Secret cross-coupling system, secret cross-coupling device, secret cross-coupling method, and program

Abstract

Provided is technology capable of securely crosslinking two tables with regard to a key attribute even if there is overlap among key attribute values in the two tables to be linked. [TL'] is generated by adding, to a [TL], as a value share column of an attribute Key', a column generated by associating a different value share between zero and α-1 with an identical value element included in [TL.Key]. [TRi] is generated by adding a value share column for the attribute Key' to [TR] (where TR0.Key'j is a value between zero and α-1, and TRi.Key'j (where i=1,..., α-1) satisfies TRi.Key'j=(TRi-1.Key'j+1) mod α). [TCi] is generated by secure row linking of [TL'] and [TRi] with regard to key attribute Key and attribute Key'. [TC] is generated by secure row linking of [TC0, ..., [TCα-1].

Description

[Technical Field]

[0001] The present invention relates to a secure computation technology, and more particularly to a technology for cross-joining two tables while keeping them confidential. [Background technology]

[0002] Secure computation is a method of obtaining the result of a specified computation without restoring the encrypted numerical value (see, for example, Reference Non-Patent Document 1, Non-Patent Document 1, and Patent Document 1). In the method of Reference Non-Patent Document 1, encryption is performed by distributing multiple pieces of information from which a numerical value can be restored to three secure computing devices, and the results of addition / subtraction, constant sum, multiplication, constant multiplication, logical operations (negation, logical product, logical sum, exclusive OR), and data format conversion (integer, binary number) can be stored in a distributed state, i.e., encrypted, among the three secure computing devices without restoring the numerical value. In general, the number of shares is not limited to 3 and can be W (W is a predetermined constant greater than or equal to 3), and a protocol that realizes secure computation through cooperative computation by W secure computing devices is called a multi-party protocol. (Reference Non-Patent Document 1: Koji Senda, Hiroki Hamada, Dai Igarashi, Katsumi Takahashi, “Rethinking Lightweight Verifiable Three-Party Secure Function Computation,” In CSS, 2010.) Techniques for joining two tables with respect to key attributes while keeping them confidential include those described in Non-Patent Document 2 and Patent Document 2. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Koji Senda, Dai Igarashi, Hiroki Hamada, and Katsumi Takahashi, "Proposal and Implementation Evaluation of Lightweight Three-Party Secure Function Computation with Error Detection," Transactions of Information Processing Society of Japan, Vol. 52, No. 9, pp. 2674-2685, 2011. [Non-patent document 2] Hiroki Hamada, Naoto Kiribuchi, and Dai Igarashi, "A Combined Algorithm for Secure Computation in the Presence of Duplicate Keys," Symposium on Cryptography and Information Security (SCIS) 2015, IEICE, 2015. [Patent documents]

[0004] [Patent Document 1] WO2019 / 203262 [Patent Document 2] WO2018 / 061800 Summary of the Invention [Problem to be solved by the invention]

[0005] However, the methods in Non-Patent Document 2 and Patent Document 2 perform a secret cross join when there is overlap in the key attribute values ​​of only one of the two tables to be joined, and cannot perform a secret cross join on the key attributes when there is overlap in the key attribute values ​​of the two tables. Here, cross joining two tables on the key attributes means obtaining a table by extracting only records whose key attribute values ​​match in the two tables from the table obtained by cross joining two tables.

[0006] Therefore, an object of the present invention is to provide a technology that can perform a private cross-join of two tables with respect to key attributes, even if there is overlap in the values ​​of the key attributes of the two tables to be joined. [Means for solving the problem]

