Secure computation device, secure computation method, and program

Abstract

This secure computation device comprises: a dummy record separation sorting unit that performs sorting on a table such that a case where a corresponding record comes to a higher rank if the record is not a dummy record is firstly prioritized, and a key column is secondly prioritized; a boundary flag generation unit that generates a boundary flag indicating whether a record is a boundary; an addition value generation unit that generates an addition value by adding all values, which are positioned at the rank higher than the value of a given record, to said value; a boundary sort unit for performing stable sorting on the table such that a case where a record being the boundary comes to a higher rank is prioritized; a difference value generation unit that generates a difference value by setting an addition value of the highest rank record in the table as the difference value, and setting, for an addition value for each of records in the second highest rank and thereafter in the table, a difference between the addition value and an addition value of a record at the next higher rank as the difference value; and a calculation result output unit that outputs a table including a key column, a difference value column, and a boundary flag column.

Description

[Technical Field]

[0001] The present invention relates to a secure computing device, a secure computing method, and a program for performing set operations on data having an encrypted dummy flag string while keeping the data encrypted. [Background technology]

[0002] To handle data safely, research is being conducted on a technology called secure computation, which analyzes data while it remains encrypted. Among these, encrypted database processing is being considered to efficiently extract data that meets certain conditions and calculate aggregate values ​​while keeping the data encrypted.

[0003] Group-by operation, a type of DB processing, is a grouping process that takes a table as input, groups it by the values ​​of a specified column, and in some cases calculates statistics for each group and outputs them in table format. A method for doing this while keeping the data encrypted is proposed in Non-Patent Document 1. The input and output considered here was a normal table in which each element was encrypted. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Ryo Kikuchi, Hiroki Hamada, Dai Igarashi, Hajime Takahashi, Katsumi Takahashi, "Cross-sectional Traffic Analysis Using Secure Computing," in SCIS, 2020. Summary of the Invention [Problem to be solved by the invention]

[0005] On the other hand, when database processing is performed while the data is encrypted, the input and output differ from normal tables in that dummy records are inserted and a dummy flag column (a column of dummy flags indicating whether the corresponding record is a dummy record) may be added.

[0006] In the case of such input, the algorithm proposed in Non-Patent Document 1 does not work. This is because, in addition to the input format being different, it has been assumed that all records have meaningful values ​​up until now, so it has not been possible to skip dummy records during processing, and the value of v, which should be ignored, affects the final result, making it impossible to obtain the intended result.

[0007] Therefore, an object of the present invention is to provide a secure computing device that can perform set operations on data having an encrypted dummy flag string while keeping the data encrypted. [Means for solving the problem]

[0008] The secure computing device of the present invention is a secure computing device that performs a Groupby-sum operation on an encrypted first table that includes a key string, a value string, and a dummy flag string that indicates whether the corresponding record is a dummy record, while keeping it secret based on the key string, and includes a dummy record separation sorting unit, a boundary flag generation unit, an additive value generation unit, a boundary sorting unit, a differential value generation unit, and an operation result output unit.

[0009] The dummy record separation sorting unit sorts the first table with the first priority being that a corresponding record that is not a dummy record is placed at the top, and the second priority being the key column. The boundary flag generation unit defines the first case as a case where a record is not a dummy record and the key of that record is different from the key of the record immediately below it, the second case as a case where a record is not a dummy record and the record immediately below it is a dummy record, and the third case as a case where a record is not a dummy record and is the lowest record. If any of the first to third cases applies, the boundary flag is generated with a flag value indicating that the record is a boundary, and if none of the first to third cases apply, the boundary flag is generated with a flag value indicating that the record is not a boundary. The additive value generation unit adds all values ​​located above a given record to the value of the given record and generates the additive value for the given record. The boundary sorting unit stably sorts the second table including the key column, additive value column, and boundary flag column with the priority being that boundary records are placed at the top. The differential value generation unit uses the sum of the top record in the second table as the differential value, and generates differential values ​​for the sum of the second and subsequent records in the second table by taking the difference between the sum of the record immediately above it as the differential value. The calculation result output unit outputs a third table including a key string, a differential value string, and a boundary flag string. [Effects of the Invention]

