SECRET COMBINATION DEVICE, SECRET COMBINATION METHOD, AND PROGRAM

Abstract

A secret equijoin device according to the present invention uses, as input, a first concealed table that is concealed information of a first table including a plurality of keys and a second concealed table that is concealed information of a second table including a plurality of keys, obtains a first concealed addition table that is concealed information of a first addition table in which a sub-key sequence has been added to the first table by secure computation, obtains a second concealed addition table that is concealed information of a second addition table in which a sub-key sequence has been further added to a third table prepared by duplicating and adding records in the second table multiple times, and obtains a concealed junction table that is concealed information of a junction table in which the first addition table and the second addition table are equi-joined, using pairs of keys and sub-keys as key attributes.

Description

[Technical Field]

[0001] The present invention relates to a secure computation technique, and more particularly to a secure equijoin technique for equijoining two tables while keeping the information in the tables secret. [Background technology]

[0002] In general cryptography, even if data that needs to be kept secret is encrypted and stored on a server, when calculations are performed using the values, the data must first be restored (decrypted) before the calculation can be performed. However, there is a technology called secure computation that allows calculations to be performed while keeping the data secret. In secure computation, a numerical value is converted into multiple secret shares, and multiple secure computing devices each have a share, and perform addition, multiplication, logical operations, etc. without leaking information about their own shares (multi-party protocol).

[0003] Furthermore, when performing calculations using tables stored in a database, it is possible that one table does not contain all the information necessary for the calculation, and calculations must be performed by collecting information from multiple tables. In this case, preprocessing is required to join multiple tables. Patent Document 1 discloses a technology for performing an equi-join of two tables using elements (keys) of a selected key column as key attributes while keeping the table information confidential. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] International Publication No. 2018 / 061800 Summary of the Invention [Problem to be solved by the invention]

[0005] The technique of Patent Document 1 can also be applied to a case where the key column of one of two tables to be equijoined contains multiple keys (key attributes) with the same value.

[0006] However, when the key string of one table contains multiple keys with the same value, and the key string of the other table also contains multiple keys with the same value, the technology of Patent Document 1 cannot be directly applied.

[0007] Here, if the maximum number of keys with the same value contained in the key string of one of the tables (maximum number of duplicates) is KL, the table can be divided into KL tables whose key strings do not contain keys with the same value, and using the technology of Patent Document 1, secret equal joins can be performed KL times, and the resulting KL tables can be joined to obtain the output.

[0008] However, it is difficult to split a table while keeping the values ​​secret, and information about each split table (for example, information about the number of keys with the same value contained in the table before splitting) is leaked during the table splitting process. Furthermore, this method requires processing time not only for the secret join but also for splitting the table before the secret join and for joining the table after the secret join. In particular, the table join process cannot be parallelized, which becomes a bottleneck in processing performance.

[0009] This invention provides a technology that can quickly perform an equijoin of two tables while keeping the table information confidential, even when the key column of one of the two tables to be equijoined contains multiple keys with the same value and the key column of the other table also contains multiple keys with the same value. [Means for solving the problem]

[0010] The following processing is performed on a first anonymization table, which is the anonymization information of a first table including a first key string having a plurality of first keys and a first arbitrary element string having a plurality of first arbitrary elements, and a second anonymization table, which is the anonymization information of a second table including a second key string having a plurality of second keys and a second arbitrary element string having a plurality of second arbitrary elements.

[0011] A first subkey string adding unit obtains a first anonymization addition table, which is secret information of the first addition table obtained by adding the first subkey string to the first table, by secure computation using the first anonymization table. The first subkey string has a plurality of first subkeys, and each of the first keys is associated with one of the first subkeys. The maximum number of first keys having the same value included in the first key string is KL, where KL is an integer equal to or greater than 2. The first keys having the same value are associated with first subkeys having different values.

[0012] The second subkey string adding unit obtains a second anonymization added table, which is secret information of the second added table obtained by adding the second subkey string to the third table, by secure computation using the second anonymization table. The third table is a table obtained by adding a plurality of duplicate records obtained by replicating each record of the second table K times (where K≧KL) to the second table. Each record of the second table includes a second key and a second arbitrary element. The third table includes a third key string having a plurality of third keys including the second key and a duplicate of the second key, and a third arbitrary element string having a plurality of third arbitrary elements including the second arbitrary element and a duplicate of the second arbitrary element. The second subkey string has a plurality of second subkeys. Each of the third keys is associated with one of the second subkeys. When the third key string includes a third key that represents the same common value as any of the first keys, at least a portion of the third keys that represent the common value is associated with a second subkey that has the same value as the first subkey that is associated with the first key that represents the common value.

[0013] The secret equal combination unit obtains, by secret calculation using the first anonymized additional table and the second anonymized additional table, an anonymized combined table which is secret information of a combined table obtained by equal-combining the first additional table and the second additional table, with the pair of the first key and the first subkey as the key attribute of the first additional table and the pair of the third key and the second subkey as the key attribute of the second additional table. [Effects of the Invention]

[0014] This allows for a high-speed equijoin of two tables while keeping the table information confidential, even if the key column of one of the two tables to be equijoined contains multiple keys with the same value, and the key column of the other table also contains multiple keys with the same value. [Brief explanation of the drawings]

[0015] [Figure 1] FIG. 1 is a block diagram illustrating the configuration of a secret equality combining system according to an embodiment. [Figure 2] FIG. 2 is a block diagram illustrating the configuration of the secret combination device according to the embodiment. [Figure 3] FIG. 3 is a flow diagram illustrating the secret equality combining method of the embodiment. [Figure 4] Fig. 4A is a diagram illustrating an example of a table 110 (first table) to be equijoined, and Fig. 4B is a diagram illustrating an example of a table 120 (second table) to be equijoined. [Figure 5] Fig. 5A is a diagram illustrating an example of added table 130 (first added table) obtained by adding a subkey string (first subkey string) to table 110 (first table). Fig. 5B is a diagram illustrating an example of table 140 (third table) obtained by adding multiple duplicate records obtained by duplicating each record of table 120 (second table) to table 120. [Figure 6] FIG. 6 is a diagram illustrating an additional table 150 (second additional table) in which a subkey string 151 (second subkey string) is added to the table 140 (third table). [Figure 7] Figures 7A to 7C are diagrams illustrating tables to be equijoined, and Figure 7D is a diagram illustrating a table obtained by equijoining the tables of Figures 7A to 7C. [Figure 8] FIG. 8 is a diagram illustrating an equijoin. [Figure 9]Fig. 9A is a diagram illustrating a table (first added table) obtained by adding a sequence number (SeqNo) column (first subkey column) to the table (first table) of Fig. 7B. Fig. 9B is a diagram illustrating a table (second added table) obtained by adding multiple duplicate records obtained by duplicating each record of the table (second table) of Fig. 7C to the table, and further adding a sequence number column (second subkey column). [Figure 10] Figure 10 is a diagram illustrating an example of a table that is an equal-join of the table in Figure 9A (first additional table) and the table in Figure 9B (second additional table), using a pair of identifier (ID) and sequence number (SeqNo) as key attributes. [Figure 11] FIG. 11 is a block diagram illustrating a hardware configuration of the secret combination device according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0016] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. [Term and symbol definitions] The terms and symbols used in this embodiment are defined below. The following symbols are used to represent tables: TX: A column X in table T is denoted as TX. The jth record of table T is j where j is an integer greater than or equal to 0. The value of column X in the jth record of table T is TX j It is written as follows.

