Secure computation device, secure computation method, and program

Abstract

This secure computation device includes: a former-half window frame flag sequence generation unit for generating a bit sequence obtained by computing an OR for all bits from an end to each respective position, with respect to a vector subVector({g→}, s+1, i) obtained by selecting out elements ranging from an s+1'th element to an i'th element of {g→}, as a former-half window frame flag sequence {wf→}; a latter-half window frame flag sequence generation unit for generating a bit sequence obtained by computing an OR for all bits from a beginning to each respective position, with respect to a vector subVector({g→}, i+1, t) obtained by selecting out elements ranging from an i+1'th element to a t'th element of {g→}, as a latter-half window frame flag sequence {wl→}; and a window frame flag sequence generation unit for combining the former-half window frame flag sequence {wf→} from the front end and the latter-half window frame flag sequence {wl→} from the rear end across {0}, thereby generating a window frame flag sequence {w→}.

Description

[Technical Field]

[0001] The present invention relates to a secure computing device, a secure computing method, and a program for performing secure computation on a database. [Background technology]

[0002] Window functions are functions that group records by key attribute and then use each row as the basis to perform aggregations within a "window" of a specified width. For example, if you want to aggregate the sum of one column before and after, the input and output will be as shown in Table 1. Please note that in this case, values ​​from different groups are not summed. [Table 1] The Group by function is similar to the Window function, but the difference is that the Group by function aggregates each group into a single value, whereas the Window function aggregates each row within a window frame and outputs the results. Prior art related to Group By is available in Patent Document 1 and Non-Patent Document 1. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6989006 [Non-patent literature]

[0004] [Non-Patent Document 1] Ryo Kikuchi, Hiroki Hamada, Dai Igarashi, and Gen Takahashi, "Let's try cross-sectional traffic analysis using secure computation," in SCIS2020 (2020 Symposium on Cryptography and Information Security), pp. 1-8, 2020. Summary of the Invention [Problem to be solved by the invention]

[0005] No literature has reported on a method for implementing window functions using secure computation. Among SQL functions, window functions require grouping by key attributes and then aggregation within the window frame. However, when implementing secure computation, a challenge arises in that calculations must be performed without looking at the contents while the grouping and window frame boundaries remain encrypted.

[0006] Therefore, an object of the present invention is to provide a secure computing device that can generate a window frame flag sequence for executing a window function in secure computation with low-cost calculations. [Means for solving the problem]

[0007] The secure computing device of the present invention uses a key string k → and a data column v, which is a column of values → The secure computing device performs computations while keeping a database including the above secret.

[0008] Group flag column g → represents a vector whose value is 1 at positions where the value of the key string changes and whose value is 0 elsewhere; the share of the value x obtained by the duplicated secret sharing is represented as {x}; the current row number is represented as i, the start position of the window as s, and the end position of the window as t; the number of rows in the key string and data string is represented as l; and the current row number i is incremented by 1 within the range from 0 to l each time all flag string generation processes are completed.

[0009] The secure computing device of the present invention includes a first half window frame flag sequence generating unit, a second half window frame flag sequence generating unit, and a window frame flag sequence generating unit.

[0010] The first half window frame flag sequence generator is →}, the vector subVector({g →},s+1,i), the bit string obtained by ORing all bits from the end to each position is called the first half window frame flag string {wf→} is generated.

[0011] The latter half of the window frame flag sequence generation part is →}, the vector subVector({g →},i+1,t), the bit string obtained by ORing all bits from the beginning to each position is called the second half window frame flag string {w l→} is generated.

[0012] The window frame flag sequence generator generates the first half window frame flag sequence {w f→} from the front, the second half of the window frame flag column {w l→} from the rear, with {0} in between, to create the window frame flag string {w →}. [Effects of the Invention]

[0013] According to the secure computing device of the present invention, it is possible to generate a window frame flag sequence for executing a window function in secure computation with low-cost calculations. [Brief explanation of the drawings]

[0014] [Figure 1] FIG. 1 is a block diagram showing the functional configuration of a secure computing device according to a first embodiment. [Figure 2] 10 is a flowchart showing the Max calculation operation of the window function of the secure computing device of the first embodiment. [Figure 3] 10 is a flowchart showing the Min calculation operation of the window function of the secure computing device of the first embodiment. [Figure 4] FIG. 11 is a block diagram showing the functional configuration of a secure computing device according to a fourth modification. [Figure 5] 10 is a flowchart showing the operation of a secure computing device according to a fourth modification. [Figure 6] FIG. 2 is a diagram showing an example of the functional configuration of a computer. DETAILED DESCRIPTION OF THE INVENTION

[0015] Hereinafter, embodiments of the present invention will be described in detail. Components having the same functions are given the same numbers, and duplicated explanations will be omitted.

[0016] <Notation> Vector v → The i-th element of the vector is v i → It is expressed as v → |u → is a vector v → u to the end of → σ(v → ) is v → represents a vector obtained by replacing the vector with σ.

[0017] Also, the vector v → The vector v' from i to j → The operation to extract v' → ←subVector(v → ,i,j).

[0018] c←max(a,b) is a calculation on plain text and outputs the larger value of plain text a or b. c←min(a,b) is a calculation on plain text and outputs the smaller value of plain text a or b.

[0019] <Secret sharing> Secret sharing is an encryption method in which data is divided into multiple values ​​and distributed to multiple parties. The secure computing device in the following embodiment encrypts data using (k, n) threshold secret sharing. (k, n) threshold secret sharing is a secret sharing scheme in which data is divided into n random values ​​(called shares), and the original data can be restored by collecting k or more shares, but information about the original data cannot be obtained from shares less than k. Specifically, the secure computing device in the following embodiment uses Shamir secret sharing (Reference Non-Patent Document 1) or cloning secret sharing (Reference Non-Patent Documents 2 and 3).