[0010] According to the secure computing device of the present invention, it is possible to perform set operations on data having an encrypted dummy flag string while keeping the data encrypted. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 2 is a diagram for explaining an outline of encrypted data (first table) input to a secure computing device. [Figure 2] FIG. 1 is a block diagram showing the functional configuration of a secure computing device according to a first embodiment. [Figure 3]4 is a flowchart showing the operation of the secure computing device of the first embodiment. [Figure 4] FIG. 10 is a diagram showing an example of a first table input to a secure computing device. [Figure 5] FIG. 10 is a diagram showing an example of a first table after processing by a dummy record separation sorting unit. [Figure 6] FIG. 10 is a diagram showing an example of a first table after processing by a boundary flag generation unit. [Figure 7] FIG. 10 is a diagram showing an example of a first table after processing by an additive value generation unit. [Figure 8] FIG. 10 is a diagram showing an example of a second table after processing by the boundary sorting unit. [Figure 9] FIG. 10 is a diagram showing an example of a second table after processing by a differential value generation unit. [Figure 10] FIG. 10 is a diagram showing an example of a third table output by the calculation result output unit. [Figure 11] FIG. 10 is a diagram showing an example of a third table output by a second calculation result output unit. [Figure 12] FIG. 10 is a diagram showing an algorithm up to the processing (steps S11 to S16) of the secure computing device. [Figure 13] FIG. 10 is a diagram showing an algorithm up to the processing (steps S11 to S17) of the secure computing device. [Figure 14] FIG. 2 is a diagram showing an example of the functional configuration of a computer. DETAILED DESCRIPTION OF THE INVENTION

[0012] <Components> Write the encrypted data as [x] and the vector x → = (x1, … , x n ) and write [x → ] = ([x1], … , [x n ]).

[0013] The encryption is performed using secret sharing (for example, Non-Patent Document 1) or homomorphic encryption (for example, Non-Patent Document 2), etc., which allows the following calculations to be performed in the encrypted state.

[0014] (Reference non-patent document 1: Dai Ikarashi, Ryo Kikuchi, Koki Hamada, and Koji Chida. Actively private and correct MPC scheme in t < n / 2 from passively secure schemes with small overhead. IACR Cryptology ePrint Archive, Vol. 2014, p. 304, 2014.) (Reference non-patent document 2: Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. Fully homomorphic encryption without bootstrapping. Electronic Colloquium on Computational Complexity (ECCC), Vol. 18, p. 111, 2011.) Since different encryptions may be used for the stored values, we write the normal secret encryption as [·], bit values ​​as [[·]], and permutations as <π>.

[0015] <Addition, subtraction, constant multiplication> Secret sharing and homomorphic encryption have natural support: c[a] ± [b] = [ca ± b], etc.

[0016] Multiplication In the case of secret sharing, it can be calculated using the method described in Non-Patent Document 1, and in the case of homomorphic encryption, it can be calculated using homomorphic operations. This can be written as [c] ← Mult([a], [b]) (where c = ab).

[0017] Stable sorting Input [x → ] = ([x1], … , [x n ]) for i ∈ {1, … , n - 1}, i ≦x' i+1 [x' such that → ] = ([x'1] , … , [x' n]) except for x' i = x' i+1 When the original x → The order of the following is given priority. More specifically, it consists of two algorithms (GenPerm, Sort).

[0018] <π> ← GenPerm([x → ]): x → The permutation π that rearranges the π is output as <π>, which is encrypted.

[0019] ·[x' → ] ←Sort(<π>, [x → ]): π to x → and rearranged x' → is calculated while still encrypted.

[0020] For simplicity, when sorting multiple vectors with the same permutation, ([x' → ], [y' → ]) ← Sort(<π>, ([x → ], [y → ])) etc. The obvious way to configure it is to use a sorting network. In addition, there are efficient secret sharing methods such as Non-Patent Document 3.

[0021] (Reference non-patent document 3: Koji Chida, Koki Hamada, Dai Ikarashi, Ryo Kikuchi, Naoto Kiribuchi, and Benny Pinkas. An efficient secure three-party sorting protocol with an honest majority. IACR Cryptology ePrint Archive, Vol. 2019, p. 695, 2019.) Modulus conversion This method takes the encrypted bit value [[a]] as input and generates the same encrypted value [a] but with a different ciphertext form. It is written as [a] ← ModConv([[a]]). Specific examples can be found in, for example, Reference Non-Patent Document 4.

