Secret percentile value calculation device and secret percentile value calculation method

Abstract

Provided is technology for secretly calculating percentile values for each group of a plurality of pieces of data classified into one or more groups, the percentile values being calculated according to a definition of percentile value often used in the field of statistical processing. The present invention includes: a first vector calculation unit for calculating vectors [→kOUT], [→kG], [→vG], [→a], and [→d] from vectors [→k] and [→v]; a second vector calculation unit for calculating vectors [→f] and [→z] from numbers t and u and vectors [→a], [→d], and [→vG]]; a permutation calculation unit for calculating permutation <ρ> from vector [→f]; and a third vector calculation unit for calculating vector [→zOUT] from permutation <ρ> and vector [→z], t and u being numbers representing percentiles, →v being a vector representing data v1, …, vM for calculating the percentile values for each group, and →k being a vector having, as elements, the numbers ki of the groups to which data vi belong.

Description

Secret percentile value calculation device and secret percentile value calculation method

[0001] The present invention relates to a technology for performing database operations while keeping data confidential.

[0002] To handle data safely, research is being conducted on a technology called secure computation, which analyzes data while keeping it secret. Among these, encrypted database processing is being considered to extract data that meets certain conditions and calculate statistical values ​​while keeping the data secret.

[0003] Group-by operation, a type of database processing, takes a table as input, groups the data by the values ​​of a specified column, calculates statistical values ​​(e.g., average, maximum / minimum values, percentile values) for each group for a separately specified column, and outputs the calculation results in table format. Here, percentile values ​​are statistical values ​​that are useful for understanding the distribution of the entire data, and have the desirable feature of being less affected by outliers, unlike averages. Non-Patent Document 1 proposes a method for securely calculating percentile values.

[0004] Hiroki Hamada, Dai Igarashi, and Koji Senda, "An algorithm for computing the median of aggregate functions in secure computation," Proceedings of the Computer Security Symposium 2012, pp.509-516, 2012.

[0005] However, there are multiple definitions of percentile values, and the definition in Non-Patent Document 1 differs from the definition of percentile values ​​that are often used in the field of statistical processing, such as in the Python library NumPy and the PERCENTILE.INC function in Microsoft Excel.

[0006] Therefore, an object of the present invention is to provide a technology for securely calculating percentile values ​​for each group of multiple data classified into one or more groups, in accordance with the definition of percentile values ​​that is often used in the field of statistical processing.

[0007] One aspect of the present invention is a secret percentile value calculation device that secretly calculates a percentile value for each group for a plurality of data classified into one or more groups, wherein t and u are numbers representing percentiles, → v=(v1, …, v M ) for which percentile values ​​for each group are calculated. M A vector representing → k=(k1, …, k M ) to data v i The number k of the group to which i Let (i=1, …, M) be a vector with elements, and let [ → k], [ → v] to the vector [ → k OUT ], [ → k G ], [ → v G ], [ → a], [ → d] (where, → k OUT =(k OUT,1 , …, k OUT,N , null, …, null) (where N is an integer less than or equal to M that represents the number of groups) is a vector → A vector obtained by sorting the elements of a set consisting of k elements in ascending order, → k G =(k G,1 , …, k G,M ) is a vector → The vector obtained by sorting the elements of k in ascending order, → v G =(v G,1 , …, v G,M ) is a vector → The vector obtained by rearranging the elements of v (where v G,i is k G,i =k σ(i) Using substitution σ(i) that satisfies G,i =v σ(i) (expressed as → a=(a1, …, a M ) is a vector → k GA vector representing the ascending order of the elements of each group (where a G,i is k G,i (where the number represents the ascending order of each group) → d=(d1, …, d M ) is a vector → k G A vector representing the descending order of the elements of each group (where d G,i is k G,i a first vector calculation unit that calculates the number t, u and the vector [ → a], [ → d], [ → v G ] to the vector [ → f], [ → z] (where → f=(f1, …, f M ) is a vector → k G A vector representing the percentile position for each group of f i is k G,i is 1 if the element represents the percentile position for each group, and 0 otherwise). → z=(z1, …, z M ) is a vector → v G A vector of the percentile values ​​of each group of (t+u) multiplied by (z i =((ua i -td i )v G,i-1 +(t+u-ua i +td i )v G,i )f i a second vector calculation unit for calculating the vector [ → f], we obtain the substitution 〈ρ〉 (where ρ is the vector → A permutation calculation part calculates the permutation <ρ> and the vector [ → z] to the vector [ → z OUT ](however, → z OUT =(z OUT,1 , …, zOUT,N , 0, …, 0) is a vector → v G A vector of the percentile values ​​of each group of (t+u) multiplied by (z OUT,i (i=1, …, N) is the number (t+u) times the percentile value of the group whose number is i), and a third vector calculation unit [ → k OUT ], [ → z OUT and an output unit that outputs the

