Database coupling method and program

Abstract

This database coupling method executes a right outer join, with the left side of the join being a first database which is encrypted and held by a first device, and the right side of the join being a second database which is plaintext and held by a second device. The database coupling method includes: a first procedure for executing an OPRF using a key set of the first database as input; a second procedure for executing a PC using the key set of the first database and a key set of the second database as input; a third procedure for calculating a random number sequence related to the key set of the second database; a fourth procedure for executing an OT using, as input, the random number sequence and a number set of elements, which are indicated as not being included as keys of the first database among characteristic vectors obtained by the PC; a fifth procedure for executing the OPRF using the random number sequence as input; a sixth procedure for transmitting, to the second device, an element sequence including an element associating a random number and a secret value of a value form the first database with each other; and a seventh procedure for calculating an output database.

Description

Database linking method and program

[0001] The present disclosure relates to a database linking method and program.

[0002] When two parties (participants) each have a database containing secret information, there are known methods for merging the databases (so-called internal or external database merging) without leaking the database information to the other party. For example, many methods have been proposed for merging encrypted (including secret sharing) databases. Another method has been proposed, for example, for merging the other party's encrypted database with one's own plaintext database (Non-Patent Document 1). Hereinafter, the method for merging the other party's database, which is fully or partially encrypted, with one's own plaintext database will be referred to as the "one-sided secret database merging method."

[0003] In general, any computation using both plaintext and encrypted data is faster than a computation using encrypted data, making one-sided secret database join a useful technique in some circumstances.

[0004] Koji Chida, Koki Hamada, Atsunori Ichikawa, Masanobu Kii, Junichi Tomida: Communication-Efficient Inner Product Private Join and Compute with Cardinality. IACR Cryptol. ePrint Arch. 2022: 338 (2022)

[0005] However, conventional one-sided secret database binding methods can require large amounts of calculation depending on the size of the database. For example, the one-sided secret database binding method described in Non-Patent Document 1 uses a mathematical structure called a cyclic group, but the computational complexity of this cyclic group operation is linear with the database sizes of two parties (participants). Group operations are classified as public key cryptosystems in cryptography and are characterized by large amounts of calculation. Therefore, one-sided secret database binding methods, in which the computational complexity of group operations is linear with the database size, inevitably require large amounts of calculation.

[0006] The present disclosure has been made in view of the above points, and provides a technique that can realize an efficient one-sided secret database join method.

[0007] A database join method according to one aspect of the present disclosure is a database join method for right outer joining a first database and a second database, with an encrypted first database held by a first device as the left side and a plaintext second database held by a second device as the right side, the method comprising: a first step in which the first device and the second device execute an oblivious pseudorandom function (OPRF) protocol using a first set of keys representing a set of keys of the first database as input, and the first device obtains a sequence of random numbers related to the first set of keys as a first random number sequence; and a second step in which the first device and the second device execute a permuted pseudorandom function (PCF) protocol using the first set of keys and a second set of keys representing a set of keys of the second database as input. a second step in which the second device executes an oblivious characteristic protocol, in which the second device obtains a random permutation π, and the first device obtains a characteristic vector whose i-th element indicates whether the π(i)-th key of the second key set is included in the first key set; a third step in which the second device calculates a sequence of random numbers related to the second key set as a second random number sequence using the permutation π; and a third step in which the first device and the second device perform an oblivious characteristic protocol using the second random number sequence and a set of numbers of elements in the characteristic vector that indicate that the key is not included as a key of the first database as input.a fourth step in which the first device executes an OPRF protocol using the second random number sequence as an input, and the first device obtains a third random number sequence consisting of random numbers for numbers included in the number set from among the random numbers included in the second random number sequence; a fifth step in which the first device and the second device execute an OPRF protocol using the second random number sequence as an input, and the second device obtains a fourth random number sequence that is a sequence of random numbers related to the second random number sequence; a sixth step in which the first device transmits to the second device an element sequence obtained by randomly rearranging elements that associate random numbers included in the first random number sequence with secret values ​​obtained by encrypting values ​​included in a value set of the first database, and elements that associate random numbers included in the third random number sequence with secret values ​​obtained by encrypting a predetermined value; and a seventh step in which the second device uses the fourth random number sequence and the element sequence to calculate an output database that associates values ​​included in a value set of the second database with secret values ​​of elements included in the element sequence.