[0020] (Reference Non-Patent Document 1: Adi Shamir. How to share a secret. Communications of the ACM, Vol. 22, No. 11, pp. 612-613, 1979.) (Reference Non-Patent Document 2: Mitsuru Ito, Akira Saito, and Takao Nishizeki. Secret sharing scheme realizing general access structure. Electronics and Communications in Japan (Part III: Fundamental Electronic Science), Vol. 72, No. 9, pp. 56-64, 1989.) (Reference Non-Patent Document 3: Ronald Cramer, Ivan Damgard, and Yuval Ishai. Share conversion, pseudorandom secret-sharing and applications to secure computation. In Theory of Cryptography Conference, pp. 342-362. Springer, 2005.) In this specification, a share of a value x obtained by Shamir secret sharing is represented as [[x]]. A share of a value x obtained by duplication secret sharing is represented as {x}. Duplication secret sharing is particularly efficient for processing 1-bit data, so these terms are used in the following examples. Furthermore, a value obtained by sharing a substitution σ is represented as <σ>.

[0021] <Components> <Addition, subtraction, constant multiplication> Addition, subtraction, and constant multiplication between shares can be performed without communication. Addition, subtraction, and constant multiplication are written as follows:

[0022] [[x]]+[[y]], c[[x]] <<Multiply and add>> a → and b → The multiplication and accumulation operation is written as follows:

[0023] [[c]]←PSum([[a → ]],[[b → ]]) Logical operations The OR operation takes ciphertexts {a} and {b} of 1-bit values ​​a and b as input, and outputs ciphertext c, the result of the calculation aORb, and is written as follows:

[0024] {c}←Or({a},{b}) Other logical operations such as AND operation and XOR operation are described in the same way.

[0025] <Prefix / Suffix OR> PrefixOR is a bit string b → The output is a bit string that takes all the ORs from the beginning to each position. → Then, c i → ←c i-1 → ORb i → , where c0 → ←b0 → This is expressed as {c →}←PrefixOr({b →}) SuffixOR is written as c → This is an operation that returns a bit string obtained by ORing all bits from the end of to each position.

[0026] ≪Equal sign judgment≫ The equality test operation takes the variance values ​​of a and b [[a]], [[b]] ​​as input and outputs the variance value of the truth value c of a==b, and is written as follows:

[0027] {c}←Eq([[a]],[[b]]) <<Privacy-stable sorting>> The privacy stable sorting is a protocol for stably sorting a vector. The privacy stable sorting consists of the following algorithm: <π>←GenPerm([[k → ]]): key string k → Outputs a permutation π that stably sorts [[v' in ascending order.→ ]]←Sort(<π>,[[v → ]]):π to v → applied to and rearranged [[v' → ]] is output. Reference Non-Patent Document 4 and other documents are known as high-speed implementation methods for achieving this.

[0028] (Reference Non-Patent Document 4: Dai Igarashi, Hiroki Hamada, Ryo Kikuchi, Koji Senda, "Design and Implementation of Ultra-High-Speed ​​Secure Computation Sorting: The Day Secure Computation Stands on Top of Scripting Languages," Computer Security Symposium 2017 Proceedings 2017(2), pp. 1-8, 2017-10-16) When using a set of multiple columns as the key column, write it as follows. However, the first specified key will be sorted first.

[0029] <π>←GenPerm([[k1 → ]],[[k2 → ]]) <Modulus conversion> The process of converting 1-bit {a} to [[a]] is described as follows.

[0030] [[a]]←ModConv({a}) Specifically, the method of Kikuchi et al. in Reference Non-Patent Document 5 is known.

[0031] (Reference non-patent document 5: Ryo Kikuchi, Dai Ikarashi, Takahiro Matsuda, Koki Hamada, and Koji Chida. Efficient bitdecomposition and modulus-conversion protocols with an honest majority. In Willy Susilo and Guomin Yang, editors, Information Security and Privacy, pp. 64-82, Cham, 2018. Springer International Publishing.) <Common Processing> The common processing is a process in which a key string and a data string are given, and as output, a flag string in which the first element of a group is 1 when grouped by the same value of the key string, a data string sorted for each group, and a key string are returned. Specifically, this can be realized by the method of Kikuchi et al. (Non-Patent Document 1). Since it is closely related to the method disclosed in the following examples, details of the method of Kikuchi et al. (Non-Patent Document 1) are shown in Algorithm 1.

[0032] [Algorithm 1:GroupByCommon] Input: key sequence [[k → ]], data column [[v → ]], (where [[k → ]] is the number of lines l, [[v → ]] is the number of lines l) Output: Grouped key column [[k' → ]], grouped data column [[v' → ]], group flag column {g →}(However, [[k' → ]] is the number of rows l,[[v' → ]] is the number of rows l, {g →} is a vector of length l that is 1 only when it is the first position of the group and 0 otherwise.) 1:<σ>←GenPerm([[k → ]],[[v → ]]) 2:[[k' → ]]←Sort([[k → ]],<σ>) 3:[[v' → ]]←Sort([[v → ]],<σ>) 4:{eq →}0←{0};{g →}0←{1} 5:for 1≦i <l do in parallel 6:{eq →} i ←Eq([[k → ]] i-1 ,[[k → ]] i ) 7:{g →} i ←Not({eq →} i ) 8:end for 9:return [[k' → ]],[[v' → ]],{g →} [End of Algorithm 1] The first line of Algorithm 1 is the key column k → , data column v → σ is output by a privacy-stable sorting process.

[0033] The second line shows that σ determines the key sequence [[k → ]] is sorted secretly and stably, and the sorted result [[k' → This shows the process of outputting ]].

