Calculation method, calculation system, calculation program, calculation device, and encryption device

Abstract

A calculation method according to one embodiment of the present invention is to be executed by a calculation system including a first encryption device, a second encryption device, and a calculation device, the calculation method comprising a conversion step in which the first encryption device converts first personal information into first non-identification processing information, an encryption step in which the first encryption device encrypts the first non-identification processing information, a conversion step in which the second encryption device converts second personal information into second non-identification processing information, an encryption step in which the second encryption device encrypts the second non-identification processing information, an acquisition step in which the calculation device acquires the encrypted first non-identification processing information and second non-identification processing information, a decryption step in which the calculation device decrypts the encrypted first non-identification processing information and second non-identification processing information, a comparison step in which the calculation device compares the decrypted first non-identification processing information and second non-identification processing information, and a calculation step in which the calculation device performs a predetermined calculation from the compared first non-identification processing information and second non-identification processing information.

Description

Calculation method, calculation system, calculation program, calculation device, and encryption device

[0001] The present invention relates to a calculation method, a calculation system, a calculation program, a calculation device, and an encryption device.

[0002] Privacy tech has been attracting attention in recent years. Cited Document 1 proposes a method for making personal information available while protecting privacy by de-identifying personal information held by multiple organizations and processing it by matching the data using homomorphic encryption.

[0003] Kazuma Nozawa (and 8 others), "Proposal and Evaluation of a Data Integration Method Suitable for Cross-Organizational Personal Data Integration," Computer Security Symposium 2022, October 24, 2022

[0004] In the above-mentioned conventional technology, the secure calculation is performed using homomorphic encryption, so while the risk of information leakage is low, the amount of calculation is large and the calculation takes a huge amount of time.

[0005] The present invention has been made in consideration of the above-mentioned problems, and aims to enable high-speed calculations while reducing the risk of information leakage.

[0006] A calculation method according to one embodiment is a calculation method executed by a calculation system including a first encryption device, a second encryption device, and a calculation device, and includes a conversion step in which the first encryption device converts first personal information into first non-identifiable processed information, an encryption step in which the first encryption device encrypts the first non-identifiable processed information, a conversion step in which the second encryption device converts second personal information into second non-identifiable processed information, an encryption step in which the second encryption device encrypts the second non-identifiable processed information, an acquisition step in which the calculation device acquires the encrypted first non-identifiable processed information and the second non-identifiable processed information, a decryption step in which the calculation device decrypts the encrypted first non-identifiable processed information and the second non-identifiable processed information, a matching step in which the calculation device matches the decrypted first non-identifiable processed information and the second non-identifiable processed information, and a calculation step in which the calculation device performs a predetermined calculation from the matched first non-identifiable processed information and the second non-identifiable processed information.

[0007] According to one embodiment, high-speed calculations can be performed while reducing the risk of information leakage.

[0008] FIG. 1 is a diagram showing an example of the configuration of a computing system 1000. FIG. 2 is a diagram showing an example of the hardware configuration of a computing device 1. FIG. 3 is a diagram showing an example of the hardware configuration of an encryption device 2. FIG. 4 is a diagram showing an example of the hardware configuration of a user terminal 3. FIG. 5 is a diagram showing an example of the functional configuration of a computing device 1. FIG. 6 is a diagram showing an example of the functional configuration of an encryption device 2. FIG. 7 is a diagram showing an example of personal information 221. FIG. 8 is a diagram showing an example of anonymized processed information 222. FIG. 9 is a diagram showing an example of the functional configuration of a user terminal 3. A flowchart showing an example of processing executed by the computing system 1000. A schematic diagram showing an example of processing executed by the computing system 1000.

[0009] Hereinafter, each embodiment of the present invention will be described with reference to the accompanying drawings. Note that, in the description of the specification and drawings relating to each embodiment, components having substantially the same functional configuration are designated by the same reference numerals, and redundant description will be omitted.

[0010] <System Configuration> First, an overview of the computing system 1000 according to this embodiment will be described. The computing system 1000 is a system that converts personal data owned by multiple owners into non-identifiable processed information, collates the data, and enables all of the personal data owned by the multiple owners to be used lawfully.

[0011] Personal data refers to personal information that constitutes a personal information database.

[0012] A personal information database is a collection of information, including personal information, that is systematically organized so that specific personal information can be searched for.

[0013] Personal information is information about a living individual that can identify a specific individual based on the name, date of birth, and other descriptions contained in that information. Personal information includes identification information and attribute information.

[0014] Identification information is information that identifies an individual. Examples of identification information include, but are not limited to, a name, an email address, or a facial image. Personal information may include multiple pieces of identification information.

[0015] Attribute information is information that indicates the attributes of an individual. Examples of attribute information include, but are not limited to, age, gender, address, occupation, and purchased products. Personal information may include multiple pieces of attribute information.

[0016] De-identified processed information is information obtained by de-identifying personal information. De-identified processed information can be personal information or non-personal information. De-identified processed information that is personal information is, for example, pseudonymized information. De-identified processed information that is non-personal information is, for example, pseudonymized information, anonymously processed information, personal-related information, or other non-personal information.

[0017] Pseudonymized information is information about an individual that has been obtained by processing personal information so that a specific individual cannot be identified unless it is compared with other information.

[0018] Anonymously processed information is information about an individual that is obtained by processing personal information so that a specific individual cannot be identified, and the personal information cannot be restored.

[0019] Personal information refers to information about a living individual that does not fall under personal information, pseudonymized information, or anonymously processed information.

[0020] FIG. 1 is a diagram illustrating an example of the configuration of a computing system 1000. As shown in FIG. 1, the computing system 1000 includes a computing device 1, an encryption device 2A, an encryption device 2B, and a user terminal 3, which are communicatively connected to each other via a network N. Hereinafter, the encryption devices 2A and 2B may be collectively referred to as an encryption device 2. The network N may be, for example, a wired local area network (LAN), a wireless LAN, the Internet, a public line network, a mobile data communication network, or a combination thereof. In the example of FIG. 1, the computing system 1000 includes one computing device 1 and one user terminal 3, but may also include multiple of each. Also, in the example of FIG. 1, the computing system 1000 includes two encryption devices 2, but may also include one or three or more.

