Information processing device, information processing method, information processing program, and learning device

Abstract

An estimation unit (130) uses a trained model (D3) obtained by performing machine learning for calculating a solution of a mathematical problem to be used for encryption to calculate, as a calculation solution, a solution of a mathematical problem to be evaluated, which is a mathematical problem to be used for encryption to be evaluated. A problem solving success rate calculation unit (140) uses the calculation solution to generate an evaluation index for evaluating the encryption to be evaluated.

Description

Information processing device, information processing method, information processing program, and learning device

[0001] The present disclosure relates to techniques for dealing with cryptographic attacks. A cryptographic attack is an attack on a ciphertext. Specifically, a cryptographic attack is an attack that attempts to decrypt a ciphertext without authorization.

[0002] In modern society, a common method of cryptographic attacks is to break a cipher by finding the solution to a mathematical problem used in the cipher. The mathematical problem used in the cipher is called the mathematical problem that can be solved by a cryptographic attack. The difficulty of solving the mathematical problem that can be solved by a cryptographic attack is called the cryptographic strength of the cipher. Evaluating the strength of a cipher is also called evaluating the security of the cipher.

[0003] Known methods and techniques for evaluating the security of cryptography include calculating the amount of calculation required for a cryptographic attack and determining the strength of the cryptography based on the amount of calculation. For example, there is an evaluation technique that uses an attack equation. In this technique, an equation having a solution corresponding to plaintext and / or a private key is formulated as the attack equation. Then, in this technique, the amount of calculation required to solve the formulated attack equation is calculated. The strength of the cryptography is evaluated based on the amount of calculation. Evaluation techniques that use attack equations are disclosed in, for example, Patent Document 1, Patent Document 2, and Non-Patent Documents 1-4.

[0004] JP 2008-11084 A JP 2008-109287 A

[0005] Nicolas T. Courtois, Willi Meier, "Algebraic attacks on stream ciphers with linear "feedback", published by Springer, published in 2003, Advantages in Cryptology-EUROCRYPT 2003 Proceedings, pp. 345-359Jearn-Charles Faugere, Antonie "Algebraic Cryptanalysis of Hidden" by Jous Field Equation (HEF) Cryptosystems Using "Grobner Bases", Springer Publishing, published in 2003, Annual International Cryptology Conference, pp. 44-60Aviad Kipnis、Jacques Patarin、Louis Goubin, "Unbalanced Oil and Vinegar Signature Schemes", published by Springer, published in 1999, International Conference on the theory and applications of Cryptographic Techniques, pp. 206-222Johannes Buchmann, Andrei Pychkine, Ralf-Philip Weinmann, "Block Ciphers Sensitive to Grobner Basis "Attacks", published by Springer, released in 2006, Topics in Cryptology CT-RSA, pp. 313-331 (RSA is a registered trademark) Guillaume Lample, Francois Charton, "Deep Learning for Symbolic Mathematics", Arxiv preprint 1912.014112019 published by Cathy Yuanchen Li, Jana Sotakova, Emily Wenger, Mohamed Malhou, Evrard Garcelon, Francois Charton, Kristin Lauter.“SALSA PICANTE: A Machine Learning Attack On LWE with Binary Secrets”, Association for Computing Machinery Publishing, 2023, Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security,

[0006] In recent years, research into machine learning theory has progressed, aiming to solve mathematical problems quickly. For example, machine-learned models have emerged that can solve differential equations faster than conventional algorithms (e.g., Non-Patent Document 5). Therefore, a cryptographic attack can be realized by using a machine-learned model to solve a mathematical problem that is resistant to a cryptographic attack. Such cryptographic attack methods are called machine learning attacks, and research has progressed in recent years (e.g., Non-Patent Document 6). The security of a cryptography against machine learning attacks refers to the low probability of a successful machine learning attack or the large amount of computation required for a machine learning attack. Evaluating the security of a cryptography against machine learning attacks involves calculating the low probability of a successful machine learning attack or the large amount of computation required for a machine learning attack.

[0007] Conventional techniques cannot evaluate the security of cryptography against machine learning attacks. Conventional techniques assume that a solution method for mathematical problems that is resistant to cryptographic attacks uses a deterministic algorithm whose behavior is consistent with respect to input. However, a solution method using a machine-learned model does not necessarily have a consistent behavior with respect to input. Furthermore, a solution method using a machine-learned model is premised on statistical estimation of the solution by learning the statistical relationship between the problem and the solution. Conventional techniques do not assume a solution method using a machine-learned model with such characteristics. For this reason, conventional techniques cannot evaluate the security of cryptography against machine learning attacks.

[0008] For example, in conventional techniques, the security of a cipher is evaluated for a solution method for an attack equation using a transformation algorithm, which is a type of deterministic algorithm (e.g., Non-Patent Documents 1-4). More specifically, in conventional techniques, the security of a cipher is evaluated by calculating the amount of computation required to transform the attack equation. On the other hand, conventional techniques do not take into account a solution method that involves statistical estimation of a solution using a model that has learned the statistical relationship between the attack equation and the solution to the attack equation, such as a machine learning attack. As such, conventional techniques have the problem of being unable to effectively evaluate the security of a cipher against machine learning attacks. In order to enable the development of a cipher generation device that is resistant to attacks on ciphers using artificial intelligence, which are expected in the near future, it is necessary to more accurately evaluate the security of ciphers against attacks using artificial intelligence.

[0009] The main purpose of the present disclosure is to solve such problems. Specifically, the main purpose of the present disclosure is to enable evaluation of the security of cryptography against machine learning attacks.