[0008] Techniques are provided that allow for efficient one-sided secret database join methods.

[0009] It is a figure which shows an example of the whole configuration of the one-sided secret database linking system based on this embodiment. It is a figure which shows an example of the hardware configuration of the participant device based on this embodiment. It is a figure which shows an example of the functional configuration of the participant device based on this embodiment. It is a flowchart which shows an example of the one-sided secret database linking process based on this embodiment.

[0010] An embodiment of the present invention will be described below. In the following embodiment, an efficient one-sided secret database binding method will be proposed, and then a one-sided secret database binding system 1 that realizes this one-sided secret database binding method will be described.

[0011] <Preparation> The following describes the existing technology used in the one-sided secret database join method proposed in this embodiment, where [n]={1, . . . , n}.

[0012] The one-sided secret database joining method proposed in this embodiment uses three existing two-party protocols: oblivious transfer (OT), oblivious pseudorandom function (OPRF), and permuted characteristic (PC) (Reference 1).

[0013] ・OT OT is a set X = {x １ , ..., x ｎ} and the receiver has the set S ⊆ [n]. The sender does not get any information, and the receiver can ｉ} ｉ∈Ｓ It is a protocol that calculates as output.

[0014] OPRF OPRF is a set Y = {y １ , ..., y ｎ}, the sender calculates the key SK of a random pseudo-random function f as the output while hiding each other's input, and the receiver calculates the pseudo-random function value f(SK, y １ ),...,f(SK,y ｎ ) as output, where the pseudorandom function f is assumed to be known by both the sender and the receiver.

[0015] ・PC PC is a set X = {x １ , ..., x ｎ} and the set Y = {y １ , ..., y ｎ}, the sender inputs a random permutation π, and the receiver inputs a feature vector e = (e １ , ..., e ｎ ) (where, for i∈[n], x π（ｉ） When Y contains e ｉ = 1, x π（ｉ） When is not included in Y, e ｉ = 0) as output.

[0016] It is known that the above three bilateral protocols OT, OPRF, and PC can be realized using group operations a number of times independent of n, or without using group operations at all (Reference 1).

[0017] <One-sided Secret Database Join Method (Proposed Method)> Below, we use the three two-party protocols OT, OPRF, and PC described in the preparation above to construct a one-sided secret database join method in which the computational complexity of group operations is sublinear with respect to the size of the databases to be joined (including the case where group operations are not used at all). Because this one-sided secret database join method is a two-party protocol, hereinafter, the participants in this one-sided secret database join method will be referred to as "Participant A" and "Participant B."

[0018] Participant A has a database (K, V) = ((k １ , v １ ), ..., (k ｎ , v ｎ )) τ Similarly, participant B has a database (K', V') = ((k １ ',v １ '), ..., (k ｎ ',v ｎ ')) τ where τ is the symbol for transposition.

[0019] It is assumed that there are no duplicate keys in database (K, V), and similarly, there are no duplicate keys in database (K', V'). For simplicity, it is assumed that the size of database (K, V) and the size of database (K', V') are both n, and are the same. However, even if database (K, V) and database (K', V') have different sizes, the one-sided secret database join method proposed in this embodiment can be implemented in the same way.

[0020] In the one-sided secret database join method proposed in this embodiment, when database (K, V) is on the left side and database (K', V') is on the right side, only participant B can obtain the output database, which is the result of right outer joining the encrypted database (K, V) and the plaintext database (K', V') based on their respective keys. That is, output database (W, V') = ((w １ , v １ '), ..., (w ｎ , v ｎ ')) τ (where, for i∈[n], k ｊ = k ｉ If there exists a j such that ｉ = Enc(v ｊ ), for any j, k ｊ ≠k ｉ When ' is ｉ =Enc(0)) is available only to participant B. Here, Enc means some kind of encryption.

