Information processing method, information processing program, and information processing system

Abstract

The use of data held by each organization without disclosing the contents to others. [Solution] A method for use in a system including a plurality of user terminals each having a control unit and a memory unit for storing sensitive data including a plurality of records, a data processing device having a calculation unit in a secure area, a key management device for managing a system key, and a memory device for storing a machine learning model encrypted using the system key, the method comprising: aggregating data held by the plurality of user terminals in the secure area to create combined data; training a machine learning model using the combined data to create a model with higher predictive accuracy than when training is performed using only the user's own data; and, by using the machine learning model in the secure area to perform inference based on the combined data, predictions can be made with higher accuracy than when training is performed using only the user's own data.

Description

[Technical Field]

[0001] The present disclosure relates to an information processing method, an information processing program, and an information processing system. [Background technology]

[0002] Materials Informatics (MI) is a technology that utilizes machine learning to improve the efficiency of materials development. In MI, it is necessary to find the appropriate combination of numerous parameters related to raw material composition and process conditions in order to manufacture materials with desired physical properties.

[0003] For example, Patent Document 1 describes a technology that uses learning data including composition data and characteristic data of a photosensitive resin composition to output recommended composition data for a photosensitive resin composition that exhibits the target characteristics of the photosensitive resin composition from target characteristic data that indicates the characteristics of the target photosensitive resin composition. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2021-004933 Summary of the Invention [Problem to be solved by the invention]

[0005] In recent years, there has been a growing trend in various fields to collaborate with external companies and organizations to utilize data held within a company (including information related to machine learning models).However, sharing highly confidential data with others poses security issues, such as information leaks and unauthorized use.

[0006] Therefore, the present disclosure has been made to solve the above problem, and its purpose is to provide an information processing method that allows each organization to utilize the contents of data it holds without disclosing the contents to others. [Means for solving the problem]

[0007] In order to achieve the above object, an information processing method according to the present disclosure is a method used in a system including a plurality of user terminals each having a control unit and a storage unit that stores sensitive data including a plurality of records, a data processing device having a calculation unit in a secure area, a key management device that manages a system key, and a storage device that stores a machine learning model encrypted using the system key, wherein each of the plurality of user terminals and the data processing device have a different common encryption key, and the method includes a step in which a control unit in each of the plurality of user terminals encrypts the sensitive data using the common encryption key of the user terminal, a step in which the calculation unit of the data processing device acquires the encrypted machine learning model from the storage device, a step in which the calculation unit of the data processing device acquires the encrypted machine learning model from the storage device, and a step in which the common encryption key of the data processing device is decrypted using the system key acquired from the key management device. the individual result data using a common encryption key shared with the user terminal that stores the sensitive data corresponding to the individual result data; transmitting the encrypted individual result data to a storage device; the control unit of the user terminal acquiring, from the storage device, the encrypted individual result data corresponding to the sensitive data stored in the user terminal; and the decrypting the encrypted individual result data using the common encryption key shared with the user terminal.

[0008] Furthermore, in order to achieve the above object, an information processing method according to the present disclosure is a method used in a system including a plurality of user terminals, each having a control unit and a storage unit that stores sensitive data including a user private key, a user public key, and a plurality of records; a data processing device having a calculation unit within a secure area; a key management device that manages a system key; and a storage device that stores a machine learning model encrypted using the system key and each of the user public keys of the plurality of user terminals, the method including the steps of: the calculation unit of the data processing device generating a secure private key and a secure public key; transmitting the secure public key and the secure private key encrypted using the system key obtained from the key management device to the storage device; the control unit in each of the plurality of user terminals acquiring the secure public key from the storage device; generating a common encryption key for the user terminals by Diffie-Hellman key agreement using the user private key and the secure public key; encrypting the sensitive data using the common encryption key for the user terminals; a step of acquiring a system key, a step of acquiring an encrypted secure private key and user public keys of a plurality of user terminals, and encrypted sensitive data from the storage device, a step of decrypting the encrypted secure private key using the system key, a step of generating a common encryption key between each of the plurality of user terminals and the data processing device by Diffie-Hellman key sharing using the user public keys of the plurality of user terminals and the decrypted secure private key, a step of decrypting the sensitive data encrypted by each of the user terminals, acquired from the storage device, using the common encryption key of the data processing device, a step of decrypting the encrypted machine learning model acquired from the storage device using the system key, a step of combining records included in each of the decrypted sensitive data to create combined data, a step of inputting the combined data to the machine learning model and outputting result data, a step of uncombining the records included in the result data to create individual result data, and a step of encrypting individual result data corresponding to the sensitive data using the common encryption key with the user terminal that stores the sensitive data corresponding to the individual result data.The method includes a step of transmitting the encrypted individual result data to a storage device, a step of a control unit of the user terminal acquiring the encrypted individual result data corresponding to the sensitive data stored in the user terminal from the storage device, and a step of decrypting the encrypted individual result data using a common encryption key of the user terminal.

[0009] In order to achieve the above object, an information processing program according to the present disclosure is a program used in a system including a plurality of user terminals each having a control unit and a storage unit that stores sensitive data including a plurality of records, a data processing device having a calculation unit in a secure area, a key management device that manages a system key, and a storage device that stores a machine learning model encrypted using the system key, wherein each of the plurality of user terminals and the data processing device have a different common encryption key, and the program includes a step in which the control unit in each of the plurality of user terminals encrypts the sensitive data using the common encryption key of the user terminal, a step in which the calculation unit of the data processing device acquires the encrypted machine learning model from the storage device, and a step in which the data processing device decrypts the machine learning model using the system key acquired from the key management device. the step of decrypting the sensitive data encrypted by each of the user terminals using a common encryption key of the user terminal; the step of combining records included in each of the decrypted sensitive data to create combined data; the step of inputting the combined data into a machine learning model and outputting result data; the step of uncombining the records included in the result data to create individual result data; the step of encrypting the individual result data using a common encryption key with the user terminal that stores the sensitive data corresponding to the individual result data; the step of transmitting the encrypted individual result data to the storage device; the step of a control unit of the user terminal acquiring, from the storage device, the encrypted individual result data corresponding to the sensitive data stored in the user terminal; and the step of decrypting the encrypted individual result data using the common encryption key of the user terminal.

[0010] Furthermore, in order to achieve the above object, an information processing program according to the present disclosure is a program used in a system including a plurality of user terminals, each having a control unit and a storage unit that stores a user private key, a user public key, and sensitive data including a plurality of records; a data processing device having a calculation unit within a secure area; a key management device that manages a system key; and a storage device that stores a machine learning model encrypted using the system key and each of the user public keys of the plurality of user terminals, the program including: a step in which the calculation unit of the data processing device generates a secure private key and a secure public key; a step in which the calculation unit of the data processing device transmits the secure public key and the secure private key encrypted using the system key obtained from the key management device to the storage device; a step in which the control unit of each of the plurality of user terminals obtains the secure public key from the storage device; a step in which the control unit of each of the plurality of user terminals generates a common encryption key for the user terminals by Diffie-Hellman key agreement using the user private key and the secure public key; a step in which the control unit of each of the plurality of user terminals encrypts the sensitive data using the common encryption key for the user terminals; a step of a computing unit of the data processing device acquiring a system key from a key management device, a step of acquiring an encrypted secure private key and user public keys of a plurality of user terminals, and encrypted sensitive data from a storage device, a step of decrypting the encrypted secure private key using the system key, a step of generating a common encryption key between each of the plurality of user terminals and the data processing device by Diffie-Hellman key sharing using the user public keys of the plurality of user terminals and the decrypted secure private key, a step of decrypting the sensitive data encrypted by each of the user terminals acquired from the storage device using the common encryption key of the data processing device, a step of decrypting the encrypted machine learning model acquired from the storage device using the system key, a step of combining records included in each of the decrypted sensitive data to create combined data, a step of inputting the combined data to the machine learning model and outputting result data, a step of uncombining the records included in the result data to create individual result data, and a step of decrypting the sensitive data corresponding to the individual result data using a common encryption key with the user terminal that stores the sensitive data.The method includes the steps of encrypting individual result data corresponding to the sensitive data, transmitting the encrypted individual result data to a storage device, acquiring the encrypted individual result data corresponding to the sensitive data stored in the user terminal from the storage device by a control unit of the user terminal, and decrypting the encrypted individual result data using a common encryption key of the user terminal.

[0011] In addition, to achieve the above object, an information processing system according to the present disclosure is a system including a plurality of user terminals each having a control unit and a storage unit that stores sensitive data including a plurality of records, a data processing device having a calculation unit in a secure area, a key management device that manages a system key, and a storage device that stores a machine learning model encrypted using the system key, wherein each of the plurality of user terminals and the data processing device have a different common encryption key, and the control unit in each of the plurality of user terminals encrypts the sensitive data using the common encryption key of the user terminal, and the calculation unit of the data processing device obtains the encrypted machine learning model from the storage device and decrypts the machine learning model using the system key obtained from the key management device. the data processing device, decrypts the sensitive data encrypted by each of the user terminals using a common encryption key of the data processing device, combines the records included in each of the decrypted sensitive data to create combined data, inputs the combined data to a machine learning model to output result data, uncombines the records included in the result data to create individual result data, encrypts the individual result data using a common encryption key with the user terminal that stores the sensitive data corresponding to the individual result data, transmits the encrypted individual result data to the storage device, and a control unit of the user terminal obtains the encrypted individual result data corresponding to the sensitive data stored in the user terminal from the storage device and decrypts the encrypted individual result data using the common encryption key of the user terminal.