[0017] Cross join: A cross join, also known as a cross join, returns the records in table TL for every combination of records in two input tables TL and TR. j and records TL in table TR pwhere j is an integer equal to or greater than 0, p is an integer equal to or greater than 0, j=0,...,LRN-1, p=0,...,RRN-1, LRN is a positive integer representing the number of records in table TL, and RRN is a positive integer representing the number of records in table TR. In other words, table TLR, which is the cross join result, is the table TLR that associates the records (TL0,...,TL LRN-1 and TR0,...,TR RRN-1 ) is the Cartesian product of the two tables. The number of records in table TLR, which is the cross join result of table TL and table TR, is LRN*RRN. However, "*" is the operator that represents multiplication. In actual use, it is common to extract and use only records that satisfy certain conditions from this table TRL.

[0018] Equijoin: An equijoin, also known as an equalization join or inner join, is a join that joins two input tables TL and TR together to create a cross join of the two input tables, TL and TR, and then joins the resulting table, TRL, with the selected attribute from table TL (key attribute TL.Key j ) and attributes selected from table TR (key attribute TR.Key p ) and the equal sign (TL.Key j =TR.Key p ) is true. The key attribute is the element of the selected column. In other words, an equijoin is a method of joining two tables, TL and TR, to obtain a table ETRL that contains only the records for which TL.Key is true. j =TR.Key p For all combinations of records that satisfy j and records TL in table TR p This is a table join method that obtains a table ETLR that associates

[0019] The following notation is used to represent confidential information: [a]: The secret information of a is written as [a]. For example, a∈Z n[a] may be the share obtained by secretly sharing a so that it can be calculated securely (see, for example, Reference 1), or it may be the ciphertext (homomorphic encryption ciphertext) obtained by encrypting a so that it can be calculated securely. When a is secretly shared among N parties (N is an integer greater than or equal to 1), N types of shares for a are given as [a]0,...[a] N-1 The result is a share [a]0,...[a] N-1 However, since the algorithm for these secure computations is common to all shares, [a]0,...[a] N-1 We will omit the subscript and write it as [a]. Reference 1: Koji Senda, Hiroki Hamada, Dai Igarashi, Katsumi Takahashi, "A Three-Party Secure Function Evaluation with Lightweight Verifiability Revisited," in CSS, 2010. Z n :Z n represents a finite ring consisting of the set of integers from 0 to n-1 (n is an integer greater than or equal to 1). [T]: The confidential information of a table T is denoted as [T]. [TX]: The confidential information in column TX is represented as [TX]. Each record (i.e., each field) in [TX] stores a confidential value. [T j ]:Record T j The confidential information of [T j ] is written as [T j ] contains an anonymized value in each column (i.e., each field). [TX j ]: Value TX of column X in the jth record of table T j Confidential information of [TX j In other words, each field in [T] stores confidential information about the value of each field in table T.

[0020] [First embodiment] A first embodiment of the present invention will be described. <Configuration> 1, the secret equal-combining system 1 of this embodiment includes N secret equal-combining apparatuses 10-0, ..., 10-(N-1). The secret equal-combining apparatuses 10-0, ..., 10-(N-1) of this embodiment are communicably connected via a network. Here, when secure computation based on secret sharing is performed, N is an integer of 2 or more (for example, N=3), and when secure computation based on homomorphic encryption is performed, N is an integer of 1 or more (for example, N=1).

[0021] 2, each secret equalization apparatus 10-n (where n=0, ..., N-1) has an input unit 11-n, a storage unit 12-n, a subkey string adding unit 13-n (first subkey string adding unit), a subkey string adding unit 14-n (second subkey string adding unit), a secret equalization apparatus 15-n, an output unit 16-n, a control unit 17-n, and a memory 18-n. Although not described below, each secret equalization apparatus 10-n executes each process based on the control unit 17-n, stores the input data and the data obtained in each process in memory 18-n, and reads and uses the data as needed.

[0022] <Pre-processing> As a pre-processing step, the anonymization table (first anonymization table) [TL] and the anonymization table (second anonymization table) [TR] to be subjected to the secret combination are input to the input unit 11-n of each secret combination device 10-n (Figure 2) and stored in the memory unit 12-n.

[0023] FIG. 4A shows an example of the anonymization table [TL]. The anonymization table [TL] is the anonymization information of the table TL (first table, left table). The table TL is made up of a plurality of (LRN) keys TL.Key0,...,TL.Key LRN-1 A key string TL.Key (first key string) with (first key) and multiple (LRN) arbitrary elements TL.V(v)0,...,TL.V(v) LRN-1(first arbitrary element) and an arbitrary element sequence TL.V(v), where v=0,...,LVN-1, and LVN is a positive integer representing the number of arbitrary element sequences. The jth record TL of the table TL j is the key TL.Key j and LVN arbitrary elements TL.V(0) j ,...,TL.V(LVN-1) j The number of records in the table TL is LRN, which in this embodiment is an integer of 2 or greater.

[0024] Specifically, the anonymization table [TL] exemplified in this embodiment includes a plurality (LRN) of anonymization keys [TL.Key0], ..., [TL.Key LRN-1 ] and multiple (LRN) arbitrary concealment elements [TL.V(v)0],...,[TL.V(v) LRN-1 ] and an arbitrary element string [TL.V(v)] with the concealed record [TL j ] is the encryption key [TL.Key j ] and LVN concealment arbitrary elements [TL.V(0) j ],...,[TL.V(LVN-1) j ] (Figure 4A).

[0025] The anonymization table [TL] of this embodiment is sorted based on the key string TL.Key of the anonymization key string [TL.Key]. This sorting may be performed before anonymization, or may be performed by secure computation after anonymization. Sorting methods using secure computation are well known and are disclosed, for example, in Reference 2. Reference 2: Dai Igarashi, Hiroki Hamada, Ryo Kikuchi, and Koji Senda, “Design and Implementation of Ultra-High-Speed ​​Secure Computation Sorting: The Day Secure Computation Stands on Par with Scripting Languages,” CSS, 2017.

[0026] Furthermore, the key string TL.Key (first key string) of the table TL includes 2 or more and KL or less keys (first keys) having the same value. That is, the key string TL.Key includes multiple keys with duplicate values, and the maximum value of the duplicate number (the maximum number of first keys with the same value included in the first key string) is KL. KL is an integer equal to or greater than 2. The value of KL is also stored in the storage unit 12-n in association with the anonymization table [TL].

