Secret computing system, user terminal, commissioning operator server, decryption administrator terminal, and program

Abstract

To provide a fully efficient, safe and practical secure computing system.SOLUTION: A secure computing system 1 comprises a plurality of user terminals 10, an entrusted computing personnel server 20, and a decryption manager terminal 30. The plurality of user terminals 10 include a first secret key holding unit 11 that shares a first secret key, an encryption unit 12 that encrypts the user data of their own by a master public key, a first partial decryption unit 13 that, upon receiving cipher text resulting from computing, decrypts it to a first partial decrypted text by the first secret key, and a computation result output unit 14 that, upon receiving a second partial decrypted text, integrates it with the first partial decrypted text and outputs a decrypted computation result. The entrusted computing personnel server 20 includes a homomorphic arithmetic unit 21 that executes prescribed arithmetic operation on encrypted user data. The decryption manager terminal 30 includes a second secret key holding unit 31 that holds a second secret key, and a second partial decryption unit 32 that, upon receiving cipher text resulting from computing, decrypts it to a second partial decrypted text by the second secret key.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present invention relates to a secure computing system using fully homomorphic operations with data input by multiple users.

Background Art

[0002] The fully homomorphic encryption method (FHE: fully homomorphic encryption) is a public key encryption method that enables arbitrary calculations while keeping the data encrypted. The configuration of FHE is shown, for example, in Non-Patent Documents 1 to 3.

[0003] The multi-key fully homomorphic encryption method (MKFHE: Multi-key FHE) is an FHE extended for use by multiple users. The configuration of MKFHE is shown, for example, in Non-Patent Documents 4 and 5.

[0004] The threshold fully homomorphic encryption method (ThFHE: Threshold FHE) is an FHE that is similar to MKFHE and has functions for use by multiple users, but the keys used in encryption are different. The configuration of ThFHE is shown, for example, in Non-Patent Documents 6 and 7.

Prior Art Documents

Non-Patent Documents

[0005]

Non-Patent Document 1

Non-Patent Document 2

[0006] By using various fully homomorphic encryption schemes, a secret computing system can be configured in which multiple users contribute sensitive information without disclosing it to others, and a trustee (e.g., a cloud server) performs calculations such as AI and statistical analysis. When constructing a secret computing system using single-key FHE, while it is efficient because a single key pair common to users is used, there are issues with security (leakage resistance, collusion resistance). Also, when constructing a secret computing system using MKFHE or ThFHE, while high security (leakage resistance, collusion resistance) is achieved with multiple key pairs, there are issues with efficiency (ciphertext size, communication cost of decryption, latency), and it is also known that there is a vulnerability (decryption halt attack) that impairs availability.

[0007] An object of the present invention is to provide a practical secure computing system that can simultaneously alleviate problems in a trade-off relationship between efficiency and security, and is sufficiently efficient, secure, and practical.

Means for Solving the Problems

[0008] The secure computing system according to the present invention includes a plurality of user terminals, a commissioning operator server, and a decryption administrator terminal. The plurality of user terminals include a first secret key holding unit that shares a first secret key in a fully homomorphic encryption method that can be decrypted only by integrating partially decrypted texts that are each partially decrypted by two parties each having one of two different secret keys for an encrypted text encrypted with a master public key, an encryption unit that encrypts its own user data with the master public key and transmits it to the commissioning operator server, a first partial decryption unit that decrypts the encrypted text of the calculation result received from the commissioning operator server into a first partially decrypted text with the first secret key, and a calculation result output unit that outputs a calculation result decrypted by integrating the first partially decrypted text when receiving a second partially decrypted text from the decryption administrator terminal. The commissioning operator server includes a homomorphic calculation unit that executes a predetermined calculation on the encrypted user data received from the plurality of user terminals in an encrypted state using the master public key and transmits the encrypted text of the calculation result to the user terminal and the decryption administrator terminal. The decryption administrator terminal includes a second secret key holding unit that holds a second secret key different from the first secret key, and a second partial decryption unit that decrypts the encrypted text of the calculation result received from the commissioning operator server with the second secret key and transmits the second partially decrypted text to any one of the plurality of user terminals.