[0022] (Reference non-patent document 4: Ryo Kikuchi, Dai Ikarashi, Takahiro Matsuda, Koki Hamada, and Koji Chida. Efficient bitdecomposition and modulus-conversion protocols with an honest majority. In ACISP 2018, pp.64-82, 2018.) Bit decomposition A method of taking an integer value [k] as input and generating the same value [[k]] as the bit representation of k, but with a different ciphertext form. → ]] ← BitDecomp([k → ]) where k → = (k1, k2, … , k l ), then k =Σ l i=1 2 i-1 k i A specific example is given in Non-Patent Document 4.

[0023] ≪Equal sign judgment≫ It takes inputs [x] and [y] and outputs [e] such that if x = y then it is 1, and if x ≠ y then it is 0. It is written as [e] ← Eq([x], [y]), where e = {1 if x = y | 0 otherwise}. Also, when testing the equality of multiple elements, it can be written as [e] ← Eq(([a], [b]), ([c], [d])) where e = {1 if a = c and b = d | 0 otherwise}.

[0024] Generally, if data is encrypted in bit representation, it is sufficient to perform a circuit calculation to determine whether each bit of [x - y] is 0, and this can be done using addition, subtraction, and multiplication. If data is encrypted in integer representation, it is sufficient to convert it to bit representation using bit decomposition (Reference Non-Patent Document 4) and perform a similar circuit calculation. Alternatively, if data is encrypted on mod p, it is sufficient to perform a circuit calculation to determine whether each bit of [(x - y) p-1 ] can also be calculated using multiplication.

[0025] If-then A method that takes flag [f], where f ∈ {0, 1}, and [x], [y] as input, and outputs [x] if f = 1, and [y] if f = 0. Written as [e] ←Ifthen([f] : [x], [y]), where e = {x if f = 1 | y otherwise}. This can be achieved by Mult([f], [x]) + Mult([1 - f], [y]), etc.

[0026] <<Input definition>> Number of records m, key k → , value v → , flag f → The flag is a bit share. If it is not a bit, it is converted to a bit using the bit decomposition protocol. Figure 1 shows an overview of the encrypted data (first table) input to the secure computing device.

[0027] Hereinafter, embodiments of the present invention will be described in detail. Components having the same functions will be assigned the same numbers, and duplicate explanations will be omitted. In the following description of the embodiments and in the drawings, the symbol [[ ]] indicating encrypted data of a bit value may be abbreviated to [ ] in some cases. [Example]

[0028] The functional configuration of the secure computing device of the first embodiment will be described below with reference to Fig. 2. The secure computing device 1 of the first embodiment is a secure computing device 1 that performs a Groupby-sum operation on an encrypted first table, which includes a key string, a value string, and a dummy flag string indicating whether or not a corresponding record is a dummy record, based on the key string while keeping it confidential, and includes a dummy record separation and sorting unit 11, a boundary flag generation unit 12, an addition value generation unit 13, a boundary sorting unit 14, a differential value generation unit 15, a computation result output unit 16, and a second computation result output unit 17, as shown in the figure.

[0029] The operation of each component will be described below with reference to FIG.

[0030] <Dummy record separation sorting part 11> The dummy record separation sorting unit 11 sorts the first table with the first priority being that the corresponding record is not a dummy record, and the second priority being the key string (S11). The processing of the dummy record separation sorting unit 11 corresponds to the processing of lines 1 to 4 of the algorithm illustrated in FIG.

[0031] 4 is input to the secure computing apparatus 1 and processed by the dummy record separation and sorting unit 11 will be described below with reference to the first to fourth lines of the algorithm. In the algorithm in the example of FIG. 12, if the corresponding record is not a dummy record, [f → ]=[1]. In other words, if the corresponding record is a dummy record, → ]=[0].