[0027] FIG. 4B shows an example of the anonymization table [TR]. The anonymization table [TR] is the anonymization information of the table TR (second table, right table). The table TR contains multiple (RRN) keys TR.Key0,...,TR.Key RRN-1 A key string TR.Key (second key string) with (second key) and multiple (RRN) arbitrary elements TR.V(w)0,...,TR.V(w) RRN-1 (second arbitrary element), where w=0,...,RVN-1, and RVN is a positive integer representing the number of arbitrary element sequences. p TR.Key p and RVN arbitrary elements TR.V(0) p ,...,TR.V(RVN-1) p The number of records in the table TR is RRN, which is an integer equal to or greater than 2 in this embodiment.

[0028] Specifically, the anonymization table [TR] exemplified in this embodiment includes a plurality (RRN) of anonymization keys [TR.Key0], ..., [TR.Key RRN-1 ] and multiple (RRN) arbitrary concealment elements [TR.V(w)0],...,[TR.V(w) RRN-1 ] and an arbitrary element sequence [TR.V(w)] with the concealed record [TR p ] is the encryption key [TR.Key p ] and RVN concealment arbitrary elements [TR.V(0) p ],...,[TR.V(RVN-1) p ] (Figure 4B).

[0029] The anonymization table [TR] of this embodiment is sorted based on the key string TR.Key of the anonymization key string [TR.Key]. This sorting may be performed before anonymization or by secure computation after anonymization.

[0030] Furthermore, the key string TR.Key (second key string) of the table TR includes 2 to KR keys (second keys) that have the same value. That is, the key string TR.Key includes multiple keys with duplicate values, and the maximum value of the duplicate number (the maximum number of second keys with the same value that are included in the second key string) is KR. KR is an integer equal to or greater than 2. The value of KR is also stored in the storage unit 12-n in association with the anonymization table [TR].

[0031] <Processing> The secret equality combining method of this embodiment will be described with reference to FIG. <<Processing of Subkey String Addition Unit 13-n (Step S13-n)>> The subkey string adding unit 13-n (first subkey string adding unit) of each secret combination device 10-n (Figure 2) obtains and outputs the anonymization additional table [TLs] (first anonymization additional table), which is confidential information of the additional table TLs (first additional table) obtained by adding the subkey string TLs.S (first subkey string) to the table TL (first table), by secure computation using the anonymization table (first anonymization table) [TL] read from the memory unit 12-n (Figure 5A).

[0032] As illustrated in FIG. 5A, the key column TLs.Key of the additional table TLs is the key column TL.Key (first key column) of the table TL (FIG. 4A), and the keys TLs.Key0, ..., TLs.Key LRN-1 is TLs.Key0=TL.Key0,...,TLs.Key LRN-1 =TL.Key LRN-1 (First key). The arbitrary element string TLs.V(v) of the additional table TLs is the arbitrary element string TL.V(v) of the table TL (FIG. 4A), and the arbitrary elements TLs.V(v) 0, ..., TLs.V(v) of the arbitrary element string TLs.V(v)LRN-1 is TLs.V(v)0=TLs.V(v)0,...,TLs.V(v) LRN-1 =TL.V(v) LRN-11 (First optional element).

[0033] As shown in FIG. 5A, the subkey string TLs.S (first subkey string) is made up of a plurality (LRN) of subkeys TLs.S0, ..., TLs.S LRN-1 (First subkey) with keys TL.Key0,...,TL.Key LRN-1 Each of the (first keys) has subkeys TLs.S0,...,TLs.S LRN-1 In the example of FIG. 5A, the key TL.Key j Subkey TLs.S j Specifically, the encryption key [TL.Key j ] to the masking subkey [TLs.S j ] are associated with each other.

[0034] As described above, the key string TL.Key (first key string) includes 2 to KL mutually equivalent keys (first keys). LRN-1 Among the keys with the same value (first key), there are subkeys TLs.S with different values. j In the example of FIG. 5A, the concealment keys [TL.Key0], ..., [TL.Key LRN-1 ], the concealment keys with the same restored value (decrypted value) have subkeys TLs.S with different values. j The secret information of the concealment subkey [TLs.S j ] is associated.

[0035] For j=0,…,LRN-1, key TL.Key j and subkey TLs.S j The relationship is exemplified as follows: (b-1) When j=0, TLs.S j =0 (b-2) j>0 and TL.Keyj ≠TL.Key j-1 If so, TLs.S j =0 (b-3) j>0 and TL.Key j =TL.Key j-1 If so, TLs.S j =TLs.S j-1 +1 Here, (b-1) is the first key TL.Key0 with subkey TLs.S j =0 is associated. (b-2) is the second or subsequent key TL.Key j is the previous key TL.Key j-1 If the value is different from the key TL.Key j There is a subkey TLs.S j =0 is associated. (b-3) is the second or subsequent key TL.Key j is the previous key TL.Key j-1 If the value is equal to TL.Key, the key j There is a subkey TLs.S j =TLs.S j-1 Since the anonymization table [TL] is sorted based on the key string TL.Key of the anonymization key string [TL.Key], (b-1)(b-2)(b-3) means that the keys TL.Key0,...,TL.Key LRN-1 Subkeys TLs.S with different values ​​(0, 1, 2, 3... and values ​​that increase by 1) for the same keys j are associated with each other. However, this is merely an example and does not limit the present invention. In order for the subkey string adding unit 13-n to execute (b-1), (b-2), and (b-3) while keeping each value anonymized by secure calculation using the anonymization table [TL], it is necessary to calculate anonymized [TLs.S] from the anonymized [TL.Key]. For this calculation, for example, the method used in the secret grouping calculation in Reference 3 can be used. Reference 3: Hiroki Hamada, Dai Igarashi, and Koji Senda, “An algorithm for calculating the median of aggregate functions on secure computation,” in CSS, 2012. The secret grouping operation is a method of grouping table [T] by the value of column [Key] while keeping the table [T] secret, and finding the median value for each group. In Reference 3, the secret grouping operation is a method of grouping table [T] by the value of column [Key] while keeping the table [T] secret, and finding the median value for each group. j The secret value of [Key j ] is assigned a secret value that is an increment value starting from 0 (calculation of step +). If the function that performs this calculation is expressed as groupby, the subkey string adding unit 13-n can obtain [TLs.S] from [TL.Key] as follows: Function groupby: [TLs.S]=groupby([TL.Key]) Input: [TL.Key] Output: [TLs.S]

[0036] <<Processing of Subkey String Addition Unit 14-n (Step S14-n)>> The subkey string addition unit 14-n (second subkey string addition unit) of each secret combination device 10-n obtains and outputs the anonymized additional table [TRs] (second anonymized additional table), which is the confidential information of the additional table TRs (second additional table) obtained by adding the subkey string TRs.S (second subkey string) to the table TRc (third table), by secure computation using the anonymized table (second anonymized table) [TR] read from the memory unit 12-n (Figures 5B and 6).