[0009] One or more data providing terminals that do not hold the first secret key and encrypt their own user data with the master public key and transmit it to the commissioning operator server are provided, and the homomorphic calculation unit may execute the predetermined calculation on the encrypted user data received from the plurality of user terminals and the data providing terminals.

[0010] The user terminal according to the present invention is in a fully homomorphic encryption method that can be decrypted only by integrating partial decryption texts obtained by partially decrypting a ciphertext encrypted with a master public key by two parties each having one of two different secret keys. It includes a first secret key holding unit that shares a first secret key with other terminals, an encryption unit that encrypts its own user data with the master public key and transmits it to a commissioned operator server, and when receiving a ciphertext of an operation result obtained by executing a predetermined operation on the encrypted user data received by the commissioned operator server from a plurality of terminals in an encrypted state using the master public key, a first partial decryption unit that decrypts it into a first partial decryption text with the first secret key, and when receiving a second partial decryption text obtained by decrypting the ciphertext of the operation result by the decryption administrator terminal with a second secret key different from the first secret key from the decryption administrator terminal, an operation result output unit that outputs the operation result decrypted by integrating the first partial decryption text.

[0011] The commissioned operator server according to the present invention is in a fully homomorphic encryption method that can be decrypted only by integrating partial decryption texts obtained by partially decrypting a ciphertext encrypted with a master public key by two parties each having one of two different secret keys. It receives user data encrypted with a first secret key from a plurality of user terminals, executes a predetermined operation on the encrypted user data in an encrypted state using the master public key, and includes a homomorphic operation unit that transmits a ciphertext of the operation result to the user terminal and the decryption administrator terminal, and causes the decrypted operation result to be output by integrating the first partial decryption text decrypted by the user terminal with the first secret key and the second partial decryption text decrypted by the decryption administrator terminal with a second secret key different from the first secret key.

[0012] The decryption manager terminal according to the present invention is in a fully homomorphic encryption system that can be decrypted only by integrating partial decryption texts obtained by partially decrypting a ciphertext encrypted with a master public key by two parties each having one of two different secret keys. It includes a second secret key holding unit that holds a second secret key, and for user data encrypted by a plurality of user terminals with a first secret key different from the second secret key, when the entrusted operator server receives a ciphertext of a calculation result obtained by executing a predetermined calculation in an encrypted state using the master public key from the entrusted operator server, a second partial decryption unit that transmits a second partial decryption text decrypted with the second secret key to any one of the plurality of user terminals. In any one of the plurality of user terminals, the decrypted calculation result is output by integrating a first partial decryption text obtained by decrypting the ciphertext of the calculation result with the first secret key and the second partial decryption text.

[0013] The program according to the present invention is for causing a computer to function as the user terminal.

[0014] The program according to the present invention is for causing a computer to function as the entrusted operator server.

[0015] The program according to the present invention is for causing a computer to function as the decryption manager terminal.

Effect of the Invention

[0016] According to the present invention, a sufficiently efficient, safe, and practical secret calculation system can be configured.

Brief Description of the Drawings

[0017]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Embodiments for Carrying Out the Invention

[0018] Hereinafter, an example of an embodiment of the present invention will be described. For comparison with this embodiment, first, three types of fully homomorphic encryption schemes and conventional secret calculation systems using these will be described, and then the system configuration and its functions of this embodiment will be described in detail.

[0019] [Single-key FHE] The fully homomorphic encryption scheme FHE = (FHE.Keygen, FHE.Enc, FHE.Dec, FHE.Eval) is defined as follows.

[0020] ·FHE.Keygen(1 λ ) → (pk, evk, sk): Outputs the public key pk, the public operation key evk, and the secret key sk. ·FHE.Enc(pk, m ∈ {0, 1}) → ct: Taking the public key pk and the plaintext m ∈ {0, 1} as inputs, and using an encryption algorithm similar to that of ordinary public key cryptography, outputs the ciphertext ct. ·FHE.Dec(sk, ct) → m: Taking the secret key sk and the ciphertext ct as inputs, and using a decryption algorithm similar to that of ordinary public key cryptography, outputs the plaintext m. ·FHE.Eval(evk, f, ct1,..., ct l ) → ct f : The operation key evk, the binary circuit f: {0, 1} l → {0, 1}, m1,..., m l and l ciphertexts ct1,..., ct encrypted forl takes as input and outputs the ciphertext ct of f(m1,…,m l ) of the homomorphic operation algorithm. f

[0021] Figure 3 is a diagram showing the configuration of a conventional secret calculation system using Single-key FHE. In the case of a multi-user secret calculation system using Single-key FHE, each user (party 1~N) shares the same key pair (pk,sk), encrypts with the public key pk, and decrypts with the secret key sk.