[0007] In one aspect of the present invention, TL is a set of key attributes Key and attributes B1, ..., B M (M is an integer greater than or equal to 1), TR is a table consisting of a key attribute Key and attributes C1, …, C N (N is an integer greater than or equal to 1), and TA is the column of values ​​of attribute A that constitutes table T. jLet (j be an integer equal to or greater than 1) represent the j-th element of the column TA, the table TL is sorted with respect to the key attribute Key, α be the maximum number of elements with the same value included in the column TL.Key, and L be the number of records included in the table TR, and the secret cross-join system is configured to calculate a table [TC] obtained by cross-joining the table TL and the table TR with respect to the key attribute Key from a table [TL] obtained by concealing the table TL and a table [TR] obtained by concealing the table TR, and adds a column generated by associating shares of different values ​​between 0 and α-1 with elements with the same value included in the column [TL.Key] to the table [TL] as a column of shares of the value of the attribute Key', and M and a first table generation means for generating a table [TL'] in which the table TL' is concealed by adding a column of the share of the value of the attribute Key' to the table [TR], thereby generating a table [TL'] in which the key attribute Key and the attributes Key', C1, …, C N Table TR consisting of i (For i=0, …, α-1, where 1≦j≦L, TR0.Key' j is a value between 0 and α-1, and TR i .Key' j (i=1, …, α-1) is TR i .Key' j =(TR i-1 .Key' j +1) mod α) is concealed in the table [TR i ] (i=0, ..., α-1), and a second table generating means for generating the table [TL'] and the table [TR i ] and the key attribute Key and the attribute Key' are secretly and equivalently joined to form tables TL and TR. i Table TC obtained by equijoining with respect to the key attribute Key and attribute Key' i The table [TC i ] (i=0, ..., α-1), and a third table generating means for generating table [TC0], ..., table [TCα-1 ] by secret row join of tables TC0, ..., and TC α-1 and a fourth table generating means for generating a table [TC] by concealing the table TC obtained by row-joining the above. [Effects of the Invention]

[0008] According to the present invention, even if there is overlap in the values ​​of the key attributes of the two tables to be joined, it is possible to perform a private cross join of the two tables with respect to the key attributes. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 10 is a diagram illustrating an example of tables to be joined. [Figure 2] FIG. 10 is a diagram illustrating an example of a table cross-joined on a key attribute. [Figure 3] FIG. 10 is a diagram illustrating a procedure for generating a table cross-joined with respect to key attributes. [Figure 4] FIG. 10 is a diagram illustrating a procedure for generating a table cross-joined with respect to key attributes. [Figure 5] FIG. 10 is a diagram illustrating a procedure for generating a table cross-joined with respect to key attributes. [Figure 6] FIG. 10 is a diagram illustrating a procedure for generating a table cross-joined with respect to key attributes. [Figure 7] FIG. 1 is a block diagram showing the configuration of a secret cross-coupling system 10. [Figure 8] FIG. 2 is a block diagram showing the configuration of a secret cross-coupling device 100i. [Figure 9] 1 is a flowchart illustrating the operation of the secret cross-linking system 10. [Figure 10] FIG. 2 is a diagram illustrating an example of the functional configuration of a computer that realizes each device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, embodiments of the present invention will be described in detail. Components having the same functions are given the same numbers, and duplicated explanations will be omitted.

[0011] Before describing each embodiment, the notation used in this specification will be explained.

[0012] ^ (caret) represents a superscript, e.g., x y^z Yes z is a superscript to x, and x y^z Yes z is a subscript to x. Also, _ (underscore) represents a subscript. For example, x y_z Yes z is a superscript to x, and x y_z Yes z is a subscript to x.

[0013] For a character x → x, ^x, and ~x → ", "^" and "~" should be written directly above the "x", but due to limitations on the description in the specification, → These are written as x, ^x or ~x. <Technical background> <<Cross-Join>> Here, cross joins on key attributes will be explained using examples. FIG. 1 is a diagram showing an example of tables to be joined. (A), (B), and (C) in FIG. 1 are a table related to beverage product names, a table related to the volume of beverage product containers, and a table related to the type of beverage product container, respectively. The two tables in FIG. 1 (B) and (C) are the tables to be joined. FIG. 2 is a diagram showing an example of a table cross joined on key attributes. The table in FIG. 2 is a table in which the two tables in FIG. 1 (B) and (C) are cross joined on key attributes, with ID as the key attribute. Note that (B) in FIG. 1 has three records with a key attribute ID value of 1000, and (C) in FIG. 1 has two records each with key attribute ID values ​​of 1000 and 4500, respectively, indicating that there is overlap in the key attribute values ​​of the two tables to be joined.