[0034] The third line shows the data sequence [[v → ]] is sorted secretly and stably, and the sorted result [[v' → This shows the process of outputting ]].

[0035] The fourth line is the vector {eq →} the first value {eq →}0 to {0} and set the group flag column {g →} the first value {g → This shows the process of setting}0 to {1}.

[0036] The fifth line indicates that the processing in the sixth and seventh lines is to be executed repeatedly.

[0037] The sixth line is the vector {eq →} the i-th value {eq →} i Eq([[k → ]] i-1 ,[[k → ]] i ), that is, the i-1th value of the key string [[k → ]] i-1 and the i-th value [[k → ]]i If they are equal, the value is 1, otherwise it is 0. Therefore, the vector eq → is a vector characterized by a series of 1s until it reaches a change in the value of the key string, then becomes 0 at the point where the value of the key string changes, and continues to be 1s until the next change in the value of the key string.

[0038] The seventh line is the group flag column {g →} the i-th value {g →} i Not({eq →} i ), that is, the group flag string g → represents a vector whose value is 1 at positions where the value of the key column changes, and whose value is 0 at other positions.

[0039] Line 8 indicates the end of the iteration, and line 9 returns the grouped key string [[k' → ]], grouped data column [[v' → ]], group flag column {g →}.

[0040] Below, Algorithm 2 shows details of a method unique to the present invention for generating a window frame flag sequence for executing a window function in secure computation.

[0041] [Algorithm 2:GenWindowFrame] Input: Group flag string {g →}, current line number i, window frame start position s, window frame end position t (where s≦i≦t) Output: window frame flags column {w →} 1:{w f→}←SuffixOr(subVector({g →},s+1,i)) 2:{w l→}←PrefixOr(subVector({g →},i+1,t)) 3:{w →}←{w f→}|{0}|{w l→} 4:return {w →} [End of Algorithm 2] The first line of Algorithm 2 is →}, the vector subVector({g →},s+1,i), the bit string obtained by ORing all bits from the end to each position is called the first half window frame flag string {w f→ Therefore, if a position where the value of the key string changes appears on the way from the end to the beginning, all elements located before this position will be 1, resulting in the value 1, ..., 1, 0, ..., 0.

[0042] The second line is {g →}, the vector subVector({g →},i+1,t), the bit string obtained by ORing all bits from the beginning to each position is called PrefixOr, and the bit string is called the second half window frame flag string {w l→ Therefore, if a position where the value of the key string changes appears on the way from the beginning to the end, all elements at the end of this position will be 1, resulting in the value 0,...,0,1,...,1.

[0043] The third and fourth lines are: f→} from the front, {w l→} from the rear, with {0} in between, to create {w →} is generated and output. In other words, {0} corresponds to the current line number. Vector w →has the characteristic that the value of 0 is displayed for elements that belong to the group that includes the current line number, and the value of 1 is displayed for elements that belong to a group different from the group that includes the current line number. For example, if the element corresponding to the current line number is expressed by placing >< between the elements, then the vector w → Possible output examples are 1,...,1,0,...,>0<,...,0,1,...,1.

[0044] The details of the method for calculating the Max operation of the window function are shown in Algorithm 3 below.

[0045] [Algorithm 3:WindowMax] Input: key sequence [[k → ]], data column [[v → ]], window frame start position offset poffset, window frame end position offset foffset (where [[k → ]] is the number of lines l, [[v → ]] is the number of lines l) Output: Grouped key column [[k' → ]], summary result column [[u → ]](where [[k' → ]] is the number of lines l, [[u → ]] is the number of lines l) 1:[[k' → ]], [[v' → ]], {g →}←GroupByCommon([[k → ]],[[v → ]]) 2:for 0≦i <l do in parallel 3: s←max(i-poffset,0) 4: t←min(i+foffset,l-1) 5:{w →}←GenWindowFrame({g →},i,s,t) 6:{w max ' →}←{w →}|{1} 7:{a max→}0←{1} 8:for 1≦j <t-s+1 do in parallel 9:{a max→} j ←{w max ' →} j-1 10:{b max→} j ←Xor({a max→} j ,{w max ' →} j ) 11:{m max ' →} j ←And({b max→} j ,{w max ' →} j ) 12:end for 13:{m max→}←subVector({m max ' →},1,ts) 14:[[m max→ ]]←ModConv({m max→}) 15:[[u → ]] i ←PSum([[m max→ ]],subVector([[v' → ]],s,t)) 16:end for 17:return [[k' → ]],[[u → ]] [End of Algorithm 3] The first line of Algorithm 3 is the grouped key string [[k' → ]], grouped data column [[v' → ]], group flag column {g →} is generated.

[0046] The second line indicates that the processing up to the 16th line is to be executed repeatedly.

[0047] The third line shows the process of calculating the window frame start position s as i-poffset, i.e., the position offset by the window frame start position offset poffset from the current row number i, and calculating the window frame start position s as s←max(i-poffset,0) in order to treat all exceptions where i-poffset is less than or equal to 0 as 0.

[0048] The fourth line shows the process of calculating the window frame end position t as i+foffset, i.e., the position offset by the window frame end position offset foffset from the current row number i, and calculating the window frame end position t as t←min(i+foffset,l-1) in order to process all exceptions where i+foffset is greater than or equal to l-1 as l-1.

[0049] The fifth line is the window frame flag column {w →} is calculated.

[0050] The sixth line is the window frame flag column {w →} to the end of the window frame flag string {w max ' → The 1 added to the end on line 6 acts as a sentinel, handling exceptions when there is no 1 at the end of the original bit string.

[0051] The seventh line is the right rotate flag string {a max→ This indicates the process of setting {1} to line 0 of}.