[0022] The delegated operator (Evaluator) receives the ciphertext Enc(m i ,pk) of the user data m from each user, and calculates the ciphertext ct of f(m1,…,m i ) by homomorphic operation and provides it to the user. N Any user can obtain the operation result f(m1,…,m N ) by decrypting the ciphertext ct with the secret key sk.

[0023] In the conventional secret calculation system using Single-key FHE, there are the following advantages and problems regarding efficiency and security. (Efficiency) It is efficient because it uses a single key pair. (Security) Since all users share the secret key, the security is not sufficient. · Leakage resistance: When the ciphertext is passed to other users, it can be easily decrypted. · Collusion resistance: If even one user colludes with the delegated operator, all ciphertexts can be decrypted.

[0024] [MKFHE] The multi-key fully homomorphic encryption scheme MKFHE=(DistSetup,KeyGen,Enc,Eval,PartDec,FinDec) is defined as follows.

[0025] · DistSetup(1 λ ,1 N, i) → params i : Input the security parameter λ, the maximum allowable number of parties N, and the party index (user number) i, and output the public parameters params for party i i . · KeyGen(params i ) → (pk i , sk i ): Party i outputs a public key - private key pair (pk i , sk i ) according to params i . · Enc(pk i , m ∈ {0, 1}) → ct: Party i inputs the public key pk i and the plaintext m ∈ {0, 1}, and outputs the ciphertext ct · Eval(evk, f, ct1, …, ct l ) → ct f : Input the evaluation key evk, the binary circuit f: {0, 1} l → {0, 1}, and the ciphertexts ct1, …, ct l , and output ct l which is the ciphertext of f(m1, …, m f ). · PartDec(i, sk i , ct) → p i : Party i inputs the private key sk i and the ciphertext ct, and outputs the partial decryption text p i . · FinDec(p1, …, p l ) → m: Input the partial decryption texts p1, …, p l of parties 1, …, l, and output m ∈ {0, 1, ⊥}

[0026] Figure 4 is a diagram showing the configuration of a conventional secret calculation system using MKFHE In the case of a multi - user secret calculation system using MKFHE, each user (user number i) has a unique key pair (pk i , ski holds it and encrypts it with the public key pk i . For decryption, all users perform partial decryption (PartDec) with sk i and then complete it by collecting all the partially decrypted texts and performing FinDec.

[0027] The delegated operator (Evaluator) receives the ciphertext Enc(m i , pk i ) of the user data m from all users (number of users: N i ). After receiving it, the obtained ciphertext is padded with 0s to expand it into a ciphertext of the corresponding length for the extended public key key pair (pk￣:=(pk1|…|pk N ), sk￣:=(sk1|…|sk N )) and then a homomorphic operation is performed. When the ciphertext ct of f(m1,…,m N ) calculated by the homomorphic operation is provided to the user, each user performs partial decryption (PartDec) using its own secret key sk i . Decryption is completed by collecting the partially decrypted texts (output of PartDec) by all users through broadcast or the like and executing FinDec.

[0028] In the conventional secret calculation system based on MKFHE, there are the following advantages and issues regarding efficiency and security. (Efficiency) · The size of the ciphertext and the homomorphic operation time increase according to the number of users N. · Since decryption needs to be executed by all users, the communication cost is high and there is also a delay. (Security) · Leakage resistance: Since the participation of all users in decryption is required, high security is maintained even when the ciphertext is leaked. · Collusion resistance: Since collusion of all users is required to obtain the plaintext, there is no risk of collusion attack. · Service stop attack (decryption interference): Any user can perform an attack to fail decryption without being detected as the perpetrator.

