Table creation device, table creation method, and program

Abstract

A table creation device according to one embodiment of the present disclosure creates a table T that approximates a discrete Laplace distribution and that satisfies a condition whereby, when the sum of n (where n is an integer of 1 or greater) elements randomly selected from the table T is defined as noise z, the distribution of the noise z achieves (ε,δ) differential privacy. This table creation device has: a probability density function creation unit, which is configured so as to satisfy the condition by using a first array C in which an element C[0] has been initialized, a second array Csym defined by the first array, and a third array Csym *n created from the second array Csym by a prescribed convolution computation, and so as to create a probability density function f expressed with the third array Csym *n; and a table creation unit, which is configured so as to create the table T by using the first array C.

Description

[Technical Field]

[0001] The present disclosure relates to a table creation device, a table creation method, and a program. [Background technology]

[0002] In privacy protection protocols such as secure computation, information is often protected by adding noise (random numbers) to data. The noise used in this case must be almost completely secret in order to protect the information. The only thing that needs to be known about the noise is the probability distribution that the noise follows, which is shared in advance among protocol participants. Not only the exact value of the noise, but also partial information, such as whether the noise is below a certain value, must be kept secret.

[0003] In particular, there are attempts to generate noise that follows a non-uniform distribution under secure computation in order to achieve a security standard known as (ε,δ) differential privacy. For this purpose, the noise must also be almost completely secret. Conventional techniques for achieving this goal include generating uniform random numbers using secure computation and converting them using a table lookup to generate noise that follows a desired probability distribution (e.g., Non-Patent Documents 1 and 2).

[0004] On the other hand, in order to achieve (ε,δ) differential privacy by adding noise to integer values ​​derived from sensitive information, the probability mass function of the noise must satisfy certain conditions. A known noise distribution that satisfies these conditions is the discrete Laplace distribution (also known as the exponential distribution, two-sided geometric distribution, etc.). [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] David Froelicher et al. "UnLynx: A Decentralized System for Privacy-Conscious Data Sharing". In: Proceedings on Privacy Enhancing Technologies 2017.4 (Oct. 1, 2017), pp. 232-250. issn: 2299-0984. [Non-patent document 2] Iwahana, Kazuki, Yanai, Naoto, and Fujiwara, Toru. "Private collaborative learning with differential privacy and secure computation for confidentiality independent of the number of data providers." In: Proceedings of CSS 2020. Computer Security Symposium 2020. Oct. 2020. Summary of the Invention [Problem to be solved by the invention]

[0006] However, with the above-mentioned conventional techniques, it is impossible to generate noise that exactly follows the discrete Laplace distribution, and it is necessary to approximate the discrete Laplace distribution in some way.

[0007] The present disclosure has been made in consideration of the above points, and aims to provide a technology that can create a table for generating noise that satisfies certain conditions and follows a probability distribution that closely approximates the discrete Laplace distribution. [Means for solving the problem]

[0008] A table creation device according to one aspect of the present disclosure is a table creation device that creates a table T such that, when the sum of n (where n is an integer equal to or greater than 1) elements randomly selected from a table T is a noise z, the distribution of the noise z satisfies a condition for achieving (ε, δ) differential privacy and approximates a discrete Laplace distribution, and the table creation device includes a first array C in which an element C[0] is initialized, and a second array C defined by the first array. sym and the second array C symA third array C created from sym *n and the third array C sym *n and a table creation unit configured to create the table T using the first array C. [Effects of the Invention]

[0009] A technique is provided that can create a table for generating noise that satisfies certain conditions and follows a probability distribution that closely approximates the discrete Laplace distribution. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 2 is a diagram illustrating an example of a hardware configuration of a table creation device according to the present embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of a functional configuration of a table creation device according to the present embodiment. [Figure 3] 10 is a flowchart illustrating an example of a table creation process according to the present embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] An embodiment of the present invention will be described below, which relates to a table creation device 10 that can create a table (array) for generating noise that satisfies certain conditions (the (ε, δ) differential privacy condition described later) and follows a probability distribution that closely approximates the discrete Laplace distribution.