[0012] In order to achieve the above object, an information processing system according to the present disclosure is a system including: a plurality of user terminals, each having a control unit and a storage unit that stores a user private key, a user public key, and sensitive data including a plurality of records; a data processing device having a calculation unit within a secure area; a key management device that manages a system key; and a storage device that stores a machine learning model encrypted using the system key and each of the user public keys of the plurality of user terminals, wherein the calculation unit of the data processing device generates a secure private key and a secure public key, and transmits the secure public key and the secure private key encrypted using the system key obtained from the key management device to the storage device; a control unit in each of the plurality of user terminals obtains the secure public key from the storage device, generates a common encryption key for the user terminals by Diffie-Hellman key agreement using the user private key and the secure public key, encrypts the sensitive data using the common encryption key for the user terminals, and transmits the encrypted sensitive data to the storage device; and the calculation unit of the data processing device obtains the system key from the key management device and transmits the encrypted secure private key and the user public key of the plurality of user terminals from the storage device. the system key, and a control unit of the user terminal acquires the encrypted individual result data corresponding to the sensitive data stored in the user terminal, and transmits the encrypted individual result data to the storage device; and a control unit of the user terminal acquires the encrypted individual result data corresponding to the sensitive data stored in the user terminal, and transmits the encrypted individual result data to the storage device.An information processing system that decrypts the encrypted individual result data. [Effects of the Invention]

[0013] According to the present disclosure, data held by each organization can be utilized without disclosing the contents to others. [Brief explanation of the drawings]

[0014] [Figure 1] 1 is an overall view of an information processing system 1. FIG. [Figure 2] FIG. 1 is a diagram illustrating a hardware configuration of a computer 1000. [Figure 3] 1 is a block diagram showing a functional configuration of a data processing device 100. FIG. [Figure 4] FIG. 2 is a block diagram showing the functional configuration of a key management device 200. [Figure 5] FIG. 2 is a block diagram showing the functional configuration of a storage device 300. [Figure 6] FIG. 2 is a block diagram showing the functional configuration of a terminal device 400. [Figure 7] FIG. 2 is a diagram showing a data structure of material data. [Figure 8] FIG. 10 is a diagram showing a specific example of material data. [Figure 9] FIG. 10 is a diagram showing an example of combined data. [Figure 10] FIG. 1 is a sequence diagram showing key agreement using the Diffie-Hellman key agreement method. [Figure 11] 3 is a flowchart showing a calculation process in the information processing system 1. [Figure 12] 3 is a flowchart showing a calculation process in the information processing system 1. [Figure 13] FIG. 2 is an overall view of an information processing system 2. [Figure 14] FIG. 2 is a block diagram showing the functional configuration of a data processing device 500. [Figure 15] FIG. 1 is a sequence diagram showing key agreement using the Diffie-Hellman key agreement method. DETAILED DESCRIPTION OF THE INVENTION

[0015] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In all drawings describing the embodiments, common components are designated by the same reference numerals, and repeated explanations will be omitted. Note that the following embodiments do not unduly limit the content of the present disclosure described in the claims. Furthermore, not all of the components shown in the embodiments are necessarily essential components of the present disclosure.

[0016] <Summary of the Invention> Traditionally, in materials informatics, each company has generated and used machine learning models based on materials data collected in-house. However, the types of features available from a company's own materials data alone are limited, and the predictive accuracy for unknown materials or design conditions is sometimes insufficient.

[0017] In recent years, there has been a growing trend for companies to collaborate with other companies and utilize the data they hold. In materials informatics, combining materials data held by other companies and other organizations will enable a wider variety of features to be used in machine learning models, which is expected to lead to improved prediction accuracy. However, materials data is highly confidential information that contains each company's research results and know-how, so strict security measures are required.

[0018] Therefore, in the present invention, data held by multiple companies is aggregated in a secure area isolated at the hardware level, and combined data is created that complements features that cannot be obtained by each company alone. Then, by training a machine learning model using the combined data that includes features other than those held by each company, it is possible to create a model with higher predictive accuracy than when training using only the company's own data. Furthermore, by using the machine learning model in the secure area to perform inference based on the combined data, it is possible to achieve predictions with higher accuracy than when training using only the company's own data. In the present invention, because learning and inference are performed in the secure area, the data and machine learning models used in learning and inference are not leaked to the outside, and highly confidential data can be utilized at a high security level.

[0019] <Embodiment 1> In this embodiment, inference is performed using a machine learning model using combined data created by aggregating data held by multiple companies.

[0020] (Configuration of Information Processing System 1) Fig. 1 is an overall view of an information processing system 1. The configuration of the information processing system 1 according to this embodiment will be described with reference to Fig. 1.

[0021] The information processing system 1 is a platform that allows each organization participating in the system to use data held by that organization without disclosing the details of that data to other organizations. Note that the term "organization" is not limited to a company or an organization, but may also refer to a group of departments, sections, groups, teams, or other groups separated by roles.

[0022] The information processing system 1 includes a cloud system 10 and a plurality of terminal devices 400. In this embodiment, two terminal devices, terminal device 400-1 and terminal device 400-2, are described as an example, but three or more terminal devices may be used. Furthermore, unless otherwise specified, they will be referred to as "terminal device 400." Terminal device 400-1 and terminal device 400-2 are used by users from different organizations, for example, with limited information sharing. The cloud system 10 and terminal devices 400 are communicatively connected via a network NW. The network NW may be the Internet or a communication network including a predetermined wide area network (WAN).

[0023] The cloud system 10 includes a data processing device 100, a key management device 200, and a storage device 300. The cloud system 10 is a system that utilizes so-called cloud computing, and is configured by a plurality of server devices connected via communication lines such as the Internet, and allows users to use resources on the network without being aware of specific hardware resources.

[0024] The data processing device 100 is a device that performs arithmetic processing, including learning and inference using a predetermined machine learning model. The data processing device 100 has a processing unit in a secure area. The secure area is a protected area in which confidentiality is maintained at the hardware level, and the contents of data and programs stored therein cannot be accessed from outside. The secure area is, for example, a type of secure hardware, such as a TEE (Trusted Execution Environment), which is a security mechanism for a processor.

[0025] The key management device 200 is a device (KMS: Key Management System) that centrally manages various encryption keys used in the cloud system 10. The key management device 200 manages, as system keys, a system private key S(S) and a system public key P(S), which are a key pair of a public key cryptosystem. The key management device 200 may be arranged within the data processing device 100 and configured to have a function of encrypting and decrypting data within the data processing device 100 using the system keys.

[0026] The storage device 300 is a storage device that stores data. The data processing device 100 and the key management device 200 can securely access the storage device 300 via the internal network of the cloud system 10. The terminal device 400 can also access the storage device 300 via the network NW. When the terminal device 400 accesses the storage device 300, it is preferable that the access authority is confirmed based on a predetermined authentication process and access control.

[0027] The storage device 300 may be realized by, for example, a hard disk drive (HDD), a solid state drive (SSD), or other large-capacity storage device. The storage device 300 may also be a distributed storage system, or may be realized by a virtual storage area provided in a cloud environment.

[0028] The terminal device 400 is an information processing terminal (corresponding to a "user terminal") operated by a user who uses the functions provided by the cloud system 10. The terminal device 400 can use the data storage and retrieval functions of the storage device 300, the arithmetic processing functions of the data processing device 100, etc. via the network NW.

[0029] The terminal device 400 encrypts sensitive data to be subjected to arithmetic processing in the data processing device 100 and transmits the data to the data processing device 100, including the secure area, via the storage device 300. The data processing device 100 decrypts the encrypted sensitive data in the secure area and performs predetermined arithmetic processing (e.g., record merging, inference using a machine learning model, etc.) on the decrypted sensitive data. The results of the arithmetic processing are encrypted in the secure area and then output to an outside of the secure area. Data input to the secure area and data output from the secure area are both transmitted and received in an encrypted state and are never handled in plaintext, reducing the risk of information leakage.

[0030] Furthermore, the TEE that realizes the secure area has a remote attestation function, and the terminal device 400 can verify, during arithmetic processing, that the execution environment of the TEE included in the data processing device 100 has a regular configuration. This technically guarantees that arithmetic processing is performed only in a trusted environment, thereby ensuring that there is no data tampering, no information leakage, and that processing is performed using a regular program, thereby ensuring overall reliability.

[0031] (Hardware configuration) The above-described data processing device 100, key management device 200, storage device 300, and terminal device 400 can all be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine in a cloud environment. The data processing device 100, key management device 200, storage device 300, and terminal device 400 are collectively referred to as "devices."

[0032] That is, the device can be realized by using hardware resources such as a CPU and memory built into a computer to execute a program corresponding to the processing performed by the device. The program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The program can also be provided via a network such as the Internet or email.

[0033] 2 is a diagram showing the hardware configuration of the computer 1000. The hardware configuration of the computer 1000 that realizes the data processing device 100 according to this embodiment will be described with reference to FIG.

[0034] The computer 1000 includes a processor 1010, a memory 1020, a storage 1030, a communication IF 1040, and an input / output IF 1050. Note that some of these components may be omitted. For example, if no display is required, the display of the input / output IF 1050 may not be included.

[0035] The processor 1010 is hardware for executing a set of instructions written in a program and controls the operation of the entire computer. The processor 1010 includes a TEE 1011. In the TEE 1011, a program is executed in an enclave, which is an isolated area within the processor, in a state that cannot be accessed from the outside, and data is stored in a state that is isolated from other processes and the operating system. The memory area used in the enclave is made up of volatile memory, and the contents of this memory are erased when processing ends.

[0036] The memory 1020 is for temporarily storing programs and data to be processed by the programs, etc. The memory 1020 is realized by a volatile memory such as a DRAM (Dynamic Random Access Memory). The programs stored in the memory 1020 are programs that execute the information processing method according to the present invention, etc.

[0037] The storage 1030 is a storage device for saving data, and is realized by, for example, a flash memory, a hard disk drive (HDD), a solid state drive (SSD), or the like.

[0038] The communication IF 1040 is a communication interface for transmitting and receiving signals so that the data processing device 100 can communicate with an external device. The communication IF 1040 may include a USB (Universal Serial Bus) connector or an Ethernet port for wired communication, or a wireless communication device (e.g., Wi-Fi (registered trademark), Bluetooth (registered trademark)) for wireless communication. Furthermore, the communication IF 1040 is preferably configured to perform secure communication using an encrypted communication protocol such as TLS (Transport Layer Security) when communicating with an external device.

[0039] The input / output IF 1050 is an interface between an input device for receiving input from a user and an output device for presenting information to the user. The input device is realized by, for example, a keyboard, a mouse, a touch panel, buttons, a microphone, etc. The output device is realized by, for example, a display, a printer, a speaker, etc.

[0040] The hardware configuration of the key management device 200, the storage device 300, and the terminal device 400 may be configured such that the TEE 1011 is omitted from the hardware configuration shown in Fig. 2. The operation of each component of these devices is realized by the processor 1010 in accordance with a program stored in the memory 1020, similar to the above-described data processing device 100. Furthermore, the key management device 200, the storage device 300, and the terminal device 400 may not include some of the components of the hardware configuration shown in Fig. 2.

[0041] (Functional configuration of data processing device 100) 3 is a block diagram showing the functional configuration of the data processing device 100. The functional configuration of the data processing device 100 according to this embodiment will be described with reference to FIG.

[0042] The data processing device 100 includes a communication unit 110, a storage unit 120, an input unit 130, an output unit 140, and a control unit 150.

[0043] The communication unit 110 performs processing for the data processing device 100 to communicate with other devices. The other devices may be PCs connected via a network, or terminals such as smartphones or tablets. The other devices may also be input / output devices, such as flash memory, HDDs, or SSDs, that input and output data.

[0044] Furthermore, the communication unit 110 transmits and receives data via a secure communication channel with the internal network of the cloud system 10, devices via the network NW, locally connected devices, etc. The construction of a secure communication channel and the communication method are well-known techniques using a common key (such as a session key) or a public key, and therefore a description thereof will be omitted.

