Secure computation device, secure computation method, and program

Abstract

This secure computation device includes: a first half window frame flag column generation unit that generates, as \{wf→\}, a bit string obtained by, regarding subVector(\{g→\}, s+1, i), operating OR of all bits from the end to each position; a latter half window frame flag column generation unit that generates, as \{wl→\}, a bit string obtained by, regarding subVector(\{g→\}, i+1, t), operating OR of all bits from the head to each position; a window frame flag column generation unit that generates \{w→\} by coupling \{wf→\} and \{wl→\}; an inverted window frame flag column generation unit that generates \{w'→\} by performing NOT operation on \{w→\}; a share conversion unit that converts \{w'→\} into [[w'→]]; and a product-sum operation unit that executes a product sum operation of subVector([[v' →]], s, t) and [[w'→]].

Description

[Technical Field]

[0001] The present invention relates to a secure computing device, a secure computing method, and a program for performing secure computation on a database. [Background technology]

[0002] Window functions are functions that group records by key attribute and then use each row as the basis to perform aggregations within a "window" of a specified width. For example, if you want to aggregate the sum of one column before and after, the input and output will be as shown in Table 1. Please note that in this case, values ​​from different groups are not summed. [Table 1] The Group by function is similar to the Window function, but the difference is that the Group by function aggregates each group into a single value, whereas the Window function aggregates each row within a window frame and outputs the results. Prior art related to Group By is available in Patent Document 1 and Non-Patent Document 1. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6989006 [Non-patent literature]

[0004] [Non-Patent Document 1] Ryo Kikuchi, Hiroki Hamada, Dai Igarashi, and Gen Takahashi, "Let's try cross-sectional traffic analysis using secure computation," in SCIS2020 (2020 Symposium on Cryptography and Information Security), pp. 1-8, 2020. Summary of the Invention [Problem to be solved by the invention]

[0005] No literature has reported on a method for implementing window functions using secure computation. Among SQL functions, window functions require grouping by key attributes and then aggregation within the window frame. However, when implementing secure computation, a challenge arises in that calculations must be performed without looking at the contents while the grouping and window frame boundaries remain encrypted.

[0006] Therefore, an object of the present invention is to provide a secure computing device that can calculate the sum of window functions at low cost. [Means for solving the problem]

[0007] The secure computing device of the present invention uses a key string k → and a data column v, which is a column of values → The secure computing device performs computations while keeping a database including the above secret.

[0008] Group flag column g → represents a vector whose value is 1 where the value of the key string changes and whose value is 0 elsewhere; a share of value x obtained by replication secret sharing is represented as {x}; a share of value x obtained by Shamir secret sharing is represented as [[x]]; the current row number is represented as i, the start position of the window as s, and the end position of the window as t; the number of rows in the key string and data string is represented as l; and the current row number i is incremented by 1 within the range from 0 to l each time all flag string generation processes are completed.

[0009] The secure computing device of the present invention includes a first half window frame flag sequence generating unit, a second half window frame flag sequence generating unit, a window frame flag sequence generating unit, an inverted window frame flag sequence generating unit, a share conversion unit, and a product-sum operation unit. →}, the vector subVector({g →},s+1,i), the bit string obtained by ORing all bits from the end to each position is called the first half window frame flag string {w f→} is generated.

[0010] The latter half of the window frame flag sequence generation part is →}, the vector subVector({g →},i+1,t), the bit string obtained by ORing all bits from the beginning to each position is called the second half window frame flag string {w l→} is generated.

[0011] The window frame flag sequence generator generates the first half window frame flag sequence {w f→} from the front, the second half of the window frame flag column {w l→} from the rear, with {0} in between, to create the window frame flag string {w →}.

[0012] The reverse window frame flag sequence generator generates a window frame flag sequence {w →}, the reverse window frame flag string {w' →}.

[0013] The share conversion part is a reverse window frame flag sequence {w' →} Invert window frame flag column [[w' → ]].

