In the computing system 10, a first open product X of a first device A is calculated. TBased on Y, the third secret information v, and the fourth secret information u, a secret product x of the first secret information y and the second secret information x is calculated while the first secret information y and the second secret information x are kept secret. T In the first embodiment, the second device B calculates the secret product x T A case where a function for calculating y is provided will be explained.

[0078] The first secret product calculation unit B106 calculates the fourth secret information u and the second public product X T Based on Yv, the secret product x T y≡u T ·(X T In the first embodiment, the secret product x T A case where y is the inner product of the first secret information y and the second secret information x will be taken as an example, but the first secret product calculation unit B106 may calculate the product of the first secret information y and the second secret information x instead of the inner product. In S112, the first secret product calculation unit B106 calculates the product of the fourth secret information u and the second public product X based on a known calculation method for calculating the inner product of matrices. T The right side of the formula in S112 corresponds to the product of the first public information Y and the third secret information v, whose product is the first secret information y, and the fourth secret information u and the first calculation information X, whose product is the second secret information x, so the second device B can calculate the same value as the dot product of the first secret information y and the second secret information x.

[0079] For example, in computing system 10, a secret product x T Based on y, learning of the learning model M in the federated learning is performed. For example, the learning model M may be a model in stacking learning that performs a predetermined estimation based on the estimation results of each of a plurality of other learning models. In the first embodiment, the second device B performs learning of the secret product x T The second device B performs learning of the second learning model BM based on y. For example, the second device B performs learning of the second learning model BM based on the calculation formula shown in FIG.

[0080] [4. Summary of the first embodiment] The first device A of the first embodiment acquires the first public information Y and the third secret information v such that the product of the first public information Y made public to the second device B and the third secret information v managed in secret by the first device A becomes the first secret information y. The first device A transmits the first public information Y to the second device B. The second device B receives the first public information Y from the first device A. The second device B acquires the first calculation information X and the fourth secret information u such that the product of the first calculation information X, the product of which with the first public information Y is calculated, and the fourth secret information u, which is managed in secret by the second device B, becomes the second secret information x. The second device B calculates the first public product X, which is the product of the first calculation information X and the first public information Y, and obtains the fourth secret information u. T The second device B calculates the first open product X T The first device A transmits the first public product X from the second device B. T The computing system 10 receives the first public product X T Based on Y, the third secret information v, and the fourth secret information u, a secret product x of the first secret information y and the second secret information x is calculated while the first secret information y and the second secret information x are kept secret. T y is calculated. Since the first secret information y secretly managed by the first device A and the second secret information x secretly managed by the second device B are not directly transmitted, the secret product x T This improves security when calculating y. Even if a third party obtains information exchanged between the first device A and the second device B, the third party cannot identify the first secret information y and the second secret information x, thereby reducing the risk that the first secret information y and the second secret information x will be leaked to a third party.

[0081] The first device A has a first open product X T The second public product (X T Y)·v. The first device A calculates the second open product X T The second device B transmits the second public product X T The second device B receives the fourth secret information u and the second public product X T Based on Yv, the secret product x T y≡u T·(X T Yv) so that the second device B can calculate the secret product x T Security is improved when calculating y. If a third party were to calculate the first public product X T Y and the second public product X T Even if Yv is obtained, the first secret information y and the second secret information x cannot be identified by Yv alone, so that the risk of the first secret information y and the second secret information x being leaked to a third party can be reduced.

[0082] Furthermore, the computing system 10 acquires the first public information Y and the third secret information v based on at least one random number. This reduces the risk that the first secret information y and the second secret information x will be leaked to a third party, because even if a third party acquires the first public information Y and the third secret information v, these are information based on random numbers and the third secret information v cannot identify the first secret information y and the second secret information x.

