Concealed noise generation system, concealed noise generation method and program

Abstract

A security noise generation system according to an aspect of the present disclosure comprises a first terminal and one or more second terminals. The first terminal has a transmission unit configured so as to transmit a first table, which has security values as elements, to the second terminal. The second terminal has a noise calculation unit configured so as to calculate, as security noise, a sum of n (where n is an integer of 2 or greater) security values selected from the first table, said calculation being made by using a security calculation technique capable of adding security values.

Description

[Technical Field]

[0001] The present disclosure relates to a concealed noise generation system, a concealed noise generation method, and a program. [Background technology]

[0002] In privacy protection protocols such as secure computation, information is often protected by adding noise (random numbers) to data. The noise used in this case must be almost completely secret in order to protect the information. The only thing that needs to be known about the noise is the probability distribution that the noise follows, which is shared in advance among protocol participants. Not only the exact value of the noise, but also partial information, such as whether the noise is below a certain value, must be kept secret.

[0003] In particular, there are attempts to generate noise that follows a non-uniform distribution under secure computation in order to achieve a security standard known as differential privacy. For this purpose, the noise must also be almost completely secret. Conventional techniques for achieving this goal include generating uniform random numbers using secure computation and converting them using a table lookup to generate noise that follows a desired probability distribution (e.g., Non-Patent Documents 1 and 2). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] David Froelicher et al. "UnLynx: A Decentralized System for Privacy-Conscious Data Sharing". In: Proceedings on Privacy Enhancing Technologies 2017.4 (Oct. 1, 2017), pp. 232-250. issn: 2299-0984. [Non-patent document 2] Iwahana, Kazuki, Yanai, Naoto, and Fujiwara, Toru. "Private collaborative learning with differential privacy and secure computation for confidentiality independent of the number of data providers." In: Proceedings of CSS 2020. Computer Security Symposium 2020. Oct. 2020. Summary of the Invention [Problem to be solved by the invention]

[0005] However, in the above-mentioned conventional techniques, it is often necessary to use huge tables to approximate the desired probability distribution with sufficient accuracy, which poses the problem of large amounts of communication traffic and memory usage.

[0006] The present disclosure has been made in consideration of the above points, and aims to provide a technology that can generate confidential noise with a small amount of communication traffic and memory usage. [Means for solving the problem]

[0007] A confidential noise generation system according to one embodiment of the present disclosure is a confidential noise generation system including a first terminal and one or more second terminals, wherein the first terminal has a transmission unit configured to transmit a first table having confidential values ​​as elements to the second terminal, and the second terminal has a noise calculation unit configured to calculate the sum of n (n is an integer greater than or equal to 2) confidential values ​​selected from the first table as confidential noise using a secure calculation technology capable of adding confidential values ​​together. [Effects of the Invention]

[0008] A technology is provided that can generate confidential noise with a small amount of communication traffic and memory usage. [Brief explanation of the drawings]

[0009] [Figure 1] 1 is a diagram illustrating an example of the overall configuration of a concealed noise generation system according to an embodiment of the present invention. [Figure 2]FIG. 2 is a diagram illustrating an example of a hardware configuration of a participant terminal according to the present embodiment. [Figure 3] FIG. 2 is a diagram illustrating an example of the functional configuration of a participant terminal according to the present embodiment. [Figure 4] FIG. 10 is a sequence diagram illustrating an example of a concealed noise generation process according to the present embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] An embodiment of the present invention will be described below. In the following embodiment, a confidential noise generation system 1 capable of generating confidential noise with a small amount of communication traffic and memory usage will be described.

[0011] Here, the confidential noise generation system 1 according to this embodiment uses a secure computation technique that allows addition of secret values ​​when generating confidential noise (for example, ciphertext of noise). Specific examples of such secure computation techniques include additive homomorphic encryption and secure computation based on additive secret sharing. The present invention can use any secure computation technique that allows addition of secret values. In the following embodiment, it is mainly assumed that additive homomorphic encryption is used when generating confidential noise. Furthermore, a case where a secure computation technique based on additive secret sharing is used will be described later as a variation of this embodiment.

[0012] <Overall configuration example of confidential noise generation system 1> An example of the overall configuration of a confidential noise generation system 1 according to this embodiment is shown in FIG. 1. As shown in FIG. 1, the confidential noise generation system 1 according to this embodiment includes a plurality of participant terminals 10. These participant terminals 10 are communicably connected via a communication network 20 including the Internet or the like. In the example shown in FIG. 1, participant terminals 101, ..., participant terminal 10 m The number of participant terminals 10 included is m, where m is the number of participants in the protocol for generating confidential noise.