[0029] Figure 5 shows the vulnerability in the conventional secret calculation system using MKFHE. Any user can cause the overall decryption to fail by disguising (FakeDec) the partial decryption. Specifically, from the security proof of MKFHE, since the output of PartDec is indistinguishable from the output of PartDec for a random ciphertext, for example, by replacing the secret key sk i with a random value, it is possible to construct a fake partial decryption FakeDec(ct,*) that is indistinguishable from the output of the correct PartDec.

[0030] [ThFHE] Let the set of participating parties (users) be P = {P1,…,P N}, and let S be the class of access structures for decryption with respect to P. For example, "t-out-of-N" represents an access structure with a threshold t where decryption is possible if t out of N people gather. For the class S, the threshold fully homomorphic encryption scheme ThFHE = (ThFHE.KeyGen, ThFHE.Enc, ThFHE.Eval, ThFHE.PartDec, ThFHE.FinDec) is defined as follows.

[0031] · ThFHE.KeyGen(1 λ , A) → (evk, pk * , sk1,…, sk N ): Given the input security parameter λ and the access structure A belonging to the class S, generate the master public key pk * , the public operation key evk, and the distributed secret keys sk1,…, sk N . ThFHE.Enc(pk * , m) → ct: Given the input master public key pk * and the plaintext m ∈ {0,1}, output the ciphertext ct. · ThFHE.Eval(evk, f, ct1,…, ct l ) → ct f : Calculation key evk, binary circuit f: {0, 1} l → {0, 1}, ciphertext ct1, …, ct l As input, f(m1, …, m l ) is the ciphertext ct f Is output. · ThFHE.PartDec(ct, sk i ) → p i : Each party P i Takes the ciphertext ct, distributed secret key sk i , as input, and outputs the partial decryption text p i . · ThFHE.FinDec({p i} i∈Q ) → m^: For a set of partial decryption texts {p N} corresponding to a certain party set Q ⊆ {P1, …, P i}, when Q satisfies the access structure A, the plaintext m ∈ {0, 1} is output, and when it does not satisfy, ⊥ is output (the correct plaintext is not output). i∈Q

[0032] In this way, in ThFHE, the master public key pk * And the corresponding distributed secret key (sk1, …, sk N ) are used. Each user (user number i) holds the distributed secret key sk i And uses the common master public key pk * For encryption. When the access structure is N-out-of-N, decryption is completed by each user using the distributed secret key sk i To perform partial decryption and collecting all partial decryption texts, similar to MKFHE.

[0033] Figure 6 is a diagram showing the configuration of a conventional secret calculation system using ThFHE. In the case of a multi-user secret calculation system using N-out-of-N ThFHE, each user (user number i) holds the distributed secret key sk i And the public key pk i corresponding to sk i ​The master public key jpk := (pk1 + … + pk N ) is used for encryption. Decryption is completed by all users performing partial decryption (PartDec) using the distributed secret key sk i and then collecting all the partially decrypted texts and performing FinDec.

[0034] In the conventional secret computation system based on ThFHE, there are similar advantages and issues regarding efficiency and security as in MKFHE.

[0035] [System Configuration] The secret computation system of this embodiment uses 2-out-of-2 ThFHE as a fully homomorphic encryption method and is configured to include entities different from the conventional multi-user secret computation system.

[0036] FIG. 1 is a diagram showing the configuration of the secret computation system 1 in this embodiment. The secret computation system 1 includes, as entities for performing secret computation, any number of user terminals 10 (party 1~N), a trustee (Evaluator) server 20 assumed as a cloud server or a machine learning model provider, and a decryption administrator terminal 30.

[0037] Let the master public key in 2-out-of-2 ThFHE be jpk, and the two distributed secret keys be sk usr , sk ad The distributed secret key sk usr common to all user terminals 10 is held by the decryption administrator terminal 30, and the distributed secret key sk ad is given to the trustee server 20 along with the computation key evk generated by all users and the decryption administrator.

[0038] All user terminals 10 share the common secret key sk usr and encrypt the data m i containing sensitive information using the master public key jpk := (pk usr + pk ad ) (1).

