Secure computation system, secure computation device, method, and program

Abstract

The secure computation system according to one embodiment of the present invention includes a first secure computation device, a second secure computation device, and a third secure computation device, each of which has a trilateral share of a concealed input array. In this secure computation system, the first secure computation device has: a first conversion unit for converting the trilateral share of the first secure computation device to a bilateral share with the third secure computation device; a first calculation unit for calculating a third array by subtracting, from the result of having applied the replacement of the first secure computation device to the bilateral share, a second array determined by a prescribed method and the result of having applied a second replacement determined in accordance with the aforementioned replacement to a first array determined by a prescribed method; and a first transmission unit for transmitting the third array and the second replacement to the second secure computation device. The third secure computation device has a second conversion unit for converting the trilateral share of the third secure computation device to a bilateral share with the first secure computation device, a second calculation unit for calculating a fourth array by adding the first array to the result of having applied a first replacement determined in accordance with the aforementioned replacement to the bilateral share, a second transmission unit for transmitting the fourth array to the third secure computation device, and a first output unit for employing the second array as a bilateral share with the second secure computation device of the result of having applied the aforementioned replacement to the input array. The second secure computation device has a second output unit for employing an array derived by adding, to the third array, the result of having applied the second replacement to the fourth array, as a bilateral share with the third secure computation device of the result of having applied the aforementioned replacement to the input array.

Description

[Technical field]

[0001] The present invention relates to a secure computation system, a secure computation device, a method, and a program. [Background technology]

[0002] Secure computation is a useful technology known for its ability to perform various calculations at high speed while keeping data secret. In many analyses, the operation of searching and extracting data that matches specific conditions from a dataset (array) is an important process that is used frequently. On the other hand, secure computation requires data references while keeping the conditions used for the search (e.g., search keywords) secret. This means that simply searching the entire array to find the part that matches the conditions every time a reference is made requires a large amount of calculation and communication traffic.

[0003] To address this issue, there are known techniques that can significantly reduce reference costs by constructing special data structures in advance using substitution and sorting (e.g., Non-Patent Documents 1 and 2). How quickly such data structures can be constructed and referenced is important for data reference in secure computation.

[0004] In constructing the above data structure, a private permutation plays an important role, which allows rearrangement of an array while keeping the permutation method secret from the participants (parties) of the secure computation. Various methods for realizing a private permutation are known, and for example, a method is known in which an array is permuted while keeping both the array and the permutation secret under the assumption that a permutation and a random number sequence that have been made secret in advance are shared between the parties. In addition, for example, a method is known in which an array is permuted while keeping the array secret from all parties and the permutation secret from parties other than the party that has the permutation under the assumption that one party has the permutation as plaintext. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Atsuo Ichikawa, Hiroki Hamada, Ryo Kikuchi, and Dai Igarashi. Optimal Private Hash in Three-Party Computation and Sublogarithmically Efficient Oblivious RAM. Proceedings of the Symposium on Cryptography and Information Security (SCIS) 2020 (2020). [Non-Patent Document 2] Hiroki Hamada and Atsutake Ichikawa. A constant-round secret array access algorithm with sublinear local complexity. Proceedings of the Symposium on Cryptography and Information Security (SCIS) 2019 (2019). Summary of the Invention [Problem to be solved by the invention]

[0006] However, the above-mentioned conventional techniques (e.g., Non-Patent Documents 1 and 2) have problems such as poor performance due to random permutation (shuffling) of arrays or partial sorting being performed multiple times, and while the performance is good, there is a vulnerability to unauthorized references.

[0007] An embodiment of the present invention has been made in consideration of the above points, and has an object to perform efficient and secure secret sequence permutation in secure computation by three parties. [Means for solving the problem]