[0014] The multiply-and-accumulate part calculates the data sequence [[v → ]] sorted in ascending order [[v' → ]] the subVector ([[v' → ]],s,t) and the reverse window frame flag sequence [[w' → ]] performs a multiply-and-accumulate operation. [Effects of the Invention]

[0015] According to the secure computing device of the present invention, it is possible to calculate the sum of window functions at low cost. [Brief explanation of the drawings]

[0016] [Figure 1] FIG. 1 is a block diagram showing the functional configuration of a secure computing device according to a first embodiment. [Figure 2] 4 is a flowchart showing the operation of the secure computing device of the first embodiment. [Figure 3] FIG. 10 is a block diagram showing the functional configuration of a secure computing device according to a first modification. [Figure 4] 10 is a flowchart showing the operation of a secure computing device according to a first modification. [Figure 5] FIG. 2 is a diagram showing an example of the functional configuration of a computer. DETAILED DESCRIPTION OF THE INVENTION

[0017] Hereinafter, embodiments of the present invention will be described in detail. Components having the same functions are given the same numbers, and duplicated explanations will be omitted.

[0018] <Notation> Vector v → The i-th element of the vector is v i → It is expressed as v → |u → is a vector v → u to the end of → σ(v → ) is v → represents a vector obtained by replacing the vector with σ.

[0019] Also, the vector v → The vector v' from i to j → The operation to extract v' → ←subVector(v → ,i,j).

[0020] c←max(a,b) is a calculation on plain text and outputs the larger value of plain text a or b. c←min(a,b) is a calculation on plain text and outputs the smaller value of plain text a or b.

[0021] <Secret sharing> Secret sharing is an encryption method in which data is divided into multiple values ​​and distributed to multiple parties. The secure computing device in the following embodiment encrypts data using (k, n) threshold secret sharing. (k, n) threshold secret sharing is a secret sharing scheme in which data is divided into n random values ​​(called shares), and the original data can be restored by collecting k or more shares, but information about the original data cannot be obtained from shares less than k. Specifically, the secure computing device in the following embodiment uses Shamir secret sharing (Reference Non-Patent Document 1) or cloning secret sharing (Reference Non-Patent Documents 2 and 3).

[0022] (Reference Non-Patent Document 1: Adi Shamir. How to share a secret. Communications of the ACM, Vol. 22, No. 11, pp. 612-613, 1979.) (Reference Non-Patent Document 2: Mitsuru Ito, Akira Saito, and Takao Nishizeki. Secret sharing scheme realizing general access structure. Electronics and Communications in Japan (Part III: Fundamental Electronic Science), Vol. 72, No. 9, pp. 56-64, 1989.) (Reference Non-Patent Document 3: Ronald Cramer, Ivan Damgard, and Yuval Ishai. Share conversion, pseudorandom secret-sharing and applications to secure computation. In Theory of Cryptography Conference, pp. 342-362. Springer, 2005.) In this specification, a share of a value x obtained by Shamir secret sharing is represented as [[x]]. A share of a value x obtained by duplication secret sharing is represented as {x}. Duplication secret sharing is particularly efficient for processing 1-bit data, so these terms are used in the following examples. Furthermore, a value obtained by sharing a substitution σ is represented as <σ>.

[0023] <Components> <Addition, subtraction, constant multiplication> Addition, subtraction, and constant multiplication between shares can be performed without communication. Addition, subtraction, and constant multiplication are written as follows:

[0024] [[x]]+[[y]], c[[x]] <<Multiply and add>> a → and b → The multiplication and accumulation operation is written as follows:

[0025] [[c]]←PSum([[a → ]],[[b → ]]) Logical operations The OR operation takes ciphertexts {a} and {b} of 1-bit values ​​a and b as input, and outputs ciphertext c, the result of the calculation aORb, and is written as follows:

[0026] {c}←Or({a},{b}) Other logical operations such as AND operation and XOR operation are described in the same way.

[0027] <Prefix / Suffix OR> PrefixOR is a bit string b → The output is a bit string that takes all the ORs from the beginning to each position. → Then, c i → ←c i-1 → ORb i → , where c0 → ←b0 → This is expressed as {c →}←PrefixOr({b→}) SuffixOR is written as c → This is an operation that returns a bit string obtained by ORing all bits from the end of to each position.