[0021] The computing device 1 is an information processing device that performs secure computation using non-identifiable processed information. The computing device 1 is, for example, but not limited to, a personal computer (PC), a smartphone, a tablet terminal, a server device, or a microcomputer. The computing device 1 includes a trusted execution environment (TEE).

[0022] The TEE is a type of Hardware-assisted Isolated Execution Environment (HIEE) and is a secure computing technology in a broad sense. More specifically, the TEE is a program execution environment protected by hardware, and allows calculations to be performed without leaking data to the outside. The TEE is composed of, for example, a central processing unit (CPU), a protected area (enclave) created in random access memory (RAM), and a communication path between the CPU and the protected area. The TEE may also be composed of a CPU, RAM designed entirely as a protected area, and a communication path between the CPU and the protected area.

[0023] The encryption device 2 is an information processing device that converts personal information into non-identifiable processed information and transmits it to the computing device 1. The encryption device 2 is, for example, but is not limited to, a PC, a smartphone, a tablet terminal, a server device, or a microcomputer. The encryption device 2A corresponds to the first encryption device in the claims, and the encryption device 2B corresponds to the second encryption device in the claims.

[0024] The user terminal 3 is an information processing device used by a user of the computing system 1000. The user may be, for example, but is not limited to, the owner of personal information. The user terminal 3 may be, for example, but is not limited to, a PC, a smartphone, or a tablet terminal. The user terminal 3 may function as the encryption device 2.

[0025] <Hardware Configuration of Computing Device 1> Next, a description will be given of the hardware configuration of the computing device 1. Fig. 2 is a diagram showing an example of the hardware configuration of the computing device 1. As shown in Fig. 2, the computing device 1 includes a processor 101, a memory 102, a storage 103, a communication I / F 104, an input device 105, an output device 106, and a drive device 107, which are interconnected via a bus B1.

[0026] The processor 101 controls each component of the computing device 1 and realizes the functions of the computing device 1 by expanding into the memory 102 and executing various programs, including an OS (Operating System) and computing programs, stored in the storage 103. The processor 101 is, for example, but not limited to, a CPU, an MPU (Micro Processing Unit), a GPU (Graphics Processing Unit), an ASIC (Application Specific Integrated Circuit), or a DSP (Digital Signal Processor).

[0027] The memory 102 is, for example, a read-only memory (ROM), a random access memory (RAM), or a combination thereof. The ROM is, for example, a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a combination thereof. The RAM is, for example, but not limited to, a dynamic random access memory (DRAM) or a static random access memory (SRAM).

[0028] 2, the TEE is configured from the processor 101 (CPU), a part of the bus B1, and a part of the memory 102 (RAM). However, as described above, the TEE may be configured from the processor 101, the bus B1, and the entire memory 102.

[0029] The storage 103 stores various programs and data, including an OS and a computing program. The storage 103 is, for example, a flash memory, a hard disk drive (HDD), a solid state drive (SSD), or a storage class memory (SCM), but is not limited to these.

[0030] The communication I / F 104 is an interface for connecting the computing device 1 to an external device via the network N and controlling communication. The communication I / F 104 is, for example, Bluetooth (registered trademark), Wi-Fi (registered trademark), ZigBee (registered trademark), or Ethernet (registered trademark), but is not limited to these.

[0031] The input device 105 is a device for inputting information to the computing device 1. The input device 105 is, for example, a mouse, a keyboard, a touch panel, a microphone, a scanner, a photographing device (camera), various sensors, or an operation button, but is not limited to these.

[0032] The output device 106 is a device for outputting information from the computing device 1. The output device 106 is, for example, a display device, a projector, a printer, a speaker, or a vibrator, but is not limited to these.

[0033] The drive device 107 is a device that reads and writes data from and to the recording medium 108. The drive device 107 is, for example, but not limited to, a magnetic disk drive, an optical disk drive, a magneto-optical disk drive, or an SD card reader. The recording medium 108 is, for example, but not limited to, a CD (Compact Disc), a DVD (Digital Versatile Disc), a FD (Floppy Disk), an MO (Magneto-Optical Disk), a BD (Blu-ray (registered trademark) Disc), a USB (registered trademark) memory, or an SD card.

[0034] In this embodiment, the calculation program may be written to memory 102 or storage 103 during the manufacturing stage of the calculation device 1, may be provided to the calculation device 1 via the network N, or may be provided to the calculation device 1 via a non-transitory computer-readable recording medium such as recording medium 108.

[0035] <Hardware Configuration of Encryption Device 2> Next, a description will be given of the hardware configuration of the encryption device 2. Fig. 3 is a diagram showing an example of the hardware configuration of the encryption device 2. As shown in Fig. 3, the encryption device 2 includes a processor 201, a memory 202, a storage 203, a communication I / F 204, an input device 205, an output device 206, and a drive device 207, which are interconnected via a bus B2.

[0036] The processor 201 controls each component of the encryption device 2 and realizes the functions of the encryption device 2 by expanding into the memory 202 and executing various programs, including an OS and a calculation program, stored in the storage 203. The processor 201 is, for example, but is not limited to, a CPU, an MPU, a GPU, an ASIC, or a DSP.

[0037] The memory 202 may be, for example, a ROM, a RAM, or a combination thereof. The ROM may be, for example, a PROM, an EPROM, an EEPROM, or a combination thereof. The RAM may be, for example, a DRAM or an SRAM, but is not limited to these.

[0038] The storage 203 stores various programs including an OS and a computing program, and data. The storage 203 is, for example, a flash memory, an HDD, an SSD, or an SCM, but is not limited to these.

[0039] The communication I / F 204 is an interface for connecting the encryption device 2 to an external device via the network N and controlling communication. The communication I / F 204 is, for example, Bluetooth (registered trademark), Wi-Fi (registered trademark), ZigBee (registered trademark), or Ethernet (registered trademark), but is not limited to these.