[0032] Therefore, the dummy record separation sorting unit 11 → ] (line 2 of the algorithm) as the key with the first priority, and sort the records in ascending order (lines 3 and 4 of the algorithm). Alternatively, the dummy record separation sorting unit 11 → ] as the first priority key and sort the records in descending order. →] is used as the second-priority key to sort the records (lines 3 and 4 of the algorithm).

[0033] 5 shows the first table after processing the first table shown in FIG. 4 by the dummy record separation sorting unit 11. The records of the sorting result are [k' → ], [v' → ], [f' → ] and is expressed by adding a comma.

[0034] As shown in Figure 5, the non-dummy records ([f → ] = [1]) are collected at the top, and [k → ] is sorted in ascending order.

[0035] <Boundary flag generation unit 12> The boundary flag generation unit 12 defines the case where a record is not a dummy record and the key of that record is different from the key of the record immediately below as the first case, the case where a record is not a dummy record and the record immediately below is a dummy record as the second case, and the case where a record is not a dummy record and is the record located at the bottom as the third case, and generates a boundary flag having a flag value indicating that the record is a boundary if it falls under any of the first to third cases, and having a flag value indicating that the record is not a boundary if it falls under none of the first to third cases (S12). The processing by the boundary flag generation unit 12 corresponds to the processing on lines 5 to 10 of the algorithm illustrated in FIG.

[0036] Below, a case where the first table shown in FIG. 5 is processed by the boundary flag generation unit 12 will be described with reference to lines 5 to 10 of the algorithm.

[0037] In the example of Figure 5, if the i-th record is not a dummy record (m is the number of records in the table, i = 1, ... , m - 1), then f' i = 1), and the key of the i + 1th record is different (k' i≠k' i+1 ) case (first case) corresponds to the records in the second and third lines, and the records in the second and third lines contain [e' → ] = [0] is assigned (line 6 of the algorithm).

[0038] Also, if the i-th record is not a dummy record (f' i = 1), the i + 1th record is a dummy record (f' i+1 = 0) (the second case), the record in the fifth row corresponds to this case, and the record in the fifth row contains [e' → ] = [0] is assigned (line 7 of the algorithm).

[0039] Also, if a record is not a dummy record and is the lowest record (f' m = 1) (third case), corresponds to the case where no dummy records exist, so there is no corresponding record in the example of Figure 5. However, if such a record exists, [e' → ] = [0] is assigned (line 8 of the algorithm).

[0040] In the example of FIG. 5, the records that do not fall under any of the first to third cases are the 1st, 4th, 7th, and 8th rows, which are not boundaries. → ] = [1] will be assigned.

[0041] FIG. 6 shows the first table after the boundary flag generating unit 12 processes the first table shown in FIG.

[0042] <Addition value generation unit 13> The addition value generation unit 13 adds all values ​​that are higher than a certain record to the value of that record, and generates the result as the addition value of that record (S13). The processing of the addition value generation unit 13 corresponds to the processing of lines 11 and 12 of the algorithm illustrated in FIG.

[0043] Hereinafter, a case where the first table shown in FIG. 6 is processed by the additive value generation unit 13 will be described with reference to lines 11 and 12 of the algorithm.

[0044] In the example of Figure 6, the value of the i-th record [v' i ], the value ([v'1] + … + [v' i-1 ]) and add all of them together ([x i ] = [v'1] + … + [v' i ]) and the sum of the i-th record [x i ]. Note that for the highest value [v'1], there is no value higher than that record, so [x1] = [v'1].

[0045] Fig. 7 shows the first table after the first table shown in Fig. 6 is processed by the addition value generation unit 13. As shown in Fig. 7, [x1] = [v'1] = [2], [x2] = [v'1] + [v'2] = [2] + [3] = [5], [x3] = [v'1] + [v'2] + [v'3] = [2] + [3] + [1] = [6], ...

[0046] <Boundary sorting part 14> The boundary sorting unit 14 stably sorts the second table including the key string, the addition value string, and the boundary flag string, giving priority to placing boundary records at the top (S14). The processing by the boundary sorting unit 14 corresponds to the processing on lines 13 and 14 of the algorithm illustrated in FIG.

[0047] Below, a case where the first table shown in FIG. 7 is processed by the boundary sorting unit 14 will be described with reference to lines 13 and 14 of the algorithm.