[0083] Furthermore, the first device A obtains a first portion Y', which is a part of the first public information Y, based on the first random number. The first device A obtains third secret information v based on the second random number. The first device A obtains a second portion y', which is the remaining portion of the first public information Y, based on the first portion Y' and the third secret information v. This allows both the first public information Y and the third secret information v to contain elements of random numbers, thereby further improving security.

[0084] Moreover, the second device B acquires the first calculation information X and the fourth secret information u based on at least one random number. This reduces the risk that the first calculation information y and the second secret information x will be leaked to a third party, because the first calculation information X and the fourth secret information u are based on random numbers and a third party cannot identify the first secret information y and the second secret information x even if the third party acquires the first calculation information X and the fourth secret information u.

[0085] Moreover, the second device B obtains a third portion X', which is a part of the first calculation information X, based on the third random number. The second device B obtains a fourth secret information u, based on the fourth random number. The second device B obtains a fourth portion x', which is the remaining portion of the first calculation information X, based on the third portion X' and the fourth secret information u. This allows both the first calculation information X and the fourth secret information u to contain elements of random numbers, thereby further improving security.

[0086] The first secret information y and the second secret information x are each in a vector format. The first public information Y, the third secret information v, the first calculation information X, and the fourth secret information u are each in a matrix format. T Here, y is the dot product. This allows the computing system 10 to calculate the dot product of vectors without transmitting the vector, which should be kept secret, between the first device A and the second device B.

[0087] In addition, the second device B is required to have higher security than the first device A. The second device B calculates the number of rows of the second secret information x and the first public product X T The first public product X is such that the number of rows of Y is different from T Y can be calculated. This allows the computing system 10 to respond to requests from the second device B to send or receive information after changing the actual number of rows, thereby satisfying the security standards required for the second device B.

[0088] In addition, each of the first secret information y and the second secret information x is in a vector format. Each of the first public information Y, the third secret information v, the first calculation information X, the fourth secret information u, the first part Y', and the second part y' is in a matrix format. T Here, y is the dot product. This allows the computing system 10 to calculate the dot product of vectors without transmitting the vector, which should be kept secret, between the first device A and the second device B.

[0089] In addition, each of the first secret information y and the second secret information x is in a vector format, and each of the first public information Y, the third secret information v, the first calculation information X, the fourth secret information u, the third part X', and the fourth part x' is in a matrix format. T Here, y is the dot product. This allows the computing system 10 to calculate the dot product of vectors without transmitting the vector, which should be kept secret, between the first device A and the second device B.

[0090] Furthermore, in the computing system 10, a plurality of devices including a first device A, a second device B, and other devices can communicate with each other. Among the plurality of devices, the second device B is required to have a relatively high level of security. Even if the second device B is required to have a relatively high level of security, the computing system 10 can calculate the inner product of vectors without transmitting a vector that should be kept secret between the first device A and the second device B, and therefore can satisfy the security standard required for the second device B.

[0091] Also, in the computation system 10, the secret product x T Based on y, learning of the learning model M in federated learning is performed. This increases security during learning in federated learning.

[0092] Furthermore, the first device A calculates first secret information y in the learning process of the first learning model AM in the associative learning. The second device B calculates second secret information x in the learning process of the second learning model BM in the associative learning. This increases security during learning in the associative learning.

[0093] Furthermore, the learning model M is a model in stacking learning that performs a predetermined estimation based on the estimation results of each of a plurality of other learning models M. This enhances security during learning in stacking learning.

[0094] The first secret information y is information about each of a plurality of users in the first service. The second secret information x is information about each of a plurality of users in the second service. The calculation system 10 can calculate the product while keeping the information about the users secret, thereby reducing the risk of the information about the users being leaked.

[0095] In addition, the user identification information of each of the multiple users in the first service is the same as the user identification information of each of the multiple users in the second service, which makes it easier to identify which user the information transmitted between the first device A and the second device B is related to.

[0096] [5. Functions in the second embodiment] Next, a second embodiment, which is another embodiment of the calculation system 10, will be described. In the calculation system 10 of the second embodiment, a first device A calculates an inner product x T y is calculated. Note that a description of the same points as in the first embodiment will be omitted.