[0040] The input device 205 is a device for inputting information to the encryption device 2. The input device 205 is, for example, a mouse, a keyboard, a touch panel, a microphone, a scanner, a photographing device (camera), various sensors, or an operation button, but is not limited to these.

[0041] The output device 206 is a device for outputting information from the encryption device 2. The output device 206 is, for example, a display device, a projector, a printer, a speaker, or a vibrator, but is not limited to these.

[0042] The drive device 207 is a device that reads and writes data from and to the recording medium 208. The drive device 207 is, for example, but not limited to, a magnetic disk drive, an optical disk drive, a magneto-optical disk drive, or an SD card reader. The recording medium 208 is, for example, but not limited to, a CD, a DVD, a FD, an MO, a BD (Blu-ray (registered trademark) Disc), a USB (registered trademark), or an SD card.

[0043] In this embodiment, the calculation program may be written to memory 202 or storage 203 during the manufacturing stage of the encryption device 2, or may be provided to the encryption device 2 via the network N, or may be provided to the encryption device 2 via a non-transitory computer-readable recording medium such as the recording medium 208.

[0044] <Hardware Configuration of User Terminal 3> Next, a description will be given of the hardware configuration of the user terminal 3. Fig. 4 is a diagram showing an example of the hardware configuration of the user terminal 3. As shown in Fig. 4, the user terminal 3 includes a processor 301, a memory 302, a storage 303, a communication I / F 304, an input device 305, an output device 306, and a drive device 307, which are interconnected via a bus B3.

[0045] The processor 301 controls each component of the user terminal 3 and realizes the functions of the user terminal 3 by expanding into the memory 302 and executing various programs, including the OS and calculation programs, stored in the storage 303. The processor 301 is, for example, but is not limited to, a CPU, an MPU, a GPU, an ASIC, or a DSP.

[0046] The memory 302 may be, for example, a ROM, a RAM, or a combination thereof. The ROM may be, for example, a PROM, an EPROM, an EEPROM, or a combination thereof. The RAM may be, for example, a DRAM or an SRAM, but is not limited to these.

[0047] The storage 303 stores various programs including an OS and a computing program, and data. The storage 303 is, for example, a flash memory, an HDD, an SSD, or an SCM, but is not limited to these.

[0048] The communication I / F 304 is an interface for connecting the user terminal 3 to an external device via the network N and controlling communication. The communication I / F 304 is, for example, Bluetooth (registered trademark), Wi-Fi (registered trademark), ZigBee (registered trademark), or Ethernet (registered trademark), but is not limited to these.

[0049] The input device 305 is a device for inputting information to the user terminal 3. The input device 305 is, for example, a mouse, a keyboard, a touch panel, a microphone, a scanner, a photographing device (camera), various sensors, or an operation button, but is not limited to these.

[0050] The output device 306 is a device for outputting information from the user terminal 3. The output device 306 is, for example, but is not limited to, a display device (display), a projector, a printer, a speaker, or a vibrator. The user terminal 3 includes a display device 306D as the output device 306.

[0051] The drive device 307 is a device that reads and writes data from and to the recording medium 308. The drive device 307 is, for example, but not limited to, a magnetic disk drive, an optical disk drive, a magneto-optical disk drive, or an SD card reader. The recording medium 308 is, for example, but not limited to, a CD, a DVD, a FD, an MO, a BD (Blu-ray (registered trademark) Disc), a USB (registered trademark), or an SD card.

[0052] In this embodiment, the calculation program may be written into memory 302 or storage 303 during the manufacturing stage of the user terminal 3, may be provided to the user terminal 3 via the network N, or may be provided to the user terminal 3 via a non-transitory computer-readable recording medium such as recording media 308.

[0053] <Functional Configuration of Computing Device 1> Next, a description will be given of the functional configuration of the computing device 1. Fig. 5 is a diagram showing an example of the functional configuration of the computing device 1. As shown in Fig. 5, the computing device 1 includes a communication unit 11, a storage unit 12, and a control unit 13.

[0054] The communication unit 11 is realized by the communication I / F 104. The communication unit 11 transmits and receives information between the encryption device 2 and the user terminal 3 via the network N. The communication unit 11 receives encrypted non-identifiable processed information from the encryption device 2 and transmits the calculation result to the user terminal 3.

[0055] The storage unit 12 is realized by a memory 102 and a storage 103. In the storage unit 12, a protected area constituting the TEE stores encrypted non-identifiable processed information 121A, 121B, encryption keys 122A, 122B, non-identifiable processed information 123A, 123B, matching information 124, and a calculation result 125. Hereinafter, the encrypted non-identifiable processed information 121A, 121B, encryption keys 122A, 122B, and non-identifiable processed information 123A, 123B may be collectively referred to as encrypted non-identifiable processed information 121, encryption key 122, and non-identifiable processed information 123, respectively.

[0056] The encrypted non-identifiable processed information 121 is non-identifiable processed information encrypted by the encryption device 2. The encrypted non-identifiable processed information 121A is non-identifiable processed information encrypted by the encryption device 2A, and the encrypted non-identifiable processed information 121B is non-identifiable processed information encrypted by the encryption device 2B.

[0057] The encryption key 122 is an encryption key for decrypting the encrypted non-identifiable processed information 121. The encryption key 122A is an encryption key for decrypting the encrypted non-identifiable processed information 121A, and the encryption key 122B is an encryption key for decrypting the encrypted non-identifiable processed information 121B. The encryption key 122 may be a common key for a common key encryption system such as AES, or a private key for a public key encryption system such as RSA. The encryption keys 122A and 122B may be a common encryption key or different encryption keys.

[0058] The non-identifiable processed information 123 is non-identifiable processed information obtained by decrypting the encrypted non-identifiable processed information 121 using the encryption key 122. The non-identifiable processed information 123A is non-identifiable processed information obtained by decrypting the encrypted non-identifiable processed information 121A using the encryption key 122A, and corresponds to the first non-identifiable processed information in the claims. The non-identifiable processed information 123B is non-identifiable processed information obtained by decrypting the encrypted non-identifiable processed information 121B using the encryption key 122B, and corresponds to the second non-identifiable processed information in the claims.

