Data matching device and program thereof

Abstract

To provide a data matching device for matching common elements of data sets between two users.SOLUTION: A data matching device 1 includes: secret information generation means 30 for generating secret distributed data, a random number, and a hash value as secret information for each element included in a data set; and matching determination means 40 for determining a common element by transmitting and receiving a part of the secret information to and from another data matching device to generate intermediate data by the secret information, transmitting and receiving the intermediate data to and from the other data matching device to generate determination data by the secret information, and transmitting and receiving the determination data to and from the other data matching device to compare them.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to a data matching device and a program for matching data between two parties. [Background technology]

[0002] Conventionally, a PSI (Private Set Intersection) protocol is known, which allows users who have a data set to share only common data (elements) without disclosing the contents of the data set to each other. This PSI protocol achieves high speed by hashing each element of a data set using a cryptographic hash function and comparing those hash values. Such a configuration that simply uses a cryptographic hash function is easily susceptible to brute force attacks if the entropy of the domain of the hash function is small (i.e., the number of types of elements in the set is not large) (see Non-Patent Document 1). This brute force attack can be prevented by using Diffie-Hellman public key cryptography, which bases its security on the discrete logarithm problem (see Non-Patent Document 2).

[0003] However, in conventional Diffie-Hellman PSI protocols, even if a sufficiently large set is secured, if one user is an attacker who does not follow the protocol, it is possible to obtain the data of another user. Such an attacker is called a malicious attacker. The PSI protocol using the general Diffie-Hellman public key cryptography does not provide security against malicious attackers who do not follow the protocol (malicious security). Furthermore, it is believed that public key cryptography will be compromised when quantum computers are realized in the future, and there is a risk that the PSI protocol using Diffie-Hellman public key cryptography will no longer be secure. For this reason, in recent years, multi-party computation (MPC) has been attracting attention as a cryptographic technology that is secure even when quantum computers are realized (quantum-safe) (Non-Patent Documents 3 and 4). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Pincas et al.,"Scalable Private Set Intersection Based on OT Extension," ACM Trans. On Privacy and Security 2018 [Non-patent document 2] Kaisei Kajita, Shuhei Taguchi, Tsuyoshi Otake, “Construction and Security of PSI for Viewing History”, 2021 Symposium on Cryptography and Information Security (SCIS2021), January 19-22, Online, Institute of Electronics, Information and Communication Engineers [Non-patent document 3] T. Araki, J. Furukawa, Y. Lindell, A. Nof, and K. Ohara, “High-throughput semi-honest secure three-party computation with an honest majority,” Proc. of ACM SIGSAC CCS'16, pp.805-817, 2016. [Non-patent document 4] T. Nishide and K. Ohta, “Multiparty Computation for Interval, Equality, and Comparison without Bit-decomposition Protocol,” Proc. of PKC'07, pp.343-360, 2007. Summary of the Invention [Problem to be solved by the invention]

[0005] As mentioned above, the conventional PSI protocol has the problem that if two parties share only common data, if one user is a malicious attacker who does not follow the protocol, he or she can obtain the other user's data, which means that the security is not met. In addition, conventional multi-party computation (MPC) requires three or more users, one of whom must be trusted. Therefore, it is not possible to realize a PSI protocol with malicious security between two parties by applying MPC.

[0006] The present invention has been made in consideration of the problems with the prior art, and its objective is to provide a data matching device and a program therefor that can ensure security in a PSI protocol between two parties, even if one of them is a malicious attacker who does not follow the protocol. [Means for solving the problem]

[0007] In order to solve the above problem, the data matching device of the present invention is a data matching device that matches common elements of data sets between two parties, and is configured to include a secret sharing data generation means, a random number generation means, a hash value calculation means, an intermediate data generation means, a judgment data generation means, and a common element extraction means.

[0008] In such a configuration, the data matching device uses a secret sharing data generation means to secretly share the values ​​of each element included in the data set so that the sum becomes the value of the element, thereby generating two secret sharing data (first secret sharing data and second secret sharing data). Furthermore, the data matching device generates two random numbers (a first random number and a second random number) using the random number generating means. Furthermore, the data matching device hashes the element value using a hash function, and calculates a hash value by multiplying the hash value by the first random number and dividing the hash value by the second random number using the hash value calculation means.