[0037] Table TRc (third table) is a table of each record TR in table TR (second table) (FIG. 4B). p (where p=0,...,RRN-1) K times and a plurality of replicated records obtained by replicating them are added to table TR (second table) (FIG. 5B). However, K≧KL, and preferably K=KL. In this embodiment, the value of KL is read from storage unit 12-n and used. As described above, each record TR of table TR (second table) p TR.Key p (Second key) and optional element TR.V(0) p ,...,TR.V(RVN-1) p(second optional element). For example, [TRc] shown in FIG. 5B includes each [TR p ] (where p=0,...,RRN-1) is replicated K times, and multiple concealed replicated records are added to [TR]. For example, each [TR p ] is [TR.Key p ] and [TR.V(0) p ],...,[TR.V(RVN-1) p ] and

[0038] As shown in FIG. 5B, the key string TRc.Key (third key string) of the table TRc (third table) is RRN*K keys TRc.Key0=TR.Key0,...,TRc.Key K-1 =TR.Key0,TRc.Key K =TR.Key1,...,TRc.Key 2K-1 =TR.Key1,...,TRc.Key RRN*K-1 =TR.Key RRN-1 (The second key and multiple third keys including duplicates of the second key). The arbitrary element string TRc.V(v) (third arbitrary element string) of the table TRc is TRc.V(v)0 = TR.V(v)0,...,TRc.V(v). K-1 =TR.V(v)0,TRc.V(v) K =TR.V(v)1,...,TRc.V(v) 2K-1 =TR.V(v)1,...,TRc.V(v) RRN*K-1 =TR.V(v) RRN-1 (a second optional element and a plurality of third optional elements including copies of the second optional element).

[0039] As shown in FIG. 6, the key column TRs.Key of the additional table TRs is the key column TRc.Key (third key column) of the table TRc (FIG. 5B), and RRN*K keys TRs.Key0=TR.Key0,...,TRs.Key K-1 =TR.Key0,TRs.Key K =TR.Key1,...,TRs.Key 2K-1 =TR.Key1,...,TRs.Key RRN*K-1 =TR.KeyRRN-1 (The second key and multiple third keys including copies of the second key). The arbitrary element sequence TRs.V(v) of the additional table TRs is the arbitrary element sequence TRc.V(v) (third arbitrary element sequence) of the table TRc (FIG. 5B), and TRs.V(v)0 = TR.V(v)0, ..., TRs.V(v). K-1 =TR.V(v)0,TRs.V(v) K =TR.V(v)1,...,TRs.V(v) 2K-1 =TR.V(v)1,...,TRs.V(v) RRN*K-1 =TR.V(v) RRN-1 (a second optional element and a plurality of third optional elements including copies of the second optional element).

[0040] The subkey column TRs.S (second subkey column) of the additional table TRs (second additional table) has multiple (RRN*K) subkeys TRs.S0,...,TRs.S RRN*K-1 (2nd subkey). Additional table TRs key TRs.Key0=TR.Key0,...,TRs.Key K-1 =TR.Key0,TRs.Key K =TR.Key1,...,TRs.Key 2K-1 =TR.Key1,...,TRs.Key RRN*K-1 =TR.Key RRN-1 Each of the (third keys) has subkeys TRs.S0,...,TRs.S RRN*K-1 In this embodiment, the key TRs.Key i Subkey TRs.S i (where i=0,...,RRN*K-1) are associated. For example, keys TRs.Key0,...,TRs.Key RRN*K-1 Among the keys with the same value, there are subkeys TRs.S with different values. i In the example of Figure 6, the encryption keys [TRs.Key0],..., [TRs.Key RRN*K-1 ], the concealment keys whose restored values ​​(decrypted values) are the same have subkeys TRs.S with different values. i The secret information of the secret subkey [TRs.S i] is associated.

[0041] For example, if the key string TRs.Key (third key string, TRc.Key) (FIG. 6) of the additional table TRs (second additional table) matches any key TLs.Key of the additional table TLs (FIG. 5A), j (First key, TL.Key j ) and TRs.Key that represents the same value (common value) i (Third key, TR.Key i ), the TRs.Key representing the common value i (Third Key, TR.Key i ) contains a key TLs.Key representing the common value. j (First key, TL.Key j ) and the corresponding subkey TLs.S j (First subkey) and the same subkey TRs.S i (second subkey) is associated. For example, TRs.Key representing the common value i (Third key, TR.Key i ) is confidential information [TRs.Key i ] includes a key TLs.Key representing the common value. j (First key, TL.Key j ) and the corresponding subkey TLs.S j (First subkey) and the same subkey TRs.S i (Second subkey) secret information [TRs.S i Preferably, the key string TRs.Key (third key string, TRc.Key) of the additional table TRs (second additional table) (FIG. 6) is TRs.Key that represents the common value. i (Third Key, TR.Key i ), the key TLs.Key representing the common value j (First key, TL.Key j ) (Fig. 5A) j The value of (first subkey) is also the TRs.Key that represents the common value. i (Third Key, TR.Key i) and the subkeys TRs.S0,...,TRs.S RRN*K-1 (second subkey). For example, the key TLs.Key that represents the common value j (First key, TL.Key j ) is confidential information [TLs.Key j ] (Fig. 5A) j ] is the restored value (decrypted value) of the subkey TLs.S j The value of (first subkey) is also the TRs.Key that represents the common value. i (Third Key, TR.Key i ) is confidential information [TRs.Key i ] are associated with the masking subkeys [TRs.S0],...,[TRs.S RRN*K-1 ], the subkeys TRs.S0,...,TRs.S RRN*K-1 (second subkey).

[0042] The relationship between [TR], [TRc] and [TRs] is shown below as an example. For i=0,...,RRN·K-1, the quotient of i divided by K is idk (i.e., idk=i div K), and imk=i-idk*K. The idkth record in table TR (second table) (Figure 4B) is TR. idk and the i-th record in table TRc (third table) (FIG. 5B) is TRc i The i-th subkey (second subkey) of the subkey column TRs.S (second subkey column) of the additional table TRs (second additional table) (Figure 6) is TRs.S i In this case, TRs i =TRc i =TR idk and TRs.S. i =imk.

[0043] Therefore, the subkey string adding unit 14-n can obtain the anonymization addition table [TRs] from the anonymization table [TR] as follows. For i=0,...,RRN·K-1, the quotient obtained by dividing i by K is set as idk, and imk=i-idk*K, and the following processing is performed. (c-1) [TRs i ]=[TRc i ]=[TR idk ] (c-2) [TRs.S i ]=[imk] Here, (c-1) is the masking record [TR] of the masking table [TR]. idk ] to [TRs i ]. (c-2) can be realized by concealing imk (for example, by secret sharing) and duplicating it as [TRs.S i This can be achieved by setting ]=[imk].

[0044] Although table TRc and anonymization table [TRc] are shown here for the sake of explanation, the subkey string adding unit 14-n need only obtain the anonymization addition table [TRs] (FIG. 6) by secure computation using the anonymization table [TR] (FIG. 4B), and does not necessarily need to obtain the anonymization table [TRc] (FIG. 5B) obtained by anonymizing table TRc. In other words, the subkey string adding unit 14-n may directly obtain [TRs] from [TR], or may obtain [TRc] from [TR] and then obtain [TRs] from [TRc].