[0012] By using the table created by the table creation device 10 according to this embodiment, it becomes possible to generate, by table lookup, noise that satisfies certain conditions and follows a probability distribution that closely approximates the discrete Laplace distribution under secure computation. Here, noise generation by table lookup refers to a method of randomly extracting values ​​from a table created in advance and using them as noise (for example, Non-Patent Documents 1 and 2). Noise generation by table lookup has the advantage of requiring significantly less computational effort than a method of mathematically converting uniform random numbers, such as that performed with plaintext.

[0013] <Conditions for achieving (ε,δ) differential privacy> Achieving (ε,δ) differential privacy by adding noise to an integer value derived from sensitive information is equivalent to the probability mass function f(k) of the noise satisfying the following condition:

[0014] Condition: Let s∈{-Δ,-Δ+1,···,+Δ} be any.

[0015]

number

[0016]

number

[0017] Here, the integer Δ(≧1) is a value called sensitivity, which is determined depending on the process (e.g., calculation of statistics) that generates the value to be protected by (ε,δ) differential privacy. Hereinafter, the above condition will also be referred to as the "(ε,δ) differential privacy condition."

[0018] <Preparation: Folding the array> As a preparation, we define the folding of an array. For an array A[0], ,A[L] of length L+1 and a positive integer n(=1,2, ), we create a new array A *nis defined as follows, and this new array A *n is called the folding of array A.

[0019]

number

[0020]

number

[0021] When an array A of length L+1 is folded, for k=0, ,L, A *n [k] is a polynomial that includes A[0], ,A[k], and is also a linear expression with respect to A[k].

[0022] <Example of hardware configuration of table creation device 10> An example of the hardware configuration of a table creation device 10 according to this embodiment is shown in Fig. 1. As shown in Fig. 1, the table creation device 10 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a RAM (Random Access Memory) 105, a ROM (Read Only Memory) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is connected to each other via a bus 109 so as to be able to communicate with each other.

[0023] The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 102 is, for example, a display, a display panel, etc. Note that the table creation device 10 does not necessarily have to include at least one of the input device 101 and the display device 102, for example.

[0024] The external I / F 103 is an interface with an external device such as a recording medium 103a. The table creation device 10 can read from and write to the recording medium 103a via the external I / F 103. Examples of the recording medium 103a include a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0025] The communication I / F 104 is an interface for connecting the table creation device 10 to the communication network 20. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 106 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 107 is a storage device (storage device) such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory. The processor 108 is an arithmetic device such as a CPU (Central Processing Unit).

[0026] The table creation device 10 according to this embodiment has the hardware configuration shown in Fig. 1 and is therefore capable of realizing the table creation process described below. Note that the hardware configuration shown in Fig. 1 is merely an example, and the hardware configuration of the table creation device 10 is not limited to this. For example, the table creation device 10 may have multiple auxiliary storage devices 107 or multiple processors 108, may not have some of the hardware shown in the figure, or may have various hardware components other than the hardware shown in the figure.

[0027] <Example of functional configuration of table creation device 10> An example of the functional configuration of the table creation device 10 according to this embodiment is shown in Fig. 2. As shown in Fig. 2, the table creation device 10 according to this embodiment includes a probability density function creation unit 201, a table creation unit 202, and a storage unit 203. Note that the probability density function creation unit 201 and the table creation unit 202 are realized, for example, by processing in which one or more programs installed in the table creation device 10 are executed by the processor 108. Furthermore, the storage unit 203 is realized, for example, by a storage device (memory) such as the auxiliary storage device 107 or the RAM 105.

[0028] The probability density function creation unit 201 creates a probability density function f(k) that satisfies the (ε, δ) differential privacy condition. At this time, in creating this probability density function f(k), the probability density function creation unit 201 selects an array C as an element of a table T for generating noise z that satisfies the (ε, δ) differential privacy condition and follows a probability distribution that closely approximates the discrete Laplace distribution, and an array C determined by the array C. sym and array C sym The folded array C sym *n The probability density function f(k) is stored in the array C sym *n It is expressed by:

[0029] The table creation unit 202 uses the array C created by the probability density function creation unit 201 to create a table T for generating noise z that satisfies the (ε, δ) differential privacy condition and follows a probability distribution that closely approximates the discrete Laplace distribution.

[0030] The storage unit 203 stores the arrays C and C created by the probability density function creation unit 201. sym , C sym *n , and the table T created by the table creating unit 202.