[0045] The storage unit 120 is configured with, for example, volatile memory such as RAM, flash memory, HDD, SSD, etc., and stores data used by the data processing device 100 and computer programs used for various processes. The computer programs may be installed from a predetermined server or the like, or may be installed using a known setup program or the like from a computer-readable portable recording medium. Examples of the portable recording medium include a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), Blu-ray (registered trademark), a USB memory, an SD card, etc.

[0046] The input unit 130 is an interface that accepts user input. The input unit 130 is, for example, but not limited to, a keyboard, a touch panel, or a microphone that detects voice input. Note that if the data processing device 100 does not accept user input, it does not need to have the function of the input unit 130.

[0047] The output unit 140 is an interface that outputs information. The output unit 140 is, for example, a display or a speaker that outputs audio, but is not limited to these. Note that if the data processing device 100 does not output information to the user, it does not need to have the function of the output unit 140.

[0048] The control unit 150 is a processor such as a CPU (Central Processing Unit) that controls each function of the data processing device 100 and operates based on a program stored in the storage unit 120 in advance.

[0049] The control unit 150 has an arithmetic unit 151 in a secure area. The secure area is, for example, a TEE. The control unit 150 also has an execution area other than the TEE (REE; Rich Execution Environment, not shown in FIG. 3). The REE is an execution area isolated from the TEE, and realizes the basic functions of the processor.

[0050] The calculation unit 151 has a common encryption key shared with each of the multiple terminal devices 400. The common encryption keys are different from one another and are generated, for example, by Diffie-Hellman key exchange (DHE). A method for generating (sharing) keys using the Diffie-Hellman key exchange will be described later. As described above, the TEE is driven by volatile memory, and the common encryption key held by the calculation unit 151 is erased when a predetermined calculation process is completed.

[0051] The calculation unit 151 uses a predetermined common encryption key to decrypt encrypted data (sensitive data or machine learning model) acquired from the storage device 300. It also performs predetermined calculation processing on the decrypted sensitive data. It also encrypts the resulting data after the predetermined calculation processing using the predetermined common encryption key and transmits the encrypted data to the storage device 300.

[0052] Here, the predetermined arithmetic processing is a calculation on material data acquired as sensitive data, and includes, for example, forward analysis, in which material characteristics (explanatory variables) are input to estimate properties (objective variables), and inverse analysis, in which target properties are input to search for material characteristics that can realize those properties. In forward analysis, the explanatory variables included in the material data are input to a machine learning model, and the estimated objective variables are obtained as result data. On the other hand, inverse analysis, the target properties are used as an evaluation function of the machine learning model, and an optimization algorithm generates and evaluates candidate explanatory variables, and the candidate with the highest degree of compatibility is obtained as result data. The calculation unit 151 encrypts such result data and transmits it to the storage device 300.

[0053] (Functional Configuration of Key Management Device 200) 4 is a block diagram showing the functional configuration of the key management device 200. The functional configuration of the key management device 200 according to this embodiment will be described with reference to FIG.

[0054] The key management device 200 includes a communication unit 210, a storage unit 220, an input unit 230, an output unit 240, and a control unit 250. The communication unit 210, the input unit 230, and the output unit 240 have the same functions as the communication unit 110, the input unit 130, and the output unit 140 of the data processing device 100, and therefore their explanation will be omitted.

[0055] The storage unit 220 has the functions of the storage unit 120 of the data processing device 100, as well as the functions of the key storage unit 221.

[0056] The key storage unit 221 stores, as system keys, a system private key S(S) and a system public key P(S), which are a key pair of a public key cryptosystem. The system keys may be obtained from an external source or may be generated by the control unit 250, which will be described later.

[0057] The control unit 250 is a processor such as a CPU (Central Processing Unit) that controls each function of the key management device 200 and operates based on a program pre-stored in the storage unit 220. The control unit 250 may have a function of generating a key.

[0058] (Functional configuration of storage device 300) 5 is a block diagram showing the functional configuration of the storage device 300. The functional configuration of the storage device 300 according to this embodiment will be described with reference to FIG.

[0059] The storage device 300 includes a communication unit 310, a storage unit 320, an input unit 330, an output unit 340, and a control unit 350. The communication unit 310, the input unit 330, and the output unit 340 have the same functions as the communication unit 110, the input unit 130, and the output unit 140 of the data processing device 100, and therefore their explanations will be omitted.

[0060] The storage unit 320 is configured, for example, by storage resources built on a cloud storage service, and stores computer programs used for various processes. The storage resources may be physically configured, for example, by storage media such as volatile memory such as RAM, flash memory, HDD, SSD, etc., which may be distributed and arranged within a cloud data center.

[0061] The computer programs stored in storage unit 320 may be installed from a predetermined management server or update server, or may be installed from a previously prepared computer-readable portable recording medium using a known setup program, etc. The portable recording medium may include, for example, a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), Blu-ray (registered trademark), a USB memory, an SD card, etc.

[0062] The storage unit 320 also stores a machine learning model Enc(M) encrypted using a system key (system public key P(S)) managed by the key management device 200. The machine learning model is, for example, a model that predicts the physical, chemical, mechanical, and other properties of a material from the characteristics of the given material. For example, the explanatory variables, which are input data, may be experimental or calculated values ​​such as material composition, lattice constant, and process conditions, and the objective variables, which are output data, may be the density, hardness, electrical conductivity, thermal conductivity, and the like of the material.

[0063] The machine learning model stored in the memory unit 320 may be a learning model generated without sensitive data held by multiple organizations participating in the information processing system 1 (including sensitive data stored in the terminal device 400) contributing to the machine learning, or may be a model generated using sensitive data held by multiple organizations participating in the information processing system 1.

[0064] The storage unit 320 also stores data transmitted from other devices connected via the network, such as the data processing device 100, the key management device 200, and the terminal device 400.

[0065] The control unit 350 is a processor such as a CPU (Central Processing Unit) that controls each function of the storage device 300 and operates based on a program stored in the storage unit 320 in advance.

[0066] (Functional configuration of terminal device 400) 6 is a block diagram showing the functional configuration of the terminal device 400. The functional configuration of the terminal device 400 according to this embodiment will be described with reference to FIG.

[0067] The terminal device 400 includes a communication unit 410, a storage unit 420, an input unit 430, an output unit 440, and a control unit 450. The communication unit 410, the input unit 430, and the output unit 440 have the same functions as the communication unit 110, the input unit 130, and the output unit 140 of the data processing device 100, and therefore their explanations will be omitted. The storage unit 420 has the following functions in addition to the functions of the storage unit 120 of the data processing device 100.

[0068] The storage unit 420 includes a key storage unit 421 and a material database 422 .

[0069] The key storage unit 421 stores a user private key S(U) and a user public key P(U). The key storage unit 421 also stores a common encryption key obtained by key sharing with the data processing device 100. The common encryption key is, for example, a key generated by the Diffie-Hellman key sharing method. A method for generating (sharing) a key by the Diffie-Hellman key sharing method will be described later.

[0070] The material database 422 is a database that stores information about various materials, and stores sensitive data including multiple material data (records). The multiple material data are unknown material data that are the subject of arithmetic processing, but may also include known material data. The material data is also called a record as an individual recording unit, and the record includes information indicating the characteristics of the material and information about its properties (e.g., information about chemical properties, physical properties, manufacturing conditions, measurement results, etc.). Each record may include sensitive information such as the development history and evaluation results of the material, and is sensitive data that requires high confidentiality. The data structure of the material data will be explained in FIG. 7.

[0071] The control unit 450 is a processor such as a CPU (Central Processing Unit) that controls each function of the terminal device 400 and operates based on a program stored in advance in the storage unit 420. The control unit 450 encrypts sensitive data using a common encryption key stored in the key storage unit 421, and transmits the encrypted sensitive data to the storage device 300 via the communication unit 410. The control unit 450 also obtains data encrypted by the data processing device 100 using the common encryption key from the storage device 300 via the communication unit 410, and decrypts the data using the common encryption key stored in the key storage unit 421.

[0072] 7 is a diagram showing the data structure of material data, and an example of the data structure of material data will be described with reference to FIG.

[0073] The material data 710 includes a material ID 711, information 712 indicating the characteristics of the material, and information 713 indicating the properties of the material.

[0074] The material ID 711 is an identifier for identifying each of a plurality of material data (records).

[0075] Information 712 indicating the characteristics of the material is, for example, the substances that make up the material and is expressed as explanatory variables x11-x1m (m is an integer equal to or greater than 1). For each piece of material data, numerical values ​​such as experimental values ​​and calculated values ​​are input as information indicating the characteristics of the material. Note that the explanatory variables are not limited to information indicating the characteristics of the material, and may also include information indicating the process conditions (temperature, pressure, time, etc.) in the reaction process or production process of the material.

[0076] Information 713 indicating the characteristics of the material is, for example, the physical, chemical, mechanical, and electrical characteristics of the material, such as the density, hardness, conductivity, and strength of the material, and is expressed as objective variables y11-y1n (n is an integer greater than or equal to 1).

[0077] 8 is a diagram showing a specific example of material data, and a specific example of material data stored in the material database 422 will be described with reference to FIG.

[0078] The material data 810 is sensitive data including multiple records stored in the material database 422. The material data 810 has a material ID, material characteristics (explanatory variables), and material properties (objective variables), and each record includes at least one of the explanatory variables and the objective variables, and an identifier for identifying the record.

[0079] In the example of FIG. 8, the material features include "raw material A," "raw material B," "raw material C," ..., "additive X," "additive Y," and "additive Z" that make up the material. Also, the material properties include the "viscosity" of the material. Note that in the example of FIG. 8, there is one objective variable, but there may be multiple objective variables.

[0080] For each material ID that identifies a material, the characteristics (explanatory variables) of the material are associated with the properties (objective variables). Numerical values, such as experimental values, that indicate the characteristics of each material are input into the explanatory variables. For the objective variables of material data to be processed, "NULL" is input, indicating that no numerical value exists, but for known materials, a numerical value is input into the objective variables.

[0081] The material data identified by material IDs "1" to "5" are the material data to be processed, and "NULL" is input as the objective variable, viscosity. Specifically, when the material ID is "1," the input values ​​are "80" for raw material A, "0" for raw material B, "0" for raw material C, ..., "4" for additive X, "0" for additive Y, "8" for additive Z, and "NULL" for viscosity. The material data to be processed is stored in the material database 142 as input data for the machine learning model.

[0082] Material data identified by material IDs "51" to "55" is known material data, and numerical values ​​are input as explanatory variables and target variables. Specifically, when the material ID is "51," the following values ​​are input: raw material A is "40," raw material B is "0," raw material C is "0," ..., additive X is "2," additive Y is "0," additive Z is "8," and viscosity is "10." The known material data may be, for example, output data of a machine learning model or output data of a simulation, or material data whose actual measured values ​​are known in advance. The known material data may be used as learning data for machine learning.