[0048] In the example of Figure 7, the key string [k' → ] and the sum value column [x → ] and boundary flag string [e' →], and the second table is extracted from the boundary flag column [e' → ] as the key, and the boundary record ([e' → ] = [0]) is prioritized to be at the top.

[0049] The second table after the boundary sorting unit 14 processes the first table shown in FIG. 7 is shown in FIG. 8. The records of the sorting result are [k'' → ], [x' → ], [e'' → ] and "'" are added. As shown in Figure 8, → It can be seen that the record where [0] = [0] has been moved to a higher position. It can also be seen that the order of the records in rows 1-2 and 6-7 has been maintained by stable sorting. Note that in order to simplify the explanation by omitting unnecessary columns, the second table is extracted from the first table in the processing of step S14, but this extraction processing is not essential, and simply sorting the first table shown in FIG. 7 is sufficient.

[0050] <Differential value generation unit 15> The differential value generation unit 15 uses the sum of the top record in the second table as the differential value, and generates differential values ​​for the sum of the second and subsequent records in the second table by taking the difference between the sum and the sum of the record immediately above it as the differential value. The processing of the differential value generation unit 15 corresponds to the processing of lines 15 and 16 of the algorithm illustrated in FIG.

[0051] Hereinafter, a case where the second table shown in FIG. 8 is processed by the differential value generating unit 15 will be described with reference to lines 15 and 16 of the algorithm.

[0052] In the example of FIG. 8, the differential value generation unit 15 sets the sum value of the top record in the second table as the differential value ([x1'] = [x1'']), and sets the sum value of the second and subsequent records in the second table ([x' i], i = 2, ... ,m), the sum of the record immediately above it ([x' i-1 ]) and the difference value ([x'' i ] = [x' i ] - [x' i-1 ]) to generate the difference value.

[0053] FIG. 9 shows the second table after the second table shown in FIG. 8 is processed by the differential value generation unit 15. As shown in FIG. 9, [x''1] = [x'1] = [5], [x''2] = [x'2] - [x'1] = [6] - [5] = [1], [x''3] = [x'3] - [x'2] =

[15] - [6] = [9], .... By the boundary sorting process (S14) described above, the sum of the values ​​of each group by each key column is further added and displayed at the top as the added value (1st to 3rd rows in the example of FIG. 9). By generating the differential value described above for this added value, it is possible to extract only the sum of the values ​​of each group by key column, which in turn matches the desired groupby-sum result (X'' in 1st to 3rd rows of FIG. 9). → Furthermore, by the boundary sorting process (S14), records including dummy records and records that do not fall on the boundaries are displayed at the bottom (lines 4 to 7 in the example in Figure 9) and are not treated as the result of groupby-sum.

[0054] <Calculation result output unit 16> The calculation result output unit 16 outputs a third table including a key string, a difference value string, and a boundary flag string (S16). Note that the calculation result output unit 16 may output a third table including a key string, a difference value string, and the negation of a boundary flag string, and in the example algorithm of Fig. 12, it is configured to output a table including the negation of a boundary flag string. The processing of the calculation result output unit 16 corresponds to the processing of lines 17 and 18 of the algorithm illustrated in Fig. 12.

[0055] Hereinafter, a case where the second table shown in FIG. 9 is processed by the calculation result output unit 16 will be described with reference to lines 17 and 18 of the algorithm.

[0056] In the example of FIG. 9, the calculation result output unit 16 calculates [e' → ] by negating each element (1-[e' → ]) to [e''' → ] (line 17 of the algorithm), ([k'' → ], [x' → ], [e''' → ]) is output as the third table (line 18 of the algorithm). The third table after the second table shown in FIG. 9 is processed by the calculation result output unit 16 is shown in FIG. 10. Note that in order to simplify the explanation by omitting unnecessary columns, the second table is converted into the third table in the processing of step S16 and output, but this processing is not essential, and for example, the secure computing device 1 may execute the above steps S11 to S16 on the first table and output it as the first table.