[0013] The participant terminals 10 are various terminals, devices, or apparatuses (for example, PCs (personal computers), smartphones, tablet terminals, wearable devices, general-purpose servers, etc.) used by participants.

[0014] Here, each participant is roughly divided into a participant who creates a table T used to generate a confidential noise, and a participant who generates a confidential noise from this table T. In the following, a participant who creates a table T used to generate a confidential noise will be referred to as a "table creator", and a participant who generates a confidential noise from the table T will be referred to as a "noise generator". In the following, as an example, the participant terminal 10 used by the table creator will be referred to as a "participant terminal 101", and the participant terminal 10 used by each noise generator will be referred to as a "participant terminal 10 i (i∈{2,···,m})".

[0015] 1 is merely an example and is not intended to be limiting. For example, the confidential noise generation system 1 may include a terminal, device, or apparatus that executes some processing required for generating confidential noise, in addition to the participant terminal 10.

[0016] <Example of hardware configuration of participant terminal 10> An example of the hardware configuration of a participant terminal 10 according to this embodiment is shown in Fig. 2. As shown in Fig. 2, the participant terminal 10 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a RAM (Random Access Memory) 105, a ROM (Read Only Memory) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is connected to each other via a bus 109 so as to be able to communicate with each other.

[0017] The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 102 is, for example, a display, a display panel, etc. Note that the participant terminal 10 does not necessarily have to have at least one of the input device 101 and the display device 102, for example.

[0018] The external I / F 103 is an interface with an external device such as a recording medium 103a. The participant terminal 10 can read from and write to the recording medium 103a via the external I / F 103. Examples of the recording medium 103a include a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0019] The communication I / F 104 is an interface for connecting the participant terminal 10 to the communication network 20. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 106 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 107 is a storage device (storage device) such as an HDD (Hard Disk Drive), SSD (Solid State Drive), or flash memory. The processor 108 is an arithmetic device such as a CPU (Central Processing Unit).

[0020] The participant terminal 10 according to this embodiment has the hardware configuration shown in Fig. 2, and is therefore capable of implementing the confidential noise generation process described below. Note that the hardware configuration shown in Fig. 2 is merely an example, and the hardware configuration of the participant terminal 10 is not limited to this. For example, the participant terminal 10 may have multiple auxiliary storage devices 107 and multiple processors 108, may not have some of the hardware shown in the figure, or may have various hardware components other than the hardware shown in the figure.

[0021] <Example of functional configuration of participant terminal 10> An example of the functional configuration of the participant terminal 10 according to this embodiment is shown in Fig. 3. As shown in Fig. 3, the participant terminal 10 according to this embodiment includes a confidential noise generation processing unit 201 and a storage unit 202. The confidential noise generation processing unit 201 is realized, for example, by a process in which one or more programs installed in the participant terminal 10 are executed by the processor 108. The storage unit 202 is realized, for example, by a storage device (memory) such as the auxiliary storage device 107 or the RAM 105.

[0022] When the confidential noise generation processing unit 201 is a participant terminal 101 of the table creator, it creates a table T whose elements are integers or real numbers that follow a certain probability distribution, and shuffles and encrypts the elements of table T. When encrypting the elements of table T, an encryption key for additive homomorphic encryption is used. Hereinafter, table T whose elements have been shuffled and encrypted will be referred to as "table T Enc " should be written as ".

[0023] On the other hand, the confidential noise generation processing unit 201 is connected to the participant terminal 10 of the noise generator. i (i∈{2, ,m}), then table T Enc Select n elements from the table T and calculate the sum of these elements as the secret noise, where n is the number of elements in the table T. Enc n is a parameter that takes an integer value of 1 or greater and indicates how many elements to select from, and is shared among participants. However, it is preferable that n be 2 or greater.

[0024] In the case of the participant terminal 101 of the table creator, the storage unit 202 stores the parameters (population parameters) of the probability distribution used when creating the table T, the parameter n, the encryption key of the additive homomorphic encryption of the table creator, the table T, and the table T Enc etc. are memorized.

[0025] On the other hand, the memory unit 202 stores the participant terminal 10 of the noise generator. i If (i∈{2, ,m}), then parameter n, table T, and table T Enc , concealed noise, etc. are stored.