[0083] 9 is a diagram showing an example of combined data, which is created by combining two records, and will be described with reference to FIG.

[0084] Material data 710 is data held by, for example, company A, and material data 720 is data held by, for example, company B, which is different from company A. The material ID 711 of material data 710 indicates "ID1," and the material ID 721 of material data 720 indicates "ID1." Material data 710 and material data 720 have the same material ID and are data containing different information about the same material.

[0085] The material data 710 includes information 712 indicating material characteristics made up of explanatory variables x11-x1m and information 713 indicating material properties made up of response variables y11-y1n. The material data 720 includes information 722 indicating material characteristics made up of explanatory variables x21-x2p (p is an integer greater than or equal to 1) and information 723 indicating material properties made up of response variables y21-y2q (q is an integer greater than or equal to 1).

[0086] The material data 910 is material data (combined record) generated by combining the material data 710 and the material data 720 using the material ID as a key.

[0087] The material data 910 includes material characteristics 922 (explanatory variables) consisting of explanatory variables x11-x1n and x21-x2p, and material properties 923 (objective variables) consisting of objective variables y11-y1m and y21-y2q. The material data 910 is high-dimensional material data having the explanatory variables and objective variables included in the original two material data 710 and 720.

[0088] In this way, the dimensionality of the explanatory variables and / or target variables contained in the data held by Company A or Company B increases by combining records. This makes it possible to analyze data that includes information from other companies that was previously unavailable to the original company, enabling highly accurate property estimation. Furthermore, by using inverse analysis, it is possible to find target candidate materials more efficiently (with fewer experiments) than before.

[0089] (Sharing a common cryptographic key using the Diffie-Hellman key sharing method) The Diffie-Hellman key agreement method is a key agreement method in which two parties who wish to share a key can obtain the same common key by performing calculations using their own private key and the other party's public key. Both parties generate the key using common cryptographic parameters (a large prime number and its generator), and then independently perform a process to combine one party's secret information (private key) with the other party's public information (public key), resulting in the same value (common key).

[0090] In addition, in the Diffie-Hellman key sharing method, only information equivalent to the public key is transmitted over the communication channel, and the private key itself is not transmitted to the outside, so even if a third party obtains the public key, the calculations required to derive the common key are extremely difficult. Therefore, both parties who want to share a key can securely establish the same common key without transmitting their respective secret information (private keys) to the outside.

[0091] FIG. 10 is a sequence diagram showing key sharing using the Diffie-Hellman key sharing method. Referring to FIG. 10, a process in which the data processing device 100 and the terminal device 400 share a common encryption key using the Diffie-Hellman key sharing method will be described. The term "terminal device 400" refers to both terminal device 400-1 and terminal device 400-2. The order of the steps shown in FIG. 10 is merely an example, and the order of the steps is not necessarily limited to this. Depending on the purpose of the process and the execution environment, the order of the steps may be changed, or some steps may be processed in parallel.

[0092] The key management device 200 stores a system public key P(S) and a system private key S(S) in the key storage unit 221. The terminal device 400 stores a user public key P(U) and a user private key S(U) in the key storage unit 421. As described above, in the Diffie-Hellman key agreement scheme, the public key is public information generated from secret information (private key) based on common cryptographic parameters (a large prime number and its generator).

[0093] In step S101, the key management device 200 sends the system public key P(S) to the storage device 300, and the terminal device 400 acquires the system public key P(S) from the storage device 300.

[0094] In step S102, the calculation unit 151 of the data processing device 100 acquires the system private key S(S) from the key management device 200. Note that a secure communication path is established within the cloud system 10, and the system private key S(S) can be transmitted safely.

[0095] In step S103, the terminal device 400 sends the user public key P(U) to the storage device 300, and the calculation unit 151 of the data processing device 100 acquires the user public key P(U) from the storage device 300.

[0096] In step S104, the terminal device 400 generates a Diffie-Hellman key (DH key) as a common encryption key through Diffie-Hellman key sharing using the user private key S(U) and the system public key P(S). The key storage unit 421 of the terminal device 400 stores the generated DH key as the common encryption key.

[0097] In step S105, the calculation unit 151 of the data processing device 100 generates a Diffie-Hellman key (DH key) as a common encryption key by Diffie-Hellman key agreement using the system private key S(S) and the user public key P(U).

[0098] In addition, when the key management device 200 is located within the data processing device 100, the key management device 200 may acquire the user public key P(U), generate a DH key from the system private key S(S) and the user public key P(U), and transmit the DH key to the calculation unit 151.

[0099] As described above, the data processing device 100 and the terminal device 400 can share a common encryption key. The calculation unit 151 of the data processing device 100 is a protected area that is blocked from unauthorized access from outside, and the DH key stored in the area cannot be viewed or tampered with, even by other applications in the same device. By storing the common encryption key in a secure area, the confidentiality and integrity of communications and data processing are ensured.

[0100] Furthermore, the secure area is configured with volatile protected memory, and the common encryption key stored in the secure area is erased upon completion of the computation process. This configuration reduces the risk of the common encryption key being leaked.

[0101] (Arithmetic processing in information processing system 1) Fig. 11 is a flowchart showing arithmetic processing in the information processing system 1. With reference to Fig. 11, arithmetic processing (inference using a machine learning model) for sensitive data transmitted from terminal device 400-1 and terminal device 400-2 in the information processing system 1 will be described. Note that the order of steps shown in Fig. 11 is an example, and the order of the steps is not necessarily limited to this. It is also possible to change the order of the steps or process some steps in parallel depending on the purpose of the processing and the execution environment.

[0102] Before starting the computation process, the terminal device 400-1 and the data processing device 100 share a common encryption key (DH key 1) through Diffie-Hellman key sharing, for example, as shown in FIG. 10. Similarly, the terminal device 400-2 and the data processing device 100 share a common encryption key (DH key 2). DH key 1 and DH key 2 are different keys. The storage device 300 also stores an encrypted machine learning model Enc(M).

[0103] In step S200, the control unit 450 of the terminal device 400-1 encrypts the sensitive data D1 stored in the storage unit 420 using the common encryption key (DH key 1) of the terminal device 400-1. The control unit 450 controls the communication unit 410 to transmit the encrypted sensitive data Enc(D1) to the storage device 300. The storage device 300 stores the encrypted sensitive data Enc(D1) received from the terminal device 400-1 in the storage unit 320. Similarly, the sensitive data D2 is encrypted in the terminal device 400-2, and the storage device 300 stores the encrypted sensitive data Enc(D2) in the storage unit 320.

[0104] In step S201, the calculation unit 151 of the data processing device 100 obtains, from the storage device 300, the machine learning model Enc(M) encrypted with the system public key P(S).

[0105] In step S202, the calculation unit 151 obtains the system private key S(S) from the key management device 200 and decrypts the machine learning model.

[0106] In step S203, the calculation unit 151 obtains the encrypted sensitive data Enc(D1) and Enc(D2) from the storage device 300.

[0107] In step S204, the calculation unit 151 decrypts the encrypted sensitive data Enc(D1) using DH key 1 held as a common encryption key for the terminal device 400-1. Similarly, the calculation unit 151 decrypts the encrypted sensitive data Enc(D2) using DH key 2 held as a common encryption key for the terminal device 400-2.

[0108] In step S205, the calculation unit 151 combines the records contained in the decrypted sensitive data D1 and D2 based on an identifier such as a material ID that can identify the material data, to create combined data D.

[0109] In step S206, the calculation unit 151 inputs the combined data into the machine learning model M decoded in S202, and outputs result data D'. For example, the calculation unit 151 inputs the characteristics (explanatory variables) of the materials included in the combined data D, and outputs the properties (objective variables) of the materials as result data D'.

[0110] The output result data D' includes the result of the inference process (objective variables) corresponding to the explanatory variables included in the input combined data. For example, in the example of FIG. 9, when the explanatory variables (x11-x1m, x21-x2p) of material data 910 created by combining material data 710 and material data 720 based on material ID "ID1" are input to the machine learning model, the result data includes the values ​​of the objective variables (y11-y1n, y21-y2q) inferred by the machine learning model. Of the result data, the objective variables (y11-y1n) are variables included in material data 710, and the objective variables (y21-y2q) are variables included in material data 720. In other words, it is possible to clearly distinguish the objective variables included in the combined data from which terminal device 400 the objective variables are included in the material data provided by the combined data.

[0111] In step S207, the calculation unit 151 cancels the combination of records included in the result data D', and creates individual result data D'i (i=1, 2) corresponding to the sensitive data before the combination.

[0112] In step S208, the calculation unit 151 encrypts the individual result data D'i using a common encryption key (DH key i) shared with the terminal device 400 that stores the sensitive data Di corresponding to the individual result data D'i.

[0113] In step S209, the calculation unit 151 transmits the encrypted individual result data Enc(D'i) to the storage device 300. The storage device 300 stores the encrypted individual result data Enc(D'i) in the storage unit 320.

[0114] In step S210, the control unit 450 of the terminal device 400-i acquires the encrypted individual result data Enc(D'i) corresponding to the terminal device 400-i from the storage device 300, and decrypts the encrypted individual result data Enc(D'i) using the DH key i held as a common encryption key. This allows the terminal device 400-i to obtain the individual result data D'i by utilizing the sensitive data of others. This completes the inference for the machine learning model.

[0115] (Explanation of effect) According to this embodiment, sensitive data acquired from multiple terminal devices 400 is combined in a secure area of ​​the data processing device 100 to create combined data that complements features that cannot be obtained from a single terminal device 400, and inference is performed based on the combined data using a machine learning model. This allows for improved prediction accuracy compared to inference using only in-house data.

[0116] Furthermore, inference is performed by decrypting the sensitive data and machine learning model acquired from each terminal device 400 in the secure area of ​​the data processing device 100. The secure area is configured so that it cannot be accessed by other devices, so the data can be utilized without disclosing its contents to others.

[0117] Furthermore, the terminal device 400 decrypts the encrypted individual result data acquired via the secure communication path using a common encryption key shared between the terminal device 400 and the data processing device 100. Since the secure area cannot be accessed by other devices, the individual result data can only be decrypted by the corresponding terminal device 400. Therefore, the confidentiality of the individual result data is ensured.

[0118] <Embodiment 2> In this embodiment, a process of generating or updating a machine learning model related to the information processing system 1 is performed.

[0119] (Generating machine learning models) Fig. 12 is a flowchart showing arithmetic processing in the information processing system 1. With reference to Fig. 12, arithmetic processing (processing for generating a machine learning model) using sensitive data transmitted from terminal device 400-1 and terminal device 400-2 in the information processing system 1 will be described. Note that the order of steps shown in Fig. 12 is an example, and the order of the steps is not necessarily limited to this. It is also possible to change the order of the steps or process some steps in parallel depending on the purpose of the processing and the execution environment.