[0008] According to the present invention, it becomes possible to perform secure calculation of percentile values ​​for each group of a plurality of data classified into one or more groups, in accordance with the definition of percentile values ​​that is often used in the field of statistical processing.

[0009] RANK is a diagram showing an example of a number obtained by multiplying the percentile value for each group by (t+u) when t=1 and u=3. + 1 is a diagram showing an example of input / output vectors of RANK. - 1 is a diagram showing an example of input / output vectors of the algorithm Group-by percentile when t=1, u=3, and an example of vectors generated in the calculation process. 2 is a diagram showing an example of input / output vectors of the algorithm Group-by percentile when t=1, u=3, and a vector generated in the calculation process. 3 is a block diagram showing the configuration of the secret percentile value calculation device 100. 4 is a flowchart showing the operation of the secret percentile value calculation device 100 / secret percentile value calculation system 10. 5 is a block diagram showing the configuration of the secret percentile value calculation system 10. i Fig. 2 is a block diagram showing an example of the functional configuration of a computer that realizes each device in the embodiment of the present invention.

[0010] Hereinafter, an embodiment of the present invention will be described in detail. Note that components having the same functions are given the same numbers and redundant explanations will be omitted.

[0011] Before describing each embodiment, the notation used in this specification will be explained.

[0012] ^ (caret) represents a superscript, e.g., x y^z Yes z is a superscript to x, and x y^z Yes z is a subscript to x. Also, _ (underscore) represents a subscript. For example, x y_z Yes z is a superscript to x, and x y_z Yes z is a subscript to x.

[0013] For a character x → x, ^x, and ~x → ", "^" and "~" should be written directly above the "x", but due to limitations on the description in the specification, → These are written as x, ^x or ~x.

[0014] <Technical Background> <<1: Definition of Percentile Value>> First, the definition of percentile value used in the embodiment of the present invention will be described. c A vector representing → v=(v1, …, v c ), the vector → The percentile value of v is a vector → The τ=(t / (t+u))×(c-1)+1th element of v (where t and u are numbers representing percentiles). → The percentile value of v is the τ-th element v if τ is an integer (i.e., (c-1) is divisible by (t+u)). τ and if τ is not an integer (i.e., (c-1) is not divisible by (t+u)), then v * =δ τ vceiling(τ)-1+(1-δ τ )vceiling(τ) (where δ τ =ceiling(τ)-τ). v * is the value obtained by linear interpolation using ceiling(τ)-1 and ceiling(τ), which are integers before and after τ. If τ is an integer, then v * =v τThis becomes:

[0015] The above definition of percentile value is a generalization of median and quartile. Specifically, when t=1, u=1 it is the median, when t=i, u=4-i with 1≦i≦3 it is the quartile, and when t=i, u=100-i with 0≦i≦100 it is the percentile.

[0016] <<2: Input / Output of Algorithm in Embodiment of the Present Invention>> Next, we will explain the input / output of the Group-by percentile algorithm that calculates percentile values ​​for each group in an embodiment of the present invention. The algorithm Group-by percentile takes numbers t and u to represent percentiles, data v1, ..., v2 for which percentile values ​​for each group are to be calculated, and M A vector representing → v=(v1, …, v M ) is encrypted as a vector, data v i The number k of the group to which i A vector with elements (i=1, …, M) → k=(k1, …, k M) is input, and a vector obtained by encrypting a vector whose elements are group numbers and a vector obtained by encrypting a vector whose elements are numbers obtained by multiplying each group's percentile value by (t+u) are output. Note that the elements of the output vector are not the encrypted numbers of each group's percentile value. The reason for using the encrypted numbers obtained by multiplying each group's percentile value by (t+u) as the elements of the output vector is that in many application situations, it is sufficient to obtain the encrypted numbers of the numbers obtained by multiplying each group's percentile value by (t+u), and the process of obtaining the encrypted numbers of each group's percentile value from the encrypted numbers obtained by multiplying each group's percentile value by (t+u) is relatively costly in secure computation. To decrypt a value obtained using the Group-by percentile algorithm, the value can be decrypted and then divided by (t+u). Furthermore, to obtain percentile values ​​while keeping the values ​​obtained using the Group-by percentile algorithm encrypted, division by (t+u) can be performed, for example, using the secure division protocol described in Reference Non-Patent Document 1.