[0009] The data matching device then transmits and receives the first secret shared data and the second random number to and from other data matching devices to be matched, and generates intermediate data that is the difference or sum of the product of the first random number and the second random number generated by the other data matching device and the difference between the second secret shared data and the first secret shared data generated by the other data matching device. Since this intermediate data is generated by secretly sharing the values ​​of the elements, the elements cannot be identified in other data matching devices.

[0010] The data matching device then transmits and receives intermediate data to and from other data matching devices using the judgment data generation means, and generates judgment data by multiplying the intermediate data generated by the other data matching device by the first random number and dividing it by the second random number. If the judgment data generated in this way has the same elements, it will have the same value as the judgment data generated by the other data matching device.

[0011] Therefore, the data matching device transmits and receives judgment data between other data matching devices using a common element extraction means, and extracts elements that match the judgment data generated by the other data matching devices with its own judgment data as common elements. In this way, the data matching device secretly shares the element values, so if this protocol is followed, only the common elements can be shared without disclosing their contents to each other. On the other hand, if this protocol is not followed, it is impossible to distinguish between common and non-common elements. The data matching device can be operated by a data matching program that causes a computer to function as each of the above-mentioned means. [Effects of the Invention]

[0012] The present invention provides the following excellent effects. According to the present invention, a PSI protocol in which only common data is shared between two parties can be realized by secret sharing. As a result, the present invention can ensure safety by preventing even a malicious attacker who does not follow the protocol from obtaining data (elements) of other users. [Brief explanation of the drawings]

[0013] [Figure 1] 1 is a block diagram showing the overall configuration of a data matching system according to an embodiment of the present invention. [Figure 2] FIG. 10 is an explanatory diagram illustrating the relationship between a data set and an intersection set. [Figure 3] 1 is a block diagram showing a configuration of a data matching device according to an embodiment of the present invention. [Figure 4] FIG. 2 is an explanatory diagram illustrating an example of a matching order of elements in two data sets of the data matching device according to the embodiment of the present invention. [Figure 5] 10 is a flowchart showing an operation between two parties of the data matching device according to the embodiment of the present invention. [Figure 6] 6 is a flowchart showing the operation of generating secret information in FIG. 5. [Figure 7] 6 is a flowchart showing the operation of the matching determination in FIG. 5. DETAILED DESCRIPTION OF THE INVENTION

[0014] <Data matching system configuration> First, with reference to FIG. 1, the configuration of a data matching system 100 according to an embodiment of the present invention will be described.

[0015] The data matching system 100 matches common elements from two data sets. The data matching system 100 includes a data matching device 1 (1 A ,1 B ) and a database 2 (2) that stores data sets to be matched by each data matching device 1. A,2 B ) and.

[0016] The data matching device 1 is a terminal device that matches common elements of data sets between two parties. For example, the data matching device 1 is a smartphone, a tablet terminal, a personal computer, or the like. The data matching device 1 matches data sets using the Private Set Intersection (PSI) protocol and generates common elements as a common set. The PSI protocol used by the data matching device 1 is a protocol that matches data (elements) while keeping the elements of its own data set secret by secretly sharing the elements of the data set. The detailed configuration of the data matching device 1 will be described later.

[0017] The database 2 stores a data set that is the target of data matching between the data matching devices 1. This database 2 exists, for example, in a cloud C (OneDrive (registered trademark), Dropbox (registered trademark), etc.). Database 2 A data matching device 1 A It stores a set of data. Database 2 B data matching device 1 B It stores a set of data.

[0018] The data length of each element of the data set stored in database 2 is the same. Data of different data lengths is processed in advance so that it has the same data length. For example, if there is data with element values ​​of "3" (1 byte), "12" (2 bytes), and "6627" (4 bytes), the data lengths will all be 4 bytes, as "0003", "0012", and "6627". In other words, the data length of each element of the data set is processed to be the same data length, and not less than the longest data length.