[0008] In order to achieve the above object, a secure computation system according to one embodiment is a secure computation system including a first secure computation device, a second secure computation device, and a third secure computation device, each of which has a three-party share of a concealed input sequence, wherein the first secure computation device has a first conversion unit which converts its own three-party share into a two-party share with the third secure computation device, a first calculation unit which calculates a third sequence obtained by subtracting a result of applying a second permutation determined in accordance with a first sequence determined by a predetermined method from a result of applying a permutation which the first secure computation device has to a two-party share which the first secure computation device has, and a second sequence determined by a predetermined method, and a first transmission unit which transmits the third sequence and the second permutation to the second secure computation device, The computing device has a second conversion unit that converts its own three-party share into a bilateral share with the first secure computing device, a second calculation unit that calculates a fourth array by adding the first array to a result of applying a first permutation determined in accordance with the permutation to the bilateral share held by the computing device, a second transmission unit that transmits the fourth array to the third secure computing device, and a first output unit that sets the second array as a bilateral share with the second secure computing device resulting from applying the permutation to the input array, and the second secure computing device has a second output unit that sets an array obtained by adding the result of applying the second permutation to the fourth array to the third array as a bilateral share with the third secure computing device resulting from applying the permutation to the input array. Effect of the Invention

[0009] In three-party secret computation, efficient and secure secret sequence permutation can be performed. [Brief description of the drawings]

[0010] [Figure 1] 1 is a diagram showing an example of the overall configuration of a secure computation system according to an embodiment of the present invention; [Diagram 2] FIG. 2 illustrates an example of a hardware configuration of a computer. [Diagram 3] FIG. 2 is a sequence diagram for explaining the first embodiment. [Figure 4] FIG. 11 is a sequence diagram for explaining a second embodiment. [Diagram 5] FIG. 11 is a sequence diagram for explaining a third embodiment. [Figure 6] FIG. 13 is a sequence diagram for explaining a fourth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] An embodiment of the present invention will be described below. In this embodiment, a secure computation system 1 capable of performing efficient and secure secret sequence permutation by asymmetrically asymmetrically obtaining information from each of the parties in a three-party secure computation will be described. In addition, a case where an arbitrary data structure (a data structure in an array format that conceals data and the reference position when accessing the data (hereinafter, also referred to as a reference position concealed array)) is constructed and referenced using the secure computation system 1 according to this embodiment will be described.

[0012] In the following, the three parties are also represented as P1, P2, and P3, and P1 is assumed to be a party with substitution.

[0013] <Preparation> First, prepare some symbols, terms, concepts, etc.

[0014] <Three-way data confidentiality> The plaintext x is concealed and the result shared among the three parties is

[0015]

number

[0016] In this case, [x] i Party P i In the following, we will abstract the "state of x shared by each party" and simply denote it as [x]. Also, each of these [x]i We call these shares fragments or shares. Furthermore, we assume that plaintext x can be restored using any two of the three shares [x]1, [x]2, and [x]3, but cannot be restored using only one of them.

[0017] An example of a technique that satisfies the above is the secret sharing scheme (e.g., References 1 and 2, etc.), but this is not limiting; any method can be used as long as it satisfies the same functionality and security as the secret sharing scheme.

[0018] <Additive bilateral data concealment> The plaintext x is made anonymous and the result shared between two parties is represented as 〈x〉1 and 〈x〉2. In particular, these two values ​​are random values ​​that satisfy 〈x〉1+〈x〉2=x. Each of 〈x〉1 and 〈x〉2 is held by two parties, P1, P2, and P3, respectively, but this state is abstracted and simply represented as 〈x〉. Also, it is assumed that it is possible to convert from [x] to 〈x〉 without communication between the parties.

[0019] An example of a technique that satisfies the above is the secret sharing scheme (e.g., References 1 and 2, etc.), but this is not limiting; any method can be used as long as it satisfies the same functionality and security as the secret sharing scheme.

[0020] <Random share generation> The process of generating a share [r] of a random number r without any party knowing the plaintext r is called random share generation. This process can be realized, for example, by the technology described in Reference 3 in the secret sharing scheme, but is not limited to this and any technology can be used as long as it has the same functionality and security as the technology.

[0021] <Pseudorandom function> In the following, a pseudorandom function that can be computed securely is represented as F, and the secure computation of the pseudorandom function is represented as F([a],[s]) for a secret value [a] and a key [s]. This secure computation process can be realized, for example, by the technology described in Reference 4, but is not limited to this and any technology can be used as long as it has the same functionality and security as this technology.

[0022] Array replacement In the following, we will express a permutation (reordering) of an arbitrary sequence of length m (not using secure computation) as a bijection π:{1, ,m} → {1, ,m}, and an array obtained by applying permutation π to an array A will be expressed as πA. Here, A = (A1, ,A m ),

[0023]

number

[0024]

number

[0025] <Overall configuration of secure computation system 1> Next, the overall configuration of the secure computation system 1 according to this embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the overall configuration of the secure computation system 1 according to this embodiment.