[0021] In this case, the one-sided secret database join method proposed in this embodiment is composed of the following steps 1 to 7.

[0022] Step 1: Participant A is the receiver and participant B is the sender. At this time, participants A and B execute OPRF with K as input of participant A, and participant A outputs a sequence of pseudorandom function values ​​(f １ , ..., f ｎ ) = (f(SK, k １ ),...,f(SK,k ｎ )), participant B each gets a key SK as output.

[0023] Step 2: Participant A is the receiver and participant B is the sender. At this time, participant A's input is K and participant B's input is K', and participants A and B execute PC. Participant A outputs a feature vector e = (e １ , ..., e ｎ ), participant B gets permutation π. Note that for i ∈ [n], k π（ｉ） When ' is included in K, e ｉ = 1, k π（ｉ） When ' is not included in K, e ｉ=0.

[0024] Step 3: Participant B generates a sequence of pseudorandom function values ​​G = (g １ , ..., g ｎ ) = (f(SK, k π（１） '),...,f(SK,k π（ｎ） ')) to calculate.

[0025] Step 4: Participant A is the receiver and participant B is the sender. Also, S = {i | e ｉ = 0}. At this time, participants A and B execute OT with participant A's input as S and participant B's input as G, and participant A outputs {g ｉ} ｉ∈Ｓ get.

[0026] Step 5: Participant A is the sender and participant B is the receiver. At this time, participants A and B execute OPRF with participant B's input as G, and participant A outputs a key SK', and participant B outputs a sequence of pseudorandom function values ​​(h １ , ..., h ｎ ) = (f(SK', g １ ),...,f(SK',g ｎ )) are obtained respectively.

[0027] Step 6: Participant A uses F = ((f １ , Enc(v １ )), ..., (f ｎ , Enc(v ｎ )), {(g ｉ , Enc(0))} ｉ∈Ｓ ) are randomly shuffled and sent to participant B. Hereafter, the elements of F are randomly shuffled (rearranged) and sent to participant B. １ ', z １ ), ..., (h ｎ＋｜Ｓ｜ ', z ｎ＋｜Ｓ｜ )) where each (f ｉ , Enc(v ｉ )) and each (g ｉ , Enc(0)) is an element of F.

[0028] Step 7: Participant B assigns h ｉ =h ｊ 'Z'ｊ Wow ｉ As, w ｉ and v ｉ By combining ' and (w ｉ , v ｉ This allows participant B to obtain the output database (W, V').

[0029] As a result, compared to conventional one-sided secret database join methods, more efficient one-sided secret database join is possible. This is because OT can obtain an output without using group operations a number of times that is independent of the database size n or without using group operations at all, thereby significantly reducing the amount of calculation. Furthermore, since OPRF and PC are protocols that can be constructed based on OT, OPRF and PC, like OT, can also obtain an output without using group operations a number of times that is independent of the database size n or without using group operations at all, thereby significantly reducing the amount of calculation.

[0030] <Example of Overall Configuration of One-Sided Secret Database Linking System 1> An example of the overall configuration of a one-sided secret database linking system 1 that realizes the one-sided secret database linking method proposed above will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the overall configuration of the one-sided secret database linking system 1 according to this embodiment.

[0031] As shown in Figure 1, the one-sided secret database linking system 1 according to this embodiment includes a participant device 10A, which is participant A, and a participant device 10B, which is participant B. The participant devices 10A and 10B are communicatively connected via a communication network 20, which may include the Internet, for example. Hereinafter, when there is no need to distinguish between the participant devices 10A and 10B, they will be referred to as "participant devices 10."

[0032] The participant devices 10 are various devices that participate in the one-sided secret database join method. Any computer (information processing device) or computer system (information processing system) can be used as the participant device 10. Specific examples of participant devices 10 that can be used include general-purpose servers, personal computers, smartphones, tablet terminals, wearable devices, game consoles, in-vehicle devices, IoT (Internet of Things) devices, and communication devices.