[0052] Line 8 indicates that the processing from lines 9 to 12 is to be executed repeatedly.

[0053] The 9th line is the right rotate flag column {a max→}, the elements from the 1st line to the tsth line are max ' →}, the elements from row 0 to row ts-1 are the right rotate flag column {a max→} is generated. max→} is roughly {w max ' →} is a flag string shifted one column to the right. For example, max ' → If =(1,1,1,0,0,0,1,1,1,1), then a max→ =(1,1,1,1,0,0,0,1,1,1), and the values ​​of each element are all shifted one column to the right. max→ The 0th line of w is set to 1 by the processing of the 7th line of Algorithm 3. max ' → The last element of is a max→ It will not remain.

[0054] The 10th line is the right rotate flag column {a max→} and trailing correction window frame flag column {w max ' →} and the right rotate boundary flag column {b max→ For example, the above w max ' → =(1,1,1,0,0,0,1,1,1,1), a max→ If =(1,1,1,1,0,0,0,1,1,1), then b max→ =(0,0,0,1,0,0,1,0,0,0), which means that the group boundaries have been extracted.

[0055] The 11th line is the right rotate boundary flag column {b max→} and trailing correction window frame flag column {w max ' →} and the end flag string {m max ' → For example, the above w max ' → =(1,1,1,0,0,0,1,1,1,1), b max→In the example of =(0,0,0,1,0,0,1,0,0,0), the AND operation results in m max ' → =(0,0,0,0,0,0,1,0,0,0), which shows that only the end position of the group has been identified.

[0056] The 12th line indicates the end of the loop, and the 13th line indicates the end of the loop. max ' →}, the elements from the first line to the ts line are extracted to create a subVector({m max ' →},1,ts) into the maximum value extraction flag string {m max→}.

[0057] Line 14 is the replica secret sharing share {m max→} to the Shamir secret sharing share [[m max→ ]]. Line 14 is performed to execute the PSum process in the following line 15.

[0058] Line 15 shows the data column [[v' → ]] the subVector([[v' → ]],s,t) and [[m max→ This means that only the last position of the group will have a value as a product, and all other products will be 0, so the aggregated result column [[u → ]] indicates the MAX value that appears at the end of the group.

[0059] Line 16 indicates the end of the iteration, and line 17 indicates the grouped key column [[k' → ]], summary result column [[u → This shows the process of outputting ]].

[0060] By executing GroupByCommon in the first line, the data column is sorted in ascending order within the group. Therefore, to calculate Max within the window frame, it is sufficient to obtain the last element within the group and the window frame.

[0061] First, in the fifth line, the flag string {w →}. → In Non-Patent Document 1,} is a flag string in which the element at the end of the group is indicated by 1, but if we consider it as a flag linked to the group boundary, we can reconsider it as a bit string in which the group boundary is indicated by 1. Then, as shown in Algorithm 2, by taking Suffix / Prefix OR in the up and down direction, it is possible to generate a flag string in which elements beyond the group boundary are 1. However, the current row is always included in the aggregation target, so the initial value is set to 0.

[0062] Using this flag sequence, lines 6 to 12 calculate the flag sequence where the position corresponding to such an element is 1. → is a sequence of 0 or more 1's followed by 1 or more 0's, followed by 0 or more 1's. The edge of the window is where 1 and 0 change places, so the required flag sequence {m max ' →} can be calculated.

[0063] Depending on the direction of rotation, either the top or the bottom can be obtained. If the data is sorted in ascending order, the Max value corresponds to the bottom, so it is rotated to the right. In line 15, the Max value is obtained using the flag column where the Max position is 1. The straightforward way is to use the vector [[v' → ]] is applied in order by IfThen (which requires multiplication), but by using PSum not only the calculation cost but also the amount of communication can be reduced.

[0064] Next, the details of the method for calculating the Min operation of the window function are shown in Algorithm 4 below.

[0065] [Algorithm 4:WindowMin] Input: key sequence [[k → ]], data column [[v → ]], window frame start position offset poffset, window frame end position offset foffset (where [[k → ]] is the number of rows l,[[v → ]] is the number of lines l) Output: Grouped key column [[k' → ]], summary result column [[u → ]](where [[k' → ]] is the number of rows l,[[u → ]] is the number of lines l) 1:[[k' → ]], [[v' → ]], {g →}←GroupByCommon([[k → ]],[[v → ]]) 2:for 0≦i <l do in parallel 3: s←max(i-poffset,0) 4: t←min(i+foffset,l-1) 5:{w →}←GenWindowFrame({g →},i,s,t) 6:{w min ' →}←{1}|{w →} 7:{a min→} t-s-1 ←{1} 8:for 0≦j <t-s do in parallel 9:{a min→} j ←{w min ' →} j+1 10:{b min→} j ←Xor({a min→} j ,{w min ' →} j ) 11:{m min ' →} j ←And({b min→} j ,{w min ' →} j ) 12:end for 13:{m min→}←subVector({m min ' →},0,ts-1) 14:[[m min→ ]]←ModConv({m min→}) 15:[[u → ]] i ←PSum([[m min→ ]],subVector([[v' → ]],s,t)) 16:end for 17:return [[k' → ]],[[u → ]] [End of Algorithm 4] Since Algorithm 4 has many processes in common with Algorithm 3, only the processes that are different from Algorithm 3 will be explained. In the case of Min, to obtain the first element in the group and in the window frame, the window frame flag sequence {w →} (line 6) by adding {1} (sentence) to the beginning of the window frame flag column {w min ' →}. Also, the left rotate flag column {a min→}, the elements from line 0 to line ts-1 are min ' →}, the elements from the 1st row to the tsth row are the left rotate flag column {a min→} to rotate left (line 9).