[0028] ≪Equal sign judgment≫ The equality test operation takes the variance values ​​of a and b [[a]], [[b]] ​​as input and outputs the variance value of the truth value c of a==b, and is written as follows:

[0029] {c}←Eq([[a]],[[b]]) <<Privacy-stable sorting>> The privacy stable sorting is a protocol for stably sorting a vector. The privacy stable sorting consists of the following algorithm: <π>←GenPerm([[k → ]]): key string k → Outputs a permutation π that stably sorts [[v' in ascending order. → ]]←Sort(<π>,[[v → ]]):π to v → applied to and rearranged [[v' → ]] is output. Non-patent document 4 is known as a high-speed implementation method for achieving this.

[0030] (Reference Non-Patent Document 4: Dai Igarashi, Hiroki Hamada, Ryo Kikuchi, Koji Senda, "Design and Implementation of Ultra-High-Speed ​​Secure Computation Sorting: The Day Secure Computation Stands on Top of Scripting Languages," Computer Security Symposium 2017 Proceedings 2017(2), pp. 1-8, 2017-10-16) When using a set of multiple columns as the key column, write it as follows. However, the first specified key will be sorted first.

[0031] <π>←GenPerm([[k1 → ]],[[k2 → ]]) <Modulus conversion> The process of converting 1-bit {a} to [[a]] is described as follows.

[0032] [[a]]←ModConv({a}) Specifically, the method of Kikuchi et al. in Reference Non-Patent Document 5 is known.

[0033] (Reference non-patent document 5: Ryo Kikuchi, Dai Ikarashi, Takahiro Matsuda, Koki Hamada, and Koji Chida. Efficient bitdecomposition and modulus-conversion protocols with an honest majority. In Willy Susilo and Guomin Yang, editors, Information Security and Privacy, pp. 64-82, Cham, 2018. Springer International Publishing.) <Common Processing> The common processing is a process in which a key string and a data string are given, and as output, a flag string in which the first element of a group is 1 when grouped by the same value of the key string, a data string sorted for each group, and a key string are returned. Specifically, this can be realized by the method of Kikuchi et al. (Non-Patent Document 1). Since it is closely related to the method disclosed in the following examples, details of the method of Kikuchi et al. (Non-Patent Document 1) are shown in Algorithm 1.

[0034] [Algorithm 1:GroupByCommon] Input: key sequence [[k → ]], data column [[v → ]], (where [[k → ]] is the number of lines l, [[v → ]] is the number of lines l) Output: Grouped key column [[k' → ]], grouped data column [[v' → ]], group flag column {g →}(However, [[k' → ]] is the number of rows l,[[v' → ]] is the number of rows l, {g →} is a vector of length l that is 1 only when it is the first position of the group and 0 otherwise.) 1:<σ>←GenPerm([[k → ]],[[v → ]]) 2:[[k' → ]]←Sort([[k → ]],<σ>) 3:[[v' → ]]←Sort([[v → ]],<σ>) 4:{eq →}0←{0};{g →}0←{1} 5:for 1≦i <l do in parallel 6:{eq →} i ←Eq([[k → ]] i-1 ,[[k → ]] i ) 7:{g →} i ←Not({eq →} i ) 8:end for 9:return [[k' → ]],[[v' → ]],{g →} [End of Algorithm 1] The first line of Algorithm 1 is the key column k → , data column v → σ is output by a privacy-stable sorting process.

[0035] The second line shows that σ determines the key sequence [[k → ]] is sorted secretly and stably, and the sorted result [[k' → This shows the process of outputting ]].

[0036] The third line shows the data sequence [[v → ]] is sorted secretly and stably, and the sorted result [[v' → This shows the process of outputting ]].

[0037] The fourth line is the vector {eq →} the first value {eq →}0 to {0} and set the group flag column {g →} the first value {g → This shows the process of setting}0 to {1}.

[0038] The fifth line indicates that the processing in the sixth and seventh lines is to be executed repeatedly.

[0039] The sixth line is the vector {eq →} the i-th value {eq →} i Eq([[k → ]] i-1 ,[[k → ]] i ), that is, the i-1th value of the key string [[k → ]] i-1 and the i-th value [[k → ]] i If they are equal, the value is 1, otherwise it is 0. Therefore, the vector eq → is a vector characterized by a series of 1s until it reaches a change in the value of the key string, then becomes 0 at the point where the value of the key string changes, and continues to be 1s until the next change in the value of the key string.