[0010] The information processing device according to the present disclosure includes: a calculation unit that calculates, as a calculated solution, a solution to a mathematical problem to be evaluated, which is a mathematical problem to be used in a cipher to be evaluated, using a trained model obtained by performing machine learning to calculate a solution to a mathematical problem to be used in a cipher; and an evaluation index generation unit that uses the calculated solution to generate an evaluation index for evaluating the cipher to be evaluated.

[0011] According to the present disclosure, it is possible to evaluate the security of a cipher against machine learning attacks.

[0012] FIG. 1 is a diagram showing an example of the functional configuration of a encryption strength evaluation device according to embodiment 1. FIG. 2 is a flowchart showing an example of the operation of the encryption strength evaluation device according to embodiment 1. FIG. 3 is a diagram showing an example of the functional configuration of a encryption strength evaluation device according to embodiment 2. FIG. 4 is a flowchart showing an example of the operation of the encryption strength evaluation device according to embodiment 2. FIG. 5 is a diagram showing an example of the functional configuration of a learning device according to embodiment 3. FIG. 6 is a flowchart showing an example of the operation of the learning device according to embodiment 3. FIG. 7 is a diagram showing an example of the hardware configuration of a encryption strength evaluation device according to embodiment 1.

[0013] Hereinafter, embodiments will be described with reference to the drawings. In the following description of the embodiments and the drawings, the same reference numerals denote the same or corresponding parts.

[0014] Embodiment 1. ***Outline*** An outline of this embodiment will be described. In this embodiment, a trained model obtained by performing machine learning to calculate a solution to a mathematical problem used in a cipher is used. Then, in this embodiment, the trained model is used to calculate, as a calculated solution, a solution to a mathematical problem (hereinafter referred to as the target mathematical problem) used in a cipher whose security is to be evaluated (hereinafter referred to as the cipher to be evaluated). The target mathematical problem is a mathematical problem that is resistant to cryptographic attacks. Furthermore, in this embodiment, the calculated solution is used to generate an evaluation index for evaluating the cipher to be evaluated. In this embodiment, the accuracy rate of the calculated solution (hereinafter referred to as the solution success rate) is calculated as the evaluation index. The solution success rate is an evaluation index for the security of the cipher to be evaluated against machine learning attacks. A high solution success rate means that the cipher to be evaluated is evaluated as vulnerable to machine learning attacks.

[0015] *** Description of Configuration *** FIG. 1 shows an example of the functional configuration of a encryption strength evaluation device 100 according to embodiment 1. FIG. 7 shows an example of the hardware configuration of the encryption strength evaluation device 100 according to embodiment 1. The encryption strength evaluation device 100 generates an evaluation index of the security of a target encryption against machine learning attacks. More specifically, the encryption strength evaluation device 100 solves the target mathematical problem using a trained model that has learned to solve mathematical problems used in the encryption. The encryption strength evaluation device 100 then calculates a solution success rate as the evaluation index. A user of the encryption strength evaluation device 100 can evaluate the security of the target encryption against machine learning attacks by referring to the solution success rate.

[0016] The encryption strength evaluation device 100 corresponds to an information processing device. The operation procedure of the encryption strength evaluation device 100 corresponds to an information processing method. The program that realizes the operation of the encryption strength evaluation device 100 corresponds to an information processing program.

[0017] First, an example of the hardware configuration of the encryption strength evaluation device 100 will be described with reference to FIG.

[0018] The encryption strength evaluation device 100 is a computer. The encryption strength evaluation device 100 includes, as hardware components, a processor 901, a main memory device 902, an auxiliary memory device 903, a communication device 904, and an input / output device 905. The encryption strength evaluation device 100 also includes, as functional components, an acquisition unit 110, an estimation unit 130, and a solution success rate calculation unit 140 shown in FIG. 1 . The functional components of FIG. 1 are implemented, for example, by programs. Programs that implement these functions are stored in the auxiliary memory device 903. These programs are loaded from the auxiliary memory device 903 to the main memory device 902. The processor 901 then executes these programs to perform the operations of the functional components of FIG. 1 . FIG. 3 schematically illustrates a state in which the processor 901 is executing programs that implement the functions of the functional components of FIG. 1 . The memory unit 120 in FIG. 1 is implemented, for example, by the auxiliary memory device 903. The communication device 904 communicates, for example, with the encrypted data mathematical problem generation device 1000 and the learning device 3000 shown in FIG. 1 . The input / output device 905 is composed of, for example, an input device such as a mouse and a keyboard, and an output device such as a display.

[0019] Next, the encrypted data mathematical problem generating device 1000 and the learning device 3000 will be described with reference to Fig. 1. An example of the functional configuration of the encryption strength evaluation device 100 will also be described.

[0020] The encryption strength evaluation device 100 is connected to an encrypted data mathematical problem generating device 1000 and a learning device 3000 .

[0021] (Encrypted data mathematical problem-forming device 1000) The encrypted data mathematical problem-forming device 1000 converts encrypted data generated by the encryption target encryption into a mathematical problem to be evaluated and a solution to the mathematical problem to be evaluated. Hereinafter, the solution to the mathematical problem to be evaluated generated by the encrypted data mathematical problem-forming device 1000 is referred to as a verification solution. The encryption target encryption is a cryptographic method implemented by a cryptography generation device (not shown) to be analyzed. For example, the encrypted data mathematical problem-forming device 1000 generates an attack equation as the mathematical problem to be evaluated. Furthermore, the encrypted data mathematical problem-forming device 1000 generates a solution to the attack equation as the verification solution. The encrypted data mathematical problem-forming device 1000 may be implemented in the cryptography generation device to be analyzed. In other words, the functionality of the encrypted data mathematical problem-forming device 1000 may be implemented in the cryptography generation device to be analyzed. The function of the encrypted data mathematical problem-forming device 1000 is to convert encrypted data into mathematical problem data and verification solution data. Furthermore, the encryption strength evaluation device 100 may be connected to a storage device that stores the mathematical problem data converted from the encrypted data and the verification solution data, instead of the encrypted data mathematical problem generating device 1000 .