[0026] 1, the secure computation system 1 according to this embodiment includes a secure computation apparatus 10, a secure computation apparatus 20, and a secure computation apparatus 30. The secure computation apparatus 10, the secure computation apparatus 20, and the secure computation apparatus 30 are connected to each other so as to be able to communicate with each other via a communication network 40 such as the Internet.

[0027] The secure computing device 10 is a computer or computer system that functions as the party P1, and includes a secure computation processing unit 101 and a storage unit 102. The secure computation processing unit 101 executes various processes for performing secret sequence permutation and constructing a reference position secret sequence. The storage unit 102 stores various information (e.g., permutation, array share, etc.) required for executing these various processes.

[0028] The secure computation device 20 is a computer or computer system that functions as the party P2, and includes a secure computation processing unit 201 and a storage unit 202. The secure computation processing unit 201 executes various processes for constructing and referencing secret sequence permutations and reference-position secret sequences. The storage unit 202 stores various information (e.g., shares of sequences, etc.) required for executing these various processes.

[0029] The secure computation device 30 is a computer or computer system that functions as the party P3, and includes a secure computation processing unit 301 and a storage unit 302. The secure computation processing unit 301 executes various processes for constructing and referencing secret sequence permutations and reference-position secret sequences. The storage unit 302 stores various information (e.g., shares of sequences, etc.) required for executing these various processes.

[0030] <Hardware configuration of secure computation system 1> Next, a description will be given of the hardware configurations of the secure computing apparatus 10, the secure computing apparatus 20, and the secure computing apparatus 30 included in the secure computing system 1 according to this embodiment. The secure computing apparatus 10, the secure computing apparatus 20, and the secure computing apparatus 30 can be realized, for example, by the hardware configuration of a computer 500 shown in FIG.

[0031] 2 includes, as hardware, an input device 501, a display device 502, an external I / F 503, a communication I / F 504, a processor 505, and a memory device 506. Each of these pieces of hardware is connected to each other via a bus 507 so as to be able to communicate with each other.

[0032] The input device 501 is, for example, a keyboard, a mouse, a touch panel, etc. The display device 502 is, for example, a display, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502.

[0033] The external I / F 503 is an interface with an external device such as a recording medium 503a. Examples of the recording medium 503a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0034] The communication I / F 504 is an interface for connecting to the communication network 40. The processor 505 is, for example, various types of arithmetic devices such as a central processing unit (CPU) and a graphics processing unit (GPU). The memory device 506 is, for example, various types of storage devices such as a hard disk drive (HDD), a solid state drive (SSD), a random access memory (RAM), a read only memory (ROM), a flash memory, etc.

[0035] The secure computing apparatus 10, the secure computing apparatus 20, and the secure computing apparatus 30 according to the present embodiment can realize various processes described below by the hardware configuration of a computer 500 shown in Fig. 2. Note that the hardware configuration of the computer 500 shown in Fig. 2 is an example, and various hardware configurations may be adopted depending on the application of the target to which the secure computing system 1 is applied.

[0036] The secure computation processing unit 101 is realized, for example, by a process in which one or more programs installed in the secure computation apparatus 10 are executed by a processor 505 of a computer 500 that realizes the secure computation apparatus 10. The storage unit 102 is realized, for example, by a memory device 506 of the computer 500 that realizes the secure computation apparatus 10.

[0037] Similarly, the secure computation processing unit 201 is realized, for example, by a process in which one or more programs installed in the secure computation device 20 are executed by a processor 505 of a computer 500 that realizes the secure computation device 20. In addition, the storage unit 202 is realized, for example, by a memory device 506 of the computer 500 that realizes the secure computation device 20.

[0038] Similarly, the secure computation processing unit 301 is realized, for example, by a process in which one or more programs installed in the secure computation device 30 are executed by a processor 505 of a computer 500 that realizes the secure computation device 30. The storage unit 302 is realized, for example, by a memory device 506 of the computer 500 that realizes the secure computation device 30.