[0017] (Reference Non-Patent Document 1: Nuttapong Attrapadung, Koki Hamada, Dai Ikarashi, Ryo Kikuchi, Takahiro Matsuda, Ibuki Mishina, Hiraku Morita, and Jacob CN Schuldt. "Adam in private: Secure and Fast Training of Deep Neural Networks with Adaptive Moment Estimation," Proceeding on Privacy Enhancing Technologie, Vol. 2022, No. 4, pp. 746-767, 2022.) Figure 1 is a diagram showing an example of the number obtained by multiplying the percentile value for each group by (t+u) when t=1 and u=3. Note that in Figure 1, input and output are shown in plain text. Here, → kOUT =(k OUT,1 , …, k OUT,N , null, …, null) (where N is an integer less than or equal to M that represents the number of groups) is a vector → is a vector obtained by sorting the elements of a set consisting of k elements in ascending order, → z OUT =(z OUT,1 , …, z OUT,N , 0, …, 0) is a vector → This is a vector that represents the number obtained by multiplying the percentile value for each group of v by (t+u). As mentioned above, the percentile values ​​for groups 1, 2, and 3 are 2.25, 1, and 4.25, respectively, but the numbers 9, 4, and 17 obtained by multiplying the percentile value for each group by 4 (=t+u) are output.

[0018] <<3: Secure Computation>> The secure computation in the embodiment of the present invention is constructed as a combination of existing secure computation operations. Below, the operations used in the embodiment of the present invention, including notation, will be explained.

[0019] [Encryption] Data x is encrypted and represented as [x]. Also, vector → x=(x1, … , x n ) for the vector → The vector obtained by encrypting x is [ → x]=([x1], … , [x n ]). The permutation obtained by encrypting the permutation π for the permutation π is represented as <π>. Any method that allows the later-described calculation to be performed while keeping the data confidential can be used as the encryption method, and for example, homomorphic encryption (see Non-Patent Document 2) or secret sharing (see Non-Patent Document 3) can be used.

[0020] (Reference non-patent document 2: Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan, "Fully Homomorphic Encryption without Bootstrapping," Electronic Colloquium on Computational Complexity, Report No.111, 2011.) (Reference non-patent document 3: Gilad Asharov, Koki Hamada, Dai Ikarashi, Ryo Kikuchi, Ariel Nof, Benny Pinkas, Katsumi Takahashi, and Junichi Tomida, "Efficient Secure Three-Party Sorting with Applications to Data Analysis and Heavy Hitters," Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pp.125-138, 2022.) [Addition / Subtraction, Constant Multiplication] Addition [a]+[b] takes [a] and [b] as input and outputs [a+b]. Subtraction [a]-[b] takes [a] and [b] as input and outputs [ab]. Constant multiplication c[a] takes c and [a] as input and outputs [ca]. It is best to use addition, subtraction, and constant multiplication, which are naturally supported for both homomorphic encryption and secret sharing.

[0021] [Multiplication] Multiplication Mult([a], [b]) takes [a] and [b] as input and outputs [ab]. For homomorphic encryption, naturally supported multiplication should be used. For secret sharing, the method described in Reference Non-Patent Document 3 should be used.

[0022] [Stable sort] Stable sort is a vector [ → x]=([x1], … , [x n ]) as input, and the vector [ → x′]=([x1′], … , [x n′]) (where for i ∈ {1, …, n - 1}, x′ i ≤ x′ i+1 is satisfied. Note that if x′ i = x′ i+1 then, → the one with the smaller element number in x is taken as x′ i ).) is output. Stable sorting can be constructed using, for example, the following two algorithms GenPerm and Sort. GenPerm takes the vector → x] as input and outputs the permutation <π> (where π is the permutation that sorts the elements of the vector → x in ascending order). Sort takes the permutation <π> and the vector → x] as input and outputs the vector → x′] (where → x′ is the vector obtained by applying the permutation π to the vector → x). <π> ← GenPerm( → x]), → x′] ← Sort(<π>, → x]) is expressed. Also, when sorting multiple vectors with the same permutation, it is expressed as ( → x′], → y′]) ← Sort(<π>, ( → x], → y]). For homomorphic encryption, it is advisable to use a sorting network. Also, for secret sharing, it is advisable to use the method described in Reference Non-Patent Document 3.