[0022] (Learning device 3000) The learning device 3000 generates a trained model D3. The trained model D3 is used by the estimation unit 130 of the encryption strength evaluation device 100. The learning device 3000 generates a trained model by performing machine learning to calculate solutions to mathematical problems used in encryption. In this embodiment, the learning device 3000 performs machine learning to calculate solutions to mathematical problems other than the mathematical problem to be evaluated, i.e., mathematical problems of encryption other than the encryption to be evaluated. The learning device 3000 may also perform machine learning to calculate solutions to mathematical problems of the encryption to be evaluated (mathematical problems to be evaluated). An example of the learning device 3000 performing machine learning to calculate solutions to mathematical problems to be evaluated will be described later in embodiment 3. Furthermore, the learning device 3000 may perform machine learning for multiple types of machine learning attacks, one for each type of machine learning attack. In this case, the learning device 3000 generates multiple trained models D3 corresponding to the multiple types of machine learning attacks.

[0023] The encryption strength evaluation device 100 includes an acquisition unit 110 , a storage unit 120 , an estimation unit 130 , and a solution success rate calculation unit 140 .

[0024] (Acquisition unit 110) The acquisition unit 110 acquires a mathematical problem dataset D1 and a verification solution dataset D2 from the encrypted data mathematical problem generating device 1000. The mathematical problem dataset D1 is a set of mathematical problems to be evaluated. The verification solution dataset D2 is a set of verification solutions. In other words, the acquisition unit 110 acquires, as the mathematical problem dataset D1, a plurality of mathematical problems to be evaluated that have been converted from a plurality of encrypted data using the encryption to be evaluated. The acquisition unit 110 also acquires, as the verification solution dataset D2, a plurality of verification solutions that have been converted from a plurality of encrypted data using the encryption to be evaluated. Hereinafter, the encrypted data set D1 and the verification solution dataset D2 will be collectively referred to as the datasets to be evaluated.

[0025] (Memory unit 120) The memory unit 120 stores various information. Specifically, the memory unit 120 stores a trained model D3, a mathematical problem dataset D1, and a verification solution dataset D2. If the learning device 3000 generates a trained model D3 for each machine learning attack, the memory unit 120 stores multiple trained models D3 corresponding to multiple types of machine learning attacks. The memory unit 120 outputs the mathematical problem dataset D1 stored at a predetermined time to the estimation unit 130 at each predetermined time. The memory unit 120 also outputs the verification solution dataset D2 stored at a predetermined time to the solution success rate calculation unit 140 at each predetermined time. The memory unit 120 also outputs the trained model D3 to the estimation unit 130. If the memory unit 120 stores multiple trained models D3 corresponding to multiple types of machine learning attacks, the memory unit 120 outputs the trained model D3 corresponding to the machine learning attack to be analyzed to the estimation unit 130. The machine learning attack to be analyzed is specified, for example, by the user of the encryption strength evaluation device 100. Note that one or more network storage devices (not shown) located on a communication network may be used instead of the storage unit 120. In this case, the estimation unit 130 and the solution success rate calculation unit 140 access the network storage device at predetermined time intervals.

[0026] (Estimation unit 130) The estimation unit 130 uses the trained model D3 to calculate a solution to each of the mathematical problems to be evaluated in the mathematical problem dataset D1. The solutions to the mathematical problems to be evaluated calculated by the estimation unit 130 are called calculated solutions. The estimation unit 130 outputs a set of calculated solutions to the solution success rate calculation unit 140 as a calculated solution dataset D4. For example, the estimation unit 130 uses an equation-solving model as the trained model D3. Here, the equation-solving model is a trained model D3 obtained by performing machine learning using data on a set of equation systems and their solutions. In other words, the equation-solving model is a model that represents the solution to the equation system. When the estimation unit 130 uses an equation-solving model, the calculated solution by the estimation unit 130 is a solution to the equation system. Note that the estimation unit 130 may calculate a solution equivalent to the solution to the mathematical problem to be evaluated as the calculated solution. The estimation unit 130 may calculate a solution to a system of equations that is known to be easy to solve. Furthermore, the estimation unit 130 may calculate a plaintext or a secret key as the calculation solution. The trained model D3 may be any trained model obtained by statistical computational learning using a Transformer, a diffusion model, or the like. The estimation unit 130 corresponds to a calculation unit. Furthermore, the processing performed by the estimation unit 130 corresponds to a calculation processing.

[0027] (Solution Success Rate Calculation Unit 140) The solution success rate calculation unit 140 generates an evaluation index for evaluating the evaluation target cipher using the calculated solution dataset D4 from the estimation unit 130 and the verification solution dataset D2 from the storage unit 120. Specifically, the solution success rate calculation unit 140 compares the calculated solutions by the estimation unit 130 with the verification solutions in the verification solution dataset D2 and calculates a solution success rate, which is the rate at which the calculated solutions are correct, as an evaluation index. In other words, the solution success rate calculation unit 140 determines whether the calculated solutions match the verification solutions and counts the number of calculated solutions that match the verification solutions to calculate the solution success rate of the evaluation target mathematical problems. For example, if the mathematical problem dataset D1 is composed of equation-solving problems, the solution success rate calculation unit 140 determines whether the calculated solutions (solutions to the equations) by the estimation unit 130 match the verification solutions (solutions to the equations) in the verification solution dataset D2. The solution success rate calculation unit 140 then counts the number of times the calculated solution matches the verification solution to calculate the solution success rate of the equation.