[0097] 8 is a diagram showing an example of functions realized by the computing system 10 of the second embodiment. For example, the first device A includes a third acquisition unit A106, a third public product calculation unit A107, a fourth transmission unit A108, a fifth reception unit A109, and a second secret product calculation unit A110. Each of the third acquisition unit A106, the third public product calculation unit A107, the fourth transmission unit A108, the fifth reception unit A109, and the second secret product calculation unit A110 is realized by the control unit A11. The second device B includes a fourth reception unit B107, a fourth public product calculation unit B108, and a fifth transmission unit B109. Each of the fourth reception unit B107, the fourth public product calculation unit B108, and the fifth transmission unit B109 is realized by the control unit B11.

[0098] 9 is a diagram showing an example of the processing executed by the computing system 10 of the second embodiment. The processing of S200, S201, S203, and S204 is similar to the processing of S100 to S103, respectively.

[0099] [Third acquisition part] The third acquisition unit A106 of the first device A acquires the fifth secret information V and the sixth secret information w, which are secretly managed by the first device A, such that the product of the fifth secret information V and the sixth secret information w becomes the third secret information v (S202). For example, the third acquisition unit A106 may acquire the fifth secret information V and the sixth secret information w based on at least one random number in the same manner as the first acquisition unit A101. The calculation method in this case is as described in the process of the first acquisition unit A101.

[0100] In the second embodiment, a case is exemplified in which the third acquisition unit A106 acquires the fifth secret information V and the sixth secret information w by calculating the fifth secret information V and the sixth secret information w by itself. Therefore, acquiring the fifth secret information V and the sixth secret information w has the same meaning as calculating the fifth secret information V and the sixth secret information w. The third acquisition unit A106 may acquire the fifth secret information V and the sixth secret information w calculated externally, instead of calculating the fifth secret information V and the sixth secret information w by itself. In this case, the first device A has a function of calculating the fifth secret information V and the sixth secret information w separately from the third acquisition unit A106. The calculation method by this function may be the same as the method described below.

[0101] In the second embodiment, the fifth secret information V and the sixth secret information w are each in a matrix format, but the fifth secret information V and the sixth secret information w may be any information that allows a product to be calculated, and are not limited to a matrix format. For example, the fifth secret information V and the sixth secret information w may be one numerical value, multiple numerical values, a matrix, an array, a data frame, or other information. When the third acquisition unit A106 acquires the fifth secret information V and the sixth secret information w in a manner similar to that of the first acquisition unit A101, the fifth secret information V and the sixth secret information w are each in a matrix format, but may be in other formats. Note that the third acquisition unit A106 may acquire the fifth secret information V and the sixth secret information w without using random numbers. In this case, the calculation method of the fifth secret information V and the sixth secret information w may be the same as the calculation method of the first public information Y and the third secret information v that are not based on random numbers.

[0102] [Third Public Product Calculation Department] The subsequent processes of S205 to S209 are the same as the processes of S104 to S108, respectively. T The third public product (X T In S210, the third public product calculation unit A107 calculates the first public product X T The product of Y and the fifth secret information V may be calculated.

[0103] [4th Transmission Unit] The fourth transmission unit A108 of the first device A transmits the third open product X T Send YV (S211). X T YV is (X T (X Y) V T In the second embodiment, the fourth transmission unit A108 calculates the third public product X based on a predetermined encryption algorithm. T In the example shown, YV is encrypted and then transmitted to the second device B. The fourth transmission unit A108 transmits the third public product X T YV may be sent in the clear without encryption.

[0104] [4th Receiver] The fourth receiving unit B107 of the second device B receives the third open product X T In the second embodiment, the third open product X T Since YV is encrypted, the fourth receiving unit B107 receives the third public product X T Decrypt YV. The third public product X T If YV is transmitted in the clear, the fourth receiving unit B107 does not perform decryption.