[0057] <Second calculation result output unit 17> If the boundary flag of a record in the second table (illustrated in FIG. 9) processed in step S15 indicates that it is not a boundary, the second calculation result output unit 17 replaces the key of the corresponding record with a concealed predetermined character string, replaces the differential value of the corresponding record with a concealed 0, and outputs the result as a fourth table including a key string, a differential value string, and a boundary flag string (S17). The processing by the second calculation result output unit 17 corresponds to the processing on lines 17 and 18 of the algorithm exemplified in FIG. 13 (with null processing, which corresponds to another version of the algorithm in FIG. 12).

[0058] Hereinafter, a case where the second table shown in FIG. 9 is processed by the second calculation result output unit 17 will be described with reference to lines 17 and 18 of the algorithm in FIG.

[0059] In the example of Figure 9, if the boundary flag of the ith record in the second table indicates that it is not a boundary, the key of the corresponding record is replaced with a predetermined string (null) that is concealed ([null]), the differential value of the corresponding record is replaced with a concealed 0 ([0]), and a fourth table containing the key column, differential value column, and boundary flag column, i.e., ([k''' → ], [x'''' → ], [e''' → ]) is output as the fourth table (S17). The fourth table obtained after the second table shown in FIG. 9 is processed by the second calculation result output unit 17 is shown in FIG.

[0060] In order to simplify the explanation by omitting unnecessary columns, the second table is converted into a fourth table in the processing of step S17 and output, but this processing is not essential. For example, the secure computing device 1 may execute the above steps S11 to S15 and S17 on the first table and output the first table as it is.

[0061] <Effects of the secure computing device 1 of the first embodiment> According to the secure computing device 1 of the first embodiment, the dummy record is sorted using the dummy flag to make the dummy record the lowest record, and an if statement is added to the group boundary determination bit so that if the dummy flag indicates that the corresponding record is a dummy record, it does not become a boundary. In the sum processing, the total sum from the top is first calculated, and then only the output value is extracted to the top by sorting, and the difference from the previous value is calculated, thereby achieving groupby-sum without decryption by combining addition and subtraction processing that does not involve communication.

[0062] <Additional Notes> The device of the present invention may, for example, be a single hardware entity having an input unit to which a keyboard or the like can be connected, an output unit to which an LCD display or the like can be connected, a communication unit to which a communication device (e.g., a communication cable) capable of communicating with an external device can be connected, a CPU (which may also include a central processing unit, cache memory, registers, etc.), memories such as RAM and ROM, an external storage device such as a hard disk, and buses connecting these input unit, output unit, communication unit, CPU, RAM, ROM, and external storage device so that data can be exchanged between them. If necessary, the hardware entity may also be provided with a device (drive) capable of reading and writing to a recording medium such as a CD-ROM. A physical entity equipped with such hardware resources includes a general-purpose computer.

[0063] The external storage device of the hardware entity stores the programs required to realize the above-mentioned functions and the data required for processing these programs (the programs may be stored in a ROM, which is a read-only storage device, for example, instead of an external storage device). Data obtained by processing these programs is stored in RAM, the external storage device, etc. as appropriate.

[0064] In a hardware entity, each program stored in an external storage device (or ROM, etc.) and the data required to process each program are loaded into memory as needed, and interpreted, executed, and processed by the CPU as appropriate, resulting in the CPU realizing a predetermined function (each component represented as a unit, means, etc., above).

[0065] The present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the spirit of the present invention. Furthermore, the processes described in the above embodiments may not only be executed in chronological order according to the order described, but may also be executed in parallel or individually depending on the processing capacity of the device that executes the processes or as needed.

[0066] As described above, when the processing functions of the hardware entities (apparatuses of the present invention) described in the above embodiments are realized by a computer, the processing contents of the functions that the hardware entities should have are described by a program. Then, by executing this program on a computer, the processing functions of the hardware entities are realized on the computer.

[0067] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 10020 of the computer 10000 shown in Figure 14 and operating the control unit 10010, input unit 10030, output unit 10040, etc.

[0068] The program describing the processing contents can be recorded on a computer-readable recording medium. Examples of computer-readable recording media include magnetic recording devices, optical disks, magneto-optical recording media, and semiconductor memories. Specifically, examples of magnetic recording devices include hard disk drives, flexible disks, and magnetic tapes; optical disks include DVDs (Digital Versatile Discs), DVD-RAMs (Random Access Memory), CD-ROMs (Compact Disc Read Only Memory), and CD-Rs (Recordable) / RWs (Rewritable); magneto-optical recording media include MOs (Magneto-Optical discs), and semiconductor memories include EEP-ROMs (Electrically Erasable and Programmable-Read Only Memory).