[0039] <Example 1> In this embodiment, P1 has an arbitrary plaintext permutation π, and all parties have an arbitrary sequence

[0040]

number

[0041]

number

[0042] The secure computation processing unit 101 of the secure computation device 10 → D] to → D〉1 (S101). Similarly, the secure computation processing unit 301 of the secure computation device 30 converts the share [ → D] to → D〉2 (S102). → D〉1 and P2 has 〈 → D〉2, but P1 has → D〉2, and P2 has 〈 → D〉1. In the following, P1 may have → D〉1 and P2 has 〈 → Let us have D〉2.

[0043] Next, the secure computation processing unit 101 of the secure computation apparatus 10

[0044]

number

[0045] Next, the secure computation processing unit 101 of the secure computation apparatus 10 → A:=π〈 → D〉1-π2 → U- → V is calculated (S105).

[0046] Then, the secure computation processing unit 101 of the secure computation apparatus 10 computes π2 and → A is transmitted to the secure computing device 20 (S106), and π1 and → U and → V is transmitted to the secure computing device 30 (S107).

[0047] The secure computation processing unit 301 of the secure computation device 30 → B:=π1〈 → D〉2+ → After calculating U (S108), → B to the secure computing apparatus 20 (S109). Also, the secure computation processing section 301 of the secure computing apparatus 30 transmits its own output as → T〉2:= → It is determined that V (S110).

[0048] The secure computation processing unit 201 of the secure computation device 20 converts its output into → T〉1:= → A+π2 → It is determined as B (S111).

[0049] In the above protocol, → A+π2 → B=π → D- → Since it becomes V, → T〉1,〈 → T〉2 is → T=π → D. Also, in the above protocol, the communication volume is 4 × (array < → D〉)+2×(size of permutation π) bits, and the number of rounds is 2. This shows that efficient secret sequence permutation is realized in this embodiment. → T〉, it can be seen that a secure secret sequence permutation has been achieved that, for example, makes it impossible for P1 to perform (illegal) manipulation or obtain information.

[0050] Therefore, according to this embodiment, any substitution can be applied to the concealed sequence, and a secure reference position concealed sequence can be efficiently obtained.

[0051] <Example 2> This embodiment is an extension of the first embodiment, and will be described with reference to FIG. 4 regarding a case where an arbitrary cryptographic pseudorandom number generator (not based on secure computation) is used to reduce the amount of communication and the number of rounds. FIG. 4 is a sequence diagram for explaining the second embodiment. Here, in this embodiment, it is assumed that a common pseudorandom number generator φ and its input p are shared in advance between P1 and P3. Note that P1 has an arbitrary plaintext permutation π, and all parties have an arbitrary concealed array [ → D] is the same as in the first embodiment.

[0052] S201 to S202 in FIG. 4 are similar to S101 to S102 in the first embodiment, respectively, and therefore the description thereof will be omitted.

[0053] The secure computation processing unit 101 of the secure computation device 10 executes ψ(p) to generate a random number sequence π1, → U, → V is obtained (S203). Similarly, the secure computation processing unit 301 of the secure computation device 30 executes ψ(p) to obtain the random number sequence π1, → U, → V is obtained (S204). That is, P1 and P3 execute ψ(p) independently to obtain a common random number sequence π1, → U, → Get a V.

[0054] Next, the secure computation processing unit 101 of the secure computation device 10 performs substitution

[0055]

number

[0056] Next, the secure computation processing unit 101 of the secure computation apparatus 10 → A:=π〈 → D〉1-π2 → U- → V is calculated (S206).

[0057] Then, the secure computation processing unit 101 of the secure computation apparatus 10 computes π2 and → A is transmitted to the secure computing apparatus 20 (S207).

[0058] The subsequent steps S208 to S211 are similar to steps S108 to S111 in the first embodiment, respectively, and therefore the description thereof will be omitted.

[0059] In this embodiment, by sharing an arbitrary update rule for p between P1 and P3 in advance (for example, updating p to p+1 every time ψ(p) is executed), it is possible to execute repeatedly without re-sharing p or ψ. This reduces the communication amount by 2×(array < → D〉) + 2 × (size of permutation π) bits, and the number of rounds can be reduced to 1.

[0060] <Example 3> This embodiment is an extension of the secret sequence permutation described in the first and second embodiments, and a method for P1 to generate a permutation π will be described with reference to Fig. 5. Fig. 5 is a sequence diagram for explaining the third embodiment. Note that the first and second embodiments do not limit the method for generating the permutation π.