[0059] The combined information 124 is obtained by combining the non-identifiable processed information 123A and the non-identifiable processed information 123B.

[0060] The calculation result 125 is information indicating the result of a predetermined calculation performed from the matching information 124. The calculation result 125 is, for example, a counting result for each attribute, a causal relationship between attributes, a correlation between attributes, the number of record overlaps, a statistical analysis result (sum, average, variance, median, frequency, etc.), a machine learning model (parameters) that has learned the matching information 124, or an inference result by the machine learning model, but is not limited to these.

[0061] The control unit 13 is realized by the processor 101 reading and executing a program from the memory 102 and working in cooperation with other hardware components. The control unit 13 controls the overall operation of the computing device 1. The control unit 13 includes an acquisition unit 131, a decryption unit 132, a matching unit 133, and a calculation unit 134.

[0062] The acquisition unit 131 acquires the encrypted non-identifiable processed information from the encryption device 2 and stores it in the storage unit 12 as encrypted non-identifiable processed information 121 .

[0063] The decryption unit 132 decrypts the encrypted non-identifiable processed information 121 using the encryption key 122 and stores the obtained non-identifiable processed information in the storage unit 12 as non-identifiable processed information 123 .

[0064] The matching unit 133 matches the non-identifiable processing information 123A and 123B and stores the matched information 124 in the storage unit 12.

[0065] The calculation unit 134 executes a predetermined calculation on the matching information 124 and stores the obtained calculation result in the storage unit 12 as the calculation result 125 .

[0066] The functional configuration of the computing device 1 is not limited to the above example, and the computing device 1 may have a functional configuration other than the above example.

[0067] <Functional Configuration of Encryption Devices 2A, 2B> Next, the functional configuration of the encryption devices 2A, 2B will be described. Fig. 6 is a diagram showing an example of the functional configuration of the encryption devices 2A, 2B. As shown in Fig. 6, the encryption devices 2A, 2B each include a communication unit 21A, 21B, a storage unit 22A, 22B, and a control unit 23A, 23B. Hereinafter, the communication units 21A, 21B, the storage units 22A, 22B, and the control units 23A, 23B may be collectively referred to as the communication unit 21, the storage unit 22, and the control unit 23, respectively.

[0068] The communication unit 21 is realized by the communication I / F 204. The communication unit 21 transmits and receives information to and from the computing device 1 via the network N. The communication units 21A and 21B transmit encrypted personal information 221A and 221B, respectively, to the computing device 1.

[0069] The storage unit 22 is realized by a memory 202 and a storage 203. The storage units 22A and 22B store personal information 221A and 221B, non-identifiable processed information 222A and 222B, hash functions 223A and 223B, salts 224A and 224B, encryption keys 225A and 225B, and encrypted non-identifiable processed information 226A and 226B, respectively.

[0070] Personal information 221 is personal data and includes identification information and attribute information. Personal information 221A corresponds to first personal information in the claims, and personal information 221B corresponds to second personal information in the claims. Personal information 221A and personal information 221B are personal information owned by different owners.

[0071] FIG. 7 is a diagram showing an example of personal information 221A, 221B. Personal information 221A, 221B in FIG. 7 includes information items such as "name," "age," "gender," and "product." "Name" is information indicating the name of an individual. "Name" corresponds to identification information. "Age" is information indicating the age of an individual. "Age" corresponds to attribute information. "Gender" is information indicating the gender of an individual. "Gender" corresponds to attribute information. "Product" is information indicating the product purchased by an individual.

[0072] The personal information 221 is not limited to the example shown in Fig. 7. The personal information 221 may not include some of the above information items, or may include information items other than those listed above.

[0073] The non-identifiable processed information 222 is non-identifiable processed information obtained by converting the personal information 221, and includes salted hashed identification information and k-anonymized attribute information. The non-identifiable processed information 222A is obtained by converting the personal information 221A, and corresponds to the first non-identifiable processed information in the claims. The non-identifiable processed information 222B is obtained by converting the personal information 221B, and corresponds to the second non-identifiable processed information in the claims. The identification information of the personal information 221A and 221B is salted hashed using the same method.

[0074] FIG. 8 is a diagram showing an example of non-identifiable processed information 222A, 222B. The non-identifiable processed information 222A, 222B in FIG. 8 includes information items such as "Name," "Age," "Gender," and "Product." "Name" is a salted hash (hash value) of an individual's name so that the individual cannot be identified. Because the identification information is salted and hashed using the same method, the "Name" "aaa" common to the non-identifiable processed information 222A, 222B has the same hash value. This allows the computing device 1 to match the non-identifiable processed information 222A, 222B without identifying the individual. "Age" is k-anonymized information indicating the individual's age. "Gender" is k-anonymized information indicating the individual's gender. "Product" is k-anonymized information indicating the individual's purchased products.

[0075] The hash function 223 is a function for salting and hashing the identification information of the personal information 221. The hash functions 223A and 223B are the same. The hash function 223 is, for example, sha256, but is not limited to this.

[0076] The salt 224 is a salt (noise) for salted hashing the identification information of the personal information 221. The salts 224A and 224B are common to each other.

[0077] The encryption key 225 is an encryption key for encrypting the non-identifiable processed information 222. The encryption key 225A is an encryption key for encrypting the non-identifiable processed information 222A, and the encryption key 225B is an encryption key for encrypting the non-identifiable processed information 222B. The encryption key 225 may be a common key for a common key encryption such as AES, or a public key for a public key encryption method such as RSA. When the encryption key 225 is a public key, the encryption key 225 is generated from the private key (encryption key 122) by the computing device 1 and shared with the encryption device 2. The encryption keys 225A and 225B may be a common encryption key or different encryption keys.