[0120] Furthermore, before starting the arithmetic processing, the terminal device 400-1 and the data processing device 100 share a common encryption key (DH key 1) by Diffie-Hellman key sharing, for example, as shown in Fig. 10. Similarly, the terminal device 400-2 and the data processing device 100 share a common encryption key (DH key 2). DH key 1 and DH key 2 are different keys.

[0121] As described with reference to FIG. 8, the material database 422 of the terminal device 400 stores known material data including a plurality of records as learning data. The storage device 300 also stores a system public key P(S).

[0122] In step S301, the control unit 450 of the terminal device 400-1 encrypts the training data D11 using the DH key 1 of the terminal device 400-1. The control unit 450 controls the communication unit 410 to transmit the encrypted training data Enc(D11) to the storage device 300. The storage device 300 stores the encrypted training data Enc(D11) received from the terminal device 400-1 in the storage unit 320. Similarly, the training data D12 is also encrypted in the terminal device 400-2, and the storage device 300 stores the encrypted training data Enc(D12) in the storage unit 320.

[0123] In step S302, the calculation unit 151 of the data processing device 100 obtains the encrypted training data Enc(D11) and Enc(D12) from the storage device 300.

[0124] In step S303, the calculation unit 151 decrypts the encrypted training data Enc(D11) using DH key 1 held as a common encryption key for the terminal device 400-1. Similarly, the calculation unit 151 decrypts the encrypted training data Enc(D12) using DH key 2 held as a common encryption key for the terminal device 400-2.

[0125] In step S304, the calculation unit 151 combines the records contained in the decoded learning data D11 and D12 based on an identifier such as a material ID that can identify the material data, to create combined learning data.

[0126] In step S305, the calculation unit 151 performs machine learning using the combined training data created in step S304, and generates a machine learning model M. The machine learning model M generated here reflects the features included in the training data D11, D12 of the terminal device 400-1 and the terminal device 400-2. That is, features not included in one training data are included in the other training data, and by combining these data, learning is performed based on training data containing a wider variety of features. Therefore, it is possible to generate a machine learning model M with more accurate prediction performance than when only the training data individually held by each terminal device 400 is used.

[0127] In step S306, the calculation unit 151 obtains the system public key P(S) from the storage device 300, and encrypts the generated machine learning model M using the system public key P(S).

[0128] In step S307, the calculation unit 151 transmits the encrypted machine learning model Enc(M) to the storage device 300. The storage device 300 stores the encrypted machine learning model Enc(M) in the storage unit 320. This completes the process of generating a machine learning model.

[0129] (Machine learning model update) If the storage device 300 stores an existing machine learning model M' that has already been generated, the calculation unit 151 may update the model by using the existing machine learning model M' as a base and performing re-learning or additional learning based on the combined learning data in step S304 of FIG. 12. This makes it possible to efficiently build a model that corresponds to new data while making use of the existing learning results. Note that the existing machine learning model M' may be a model generated without sensitive data held by multiple organizations participating in the information processing system 1 (i.e., stored in the terminal device 400) contributing to the machine learning, or may be a model generated using sensitive data held by multiple organizations participating in the information processing system 1.

[0130] Furthermore, after performing an inference, if the calculation unit 151 can obtain the input data for the inference and the inference result, or correct answer information (teacher label) for the inference result, user feedback, a true value obtained later, a collation result with an external database, etc., it may use these as new learning data to update the existing machine learning model. This makes it possible to update the model based on the actual inference result, and to continuously improve the accuracy of the model.

[0131] (Effects of the Invention) According to this embodiment, in a secure area of ​​the data processing device 100, a machine learning model is generated or updated using combined training data created by combining training data acquired from multiple terminal devices 400. This enables learning based on a wider variety of features compared to when only training data held by a single terminal device 400 is used, thereby improving the prediction accuracy of the machine learning model.

[0132] Furthermore, according to this embodiment, model learning and updating are performed in a secure area, which prevents the learning data of each terminal device 400 from being disclosed to a third party, thereby ensuring security and allowing the use of data from others.

[0133] Furthermore, according to this embodiment, in the secure area, the learning data stored in multiple terminal devices is used to update a machine learning model that was generated without contributing to machine learning. This allows a machine learning model generated by a third party to be retrained or fine-tuned using data from organizations participating in the information processing system 1, thereby optimizing the model to meet the needs of the participating organizations. Furthermore, when a machine learning model generated by a third party is used, there is no need to prepare a large-scale dataset for model generation, thereby reducing development costs.

[0134] <Embodiment 3> In this embodiment, inference is performed using a machine learning model using combined data created by aggregating data held by multiple companies. This embodiment differs from embodiment 1 in the method of key sharing between the data processing device and the terminal device. After the key sharing, inference is performed using the same process as embodiment 1.

[0135] (Configuration of Information Processing System 2) 13 is an overall view of the information processing system 2. The configuration of the information processing system according to this embodiment will be described with reference to FIG.

[0136] The information processing system 2 includes a cloud system 20, a data processing device 500, and a key management device 600, instead of the cloud system 10, the data processing device 100, and the key management device 200 of the information processing system 1 according to the first embodiment.

[0137] The cloud system 20 includes a storage device 300 and a data processing device 500. The data processing device 500 generates a secure private key S(T) and a secure public key P(T) in a calculation unit 551 (described later) in a secure area, and shares keys with the terminal device 400 using these keys.

[0138] The key management device 600 is located in a third-party certification authority and connected to the network NW. The key management device 600 stores a system private key S(S) and a system public key P(S).

[0139] Furthermore, the key management device 600 issues a digital certificate for the public key generated by the TEE, for example, to guarantee the authenticity and reliability of the TEE. This allows the terminal device 400 to safely request key sharing or calculation processing after confirming that the calculation unit 551 of the data processing device 500 is a reliable execution environment. Note that the key management device 600 only needs to be located within a reliable certification authority, and may be under the management of a participating organization, for example.

[0140] 14 is a block diagram showing the functional configuration of the data processing device 500. The functional configuration of the data processing device 500 according to this embodiment will be described with reference to FIG.

[0141] The data processing device 500 includes a control unit 550 instead of the control unit 150 of the data processing device 100 .

[0142] The control unit 550 has an arithmetic unit 551 in the cure area. The arithmetic unit 551 generates a secure private key S(T) and a secure public key P(T), and has a common encryption key obtained by using these keys to perform key sharing processing with each of the multiple terminal devices 400. The key sharing processing will be described in detail with reference to FIG. 15. The other functions are the same as those of the arithmetic unit 151, so their description will be omitted.

[0143] FIG. 15 is a sequence diagram showing key sharing using the Diffie-Hellman key sharing method. Referring to FIG. 15, a process in which data processing device 500 and terminal device 400 share a common encryption key using Diffie-Hellman key sharing will be described. Note that, hereinafter, the term "terminal device 400" refers to the processing of both terminal device 400-1 and terminal device 400-2. The order of steps shown in FIG. 15 is merely an example, and the order of the steps is not necessarily limited to this. Depending on the purpose of the processing and the execution environment, the order of the steps may be changed, or some steps may be processed in parallel.

[0144] The key management device 600 stores a system public key P(S) and a system private key S(S). The terminal device 400 stores a user public key P(U) and a user private key S(U) in the key storage unit 421. As described above, in the Diffie-Hellman key agreement scheme, the public key is public information generated from secret information (private key) based on common cryptographic parameters (a large prime number and its generator).

[0145] In step S401, the calculation unit 551 of the data processing device 500 generates a secure private key S(T) and a secure public key P(T) (a pair of secure keys).

[0146] In step S 402 , the calculation unit 551 of the data processing device 500 acquires the system public key P(S) from the key management device 600 .

[0147] In step S403, the calculation unit 551 of the data processing device 500 encrypts the secure private key S(T) using the system public key P(S).

[0148] In step S404, the calculation unit 551 of the data processing device 500 sends the encrypted secure private key Enc(S(T)) to the storage device 300, and the storage device 300 stores the encrypted secure private key Enc(S(T)) in the storage unit 320.

[0149] In step S405, the calculation unit 551 of the data processing device 500 sends the secure public key P(T) to the storage device 300, and the storage device 300 stores the secure public key P(T) in the storage unit 320. In addition, the terminal device 400 acquires the secure public key P(T) from the storage device 300.

[0150] In step S406, the terminal device 400 generates a Diffie-Hellman key (T-DH key) as a common encryption key through Diffie-Hellman key agreement using the user private key S(U) and the secure public key P(T). The key storage unit 421 of the terminal device 400 stores the generated T-DH key as the common encryption key.

[0151] In step S407, the terminal device 400 sends the user public key P(U) to the storage device 300, and the storage device 300 stores the user public key P(U) of the terminal device 400. In addition, the data processing device 500 acquires the user public key P(U) from the storage device 300.

[0152] In step S408, the calculation unit 551 of the data processing device 500 obtains the encrypted secure private key Enc(S(T)) from the storage device 300.

[0153] In step S409, the calculation unit 551 of the data processing device 500 obtains the system private key S(S) from the key management device 600.

[0154] In step S410, the calculation unit 551 of the data processing device 500 decrypts the encrypted secure private key Enc(S(T)) obtained in step S408 using the system private key S(S).

[0155] In step S411, the calculation unit 551 of the data processing device 500 generates a Diffie-Hellman key (T-DH key) as a common encryption key through Diffie-Hellman key agreement using the user public key P(U) acquired in step S407 and the decrypted secure private key S(T).

[0156] As described above, the secure area (processing unit) of the data processing device 500 holds the Diffie-Hellman key (T-DH key) generated as a common encryption key shared with each of the terminal devices 400 .

[0157] (Arithmetic processing in information processing system 2) In the information processing system 2, the arithmetic processing (inference using a machine learning model) for the sensitive data transmitted from the terminal device 400-1 and the terminal device 400-2 will be described.

[0158] 15, the terminal device 400-1 and the data processing device 100 have T-DH key 1 as a common encryption key. Similarly, the terminal device 400-2 and the data processing device 100 have T-DH key 2, which is different from T-DH key 1, as a common encryption key.

[0159] In the information processing system 2, the inference using the machine learning model for the sensitive data transmitted from the terminal device 400-1 and the terminal device 400-2 is the same as the processing shown in FIG. 11 except that the common encryption key used by the terminal device 400 and the data processing device 500 is different, and therefore a detailed explanation is omitted.

[0160] (Explanation of effect) According to the information processing system 2 of this embodiment, a symmetric encryption key is generated (shared) by Diffie-Hellman key sharing using a pair of secure keys generated in a processing unit (TEE) in a secure area. Then, sensitive data encrypted using the symmetric encryption key is acquired from the terminal device 400 and combined in the secure area, creating combined data that complements features that the terminal device 400 cannot obtain on its own, and inference is performed based on the combined data using a machine learning model. By using a pair of secure keys to generate the symmetric encryption key, in addition to the effects described in the first embodiment, keys can be used flexibly while maintaining a higher level of security.