[0039] The entrusted computing server 20 performs a homomorphic operation using the computing key evk and the master public key jpk, taking as input the ciphertext received from the user (2). Then, the entrusted computing server 20 transmits the ciphertext ct after the operation to the decryption administrator terminal 30 (3). At this time, it is prohibited to transmit the ciphertext before the operation to the decryption administrator terminal 30.

[0040] The decryption administrator terminal 30 performs partial decryption of the ciphertext ct using the secret key sk ad and transmits the partially decrypted text to the appropriate user terminal 10 (4). Here, for example, when the plaintext information of the operation result can be regarded as statistical information that does not include sensitive information, the partially decrypted text may be publicly disclosed to all users. Alternatively, the partially decrypted text may be transmitted only to certain limited users (for example, those who have requested the operation from the entrusted computing operator). Note that since the partially decrypted text partially decrypted by the decryption administrator can be decrypted by all users, it is desirable to have a use case where the entrusted computing operator follows the rules, provides the decryption administrator only with the ciphertext containing only the already computed statistical information, and is allowed to publicly disclose the statistical information to all users.

[0041] The user terminal 10 that has received the partially decrypted text from the decryption administrator terminal 30 completes the decryption of the operation result by performing FinDec in combination with the partially decrypted text using its own secret key sk usr .

[0042] Figure 2 is a diagram showing the functional parts of each device constituting the secret computing system 1 in the present embodiment. The plurality of user terminals 10, the entrusted computing server 20, and the decryption administrator terminal 30 are all information processing devices (computers) equipped with various input / output and communication interfaces in addition to a control unit and a storage unit. The control unit realizes the processing of each functional part by reading and executing the software stored in the storage unit.

[0043] The control unit of the user terminal 10 includes a first secret key holding unit 11, an encryption unit 12, a first partial decryption unit 13, and a calculation result output unit 14.

[0044] The first secret key holding unit 11 shares the ciphertext encrypted by the master public key (jpk) among multiple user terminals 10, and holds in the storage unit the first secret key (sk usr ) in a fully homomorphic encryption scheme (e.g., the aforementioned 2-out-of-2 ThFHE) that can be decrypted only by integrating the partial decryption texts partially decrypted by each of the two parties having one of the two different secret keys.

[0045] The encryption unit 12 encrypts its own user data (m i ) with the master public key respectively, and transmits it to the entrusted operator server 20.

[0046] When the first partial decryption unit 13 receives the ciphertext (ct) of the calculation result from the entrusted operator server 20, it decrypts it into the first partial decryption text with the first secret key (sk usr ) (PartDec(ct, sk usr )).

[0047] When the calculation result output unit 14 receives the second partial decryption text (PartDec(ct, sk ad )) from the decryption administrator terminal 30, it outputs the decrypted calculation result by integrating it with the first partial decryption text (FinDec).

[0048] The control unit of the entrusted operator server 20 includes a homomorphic operation unit 21. The homomorphic operation unit 21 executes a predetermined operation (f) on the encrypted user data received from multiple user terminals 10 in an encrypted state using the master public key (jpk), and transmits the ciphertext (ct) of the calculation result to the user terminal 10 and the decryption administrator terminal 30.

[0049] The control unit of the decryption administrator terminal 30 includes a second secret key holding unit 31 and a second partial decryption unit 32.

[0050] The second secret key holding unit 31 acquires a second secret key (sk usr ) different from the first secret key (sk ad ) generated by a predetermined procedure in the multi-key fully homomorphic encryption scheme, and holds it in the storage unit.

[0051] When the second partial decryption unit 32 receives the ciphertext (ct) of the calculation result from the entrusted operator server 20, it transmits the second partial decryption text (PartDec(ct, sk ad )) decrypted by the second secret key (sk ad ) to any one of the plurality of user terminals 10.

[0052] Here, the secret computing system 1 may include one or more data providing terminals that do not hold the secret keys (sk usr , sk ad ) separately from the user terminals 10, and encrypt their own user data with the master public key (jpk) and transmit it to the entrusted operator server 20. In this case, the entrusted operator server 20 similarly executes a predetermined operation on the encrypted user data received from the plurality of user terminals 10 and the data providing terminals. However, the additional party (data providing terminal) can provide data to the entrusted operator server 20 in exchange for, for example, a reward, but cannot decrypt the ciphertext, and thus cannot obtain the calculation result.