[0028] ***Explanation of Operation*** Next, an example of the operation of the encryption strength evaluation device 100 according to this embodiment will be described with reference to FIG.

[0029] (Step S11) First, in step S11, the acquisition unit 110 acquires an evaluation target dataset from the encrypted data mathematical problem generating device 1000. The acquisition unit 110 stores the acquired evaluation target dataset in the storage unit 120.

[0030] (Step S12) Next, in step S12, the estimation unit 130 estimates solutions to the mathematical problems to be evaluated using the trained model D3. That is, the estimation unit 130 acquires the mathematical problem dataset D1 and the trained model D3 from the storage unit 120. Then, the estimation unit 130 calculates solutions to each mathematical problem to be evaluated in the mathematical problem dataset D1 as calculated solutions using the trained model D3. The estimation unit 130 outputs a set of calculated solutions to the solution success rate calculation unit 140 as a calculated solution dataset D4. (Step S13) Finally, in step S13, the solution success rate calculation unit 140 calculates the solution success rate using the calculated solution dataset D4 and the verification solution dataset D2. That is, the solution success rate calculation unit 140 compares the calculated solutions in the calculated solution dataset D4 with the verification solutions in the verification solution dataset D2 to calculate the solution success rate. The solution success rate calculation unit 140 displays the calculated solution success rate on the display of the input / output device 905. A user of the encryption strength evaluation device 100 can evaluate the security of the encryption strength evaluation target using the solution success rate displayed on the display.

[0031] ***Description of Effects of the Embodiment*** According to this embodiment, it is possible to evaluate the security of a cipher against machine learning attacks. The cipher strength evaluation device 100 according to this embodiment inputs a mathematical problem dataset into a trained model that has trained to solve mathematical problems. The cipher strength evaluation device 100 according to this embodiment then calculates a solution success rate by comparing the calculated solution dataset with the verification solution dataset. The solution success rate is the probability that a machine learning attack on the cipher to be evaluated will be successful. The higher the solution success rate, the lower the security of the cipher to be evaluated against machine learning attacks, and the lower the solution success rate, the higher the security of the cipher to be evaluated against machine learning attacks. Therefore, by evaluating the solution success rate, it is possible to evaluate the security of the cipher to be evaluated against machine learning attacks. As a result, it is possible to develop a cipher generation device that is resistant to attacks on ciphers using artificial intelligence that are expected in the near future.

[0032] Furthermore, the mathematical problem dataset according to this embodiment is composed of mathematical problems of the cipher to be evaluated (the mathematical problems to be evaluated). Furthermore, the verification solution dataset is composed of solutions to the mathematical problems to be evaluated. Therefore, the encryption strength evaluation device 100 according to this embodiment can calculate the success rate of solving the mathematical problems to be evaluated. Therefore, according to this embodiment, it is possible to evaluate the security of the cipher to be evaluated against machine learning attacks.

[0033] Furthermore, the encryption strength evaluation device 100 according to this embodiment stores a plurality of trained models corresponding to a plurality of types of machine learning attacks. Therefore, according to this embodiment, the security of the encryption to be evaluated against the machine learning attack to be analyzed can be evaluated by evaluating the solution success rate calculated using the trained model corresponding to the machine learning attack to be analyzed.

[0034] Furthermore, according to this embodiment, the security of the cryptographic parameters of the cipher to be evaluated against machine learning attacks can be evaluated by evaluating the success rate of solution. Furthermore, according to this embodiment, the feasibility of a machine learning attack can be evaluated by evaluating the success rate of solution.

[0035] Embodiment 2. In embodiment 1, the encrypted data mathematical problem generating device 1000 converts encrypted data using a target cipher into a target mathematical problem and a solution to the target mathematical problem. In this embodiment, the encryption strength evaluation device 100 converts encrypted data using a target cipher into a target mathematical problem and a solution to the target mathematical problem. In this embodiment, differences from embodiment 1 will be mainly explained. Note that matters not explained below are the same as in embodiment 1.

[0036] ***Description of Configuration*** FIG. 3 shows an example of the functional configuration of a cryptography strength evaluation device 100 according to the second embodiment.

[0037] 3, compared to Fig. 1, a cipher generation device 2000 is provided instead of the encrypted data mathematical problem generating device 1000. Furthermore, a preprocessing unit 150 is added to the cipher strength evaluation device 100. The functions of the preprocessing unit 150 are also realized by a program, similar to the acquisition unit 110 and the like. The program that realizes the functions of the preprocessing unit 150 is executed by a processor 901.

[0038] (Cryptography generating device 2000) The cryptography generating device 2000 is a device for generating cryptography to be analyzed. The cryptography generating device 2000 uses the cryptography to be evaluated as the cryptographic method. The cryptography generating device 2000 is, for example, a symmetric key cryptography generating device conforming to AES (Advanced Encryption Standard), which is a symmetric key block cryptography. The cryptography generating device 2000 may also be a public key cryptography generating device conforming to UOV (Unbalanced Oil and Vineger), which is a public key multivariate polynomial cryptography. The cryptography generating device 2000 may be realized by hardware or a simulator.