[0040] The seventh line is the group flag column {g →} the i-th value {g →} i Not({eq →} i ), that is, the group flag string g → represents a vector whose value is 1 at positions where the value of the key column changes, and whose value is 0 at other positions.

[0041] Line 8 indicates the end of the iteration, and line 9 returns the grouped key string [[k' → ]], grouped data column [[v' → ]], group flag column {g →}.

[0042] Below, Algorithm 2 shows details of a method unique to the present invention for generating a window frame flag sequence for executing a window function in secure computation.

[0043] [Algorithm 2:GenWindowFrame] Input: Group flag string {g →}, current line number i, window frame start position s, window frame end position t (where s≦i≦t) Output: window frame flags column {w →} 1:{w f→}←SuffixOr(subVector({g →},s+1,i)) 2:{w l→}←PrefixOr(subVector({g →},i+1,t)) 3:{w →}←{w f→}|{0}|{w l→} 4:return {w →} [End of Algorithm 2] The first line of Algorithm 2 is →}, the vector subVector({g →},s+1,i), the bit string obtained by ORing all bits from the end to each position is called the first half window frame flag string {w f→ Therefore, if a position where the value of the key string changes appears on the way from the end to the beginning, all elements located before this position will be 1, resulting in the value 1, ..., 1, 0, ..., 0.

[0044] The second line is {g →}, the vector subVector({g →},i+1,t), the bit string obtained by ORing all bits from the beginning to each position is called PrefixOr, and the bit string obtained by ORing all bits from the beginning to each position is called the second half window frame flag string {w l→ Therefore, if a position where the value of the key string changes appears on the way from the beginning to the end, all elements at the end of this position will be 1, resulting in the value 0,...,0,1,...,1.

[0045] The third and fourth lines are: f→} from the front, {w l→} from the rear, with {0} in between, to create {w →} is generated and output. In other words, {0} corresponds to the current line number. Vector w → has the characteristic that the value of 0 is displayed for elements that belong to the group that includes the current line number, and the value of 1 is displayed for elements that belong to a group different from the group that includes the current line number. For example, if the element corresponding to the current line number is expressed by placing >< between the elements, then the vector w → Possible output examples are 1,...,1,0,...,>0<,...,0,1,...,1.

[0046] The details of the method for calculating the sum of the window functions are shown in Algorithm 3 below.

[0047] [Algorithm 3:WindowSum] Input: key sequence [[k → ]], data column [[v → ]], window frame start position offset poffset, window frame end position offset foffset (where [[k → ]] is the number of lines l, [[v → ]] is the number of lines l) Output: Grouped key column [[k' → ]], summary result column [[u → ]](where [[k' →]] is the number of lines l, [[u → ]] is the number of lines l) 1:[[k' → ]], [[v' → ]], {g →}←GroupByCommon([[k → ]],[[v → ]]) 2:for 0≦i <l do in parallel 3: s←max(i-poffset,0) 4: t←min(i+foffset,l-1) 5:{w →}←GenWindowFrame({g →},i,s,t) 6:{w' →}←Not({w} → ) 7:[[w' → ]]←ModConv({w' →}) 8:[[u → ]] i ←PSum([[w' → ]],subVector([[v' → ]],s,t)) 9:end for 10:return [[k' → ]],[[u → ]] [End of Algorithm 3] The first line of Algorithm 3 is the grouped key string [[k' → ]], grouped data column [[v' → ]], group flag column {g →} is generated.

[0048] The second line indicates that the processing up to the ninth line is to be executed repeatedly.

[0049] The third line shows the process of calculating the window frame start position s as i-poffset, i.e., the position offset by the window frame start position offset poffset from the current row number i, and calculating the window frame start position s as s←max(i-poffset,0) in order to treat all exceptions where i-poffset is less than or equal to 0 as 0.

[0050] The fourth line shows the process of calculating the window frame end position t as i+foffset, i.e., the position offset by the window frame end position offset foffset from the current row number i, and calculating the window frame end position t as t←min(i+foffset,l-1) in order to process all exceptions where i+foffset is greater than or equal to l-1 as l-1.

[0051] The fifth line is the window frame flag column {w →} is calculated.

[0052] The sixth line is the window frame flag column {w →}, the reverse window frame flag string {w' → Line 7 shows the process of generating the replica secret sharing share {w' →} to the Shamir secret sharing share [[w' → ]]. Line 7 is performed to execute the PSum process in the following line 8.