[0105] [4th Public Product Calculation Department] The fourth public product calculation unit B108 calculates the fourth secret information u and the third public product X T Based on YV and, the fourth open product u T ·(XT In S213, the fourth public product calculation unit B108 calculates the fourth secret information u and the third public product X T Just calculate the product of YV and .

[0106] [5th ​​Transmission Unit] The fifth transmitting unit B109 of the second device B transmits the fourth open product u T X T Transmit YV (S214). T X T YV is u T ·(X T YV) and u T ·(X T In the second embodiment, the fifth transmission unit B109 calculates the fourth public product u T X T In the example shown, YV is encrypted and then transmitted to the second device B. The fifth transmission unit B109 transmits the fourth public product u T X T YV may be sent in the clear without encryption.

[0107] [5th ​​Receiving Unit] The fifth receiving unit A109 of the first device A receives the fourth open product u from the second device B. T X T In the second embodiment, the fourth open product u T X T Since YV is encrypted, the fifth receiving unit A109 receives the fourth public product u T X T Decode YV. The fourth public product u T X T If YV is transmitted in the clear, the fifth receiving unit A109 does not perform decryption.

[0108] [Second secret product calculation section] The second private product calculation unit A110 of the first device A calculates the fourth public product u T X T Based on YV and the sixth secret information w, the secret product xT y≡(u T X T In the second embodiment, the secret product x T y is the fourth open product u T X T The case of the inner product of YV and the sixth secret information w will be taken as an example. However, the second secret product calculation unit A110 calculates the fourth public product u T X T In S216, the second secret product calculation unit A110 may calculate the product of YV and the sixth secret information w. In S216, the second secret product calculation unit A110 calculates the fourth public product u T X T It is only necessary to calculate the inner product of YV and the sixth secret information w. The right side of the formula in S216 corresponds to the product of the first public information Y, the fifth secret information V, and the sixth secret information w, whose product is the first secret information y, and the fourth secret information u and the first calculation information X, whose product is the second secret information x, so the first device A can calculate the same value as the inner product of the first secret information y and the second secret information x.

[0109] [6. Summary of the second embodiment] The first device A of the second embodiment acquires the fifth secret information V and the sixth secret information w, which are secretly managed by the first device A, so that the product of the fifth secret information V and the sixth secret information w becomes the third secret information v. The first device A obtains the first public product X T The third public product (X T Y)·V. The first device A calculates the third open product X T The second device B transmits the third open product X from the first device A. T The second device B receives the fourth secret information u and the third public product X T Based on YV and, the fourth open product u T ·(X T The second device B calculates the fourth open product u T X T The first device A transmits the fourth open product u from the second device B. T X T The first device A receives the fourth open product uT X T Based on YV and the sixth secret information w, the secret product x T y≡(u T X T YV) w. This allows the first device A to obtain the secret product x T Security is improved when calculating y. If a third party were to calculate the first public product X T Y, the third open product X T YV, and the fourth open product u T X T Even if YV is obtained, the first secret information y and the second secret information x cannot be identified by YV alone, so the risk of the first secret information y and the second secret information x being leaked to a third party can be reduced.

[0110] The first secret information y and the second secret information x are each in a vector format. The first public information Y, the third secret information v, the first calculation information X, the fourth secret information u, the fifth secret information V, and the sixth secret information w are each in a matrix format. T Here, y is the dot product. This allows the computing system 10 to calculate the dot product of vectors without transmitting the vector, which should be kept secret, between the first device A and the second device B.

[0111] [7. Modifications] The present disclosure is not limited to the above-described embodiments. It can be modified as appropriate without departing from the spirit of the present disclosure. For example, the calculation system 1 may have both the function described in the first embodiment and the function described in the second embodiment. The calculation system 1 can be applied to situations other than federated learning. The calculation system 1 can be applied to situations in which a product of multiple pieces of secret information is calculated for some purpose.