[0014] Next, we will explain the procedure for generating a table cross-joined with respect to key attributes. Hereinafter, the two tables in Figure 1 (B) and (C) are called TL and TR, respectively. If α is the maximum number of elements with the same value included in the key attribute ID of table TL, then α = 3. Also, if L is the number of records included in table TR, then L = 5. Let TA be the column of values ​​of attribute A that make up table T, and TA j Let denote the j-th element of the column TA. Note that the table TL is sorted with respect to the key attribute ID. (Step 1) Table TL' is generated by adding a column generated by associating different values ​​between 0 and α-1 with elements of the same value included in the key attribute ID of table TL as a column of attribute ID' values ​​to table TL. Figure 3 shows table TL' obtained by executing step 1. (Step 2) By adding a column of attribute ID' values ​​to table TR, α tables TR0, …, TR α-1 where TR0.ID' is generated for j satisfying 1 ≤ j ≤ L. j is a value between 0 and α-1, and TR i .ID' j (i=1, …, α-1) is TRi .ID' j =(TR i-1 .Key' j +1) mod α. Figure 4 shows the table TR0, …, TR α-1 FIG. (Step 3) Table TL and Table TR i By equijoining on the key attribute ID and attribute ID', table TC i (i=0, …, α-1). Figure 5 shows the table TC0, …, TC α-1 FIG. (Step 4) Table TC0, ..., Table TC α-1 6 is a diagram showing the table TC obtained by executing step 4. <<Secure calculation>> The secure computation in the present invention is constructed by combining existing secure computation operations. Operations required for this secure computation include, for example, concealment, addition, subtraction, multiplication, division, logical operations (negation, logical AND, logical OR, exclusive OR), comparison operations (=, <, >, ≦, ≧), group-by operations, and secret equal joins. Some operations, including notations, will be explained below.

[0015] Secure computation on a table can be realized by regarding the table as a matrix, the columns of attribute values ​​of the table as column vectors, and the records of the table as row vectors. [Redacted] Let [x] be the value of x concealed by secret sharing (hereinafter referred to as a share of x). Any secret sharing method can be used. For example, 61 -1) Shamir secret sharing on Z2 and replication secret sharing on Z2 can be used.

[0016] Multiple secret sharing methods may be combined within a single algorithm. In this case, they will be converted into each other as appropriate.

[0017] Also, N-dimensional vector → x=(x1, …, x N ) and [ → x]=([x1], …, [x N ]) in other words, [ → x] is → The nth element of x, x n Share of [x n ] is a vector with n-th element. Similarly, M×N matrix A=(a m,n )(1≦m≦M, 1≦n≦N), [A] is also the (m, n)th element of A, a m,n Share of [a m,n ] is the matrix whose element is (m, n).

[0018] Note that x is called the plaintext of [x].

[0019] Specific examples of a method for obtaining [x] from x (concealment) and a method for obtaining x from [x] (restoration) are described in Reference Non-Patent Document 1 and Reference Non-Patent Document 2. (Reference Non-Patent Document 2: Shamir, A., "How to share a secret", Communications of the ACM, Vol. 22, No. 11, pp. 612-613, 1979.) [Addition, Subtraction, Multiplication, Division] Secure addition [x]+[y] takes [x] and [y] as input and outputs [x+y]. Secure subtraction [x]-[y] takes [x] and [y] as input and outputs [xy]. Secure multiplication [x]×[y] (sometimes expressed as mul([x], [y])) takes [x] and [y] as input and outputs [x×y]. Secure division [x] / [y] (sometimes expressed as div([x], [y])) takes [x] and [y] as input and outputs [x / y].