[0019] The data set stored in the database 2 can be of any type, such as a television program viewing history, as long as the data can be stored by the user in the database 2. Here, a viewing history will be used as an example of the data set. The viewing history is history data of programs that the user has viewed via the viewing terminal TE. The viewing terminal TE is a television terminal for viewing programs via broadcast waves, a smartphone, tablet terminal, personal computer, etc. for viewing videos provided by high-speed Internet OTT (Over The Top) services. Here, the data matching device 1 A The viewing history of user X who owns A and the data matching device 1 B The viewing history of user Y who owns B It is assumed that the value is stored in

[0020] For example, database 2 A As shown in Figure 2, the data set U X Let us consider M elements e (e1: drama A1, e2: movie B1, ..., e M :Drama J3) is assumed to include each history. Also, database 2 B In the dataset U Y Let us consider N elements e (e1: Sports E21, e2: Variety C3, ..., e M : It is assumed that each history of the movie K2) is included. In this case, the data matching device 1 A ,1 B Each of them keeps the elements of their own data sets secret, and extracts the common elements “Movie B1” and “Variety C2” into the common set U CX =U CY Extract as.

[0021] <Configuration of data matching device> Next, the configuration of the data matching device 1 according to the embodiment of the present invention will be described with reference to FIG. A ,1 B Each of the above has the same configuration, but the operation of each means differs depending on whether it functions as the side requesting data matching (hereinafter referred to as the matching requesting side) or the side that is requested to perform data matching (hereinafter referred to as the matching requested side). These differences will be explained appropriately in the following explanations of each means. Here, the data matching device 1 A The matching request side, data matching device 1 B Let be the matching requestee. The data matching device 1 includes a matching request means 10, an element selection means 20, a secret information generation means 30, a matching determination means 40, and a communication means 50.

[0022] The matching request means 10 controls the start of the data matching operation in response to a matching request. Data matching device 1 A The matching request means 10 (of the matching requesting side) receives a matching request from the outside, and transmits a data matching request instruction (matching request) to the other party's data matching device 1 via the communication means 50. B Then, the matching request means 10 transfers the operation to the element selection means 20.

[0023] On the other hand, data matching device 1 B The matching request means 10 (on the matching request receiving side) transfers operation to the element selection means 20 when instructed to make a matching request via the communication means 50. In addition, the data matching device 1 A ,1 B The matching request means 10 starts the matching process and then stores the intersection set U CX ,U CY Set to the empty set.

[0024] Also, here, when the matching request means 10 sends a matching request to the other party via the communication means 50, or when it receives a matching request from the other party via the communication means 50, the two parties notify each other of the number of elements of the data set stored in the database 2.

[0025] The element selection means 20 sequentially selects elements of a data set stored in the database 2. The element selection means 20 outputs the selected elements to the secret information generation means 30 sequentially. In addition, the data matching device 1 A The element selection means 20 (on the matching request side) selects the next element each time the matching determination means 40 completes matching of elements, and ends its operation when all elements of its own data set have been selected. On the other hand, data matching device 1 B The element selection means 20 (of the matching request recipient side) selects the next element each time the matching determination means 40 completes element matching, and repeats the operation of selecting all elements of its own data set for the number of elements in the other party's data set.

[0026] The secret information generating means 30 generates secret information from the elements selected by the element selecting means 20 . The secret information generation means 30 includes a secret sharing data generation means 31 , a random number generation means 32 , and a hash value calculation means 33 .

[0027] The secret sharing data generation means 31 secretly shares the element values ​​for each element selected by the element selection means 20 so that the sum becomes the element value, thereby generating first secret sharing data and second secret sharing data. When the value of the selected element is a, the secret shared data generation means 31 generates first secret shared data a1 and second secret shared data a2 from a, where the secret shared data a1 and a2 satisfy a=a1+a2. Note that any method for sharing a may be used as long as a=a1+a2 is satisfied. For example, the secret shared data generation means 31 generates first secret shared data a1 having the same data length as the element a as a random number (pseudo-random number), and generates second secret shared data a2 by subtracting the first secret shared data a1 from a (a-a1).