[0039] (Acquisition Unit 110) The acquisition unit 110 acquires the encryption data set D21 and the auxiliary data set D22 from the encryption device 2000. The encryption data set D21 is composed of encrypted data and plaintext data generated by the encryption device 2000. The encryption data set D21 is composed of information necessary for the preprocessing unit 150 to generate a mathematical problem to be evaluated. The auxiliary data set D22 is composed of information necessary for the preprocessing unit 150 to generate a solution (verification solution) to the mathematical problem to be evaluated. The encryption data set D21 and the auxiliary data set D22 are collectively referred to as the initial data set. For example, it is assumed that the encryption device 2000 is a symmetric key encryption device conforming to AES. It is also assumed that the encryption attack that is expected to be performed is a secret key recovery attack through the solution of the attack equation described in Non-Patent Document 4. In this case, the encryption data set D21 is composed of plaintext data and encrypted data required to formulate the attack equation. The auxiliary data set D22 consists of data of a secret key used to generate the encrypted data of the encryption data set D21, which corresponds to a solution to the attack equation. It is also assumed that the cryptography generation device 2000 is a public-key cryptography generation device conforming to UOV. It is also assumed that the cryptographic attack that is likely to be carried out is a signature forgery attack through the solution of an equation corresponding to a public key as described in Non-Patent Document 4. In this case, the encryption data set D21 consists of plaintext data and encrypted data. The auxiliary data set D22 also consists of data of a secret key and data of a public key used to generate the encrypted data of the encryption data set D21.

[0040] (Memory Unit 120) In this embodiment, the memory unit 120 also stores various types of information. Specifically, the memory unit 120 stores the trained model D3, the encryption data set D21, the auxiliary data set D22, and the verification solution data set D2 generated by the pre-processing unit 150. The memory unit 120 outputs the encryption data set D21 and the auxiliary data set D22 stored at the predetermined time to the pre-processing unit 150 at predetermined intervals. The memory unit 120 also outputs the verification solution data set D2 stored at the predetermined time to the solution success rate calculation unit 140 at predetermined intervals. Furthermore, the memory unit 120 outputs the trained model D3 to the estimation unit 130.

[0041] (Preprocessing Unit 150) The preprocessing unit 150 analyzes the encrypted data generated by the encryption to be evaluated and extracts a mathematical problem to be evaluated and a verification solution from the encrypted data. That is, the preprocessing unit 150 performs data preprocessing on the encrypted data set D21 and the auxiliary data set D22 input from the storage unit 120 to generate a mathematical problem data set D1 and a verification solution data set D2. The mathematical problem data set D1 and the verification solution data set D2 are the same as those described in the first embodiment. The preprocessing unit 150 performs processing similar to that of the encrypted data mathematical problem generation device 1000 described in the first embodiment. More specifically, the preprocessing unit 150 processes the encrypted data included in the encrypted data set D21 using a mathematical or cryptographic algorithm or the like to convert the encrypted data into a mathematical problem to be evaluated. The preprocessing unit 150 then outputs a set of multiple mathematical problems to be evaluated to the estimation unit 130 as a mathematical problem data set D1. The preprocessing unit 150 also uses the auxiliary data set D22 to process the encrypted data included in the encrypted data set D21 using a mathematical or cryptographic algorithm or the like to convert the encrypted data into a solution (verification solution) for the mathematical problem to be evaluated. The preprocessing unit 150 outputs a set of verification solutions to the storage unit 120 as a verification solution data set D2. For example, it is assumed that the cryptography generation device 2000 is a symmetric key cryptography generation device conforming to the AES. It is also assumed that the cryptographic attack that is likely to be performed is a secret key recovery attack through the solution of the attack equation described in Non-Patent Document 4. In this case, the preprocessing unit 150 formulates an attack equation from the plaintext data and encrypted data that constitute the encrypted data set D21. The preprocessing unit 150 then adds the attack equation to the mathematical problem data set D1. The preprocessing unit 150 also calculates a solution to the attack equation from the secret key data that constitutes the auxiliary data set D22. The preprocessing unit 150 then adds the solution to the attack equation to the verification solution data set D2. It is also assumed that the cryptographic generator 2000 is a public key cryptographic generator conforming to UOV, and that the cryptographic attack that is presumed to be performed is a signature forgery attack through solving an equation corresponding to the public key described in Non-Patent Document 4.In this case, the preprocessing unit 150 formulates an equation corresponding to the public key from the encryption data set D21 and the public key data constituting the auxiliary data set D22. Then, the preprocessing unit 150 adds the equation to the mathematical problem data set D. Furthermore, the preprocessing unit 150 calculates a solution to the attack equation from the public key data constituting the auxiliary data set D22. Then, the preprocessing unit 150 adds the solution to the attack equation to the verification solution data set D2. The preprocessing unit 150 corresponds to a mathematical problem extraction unit.

[0042] The estimation unit 130 and the solution success rate calculation unit 140 are the same as those shown in the first embodiment.

[0043] ***Explanation of Operation*** Next, an example of operation of the encryption strength evaluation device 100 according to this embodiment will be described with reference to FIG.

[0044] (Step S21) First, in step S21, the acquiring unit 110 acquires the initial data set generated by the code generating device 2000.

[0045] (Step S22) Next, in step S22, the preprocessing unit 150 performs preprocessing on the initial dataset. More specifically, as described above, the preprocessing unit 150 performs processing such as a mathematical or cryptographic algorithm on the initial dataset. Then, the preprocessing unit 150 generates a mathematics problem dataset D1 and a verification solution dataset D2.

[0046] (Step S23) Next, in step S23, the estimation unit 130 estimates solutions to the mathematical problems to be evaluated using the trained model D3. That is, the estimation unit 130 acquires the trained model D3 from the storage unit 120. The estimation unit 130 also acquires the mathematical problem dataset D1 from the preprocessing unit 150. Then, the estimation unit 130 uses the trained model D3 to calculate solutions to the mathematical problems to be evaluated in the mathematical problem dataset D1 as calculated solutions.