[0020] Specific methods for addition, subtraction, multiplication, and division include those described in Reference Non-Patent Documents 3 and 4. (Reference Non-Patent Document 3: Ben-Or, M., Goldwasser, S. and Wigderson, A., “Completeness theorems for non-cryptographic fault-tolerant distributed computation”, Proceedings of the twentieth annual ACM symposium on Theory of computing, ACM, pp. 1-10, 1988.) (Reference Non-Patent Document 4: Gennaro, R., Rabin, MO and Rabin, T., “Simplified VSS and fast-track multiparty computations with applications to threshold cryptography”, Proceedings of the seventeenth annual ACM symposium on Principles of distributed computing, ACM, pp.101-111, 1998.) [Logical Operations] Secure negation not[x] takes [x] as input and outputs [not(x)]. Secure logical conjunction and([x], [y]) takes [x] and [y] as input and outputs [and(x, y)]. Secure logical sum or([x], [y]) takes [x] and [y] as input and outputs [or(x, y)]. Secure exclusive OR xor([x], [y]) takes [x] and [y] as input and outputs [xor(x, y)].

[0021] Note that logical operations can be easily configured by combining addition, subtraction, multiplication, and division. [Comparison operation] Equality judgment by secret calculation =([x], [y]) (sometimes denoted as equal([x], [y])) takes [x] and [y] as inputs and outputs [1] if x = y and [0] otherwise. Comparison by secret calculation <([x], [y]) takes [x] and [y] as inputs and outputs [1] if x < y and [0] otherwise. Comparison by secret calculation >([x], [y]) takes [x] and [y] as inputs and outputs [1] if x > y and [0] otherwise. Comparison by secret calculation ≦([x], [y]) takes [x] and [y] as inputs and outputs [1] if x ≦ y and [0] otherwise. Comparison by secret calculation ≧([x], [y]) takes [x] and [y] as inputs and outputs [1] if x ≧ y and [0] otherwise.

[0022] Note that the comparison operation can be easily constructed by combining logical operations. [Group-by operation] N-dimensional vector → x=(x1, …, x N ) is assumed to be sorted. That is, x1, …, x N satisfy x1≦…≦x N or x1≧…≧x N . At this time, x i , x i+1 , …, x i+k-1 (k is an integer greater than or equal to 1, provided that x i-1 ≠x i , x i+k-1 ≠x i+k ) are taken as one group, and the vector i , …, x i+k-1 is obtained by associating 0, …, k - 1 with respect to x → y=(y1, …, y N ). → y is represented as y=group-by( → x), and from vector → x to vector →The operation to obtain y is called group-by operation. For example, for a vector (1000, 1000, 1000, 3210, 4050), group-by((1000, 1000, 1000, 3210, 4050)) = (0, 1, 2, 0, 0).

[0023] The anonymized vector [ → x]=([x1], …, [x N ]), we can similarly define a group-by operation for an N-dimensional vector. → x=(x1, …, x N ) (where x1, …, x N is x1≦…≦x N or x1 ≥ … ≥ x N (satisfying) share [ → x], N-dimensional vector → y=(y1, …, y N )(however, → y is the same value as x i , x i+1 , …, x i+k-1 (k is an integer greater than or equal to 1, but x i-1 ≠x i , x i+k-1 ≠x i+k ) as one group, x i , …, x i+k-1 (the vector obtained by assigning 0, …, k-1 to → y] to [ → y]=group-by([ → x]).

[0024] A specific method of the group-by operation is disclosed in Patent Document 1. [Secret combination] TL is a set of key attributes Key and attributes B1, …, B M (M is an integer greater than or equal to 1), TR is a table consisting of a key attribute Key and attributes C1, …, C N(N is an integer equal to or greater than 1). In this case, a table TC obtained by equijoining table TL and table TR with respect to the key attribute Key is a table consisting of the key attribute Key and attributes B1, ..., B M and key attribute Key and attributes C1, …, C N (See Figures 3 to 5.)

[0025] Equijoins can be defined for the anonymized tables [TL] and [TR] in the same way. That is, the key attribute Key and the attributes B1, …, B M The table TL is a table [TL] that is anonymized by adding the key attribute Key and the attributes C1, …, C N Table [TR] is a table that is anonymized from table TR, and table [TL] and table [TR] are secretly joined with respect to the key attribute Key to obtain table [TC], which is a table that has the key attribute Key and attributes B1, ..., B M and key attribute Key and attributes C1, …, C N Here, [TC] = join([TL], [TR]).