[0112] For example, the functions described as being realized by the first device A or the second device B may be realized by at least one computer in the computing system 10, or the functions may be shared among multiple computers. In this case, each of the multiple computers may transmit its own processing results to the other computers, thereby sharing the functions.

[0113] [8. Notes] For example, the computing system may be configured as follows. (1) A first device that secretly manages first secret information and a second device that secretly manages second secret information, The first device is a first acquisition unit that acquires first public information and third secret information that is managed in secret by the first device such that a product of first public information that is made public to the second device and third secret information that is managed in secret by the first device becomes the first secret information; a first transmission unit that transmits the first public information to the second device; Including, The second device is a first receiving unit that receives the first public information from the first device; a second acquisition unit that acquires first calculation information and fourth secret information that is managed secretly in the second device, so that a product of first calculation information, the product of which is calculated with the first public information, and fourth secret information becomes the second secret information; a first public product calculation unit that calculates a first public product that is a product of the first calculation information and the first public information; a second transmission unit configured to transmit the first public product to the first device; Including, The first device further includes a second receiving unit that receives the first open product from the second device, a secret product which is a product of the first secret information and the second secret information is calculated based on the first public product, the third secret information, and the fourth secret information, in a state in which the first secret information and the second secret information are managed in secret; Calculation system. (2) The first device is a second public product calculation unit that calculates a second public product that is a product of the first public product and the third secret information; a third transmitting unit configured to transmit the second public product to the second device; Further comprising: The second device is a third receiving unit that receives the second open product from the first device; a first secret product calculation unit that calculates the secret product based on the fourth secret information and the second public product; The computing system of (1) further comprising: (3) The first device is a third acquisition unit that acquires the fifth secret information and the sixth secret information, which are secretly managed in the first device, such that a product of the fifth secret information and the sixth secret information becomes the third secret information; a third public product calculation unit that calculates a third public product that is a product of the first public product and the fifth secret information; a fourth transmission unit that transmits the third public product to the second device; Including, The second device is a fourth receiving unit that receives the third open product from the first device; a fourth public product calculation unit that calculates a fourth public product based on the fourth secret information and the third public product; a fifth transmitting unit configured to transmit the fourth public product to the first device; Further comprising: The first device is a fifth receiving unit that receives the fourth open product from the second device; a second private product calculation unit that calculates the private product based on the fourth public product and the sixth private information; The computing system according to (1) or (2), further comprising: (4) the first acquisition unit acquires the first public information and the third secret information based on at least one random number; A computation system according to any one of (1) to (3). (5) The first acquisition unit is obtaining a first portion that is a part of the first public information based on a first random number; obtaining the third secret information based on the second random number; obtaining a second portion, which is a remaining portion of the first public information, based on the first portion and the third secret information; (4) A computing system according to claim 1. (6) the second acquisition unit acquires the first computation information and the fourth secret information based on at least one random number. A computation system according to any one of (1) to (5). (7) The second acquisition unit is obtaining a third portion of the first calculation information based on a third random number; obtaining the fourth secret information based on the fourth random number; obtaining a fourth part, which is a remaining part of the first computation information, based on the third part and the fourth secret information; (6) A computing system according to (6). (8) Each of the first secret information and the second secret information is in a vector format; each of the first public information, the third secret information, the first calculation information, and the fourth secret information is in a matrix format; The secret product is an inner product. A computation system according to any one of (1) to (7). (9) The second device is required to have higher security than the first device, the first public product calculation unit is capable of calculating the first public product such that the number of rows of the second secret information is different from the number of rows of the first public product. (8) A computing system according to (8). (10) Each of the first secret information and the second secret information is in a vector format; each of the first public information, the third secret information, the first calculation information, the fourth secret information, the fifth secret information, and the sixth secret information is in a matrix format; The secret product is an inner product. (3) A computing system according to (3). (11) Each of the first secret information and the second secret information is in a vector format; each of the first public information, the third secret information, the first computation information, the fourth secret information, the first portion, and the second portion is in a matrix form; The secret product is an inner product. (5) A computing system according to (5). (12) Each of the first secret information and the second secret information is in a vector format; each of the first public information, the third secret information, the first computation information, the fourth secret information, the third portion, and the fourth portion is in a matrix form; The secret product is an inner product. (7) A computing system according to (7). (13) In the computing system, each of a plurality of devices including the first device, the second device, and another device is capable of communicating with each other; The second device is required to have relatively high security among the plurality of devices. A computation system according to any one of (1) to (12). (14) In the computing system, learning of a learning model in federated learning is performed based on the secret product. A computation system according to any one of (1) to (13). (15) the first device calculates the first secret information in a learning process of a first learning model in the federated learning; The second device calculates the second secret information in a learning process of a second learning model in the federated learning. (14) A computing system according to (14). (16) The learning model is a model in stacking learning that performs a predetermined estimation based on each estimation result of a plurality of other learning models. A computing system according to (14) or (15). (17) the first secret information is information regarding each of a plurality of users in a first service; The second secret information is information regarding each of the plurality of users in the second service. A computation system according to any one of (1) to (16). (18) User identification information of each of the plurality of users in the first service is the same as user identification information of each of the plurality of users in the second service. (17) A computing system according to (17). [Explanation of symbols]