[0045] <Processing of Secret Combination Part 15-n (Step S15-n)> The secret combination unit 15-n of each secret combination device 10-n performs secure computation using the concealment addition table [TLs] (first concealment addition table) (FIG. 5A) and the concealment addition table [TRs] (second concealment addition table) (FIG. 6) obtained as described above to obtain TLs.Key of the table TLs. j (First key) and subkey TLs.S j (First subkey) and the pair (TLs.Key j , TLs.S j )(j=0,...,LRN-1) is the key attribute of the additional table TLs (first additional table), and the key TRs.Key of the additional table TRs i (3rd key) and subkey TRs.Si (2nd subkey) and the pair (TRs.Key i , TRs.S i ) (i=0,...,RRN*K-1) as the key attribute of the additional table TRs (second additional table), and obtain and output the anonymized joined table [ETRL], which is the confidential information of the joined table ETRL obtained by the equijoin of the additional table TLs (first additional table) and the additional table TRs (second additional table). As mentioned above, the joined table TLR is obtained by using the equal sign (TLs.Key j , TLs.S j )=(TRs.Key i , TRs.S i ) is a table that extracts only the records for which

[0046] Here, the key of the additional table TLs (first additional table) is TLs.Key0=TL.Key0,...,TLs.Key LRN-1 =TL.Key LRN-1 Among the keys with the same value, there are subkeys TLs.S with different values. j Therefore, the key attribute of the additional table TLs, the tuple (TLs.Key j ,TLs.S j ) values ​​for each record TLs j In other words, the set of additional tables TLs (TLs.Key0, TLs.S0),...,(TLs.Key LRN-1 ,TLs.S LRN-1 ) do not have any pairs of the same value (a pair in which both elements are duplicated). On the other hand, the pair (TRs.Key i ,TRs.S i ) values ​​for each record TRs j In other words, the set of additional tables TRs (TRs.Key0, TRs.S0), ..., (TRs.Key RRN*K-1 ,TRs.S RRN*K-1) have pairs of equivalent values ​​(pairs in which both elements overlap). In this way, a method for performing an equi-join by secure computation when there is no overlap in the key attribute of one of two tables to be equi-joined and there is overlap only in the key attribute of the other table is disclosed in Patent Document 1. Therefore, the secure equi-join unit 15-n obtains and outputs the anonymized join table [ETRL] by secure computation using the anonymized additional table [TLs] and the anonymized additional table [TRs], for example, according to the method disclosed in Patent Document 1. This process is described as follows: Function join: [ETRL]=join(([TLs.Key],[TLs.S],[TLs.V(0)],...,[TLs.V(LVN-1)]), ([TRs.Key],[TRs.S],[TRs.V(0)],...,[TRs.V(RVN-1)]), ([TLs.Key],[TLs.S]), ([TRs.Key],[TRs.S])) Input: ([TLs.Key],[TLs.S],[TLs.V(0)],...,[TLs.V(LVN-1)]),([TRs.Key],[TRs.S],[TRs.V(0)],...,[TRs.V(RVN-1)]) Output: [ETRL]=([TLs.Key],[TLs.S],[TLs.V(0)],...,[TLs.V(LVN-1)],[TRs.Key],[TRs.S],[TRs.V(0)],...,[TRs.V(RVN-1)]) However, join is a secret equal join function as follows: [Table 1 and 2 are joined equally] = join([Table 1], [Table 2], [Key attribute of Table 1], [Key attribute of Table 2])

[0047] The obtained concealed join table [ETRL] may be used for other processing (e.g., secret equality processing or restoration processing) in the secret equality device 10-n, or may be output from the output unit 16-n and used for processing in another device.

[0048] <Example> Next, this embodiment will be described using a specific example. This specific example shows an example in which the anonymization tables illustrated in Fig. 7A to Fig. 7C are secretly joined to obtain the anonymized joined table illustrated in Fig. 7D. The anonymization table in Fig. 7A is confidential information of a beverage product name table in which "ID" is a key string and "beverage product name" is an arbitrary element string (hereinafter referred to as "anonymized beverage product name table"). The key string of the beverage product name table has ID="1000", "4050", and "3210" as elements, and the arbitrary element string has beverage product name="mineral water A", "black coffee B", and "orange juice C" as elements. The anonymization table in Fig. 7B is confidential information of a capacity table in which "ID" is a key string and "capacity" is an arbitrary element string (hereinafter referred to as "anonymized capacity table"). The key string of the capacity table has ID="1000", "1000", "1000", "4050", and "3210" as elements, and the arbitrary element string has capacity="200", "500", "1000", "200", and "500" as elements. The anonymization table in FIG. 7C is confidential information of the container type table with ID as the key string and "container" as the arbitrary element string (hereinafter referred to as the "anonymized container type table"). The key string of the container type table has ID="1000", "1000", "4050", "4050", and "3210" as elements, and the arbitrary element string has container="plastic bottle", "aluminum can", "plastic bottle", "aluminum can", and "aluminum can" as elements.

[0049] Here, the key strings corresponding to the anonymized beverage product name table in Fig. 7A do not have elements (keys) with the same value. On the other hand, the key strings corresponding to the anonymized capacity table in Fig. 7B have the element "1000" with the same value, and the key strings corresponding to the anonymized container type table in Fig. 7C have the elements "1000" and "4050" with the same value. Therefore, as illustrated in Fig. 8, (1) first, using the method of this embodiment, a secret equality join is performed between the anonymized capacity table in Fig. 7B and the anonymized container type table in Fig. 7C to obtain an anonymized joined table, and then (2) a secret equality join is performed between this anonymized joined table and the anonymized beverage product name table in Fig. 7A to obtain the final anonymized joined table illustrated in Fig. 7D. Here, the concealment capacity table is [TL], and LRN=5, LVN=1, [TL.Key]=[ID], [TL.Key0]=

[1000] , [TL.Key1]=

[1000] , [TL.Key2]=

[1000] , [TL.Key3]=

[4050] , [TL.Key4]=

[3210] , [TL.V(0)0]=

[0200] , [TL.V(0)1]=

[0500] , [TL.V(0)2]=

[1000] , [TL.V(0)3]=

[0200] , [TL.V(0)4]=

[0500] . Furthermore, the anonymized container type table is assumed to be [TR], with RRN=5, RVN=1, [TR.Key]=[ID], [TR.Key0]=

[1000] , [TR.Key1]=

[1000] , [TR.Key2]=

[4050] , [TR.Key3]=

[4050] , [TR.Key4]=

[3210] , [TR.V(0)0]=[PET bottle], [TR.V(0)1]=[Aluminum can], [TR.V(0)2]=[PET bottle], [TR.V(0)3]=[Aluminum can], [TR.V(0)4]=[Aluminum can].

[0050] When the process of step S13-n is performed on the encryption capacity table [TL], for example, the encryption additional table (encrypted "capacity + sequence number" table) [TLs] shown in Fig. 9A is obtained. In this encryption additional table [TLs], LRN=5, LVN=1, [TLs.Key]=[ID], [TLs.Key0]=

[1000] , [TLs.Key1]=

[1000] , [TLs.Key2]=

[1000] , [TLs.Key3]=

[4050] , [TLs.Key4]=

[3210] , [TLs.S]=[SeqNo], [TLs. S0]=[0],[TLs.S1]=[1],[TLs.S2]=[2],[TLs.S3]=[0],[TLs.S4]=[0],[TLs.V(0)0]=

[0200] , [TLs.V(0)1]=

[0500] , [TLs.V(0)2]=

[1000] , [TLs.V(0)3]=

[0200] , [TLs.V(0)4]=

[0500] .