[0066] In SQL, the option for specifying the window frame start position is "UNBOUNDED PRECEDINGS", which indicates starting from the beginning of the group, and the option for specifying the window frame end position is "UNBOUNDED PRECEDINGS", which indicates going to the end of the group. Because the group flag is not a public value, poffset and foffset cannot be specified as the beginning / end of the group, but in the case of "UNBOUNDED PRECEDINGS", the same result can be achieved by setting the window frame start position offset to poffset=-n, and in the case of "UNBOUNDED FOLLOWING", the window frame end position offset to foffset=n. If "CURRENT ROW", which indicates the current row, is specified as the option for specifying the start / end positions, set the window frame start position / end position offset to 0. [Example]

[0067] Hereinafter, the configuration of the secure computing device of the first embodiment that executes Algorithms 3 and 4 to perform Max / Min calculations of window functions will be described with reference to FIG. As shown in the figure, the secure computing device 1 of this embodiment includes an input data storage unit 10A, a first half window frame flag sequence generation unit 10, a second half window frame flag sequence generation unit 11, a window frame flag sequence generation unit 12, an end correction window frame flag sequence generation unit 131, a right rotate flag sequence generation unit 141, a right rotate boundary flag sequence generation unit 151, an end flag sequence generation unit 161, a maximum value extraction flag sequence generation unit 171, a first share conversion unit 181, a first product-sum operation unit 191, a start correction window frame flag sequence generation unit 132, a left rotate flag sequence generation unit 142, a left rotate boundary flag sequence generation unit 152, a start flag sequence generation unit 162, a minimum value extraction flag sequence generation unit 172, a second share conversion unit 182, a second product-sum operation unit 192, and an output data storage unit 10B.

[0068] <Input data storage unit 10A> The input data storage unit 10A stores in advance the data to be input to the secure computing apparatus. In this embodiment, it is assumed that Algorithm 1 has already been executed, and the input data storage unit 10A stores the grouped key string [[k' → ]], grouped data column [[v' → ]], group flag column {g → The input data storage unit 10A also stores in advance a window frame start position offset poffset and a window frame end position offset foffset, which are parameters that can be arbitrarily set by the user.

[0069] When Algorithm 1 is also executed by this secure computing device, the input data storage unit 10A stores the key string [[k → ]], data column [[v → ]], the window frame start position offset poffset, and the window frame end position offset foffset may be stored in advance.

[0070] The detailed operation of each component will be described below with reference to FIGS.

[0071] <First half window frame flag sequence generation unit 10> The first-half window frame flag sequence generation unit 10 executes lines 3 to 5 of Algorithm 3 (or 4) (line 1 of Algorithm 2 referred to by line 5) according to the repetition condition on line 2 of Algorithm 3 (or 4).

[0072] Specifically, the first half window frame flag sequence generator 10 acquires the window frame start position s and the window frame end position t, and calculates {g →}, the vector subVector({g →},s+1,i), the bit string obtained by ORing all bits from the end to each position is called the first half window frame flag string {w f→} (S10).

[0073] <Second-half window frame flag sequence generation unit 11> The latter half window frame flag sequence generation unit 11 executes lines 3 to 5 of Algorithm 3 (or 4) (the second line of Algorithm 2 referred to by line 5) according to the repetition condition of line 2 of Algorithm 3 (or 4).

[0074] Specifically, the latter window frame flag sequence generator 11 acquires the window frame start position s and the window frame end position t, and →}, the vector subVector({g →},i+1,t), the bit string obtained by ORing all bits from the beginning to each position is called the second half window frame flag string {w l→} (S11).

[0075] <Window Frame Flag Sequence Generator 12> The window frame flag sequence generation unit 12 executes the fifth line of Algorithm 3 (or 4) (the third line of Algorithm 2 referred to by the fifth line) according to the repetition condition in the second line of Algorithm 3 (or 4).

[0076] Specifically, the window frame flag sequence generator 12 generates the first half window frame flag sequence {w f→} from the front, the second half of the window frame flag column {w l→} from the rear, with {0} in between, to create the window frame flag string {w →} is generated (S12).

[0077] The Max calculation operation of the window function of the secure computing apparatus 1 of this embodiment will be described below (see FIG. 2).

[0078] <End Correction Window Frame Flag Sequence Generator 131> The tail correction window frame flag sequence generation unit 131 executes the sixth line of Algorithm 3 according to the repetition condition in the second line of Algorithm 3.

[0079] Specifically, the end correction window frame flag sequence generator 131 generates a window frame flag sequence {w →} to the end of the window frame flag string {w max ' →} is generated (S131).

[0080] <Right Rotation Flag String Generator 141> The right rotate flag sequence generation unit 141 executes lines 7 and 9 of Algorithm 3 according to the iteration conditions in lines 2 and 8 of Algorithm 3.

[0081] Specifically, the right rotate flag string generation unit 141 generates the right rotate flag string {a max→}, the 0th row is {1}, and the right rotate flag column {a max→}, the elements from the 1st row to the tsth row are added to the end correction window frame flag column {w max ' →}, the elements from row 0 to row ts-1 are the right rotate flag column {a max→} is generated (S141).

[0082] <Right Rotation Boundary Flag String Generator 151> The right rotate boundary flag sequence generation unit 151 executes the tenth line of Algorithm 3 according to the iteration conditions in the second and eighth lines of Algorithm 3.

[0083] Specifically, the right rotate flag column {a max→} and trailing correction window frame flag column {w max ' →} and the right rotate boundary flag column {b max→} is generated (S151).

[0084] <Tail flag string generation unit 161> The tail flag string generation unit 161 executes the eleventh line of Algorithm 3 according to the repetition conditions in the second and eighth lines of Algorithm 3.