[0053] The 8th line shows the data column [[v' → ]] the subVector([[v' → ]],s,t) and [[w' → This means that only the target position will have a product value, and all other products will be 0, so the total result column [[u → ]] indicates the result of the Sum operation for the aggregation target. Line 9 indicates the end of the iteration, and line 10 indicates the grouped key column [[k'→ ]], summary result column [[u → This shows the process of outputting ]].

[0054] By executing GroupByCommon in the first line, the data column is sorted in ascending order within the group.

[0055] First, in the fifth line, the flag string {w →}. → In Non-Patent Document 1,} is a flag string in which the element at the end of the group is indicated by 1, but if we consider it as a flag linked to the group boundary, we can reconsider it as a bit string in which the group boundary is indicated by 1. Then, as shown in Algorithm 2, by taking Suffix / Prefix OR in the up and down direction, it is possible to generate a flag string in which elements beyond the group boundary are 1. However, the current row is always included in the aggregation target, so the initial value is set to 0.

[0056] As mentioned above, →} is a flag string where the position to be counted is 0 and the other positions are 1. To calculate the sum within the window frame, → v' corresponds to the position where is 0 → Just add up the elements of .

[0057] Therefore, in the sixth line, the flag column {w →}, the flag sequence {w' →} is being calculated.

[0058] Vector [[v' → ]] can also be calculated by applying IfThen (which requires multiplication) to each element in order and adding up all the elements, but by using PSum instead, not only can the calculation cost be reduced, but also the amount of communication can be reduced.

[0059] In SQL, the option for specifying the window frame start position is "UNBOUNDED PRECEDINGS", which indicates starting from the beginning of the group, and the option for specifying the window frame end position is "UNBOUNDED PRECEDINGS", which indicates going to the end of the group. Because the group flag is not a public value, poffset and foffset cannot be specified as the beginning / end of the group, but in the case of "UNBOUNDED PRECEDINGS", the same result can be achieved by setting the window frame start position offset to poffset=-n, and in the case of "UNBOUNDED FOLLOWING", the window frame end position offset to foffset=n. If "CURRENT ROW", which indicates the current row, is specified as the option for specifying the start / end positions, set the window frame start position / end position offset to 0. [Example]

[0060] The configuration of a secure computing device of Example 1 that performs a sum operation of a window function by executing Algorithm 3 will be described below with reference to Fig. 1. As shown in the figure, the secure computing device 1 of this example includes an input data storage unit 10A, a first half window frame flag sequence generation unit 10, a second half window frame flag sequence generation unit 11, a window frame flag sequence generation unit 12, an inverted window frame flag sequence generation unit 13, a share conversion unit 14, a product-sum operation unit 15, and an output data storage unit 10B.

[0061] <Input data storage unit 10A> The input data storage unit 10A stores in advance the data to be input to the secure computing apparatus. In this embodiment, it is assumed that Algorithm 1 has already been executed, and the input data storage unit 10A stores the grouped key string [[k' → ]], grouped data column [[v' → ]], group flag column {g → The input data storage unit 10A also stores in advance a window frame start position offset poffset and a window frame end position offset foffset, which are parameters that can be arbitrarily set by the user.

[0062] When Algorithm 1 is also executed by this secure computing device, the input data storage unit 10A stores the key string [[k → ]], data column [[v → ]], the window frame start position offset poffset, and the window frame end position offset foffset may be stored in advance.

[0063] The detailed operation of each component will be described below with reference to FIG.

[0064] <First half window frame flag sequence generation unit 10> The first-half window frame flag sequence generation unit 10 executes lines 3 to 5 of Algorithm 3 (line 1 of Algorithm 2 referred to by line 5) according to the repetition condition in line 2 of Algorithm 3.

[0065] Specifically, the first half window frame flag sequence generator 10 acquires the window frame start position s and the window frame end position t, and calculates {g →}, the vector subVector({g →},s+1,i), the bit string obtained by ORing all bits from the end to each position is called the first half window frame flag string {w f→} (S10).

[0066] <Second-half window frame flag sequence generation unit 11> The latter-half window frame flag sequence generation unit 11 executes lines 3 to 5 of Algorithm 3 (line 2 of Algorithm 2 referred to by line 5) according to the repetition condition in line 2 of Algorithm 3.