[0033] <Example of Hardware Configuration of Participant Device 10> An example of the hardware configuration of the participant device 10 according to this embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the hardware configuration of the participant device 10 according to this embodiment.

[0034] 2, the participant device 10 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a random access memory (RAM) 105, a read only memory (ROM) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is connected via a bus 109 so as to be able to communicate with each other.

[0035] The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 102 is, for example, a display, a display panel, etc. Note that the participant device 10 does not necessarily have to have at least one of the input device 101 and the display device 102, for example.

[0036] The external I / F 103 is an interface with an external device such as a recording medium 103a. Examples of the recording medium 103a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0037] The communication I / F 104 is an interface for connecting the participant device 10 to the communication network 20. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 106 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 107 is a non-volatile storage device such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory. The processor 108 is a variety of arithmetic devices such as a CPU (Central Processing Unit).

[0038] 2 is an example, and the hardware configuration of the participant device 10 is not limited to this. For example, the participant device 10 may have multiple auxiliary storage devices 107 or multiple processors 108, may not have some of the hardware shown in the figure, or may have various hardware other than the hardware shown in the figure.

[0039] <Example of Functional Configuration of Participant Device 10> An example of the functional configuration of the participant device 10 according to this embodiment will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the functional configuration of the participant device 10 according to this embodiment.

[0040] As shown in FIG. 3 , the participant device 10 according to this embodiment includes a protocol execution unit 201 and a database storage unit 202. The protocol execution unit 201 is realized, for example, by a process in which one or more programs installed in the participant device 10 are executed by the processor 108 or the like. The database storage unit 202 is realized, for example, by a storage area such as the auxiliary storage device 107. Hereinafter, the protocol execution unit 201 of the participant device 10A will be referred to as the "protocol execution unit 201A," and the protocol execution unit 201 of the participant device 10B will be referred to as the "protocol execution unit 201B." Similarly, the database storage unit 202 of the participant device 10A will be referred to as the "database storage unit 202A," and the database storage unit 202 of the participant device 10B will be referred to as the "database storage unit 202B."

[0041] The protocol execution unit 201 executes processing for implementing the one-sided secret database binding method with other participant devices 10 (hereinafter also referred to as one-sided secret database binding processing).

[0042] The database storage unit 202 stores a database (DB) that is the target of the one-sided secret database merging process. That is, the database storage unit 202A of the participant device 10A stores a database (K, V)=((k １ , v １ ), ..., (k ｎ , v ｎ )) τ Similarly, the database storage unit 202B of the participant device 10B stores the database (K', V')=((k １ ',v １ '), ..., (k ｎ ',v ｎ ')) τ Remember.

[0043] <One-sided secret database linking process> The one-sided secret database linking process according to this embodiment will be described below with reference to Fig. 4. Fig. 4 is a flowchart showing an example of the one-sided secret database linking process according to this embodiment.

[0044] Step S101: The protocol executor 201A of the participant device 10A and the protocol executor 201B of the participant device 10B execute the above procedure 1. That is, the protocol executor 201A and the protocol executor 201B execute OPRF with the participant device 10A as the receiver, the participant device 10B as the sender, and K as the input of the participant device 10A, and generate a sequence of pseudorandom function values ​​(f １ , ..., f ｎ ) = (f(SK, k １ ),...,f(SK,k ｎ ) and calculate a key SK as the output of protocol execution unit 201B.

[0045] Step S102: The protocol executor 201A of the participant device 10A and the protocol executor 201B of the participant device 10B execute the above procedure 2. That is, the protocol executor 201A and the protocol executor 201B execute PC with the participant device 10A as the receiver, the participant device 10B as the sender, the input of the participant device 10A as K, and the input of the participant device 10B as K', and obtain the feature vector e=(e １ , ..., e ｎ ), and calculate the permutation π as the output of protocol execution unit 201B.

[0046] Step S103: The protocol execution unit 201B of the participant device 10B executes the above procedure 3. That is, the protocol execution unit 201B executes the sequence G=(g １ , ..., g ｎ ) = (f(SK, k π（１） '),...,f(SK,k π（ｎ） ')) to calculate.