[0161] <Embodiment 4> In this embodiment, a process for generating or updating a machine learning model related to the information processing system 2 is performed. This embodiment differs from embodiment 2 in the method of key sharing between the data processing device and the terminal device. After the key sharing, a process for generating or updating a machine learning model is performed in the same manner as embodiment 2.

[0162] As explained in Fig. 15, the terminal device 400-1 and the data processing device 500 have a T-DH1 key as a common encryption key through Diffie-Hellman key sharing using a pair of secure keys. Similarly, the terminal device 400-2 and the data processing device 500 have a T-DH key2, which is different from the T-DH1 key, as a common encryption key. The process of generating or updating a machine learning model is as shown in Fig. 12, so details will be omitted.

[0163] (Explanation of effect) According to the information processing system 2 of this embodiment, a symmetric encryption key is generated (shared) by Diffie-Hellman key sharing using a pair of secure keys generated in a processing unit (TEE) in a secure area. Then, training data encrypted using the symmetric encryption key is combined in the secure area from a terminal device 400, and a machine learning model is generated or updated using the combined training data. By using a pair of secure keys to generate the symmetric encryption key, in addition to the effects described in the second embodiment, a training model can be generated while maintaining a higher level of security.

[0164] <Variation 1> In the second embodiment, the machine learning model used for inference in the information processing system 1 is generated by the data processing device 100, which uses the DH key generated using the key pair of the system key as the common encryption key. Here, the machine learning model used for inference in the information processing system 1 may be generated by a learning process of the data processing device 500, which uses the T-DH key generated using the key pair of the secure key generated in the secure area as the common encryption key, as described in the fourth embodiment.

[0165] <Variation 2> In the fourth embodiment, the machine learning model used for inference in the information processing system 2 is generated by the data processing device 500, which uses the T-DH key generated using the key pair of the secure keys as the common encryption key. Here, the machine learning model used for inference in the information processing system 2 may be generated by the learning process of the data processing device 100, which uses the DH key generated using the key pair of the system keys as the common encryption key, as described in the second embodiment.

[0166] <Variation 3> The system keys stored in the key management device 200 of the information processing system 1 according to the first and second embodiments are keys of the public key cryptosystem, but the key management device 200 may store system keys of the common key cryptosystem.

[0167] When the system key of the key management device 200 is of the symmetric key cryptosystem, the data processing device 100 and the terminal device 400 can share an encryption key by hybrid cryptosystem (a system in which a symmetric key is securely transmitted using public key cryptography and data is encrypted using the symmetric key). For example, the key management device 200 generates a system symmetric key K(S_Ui) for each of the terminal devices 400-i (i=1, 2). The terminal device 400-i then obtains the system symmetric key K(S_Ui), encrypted using the user public key P(Ui), from the key management device 200 via the storage device 300, and decrypts it using the user private key S(Ui), thereby sharing the system symmetric key K(S_Ui) with the data processing device 100 as a symmetric encryption key.

[0168] <Variation 4> The system key stored in the key management device 600 of the information processing system 2 according to the third and fourth embodiments is a key of the public key cryptosystem, but a system key of the symmetric cryptosystem may be stored. In this case, the calculation unit 551 of the data processing device 500 encrypts or decrypts the generated secure private key S(S) or machine learning model M using the system symmetric key K(S).

[0169] <Variation 5> The information processing system 1 according to the first and second embodiments may include a key management device 600 disposed in a third-party certification authority and connected to the network NW instead of the key management device 200. Furthermore, the information processing system 2 according to the third and fourth embodiments may include a key management device 200 disposed in a data processing device 100 instead of the key management device 600.

[0170] The above-described embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and modifications are intended to be included in the scope of the invention and their equivalents as defined in the claims, as well as in the scope and spirit of the invention.

[0171] The matters described in the above embodiments will be supplemented below.

[0172] (Appendix 1) a plurality of user terminals each having a control unit and a storage unit for storing sensitive data including a plurality of records; a data processing device having an arithmetic unit in a secure domain; a key management device that manages a system key; a storage device that stores a machine learning model encrypted using the system key; 1. A method for use in a system comprising: each of the plurality of user terminals and the data processing device has a different common encryption key; The control unit in each of the plurality of user terminals, encrypting the sensitive data using the common encryption key of the user terminal; The calculation unit of the data processing device retrieving the encrypted machine learning model from the storage device; decrypting the machine learning model using the system key obtained from the key management device; decrypting the sensitive data encrypted by each of the user terminals using the common encryption key of the data processing device; A step of combining the records included in each of the decrypted sensitive data to create combined data; inputting the combined data into the machine learning model and outputting result data; a step of canceling the combination of the records included in the result data to create individual result data; encrypting the individual result data using the common encryption key shared with the user terminal that stores the sensitive data corresponding to the individual result data; transmitting the encrypted individual result data to the storage device; The control unit of the user terminal acquiring, from the storage device, the encrypted individual result data corresponding to the sensitive data stored in the user terminal; decrypting the encrypted individual result data using the common encryption key of the user terminal; An information processing method comprising:

[0173] (Appendix 2) the storage unit of the user terminal stores learning data including a plurality of the records; The control unit in each of the plurality of user terminals, encrypting the training data using the common encryption key of the user terminal; The calculation unit of the data processing device a step of decrypting the encrypted learning data by each of the user terminals using the common encryption key of the data processing device; combining the records included in each of the decoded training data to generate combined training data; performing machine learning using the combined training data to generate or update the machine learning model; encrypting the machine learning model using the system key; transmitting the encrypted machine learning model to the storage device; The information processing method described in (Supplementary Note 1) comprises:

[0174] (Appendix 3) the storage unit of the user terminal stores a user private key, a user public key, and learning data including a plurality of the records; the storage device stores the user public keys of the plurality of user terminals; The calculation unit of the data processing device generating a secure private key and a secure public key; transmitting the secure public key and the secure private key encrypted using the system key obtained from the key management device to the storage device; The control unit in each of the plurality of user terminals, generating the common encryption key of the user terminal by Diffie-Hellman key agreement using the user private key and the secure public key obtained from the storage device; encrypting the training data using the common encryption key of the user terminal; transmitting the encrypted training data to the storage device; The calculation unit of the data processing device obtaining the system key from the key management device; acquiring the encrypted secure private key, the user public keys of the plurality of user terminals, and the encrypted training data from the storage device; decrypting the encrypted secure private key obtained from the storage device using the system key obtained from the key management device; generating the common encryption key between each of the plurality of user terminals and the data processing device by Diffie-Hellman key sharing using the user public keys of the plurality of user terminals acquired from the storage device and the decrypted secure private key; decrypting the learning data encrypted by each of the user terminals, which is acquired from the storage device, using the common encryption key of the data processing device; combining the records included in each of the decoded training data to generate combined training data; performing machine learning using the combined training data to generate or update the machine learning model; encrypting the machine learning model using the system key; transmitting the encrypted machine learning model to the storage device; The information processing method according to (Appendix 1).

[0175] (Appendix 4) a plurality of user terminals each having a control unit, a user private key, a user public key, and a storage unit for storing sensitive data including a plurality of records; a data processing device having an arithmetic unit in a secure domain; a key management device that manages a system key; a storage device that stores a machine learning model encrypted using the system key and the user public keys of each of the plurality of user terminals; 1. A method for use in a system comprising: The calculation unit of the data processing device generating a secure private key and a secure public key; transmitting the secure public key and the secure private key encrypted using the system key obtained from the key management device to the storage device; The control unit in each of the plurality of user terminals, obtaining the secure public key from the storage device; generating a common encryption key for the user terminal by Diffie-Hellman key agreement using the user private key and the secure public key; encrypting the sensitive data using the common encryption key of the user terminal; transmitting the encrypted sensitive data to the storage device; The calculation unit of the data processing device obtaining the system key from the key management device; obtaining the encrypted secure private key and the user public keys of the plurality of user terminals, and the encrypted sensitive data from the storage device; decrypting the encrypted secure private key using the system key; generating the common encryption key between each of the plurality of user terminals and the data processing device by Diffie-Hellman key agreement using the user public keys of the plurality of user terminals and the decrypted secure private key; decrypting the encrypted sensitive data obtained from the storage device by each of the user terminals using the common encryption key of the data processing device; decrypting the encrypted machine learning model obtained from the storage device using the system key; A step of combining the records included in each of the decrypted sensitive data to create combined data; inputting the combined data into the machine learning model and outputting result data; a step of canceling the combination of the records included in the result data to create individual result data; encrypting the individual result data corresponding to the sensitive data using the common encryption key shared with the user terminal that stores the sensitive data corresponding to the individual result data; transmitting the encrypted individual result data to the storage device; The control unit of the user terminal acquiring, from the storage device, the encrypted individual result data corresponding to the sensitive data stored in the user terminal; decrypting the encrypted individual result data using the common encryption key of the user terminal; An information processing method comprising:

[0176] (Appendix 5) the storage unit of the user terminal stores learning data including a plurality of the records; the storage device stores the user public keys of each of the plurality of user terminals; The calculation unit of the data processing device generating said secure private key and said secure public key; transmitting the secure public key and the secure private key encrypted using the system key obtained from the key management device to the storage device; The control unit in each of the plurality of user terminals, generating the common encryption key of the user terminal by Diffie-Hellman key agreement using the user private key and the secure public key obtained from the storage device; encrypting the training data using the common encryption key of the user terminal; transmitting the encrypted training data to the storage device; The calculation unit of the data processing device acquiring the encrypted secure private key, the user public keys of the plurality of user terminals, and the encrypted training data from the storage device; decrypting the encrypted secure private key obtained from the storage device using the system key obtained from the key management device; generating the common encryption key between each of the plurality of user terminals and the data processing device by Diffie-Hellman key sharing using the user public keys of the plurality of user terminals acquired from the storage device and the decrypted secure private key; decrypting the learning data encrypted by each of the user terminals, which is acquired from the storage device, using the common encryption key of the data processing device; combining the records included in each of the decoded training data to generate combined training data; performing machine learning using the combined training data to generate or update the machine learning model; encrypting the machine learning model using the system key; transmitting the encrypted machine learning model to the storage device; The information processing method described in (Supplementary Note 4) comprises:

[0177] (Appendix 6) each of the plurality of user terminals and the data processing device has a different common encryption key; the storage unit of the user terminal stores learning data including a plurality of the records; the control unit in each of the plurality of user terminals encrypts the training data using the common encryption key of the user terminal; The calculation unit of the data processing device a step of decrypting the encrypted learning data by each of the user terminals using the common encryption key of the data processing device; combining the records included in each of the decoded training data to generate combined training data; performing machine learning using the combined training data to generate or update the machine learning model; encrypting the machine learning model using the system key; transmitting the encrypted machine learning model to the storage device; The information processing method described in (Supplementary Note 4) comprises:

[0178] (Appendix 7) An information processing method described in any one of (Appendix 2), (Appendix 3), (Appendix 5), or (Appendix 6), wherein in the step of generating or updating the machine learning model, the machine learning model updated by the calculation unit is a model generated without the learning data stored in the multiple user terminals contributing to machine learning.