[0078] The encrypted non-identifiable processed information 226 is the non-identifiable processed information 222 encrypted by the encryption device 2. The encrypted non-identifiable processed information 226A is the non-identifiable processed information 222A encrypted by the encryption device 2A, and the encrypted non-identifiable processed information 226B is the non-identifiable processed information 222B encrypted by the encryption device 2B.

[0079] The control unit 23 is realized by the processor 201 reading and executing a program from the memory 202 and working in cooperation with other hardware components. The control unit 23 controls the overall operation of the encryption device 2. The control units 23A and 23B include conversion units 231A and 231B and encryption units 232A and 232B, respectively.

[0080] The conversion units 231A and 231B convert the personal information 221A and 221B into non-identifiable processed information 222A and 222B, respectively, and store the non-identifiable processed information in the storage units 22A and 22B, respectively. Specifically, the conversion units 231A and 231B use hash functions 223A and 223B and salts 224A and 224B, respectively, to salt-hash the identification information of the personal information 221A and 221B, respectively. The conversion units 231A and 231B also k-anonymize the attribute information of the personal information 221A and 221B, respectively.

[0081] The encryption units 232A and 232B encrypt the non-identifiable processed information 222A and 222B, respectively, to generate encrypted non-identifiable processed information 226A and 226B, which are then stored in the storage units 22A and 22B, respectively.

[0082] The functional configuration of the encryption devices 2A and 2B is not limited to the above example. For example, the encryption devices 2A and 2B may have functional configurations other than those described above. Furthermore, each functional configuration of the encryption device 2 may be realized by software as described above, or may be realized by hardware such as an IC chip, SoC, LSI, or microcomputer.

[0083] <Functional Configuration of User Terminal 3> Next, a description will be given of the functional configuration of the user terminal 3. Fig. 9 is a diagram showing an example of the functional configuration of the user terminal 3. As shown in Fig. 9, the user terminal 3 includes a communication unit 31, a storage unit 32, and a control unit 33.

[0084] The communication unit 31 is realized by the communication I / F 304. The communication unit 31 transmits and receives information to and from the computing device 1 via the network N. The communication unit 31 receives the calculation result 125 from the computing device 1.

[0085] The storage unit 32 is realized by the memory 302 and the storage 303. The storage unit 32 stores the calculation result 321.

[0086] The calculation result 321 is information indicating the result of a predetermined calculation performed by the calculation device 1 from the matching information 124. The calculation result 321 includes the aggregation result for each attribute, the causal relationship between attributes, and the correlation between attributes.

[0087] The control unit 33 is realized by the processor 301 reading and executing a program from the memory 302 and working in cooperation with other hardware components. The control unit 33 controls the overall operation of the user terminal 3. The control unit 33 includes an acquisition unit 331 and a display unit 332.

[0088] The acquisition unit 331 acquires the calculation result 125 from the calculation device 1 and stores it as the calculation result 321 in the storage unit 32 .

[0089] The display unit 332 controls the screen displayed on the display device 306 D. The display unit 332 displays the calculation result 321 on the display device 306 D in response to a user operation.

[0090] The functional configuration of the user terminal 3 is not limited to the above example. For example, the user terminal 3 may have a functional configuration other than the above. Furthermore, each functional configuration of the user terminal 3 may be realized by software as described above, or may be realized by hardware such as an IC chip, an SoC, an LSI, or a microcomputer.

[0091] <Processing Executed by Computing System 1000> Next, a description will be given of processing executed by the computing system 1000. Fig. 10 is a flowchart showing an example of processing executed by the computing system 1000. Fig. 11 is a schematic diagram showing an example of processing executed by the computing system 1000.

[0092] In FIG. Ａ is personal information 221A (personal data), and M Ａ Column N Ａ It is a matrix of rows. Ａ is the identification information, and N Ａ It is a row vector. Ａ is attribute information, and (M Ａ -1) Column N Ａ row matrix. K is the k-anonymization algorithm. H is the hash function 223A. r is the salt 224A. X Ａ ' is the non-identifiable processed information 222A. Enc is the encryption algorithm. Enc(X Ａ ') is the encrypted non-identifiable processed information 226A.

[0093] Also, in FIG. Ｂ is personal information 221B (personal data), and M Ｂ Column N Ｂ It is a matrix of rows. Ｂ is the identification information, and N Ｂ It is a row vector. Ｂ is attribute information, and (M Ｂ -1) Column N Ｂ is a matrix of rows. K is the k-anonymization algorithm. H is a hash function 223B. r is a salt 224B. X Ｂ ' is the non-identifiable processed information 222B. Enc is the encryption algorithm. Enc(X Ｂ') is the encrypted non-identifiable processed information 226B.

[0094] In FIG. 11, Dec is the decoding algorithm. Ａ Dec(Enc(X')) is the non-identifiable processed information 123A. Ｂ ')) is the non-identifiable processed information 123B.

[0095] (Step S101) First, the conversion unit 231A of the encryption device 2A converts the personal information 221A into the non-identifiable processed information 222A using the hash function 223A and the salt 224A (step S101).

[0096] Specifically, as shown in FIG. 11, the conversion unit 231A converts the attribute information P Ａ (first attribute information) is anonymized by k (K(P Ａ )) Identification information i of personal information 221A Ａ (First identification information) is hashed using a hash function 223A to obtain (H(i Ａ )), add salt 224A (i A ' xor r). The conversion unit 231A converts the identification information i of the personal information 221A into Ａ A salt 224A may be added to the value, and the value may be hashed using a hash function 223A. If the hash function 223A is sha256, the salt 224A will be a 256-bit random number, as shown in FIG.

[0097] (Step S102) The conversion unit 231A converts the personal information 221A (X Ａ ) is converted to non-identifiable processed information 222A (X Ａ After storing the above information in the storage unit 22A, the salt 224A is discarded (step S102). This makes it impossible to restore the personal information 221A from the non-identifiable processed information 222A.

[0098] (Step S103) Next, the encryption unit 232A of the encryption device 2A uses the encryption key 225A to encrypt the non-identifiable processed information 222A (X Ａ The encryption unit 232A encrypts the non-identifiable processed information 222A (X') (step S103). ＡEncrypted non-identifiable processed information 226A (Enc(X') Ａ ')) is stored in the storage unit 22A.