[0085] Specifically, the end flag sequence generator 151 generates the right rotate boundary flag sequence {b max→} and trailing correction window frame flag column {w max ' →} and the end flag string {m max ' →} is generated (S161).

[0086] <Maximum value extraction flag sequence generation unit 171> The maximum value extraction flag sequence generation unit 171 executes the thirteenth line of Algorithm 3 according to the iteration condition in the second line of Algorithm 3.

[0087] Specifically, the maximum value extraction flag sequence generation unit 171 extracts the maximum value from the tail flag sequence {m max ' →}, the subVector({m max ' →},1,ts) into the maximum value extraction flag string {m max→} (S171).

[0088] <First share conversion unit 181> The first share conversion unit 181 executes the 14th line of Algorithm 3 in accordance with the iteration condition in the 2nd line of Algorithm 3.

[0089] Specifically, the first share conversion unit 181 converts the maximum value extraction flag sequence {m max→} to the maximum value extraction flag string [[m max→ ]] (S181).

[0090] <First product-sum calculation unit 191> The first product-sum operation unit 191 executes the 15th line of Algorithm 3 in accordance with the iteration condition in the 2nd line of Algorithm 3.

[0091] Specifically, the first product-sum operation unit 191 calculates the data string [[v → ]] sorted in ascending order [[v'→ ]] the subVector ([[v' → ]],s,t) and maximum value extraction flag sequence [[m max→ ]] is multiplied and accumulated (S191).

[0092] The Min calculation operation of the window function of the secure computing apparatus 1 of this embodiment will be described below (see FIG. 3).

[0093] <Head Correction Window Frame Flag Sequence Generator 132> The head correction window frame flag sequence generation unit 132 executes the sixth line of Algorithm 4 according to the repetition condition in the second line of Algorithm 4.

[0094] Specifically, the leading correction window frame flag sequence generator 132 generates a window frame flag sequence {w →} to add {1} to the beginning of the window frame flag string {w min ' →} is generated (S132).

[0095] <Left Rotation Flag String Generator 142> The left rotate flag sequence generation unit 142 executes lines 7 and 9 of Algorithm 4 according to the iteration conditions in lines 2 and 8 of Algorithm 4.

[0096] Specifically, the left rotate flag sequence generator 142 generates a left rotate flag sequence {a min→}, the ts-1st line is set to {1}, and the left rotate flag column {a min→}, the elements from row 0 to row ts-1 are set as the leading correction window frame flag column {w min ' →}, the elements from the 1st row to the tsth row are the left rotate flag column {a min→} is generated (S142).

[0097] <Left Rotation Boundary Flag String Generator 152> The left rotate boundary flag sequence generation unit 152 executes the tenth line of Algorithm 4 according to the iteration conditions in the second and eighth lines of Algorithm 4.

[0098] Specifically, the left rotate boundary flag sequence generator 152 generates the left rotate flag sequence {a min→} and the leading correction window frame flag column {w min ' →} and the left rotate boundary flag column {b min→} is generated (S152).

[0099] <Head Flag Sequence Generator 162> The head flag sequence generation unit 162 executes the eleventh line of Algorithm 4 according to the repetition conditions in the second and eighth lines of Algorithm 4.

[0100] Specifically, the head flag sequence generator 162 generates the left rotate boundary flag sequence {b min→} and the leading correction window frame flag column {w min ' →} and the first flag string {m min ' →} is generated (S162).

[0101] <Minimum Value Extraction Flag Sequence Generator 172> The minimum value extraction flag sequence generation unit 172 executes the thirteenth line of Algorithm 4 according to the iteration condition in the second line of Algorithm 4.

[0102] Specifically, the minimum value extraction flag sequence generation unit 172 extracts the minimum value from the leading flag sequence {m min ' →}, the elements from the 0th row to the ts-1th row are extracted and used as a subVector({m min ' →},0,ts-1) into the minimum value extraction flag string {m min→} (S172).

[0103] <Second share conversion unit 182> The second share conversion unit 182 executes the 14th line of Algorithm 4 in accordance with the iteration condition in the 2nd line of Algorithm 4.

[0104] Specifically, the second share conversion unit 182 converts the minimum value extraction flag string {m min→} to the minimum value extraction flag string [[m min→ ]] (S182).

[0105] <Second product-sum calculation unit 192> The second product-sum operation unit 192 executes the 15th line of Algorithm 4 in accordance with the iteration condition in the 2nd line of Algorithm 4 (S192).

[0106] Specifically, the second product-sum operation unit 192 calculates the data string [[v → ]] sorted in ascending order [[v' → ]] the subVector ([[v' → ]],s,t) and the minimum value extraction flag sequence [[m min→ ]] is multiplied and accumulated (S192).

[0107] <Output data storage unit 10B> The output data storage unit 10B stores the output of Algorithm 3 or 4, [[k' → ]] and [[u → Remember ]].

[0108] <Modification> The secure computing apparatus 1 of the first embodiment is provided with both the Max calculation function and the Min calculation function of the window function, but the secure computing apparatus may have other configurations.

[0109] For example, the secure computing apparatus of Modification 1 only has a function for generating a window frame flag sequence. The secure computing apparatus of Modification 1 does not need to include 131, 141, 151, 161, 171, 181, 191, 132, 142, 152, 162, 172, 182, and 192. The output data storage unit 10B stores the output of Algorithm 2, [w→ ] is memorized.

[0110] According to the secure computing device of the first modification, a flag representing a window can be generated so as to be usable in subsequent aggregation processing. By utilizing this, it is possible to realize SQL window function calculations, which have not been realized in the past, by efficient bit manipulation and inexpensive product-sum operations, while keeping the grouping and window information encrypted. Therefore, the secure computing device of the first modification contributes to improving the functionality of computers.