[0028] The random number generating means 32 generates random numbers (pseudo-random numbers). Note that a general method for generating random numbers may be used, and therefore a description thereof will be omitted. Here, the random number generation means 32 generates two random numbers (first random numbers q A , the second random number q A '). The random number generation means 32 outputs the two generated random numbers to the hash value calculation means 33.

[0029] The hash value calculation means 33 hashes the value of the element selected by the element selection means 20 using a hash function, and calculates a hash value by multiplying the hash value by the first random number and dividing the hash value by the second random number. Specifically, the hash value calculation means 33 calculates the value of the element as a, the two random numbers as the first random number q, and A , the second random number q A ', the element value a is hashed by the hash function, and the first random number q A Multiplication by the second random number q A ' and obtain the hash value r a Calculate.

[0030]

number

[0031] Here, Hash indicates a hash function. The algorithm of the hash function may be a general algorithm such as SHA (Secure Hash Algorithm) 256. The secret information generation means 30 generates the secret information (secret shared data a1, a2) generated by the secret shared data generation means 31 and the random number q generated by the random number generation means 32. A ,q A ' and the hash value r generated by the hash value calculation means 33 a and output to the matching determination means 40. Similarly, in the data matching device 1 of the other party, the secret information generation means 30 generates secret information (secret shared data b1, b2 = b - b1 when the value of the element is b) and a random number q B ,q B ′ and the hash value r b =Hash(b)×q B / q B ') will be generated.

[0032] The matching determination means 40 determines whether or not elements match based on the secret information for each element generated by the secret information generation means 30 and the secret information for each element generated by the matching partner data matching device 1. Here, the matching determination means 40 includes an intermediate data generation means 41, a determination data generation means 42, and a common element extraction means 43.

[0033] The intermediate data generating means 41 generates intermediate data for generating determination data for determining whether or not its own element and the other party's element are the same. The intermediate data generating means 41 generates the intermediate data from the data matching device 1 of the other party for the element to be matched. B The intermediate data is generated from a part of the secret information generated by the user and a part of the user's own secret information. Specifically, the intermediate data generation means 41 receives the first secret shared data a1 and the second random number q, which are part of the secret information of its own element, via the communication means 50. A ' to the data matching device 1 of the other party, and the first secret shared data b1 and the second random number q, which are part of the secret information of the other party's element, are transmitted from the data matching device 1 of the other party. B ' is received. Then, the intermediate data generation means 41 generates the second secret shared data a2 and the first random number q A and the hash value r a and the received first secret sharing data b1 and second random number q B ', the intermediate data C A1 Generate.

[0034]

number

[0035] In addition, the other party's data matching device 1 B Similarly, the intermediate data generating means 41 generates the intermediate data C B1 is generated.

[0036]

number

[0037] The intermediate data generating means 41 generates the intermediate data C A1 is output to the judgment data generating means 42.

[0038] The determination data generating means 42 generates determination data for determining whether or not the element of the own device is the same as the element of the other device. The judgment data generating means 42 generates intermediate data from the other party's intermediate data for the element to be matched and random numbers (first random number, second random number) that are part of its own secret information. Specifically, the judgment data generating means 42 receives the intermediate data C via the communication means 50. A1 The other party's data matching device 1 B and the data matching device 1 of the other party. B From intermediate data C B1 Receive. Then, the determination data generating means 42 calculates the received intermediate data C as shown in the following formula (4): B1 For the first random number q A, multiplied by the second random number q A By dividing by ', the judgment data C A2 Generate.

[0039]

number

[0040] In addition, the other party's data matching device 1 B Similarly, the judgment data generating means 42 generates the judgment data C B2 is generated.

[0041]

number

[0042] The judgment data generating means 42 generates the judgment data C A2 is output to the common element extraction means 43.