[0099] (Step S104) After that, the communication unit 21A of the encryption device 2A transmits the encrypted non-identifiable processed information 226A (Enc(X Ｂ ')) to the computing device 1 (step S104).

[0100] (Step S105) As with the encryption device 2A, the conversion unit 231B of the encryption device 2B converts the personal information 221B into non-identifiable processed information 222B using the hash function 223B and the salt 224B (step S105).

[0101] Specifically, as shown in FIG. 11, the conversion unit 231B converts the attribute information P Ｂ (second attribute information) is anonymized by k (K(P Ｂ )) Identification information i of personal information 221B Ｂ (Second identification information) is hashed using a hash function 223B to obtain (H(i Ｂ )), add salt 224B (i B ' xor r). The conversion unit 231B converts the identification information i of the personal information 221B into Ｂ A salt 224B may be added to the above and hashed using a hash function 223B. When the hash function 223B is sha256, the salt 224B becomes a 256-bit random number, as shown in FIG.

[0102] As described above, the hash function 223A and the hash function 223B are common to both the hash functions 223A and 223B, and the salt 224A and the salt 224B are common to both the hash functions 223A and 223B.

[0103] (Step S106) The conversion unit 231B converts the personal information 221B (X Ｂ ) is converted to non-identifiable processed information 222B (X Ｂ After storing the above information in the storage unit 22B, the salt 224B is discarded (step S106). This makes it impossible to restore the personal information 221B from the non-identifiable processed information 222B.

[0104] (Step S107) Next, the encryption unit 232B of the encryption device 2B uses the encryption key 225B to encrypt the non-identifiable processed information 222B (X Ｂ The encryption unit 232B encrypts the non-identifiable processed information 222B (X') (step S107). Ｂ Encrypted non-identifiable processed information 226B (Enc(X') Ｂ The encryption unit 232A and the encryption unit 232B store the encrypted data in the storage unit 22B. As described above, the encryption key 225A and the encryption key 225B may be the same or different. Furthermore, the encryption method of the encryption unit 232A and the encryption unit 232B may be the same or different.

[0105] (Step S108) After that, the communication unit 21B of the encryption device 2B transmits the encrypted non-identifiable processed information 226B (Enc(X Ｂ ')) to the computing device 1 (step S108).

[0106] The order of steps S101 to S104 and steps S105 to S108 may be reversed. Furthermore, if the computing system 1000 includes three or more encryption devices 2, each encryption device 2 may perform the same processing as steps S101 to S104. This allows the computing device 1 to obtain, in an encrypted state, anonymized information corresponding to personal information owned by multiple different owners.

[0107] (Step S109) Next, the acquisition unit 131 of the computing device 1 acquires the encrypted non-identifiable processed information 226A received from the encryption device 2A and stores it as encrypted non-identifiable processed information 121A in the protected area (TEE) of the storage unit 12 (step S109). Similarly, the acquisition unit 131 of the computing device 1 acquires the encrypted non-identifiable processed information 226B received from the encryption device 2B and stores it as encrypted non-identifiable processed information 121B in the protected area (TEE) of the storage unit 12 (step S109).

[0108] (Step S110) The decryption unit 132 decrypts the encrypted non-identifiable processed information 121A using the encryption key 122A corresponding to the encryption key 225A (step S110). The decryption unit 132 stores the non-identifiable processed information 123A obtained by decrypting the encrypted non-identifiable processed information 121A in the protected area (TEE) of the storage unit 12.

[0109] Similarly, the decryption unit 132 decrypts the encrypted non-identifiable processed information 121B using the encryption key 122B corresponding to the encryption key 225B (step S110). The decryption unit 132 stores the non-identifiable processed information 123B obtained by decrypting the encrypted non-identifiable processed information 121B in the protected area (TEE) of the storage unit 12.

[0110] (Step S111) The matching unit 133 matches the non-identifiable processed information 123A and 123B and stores the obtained matched information 124 in the protected area (TEE) of the storage unit 12 (step S111). As described above, the identification information of the non-identifiable processed information 123A and 123B is salted and hashed using the same method, so the matching unit 133 can match the non-identifiable processed information 123A and 123B even if individuals cannot be identified (see FIG. 8 ).

[0111] (Step S112) The calculation unit 134 executes a predetermined calculation on the matching information 124, and stores the obtained calculation result as the calculation result 125 in the protected area (TEE) of the storage unit 12 (step S112).

[0112] (Step S113) After that, the communication unit 11 of the computing device 1 transmits the calculation result 125 to the user terminal 3 (Step S113). The computing device 1 may transmit the calculation result 125 as is, or may encrypt it before transmitting it.

[0113] (Step S114) The acquisition unit 331 of the user terminal 3 acquires the calculation result 125 received from the computing device 1, and stores it as the calculation result 321 in the storage unit 32 (step S114).

[0114] (Step S115) The display unit 332 displays the calculation result 321 on the display device 206D in response to a user operation (step S115).

[0115] <Summary> As described above, according to this embodiment, a calculation method is realized which is executed by a calculation system 1000 which includes an encryption device 2A, an encryption device 2B, and a calculation device 1, and which includes: a conversion step in which the encryption device 2A converts personal information 221A into non-identifiable processed information 222A; an encryption step in which the encryption device 2A encrypts the non-identifiable processed information 222A; a conversion step in which the encryption device 2B converts personal information 221B into non-identifiable processed information 222B; an encryption step in which the encryption device 2B encrypts the non-identifiable processed information 222B; an acquisition step in which the calculation device 1 acquires encrypted non-identifiable processed information 226A, 226B; a decryption step in which the calculation device 1 decrypts the encrypted non-identifiable processed information 121A, 121B; a matching step in which the calculation device 1 matches the non-identifiable processed information 123A, 123B; and a calculation step in which the calculation device 1 performs a predetermined calculation from the matching information 124.