[0111] Furthermore, for example, the secure computing apparatus of Modification 2 only has the Max calculation function of the window function. The secure computing apparatus of Modification 2 does not need to include 132, 142, 152, 162, 172, 182, and 192.

[0112] According to the secure computing device of Modification 2, it is possible to realize Max calculation of SQL window function, which has not been realized in the past, while keeping the grouping and window frame information encrypted, by efficient bit manipulation and low-cost product-sum calculation, etc. Therefore, the secure computing device of Modification 2 contributes to improving the functionality of a computer.

[0113] Furthermore, for example, the secure computing apparatus of Modification 3 only has the Min calculation function of the window function. The secure computing apparatus of Modification 3 does not need to include 131, 141, 151, 161, 171, 181, and 191.

[0114] According to the secure computing device of Modification 3, it is possible to realize the Min operation of the SQL window function, which has not been realized in the past, while keeping the grouping and window frame information encrypted, by efficient bit manipulation and low-cost product-sum operations, etc. Therefore, the secure computing device of Modification 3 contributes to improving the functionality of a computer.

[0115] Also, as shown in Figures 4 and 5, the secure computing device may be configured with a database 2 configured with data before anonymization, a data anonymization unit 3 that anonymizes the data in the database 2, and a secure computing unit 1 that performs the same processing as the secure computing device 1 (secure computing device 100 of variant example 4, steps S3 and S1).

[0116] <Additional Notes> The device of the present invention may, for example, be a single hardware entity having an input unit to which a keyboard or the like can be connected, an output unit to which an LCD display or the like can be connected, a communication unit to which a communication device (e.g., a communication cable) capable of communicating with an external device can be connected, a CPU (which may also include a central processing unit, cache memory, registers, etc.), memories such as RAM and ROM, an external storage device such as a hard disk, and buses connecting these input unit, output unit, communication unit, CPU, RAM, ROM, and external storage device so that data can be exchanged between them. If necessary, the hardware entity may also be provided with a device (drive) capable of reading and writing to a recording medium such as a CD-ROM. A physical entity equipped with such hardware resources includes a general-purpose computer.

[0117] The external storage device of the hardware entity stores the programs required to realize the above-mentioned functions and the data required for processing these programs (the programs may be stored in a ROM, which is a read-only storage device, for example, instead of an external storage device). Data obtained by processing these programs is stored in RAM, the external storage device, etc. as appropriate.

[0118] In a hardware entity, each program stored in an external storage device (or ROM, etc.) and the data required to process each program are loaded into memory as needed, and interpreted, executed, and processed by the CPU as appropriate, resulting in the CPU realizing a predetermined function (each component represented as a unit, means, etc., above).

[0119] The present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the spirit of the present invention. Furthermore, the processes described in the above embodiments may not only be executed in chronological order according to the order described, but may also be executed in parallel or individually depending on the processing capacity of the device that executes the processes or as needed.

[0120] As described above, when the processing functions of the hardware entities (apparatuses of the present invention) described in the above embodiments are realized by a computer, the processing contents of the functions that the hardware entities should have are described by a program. Then, by executing this program on a computer, the processing functions of the hardware entities are realized on the computer.

[0121] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 10020 of the computer 10000 shown in Figure 6 and operating the control unit 10010, input unit 10030, output unit 10040, etc.

[0122] The program describing the processing contents can be recorded on a computer-readable recording medium. Examples of computer-readable recording media include magnetic recording devices, optical disks, magneto-optical recording media, and semiconductor memories. Specifically, examples of magnetic recording devices include hard disk drives, flexible disks, and magnetic tapes; optical disks include DVDs (Digital Versatile Discs), DVD-RAMs (Random Access Memory), CD-ROMs (Compact Disc Read Only Memory), and CD-Rs (Recordable) / RWs (Rewritable); magneto-optical recording media include MOs (Magneto-Optical discs), and semiconductor memories include EEP-ROMs (Electrically Erasable and Programmable-Read Only Memory).

[0123] The program may be distributed, for example, by selling, transferring, lending, etc. a portable recording medium such as a DVD or CD-ROM on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to another computer via a network, thereby distributing the program.

[0124] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the received program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. In this embodiment, the program includes information used for processing by a computer that is equivalent to a program (such as data that is not a direct instruction to the computer but has properties that define computer processing).

[0125] In addition, in this embodiment, a hardware entity is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

Claims

1. Key column k, which is the attribute column → and a data column v, which is a column of values → A secure computing device that performs computations while keeping a database including Group flag column g → represents a vector whose value is 1 at positions where the value of the key string changes and whose value is 0 at other positions, Let {x} denote the shared secret of a value x. Let i denote the current line number, s the window frame start position, and t the window frame end position. The number of rows in the key string and the data string is set to l, and the current row number i is incremented by 1 within the range of 0 to l each time all flag string generation processes are completed once; {g → }, the vector subVector({g → },s+1,i), the bit string obtained by ORing all bits from the end to each position is called the first half window frame flag string {w f→ }, and {g → }, the vector subVector({g → },i+1,t), the bit string obtained by ORing all bits from the beginning to each position is called the second half window frame flag string {w l→ }, and The first half window frame flag sequence {w f→ } from the front, the latter half of the window frame flag column {w l→ } from the rear, with {0} in between, to create the window frame flag string {w → }, including the window frame flag sequence generator Secret computing device.