[0047] Step S104: The protocol executor 201A of the participant device 10A and the protocol executor 201B of the participant device 10B execute the above procedure 4. That is, the protocol executor 201A and the protocol executor 201B treat the participant device 10A as the receiver, the participant device 10B as the sender, and the input of the participant device 10A as S={i|e ｉ =0}, the participant device 10B executes OT with G as the input, and the protocol execution unit 201A outputs {g ｉ} ｉ∈Ｓ Calculate.

[0048] Step S105: The protocol executor 201A of the participant device 10A and the protocol executor 201B of the participant device 10B execute the above procedure 5. That is, the protocol executor 201A and the protocol executor 201B execute OPRF with the participant device 10A as the sender, the participant device 10B as the receiver, and the input of the participant device 10B as G, and output the key SK′ as the output of the protocol executor 201A and the sequence of pseudorandom function values ​​(h １ , ..., h ｎ ) = (f(SK', g１ ),...,f(SK',g ｎ )) are calculated respectively.

[0049] Step S106: The protocol executor 201A of the participant device 10A executes the above procedure 6. That is, the protocol executor 201A executes F=((f １ , Enc(v １ )), ..., (f ｎ , Enc(v ｎ )), {(g ｉ , Enc(0))} ｉ∈Ｓ The elements of (h) are randomly shuffled. １ ', z １ ), ..., (h ｎ＋｜Ｓ｜ ', z ｎ＋｜Ｓ｜ )) and create this ((h １ ', z １ ), ..., (h ｎ＋｜Ｓ｜ ', z ｎ＋｜Ｓ｜ )) to the participant device 10B.

[0050] Step S107: The protocol execution unit 201B of the participant device 10B executes the above procedure 7. That is, the protocol execution unit 201B executes the following procedure for i∈[n]: ｉ =h ｊ 'Z' ｊ Wow ｉ As, w ｉ and v ｉ By combining ' and (w ｉ , v ｉ As a result, the participant device 10B can obtain the output database (W, V').

[0051] <Summary> As described above, the one-sided secret database binding system 1 according to this embodiment can realize a one-sided secret database binding method in which the computational complexity of group operations is sublinear with respect to the size of the databases to be bound (including the case where group operations are not used at all) by utilizing the three two-party protocols OT, OPRF, and PC. As a result, the one-sided secret database binding system 1 according to this embodiment can achieve one-sided secret database binding that is more efficient than conventional one-sided secret database binding methods.

[0052] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0053] [References] Reference 1: Gayathri Garimella, Payman Mohassel, Mike Rosulek, Saeed Sadeghian, Jaspal Singh: Private Set Operations from Oblivious Switching. Public Key Cryptography (2) 2021: 591-617

[0054] REFERENCE SIGNS LIST 1 One-sided secret database linking system 10 Participant device 20 Communication network 101 Input device 102 Display device 103 External I / F 103a Recording medium 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage device 108 Processor 109 Bus 201 Protocol execution unit 202 Database storage unit

Claims

1. A database join method for right outer joining a first database and a second database, with an encrypted first database held by a first device on the left side and a plaintext second database held by a second device on the right side, comprising: a first step in which the first device and the second device execute an oblivious pseudorandom function (OPRF) protocol using a first key set representing a key set of the first database as an input, and the first device obtains a sequence of random numbers related to the first key set as a first random number sequence; a second step in which the first device and the second device execute a permuted characteristic (PC) protocol using the first key set and a second key set representing a key set of the second database as an input, and the first device obtains a random permutation π, and a characteristic vector whose i-th element indicates whether or not the π(i)-th key of the second key set is included in the first key set; a third step in which the second device calculates a sequence of random numbers related to the second key set as a second random number sequence using the permutation π; a fourth step in which the first device and the second device execute an oblivious transfer (OT) protocol using the second random number sequence and a set of numbers of elements in the feature vector that indicate that they are not included as keys of the first database, and the first device obtains a third random number sequence consisting of random numbers of numbers included in the set of numbers among the random numbers included in the second random number sequence; a fifth step in which the first device and the second device execute an OPRF protocol using the second random number sequence as an input, and the second device obtains a fourth random number sequence that is a sequence of random numbers related to the second random number sequence; a sixth step in which the first device transmits to the second device an element sequence in which elements in which random numbers included in the first random number sequence correspond to secret values ​​obtained by encrypting values ​​included in a value set of the first database, and elements in which random numbers included in the third random number sequence correspond to secret values ​​obtained by encrypting a predetermined value, are randomly rearranged;a seventh step of the second device calculating, by using the fourth random number sequence and the element sequence, an output database in which values ​​included in a value set of the second database correspond to secret values ​​of elements included in the element sequence.