[0026] A specific method for secret equal binding is the method described in Patent Document 2. The method described in Patent Document 2 is a method that allows duplicate values ​​of the key attribute Key of the table TR. First Embodiment The secret cross-coupling system 10 will be described below with reference to Figs. 7 to 9. Fig. 7 is a block diagram showing the configuration of the secret cross-coupling system 10. The secret cross-coupling system 10 comprises W (W is a predetermined integer of 3 or more) secret cross-coupling devices 1001, ..., 100 W Secret cross-coupling devices 1001, ..., 100 W are connected to a network 800 and can communicate with each other. The network 800 may be, for example, a communication network such as the Internet or a broadcast communication path. i9 is a block diagram showing the configuration of (1≦i≦W). FIG. 9 is a flowchart showing the operation of the secret cross-coupling system 10.

[0027] As shown in FIG. 8, a secret cross-coupling device 100 i The first table generation unit 110 i and the second table generating unit 120 i and the third table generating unit 130 i and the fourth table generating unit 140 i and recording unit 190 i Recording unit 190 i Excluding the secret cross-coupling device 100 i Each component of the above is configured to be able to execute the operations required for secure computation, that is, at least the operations required to realize the function of each component, among the operations required for secure computation, i.e., at least the concealment, addition, subtraction, multiplication, division, logical operation, comparison operation, group-by operation, and secret combination. In the present invention, the specific functional configuration for realizing each operation is sufficient if it is a configuration that can execute existing algorithms including the algorithms disclosed in Patent Documents 1 and 2 and Reference Non-Patent Documents 1 to 4, and since these are conventional configurations, detailed description thereof will be omitted. Also, the recording unit 190 i The secret cross-coupling device 100 i This is a component that records information necessary for processing.

[0028] W secret cross-couplers 100 i By the collaborative computation by the above, the secret cross-linking system 10 realizes the secure computation of the cross-linking on the key attribute, which is a multi-party protocol. Therefore, the first table generating means 110 (not shown) of the secret cross-linking system 10 comprises first table generating units 1101, ..., 110 W The second table generating means 120 (not shown) is composed of second table generating units 1201, . . . , 120 W The third table generating means 130 (not shown) is composed of third table generating units 1301, . . . , 130 W The fourth table generating means 140 (not shown) is composed of fourth table generating units 1401, . . . , 140 WIt consists of:

[0029] TL is a key attribute Key and attributes B1, …, B M (M is an integer greater than or equal to 1), TR is a table consisting of a key attribute Key and attributes C1, …, C N (N is an integer greater than or equal to 1). Also, let TA be the column of values ​​of attribute A that constitutes table T, and TA j (j is an integer greater than or equal to 1) represents the j-th element of column TA. Furthermore, table TL is assumed to be sorted with respect to key attribute Key, α is the maximum number of elements with the same value in column TL.Key, and L is the number of records in table TR.

[0030] The secret cross-link system 10 calculates a table [TC] obtained by concealing the table TC obtained by cross-linking the table TL and the table TR with respect to the key attribute Key from the table [TL] obtained by concealing the table TL and the table [TR] obtained by concealing the table TR. The table [TL] and the table [TR] are stored in advance in the recording unit 190. i You may record it in

[0031] The operation of the secret cross-linking system 10 will now be described with reference to FIG.

[0032] In S110, the first table generation means 110 generates a column in the table [TL.Key] by associating elements with the same value contained in the column [TL.Key] with shares of different values ​​between 0 and α-1, and adds the column to the table [TL] as a column of shares of the value of the attribute Key'. M The first table generation means 110 generates a table [TL'] by concealing the table TL' configured as above. The first table generation means 110 can generate a column of shares of the values ​​of the attribute Key' by group-by([TL.Key]), for example, to generate the table [TL'].