[0031] The table creation process according to this embodiment will be described with reference to Fig. 3. Below, we will explain the case of creating a table T in which, when n (=1, 2,...) elements are randomly selected from table T and their sum is z, the distribution of z satisfies the (ε, δ) differential privacy condition and closely approximates the discrete Laplace distribution.

[0032] The probability density function creating unit 201 creates a probability density function f(k) that satisfies the (ε, δ) differential privacy condition (step S101). Here, the probability density function creating unit 201 creates the probability density function f(k) through the following steps 1 to 3.

[0033] Step 1: First, the probability density function creation unit 201 initializes C[0] to an appropriate positive integer. Here, it is preferable that C[0] is small in order to reduce the size of the table T that is ultimately obtained. On the other hand, if C[0] is too small, subsequent processing may not proceed smoothly, so it is necessary to set it to an appropriate value. For example, when n=1, it is best to define C[0] as follows:

[0034]

number

[0035]

number

[0036] Step 2: Next, the probability density function creating unit 201 sets the variable L to 0, and then executes the following steps 2-1 to 2-5.

[0037] (Step 2-1) For i=0,...,L, array C sym is defined below.

[0038] C sym [i]=Csym [(2L+2)-i]=C[i] However, please refer to the following procedure 2-2. sym [L+1] is treated as a symbol (indeterminate element).

[0039] (Step 2-2)C sym *n Calculates real numbers c0 and c1 that satisfy [L+1]=c1C[L+1]+c0. As mentioned above, c0 and c1 can be expressed as polynomials in C[0], ,C[L], and c1 is not 0.

[0040] (Step 2-3) At the end of array C

[0041]

number

[0042]

number

[0043] (Step 2-4) Increase variable L by one.

[0044] (Step 2-5) If the following conditions (termination conditions) are met, proceed to step 3; if not, return to step 2-1.

[0045]

number

[0046] If the value of C[0] set in step 1 above is too small, the value of C will be sym *n [L+1]=C sym *nTherefore, it is preferable to determine the value of C[0] when n>1 by prior testing.

[0047] Step 3: When the length of the array C obtained in step 2 above is L+1,

[0048]

number

[0049]

number

[0050] Next, the table creation unit 202 uses the array C obtained when creating the probability density function f(k) to create a table T for generating noise z that satisfies the (ε, δ) differential privacy condition and follows a probability distribution that closely approximates the discrete Laplace distribution (step S102). Specifically, when the length of the array C is L+1, the table creation unit 202 creates a table T that stores C[L-|k|] elements, where k=-L, -L+1, . . . , L. As a result, when n (=1, 2, . . .) elements are randomly taken from table T and their sum is z, a table T is obtained in which the distribution of z satisfies the (ε, δ) differential privacy condition and closely approximates the discrete Laplace distribution.

[0051] It should be noted that the probability density function f(k) is not used when creating the table T in step S102 above, and therefore procedure 3 in step S101 above does not need to be executed.

[0052] <Summary> As described above, the table creation device 10 according to this embodiment calculates the value C obtained by convolution of the array when the probabilities f(0), . . . , f(L) are obtained. sym*n By utilizing the fact that the value of the probability density function f is similar to [L+1] and that this value is a linear function with respect to the new element C[L+1] of the array C, the probability density function f that satisfies the (ε, δ) differential privacy condition is constructed by an iterative operation. This enables the table creation device 10 according to this embodiment to construct the desired table T from this array C.

[0053] <Effects> The table creation device 10 according to this embodiment mainly has the following advantages (1) and (2).

[0054] (1) The noise required to achieve (ε, δ) differential privacy can be generated using a noise generation method that requires little computational effort and is easy to implement, namely, table lookup.

[0055] (2) When n ≥ 2 is used, a smaller table can be used to achieve a smaller δ than when n = 1. Specifically, the size (length) of the table is approximately (1 / δ) 1 / n is proportional to.

[0056] Therefore, for protocols that require confidential noise (noise generation under secure computation), such as (ε, δ) differential privacy, by using the table T created by the table creation device 10 of this embodiment, it is possible to execute the protocol more efficiently.