2. 2. The secure computing device according to claim 1, Let [[x]] denote the Shamir secret sharing share of value x, The window frame flag column {w → } to the end of the window frame flag string {w max ' → a tail correction window frame flag sequence generator that generates a tail correction window frame flag sequence}; Right rotate flag column {a max→ }, the elements from the 1st row to the tsth row are converted into the end correction window frame flag column {w max ' → }, the right rotate flag column {a max→ }; The right rotate flag column {a max→ } and the trailing correction window frame flag string {w max ' → } and the right rotate boundary flag column {b max→ a right rotate boundary flag sequence generator that generates a right rotate boundary flag sequence}; The right rotate boundary flag column {b max→ } and the trailing correction window frame flag string {w max ' → } and the end flag string {m max ' → a tail flag string generator that generates a tail flag string}; The tail flag string {m max ' → }, the subVector({m max ' → },1,ts) into the maximum value extraction flag string {m max→ }, and The maximum value extraction flag sequence {m max→ } to the maximum value extraction flag string [[m max→ a share converter that converts Data column [[v →< / sup >]] sorted in ascending order [[v' →< / sup >]] the subVector ([[v' → ]],s,t) and maximum value extraction flag sequence [[m max→ ]] includes a multiply-and-accumulate unit that performs the multiply-and-accumulate operation Secret computing device.

3. 2. The secure computing device according to claim 1, Let [[x]] denote the Shamir secret sharing share of value x, The window frame flag column {w → } to add {1} to the beginning of the window frame flag string {w min ' → a head correction window frame flag sequence generator that generates a head correction window frame flag sequence; Left rotate flag column {a min→ }, the elements from the 0th row to the ts-1th row are set as the leading correction window frame flag column {w min ' → }, the elements from the first row to the tsth row are the left rotate flag column {a min→ }; The left rotate flag column {a min→ } and the leading correction window frame flag string {w min ' → } and the left rotate boundary flag column {b min→ }; The left rotate boundary flag column {b min→ } and the leading correction window frame flag string {w min ' → } and the first flag string {m min ' → a head flag string generator that generates a head flag string}; The first flag string {m min ' → }, the elements from the 0th row to the ts-1th row are extracted and used as a subVector({m min ' → },0,ts-1) into the minimum value extraction flag string {m min→ }, and The minimum value extraction flag sequence {m min→ } to the minimum value extraction flag string [[m min→ a share converter that converts Data column [[v →< / sup >]] sorted in ascending order [[v' →< / sup >]] the subVector ([[v' → ]],s,t) and the minimum value extraction flag sequence [[m min→ ]] includes a multiply-and-accumulate unit that performs the multiply-and-accumulate operation Secret computing device.

4. Key column k, which is the attribute column → and a data column v, which is a column of values → A secure computation method executed by a secure computing device while keeping a database including Group flag column g → represents a vector whose value is 1 at positions where the value of the key string changes and whose value is 0 at other positions, Let {x} denote the shared secret of a value x. Let i denote the current line number, s the window start position, and t the window end position. The number of rows in the key string and the data string is set to l, and the current row number i is incremented by 1 within the range of 0 to l each time all flag string generation processes are completed once; {g → }, the vector subVector({g → },s+1,i), the bit string obtained by ORing all bits from the end to each position is called the first half window frame flag string {w f→ }; {g → }, the vector subVector({g → },i+1,t), the bit string obtained by ORing all bits from the beginning to each position is called the second half window frame flag string {w l→ }; The first half window frame flag sequence {w f→ } from the front, the latter half of the window frame flag column {w l→ } from the rear, with {0} in between, to create the window frame flag string {w → } Secret calculation method.

5. 5. The secure computation method according to claim 4, Let [[x]] denote the Shamir secret sharing share of value x, The window frame flag column {w → } to the end of the window frame flag string {w max ' → }; Right rotate flag column {a max→ }, the elements from the 1st row to the tsth row are converted into the end correction window frame flag column {w max ' → }, the right rotate flag column {a max→ }; The right rotate flag column {a max→ } and the trailing correction window frame flag string {w max ' → } and the right rotate boundary flag column {b max→ }; The right rotate boundary flag column {b max→ } and the trailing correction window frame flag string {w max ' → } and the end flag string {m max ' → }; The tail flag string {m max ' → }, the subVector({m max ' → },1,ts) into the maximum value extraction flag string {m max→ }; The maximum value extraction flag sequence {m max→ } to the maximum value extraction flag string [[m max→< / sup >]], and Data column [[v →< / sup >]] sorted in ascending order [[v' →< / sup >]] the subVector ([[v' → ]],s,t) and maximum value extraction flag sequence [[m max→ ]] includes a step of performing a multiply-and-accumulate operation Secret calculation method.

6. 5. The secure computation method according to claim 4, Let [[x]] denote the Shamir secret sharing share of value x, The window frame flag column {w → } to add {1} to the beginning of the window frame flag string {w min ' → }; Left rotate flag column {a min→ }, the elements from the 0th row to the ts-1th row are set as the leading correction window frame flag column {w min ' → }, the elements from the first row to the tsth row are the left rotate flag column {a min→ }; The left rotate flag column {a min→ } and the leading correction window frame flag string {w min ' → } and the left rotate boundary flag column {b min→ }; The left rotate boundary flag column {b min→ } and the leading correction window frame flag string {w min ' → } and the first flag string {m min ' → }; The first flag string {m min ' → }, the elements from the 0th row to the ts-1th row are extracted and used as a subVector({m min ' → },0,ts-1) into the minimum value extraction flag string {m min→ }; The minimum value extraction flag sequence {m min→ } to the minimum value extraction flag string [[m min→ ]]; Data column [[v →< / sup >]] sorted in ascending order [[v' →< / sup >]] the subVector ([[v' → ]],s,t) and the minimum value extraction flag sequence [[m min→ ]] includes a step of performing a multiply-and-accumulate operation Secret calculation method.

7. A program that causes a computer to function as the secure computing device according to any one of claims 1 to 3.

Images