2. The database binding method of claim 1, wherein the first step is a step in which the second device obtains a key for a random pseudorandom function and the first device obtains the first random number sequence generated using the pseudorandom function, the key, and the first key set, and the third step is a step in which the second random number sequence is calculated using the permutation π, the pseudorandom function, and the key.

3. The sixth step is to set the first random number sequence (f １ , ..., f ｎ ), the third random number sequence is {g ｉ } ｉ∈Ｓ , the value set of the first database is {v １ , ..., v ｎ }, a given encryption is Enc(·), and for i=1, . . . , n, a random number f ｉ and the secret value Enc(v ｉ ) and a random number g ｉ and the secret value Enc(0) are randomly rearranged to create an element sequence ((h １ ', z １ ), ..., (h ｎ＋｜Ｓ｜ ', z ｎ＋｜Ｓ｜ 3. The database binding method according to claim 2, further comprising the step of transmitting the first device to the second device.

4. The seventh step is to set the fourth random number sequence (h １ , ..., h ｎ ), the set of values ​​in the first database is {v １ ', ..., v ｎ '}, for i = 1, ..., n, v ｉ ' and h ｉ = h ｊ ' is z ｊ 4. The database linking method according to claim 3, further comprising the step of calculating the output database in which the first and second databases are associated with each other.

5. A database linking method according to any one of claims 1 to 4, wherein the OT protocol is a protocol that uses group operations a number of times independent of the sizes of the first database and the second database, or a protocol that does not use group operations at all, and the OPRF protocol and the PC protocol are protocols based on the OT protocol.

6. A program for right outer joining a first database and a second database, with an encrypted first database held by a first device on the left side and a plaintext second database held by a second device on the right side, comprising: a first step of making the first device and the second device execute an oblivious pseudorandom function (OPRF) protocol using a first key set representing a key set of the first database as an input, and the first device obtains a sequence of random numbers related to the first key set as a first random number sequence; a second step of making the first device and the second device execute a permuted characteristic (PC) protocol using the first key set and a second key set representing a key set of the second database as an input, and the first device obtains a random permutation π, and a characteristic vector whose i-th element represents whether or not the π(i)-th key of the second key set is included in the first key set; a third step of having the second device calculate a sequence of random numbers related to the second key set as a second random number sequence using the permutation π; a fourth step of having the first device and the second device execute an oblivious transfer (OT) protocol using the second random number sequence and a set of numbers of elements in the feature vector that indicate that they are not included as keys of the first database, so that the first device obtains a third random number sequence consisting of random numbers of numbers included in the set of numbers among the random numbers included in the second random number sequence; a fifth step of having the first device and the second device execute an OPRF protocol using the second random number sequence as an input, so that the second device obtains a fourth random number sequence that is related to the second random number sequence; a sixth step of causing the first device to transmit to the second device an element sequence in which elements in which random numbers included in the first random number sequence correspond to secret values ​​obtained by encrypting values ​​included in a value set of the first database, and elements in which random numbers included in the third random number sequence correspond to secret values ​​obtained by encrypting a predetermined value, are randomly rearranged;a seventh step of causing the second device to calculate an output database using the fourth random number sequence and the element sequence, in which values ​​included in a value set of the second database correspond to secret values ​​of elements included in the element sequence.

Images