[0061] In this embodiment, it is assumed that an arbitrary pseudorandom function F that can be secretly calculated is shared among all parties in advance, and that at least P1 has an arbitrary mechanism M that uniquely calculates a permutation from the plaintext value of the output of F. Here, the mechanism M is an array (f1, . . . , f n ), outputs the bijection π:{1, ,m}→{1, ,m} (where n ≤ m) and the value f i Mechanism M is a device or algorithm that outputs π(i) when it is input. For example, cuckoo hashing, which is described in Reference 5, can be used as mechanism M, but it is not limited to this and any device or algorithm can be used as long as it has properties similar to cuckoo hashing. Note that in some mechanisms, including cuckoo hashing, the output of a pseudorandom function is a multi-value f i (1),f i (l) (where l is a lowercase L), and when this is input to M, the output is also multi-valued π (1) (i),...,π (l) It is also possible that it would be (i) (where l is a lowercase L), but even in that case it can be used in this embodiment.

[0062] In this embodiment, [D i ]=([k i ],*), and the share of any concealed sequence that all parties have (or input) is [ → D]:=([D1], ,[D n ]), where k i is assumed to function as a search key for data reference, which will be explained in Example 4, and D i Each k is different i In addition, * can be any type, size, or number of data, but in principle it is a share.

[0063] First, the secure computation processing unit 101 of the secure computation apparatus 10, the secure computation processing unit 201 of the secure computation apparatus 20, and the secure computation processing unit 301 of the secure computation apparatus 30 execute random share generation to obtain a share [s] of a random number (S301). That is, all parties execute random share generation, and P1, P2, and P3 obtain shares [s]1, [s]2, and [s]3, respectively.

[0064] Next, the secure computation processing unit 101 of the secure computation apparatus 10, the secure computation processing unit 201 of the secure computation apparatus 20, and the secure computation processing unit 301 of the secure computation apparatus 30 calculate [f i ]←F([k i ],[s]) and → f]:=([f1], ,[f n ]) is obtained (S302). That is, for all parties, [f i ]←F([k i ],[s]) and → f]:=([f1], ,[f n) is obtained. As a result, P1, P2, and P3 each obtain a share → f]1, → f]2, and → f]3, respectively.

[0065] Next, the secret calculation processing unit 201 of the secret calculation device 20 transmits its own share → f]2 to the secret calculation device 10 (S303). However, the secret calculation processing unit 301 of the secret calculation device 30 may transmit its own share → f]3 to the secret calculation device 10. That is, either P2 or P3 may transmit its own share → f to P1.

[0066] The secret calculation processing unit 101 of the secret calculation device 10 uses its own share → f]1 and the share → f transmitted from the secret calculation device 20 (or the secret calculation device 30) to → restore f (S304).

[0067] Next, the secret calculation processing unit 101 of the secret calculation device 10 inputs the plaintext → f into the mechanism M to obtain the substitution π (S305).

[0068] After that, the secret calculation processing unit 101 of the secret calculation device 10, the secret calculation processing unit 201 of the secret calculation device 20, and the secret calculation processing unit 301 of the secret calculation device 30 execute the secret array substitution described in Example 1 or 2 (S306). As a result, P2 obtains < → T>1, and P3 obtains < → T>2, respectively. However, when the range m of the bijective π satisfies n < m, before executing the secret array substitution described in Example 1 or 2, all parties → add shares of dummy data so that the length of D becomes m. Note that the dummy data used here may be any value as long as it satisfies "the search key is → different from any k i included in D".

[0069] Then, the secure computation processing unit 101 of the secure computation apparatus 10 stores [s]1 in the storage unit 102 (S307). → T〉1 in the storage unit 202 (S308). → T>2 is stored in the storage unit 302 (S309).

[0070] According to the above protocol, any data structure (reference-location-hiding array), such as the cuckoo hash table described in Reference 5, can be constructed mainly with only one permutation. In addition, P1, who knows the permutation π, can construct the array < → T〉, P1 cannot observe the data reference (array reference) described in Example 4, and is therefore unable to identify the reference. Therefore, as described in Example 1, this example makes it possible to efficiently obtain a secure reference-position-hiding array.