[0116] This allows the computing system 1000 to perform calculations on the non-identifiable processed information in an unencrypted state while increasing the security of the exchange of non-identifiable processed information between the computing device 1 and the encryption device 2. As a result, the computing system 1000 can perform calculations on the non-identifiable processed information at high speed while reducing the risk of information leakage of the non-identifiable processed information.

[0117] Furthermore, according to this embodiment, the acquisition step S109, the decryption step S110, the matching step S111, and the calculation step S112 are executed by the TEE of the computing device 1. This can further reduce the risk of information leakage of the anonymized processed information.

[0118] <Additional Notes> This embodiment includes the following disclosure.

[0119] (Supplementary Note 1) A calculation method executed by a calculation system including a first encryption device, a second encryption device, and a calculation device, the calculation method including: a conversion step in which the first encryption device converts first personal information into first non-identifiable processed information; an encryption step in which the first encryption device encrypts the first non-identifiable processed information; a conversion step in which the second encryption device converts second personal information into second non-identifiable processed information; an encryption step in which the second encryption device encrypts the second non-identifiable processed information; an acquisition step in which the calculation device acquires the encrypted first non-identifiable processed information and the second non-identifiable processed information; a decryption step in which the calculation device decrypts the encrypted first non-identifiable processed information and the second non-identifiable processed information; a matching step in which the calculation device matches the decrypted first non-identifiable processed information and the second non-identifiable processed information; and a calculation step in which the calculation device performs a predetermined calculation from the matched first non-identifiable processed information and the second non-identifiable processed information.

[0120] (Supplementary Note 2) The calculation method according to claim , wherein the calculation device executes the obtaining step, the decrypting step, the matching step, and the calculation step using a TEE.

[0121] (Supplementary Note 3) The calculation method according to the supplementary note, wherein at least one of the first encryption device and the second encryption device performs the encryption step using a common key, and the calculation device performs the decryption step using the common key.

[0122] (Supplementary Note 4) The calculation method according to the supplementary note, wherein at least one of the first encryption device and the second encryption device performs the encryption step using a public key, and the calculation device performs the decryption step using a private key corresponding to the public key.

[0123] (Supplementary Note 5) The calculation method described in the supplementary note, wherein the first personal information includes first attribute information, the conversion step of the first encryption device includes processing to k-anonymize the first attribute information, the second personal information includes second attribute information, and the conversion step of the second encryption device includes processing to k-anonymize the second attribute information.

[0124] (Supplementary Note 6) The calculation method according to the supplementary note, wherein the first personal information includes first identification information, and the converting step of the first encryption device includes a process of hashing the first identification information and adding a salt.

[0125] (Supplementary Note 7) The calculation method according to the supplementary note, wherein the first personal information includes first identification information, and the converting step of the first encryption device includes a process of adding a salt to the first identification information and hashing it.

[0126] (Supplementary Note 8) The calculation method according to Supplementary Note 6 or Supplementary Note 7, wherein the first encryption device discards the salt after the converting step.

[0127] (Supplementary Note 9) The calculation method according to the supplementary note, wherein the second personal information includes second identification information, and the converting step of the second encryption device includes a process of hashing the second identification information and adding a salt.

[0128] (Supplementary Note 10) The calculation method according to Supplementary Note 1, wherein the second personal information includes second identification information, and the converting step of the second encryption device includes a process of adding a salt to the second identification information and hashing it.

[0129] (Supplementary Note 11) The calculation method according to Supplementary Note 10 or Supplementary Note 11, wherein the second encryption device discards the salt after the converting step.

[0130] (Supplementary Note 12) The calculation method according to Supplementary Note 1, wherein the first encryption device and the second encryption device use a common hash function and salt in the conversion step.

[0131] (Supplementary Note 13) The calculation method according to Supplementary Note 1, wherein the first non-identifiable processed information and the second non-identifiable processed information are pseudonymized information, anonymously processed information, personal information, or non-personal information.

[0132] (Supplementary Note 13) A computing system including a first encryption device, a second encryption device, and a computing device, the computing system executing a computing method including: a conversion step in which the first encryption device converts first personal information into first non-identifiable processed information; an encryption step in which the first encryption device encrypts the first non-identifiable processed information; a conversion step in which the second encryption device converts second personal information into second non-identifiable processed information; an encryption step in which the second encryption device encrypts the second non-identifiable processed information; an acquisition step in which the computing device acquires the encrypted first non-identifiable processed information and the second non-identifiable processed information; a decryption step in which the computing device decrypts the encrypted first non-identifiable processed information and the second non-identifiable processed information; a matching step in which the computing device matches the decrypted first non-identifiable processed information and the second non-identifiable processed information; and a calculation step in which the computing device performs a predetermined calculation from the matched first non-identifiable processed information and the second non-identifiable processed information.

[0133] (Supplementary Note 14) A computing program causing a computing system including a first encryption device, a second encryption device, and a computing device to execute a computing method including: a conversion step in which the first encryption device converts first personal information into first non-identifiable processed information; an encryption step in which the first encryption device encrypts the first non-identifiable processed information; a conversion step in which the second encryption device converts second personal information into second non-identifiable processed information; an encryption step in which the second encryption device encrypts the second non-identifiable processed information; an acquisition step in which the computing device acquires the encrypted first non-identifiable processed information and the second non-identifiable processed information; a decryption step in which the computing device decrypts the encrypted first non-identifiable processed information and the second non-identifiable processed information; a matching step in which the computing device matches the decrypted first non-identifiable processed information and the second non-identifiable processed information; and a calculation step in which the computing device performs a predetermined calculation from the matched first non-identifiable processed information and the second non-identifiable processed information.

[0134] (Supplementary Note 15) A computing device that executes the following steps: an acquisition step of acquiring encrypted first non-identifiable processed information and second non-identifiable processed information; a decryption step of decrypting the encrypted first non-identifiable processed information and second non-identifiable processed information; a matching step of matching the decrypted first non-identifiable processed information and second non-identifiable processed information; and a calculation step of performing a predetermined calculation from the matched first non-identifiable processed information and second non-identifiable processed information.