[0179] (Appendix 8) The information processing method according to any one of (Supplementary Note 1) to (Supplementary Note 6), wherein the system key is a key of a public key cryptosystem or a key of a common key cryptosystem.

[0180] (Appendix 9) The information processing method according to any one of (Supplementary Note 1) to (Supplementary Note 6), wherein the key management device is located within a trusted third-party certification authority or within the data processing device.

[0181] (Appendix 10) the record includes at least one of an explanatory variable and a target variable, and an identifier for identifying the record; the calculation unit of the data processing device combines the records based on the identifiers, the combined records include the explanatory variables and the objective variable; An information processing method according to any one of (Appendix 1) to (Appendix 9).

[0182] (Appendix 11) a plurality of user terminals each having a control unit and a storage unit for storing sensitive data including a plurality of records; a data processing device having an arithmetic unit in a secure domain; a key management device that manages a system key; a storage device that stores a machine learning model encrypted using the system key; A program used in a system comprising: each of the plurality of user terminals and the data processing device has a different common encryption key; The control unit in each of the plurality of user terminals, encrypting the sensitive data using the common encryption key of the user terminal; The calculation unit of the data processing device retrieving the encrypted machine learning model from the storage device; decrypting the machine learning model using the system key obtained from the key management device; decrypting the sensitive data encrypted by each of the user terminals using the common encryption key of the data processing device; A step of combining the records included in each of the decrypted sensitive data to create combined data; inputting the combined data into the machine learning model and outputting result data; a step of canceling the combination of the records included in the result data to create individual result data; encrypting the individual result data using the common encryption key shared with the user terminal that stores the sensitive data corresponding to the individual result data; transmitting the encrypted individual result data to the storage device; The control unit of the user terminal acquiring, from the storage device, the encrypted individual result data corresponding to the sensitive data stored in the user terminal; decrypting the encrypted individual result data using the common encryption key of the user terminal; An information processing program comprising:

[0183] (Appendix 12) a plurality of user terminals each having a control unit, a user private key, a user public key, and a storage unit for storing sensitive data including a plurality of records; a data processing device having an arithmetic unit in a secure domain; a key management device that manages a system key; a storage device that stores a machine learning model encrypted using the system key and the user public keys of each of the plurality of user terminals; A program used in a system comprising: The calculation unit of the data processing device generating a secure private key and a secure public key; transmitting the secure public key and the secure private key encrypted using the system key obtained from the key management device to the storage device; The control unit in each of the plurality of user terminals, obtaining the secure public key from the storage device; generating a common encryption key for the user terminal by Diffie-Hellman key agreement using the user private key and the secure public key; encrypting the sensitive data using the common encryption key of the user terminal; transmitting the encrypted sensitive data to the storage device; The calculation unit of the data processing device obtaining the system key from the key management device; obtaining the encrypted secure private key and the user public keys of the plurality of user terminals, and the encrypted sensitive data from the storage device; decrypting the encrypted secure private key using the system key; generating the common encryption key between each of the plurality of user terminals and the data processing device by Diffie-Hellman key agreement using the user public keys of the plurality of user terminals and the decrypted secure private key; decrypting the encrypted sensitive data obtained from the storage device by each of the user terminals using the common encryption key of the data processing device; decrypting the encrypted machine learning model obtained from the storage device using the system key; A step of combining the records included in each of the decrypted sensitive data to create combined data; inputting the combined data into the machine learning model and outputting result data; a step of canceling the combination of the records included in the result data to create individual result data; encrypting the individual result data corresponding to the sensitive data using the common encryption key shared with the user terminal that stores the sensitive data corresponding to the individual result data; transmitting the encrypted individual result data to the storage device; The control unit of the user terminal acquiring, from the storage device, the encrypted individual result data corresponding to the sensitive data stored in the user terminal; decrypting the encrypted individual result data using the common encryption key of the user terminal; An information processing program comprising:

[0184] (Appendix 13) a plurality of user terminals each having a control unit and a storage unit for storing sensitive data including a plurality of records; a data processing device having an arithmetic unit in a secure domain; a key management device that manages a system key; a storage device that stores a machine learning model encrypted using the system key; A system comprising: each of the plurality of user terminals and the data processing device has a different common encryption key; The control unit in each of the plurality of user terminals, encrypting the sensitive data using the common encryption key of the user terminal; The calculation unit of the data processing device obtaining the encrypted machine learning model from the storage device; decrypting the machine learning model using the system key obtained from the key management device; decrypting the sensitive data encrypted by each of the user terminals using the common encryption key of the data processing device; combining the records included in each of the decrypted sensitive data to create combined data; inputting the combined data into the machine learning model and outputting result data; canceling the combination of the records included in the result data to create individual result data; encrypting the individual result data using the common encryption key with the user terminal that stores the sensitive data corresponding to the individual result data; transmitting the encrypted individual result data to the storage device; The control unit of the user terminal Obtaining the encrypted individual result data corresponding to the sensitive data stored in the user terminal from the storage device; decrypting the encrypted individual result data using the common encryption key of the user terminal; Information processing system.

[0185] (Appendix 14) a plurality of user terminals each having a control unit, a user private key, a user public key, and a storage unit for storing sensitive data including a plurality of records; a data processing device having an arithmetic unit in a secure domain; a key management device that manages a system key; a storage device that stores a machine learning model encrypted using the system key and the user public keys of each of the plurality of user terminals; A system comprising: The calculation unit of the data processing device generating a secure private key and a secure public key; transmitting the secure public key and the secure private key encrypted using the system key obtained from the key management device to the storage device; The control unit in each of the plurality of user terminals, obtaining the secure public key from the storage device; generating a common encryption key for the user terminal by Diffie-Hellman key agreement using the user private key and the secure public key; encrypting the sensitive data using the common encryption key of the user terminal; transmitting the encrypted sensitive data to the storage device; The calculation unit of the data processing device obtaining the system key from the key management device; acquiring the encrypted secure private key and the user public keys of the plurality of user terminals, and the encrypted sensitive data from the storage device; decrypting the encrypted secure private key using the system key; generating the common encryption key between each of the plurality of user terminals and the data processing device by Diffie-Hellman key sharing using the user public keys of the plurality of user terminals and the decrypted secure private key; decrypting the sensitive data encrypted by each of the user terminals, which is obtained from the storage device, using the common encryption key of the data processing device; decrypting the encrypted machine learning model obtained from the storage device using the system key; combining the records included in each of the decrypted sensitive data to create combined data; inputting the combined data into the machine learning model and outputting result data; canceling the combination of the records included in the result data to create individual result data; encrypting the individual result data corresponding to the sensitive data using the common encryption key with the user terminal that stores the sensitive data corresponding to the individual result data; transmitting the encrypted individual result data to the storage device; The control unit of the user terminal Obtaining the encrypted individual result data corresponding to the sensitive data stored in the user terminal from the storage device; decrypting the encrypted individual result data using the common encryption key of the user terminal; Information processing system. [Explanation of symbols]

[0186] 1,2 Information processing system, 10 Cloud system, 100,500 Data processing device, 200,600 Key management device, 300 Storage device, 400 Terminal device, 110,210,310,410 Communication unit, 120,220,320,420 Storage unit, 130,230,330,430 Input unit, 140,240,340,440 Output unit, 150,250,350,450 Control unit, 151,551 Calculation unit, 221,421 Key storage unit, 442 Materials database.

Claims

1. a plurality of user terminals each having a control unit and a storage unit for storing sensitive data including a plurality of records; a data processing device having an arithmetic unit in a secure domain; a key management device that manages a system key; a storage device that stores a machine learning model encrypted using the system key; 1. A method for use in a system comprising: each of the plurality of user terminals and the data processing device has a different common encryption key; The control unit in each of the plurality of user terminals, encrypting the sensitive data using the common encryption key of the user terminal; The calculation unit of the data processing device retrieving the encrypted machine learning model from the storage device; decrypting the machine learning model using the system key obtained from the key management device; decrypting the sensitive data encrypted by each of the user terminals using the common encryption key of the data processing device; A step of combining the records included in each of the decrypted sensitive data to create combined data; inputting the combined data into the machine learning model and outputting result data; a step of canceling the combination of the records included in the result data to create individual result data; encrypting the individual result data using the common encryption key shared with the user terminal that stores the sensitive data corresponding to the individual result data; transmitting the encrypted individual result data to the storage device; The control unit of the user terminal acquiring, from the storage device, the encrypted individual result data corresponding to the sensitive data stored in the user terminal; decrypting the encrypted individual result data using the common encryption key of the user terminal; An information processing method comprising:

2. the storage unit of the user terminal stores learning data including a plurality of the records; The control unit in each of the plurality of user terminals, encrypting the training data using the common encryption key of the user terminal; The calculation unit of the data processing device a step of decrypting the encrypted learning data by each of the user terminals using the common encryption key of the data processing device; combining the records included in each of the decoded training data to generate combined training data; performing machine learning using the combined training data to generate or update the machine learning model; encrypting the machine learning model using the system key; transmitting the encrypted machine learning model to the storage device; The information processing method according to claim 1 , comprising:

3. the storage unit of the user terminal stores a user private key, a user public key, and learning data including a plurality of the records; the storage device stores the user public keys of the plurality of user terminals; The calculation unit of the data processing device generating a secure private key and a secure public key; transmitting the secure public key and the secure private key encrypted using the system key obtained from the key management device to the storage device; The control unit in each of the plurality of user terminals, generating the common encryption key of the user terminal by Diffie-Hellman key agreement using the user private key and the secure public key obtained from the storage device; encrypting the training data using the common encryption key of the user terminal; transmitting the encrypted training data to the storage device; The calculation unit of the data processing device obtaining the system key from the key management device; acquiring the encrypted secure private key, the user public keys of the plurality of user terminals, and the encrypted training data from the storage device; decrypting the encrypted secure private key obtained from the storage device using the system key obtained from the key management device; generating the common encryption key between each of the plurality of user terminals and the data processing device by Diffie-Hellman key sharing using the user public keys of the plurality of user terminals acquired from the storage device and the decrypted secure private key; decrypting the learning data encrypted by each of the user terminals, which is acquired from the storage device, using the common encryption key of the data processing device; combining the records included in each of the decoded training data to generate combined training data; performing machine learning using the combined training data to generate or update the machine learning model; encrypting the machine learning model using the system key; transmitting the encrypted machine learning model to the storage device; The information processing method according to claim 1 .