[0067] Specifically, the latter window frame flag sequence generator 11 acquires the window frame start position s and the window frame end position t, and →}, the vector subVector({g →},i+1,t), the bit string obtained by ORing all bits from the beginning to each position is called the second half window frame flag string {w l→} (S11).

[0068] <Window Frame Flag Sequence Generator 12> The window frame flag sequence generation unit 12 executes the fifth line of Algorithm 3 (the third line of Algorithm 2 referred to by the fifth line) according to the repetition condition in the second line of Algorithm 3.

[0069] Specifically, the window frame flag sequence generator 12 generates the first half window frame flag sequence {w f→} from the front, the second half of the window frame flag column {w l→} from the rear, with {0} in between, to create the window frame flag string {w →} is generated (S12).

[0070] <Reverse window frame flag sequence generation unit 13> The reverse window frame flag sequence generation unit 13 executes the sixth line of Algorithm 3 according to the iteration condition in the second line of Algorithm 3.

[0071] Specifically, the reverse window frame flag sequence generator 13 generates a window frame flag sequence {w →}, the reverse window frame flag string {w' →} is generated (S13). <Share conversion unit 14> The share conversion unit 14 executes the seventh line of Algorithm 3 according to the iteration condition in the second line of Algorithm 3.

[0072] Specifically, the share conversion unit 14 converts the reverse window frame flag string {w' →} Invert window frame flag column [[w' → ]] (S14).

[0073] <Product-sum calculation unit 15> The product-sum operation unit 15 executes the eighth line of Algorithm 3 according to the iteration condition in the second line of Algorithm 3.

[0074] Specifically, the product-sum calculation unit 15 calculates the data string [[v → ]] sorted in ascending order [[v' → ]] the subVector ([[v' → ]],s,t) and the reverse window frame flag sequence [[w' → ]] is multiplied and accumulated (S15).

[0075] <Output data storage unit 10B> The output data storage unit 10B stores the output of Algorithm 3, [[k' → ]] and [[u → Remember ]].

[0076] <Modification> As shown in Figures 3 and 4, the secure computing device may be composed of a database 2 consisting of data before anonymization, a data anonymization unit 3 that anonymizes the data in the database 2, and a secure computing unit 1 that performs the same processing as the secure computing device 1 (secure computing device 100 of variant example 1, steps S3 and S1).

[0077] <Additional Notes> The device of the present invention may, for example, be a single hardware entity having an input unit to which a keyboard or the like can be connected, an output unit to which an LCD display or the like can be connected, a communication unit to which a communication device (e.g., a communication cable) capable of communicating with an external device can be connected, a CPU (which may also include a central processing unit, cache memory, registers, etc.), memories such as RAM and ROM, an external storage device such as a hard disk, and buses connecting these input unit, output unit, communication unit, CPU, RAM, ROM, and external storage device so that data can be exchanged between them. If necessary, the hardware entity may also be provided with a device (drive) capable of reading and writing to a recording medium such as a CD-ROM. A physical entity equipped with such hardware resources includes a general-purpose computer.

[0078] The external storage device of the hardware entity stores the programs required to realize the above-mentioned functions and the data required for processing these programs (the programs may be stored in a ROM, which is a read-only storage device, for example, instead of an external storage device). Data obtained by processing these programs is stored in RAM, the external storage device, etc. as appropriate.

[0079] In a hardware entity, each program stored in an external storage device (or ROM, etc.) and the data required to process each program are loaded into memory as needed, and interpreted, executed, and processed by the CPU as appropriate, resulting in the CPU realizing a predetermined function (each component represented as a unit, means, etc., above).

[0080] The present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the spirit of the present invention. Furthermore, the processes described in the above embodiments may not only be executed in chronological order according to the order described, but may also be executed in parallel or individually depending on the processing capacity of the device that executes the processes or as needed.

[0081] As described above, when the processing functions of the hardware entities (apparatuses of the present invention) described in the above embodiments are realized by a computer, the processing contents of the functions that the hardware entities should have are described by a program. Then, by executing this program on a computer, the processing functions of the hardware entities are realized on the computer.