[0053] According to this embodiment, the secret computing system 1 improves the efficiency and security as follows compared with the prior art.

[0054] (Efficiency) The efficiency of ThFHE, for example, when using the method of Non-Patent Document 6, has the same ciphertext and key sizes as normal single-key FHE, and the cost of homomorphic operations is linearly proportional to the number of distributed secret keys. In this embodiment, since only two distributed secret keys are used, the increase in cost is suppressed to about twice, which is sufficiently efficient.

[0055] (Security) Regarding privacy protection, although 2-out-of-2 FHE is considered to be somewhat less secure theoretically compared to MKFHE or N-out-of-N ThFHE (N > 2), under the reliability assumption of the trustee or the decryption manager, sufficient security can be provided as follows. Furthermore, the issue of the decryption interference attack, which is a vulnerability of the secret computing system based on MKFHE, is also solved as follows.

[0056] · Leakage resistance: Before the operation, the data including the user's sensitive information cannot be decrypted by other users unless the secret key of the decryption manager is misused (leaked). That is to say, under the reliability assumption of the decryption manager, the secret computing system 1 can be said to be sufficiently secure compared to single-key FHE.

[0057] · Collusion resistance: Unless one user, the trustee, and the decryption manager collude, the data before the operation including the sensitive information of other users cannot be decrypted. That is, unless one user receives the ciphertext before the operation of another user from the trustee, requests partial decryption from the decryption manager, or ad obtains the secret key sk, decryption is finally possible. Therefore, the secret computing system 1 can be said to be sufficiently secure compared to single-key FHE.

[0058] · Service stop attack (decryption interference): The only one who can perform the decryption interference attack in MKFHE on the secret computing system 1 is the decryption manager. However, when the user fails to decrypt (FinDec), since it is obvious that the attacker (criminal) is the decryption manager, the attack does not succeed.

[0059] In this way, according to this embodiment, a sufficiently efficient, secure, and practical secret computing system 1 can be configured. Also, the secret computing system 1 may obtain user data from a data providing terminal that cannot decrypt the operation result without holding the secret key, and thus it can be applied to statistical analysis targeting large-scale data.

[0060] Note that according to the present embodiment, for example, since a secure computing system having practical efficiency and safety can be configured, it is possible to contribute to Goal 9 of the Sustainable Development Goals (SDGs) led by the United Nations, "Build resilient infrastructure, promote sustainable industrialization, and foster innovation."

[0061] As described above, the embodiments of the present invention have been described. However, the present invention is not limited to the above-described embodiments. Also, the effects described in the above-described embodiments are merely an enumeration of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0062] The functions of the decryption manager terminal 30 (the second secret key holding unit 31, the second partial decryption unit 32) in the above-described embodiment may be transferred to the entrusted operator server 20. In this case, since the decryption manager terminal 30 does not exist, if a certain user and the entrusted operator collude, all ciphertexts may be decrypted. Therefore, the collusion resistance is the same as in the case of single-key FHE, but the leakage resistance and the decryption interference resistance are maintained.

[0063] Also, in the above-described embodiment, the system configuration using 2-out-of-2 ThFHE is adopted, but it is not limited thereto. More generally, a ciphertext encrypted with a public key jpk cannot be decrypted without the cooperation of two parties having two distributed secret keys sk usr , sk ad and can be realized by FHE.

[0064] The secret computing method by the secret computing system 1 is realized by software or a hardware circuit. When it is realized by software, the programs constituting this software are installed in an information processing apparatus (computer). Further, these programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded.