[0051] When the process of step S14-n is executed on the anonymized container type table [TR], for example, the anonymized additional table (anonymized "capacity type + sequence number" table) [TRs] shown in Fig. 9B is obtained. In this anonymized additional table [TRs], K=5, RRN=5, RVN=1, [TRs.Key]=[ID], [TRs.Key0]=

[1000] , [TRs.Key1]=

[1000] , [TRs.Key2]=

[1000] , [TRs.Key3]=

[1000] , [TRs.Key4]=

[1000] , [TRs.Key5]=

[1000] , [TRs.Key6]=

[4050] , [TRs.Key7]=

[4050] , [TRs.Key8]=

[4050] , [TRs.Key9]=

[4050] , [TRs.Key 10 ]=

[4050] ,[TRs.Key 11 ]=

[4050] ,[TRs.Key 12 ]=

[3210] ,[TRs.Key 13 ]=

[3210] ,[TRs.Key 14]=

[3210] ,[TRs.S]=[SeqNo],[TRs.S0]=[0],[TRs.S1]=[1],[TRs.S2]=[2],[TRs.S3]=[0],[TR s.S4]=[1],[TRs.S5]=[2],[TRs.S6]=[0],[TRs.S7]=[1],[TRs.S8]=[2],[TRs.S9]=[0],[TRs.S 10 ]=[1],[TRs.S 11 ]=[2],[TRs.S 12 ]=[0],[TRs.S 13 ]=[1],[TRs.S 14 ]=[2],[TRs.V(0)0]=[Plastic bottle],[TRs.V(0)1]=[Plastic bottle],[TRs.V(0)2]=[Plastic bottle],[TRs.V(0)3]=[Aluminum can],[TRs.V(0)4]=[Aluminum can],[TRs.V(0)5]=[Aluminum can],[TRs.V(0)6]=[Plastic bottle],[TRs.V(0)7]=[Plastic bottle],[TRs.V(0)8]=[Plastic bottle],[TRs.V(0)8]=[Aluminum can],[TRs.V(0)9]=[Aluminum can],[TRs.V(0) 10 ]=[Aluminum can],[TRs.V(0) 11 ]=[Aluminum can],[TRs.V(0) 12 ]=[Aluminum can],[TRs.V(0) 13 ]=[Aluminum can],[TRs.V(0) 14 ]=[Aluminum can].

[0052] When the processing of step S15-n is performed on such anonymization addition table [TLs] and anonymization addition table [TRs], for example, an anonymization combined table [ETRL] = ([TLs.Key], [TLs.S], [TLs.V(0)], ..., [TLs.V(LVN-1)], [TRs.Key], [TRs.S], [TRs.V(0)], ..., [TRs.V(RVN-1)]) = ([ID], [SeqNo], [Capacity], [ID], [SeqNo], [Container]) as illustrated in Figure 10 is obtained.

[0053] <Features of this embodiment> As described above, in this embodiment, the subkey string adding unit 13-n obtains, by secure computation using the anonymization table (first anonymization table) [TL], the anonymization additional table [TLs] (first anonymization additional table) which is secret information of the additional table TLs (first additional table) obtained by adding the subkey string TLs.S (first subkey string) to the table TL (first table) (step S13-n). Also, the subkey string adding unit 14-n obtains, by secure computation using the anonymization table (second anonymization table) [TR], the anonymization additional table [TRs] (second anonymization additional table) which is secret information of the additional table TRs (second additional table) obtained by adding the subkey string TRs.S (second subkey string) to the table TRc (third table) obtained by copying the records of TR (step S14-n). Then, the secret combination unit 15-n performs secure computation using the concealment addition table [TLs] (first concealment addition table) and the concealment addition table [TRs] (second concealment addition table) to obtain TLs.Key of the table TLs. j (First key) and subkey TLs.S j (First subkey) and the pair (TLs.Key j , TLs.S j )(j=0,...,LRN-1) is the key attribute of the additional table TLs (first additional table), and the key TRs.Key of the additional table TRs i (3rd key) and subkey TRs.S i (2nd subkey) and the pair (TRs.Key i , TRs.S i ) (i=0,...,RRN*K-1) as the key attribute of the additional table TRs (second additional table), and obtain and output the concealed joined table [ETRL], which is the confidential information of the joined table ETRL obtained by equijoining the additional table TLs (first additional table) and the additional table TRs (second additional table) (step S15-n). Here, the key TLs.Key0 of the additional table TLs (first additional table) is TL.Key0,...,TLs.Key LRN-1 =TL.Key LRN-1 Among the keys with the same value, there are subkeys TLs.S with different values. jTherefore, the key attribute of the additional table TLs is the set (TLs.Key0,TLs.S0),...,(TLs.Key LRN-1 ,TLs.S LRN-1 ) do not have any pairs of equivalent values ​​(pairs in which both elements overlap). The secret equal join unit 15-n can obtain the secret join table [ETRL] by secure computation using the secret additional table [TLs] and the secret additional table [TRs], for example, according to the method disclosed in Patent Document 1. In this case, since processes such as dividing the table before the secret equal join and joining the table after the secret equal join are not required, the two tables can be equijoined at high speed while keeping the table information secret.

[0054] In particular, table TRc (third table) (FIG. 5B) contains each record TR in table TR (second table) (FIG. 4B). p (where p=0,...,RRN-1) is replicated K times and multiple replicated records are added to table TR (second table). Processing can be performed most quickly when K=KL.

[0055] Furthermore, if the maximum number KR of the number of mutually equivalent keys (second keys) included in the key string TR.Key (second key string) of table TR (second table, right table) is less than or equal to the maximum number KL of the number of mutually equivalent keys included in the key string TL.Key (first key string) of table TL (first table, left table) (KR≦KL), processing can be performed faster. Therefore, it is preferable that the anonymization table (first anonymization table) [TL] and the anonymization table (second anonymization table) [TR] are stored in the storage unit 12-n so that KR≦KL.

[0056] In this embodiment, the values ​​of KL and KR are stored in the storage unit 12-n. However, if at least one of these values ​​is known, the known value does not have to be stored in the storage unit 12-n.

[0057] [Second embodiment] As described above, the anonymization table (first anonymization table) [TL] and the anonymization table (second anonymization table) [TR] are stored in the storage unit 12-n so that KR≦KL, thereby enabling faster processing. In an environment where this is not guaranteed, a process of switching the anonymization tables may be performed so that KR≦KL. The following description will focus on differences from the first embodiment, and the same reference numbers will be used to simplify the description of matters that have already been described.

[0058] <Configuration> 1, the secret equal-combining system 2 of this embodiment includes N secret equal-combining devices 20-0, ..., 20-(N-1). The secret equal-combining devices 20-0, ..., 20-(N-1) of this embodiment are communicably connected via a network.