[0082] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 10020 of the computer 10000 shown in Figure 5 and operating the control unit 10010, input unit 10030, output unit 10040, etc.

[0083] The program describing the processing contents can be recorded on a computer-readable recording medium. Examples of computer-readable recording media include magnetic recording devices, optical disks, magneto-optical recording media, and semiconductor memories. Specifically, examples of magnetic recording devices include hard disk drives, flexible disks, and magnetic tapes; optical disks include DVDs (Digital Versatile Discs), DVD-RAMs (Random Access Memory), CD-ROMs (Compact Disc Read Only Memory), and CD-Rs (Recordable) / RWs (Rewritable); magneto-optical recording media include MOs (Magneto-Optical discs), and semiconductor memories include EEP-ROMs (Electrically Erasable and Programmable-Read Only Memory).

[0084] The program may be distributed, for example, by selling, transferring, lending, etc. a portable recording medium such as a DVD or CD-ROM on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to another computer via a network, thereby distributing the program.

[0085] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the received program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. In this embodiment, the program includes information used for processing by a computer that is equivalent to a program (such as data that is not a direct instruction to the computer but has properties that define computer processing).

[0086] In addition, in this embodiment, a hardware entity is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

Claims

1. Key column k, which is an attribute column → and a data column v, which is a column of values → A secure computing device that performs computations while keeping a database including Group flag column g → represents a vector whose value is 1 at positions where the value of the key string changes and whose value is 0 at other positions, Let {x} denote the shared secret of a value x. Let [[x]] denote the Shamir secret sharing share of value x, Let i denote the current line number, s the window frame start position, and t the window frame end position. The number of rows in the key string and the data string is set to l, and the current row number i is incremented by 1 within the range of 0 to l each time all flag string generation processes are completed once; {g → }, the vector subVector({g → },s+1,i), the bit string obtained by ORing all bits from the end to each position is called the first half window frame flag string {w f→ }, and {g → }, the vector subVector({g → },i+1,t), the bit string obtained by ORing all bits from the beginning to each position is called the second half window frame flag string {w l→ }, and The first half window frame flag sequence {w f→ } from the front, the latter half of the window frame flag column {w l→ } from the rear, with {0} in between, to create the window frame flag string {w → a window frame flag sequence generator that generates a window frame flag sequence}; The window frame flag column {w → }, the reverse window frame flag string {w' → a reverse window frame flag sequence generator that generates a reverse window frame flag sequence}; The reverse window frame flag sequence {w' → } Invert window frame flag column [[w' → a share converter that converts Data column [[v →< / sup >]] sorted in ascending order [[v' →< / sup >]] the subVector ([[v' → ]],s,t) and the reverse window frame flag sequence [[w' → ]] includes a multiply-and-accumulate unit that performs the multiply-and-accumulate operation Secret computing device.

2. Key column k, which is an attribute column → and a data column v, which is a column of values → A secure computation method executed by a secure computing device while keeping a database including Group flag column g → represents a vector whose value is 1 at positions where the value of the key string changes and whose value is 0 at other positions, Let {x} denote the shared secret of a value x. Let [[x]] denote the Shamir secret sharing share of value x, Let i denote the current line number, s the window frame start position, and t the window frame end position. The number of rows in the key string and the data string is set to l, and the current row number i is incremented by 1 within the range of 0 to l each time all flag string generation processes are completed once; {g → }, the vector subVector({g → },s+1,i), the bit string obtained by ORing all bits from the end to each position is called the first half window frame flag string {w f→ }; {g → }, the vector subVector({g → },i+1,t), the bit string obtained by ORing all bits from the beginning to each position is called the second half window frame flag string {w l→ }; The first half window frame flag sequence {w f→ } from the front, the latter half of the window frame flag column {w l→ } from the rear, with {0} in between, to create the window frame flag string {w → }; The window frame flag column {w → }, the reverse window frame flag string {w' → }; The reverse window frame flag sequence {w' → } Invert window frame flag column [[w' → ]]; Data column [[v →< / sup >]] sorted in ascending order [[v' →< / sup >]] the subVector ([[v' → ]],s,t) and the reverse window frame flag sequence [[w' → ]] includes a step of performing a multiply-and-accumulate operation Secret computation method.

3. A program that causes a computer to function as the secure computing device according to claim 1.

Images