[0071] <Example 4> In this example, the sequence obtained in Example 3 → A method of referring to T will be described with reference to Fig. 6. Fig. 6 is a sequence diagram for explaining the fourth embodiment. In this embodiment, it is assumed that a pseudorandom function F and a mechanism F similar to those used in the third embodiment are shared in advance among all the parties.

[0072] In the following, a case will be described in which a three-way share [k] of a certain search key is input, and a two-way share 〈D〉=(〈k〉,*) of data matching the search key is output.

[0073] First, the secure computation processor 101 of the secure computation apparatus 10, the secure computation processor 201 of the secure computation apparatus 20, and the secure computation processor 301 of the secure computation apparatus 30 calculate [f]←F([k],[s]) (S401). That is, all the parties calculate [f]←F([k],[s]). As a result, each P i (i=1,2,3) is [f] i You will have.

[0074] Next, the secure computation processor 201 of the secure computation apparatus 20 and the secure computation processor 301 of the secure computation apparatus 30 mutually restore [f] to obtain plaintext f (S402). That is, P2 transmits [f]2 that it possesses to P3. Similarly, P3 transmits [f]3 that it possesses to P2. Then, P2 restores f using [f]2 that it possesses and [f]3 transmitted from P3. Similarly, P3 restores f using [f]3 that it possesses and [f]2 transmitted from P2.

[0075] Next, the secure computation processor 201 of the secure computing apparatus 20 inputs the plaintext f to the mechanism M to obtain a value q (S403). Similarly, the secure computation processor 301 of the secure computing apparatus 30 inputs the plaintext f to the mechanism M to obtain a value q (S404). That is, P2 and P3 each independently input the plaintext f to the mechanism M to obtain a value q.

[0076] Then, the secure computation processing unit 201 of the secure computation device 20 executes the following: → The qth element of T〉1〈T q 〉1 (S405). → The qth element of T〉2〈T q 〉1 (S406). That is, P2 and P3 each independently output → The qth element of T q 〉 is output.

[0077] In this case, k i = k, the data [D i ]=([k i ],*)but[ → D], the result of the pseudorandom function calculation is also f i Using the fact that = f, we can determine that q = π(i) is true for 〈T q 〉=〈D i 〉. In addition, P2 and P3 can refer to the permutation π and the array (f1, ,f n), it is difficult to identify the reference point (i.e., index i) in the original array by observing only f and q. In addition, if the mechanism M always maps any output f of the pseudorandom function F to the range {1, ,m}, then the input k is the original data array. → Even for invalid references not included in D, → Any element of T q ;q∈{1, ,m}, which provides resistance to attacks that attempt to identify the index by deliberately making invalid references.

[0078] In addition, as described in the third embodiment, if the pseudorandom function and the mechanism each output multiple values, P2 and P3 output multiple values ​​q instead of q. (1) , ,q (l) (where l is a lowercase L). In this case, all elements in S405 and S406

[0079]

number

[0080]

number

[0081] <Summary> As described above, the secure computation system 1 according to the present embodiment can efficiently apply any permutation π held by P1 to an array while keeping it secret from P2 and P3 by utilizing the asymmetry of information between the parties in three-party secure computation, and can achieve higher security than the conventional technology by not having P1 hold the array after the permutation. In addition, any data that can conceal the reference position of the array can be constructed by using such permutation. Here, the asymmetry of information between the parties means that information is asymmetric between the party P1 that holds the permutation for the array and the parties P2 and P3 that hold the array itself after the permutation. It also means that information is asymmetric between the parties P2 and P3.

[0082] For example, the array permutation method described in Reference 6 assumes that the permutation is kept secret from all parties, whereas in this embodiment, P1 has an arbitrary plaintext permutation π. Therefore, in Reference 6, in order to perform an arbitrary permutation other than random permutation, it is necessary to allow extra communication cost or to add a new process, whereas in this embodiment, it is possible to perform an arbitrary permutation without any constraints.

[0083] Also, for example, in the method of permuting an array described in Reference 7, one party has an arbitrary plaintext permutation, so that the range of applicable permutations is wide like this embodiment, but the party with the permutation also obtains the permuted array. For this reason, in Reference 7, it is not possible to conceal the reference position from the party with the permutation. In contrast, in this embodiment, as described above, only P2 and P3 have the permuted array, and P1 with the permutation does not have the permuted array, so it is possible to conceal the reference position even from P1 with the permutation.