[0033] In S120, the second table generation means 120 adds a column of the share of the value of the attribute Key' to the table [TR], thereby generating a table of the key attribute Key and the attributes Key', C1, ..., C N Table TR consisting of i (For i=0, …, α-1, where 1≦j≦L, TR0.Key' j is a value between 0 and α-1, and TR i .Key' j (i=1, …, α-1) is TR i .Key' j =(TR i-1 .Key' j +1) mod α) is concealed in the table [TR i ] (i=0, ..., α-1). The second table generating means 120 generates, for example, a random number r j Share of [r j ] and generate [TR0.Key' j ]= [r j ] mod α, [TR i .Key' j ]=([TR i-1 .Key' j ]+[1]) mod α, the table [TR i ] (i=0, ..., α-1) can be generated. Note that mod in secure computation is computationally expensive, so it is recommended to use subtraction, for example, as follows: [TR i .Key' j ]=[TR i-1 .Key' j ]+[1] if ([TR i .Key' j ]==[α]) then [TR i .Key' j ]=[0] Here, = indicates substitution, and == indicates a conditional test of equality.

[0034] In S130, the third table generating means 130 generates the table [TL'] and the table [TR i] and the key attribute Key and the attribute Key' are secretly and equivalently joined to form tables TL and TR. i Table TC obtained by equijoining with respect to the key attribute Key and attribute Key' i The table [TC i ] (i=0, ..., α-1). The third table generating means 130 generates, for example, [TC i ]=join([TL'], [TR i ]) to the table [TC i ](i=0, …, α-1) can be generated.

[0035] In S140, the fourth table generating means 140 generates the table [TC0], ..., table [TC α-1 ] by secret row join of tables TC0, ..., and TC α-1 The fourth table generation means 140 generates a table [TC] by concealing the table TC obtained by row-joining the above. The fourth table generation means 140 can generate the table [TC] by, for example, a method similar to row-joining in plain text.

[0036] Here, β is the maximum number of elements with the same value contained in the column TR.Key. When the tables TL and TR are sorted by the key attribute Key, the secret cross join system 10 can execute the secret cross join faster when α≧β than when α<β. Therefore, when α<β, the tables TL and TR may be swapped in advance before executing the secret cross join.

[0037] According to the embodiment of the present invention, even if there are overlaps in the values ​​of the key attributes of the two tables to be joined, it is possible to perform a private cross join between the two tables with respect to the key attributes. The embodiment of the present invention is a table [TL'] that contains the same number of records as the table [TL] and a table [TR] that contains the same number of records as the table [TR]. i] to realize a secret cross join. This method divides table [TL] into α tables [TL] so that there are no overlaps in the values ​​of the key attributes. i This solves the problem of information leakage that occurs in a method (hereinafter referred to as a conventional method) of implementing a secure cross join by performing a secure equijoin on table [TR] and table [TR]. Furthermore, the method of the embodiment of the present invention can reduce the memory size required for calculation compared to the conventional method. Specifically, if K is the number of records included in table TL, the conventional method requires a column join between a table with K×β records and a table with L records, whereas the method of the embodiment of the present invention only requires a column join between a table with K codes and a table with L records to be performed α times, thereby significantly reducing the memory size. <Additional Notes> The processing of each unit of each of the above-mentioned devices may be realized by a computer, in which case the processing content of the functions that each device should have is described by a program. Then, by loading this program into the recording unit 2020 of the computer 2000 shown in Fig. 10 and operating the arithmetic processing unit 2010, the input unit 2030, the output unit 2040, the auxiliary recording unit 2025, etc., various processing functions of each of the above-mentioned devices are realized on the computer.

[0038] The device of the present invention may, for example, be a single hardware entity, having an input unit capable of inputting signals from outside the hardware entity, an output unit capable of outputting signals to outside the hardware entity, a communication unit to which a communication device (e.g., a communication cable) can be connected for communication with outside the hardware entity, a CPU (which may also include a central processing unit, cache memory, registers, etc.) as an arithmetic processing unit, RAM and ROM as memories, an external storage device such as a hard disk, and buses connecting these input unit, output unit, communication unit, CPU, RAM, ROM, and external storage device so as to enable data exchange. If necessary, the hardware entity may also be provided with a device (drive) capable of reading and writing to a recording medium such as a CD-ROM. An example of a physical entity equipped with such hardware resources is a general-purpose computer.

[0039] The external storage device of the hardware entity stores the programs required to realize the above-mentioned functions and the data required for processing these programs (the programs may be stored in a ROM, which is a read-only storage device, for example, instead of an external storage device). Data obtained by processing these programs is stored in RAM, the external storage device, etc. as appropriate.