[0114] 10 Computing system, A first device, B second device, A11 control unit, A12 memory unit, A13 communication unit, B11 control unit, B12 memory unit, B13 communication unit, A100 first data memory unit, A101 first acquisition unit, A102 first transmission unit, A103 second public product calculation unit, A104 third transmission unit, A105 second reception unit, B100 second data memory unit, B101 second acquisition unit, B102 first reception unit, B103 first public product calculation unit, B104 second transmission unit, B105 third reception unit, B106 first secret product calculation unit.

Claims

1. A first device that secretly manages first secret information and a second device that secretly manages second secret information, The first device is a first acquisition unit that acquires first public information and third secret information that is managed in secret by the first device such that a product of first public information that is made public to the second device and third secret information that is managed in secret by the first device becomes the first secret information; a first transmission unit that transmits the first public information to the second device; Including, The second device is a first receiving unit that receives the first public information from the first device; a second acquisition unit that acquires first calculation information and fourth secret information that is managed secretly in the second device, so that a product of first calculation information, the product of which is calculated with the first public information, and fourth secret information becomes the second secret information; a first public product calculation unit that calculates a first public product that is a product of the first calculation information and the first public information; a second transmitter configured to transmit the first public product to the first device; Including, The first device further includes a second receiving unit that receives the first public product from the second device, a secret product which is a product of the first secret information and the second secret information is calculated based on the first public product, the third secret information, and the fourth secret information, in a state in which the first secret information and the second secret information are managed in secret; Calculation system.

2. The first device is a second public product calculation unit that calculates a second public product that is a product of the first public product and the third secret information; a third transmitter configured to transmit the second public product to the second device; Further comprising: The second device is a third receiving unit that receives the second open product from the first device; a first secret product calculation unit that calculates the secret product based on the fourth secret information and the second public product; The computing system of claim 1 further comprising:

3. The first device is a third acquisition unit that acquires the fifth secret information and the sixth secret information, which are secretly managed in the first device, such that a product of the fifth secret information and the sixth secret information becomes the third secret information; a third public product calculation unit that calculates a third public product that is a product of the first public product and the fifth secret information; a fourth transmitter configured to transmit the third public product to the second device; Including, The second device is a fourth receiving unit that receives the third open product from the first device; a fourth public product calculation unit that calculates a fourth public product based on the fourth secret information and the third public product; a fifth transmitting unit configured to transmit the fourth public product to the first device; Further comprising: The first device is a fifth receiving unit that receives the fourth open product from the second device; a second private product calculation unit that calculates the private product based on the fourth public product and the sixth private information; The computing system of claim 1 or 2, further comprising:

4. the first acquisition unit acquires the first public information and the third secret information based on at least one random number. A computing system according to claim 1 or 2.