[0043] The common element extraction means 43 extracts, as a common element, an element whose judgment data generated by its own judgment data generation means 42 matches the judgment data generated by the other data matching device 1 for the element to be matched. Specifically, the common element extraction means 43 receives the judgment data C via the communication means 50. A2 The counterparty's data matching device 1 B and the data matching device 1 of the other party. B Judgment data C B2 Receive. Then, the common element extraction means 43 extracts the judgment data C A2 and judgment data C B2 It is determined whether or not the elements match, and the elements that match are extracted as common elements and added to the intersection set. The proof that the elements are common when the determination data matches will be described later. The matching determination means 40 transfers the operation to the element selection means 20 when it has completed the matching determination of the elements.

[0044] As a result, as shown in FIG. 4, the data matching device 1 A The matching determination means 40 is X and a data matching device 1 B Data set U Y All N elements e1~e N The process of performing N matching checks between the dataset U and X By repeating this process M times, which is the number of elements in the table, all combinations are checked for matching.

[0045] The communication means 50 transmits and receives data via a communication line such as an IP network, etc. The communication means 50 can be configured with a general communication control device. As described above, the data matching device 1 can share common data (elements) while keeping the elements of a data set secret. Furthermore, the data matching device 1 can realize a PSI protocol that has malicious security even between two parties by secretly sharing the element values. The data matching device 1 can be operated by a program (data matching program) that causes a computer to function as each of the above-mentioned means.

[0046] (Proof of common element determination using judgment data) Next, the common element extraction means 43 of the matching determination means 40 extracts the determination data C A2 and judgment data C B2 We prove that the common elements can be determined by matching the Judgment Data C A2 is C in the formula (4). B1 By substituting the above formula (3) into this, it can be transformed into the following formula (6).

[0047]

number

[0048] In addition, judgment data C B2 is C in the formula (5). A1 By substituting the above formula (2) into the above, it can be transformed into the following formula (7).

[0049]

number

[0050] Therefore, (C A2 -C B2 ) can be transformed into the following equation (8).

[0051]

number

[0052] As shown in equation (8), (C A2 -C B2 ) is "0" when a=b and Hash(a)=Hash(b). If a=b, then Hash(a)=Hash(b). That is, C A2 =C B2 In this case, a=b. As a result, the common element extraction means 43 of the matching determination means 40 extracts the determination data C A2 and judgment data C B2 If they match, each data matching device 1 A ,1 B It can be determined that the elements a and b selected in are common elements.

[0053] <Operation of the data matching device> Next, the operation of the data matching device 1 according to the embodiment of the present invention will be described with reference to FIGS. 5 to 7 (and as appropriate, with reference to FIG. 3 for the configuration). Here, the data matching device 1 A ,1 B Then, data matching is performed, and the data matching device 1 Ais the party requesting data matching. A ,1 B The description of the process that performs the same operation as in step 1 will be omitted as appropriate.

[0054] First, the overall operation of the data matching device 1 will be described with reference to FIG. In step S10, the data matching device 1 A When a matching request is externally instructed, the matching request means 10 transmits a data matching request instruction (matching request) to the data matching device 1 via the communication means 50. B Send to. In step S11, the data matching device 1 B The matching request means 10 receives the matching request transmitted in step S10 via the communication means 50. At this time, although not shown as a step, the matching request means 10 notifies each other of the number of elements in the data sets stored in the database 2. Hereafter, data matching device 1 A The processing from step S12 to S15 and the data matching device 1 B The processing from step S12B to step S15B is the same as the processing from step S12B to step S15B except for the data set to be matched. A Only the operation of

[0055] In step S12, the matching request means 10 sets the intersection set to an empty set. In step S13, the matching request means 10 checks the database 2,2 A The dataset U stored in X and select the first element. In step S14, the secret information generating means 30 generates the secret information based on the element selected in step S13 or the element selected in step S18 (data matching device 1) to be described later. B Then, secret information is generated from the elements selected in step S21).

[0056] Here, the operation of generating the secret information in step S14 will be described in more detail with reference to FIG. A Then, element a is selected, and data matching device 1 B shows an example where element b is selected. In step S140, the secret shared data generation means 31 distributes the selected element a into two pieces of data (first secret shared data a1 and second secret shared data a2). In step S141, the random number generation means 32 generates two random numbers (first random number q A , the second random number q A '). In step S142, the hash value calculation means 33 calculates the hash value of the selected element a and the first random number q generated in step S141. A , the second random number q A ', and the hash value r is calculated by the above formula (1). a Calculate.