[0040] In the hardware entity, each program stored in an external storage device (or ROM, etc.) and data required for processing each program are loaded into memory as needed, and interpreted, executed, and processed by the CPU as appropriate. As a result, the CPU realizes predetermined functions (each component represented as the above, "... unit," "... means," etc.). In other words, each component in the embodiments of the present invention may be configured by a processing circuitry.

[0041] As described above, when the processing functions of the hardware entities (apparatuses of the present invention) described in the above embodiments are realized by a computer, the processing contents of the functions that the hardware entities should have are described by a program. Then, by executing this program on a computer, the processing functions of the hardware entities are realized on the computer.

[0042] The program describing the processing contents can be recorded on a computer-readable recording medium, such as a non-transitory recording medium, specifically a magnetic recording device, an optical disk, or the like.

[0043] The program may be distributed, for example, by selling, transferring, lending, etc. a portable recording medium such as a DVD or CD-ROM on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to another computer via a network, thereby distributing the program.

[0044] A computer that executes such a program, for example, first stores the program recorded on a portable recording medium or transferred from a server computer in its own non-transitory storage device, the auxiliary storage unit 2025. Then, when executing a process, the computer loads the program stored in its own non-transitory storage device, the auxiliary storage unit 2025, into the storage unit 2020 and executes processing in accordance with the loaded program. Alternatively, as another execution mode of this program, the computer may load the program directly from a portable recording medium into the storage unit 2020 and execute processing in accordance with the program. Furthermore, each time a program is transferred from a server computer to this computer, the computer may execute processing in accordance with the received program. Alternatively, the server computer may not transfer the program to this computer, but may instead execute the processing function by issuing an execution instruction and obtaining the results, thereby executing the above-described processing through a so-called ASP (Application Service Provider) type service. Note that the program in this embodiment includes information used for processing by a computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that define computer processing).

[0045] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0046] The present invention is not limited to the above-described embodiment, and various modifications can be made without departing from the spirit of the present invention.

Claims

1. TL is the key attribute Key and attribute B 1 , …, B M (M is an integer greater than or equal to 1) 1 , …, C N (N is an integer greater than or equal to 1) Let TA be the column of values ​​of attribute A that constitutes table T, and TA j (j is an integer greater than or equal to 1) represents the j-th element of column TA, Assume that table TL is sorted with respect to the key attribute Key. Let α be the maximum number of elements with the same value in the column TL.Key, and L be the number of records in the table TR. A secret cross-join system, which is composed of three or more secret cross-join devices, calculates a table [TC] obtained by concealing a table TC obtained by cross-joining a table TL and a table TR with respect to a key attribute Key from a table [TL] obtained by concealing a table TL and a table [TR] obtained by concealing a table TR, By adding a column generated by associating the shares of different values ​​between 0 and α-1 with the elements of the same value contained in the column [TL.Key] to the table [TL] as a column of the share of the value of attribute Key', the key attribute Key and attribute Key', B 1 , …, B M a first table generation means for generating a table [TL'] obtained by concealing the table TL' configured as above; By adding a column for the share of the value of attribute Key' to table [TR], the key attribute Key and attribute Key', C 1 , …, C N Table TR consisting of i (i=0, …, α-1, where 1≦j≦L, for j, TR 0 .Key' j is a value between 0 and α-1, and TR i .Key' j (i=1, …, α-1) is TR i .Key' j =(TR i-1 .Key' j +1) mod α) i ] (i=0, ..., α-1), Table [TL'] and Table [TR i ] and the key attribute Key and the attribute Key' are secretly and equivalently joined to form tables TL and TR. i Table TC obtained by equijoining with respect to the key attribute Key and attribute Key' i The table [TC i ] (i=0, ..., α-1); Table [TC 0 ], …, table [TC α-1 ] to table TC 0 , ..., Table TC α-1 a fourth table generation means for generating a table [TC] obtained by concealing the table TC obtained by row-joining the above; A secret cross-linking system including:

2. TL is the key attribute Key and attribute B 1 , …, B M (M is an integer greater than or equal to 1) 1 , …, C N (N is an integer greater than or equal to 1) Let TA be the column of values ​​of attribute A that constitutes table T, and TA j (j is an integer greater than or equal to 1) represents the j-th element of column TA, Assume that table TL is sorted with respect to the key attribute Key. Let α be the maximum number of elements with the same value in the column TL.Key, and L be the number of records in the table TR. A secret cross-link device in a secret cross-link system, which is composed of three or more secret cross-link devices, calculates a table [TC] obtained by concealing a table TC obtained by cross-linking a table TL and a table TR with respect to a key attribute Key from a table [TL] obtained by concealing a table TL and a table [TR] obtained by concealing a table TR, By adding a column generated by associating the shares of different values ​​between 0 and α-1 with the elements of the same value contained in the column [TL.Key] to the table [TL] as a column of the share of the value of attribute Key', the key attribute Key and attribute Key', B 1 , …, B M a first table generation unit that generates a table [TL'] obtained by concealing the table TL' configured as above; By adding a column for the share of the value of attribute Key' to table [TR], the key attribute Key and attribute Key', C 1 , …, C N Table TR consisting of i (i=0, …, α-1, where 1≦j≦L, for j, TR 0 .Key' j is a value between 0 and α-1, and TR i .Key' j (i=1, …, α-1) is TR i .Key' j =(TR i-1 .Key' j +1) mod α) i ] (i=0, ..., α-1), Table [TL'] and Table [TR i ] and the key attribute Key and the attribute Key' are secretly and equivalently joined to form tables TL and TR. i Table TC obtained by equijoining with respect to the key attribute Key and attribute Key' i The table [TC i ] (i=0, ..., α-1), Table [TC 0 ], …, table [TC α-1 ] to table TC 0 , ..., Table TC α-1 a fourth table generation unit that generates a table [TC] by concealing the table TC obtained by row-joining the above; A secret cross-coupling device including:

3. TL is the key attribute Key and attribute B 1 , …, B M (M is an integer greater than or equal to 1) 1 , …, C N (N is an integer greater than or equal to 1) Let TA be the column of values ​​of attribute A that constitutes table T, and TA j (j is an integer greater than or equal to 1) represents the j-th element of column TA, Assume that table TL is sorted with respect to the key attribute Key. Let α be the maximum number of elements with the same value in the column TL.Key, and L be the number of records in the table TR. A secret cross-join method in which a secret cross-join system consisting of three or more secret cross-join devices calculates a table [TC] obtained by concealing a table TC obtained by cross-joining a table TL and a table TR with respect to a key attribute Key from a table [TL] obtained by concealing a table TL and a table [TR] obtained by concealing a table TR, the method comprising: The secret cross-link system generates a column in the table [TL] by associating a share of a value between 0 and α-1 with an element of the same value included in the column [TL.Key]. The column is then added to the table [TL] as a column of shares of the value of the attribute Key'. 1 , …, B M a first table generation step of generating a table [TL'] obtained by concealing the table TL' configured as above; The secret cross-linking system adds a column of shares of the value of the attribute Key' to the table [TR] to create a key attribute Key and an attribute Key', C 1 , …, C N Table TR consisting of i (i=0, …, α-1, where 1≦j≦L, for j, TR 0 .Key' j is a value between 0 and α-1, and TR i .Key' j (i=1, …, α-1) is TR i .Key' j =(TR i-1 .Key' j +1) mod α) i ](i=0, ..., α-1) as a second table generation step; The secret cross-link system comprises a table [TL'] and a table [TR i ] and the key attribute Key and the attribute Key' are secretly and equivalently joined to form tables TL and TR. i Table TC obtained by equijoining with respect to the key attribute Key and attribute Key' i The table [TC i ] (i=0, ..., α-1), The secret cross-linking system is 0 ], …, table [TC α-1 ] to table TC 0 , ..., Table TC α-1 a fourth table generation step of generating a table [TC] by concealing the table TC obtained by row-joining the above; A secret cross-linking method including:

4. A program for causing a computer to function as the secret cross-coupling device according to claim 2.

Images