[0023] [Comparison] LessThan([x], [y]) takes [x], [y] as input and outputs [e] such that if x < y then e = 1, otherwise e = 0. It is expressed as [e] ← LessThan([x], [y]).

[0024] When data is encrypted in bit representation, LessThan([x], [y]) can be calculated by circuit calculation to determine whether each bit of [xy] is 0 or not, and the circuit calculation can be performed using addition, subtraction, and multiplication. When data is encrypted in integer representation, it can be converted to bit representation using bit decomposition (see Non-Patent Document 4) and then the circuit calculation can be performed. When data is encrypted on mod p, it can be calculated by multiplication using [(xy) p-1 ] can be calculated.

[0025] (Reference non-patent document 4: Ryo Kikuchi, Dai Ikarashi, Takahiro Matsuda, Koki Hamada, and Koji Chida, "Efficient Bit-Decomposition and Modulus-Conversion Protocols with an Honest Majority," ACISP 2018, pp.64-82, 2018.) [Group-by rank + , Group-by rank - ] → v=(v1, …, v M ) to calculate ascending or descending ranks for each group of data v1, …, v M A vector representing → k=(k1, …, k M ) to data v i The number k of the group to which i Let (i=1, …, M) be a vector with elements, and RANK + is a vector [ → k], [ → v] as input and vector [ → k OUT ], [ → k G ], [ → v G ], [ → a] and RANK - is a vector [ → k], [ → v] as input and vector [ → k OUT ], [ → kG ], [ → v G ], [ → d] is output, where → k OUT =(k OUT,1 , …, k OUT,N , null, …, null) (where N is an integer less than or equal to M that represents the number of groups) is a vector → A vector obtained by sorting the elements of a set consisting of k elements in ascending order, → k G =(k G,1 , …, k G,M ) is a vector → The vector obtained by sorting the elements of k in ascending order, → v G =(v G,1 , …, v G,M ) is a vector → The vector obtained by rearranging the elements of v (where v G,i is k G,i =k σ(i) Using substitution σ(i) that satisfies G,i =v σ(i) (expressed as → a=(a1, …, a M ) is a vector → k G A vector representing the ascending order of the elements of each group (where a G,i is k G,i (where the number represents the ascending order of each group) → d=(d1, …, d M ) is a vector → k G A vector representing the descending order of the elements of each group (where d G,i is k G,i RANK is a number that represents the descending order of each group. + , RANK - calculates the ascending order and descending order for each group, respectively. However, the ascending order and descending order for each group are counted as 0, 1, 2, .... Also, ([ → k out ], [ → kG ], [ → v G ], [ → a])←RANK + ([ → k], [ → v]) and ([ → k out ], [ → k G ], [ → v G ], [ → d])←RANK - ([ → k], [ → v]) For secret sharing, the method described in Non-Patent Document 5 may be used.

[0026] (Reference Non-Patent Document 5: Ryo Kikuchi, Hiroki Hamada, Dai Igarashi, Hajime Takahashi, Katsumi Takahashi, "Let's try cross-sectional movement analysis using secure computation," SCIS 2020, 2020.) Note that the vector → permutation on k (i.e., vector → k G In the process of obtaining k G,i =k G,i+1 If (i∈{1, … , M-1}), then → The element number in k that is smaller is k G,i (Assuming that.)

[0027] Figure 2 is RANK + FIG. 3 shows an example of the input / output vectors of RANK. - FIG. 10 is a diagram illustrating an example of input and output vectors.

[0028] <<4: Algorithm in the embodiment of the present invention>> The algorithm Group-by percentile in the embodiment of the present invention is shown below.