[0084] The present invention is not limited to the above-described embodiments specifically disclosed, and various modifications, changes, combinations with known technologies, etc. are possible without departing from the scope of the claims.

[0085] [References] Reference 1: A. Shamir. How to share a secret. Commun. ACM, Vol. 22, No. 11, pp. 612-613, 1979. Reference 2: M. Ito, A. Saito, and T. Nishizeki. Secret sharing schemes realizing general access structures. Proceedings of the IEEE Global Telecommunication Conference, Globecom 87, pp. 99-102, 1987. Reference 3: Naoto Kiribuchi, Dai Igarashi, Hiroki Hamada, Ryo Kikuchi. Programmable Secure Computation Library MEVAL3. Proceedings of the Symposium on Cryptography and Information Security (SCIS) 2018 (2018). Reference 4: K. Chida, K. Hamada, D. Ikarashi, R. Kikuchi, and B. Pinkas. High-throughput secure AES computation. In WAHC@CCS 2018, pages 13-24, 2018. Reference 5: A. Kirsch, M. Mitzenmacher, and U. Wieder. More robust hashing: Cuckoo hashing with a stash. In ESA, pages 611-622, 2008. Reference 6: K. Chida, K. Hamada, D. Ikarashi, R. Kikuchi, N. Kiribuchi, B. Pinkas. Anefficient secure threeparty sorting protocol with an honest majority. CryptologyePrint Archive, Report 2019 / 695 (2019), https: / / eprint.iacr.org / 2019 / 695 Reference 7: P. Mohassel, P. Rindal, and M. Rosulek. Fast database joins and PSI for secret shared data. Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (CCS '20). Association for Computing Machinery, New York, NY, USA, 1271-1287. 2020. [Explanation of symbols]

[0086] 1. Secure computing system 10, 20, 30 Secret computing device 101, 201, 301 Secure computing processing unit 102, 202, 302 storage section 40 Communication Network 500 Computers 501 Input Device 502 Display device 503 External I / F 503a Recording media 504 Communication I / F 505 Processor 506 Memory Device 507 Bus

Claims

1. A secure computation system including a first secure computation device, a second secure computation device, and a third secure computation device, each of which has a three-party share of a concealed input sequence, The first secure computing device is a first conversion unit that converts a three-party share that the first conversion unit has into a two-party share with the third secure computing device; a first calculation unit that calculates a third array by subtracting a result of applying a second permutation determined in accordance with a first array determined by a predetermined method from a result of applying a permutation that the user has to a bilateral share that the user has, and the second array determined by the predetermined method; a first transmitting unit that transmits the third array and the second permutation to the second secure computing device, The third secure computing device is a second conversion unit that converts a three-party share that the second conversion unit has into a two-party share with the first secure computing device; a second calculation unit that calculates a fourth array by adding the first array to a result of applying a first permutation determined in accordance with the permutation to the bilateral share held by the second calculation unit; a second transmitting unit that transmits the fourth array to the third secure computing device; a first output unit that outputs the second array as a two-party share with the second secure computing device, the two-party share being a result of applying the permutation to the input array; The second secure computing device is a second output unit that adds a result of applying the second permutation to the fourth array to the third array, and sets the resulting array as a two-party share between the third secure computing device and the third array of the result of applying the permutation to the input array; A secure computing system having the above structure.

2. The first secure computing device is a first determination unit that randomly determines the first permutation and the second permutation such that a composite map of the first permutation and the second permutation becomes the permutation; a second determination unit that randomly determines the first array and the second array to have the same size as the size of the two-party share that the device has; The first transmission unit is The secure computing system according to claim 1 , wherein the first permutation, the first array, and the second array are transmitted to the third secure computing device.

3. The first secure computing device is a third determination unit that determines the first permutation, the first array, and the second array by using a pseudorandom number generator shared with the third secure computing device and input data to the pseudorandom number generator; a fourth determination unit that determines a composite map of an inverse map of the first permutation and the permutation as the second permutation; The third secure computing device is 2. The secure computing system according to claim 1, further comprising: a fifth determination unit that determines the first permutation, the first array, and the second array using a pseudorandom number generator shared with the first secure computing device and input data to the pseudorandom number generator.