[0057] Through the above operations, the secret information generation means 30 generates the secret shared data a1 and a2 and the random number q as secret information. A ,q A ′ and the hash value r a and generate. In addition, the data matching device 1 B The operation of step S14B is the same as that of step S14A except that element a is replaced by element b.

[0058] Returning to FIG. 5, the overall operation of the data matching device 1 will be explained further. In step S15, the matching determination means 40 uses the secret information generated in step S14 to determine whether the matching target data matching device 1 B Determine whether the element matches between

[0059] Now, with reference to FIG. 7, the operation of the matching determination in step S15 will be described in further detail. In step S150, the intermediate data generation means 41 generates the first secret shared data a1 and the second random number q, which are part of the secret information generated in step S14. A ' and the data matching device 1 B Send to. In step S151, the intermediate data generating means 41 executes the data matching process using the data matching device 1. B From the first secret sharing data b1 and the second random number q, which are part of the other party's secret information, B ' is received.

[0060] In step S152, the intermediate data generation means 41 generates the second secret shared data a2, which is a part of the secret information generated in step S14, and the first random number q A and the hash value r a The first secret shared data b1 and the second random number q received in step S151 are B ', and the intermediate data C A1 Generate. Data matching device 1 B In the same manner as in steps S150 to S152, in steps S150B to S152B, the first secret shared data and the second random number are transmitted and received, and intermediate data C B1 Generate.

[0061] In step S153, the determination data generating means 42 generates the intermediate data C A1 The data matching device 1 B Send to. In step S154, the determination data generating means 42 performs the data matching process on the data matching device 1. B From the other party's intermediate data C B1 Receive. In step S155, the determination data generating means 42 generates the intermediate data C received in step S154. B1 As shown in the above formula (4), the first random number q A Multiply by the second random number q A By dividing by ′, the judgment data C A2 Generate. Data matching device 1B In the same manner as in steps S153 to S155, in steps S153B to S155B, intermediate data is transmitted and received, and the determination data C B2 Generate.

[0062] In step S156, the common element extraction means 43 extracts the judgment data C generated in step S155. A2 The data matching device 1 B Send to. In step S157, the common element extraction means 43 extracts the common element from the data matching device 1. B From the other party's judgment data C B2 Receive. In step S158, the common element extraction means 43 extracts the judgment data C generated in step S155. A2 and the determination data C received in step S157. B2 It is determined whether or not the above matches.

[0063] Here, the judgment data C A2 and judgment data C B2 If they match (Yes in step S158), in step S159, the common element extraction means 43 adds the currently selected element a to the common set, and ends the matching determination in step S15. On the other hand, judgment data C A2 and judgment data C B2 If they do not match (No in step S158), the common element extraction means 43 ends the matching determination in step S15. Data matching device 1 B In the same manner as in steps S156 to S159, in steps S156B to S159B, the judgment data is transmitted and received, and the judgment data C A2 and judgment data C B2 If and match, add the currently selected element b to the intersection.

[0064] Returning to FIG. 5, the overall operation of the data matching device 1 will be explained further. In step S16, the matching determination means 40 determines whether or not all elements of the matching partner have been determined for the selected element. In other words, the matching determination means 40 determines whether or not determination has been performed for the number of elements of the matching partner. Here, if all the elements of the matching partner have not yet been determined (No in step S16), the data matching device 1 A Then, the process returns to step S15 to repeat the matching determination.

[0065] On the other hand, if all of the elements of the matching partner have been determined (Yes in step S16), it is determined in step S17 whether or not all of the elements of the own data set have been selected. Here, if all elements of its own data set have not yet been selected (No in step S17), the data matching device 1 A If so, the operation proceeds to step S18. On the other hand, if all elements of its own data set have been selected (Yes in step S17), the data matching device 1 A If so, the operation proceeds to step S19. In step S18, the element selection means 20 selects the next element from its data set and returns the operation to step S14. In step S19, the matching determination means 40 outputs the elements included in the common set as the matching result to a display device or the like.