[0047] (Step S24) Finally, in step S24, the solution-finding success rate calculation unit 140 calculates the solution-finding success rate using the calculated solution data set D4 and the verification solution data set D2.

[0048] ***Explanation of Effects of the Embodiment*** In this embodiment, the encryption strength evaluation device 100 generates the mathematical problem data set D1 and the verification solution data set D2. Therefore, according to this embodiment, the encrypted data mathematical problem generating device 1000 described in the first embodiment is not necessary, and the system configuration can be simplified.

[0049] Embodiment 3. In Embodiments 1 and 2, the learning device 3000 performs machine learning on mathematical problems other than the mathematical problems of the cipher to be evaluated (the mathematical problems to be evaluated). However, there is a possibility that the mathematical problems to be evaluated are statistically exceptional from the mathematical problems on which the learning device 3000 has performed machine learning. In this case, there is a possibility that the security of the cipher to be evaluated against machine learning attacks cannot be appropriately evaluated. Therefore, in this embodiment, an example will be described in which the learning device 3000 performs machine learning on the mathematical problems to be evaluated. In this embodiment, the differences from Embodiments 1 and 2 will mainly be described. Note that matters not described below are the same as in Embodiments 1 and 2.

[0050] ***Description of Configuration*** Fig. 5 shows an example of the functional configuration of a learning device 3000 according to embodiment 3. The learning device 3000 performs machine learning to calculate a solution to a mathematical problem to be evaluated, and generates a trained model. The learning device 3000 is connected to a cryptography generation device 2000 and a cryptography strength evaluation device 100. The cryptography generation device 2000 is the same as that described in embodiment 2. The cryptography strength evaluation device 100 is the same as that described in embodiment 1 and embodiment 2.

[0051] The learning device 3000 includes a learning dataset acquisition unit 310 , a learning pre-processing unit 320 , a learning unit 330 , and a learning storage unit 340 .

[0052] (Learning dataset acquisition unit 310) The learning dataset acquisition unit 310 acquires a learning dataset D31 to be used for machine learning. Here, the learning dataset D31 includes the encryption dataset D21 and the auxiliary dataset D22 described in embodiment 2. In other words, the learning dataset D31 includes information necessary for the learning pre-processing unit 320 to generate a mathematical problem to be evaluated, and information necessary for the learning pre-processing unit 320 to generate a solution (verification solution) to the mathematical problem to be evaluated.

[0053] (Learning Preprocessing Unit 320) The learning preprocessing unit 320 performs preprocessing of the learning dataset D31, similar to the preprocessing unit 150 described in the second embodiment. That is, the learning preprocessing unit 320 analyzes the encrypted data generated by the encryption to be evaluated and extracts the mathematical problem to be evaluated and the verification solution from the encrypted data. More specifically, the learning preprocessing unit 320 processes the encrypted data included in the encrypted dataset D21 using a mathematical or cryptographic algorithm or the like to convert the encrypted data into the mathematical problem to be evaluated. In this embodiment, too, the set of data on the mathematical problem to be evaluated is referred to as the mathematical problem dataset D1. Furthermore, the learning preprocessing unit 320 processes the encrypted data included in the encrypted dataset D21 using a mathematical or cryptographic algorithm or the like, using the auxiliary dataset D22, to convert the encrypted data into a solution (verification solution) of the mathematical problem to be evaluated. In this embodiment, too, the set of solutions (verification solutions) of the mathematical problem to be evaluated converted from the encrypted data is referred to as the verification solution dataset D2. The mathematical problem dataset D1 and the verification solution dataset D2 are the same as those described in the first and second embodiments. The pre-learning processing unit 320 outputs the generated mathematical problem data set D1 and verification solution data set D2 to the learning unit 330 as an evaluation target encryption data set D32.

[0054] (Learning Unit 330) The learning unit 330 performs machine learning using the evaluation target encryption data set D32 (the mathematical problem data set D1 and the verification solution data set D2) to generate a trained model D3. As described in the first embodiment, the learning unit 330 performs statistical computational learning using a Transformer, a diffusion model, etc.

[0055] ***Explanation of Operation*** Next, the operation of learning device 3000 according to this embodiment will be described with reference to FIG.

[0056] (Step S31) First, in step S31, the training data set acquisition unit 310 acquires the training data set D31 from the code generation device 2000.

[0057] (Step S32) Next, in step S32, the pre-learning processing unit 320 performs pre-learning processing on the training dataset D31. More specifically, the pre-learning processing unit 320 generates a mathematical problem dataset D1 and a verification solution dataset D2 using the encryption dataset D21 and auxiliary dataset D22 included in the training dataset D31. Then, the pre-learning processing unit 320 outputs the generated mathematical problem dataset D1 and verification solution dataset D2 to the training unit 330 as an evaluation target encryption dataset D32.

[0058] (Step S33) Next, in step S33, the learning unit 330 performs machine learning using the evaluation target encryption data set D32 created in step S32, and generates a trained model D3. The learning unit 330 transmits the generated trained model D3 to the encryption strength evaluation device 100.

[0059] In the encryption strength evaluation device 100, the trained model D3 generated in this manner is stored in the storage unit 120. Then, in the encryption strength evaluation device 100, the estimation unit 130 generates a calculated solution dataset D4 using the trained model D3 according to the procedures described in the first and second embodiments. Furthermore, the solution success rate calculation unit 140 calculates a solution success rate using the calculated solution dataset D4 and the verification solution dataset D2.