4. the first secure computing device, the second secure computing device, and the third secure computing device share a pseudorandom function that can be secretly computed; The first secure computing device is a generation unit that generates a three-party share of a random number by random share generation between the second secure computing device and the third secure computing device; a third calculation unit that calculates, by secure calculation between the second secure computing device and the third secure computing device, a three-party share of an array of function values ​​of the pseudorandom function to which the three-party share of the random number and each of the predetermined three-party shares included in each element of the input array are input; a first restoration unit that restores the array of function values ​​by using a three-party share of the array of function values ​​transmitted from the second secure computing device or the third secure computing device and a three-party share of the array of function values ​​that the first restoration unit has; 4. The secure computation system according to claim 1, further comprising: a permutation generating unit that generates the permutation by a predetermined mechanism using the array of function values ​​as an input.

5. The second secure computing device is a third calculation unit that calculates a three-party share of a function value of the pseudorandom function using as input the three-party share of the random number and the three-party share of a search key for the input sequence, by secure calculation between the first secure calculation device and the third secure calculation device; a third transmitting unit that transmits a three-party share of the function value that the third transmitting unit possesses to the third secure computing device; a second restoration unit that restores the function value by using the three-party share of the function value transmitted from the third secure computing device and the three-party share of the function value that the second restoration unit has; a first reference position generation unit that generates a value indicating a reference position for a two-party share with the third secure computing device as a result of applying the permutation to the input array by the mechanism using the function value as an input, The third secure computing device is a fourth calculation unit that calculates a three-party share of a function value of the pseudorandom function using as input the three-party share of the random number and the three-party share of a search key for the input sequence by secure calculation between the first secure computing device and the second secure computing device; a fourth transmission unit that transmits a three-party share of the function value that the fourth transmission unit has to the second secure computing device; a third restoration unit that restores the function value by using the three-party share of the function value transmitted from the second secure computing device and the three-party share of the function value that the third restoration unit has; The secure computing system of claim 4, further comprising: a second reference position generation unit that generates a value indicating a reference position for a two-party share with the second secure computing device as a result of applying the permutation to the input array using the mechanism that uses the function value as input.

6. A secure computing device that shares a three-way share of a concealed input sequence with another first secure computing device and a second secure computing device, a conversion unit that converts a three-party share that the third secure computing device has into a two-party share with the second secure computing device; a first determination unit that randomly determines the first permutation and the second permutation such that a composite map of the first permutation and the second permutation is a permutation that the first permutation has; a second determination unit that randomly determines a first array and a second array having the same size as the size of the two-party share that the second determination unit has; a calculation unit that calculates a third array by subtracting a result of applying the second permutation to the first array from a result of applying the permutation to the bilateral share held by the calculation unit, and the second array; a first transmitting unit that transmits the third sequence and the second permutation to the first secure computing device; a second transmission unit that transmits the first permutation, the first array, and the second array to the second secure computing device; A secure computing device having the above configuration.

7. A method for use in a secure computing system including a first secure computing device, a second secure computing device, and a third secure computing device, each of which has a three-party share of a concealed input sequence, comprising: The first secure computing device, a first conversion step of converting a three-party share held by the third secure computing device into a two-party share with the third secure computing device; a first calculation step of calculating a third array by subtracting a result of applying a second permutation determined in response to a first array determined in a predetermined manner from a result of applying a permutation that the user has to a bilateral share that the user has, and the second array determined in a predetermined manner; a first transmission step of transmitting the third sequence and the second permutation to the second secure computing device; The third secure computing device, a second conversion step of converting a three-party share held by the first secure computing device into a two-party share with the first secure computing device; a second calculation step of calculating a fourth array by adding the first array to a result of applying a first permutation determined according to the permutation to the bilateral share held by the player; a second transmission step of transmitting the fourth sequence to the third secure computing device; a first output step of setting the second sequence as a two-party share with the second secure computing device, the two-party share being a result of applying the permutation to the input sequence; The second secure computing device, a second output step of adding a result of applying the second permutation to the fourth array to the third array, and setting the resulting array as a two-party share between the third secure computing device and the third secure computing device of the result of applying the permutation to the input array; How to do it.

8. A program for causing a computer to function as a first secure computing device, a second secure computing device, or a third secure computing device included in the secure computing system according to any one of claims 1 to 5.

Images