[0069] The program may be distributed, for example, by selling, transferring, lending, etc. a portable recording medium such as a DVD or CD-ROM on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to another computer via a network, thereby distributing the program.

[0070] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the received program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. In this embodiment, the program includes information used for processing by a computer that is equivalent to a program (such as data that is not a direct instruction to the computer but has properties that define computer processing).

[0071] In addition, in this embodiment, a hardware entity is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

Claims

1. 1. A secure computing device that performs a Groupby-sum operation on an encrypted first table, the encrypted first table including a key string, a value string, and a dummy flag string indicating whether a corresponding record is a dummy record, based on the key string while keeping the table secret, a dummy record separation sorting unit that sorts the first table with a first priority on ranking a corresponding record that is not a dummy record and a second priority on a key string; a boundary flag generation unit which generates a boundary flag having a flag value indicating that a record is a boundary if the record corresponds to any of the first to third cases, and having a flag value indicating that the record is not a boundary if the record does not correspond to any of the first to third cases, wherein the first case is a case where a certain record is not a dummy record and the key of the certain record is different from the key of the record immediately below it, the second case is a case where the certain record is not a dummy record and the record immediately below it is a dummy record, and the third case is a case where the certain record is not a dummy record and is the record located at the bottom; an additive value generating unit that adds all values ​​that are higher than a certain record to the value of the certain record and generates the added value of the certain record; a boundary sorting unit that stably sorts a second table including a key string, an additive value string, and a boundary flag string, with priority given to placing boundary records at the top; a differential value generating unit that generates differential values ​​by taking the sum of the top record of the second table as a differential value and calculating the difference between the sum of the top record and the sum of the record immediately above the top record of the second table as a differential value; and a calculation result output unit that outputs a third table including a key string, a difference value string, and a boundary flag string. Secret computing device.

2. 2. The secure computing device according to claim 1, and a second operation result output unit that, when the boundary flag of a certain record in the second table indicates that it is not a boundary, replaces the key of the corresponding record with a concealed predetermined character string, replaces the differential value of the corresponding record with a concealed 0, and outputs the result as a fourth table including a key string, a differential value string, and a boundary flag string. Secret computing device.

3. A secure computation method executed by a secure computation device, which performs a Groupby-sum operation on an encrypted first table, the encrypted first table including a key string, a value string, and a dummy flag string indicating whether a corresponding record is a dummy record, while keeping the encrypted first table secret based on the key string, comprising: a step of sorting the first table with a first priority being to rank the corresponding records that are not dummy records, and a second priority being to sort the key string; a step of generating a boundary flag having a flag value indicating that the record is a boundary if the record is not a dummy record and the key of the record immediately below it is defined as a first case, a second case if the record is not a dummy record and the record immediately below it is a dummy record, and a third case if the record is not a dummy record and is the lowest record, the step of generating a boundary flag having a flag value indicating that the record is a boundary if the record falls under any of the first to third cases, and a flag value indicating that the record is not a boundary if the record does not fall under any of the first to third cases; a step of adding all values ​​higher than a certain record to the value of the certain record and generating the added value of the certain record; A step of stably sorting a second table including a key column, an additive value column, and a boundary flag column, with priority given to placing boundary records at the top; generating differential values ​​by using the sum of the top record of the second table as a differential value, and by using the difference between the sum of the top record of the second table and the sum of the record immediately above the top record as a differential value; outputting a third table including a key column, a difference value column, and a boundary flag column. Secret computation method.

4. 4. The secure computation method according to claim 3, and a step of outputting a fourth table including a key string, a differential value string, and a boundary flag string when the boundary flag of a certain record in the second table indicates that the record is not a boundary and the key of the corresponding record is replaced with a concealed predetermined character string and the differential value of the corresponding record is replaced with a concealed 0. Secret computation method.

5. A program that causes a computer to function as the secure computing device according to claim 1 or 2.

Images