[0026] <Hidden noise generation processing> The confidential noise generation process according to this embodiment will be described below with reference to Fig. 4. It is assumed that a parameter n is given to each participant terminal 10 in advance and stored in the storage unit 202 of that participant terminal 10.

[0027] The confidential noise generation processing unit 201 of the participant terminal 101 creates a table T whose elements are integers or real numbers that follow a certain probability distribution (step S101). Here, the parameters (population variables) of the probability distribution may be determined by the participant terminal 101 itself, or may be provided to the participant terminal 101. Furthermore, the number of elements in table T is not particularly limited, and may be determined appropriately by the participant terminal 101 itself (for example, by randomly determining the number of elements in table T), or the number of elements in table T may be provided to the participant terminal 101.

[0028] For example, if the j-th element of table T is T[j] and the number of elements is J, table T can be expressed as T={T[j]|j=1, ,J}. In other words, table T can be realized as an array with T[j] as the j-th element.

[0029] Next, the concealed noise generation processing unit 201 of the participant terminal 101 stores the table T created in the above step S101 in its own storage unit 202 (step S102).

[0030] Next, the concealed noise generating unit 201 of the participant terminal 101 transmits the table T created in step S101 to each participant terminal 10. i (i={2, . . . , m}) (step S103).

[0031] Participant terminal 10 i The (i={2, . . . , m}) confidential noise generation processing unit 201 stores the table T received from the participant terminal 101 in its own storage unit 202 (step S104). As a result, the table T is shared among the participant terminals 10 of the participants.

[0032] The confidential noise generating unit 201 of the participant terminal 101 shuffles the elements of the table T, and encrypts all the elements of the shuffled table T using an encryption key for additive homomorphic encryption to generate a table T Enc is created (step S105).

[0033] For example, a shuffle can be expressed by a certain permutation σ on {1, ,J}. If the shuffled elements are T[σ(j)] and the data x encrypted with the encryption key of additive homomorphic encryption is Enc(x), then the table T Enc is T Enc ={Enc(T[σ(j)])|j=1, ,J}.

[0034] Next, the confidential noise generating unit 201 of the participant terminal 101 calculates the confidential noise by the table T Enc is stored in its own storage unit 202 (step S106).

[0035] Next, the concealed noise generating unit 201 of the participant terminal 101 uses the table T Enc Each participant terminal 10 i (i={2, . . . , m}) (step S107).

[0036] Participant terminal 10 i The confidential noise generation processing unit 201 of (i={2, . . . , m}) receives the table T Enc The participant terminal 10 of each participant stores the table T Enc is shared.

[0037] Next, the participant terminal 10 i The confidential noise generation processing unit 201 of (i={2, . . . , m}) uses the table T Enc n elements are uniformly selected at random from (step S109).

[0038] And participant terminal 10 iThe confidential noise generation processing unit 201 (i={2, . . . , m}) generates the confidential noise by using the ciphertext of the sum of the n elements selected in the above step S109 (step S110). That is, for example, in the above step S109, the n elements Enc(T[j1]), . . . ,Enc(T[j n ])∈T Enc is selected, the concealment noise generation processing unit 201 calculates Enc(z)=Enc(T[j1])+ +Enc(T[j n ]) to calculate the confidential noise Enc(z), which is the ciphertext of the noise z. n ∈{1, ,J}. This allows each noise generator to obtain the secret noise (i.e., the ciphertext Enc(z) of the noise z).

[0039] For example, if a certain noise generator wants to obtain multiple secret noises, the participant terminal 10 of the noise generator i To do this, the above steps S109 to S110 may be repeated as many times as necessary.

[0040] <Modification> A modification of this embodiment will now be described.

[0041] Variation 1 In step S103 above, the participant terminal 101 transfers the table T itself to each participant terminal 10 i (i={2, . . . , m}), but as an equivalent operation, the participant terminal 101 transmits the creation algorithm of table T (or information identifying the algorithm) and the input of the algorithm (for example, parameters (population parameters) of the probability distribution to which integers or real numbers as elements of table T follow) to each participant terminal 10 i (i={2, . . . , m}). Alternatively, if the algorithm for creating table T is shared among the participants in advance, the participant terminal 101 may transmit only the input of the algorithm to each participant terminal 10. i (i={2, ,m}).