[0060] ***Description of Effects of the Embodiment*** In this embodiment, the learning device 3000 performs machine learning on the mathematical problem to be evaluated. Therefore, according to this embodiment, it is possible to generate a trained model corresponding to the mathematical problem to be evaluated. As a result, according to this embodiment, it is possible to appropriately evaluate the security of the cipher to be evaluated against machine learning attacks.

[0061] ***Application Examples*** The encryption strength evaluation device 100 according to the present disclosure can be applied to, for example, encryption technologies whose security is based on the difficulty of solving mathematical problems. For example, when designing a cryptography device, or when generating and communicating ciphertext using the cryptography device, the encryption strength evaluation device 100 can calculate an evaluation index for the security of a cryptography against machine learning attacks. This allows users to evaluate the security of a cryptography against machine learning attacks based on a quantitative evaluation index that does not rely on human subjectivity.

[0062] Although the first to third embodiments have been described above, two or more of these embodiments may be combined and implemented. Alternatively, one of these embodiments may be partially implemented. Alternatively, two or more of these embodiments may be partially combined and implemented. Furthermore, the configurations and procedures described in these embodiments may be modified as necessary.

[0063] *** Supplementary Explanation of Hardware Configuration *** Here, a supplementary explanation of the hardware configuration of the encryption strength evaluation device 100 will be provided. The processor 901 shown in FIG. 7 is an IC (Integrated Circuit) that performs processing. The processor 901 is a CPU (Central Processing Unit), a DSP (Digital Signal Processor), or the like. The main memory device 902 shown in FIG. 7 is a RAM (Random Access Memory). The auxiliary memory device 903 shown in FIG. 7 is a ROM (Read Only Memory), a flash memory, an HDD (Hard Disk Drive), or the like. The communication device 904 shown in FIG. 7 is an electronic circuit that executes data communication processing. The communication device 904 is, for example, a communication chip or a NIC (Network Interface Card).

[0064] The auxiliary storage device 903 also stores an operating system (OS). At least a portion of the OS is executed by the processor 901. While executing at least a portion of the OS, the processor 901 executes programs that implement the functions of the functional components shown in FIGS. 1 and 3. The processor 901 executes the OS to perform tasks, memory management, file management, communication control, and the like. At least one of information, data, signal values, and variable values ​​indicating the results of processing by the functional components shown in FIGS. 1 and 3 is stored in at least one of the main storage device 902, the auxiliary storage device 903, and registers and cache memory within the processor 901. The programs that implement the functions of the functional components shown in FIGS. 1 and 3 may be stored on a portable recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. Portable recording media storing the programs that implement the functions of the functional components shown in FIGS. 1 and 3 may be distributed.

[0065] Furthermore, the term "unit" of at least any of the functional components shown in FIGS. 1 and 3 may be interpreted as a "circuit," a "step," a "procedure," a "process," or a "circuitry." The encryption strength evaluation device 100 may be implemented by a processing circuit. The processing circuit may be, for example, a logic IC (Integrated Circuit), a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), or an FPGA (Field-Programmable Gate Array). In this case, the functional components shown in FIGS. 1 and 3 are implemented as parts of the processing circuit. In this specification, the generic concept of a processor and a processing circuit is referred to as a "processing circuitry." In other words, a processor and a processing circuit are each specific examples of "processing circuitry."

[0066] Various aspects of the present disclosure are described below as appendices. (Appendix 1) An information processing device having: a calculation unit that calculates, as a calculated solution, a solution to a mathematical problem to be evaluated, which is a mathematical problem to be used in a cipher to be evaluated, using a trained model obtained by performing machine learning to calculate a solution to a mathematical problem to be used in a cipher to be evaluated; and an evaluation index generation unit that generates, using the calculated solution, an evaluation index for evaluating the cipher to be evaluated. (Appendix 2) The information processing device according to Appendix 1, wherein the evaluation index generation unit calculates, as the evaluation index, a rate of accuracy of the calculated solution. (Appendix 3) The information processing device according to Appendix 1 or 2, wherein the evaluation index generation unit compares the calculated solution with a verification solution, which is the solution to the mathematical problem to be evaluated, to calculate a rate of accuracy of the calculated solution. (Supplementary Note 4) The information processing device according to Supplementary Note 3, wherein the information processing device further includes an acquisition unit that acquires the mathematical problem to be evaluated and the verification solution, the calculation unit calculates the solution to the mathematical problem to be evaluated acquired by the acquisition unit as the calculated solution, and the evaluation index generation unit compares the calculated solution with the verification solution acquired by the acquisition unit to calculate a rate of accuracy of the calculated solution. (Supplementary Note 5) The information processing device according to any one of Supplements 1 to 4, wherein the calculation unit calculates the calculated solution using one of a plurality of trained models obtained by performing machine learning for each of a plurality of types of machine learning attacks. (Supplementary Note 6) The information processing device according to Supplementary Note 3, wherein the information processing device further comprises a mathematical problem extraction unit that analyzes encrypted data generated by the encryption to be evaluated and extracts the mathematical problem to be evaluated and the verification solution from the encrypted data, wherein the calculation unit calculates the solution to the mathematical problem to be evaluated extracted by the mathematical problem extraction unit as the calculated solution, and the evaluation index generation unit compares the calculated solution with the verification solution extracted by the mathematical problem extraction unit to calculate a rate of accuracy of the calculated solution. (Supplementary Note 7) The information processing device according to any one of Supplements 1 to 6, wherein the calculation unit calculates the solution to the mathematical problem to be evaluated using a trained model obtained by performing machine learning for calculating the solution to the mathematical problem to be evaluated.(Supplementary Note 8) The information processing device according to Supplementary Note 7, wherein the calculation unit analyzes encrypted data generated by the cipher to be evaluated to extract the mathematical problem to be evaluated from the encrypted data, and calculates a solution to the extracted mathematical problem to be evaluated using a trained model obtained by the machine learning in a learning device that performs machine learning to calculate a solution to the extracted mathematical problem to be evaluated. (Supplementary Note 9) An information processing method in which a computer calculates a solution to the mathematical problem to be evaluated, which is a mathematical problem used in the cipher to be evaluated, as a calculated solution using a trained model obtained by performing machine learning to calculate a solution to a mathematical problem used in the cipher to be evaluated, and the computer generates an evaluation index for evaluating the cipher to be evaluated using the calculated solution. (Supplementary Note 10) An information processing program that causes a computer to execute a calculation process of calculating a solution to the mathematical problem to be evaluated, which is a mathematical problem used in the cipher to be evaluated, as a calculated solution using a trained model obtained by performing machine learning to calculate a solution to a mathematical problem used in the cipher to be evaluated, and an evaluation index generation process of generating an evaluation index for evaluating the cipher to be evaluated using the calculated solution. (Supplementary Note 11) A learning device having: a pre-learning processing unit that analyzes encrypted data generated by a cipher to be evaluated and extracts from the encrypted data a mathematical problem to be evaluated, which is a mathematical problem used in the cipher to be evaluated; and a learning unit that performs machine learning to calculate a solution to the mathematical problem to be evaluated extracted by the pre-learning processing unit.