4. a plurality of user terminals each having a control unit, a user private key, a user public key, and a storage unit for storing sensitive data including a plurality of records; a data processing device having an arithmetic unit in a secure domain; a key management device that manages a system key; a storage device that stores a machine learning model encrypted using the system key and the user public keys of each of the plurality of user terminals; 1. A method for use in a system comprising: The calculation unit of the data processing device generating a secure private key and a secure public key; transmitting the secure public key and the secure private key encrypted using the system key obtained from the key management device to the storage device; The control unit in each of the plurality of user terminals, obtaining the secure public key from the storage device; generating a common encryption key for the user terminal by Diffie-Hellman key agreement using the user private key and the secure public key; encrypting the sensitive data using the common encryption key of the user terminal; transmitting the encrypted sensitive data to the storage device; The calculation unit of the data processing device obtaining the system key from the key management device; obtaining the encrypted secure private key and the user public keys of the plurality of user terminals, and the encrypted sensitive data from the storage device; decrypting the encrypted secure private key using the system key; generating the common encryption key between each of the plurality of user terminals and the data processing device by Diffie-Hellman key agreement using the user public keys of the plurality of user terminals and the decrypted secure private key; decrypting the encrypted sensitive data obtained from the storage device by each of the user terminals using the common encryption key of the data processing device; decrypting the encrypted machine learning model obtained from the storage device using the system key; A step of combining the records included in each of the decrypted sensitive data to create combined data; inputting the combined data into the machine learning model and outputting result data; a step of canceling the combination of the records included in the result data to create individual result data; encrypting the individual result data corresponding to the sensitive data using the common encryption key shared with the user terminal that stores the sensitive data corresponding to the individual result data; transmitting the encrypted individual result data to the storage device; The control unit of the user terminal acquiring, from the storage device, the encrypted individual result data corresponding to the sensitive data stored in the user terminal; decrypting the encrypted individual result data using the common encryption key of the user terminal; An information processing method comprising:

5. the storage unit of the user terminal stores learning data including a plurality of the records; the storage device stores the user public keys of each of the plurality of user terminals; The calculation unit of the data processing device generating said secure private key and said secure public key; transmitting the secure public key and the secure private key encrypted using the system key obtained from the key management device to the storage device; The control unit in each of the plurality of user terminals, generating the common encryption key of the user terminal by Diffie-Hellman key agreement using the user private key and the secure public key obtained from the storage device; encrypting the training data using the common encryption key of the user terminal; transmitting the encrypted training data to the storage device; The calculation unit of the data processing device acquiring the encrypted secure private key, the user public keys of the plurality of user terminals, and the encrypted training data from the storage device; decrypting the encrypted secure private key obtained from the storage device using the system key obtained from the key management device; generating the common encryption key between each of the plurality of user terminals and the data processing device by Diffie-Hellman key sharing using the user public keys of the plurality of user terminals acquired from the storage device and the decrypted secure private key; decrypting the learning data encrypted by each of the user terminals, which is acquired from the storage device, using the common encryption key of the data processing device; combining the records included in each of the decoded training data to generate combined training data; performing machine learning using the combined training data to generate or update the machine learning model; encrypting the machine learning model using the system key; transmitting the encrypted machine learning model to the storage device; The information processing method according to claim 4 , comprising:

6. each of the plurality of user terminals and the data processing device has a different common encryption key; the storage unit of the user terminal stores learning data including a plurality of the records; the control unit in each of the plurality of user terminals encrypts the training data using the common encryption key of the user terminal; The calculation unit of the data processing device a step of decrypting the encrypted learning data by each of the user terminals using the common encryption key of the data processing device; combining the records included in each of the decoded training data to generate combined training data; performing machine learning using the combined training data to generate or update the machine learning model; encrypting the machine learning model using the system key; transmitting the encrypted machine learning model to the storage device; The information processing method according to claim 4 , comprising:

7. An information processing method according to claim 2, claim 3, claim 5, or claim 6, wherein in the step of generating or updating the machine learning model, the machine learning model updated by the calculation unit is a model generated without the learning data stored in the multiple user terminals contributing to machine learning.

8. The information processing method according to claim 1 , wherein the system key is a key of a public key cryptosystem or a key of a common key cryptosystem.

9. The information processing method according to claim 1 , wherein the key management device is located within a trusted third-party certificate authority or within the data processing device.

10. the record includes at least one of an explanatory variable and a target variable, and an identifier for identifying the record; the calculation unit of the data processing device combines the records based on the identifiers, the combined records include the explanatory variables and the objective variable; The information processing method according to any one of claims 1 to 6.

11. a plurality of user terminals each having a control unit and a storage unit for storing sensitive data including a plurality of records; a data processing device having an arithmetic unit in a secure domain; a key management device that manages a system key; a storage device that stores a machine learning model encrypted using the system key; A program used in a system comprising: each of the plurality of user terminals and the data processing device has a different common encryption key; The control unit in each of the plurality of user terminals, encrypting the sensitive data using the common encryption key of the user terminal; The calculation unit of the data processing device retrieving the encrypted machine learning model from the storage device; decrypting the machine learning model using the system key obtained from the key management device; decrypting the sensitive data encrypted by each of the user terminals using the common encryption key of the data processing device; A step of combining the records included in each of the decrypted sensitive data to create combined data; inputting the combined data into the machine learning model and outputting result data; a step of canceling the combination of the records included in the result data to create individual result data; encrypting the individual result data using the common encryption key shared with the user terminal that stores the sensitive data corresponding to the individual result data; transmitting the encrypted individual result data to the storage device; The control unit of the user terminal acquiring, from the storage device, the encrypted individual result data corresponding to the sensitive data stored in the user terminal; decrypting the encrypted individual result data using the common encryption key of the user terminal; An information processing program comprising:

12. a plurality of user terminals each having a control unit, a user private key, a user public key, and a storage unit for storing sensitive data including a plurality of records; a data processing device having an arithmetic unit in a secure domain; a key management device that manages a system key; a storage device that stores a machine learning model encrypted using the system key and the user public keys of each of the plurality of user terminals; A program used in a system comprising: The calculation unit of the data processing device generating a secure private key and a secure public key; transmitting the secure public key and the secure private key encrypted using the system key obtained from the key management device to the storage device; The control unit in each of the plurality of user terminals, obtaining the secure public key from the storage device; generating a common encryption key for the user terminal by Diffie-Hellman key agreement using the user private key and the secure public key; encrypting the sensitive data using the common encryption key of the user terminal; transmitting the encrypted sensitive data to the storage device; The calculation unit of the data processing device obtaining the system key from the key management device; obtaining the encrypted secure private key and the user public keys of the plurality of user terminals, and the encrypted sensitive data from the storage device; decrypting the encrypted secure private key using the system key; generating the common encryption key between each of the plurality of user terminals and the data processing device by Diffie-Hellman key agreement using the user public keys of the plurality of user terminals and the decrypted secure private key; decrypting the encrypted sensitive data obtained from the storage device by each of the user terminals using the common encryption key of the data processing device; decrypting the encrypted machine learning model obtained from the storage device using the system key; A step of combining the records included in each of the decrypted sensitive data to create combined data; inputting the combined data into the machine learning model and outputting result data; a step of canceling the combination of the records included in the result data to create individual result data; encrypting the individual result data corresponding to the sensitive data using the common encryption key shared with the user terminal that stores the sensitive data corresponding to the individual result data; transmitting the encrypted individual result data to the storage device; The control unit of the user terminal acquiring, from the storage device, the encrypted individual result data corresponding to the sensitive data stored in the user terminal; decrypting the encrypted individual result data using the common encryption key of the user terminal; An information processing program comprising:

13. a plurality of user terminals each having a control unit and a storage unit for storing sensitive data including a plurality of records; a data processing device having an arithmetic unit in a secure domain; a key management device that manages a system key; a storage device that stores a machine learning model encrypted using the system key; A system comprising: each of the plurality of user terminals and the data processing device has a different common encryption key; The control unit in each of the plurality of user terminals, encrypting the sensitive data using the common encryption key of the user terminal; The calculation unit of the data processing device obtaining the encrypted machine learning model from the storage device; decrypting the machine learning model using the system key obtained from the key management device; decrypting the sensitive data encrypted by each of the user terminals using the common encryption key of the data processing device; combining the records included in each of the decrypted sensitive data to create combined data; inputting the combined data into the machine learning model and outputting result data; canceling the combination of the records included in the result data to create individual result data; encrypting the individual result data using the common encryption key with the user terminal that stores the sensitive data corresponding to the individual result data; transmitting the encrypted individual result data to the storage device; The control unit of the user terminal Obtaining the encrypted individual result data corresponding to the sensitive data stored in the user terminal from the storage device; decrypting the encrypted individual result data using the common encryption key of the user terminal; Information processing system.

14. a plurality of user terminals each having a control unit, a user private key, a user public key, and a storage unit for storing sensitive data including a plurality of records; a data processing device having an arithmetic unit in a secure domain; a key management device that manages a system key; a storage device that stores a machine learning model encrypted using the system key and the user public keys of each of the plurality of user terminals; A system comprising: The calculation unit of the data processing device generating a secure private key and a secure public key; transmitting the secure public key and the secure private key encrypted using the system key obtained from the key management device to the storage device; The control unit in each of the plurality of user terminals, obtaining the secure public key from the storage device; generating a common encryption key for the user terminal by Diffie-Hellman key sharing using the user private key and the secure public key; encrypting the sensitive data using the common encryption key of the user terminal; transmitting the encrypted sensitive data to the storage device; The calculation unit of the data processing device obtaining the system key from the key management device; acquiring the encrypted secure private key and the user public keys of the plurality of user terminals, and the encrypted sensitive data from the storage device; decrypting the encrypted secure private key using the system key; generating the common encryption key between each of the plurality of user terminals and the data processing device by Diffie-Hellman key sharing using the user public keys of the plurality of user terminals and the decrypted secure private key; decrypting the sensitive data encrypted by each of the user terminals, which is obtained from the storage device, using the common encryption key of the data processing device; decrypting the encrypted machine learning model obtained from the storage device using the system key; combining the records included in each of the decrypted sensitive data to create combined data; inputting the combined data into the machine learning model and outputting result data; canceling the combination of the records included in the result data to create individual result data; encrypting the individual result data corresponding to the sensitive data using the common encryption key with the user terminal that stores the sensitive data corresponding to the individual result data; transmitting the encrypted individual result data to the storage device; The control unit of the user terminal Obtaining the encrypted individual result data corresponding to the sensitive data stored in the user terminal from the storage device; decrypting the encrypted individual result data using the common encryption key of the user terminal; Information processing system.

Images