Explanation of Signs

[0065] 1 Secret computing system 10 User terminal 11 First secret key holding unit 12 Encryption unit 13 First partial decryption unit 14 Calculation result output unit 20 Entrusted calculator server 21 Homomorphic operation unit 30 Decryption administrator terminal 31 Second secret key holding unit 32 Second partial decryption unit

Claims

1. A secret computing system comprising a plurality of user terminals, a commissioned operator server, and a decryption administrator terminal, wherein the plurality of user terminals include a first secret key holding unit that shares a first secret key in a fully homomorphic encryption scheme that can only be decrypted by integrating partial decryption texts each partially decrypted by two parties each having one of two different secret keys with respect to a ciphertext encrypted with a master public key; an encryption unit that encrypts its own user data with the master public key and transmits it to the commissioned operator server; a first partial decryption unit that, when receiving a ciphertext of a calculation result from the commissioned operator server, decrypts it into a first partial decryption text with the first secret key; a calculation result output unit that outputs a calculation result decrypted by integrating the first partial decryption text when receiving a second partial decryption text from the decryption administrator terminal; and wherein the commissioned operator server includes a homomorphic operation unit that performs a predetermined operation on the encrypted user data received from the plurality of user terminals in an encrypted state using the master public key and transmits a ciphertext of the calculation result to the user terminal and the decryption administrator terminal; wherein the decryption administrator terminal includes a second secret key holding unit that holds a second secret key different from the first secret key; and a second partial decryption unit that, when receiving the ciphertext of the calculation result from the commissioned operator server, decrypts it with the second secret key and transmits the second partial decryption text to any one of the plurality of user terminals.

2. The secret computing system according to claim 1, further comprising one or more data providing terminals that do not hold the first secret key, encrypt their own user data with the master public key, and transmit it to the commissioned operator server, wherein the homomorphic operation unit performs the predetermined operation on the encrypted user data received from the plurality of user terminals and the data providing terminals.

3. A first secret key holding unit that shares a first secret key with another terminal in a fully homomorphic encryption scheme that can only be decrypted by integrating partial decryption texts each partially decrypted by two parties each having one of two different secret keys with respect to a ciphertext encrypted with a master public key; an encryption unit that encrypts its own user data with the master public key and transmits it to a commissioned operator server; When receiving, from the entrusted computing server, a ciphertext of a computation result obtained by executing a predetermined computation on encrypted user data received from a plurality of terminals in an encrypted state using the master public key, a first partial decryption unit that decrypts the ciphertext into a first partial decrypted text using the first secret key; When receiving, from the decryption administrator terminal, a second partial decrypted text obtained by decrypting the ciphertext of the computation result using a second secret key different from the first secret key, a computation result output unit that outputs a decrypted computation result by integrating the second partial decrypted text with the first partial decrypted text. A user terminal comprising:

4. In a fully homomorphic encryption method that can be decrypted only by integrating partial decrypted texts obtained by partially decrypting a ciphertext encrypted with a master public key by two parties each having one of two different secret keys, receiving encrypted user data encrypted with the first secret key from a plurality of user terminals, performing a predetermined computation on the encrypted user data in an encrypted state using the master public key, and transmitting a ciphertext of the computation result to the user terminal and the decryption administrator terminal, a homomorphic computation unit comprising: A entrusted computing server that outputs a decrypted computation result by integrating a first partial decrypted text decrypted by the user terminal using the first secret key and a second partial decrypted text decrypted by the decryption administrator terminal using a second secret key different from the first secret key.

5. In a fully homomorphic encryption method that can be decrypted only by integrating partial decrypted texts obtained by partially decrypting a ciphertext encrypted with a master public key by two parties each having one of two different secret keys, a second secret key holding unit that holds the second secret key; When receiving, from the entrusted computing server, a ciphertext of a computation result obtained by executing a predetermined computation on encrypted user data encrypted with a first secret key different from the second secret key by a plurality of user terminals in an encrypted state using the master public key, a second partial decryption unit that transmits a second partial decrypted text decrypted using the second secret key to any one of the plurality of user terminals. At any one of the plurality of user terminals, a decryption administrator terminal that outputs a decrypted computation result by integrating a first partial decrypted text obtained by decrypting the ciphertext of the computation result using the first secret key and the second partial decrypted text.

6. A program for causing a computer to function as the user terminal according to claim 3.

7. A program for causing a computer to function as the commissioned operator server according to claim 4.

8. A program for causing a computer to function as the decryption administrator terminal according to claim 5.

Images