5. The first acquisition unit is obtaining a first portion of the first public information based on a first random number; obtaining the third secret information based on the second random number; obtaining a second portion, which is a remaining portion of the first public information, based on the first portion and the third secret information; The computing system of claim 4.

6. the second acquisition unit acquires the first calculation information and the fourth secret information based on at least one random number. A computing system according to claim 1 or 2.

7. The second acquisition unit is obtaining a third portion of the first calculation information based on a third random number; obtaining the fourth secret information based on a fourth random number; obtaining a fourth portion, which is a remaining portion of the first computational information, based on the third portion and the fourth secret information; The computing system of claim 6.

8. each of the first secret information and the second secret information is in a vector format; each of the first public information, the third secret information, the first calculation information, and the fourth secret information is in a matrix form; The secret product is an inner product. A computing system according to claim 1 or 2.

9. The second device is required to have higher security than the first device, the first public product calculation unit is capable of calculating the first public product such that the number of rows of the second secret information is different from the number of rows of the first public product. The computing system of claim 8.

10. each of the first secret information and the second secret information is in a vector format; each of the first public information, the third secret information, the first calculation information, the fourth secret information, the fifth secret information, and the sixth secret information is in a matrix form; The secret product is an inner product. The computing system of claim 3.

11. each of the first secret information and the second secret information is in a vector format; each of the first public information, the third secret information, the first calculation information, the fourth secret information, the first portion, and the second portion is in a matrix form; The secret product is an inner product. The computing system of claim 5.

12. each of the first secret information and the second secret information is in a vector format; each of the first public information, the third secret information, the first computation information, the fourth secret information, the third portion, and the fourth portion is in a matrix form; The secret product is an inner product. The computing system of claim 7.

13. In the computing system, each of a plurality of devices including the first device, the second device, and another device is capable of communicating with each other; The second device is required to have relatively high security among the plurality of devices. A computing system according to claim 1 or 2.

14. In the computing system, learning of a learning model in federated learning is performed based on the secret product. A computing system according to claim 1 or 2.

15. the first device calculates the first secret information in a learning process of a first learning model in the federated learning; The second device calculates the second secret information in a learning process of a second learning model in the federated learning.

15. The computing system of claim 14.

16. The learning model is a model in stacking learning that performs a predetermined estimation based on each estimation result of a plurality of other learning models.

15. The computing system of claim 14.

17. the first secret information is information regarding each of a plurality of users in a first service; The second secret information is information regarding each of the plurality of users in the second service. A computing system according to claim 1 or 2.

18. User identification information of each of the plurality of users in the first service is the same as user identification information of each of the plurality of users in the second service.

20. The computing system of claim 17.

19. The method is executed by a first device that secretly manages first secret information and a second device that secretly manages second secret information, The first device is acquiring the first public information and the third secret information that is managed in secret by the first device such that a product of the first public information that is made public to the second device and the third secret information that is managed in secret by the first device becomes the first secret information; Transmitting the first public information to the second device; The second device is receiving the first public information from the first device; acquiring first calculation information and fourth secret information that is managed secretly in the second device, so that a product of first calculation information, the product of which is calculated with the first public information, and fourth secret information becomes the second secret information; Calculating a first public product that is a product of the first calculated information and the first public information; Sending the first public product to the first device; the first device receives the first public product from the second device; a secret product which is a product of the first secret information and the second secret information is calculated based on the first public product, the third secret information, and the fourth secret information, in a state in which the first secret information and the second secret information are managed in secret; Calculation method.

20. 3. A non-transitory information storage medium storing a program for causing a computer to operate as the first device or the second device according to claim 1 or 2.

Images