[0057] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0058] [References] Reference 1: Cynthia Dwork et al. "Our Data, Ourselves: Privacy Via Distributed Noise Generation". In: Advances in Cryptology - EUROCRYPT 2006. Ed. by Serge Vaudenay. Lecture Notes in Computer Science. Berlin, Heidelberg: Springer, 2006, pp. 486-503. ISBN: 978-3-540-34547-3. Reference 2: Arpita Ghosh, Tim Roughgarden, and Mukund Sundararajan. "Universally Utility-Maximizing Privacy Mechanisms". In: Proceedings of the Forty-First Annual ACM Symposium on Theory of Computing. STOC '09. New York, NY, USA: Association for Computing Machinery, May 31, 2009, pp. 351-360. ISBN: 978-1-60558-506-2. [Explanation of symbols]

[0059] 10 Table making device 101 Input Device 102 Display device 103 External I / F 103a Recording media 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage 108 processors 109 Bus 201 Probability density function creation section 202 Table Creation Department 203 Storage section

Claims

1. A table creation device that creates a table T such that, when a sum of n (n is an integer equal to or greater than 1) elements randomly selected from a table T is a noise z, the distribution of the noise z satisfies a condition for achieving (ε, δ) differential privacy and approximates a discrete Laplace distribution, comprising: A first array C whose element C[0] is initialized and a second array C defined by the first array ｓｙｍ and the second array C ｓｙｍ A third array C created from ｓｙｍ ＊ｎ and the third array C ｓｙｍ ＊ｎ a probability density function generating unit configured to generate a probability density function f expressed as a table creation unit configured to create the table T using the first array C; A table creation device having:

2. The table creation unit 2. The table creation device according to claim 1, wherein the table T is created by storing C[L-|k|] pieces of k=-L, -L+1, ..., L, where L is an integer greater than or equal to 0, when the length of the first array C is L+1.

3. The probability density function creation unit For L (where L is an integer equal to or greater than 0), C ｓｙｍ [i] = C ｓｙｍ [(2L+2)-i]=C[i] (i=0, . . . , L) to obtain the second array C ｓｙｍ Define C ｓｙｍ ＊ｎ [L+1] = c １ C[L+1]+c ０ A real number c that satisfies ０ , c １ Calculate For a predetermined ε>0 (e ε C ｓｙｍ ＊ｎ [L]-c ０ ) / c １ Let C[L+1] be the largest integer not exceeding Repeat adding 1 to L until a predetermined termination condition is met. C ｓｙｍ ＊ｎ [k+L] / (C ｓｙｍ ＊ｎ 3. The table creating device according to claim 1, wherein the table creating device creates a probability density function f(k) of the sum of [j] from j=0 to j=2L-1 as the probability density function f(k).

4. The termination condition is: L+1≧Δ (where Δ≧1 is an integer representing the sensitivity), and (C ｓｙｍ ＊ｎ [j] from j = 0 to j = Δ-1) / (C ｓｙｍ ＊ｎ 4. The table creating device according to claim 3, wherein the sum of [j] from j=0 to j=2L-1 is less than δ (where δ>0 is a predetermined value).

5. 4. The table creation device according to claim 3, wherein the termination condition is that a predetermined number of repetitions has been reached.

6. A table creation method for creating a table T such that, when noise z is the sum of n elements (n is an integer equal to or greater than 1) randomly selected from the table T, the distribution of the noise z satisfies a condition for achieving (ε, δ) differential privacy and approximates a discrete Laplace distribution, the method comprising: A first array C whose element C[0] is initialized and a second array C defined by the first array ｓｙｍ and the second array C ｓｙｍ A third array C created from ｓｙｍ ＊ｎ and the third array C ｓｙｍ ＊ｎ A probability density function creation procedure for creating a probability density function f expressed as a table creation procedure for creating the table T using the first array C; The computer executes the table creation method.

7. A program for creating a table T such that, when the sum of n elements (n is an integer equal to or greater than 1) randomly selected from the table T is a noise z, the distribution of the noise z satisfies the conditions for achieving (ε, δ) differential privacy and approximates a discrete Laplace distribution, the program comprising: A first array C whose element C[0] is initialized and a second array C defined by the first array ｓｙｍ and the second array C ｓｙｍ A third array C created from ｓｙｍ ＊ｎ and the third array C ｓｙｍ ＊ｎ A probability density function creation procedure for creating a probability density function f expressed as a table creation procedure for creating the table T using the first array C; A program that causes a computer to execute the following.

Images