[0067] 100 Encryption strength evaluation device, 110 Acquisition unit, 120 Memory unit, 130 Estimation unit, 140 Solution success rate calculation unit, 150 Preprocessing unit, 310 Learning dataset acquisition unit, 320 Learning preprocessing unit, 330 Learning unit, 901 Processor, 902 Main memory device, 903 Auxiliary memory device, 904 Communication device, 905 Input / output device, 1000 Encrypted data mathematical problem generation device, 2000 Encryption generation device, 3000 Learning device.

Claims

1. An information processing device having: a calculation unit that calculates a solution to a mathematical problem to be evaluated, which is a mathematical problem to be used in a cipher to be evaluated, as a calculated solution using a trained model obtained by performing machine learning to calculate a solution to a mathematical problem to be used in a cipher to be evaluated; and an evaluation index generation unit that uses the calculated solution to generate an evaluation index for evaluating the cipher to be evaluated.

2. The information processing device according to claim 1, wherein the evaluation index generation unit calculates the accuracy rate of the calculated solution as the evaluation index.

3. The information processing device according to claim 1 or 2, wherein the evaluation index generation unit compares the calculated solution with a verification solution, which is the solution to the mathematical problem to be evaluated, and calculates the accuracy rate of the calculated solution.

4. The information processing device according to claim 3, further comprising an acquisition unit that acquires the mathematical problem to be evaluated and the verification solution, wherein the calculation unit calculates the solution to the mathematical problem to be evaluated acquired by the acquisition unit as the calculated solution, and wherein the evaluation index generation unit compares the calculated solution with the verification solution acquired by the acquisition unit to calculate the accuracy rate of the calculated solution.

5. An information processing device according to any one of claims 1 to 4, wherein the calculation unit calculates the calculated solution using one of a plurality of trained models obtained by performing machine learning for each of a plurality of types of machine learning attacks.

6. The information processing device according to claim 3, further comprising a mathematical problem extraction unit that analyzes encrypted data generated by the encryption to be evaluated and extracts the mathematical problem to be evaluated and the verification solution from the encrypted data; the calculation unit calculates the solution to the mathematical problem to be evaluated extracted by the mathematical problem extraction unit as the calculated solution; and the evaluation index generation unit compares the calculated solution with the verification solution extracted by the mathematical problem extraction unit to calculate the accuracy rate of the calculated solution.

7. An information processing device described in any one of claims 1 to 6, wherein the calculation unit calculates the solution to the mathematical problem to be evaluated using a trained model obtained by performing machine learning to calculate the solution to the mathematical problem to be evaluated.

8. The information processing device described in claim 7, wherein the calculation unit analyzes encrypted data generated by the encryption to be evaluated, extracts the mathematical problem to be evaluated from the encrypted data, and calculates the solution to the mathematical problem to be evaluated using a trained model obtained by machine learning in a learning device that performs machine learning to calculate the solution to the extracted mathematical problem to be evaluated.

9. An information processing method in which a computer uses a trained model obtained by performing machine learning to calculate solutions to mathematical problems used in cryptography to calculate a calculated solution to a mathematical problem to be evaluated, which is a mathematical problem used in a cryptography to be evaluated, and the computer uses the calculated solution to generate an evaluation index for evaluating the cryptography to be evaluated.

10. An information processing program that causes a computer to execute a calculation process that calculates a solution to a mathematical problem to be evaluated, which is a mathematical problem to be used in a cipher to be evaluated, as a calculated solution using a trained model obtained by performing machine learning to calculate a solution to a mathematical problem to be used in a cipher to be evaluated, and an evaluation index generation process that uses the calculated solution to generate an evaluation index for evaluating the cipher to be evaluated.

11. A learning device having a pre-learning processing unit that analyzes encrypted data generated by a cipher to be evaluated and extracts from the encrypted data a mathematical problem to be evaluated that is a mathematical problem used in the cipher to be evaluated, and a learning unit that performs machine learning to calculate a solution to the mathematical problem to be evaluated extracted by the pre-learning processing unit.