[0066] Data matching device 1 B In step S20, it is determined whether or not all elements of its own data set have been selected. Here, if all elements of its own data set have not yet been selected (No in step S20), the data matching device 1 B If so, the operation proceeds to step S21.

[0067] On the other hand, if all elements of its own data set have been selected (Yes in step S20), the data matching device 1 B If so, the operation proceeds to step S22. In step S21, the element selection means 20 selects the next element from its own data set and returns the operation to step S14B. In step S22, the matching determination means 40 determines whether or not all elements of the matching partner have been determined, that is, the matching determination means 40 determines whether or not determination has been performed for the number of elements of the matching partner.

[0068] Here, if all the elements of the matching partner have not yet been determined (No in step S22), the data matching device 1 B Then, the process returns to step S13B and the matching determination is repeated. On the other hand, if all of the elements of the matching partner have been determined (Yes in step S22), in step S23 the matching determination means 40 outputs the elements included in the common set as the matching result to a display device or the like. By the above operation, the data matching device 1 can share common data (elements) while keeping the elements of the data set secret.

[0069] Although the configuration and operation of the data matching device 1 according to the embodiment of the present invention have been described above, the present invention is not limited to this embodiment. For example, in this example, the data matching device 1 is configured to include a secret information generation means 30 (secret shared data generation means 31, random number generation means 32, and hash value calculation means 33) inside the device. However, the secret information generation means 30 may be stored outside the device 1, for example, in a database 2, and may sequentially acquire secret information.

[0070] Also, here, the intermediate data generation means 41 subtracts the first secret shared data b1 from the second secret shared data a2 as in the above equation (2), but it may also subtract the second secret shared data a2 from the first secret shared data b1. In this case, the corresponding equation (3) subtracts the second secret shared data b2 from the first secret shared data a1.

[0071] In addition, here, the intermediate data generating means 41 calculates q A ×q B ′×(a2-b1) and r a The difference between the intermediate data C A1 was generated as. However, the intermediate data generating means 41 A ×q B ′×(a2-b1) and r a The sum of the intermediate data C A1 It may be generated as: In that case, the corresponding equation (3) also becomes q A ′×q B ×(b2-a1) and r b The sum of the intermediate data C B1 It can be generated as follows. [Explanation of symbols]

[0072] 100 Data Matching System 1. Data matching device 10 Matching request method 20 Element Selection Methods 30 Secret information generation means 31 Secret sharing data generation method 32 Random number generation method 33 Hash value calculation method 40 Matching Determination Method 41 Intermediate data generation means 42 Judgment data generation means 43 Common element extraction means 50 Means of communication 2 Database

Claims

1. A data matching device that matches common elements of data sets between two parties, comprising: secret sharing data generation means for secretly sharing the values ​​of the elements included in the data set so that the sum of the values ​​of the elements becomes the value of the elements, thereby generating first secret sharing data and second secret sharing data; a random number generating means for generating a first random number and a second random number; a hash value calculation means for hashing the value of the element using a hash function, and calculating a hash value by multiplying the value by the first random number and dividing the value by the second random number; an intermediate data generating means for transmitting and receiving the first secret shared data and the second random number to and from another data matching device to be matched, and for generating intermediate data by multiplying the product of the first random number and the second random number generated by the other data matching device by the difference between the second secret shared data and the first secret shared data generated by the other data matching device, and the difference between the hash value; a determination data generating means for transmitting and receiving the intermediate data to and from the other data matching device, and generating determination data by multiplying the intermediate data generated by the other data matching device by the first random number and dividing the intermediate data by the second random number; common element extraction means for transmitting and receiving the judgment data to and from the other data matching device, and extracting, as common elements, elements whose judgment data generated by the other data matching device matches its own judgment data; A data matching device comprising:

2. 2. The data matching device according to claim 1, wherein the intermediate data generating means calculates the sum of the multiplied value and the hash value instead of calculating the difference between the multiplied value and the hash value.

3. 3. The data matching device according to claim 1, wherein all elements of the data set have the same data length.

4. A data matching program for causing a computer to function as the data matching device according to any one of claims 1 to 3.

Images