[0059] 2, each secret equality combining device 20-n (where n=0, ..., N-1) has a table resetting unit 221-n, an input unit 11-n, a storage unit 12-n, a subkey string adding unit 13-n (first subkey string adding unit), a subkey string adding unit 14-n (second subkey string adding unit), a secret equality combining unit 15-n, an output unit 16-n, a control unit 17-n, and a memory 18-n. Although not described below, each secret equality combining device 20-n executes each process based on the control unit 17-n, stores input data and data obtained in each process in memory 18-n, and reads and uses the data as needed.

[0060] <Pre-processing> This is the same as the first embodiment.

[0061] <Processing> The secret equality combining method of this embodiment will be described with reference to FIG. <<Processing of Table Resetting Unit 221-n (Step S221-n)>> The table resetting unit 221-n reads out the values ​​of KR (the maximum number of mutually equivalent second keys included in the second key string) and KL (the maximum number of mutually equivalent first keys included in the first key string) from the storage unit 12-n, and if KR is greater than KL, it swaps the anonymization table [TL] (first anonymization table) and the anonymization table [TR] (second anonymization table) stored in the storage unit 12-n and stores them in the storage unit 12-n. As a result, a plurality (LRN) of keys TL.Key0,...,TL.Key LRN-1 A key string TL.Key (first key string) with (first key) and multiple (LRN) arbitrary elements TL.V(v)0,...,TL.V(v) LRN-1 A table TL (first table, left table) containing an arbitrary element sequence TL.V(v) with (first arbitrary element), and multiple (RRN) keys TR.Key0,...,TR.Key RRN-1 A key string TR.Key (second key string) with (second key) and multiple (RRN) arbitrary elements TR.V(w)0,...,TR.V(w) RRN-1 (second arbitrary element) and an arbitrary element sequence TR.V(w) with multiple (RRN) keys TR.Key0,...,TR.Key RRN-1 A key string TR.Key (second key string) with (second key) and multiple (RRN) arbitrary elements TR.V(w)0,...,TR.V(w) RRN-1 A table TR (second table, right table) containing an arbitrary element sequence TR.V(w) with (second arbitrary element), and multiple (LRN) keys TL.Key0,...,TL.Key LRN-1 A key string TL.Key (first key string) with (first key) and multiple (LRN) arbitrary elements TL.V(v)0,...,TL.V(v) LRN-1The anonymization table [TL] (first table, left table) is reset to include an arbitrary element sequence TL.V(v) having (first arbitrary element). The anonymization table [TL] (first anonymization table) and the anonymization table [TR] (second anonymization table) reset in this manner satisfy the relationship KR≦KL. On the other hand, if KR and KL satisfy the relationship KR≦KL, the table resetting unit 221-n does not swap the anonymization tables [TL] and [TR].

[0062] After step S221-n, the processes of steps S13-n, S14-n, and S15-n described in the first embodiment are executed.

[0063] <Features of this embodiment> This embodiment can also achieve the same effects as the first embodiment. Furthermore, even if the [TL] and [TR] that satisfy the relationship KR≦KL are not stored in the storage unit 12-n, they can be swapped to reset the [TL] and [TR] to satisfy the relationship KR≦KL. This allows for faster secret binding.

[0064] [Hardware configuration] The secret or equivalent binding devices 10-n and 20-n in each embodiment are devices configured by a general-purpose or dedicated computer having a processor (hardware processor) such as a CPU (central processing unit) and memories such as RAM (random-access memory) and ROM (read-only memory) executing a predetermined program. That is, the secret or equivalent binding devices 10-n and 20-n in each embodiment have, for example, processing circuitry configured to implement each of the units possessed by the device. This computer may have one processor and memory, or may have multiple processors and memories. This program may be installed on the computer or may be pre-recorded in a ROM or the like. Furthermore, some or all of the processing units may be configured using electronic circuits that independently realize processing functions, rather than electronic circuits that realize functional configuration by loading a program like a CPU. Furthermore, the electronic circuits constituting one device may include multiple CPUs.

[0065] FIG. 11 is a block diagram illustrating the hardware configuration of the secret or equivalent binding apparatus 10-n, 20-n in each embodiment. As illustrated in FIG. 11, the secret or equivalent binding apparatus 10-n, 20-n in this example includes a CPU (Central Processing Unit) 10a, an input unit 10b, an output unit 10c, a RAM (Random Access Memory) 10d, a ROM (Read Only Memory) 10e, an auxiliary storage device 10f, and a bus 10g. The CPU 10a in this example includes a control unit 10aa, an arithmetic unit 10ab, and a register 10ac, and executes various arithmetic processes according to various programs loaded into the register 10ac. The input unit 10b is an input terminal for inputting data, a keyboard, a mouse, a touch panel, or the like. The output unit 10c is an output terminal for outputting data, a display, a LAN card controlled by the CPU 10a that has loaded a predetermined program, or the like. The RAM 10d is a static random access memory (SRAM), a dynamic random access memory (DRAM), or the like, and has a program area 10da where a predetermined program is stored and a data area 10db where various data are stored. The auxiliary storage device 10f is a hard disk, a magneto-optical disc (MO), a semiconductor memory, or the like, and has a program area 10fa where a predetermined program is stored and a data area 10fb where various data are stored. The bus 10g connects the CPU 10a, the input unit 10b, the output unit 10c, the RAM 10d, the ROM 10e, and the auxiliary storage device 10f so that information can be exchanged. The CPU 10a writes the program stored in the program area 10fa of the auxiliary storage device 10f to the program area 10da of the RAM 10d in accordance with the loaded OS (Operating System) program. Similarly, the CPU 10a writes various data stored in the data area 10fb of the auxiliary storage device 10f to the data area 10db of the RAM 10d. The address on the RAM 10d where this program or data is written is stored in the register 10ac of the CPU 10a.The control unit 10aa of the CPU 10a sequentially reads out these addresses stored in the register 10ac, reads out programs and data from the areas on the RAM 10d indicated by the read addresses, causes the calculation unit 10ab to sequentially execute the operations indicated by the programs, and stores the calculation results in the register 10ac. With this configuration, the functional configuration of the secret combination devices 10-n and 20-n is realized.

[0066] The above-mentioned program can be recorded on a computer-readable recording medium. Examples of computer-readable recording media include non-transitory recording media. Examples of such recording media include magnetic recording devices, optical disks, magneto-optical recording media, and semiconductor memories.

[0067] This program may be distributed, for example, by selling, transferring, or lending a portable recording medium, such as a DVD or CD-ROM, on which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of a server computer and transferring the program from the server computer to other computers via a network. As described above, a computer that executes such a program may, for example, first temporarily store the program recorded on a portable recording medium or transferred from the server computer in its own storage device. Then, when executing a process, the computer reads the program stored in its own storage device and executes processing in accordance with the read program. Alternatively, the program may be executed by a computer that reads the program directly from a portable recording medium and executes processing in accordance with the program. Furthermore, the computer may execute processing in accordance with the received program each time a program is transferred from the server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the processing function simply by issuing an execution instruction and obtaining the results, thereby executing the processing described above through a so-called ASP (Application Service Provider) type service. In this embodiment, the program includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that dictate computer processing).