[0135] (Supplementary Note 16) An encryption device that performs a conversion step of converting personal information into non-identifiable processed information, an encryption step of encrypting the non-identifiable processed information, and a transmission step of transmitting the encrypted non-identifiable processed information to a computing device.

[0136] The embodiments disclosed herein are illustrative in all respects and should not be considered limiting. The scope of the present invention is defined by the claims, not by the above meaning, and is intended to include all modifications within the meaning and scope of the claims. Furthermore, the present invention is not limited to the above-described embodiments, and various modifications are possible within the scope of the claims. Embodiments obtained by appropriately combining the technical means disclosed in different embodiments are also included in the technical scope of the present invention.

[0137] 1: Calculation device 2: Encryption device 3: User terminal 11: Communication unit 12: Storage unit 13: Control unit 121: Encrypted unidentifiable processed information 122: Encryption key 123: Unidentifiable processed information 124: Matching information 125: Calculation result 131: Acquisition unit 132: Decryption unit 133: Matching unit 134: Calculation unit

Claims

1. A calculation method executed by a calculation system including a first encryption device, a second encryption device, and a calculation device, comprising: a conversion step in which the first encryption device converts first personal information into first non-identifiable processed information; an encryption step in which the first encryption device encrypts the first non-identifiable processed information; a conversion step in which the second encryption device converts second personal information into second non-identifiable processed information; an encryption step in which the second encryption device encrypts the second non-identifiable processed information; an acquisition step in which the calculation device acquires the encrypted first non-identifiable processed information and the second non-identifiable processed information; a decryption step in which the calculation device decrypts the encrypted first non-identifiable processed information and the second non-identifiable processed information; a matching step in which the calculation device matches the decrypted first non-identifiable processed information and the second non-identifiable processed information; and a calculation step in which the calculation device performs a predetermined calculation from the matched first non-identifiable processed information and the second non-identifiable processed information.

2. The calculation method according to claim 1, wherein the calculation device executes the obtaining step, the decrypting step, the matching step and the calculation step in a TEE.

3. The calculation method according to claim 1, wherein at least one of the first encryption device and the second encryption device performs the encryption step with a common key, and the calculation device performs the decryption step with the common key.

4. The method of claim 1, wherein at least one of the first encryption device and the second encryption device performs the encryption step with a public key, and the computing device performs the decryption step with a private key corresponding to the public key.

5. The calculation method according to claim 1, wherein the first personal information includes first attribute information, the conversion step of the first encryption device includes a process of k-anonymizing the first attribute information, the second personal information includes second attribute information, and the conversion step of the second encryption device includes a process of k-anonymizing the second attribute information.

6. The method according to claim 1, wherein the first personal information includes first identification information, and the converting step of the first encryption device includes a process of hashing the first identification information and adding a salt.

7. The method according to claim 1, wherein the first personal information includes first identification information, and the converting step of the first encryption device includes a process of adding a salt to the first identification information and hashing it.

8. The method according to claim 6 or 7, wherein the first encryption device discards the salt after the conversion step.

9. The method according to claim 1, wherein the second personal information includes second identification information, and the converting step of the second encryption device includes a process of hashing the second identification information and adding a salt.

10. The method of claim 1, wherein the second personal information includes first identification information, and the converting step of the second encryption device includes a process of adding a salt to the second identification information and hashing it.

11. The method of claim 10 or 11, wherein the second encryption device discards the salt after the converting step.

12. The calculation method according to claim 1, wherein the first encryption device and the second encryption device use a common hash function and salt in the conversion step.

13. The calculation method described in claim 1, wherein the first non-identifiable processed information and the second non-identifiable processed information are pseudonymized information, anonymously processed information, personal information or non-personal information.

14. A computing system including a first encryption device, a second encryption device, and a computing device, which executes a computing method including: a conversion step by the first encryption device converting first personal information into first non-identifiable processed information; an encryption step by the first encryption device encrypting the first non-identifiable processed information; a conversion step by the second encryption device converting second personal information into second non-identifiable processed information; an encryption step by the second encryption device encrypting the second non-identifiable processed information; an acquisition step by the computing device acquiring the encrypted first non-identifiable processed information and the second non-identifiable processed information; a decryption step by the computing device decrypting the encrypted first non-identifiable processed information and the second non-identifiable processed information; a matching step by the computing device matching the decrypted first non-identifiable processed information and the second non-identifiable processed information; and a calculation step by the computing device performing a predetermined calculation from the matched first non-identifiable processed information and the second non-identifiable processed information.

15. A computing program for causing a computing system including a first encryption device, a second encryption device, and a computing device to execute a computing method including: a conversion step by the first encryption device of converting first personal information into first non-identifiable processed information; an encryption step by the first encryption device of encrypting the first non-identifiable processed information; a conversion step by the second encryption device of converting second personal information into second non-identifiable processed information; an encryption step by the second encryption device of encrypting the second non-identifiable processed information; an acquisition step by the computing device of acquiring the encrypted first non-identifiable processed information and the second non-identifiable processed information; a decryption step by the computing device of decrypting the encrypted first non-identifiable processed information and the second non-identifiable processed information; a matching step by the computing device of matching the decrypted first non-identifiable processed information and the second non-identifiable processed information; and a calculation step by the computing device of performing a predetermined calculation from the matched first non-identifiable processed information and the second non-identifiable processed information.

16. A computing device that executes the following steps: an acquisition step for acquiring encrypted first non-identifiable processed information and second non-identifiable processed information; a decryption step for decrypting the encrypted first non-identifiable processed information and the second non-identifiable processed information; a matching step for matching the decrypted first non-identifiable processed information and the second non-identifiable processed information; and a calculation step for performing a predetermined calculation from the matched first non-identifiable processed information and the second non-identifiable processed information.

17. An encryption device that performs a conversion step of converting personal information into de-identified processed information, an encryption step of encrypting the de-identified processed information, and a transmission step of transmitting the encrypted de-identified processed information to a computing device.

Images