[0042] As a result, each participant terminal 10i Similarly, table T is created in (i={2, ,m}), and as a result, table T can be shared among participants.

[0043] Variation 2 When a secure computation technique other than additive homomorphic encryption is used, the calculation of the confidential noise in step S110 may be performed by multiple participant terminals 10. For example, when secure computation based on additive secret sharing is used, the calculation of the confidential noise needs to be performed by multiple participant terminals 10.

[0044] In this case, T Enc Therefore, when the concealment noise is calculated by a plurality of participant terminals 10 in step S110, for example, the concealment noise is calculated by the participant terminals 10 other than the participant terminal 101. i (i={2, . . . , m}) or in step S109, the concealment noise is calculated using only the Enc After the table is created, it is converted to table T by the method described in Reference 1. Enc The elements of need to be shuffled.

[0045] <Summary> As described above, the secret noise generation system 1 according to this embodiment shuffles and encrypts the elements of table T, which has elements that follow a certain probability distribution, and then uses a secure computation technique that allows addition of secret values ​​to generate shuffled and encrypted table T. Enc The confidential noise is generated by adding one or more elements (preferably two or more elements) of the above. As a result, the confidential noise generation system 1 according to this embodiment can generate noise (random numbers) whose values ​​are unknown to all participants with less communication traffic and memory usage than conventional techniques.

[0046] Therefore, for example, by applying the confidential noise generation system 1 according to this embodiment to a protocol that requires confidential noise, such as differential privacy, the protocol can be executed more efficiently.

[0047] <Effects> The confidential noise generation system 1 according to this embodiment mainly has the following advantages (1) to (4).

[0048] (1) All participants cannot know anything about the plaintext noise z other than the probability distribution that the noise z follows until they decrypt Enc(z). The table creator cannot know which elements of table T were selected to create the noise z, and the table T Enc Since the elements of are encrypted, each noise generator cannot know the value of the element they chose. Each participant can calculate the probability distribution that the noise z follows from the table T and the parameter n.

[0049] (2) Since the calculation required to generate the concealment noise is only addition, the generation time per noise is short.

[0050] (3) For example, it is easier to implement than generating random numbers by performing mathematical transformations or bit array manipulations on uniform random numbers.

[0051] (4) When n ≥ 2, the probability distribution that can take on extremely large or extremely small values ​​can be approximated with small communication and memory usage. This is because if the maximum value of table T is S and the minimum value is s, the maximum value that noise z can take is nS and the minimum value is ns.

[0052] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0053] [Reference 1] Reference 1: Melissa Chase, Esha Ghosh, and Oxana Poburinnaya. Secret Shared Shuffle. 1340. 2019. [Explanation of symbols]

[0054] 1. Hidden noise generation system 10 Participant terminals 20. Communication Networks 101 Input Device 102 Display device 103 External I / F 103a Recording media 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage 108 processors 109 Bus 201 Hidden noise generation processing unit 202 Storage section

Claims

1. A secret noise generation system including a first terminal and one or more second terminals, The first terminal a transmitter configured to transmit a first table having secret values ​​as elements to the second terminal; The second terminal A confidential noise generation system having a noise calculation unit configured to calculate the sum of n (n is an integer greater than or equal to 2) confidential values ​​selected from the first table as confidential noise using a confidential calculation technology capable of adding confidential values ​​together.

2. The first terminal a first creating unit configured to create a second table having, as elements, values ​​that follow a predetermined distribution; and a second creation unit configured to shuffle the elements of the second table and then encrypt the elements of the second table after the shuffling to create the first table.

3. The noise calculation unit 2. The confidential noise generation system according to claim 1, wherein the confidential noise generation system is configured to calculate, by the secure computation technique, a sum of n confidential values ​​selected uniformly at random from the first table as the confidential noise.

4. The confidential noise generation system according to claim 1 , wherein the secure computation technique is additive homomorphic encryption or additive secret sharing-based secure computation.

5. A concealment noise generation method used in a concealment noise generation system including a first terminal and one or more second terminals, The first terminal a transmission step of transmitting a first table having secret values ​​as elements to the second terminal; The second terminal A confidential noise generation method that executes a noise calculation procedure that calculates the sum of n (n is an integer greater than or equal to 2) confidential values ​​selected from the first table as confidential noise using a confidential calculation technology that enables addition of confidential values.

6. A program that causes a computer to function as the first terminal or the second terminal included in the confidential noise generation system according to claim 1.

Images