[0068] In each embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0069] It should be noted that the present invention is not limited to the above-described embodiment. For example, the secret combination devices 10-0, ..., 10-(N-1) (or 20-0, ..., 20-(N-1)) may exchange data via a portable recording medium rather than via a network. Also, in the above-described embodiment, sequence numbers such as 0, 1, 2, 3, ..., which increase by one, are used as subkeys, but other numbers or symbols may also be used as subkeys.

[0070] Furthermore, the various processes described above may not only be executed in chronological order as described, but may also be executed in parallel or individually depending on the processing capabilities of the devices executing the processes or as necessary. Needless to say, other modifications are possible within the scope of the present invention. [Explanation of symbols]

[0071] 1,2 Secret and Equal Bonding System 10-n,20-n secret equal combination device 13-n, 14-n Subkey Addition Section 15-n Secret etc. joint 221-n Table resetting section

Claims

1. (a) a storage unit, (b) a first subkey string adding unit, (c) a second subkey string adding unit, and (d) a secret combination unit; (a) the storage unit includes a first anonymization table which is anonymized information of a first table including a first key string having a plurality of first keys and a first arbitrary element string having a plurality of first arbitrary elements; a second anonymization table which is anonymized information of the second table including a second key string having a plurality of second keys and a second arbitrary element string having a plurality of second arbitrary elements; Store the (b) the first subkey string adding unit obtains, by a secure calculation using the first anonymization table, a first anonymization addition table that is secret information of a first addition table obtained by adding the first subkey string to the first table; the first subkey string has a plurality of first subkeys; Each of the first keys is associated with one of the first subkeys; the maximum number of the first keys having the same value included in the first key string is KL, where KL is an integer equal to or greater than 2; the first keys each having the same value are associated with the first subkeys each having a different value; (c) the second subkey string adding unit obtains, by a secure computation using the second anonymization table, a second anonymization addition table which is secret information of a second addition table obtained by adding the second subkey string to a third table; Each record of the second table includes a respective second key and a respective second optional element; the third table is a table obtained by adding a plurality of duplicate records obtained by duplicating each of the records of the second table K times to the second table, where K≧KL; the third table includes a third key string having a plurality of third keys including the second key and a duplicate of the second key, and a third arbitrary element string having a plurality of third arbitrary elements including the second arbitrary element and a duplicate of the second arbitrary element, the second subkey string has a plurality of second subkeys; Each of the third keys is associated with one of the second subkeys; when the third key string includes the third key representing the same common value as any one of the first keys, at least a part of the third key representing the common value is associated with the second subkey having the same value as the first subkey associated with the first key representing the common value; (d) the secret equal combination unit obtains, by a secret calculation using the first anonymization addition table and the second anonymization addition table, an anonymization combined table which is secret information of a combined table obtained by equal-combining the first and second additional tables, with the pair of the first key and the first subkey as a key attribute of the first additional table and the pair of the third key and the second subkey as a key attribute of the second additional table. Secret combination device.

2. 2. The secret binding device of claim 1, A secret equality binding device, wherein when the third key string includes the third key representing the common value, the value of any of the first subkeys corresponding to the first key representing the common value is equivalent to any of the second subkeys corresponding to the third key representing the common value.

3. 3. The secret binding device according to claim 1 or 2, A secret equal-binding device, where K=KL.

4. 4. The secret binding device according to claim 1, a maximum number of the second keys having the same value and included in the second key string is equal to or less than a maximum number of the first keys having the same value and included in the first key string.

5. 4. The secret binding device according to claim 1, (e) swapping the first anonymization table with the second anonymization table when a maximum number of the second keys having the same value included in the second key string is greater than a maximum number of the first keys having the same value included in the first key string; a table resetting unit that resets the first table including the first key string having the first key and the first arbitrary element string having the first arbitrary element, and the second table including the second key string having the second key and the second arbitrary element string having the second arbitrary element, into the second table including the second key string having the second key and the second arbitrary element string having the second arbitrary element, and the first table including the first key string having the first key and the first arbitrary element string having the first arbitrary element, respectively.

6. 6. A secret binding device according to claim 1, The number of records in the first table is LRN, the number of records in the second table is RRN, and LRN and RRN are integers equal to or greater than 2; (b) j = 0, …, LRN-1, The j-th first key in the first key string is TL.Key j and The j-th first subkey in the first subkey string is TLs.S j and When j=0, TLs.S j = 0, j>0 and TL.Key j ≠TL.Key j-1 If so, TLs.S j = 0, j>0 and TL.Key j =TL.Key j-1 If so, TLs.S j =TLs.S j-1 +1, (c) i = 0, ..., RRN*K-1, The quotient of i divided by K is idk, imk=i-idk*K, The idkth record in the second table is TR idk and The i-th record of the third table is TRc i and TRc i =TR idk and The i-th second subkey in the second subkey string is TRs.S i and TRs.S i = imk, a secret binding device.

7. A secret equality binding method for a secret equality binding device, comprising: (a) a storing step, (b) a first subkey string adding step, (c) a second subkey string adding step, and (d) a secret equicombining step, (a) the storage step includes: storing a first anonymization table, which is anonymized information of a first table including a first key string having a plurality of first keys and a first arbitrary element string having a plurality of first arbitrary elements; a second anonymization table which is anonymized information of the second table including a second key string having a plurality of second keys and a second arbitrary element string having a plurality of second arbitrary elements; storing the above in a storage unit; (b) the first subkey string addition step is a step of obtaining, by a first subkey string addition unit performing a secure calculation using the first anonymization table, a first anonymization addition table that is secret information of a first addition table obtained by adding a first subkey string to the first table, the first subkey string has a plurality of first subkeys; Each of the first keys is associated with one of the first subkeys; the maximum number of the first keys having the same value included in the first key string is KL, where KL is an integer equal to or greater than 2; the first keys each having the same value are associated with the first subkeys each having a different value; (c) the second subkey string addition step is a step of obtaining, by a second subkey string addition unit performing a secure calculation using the second anonymization table, a second anonymization addition table which is secret information of a second addition table obtained by adding the second subkey string to a third table; Each record of the second table includes a respective second key and a respective second optional element; the third table is a table obtained by adding a plurality of duplicate records obtained by duplicating each of the records of the second table K times to the second table, where K≧KL; the third table includes a third key string having a plurality of third keys including the second key and a duplicate of the second key, and a third arbitrary element string having a plurality of third arbitrary elements including the second arbitrary element and a duplicate of the second arbitrary element, the second subkey string has a plurality of second subkeys; Each of the third keys is associated with one of the second subkeys; when the third key string includes the third key representing the same common value as any one of the first keys, at least a part of the third key representing the common value is associated with the second subkey having the same value as the first subkey associated with the first key representing the common value; (d) the secret equal combination step is a step in which a secret equal combination unit obtains, by a secret calculation using the first anonymization additional table and the second anonymization additional table, an anonymization combined table which is secret information of a combined table obtained by equal-combining the first and second additional tables, with a pair of the first key and the first subkey as a key attribute of the first additional table and a pair of the third key and the second subkey as a key attribute of the second additional table. Secret etc. join method.

8. 7. A program for causing a computer to function as the secret binding device according to any one of claims 1 to 6.

Images