[0029] <<Group-by percentile algorithm>> ------------------------------------------------------------------ Input: t, u, [ → k], [ → v] Output: [→ k out ], [ → z out ] 1. ([ → k out ], [ → k G ], [ → v G ], [ → a])←RANK + ([ → k], [ → v]) 2. ([ → k out ], [ → k G ], [ → v G ], [ → d])←RANK - ([ → k], [ → v]) 3. For every i∈{1, …, M}: (a) [f i ]←IsInRange(u[a i ], t[d i ], t[d i ]+t+u) (b) [x i ]←Mult(u[a i ]-t[d i ], [v G,i-1 ]) (c) [y i ]←Mult(t+u-u[a i ]+t[d i ], [v G,i ]) (d) [z i ]←Mult([x i ]+[y i ], [f i ]) 4. <ρ>←GenPerm(1-[ → f]) 5. [ → z out ]←Sort(<ρ>, [ → z]) 6. Output([ → k out ], [ → z out) ------------------------------------------------------------------ 1 in Step 4 represents a vector where all elements are 1. Also, v in Step 3(b) is set to 0 when i = 1. G,i-1 is set to 0 when i = 1 G,i-1 for v

[0030] IsInRange in Step 3(a) is a function that checks whether r0 ≤ a < r1 holds. Given [a], [r0], and [r1] as inputs, it outputs [1] if r0 ≤ a < r1 holds, and [0] otherwise. IsInRange can be constructed using comparisons as follows, for example.

[0031] <<Algorithm IsInRange>> ------------------------------------------------------------------ Input: [a], [r0], [r1] Output: [f] 1. [e0]←LessThan([a], [r0]) 2. [e1]←LessThan([a], [r1]) 3. [f]←Mult(1 - [e0], [e1]) 4. Output([f]) ------------------------------------------------------------------ An important point in constructing the Algorithm Group-by percentile is the fact that the ((t / (t + u)) × (c - 1) + 1)-th element of a certain group is the element that divides the elements of that group into u to t. From this fact, it can be seen that "comparing element-wise the sequence obtained by multiplying the ascending ranks for each group by u and the sequence obtained by multiplying the descending ranks for each group by t, the position where the magnitude relationship is reversed becomes the ((t / (t + u)) × (c - 1) + 1)-th element." Therefore, first, calculate a vector → f where only the ((t / (t + u)) × (c - 1) + 1)-th element of each group is 1. Specifically, calculate the vector → f as follows. The vector →The i-th (1≦i≦M) element of v i Let c be the number of elements in the group to which element v belongs, i If is the jth (1≦j≦c) element in the group, then a i =j-1, d i =cj holds. a i =j-1, d i Under the assumption that =cj holds, when j=ceiling((t / (t+u))×(c-1)+1), f i = 1 vector → f is the vector we want to find. i = 1 for element v i The following equivalence relation holds for

[0032] j=ceiling((t / (t+u))×(c-1)+1) ⇔j-1<(t / (t+u))×(c-1)+1, (t / (t+u))×(c-1)+1≦j ⇔u(j-1) <t(c-j)+(t+u), t(c-j)≦u(j-1) ⇔ua i <td i +(t+u), d i ≦ua i Here, ⇔ represents an equivalence relation.

[0033] Therefore, ua i <td i +(t+u), d i ≦ua i If holds, then f i = 1, otherwise f i = 0, the vector → f can be calculated.

[0034] Next, f i = 1 when v * =δ τ vceiling(τ)-1+(1-δ τ )vceiling(τ) (where τ=(t / (t+u))×(c-1)+1, δ τ = ceiling(τ) - τ) is calculated. i = 1, then ceiling(τ) = j, a i =j-1, d i =cj holds, so δτ can be calculated as follows:

[0035] δ τ =j-τ=j-((t / (t+u))×(c-1)+1)=(tj+uj-tc-u) / (t+u)=(ua i -td i ) / (t+u) Therefore, (t+u)v * can be calculated by the following formula:

[0036] (t+u)v * =(ua i -td i )v i-1 +(t+u-ua i +td i )v i From the above, the vector → Using f, we can calculate the number obtained by multiplying the percentile value for each group by (t+u).

[0037] FIG. 4 shows an example of input and output vectors of the Group-by percentile algorithm when t=1, u=3, and vectors generated during the calculation process.

[0038] First Embodiment A secret percentile value calculation device 100 of this embodiment uses, for example, homomorphic encryption to secretly calculate percentile values ​​for each group of a plurality of data items classified into one or more groups.

[0039] The secret percentile value calculation device 100 will be described below with reference to FIGS. 5 and 6. FIG. 5 is a block diagram showing the configuration of the secret percentile value calculation device 100. FIG. 6 is a flowchart showing the operation of the secret percentile value calculation device 100. As shown in FIG. 5, the secret percentile value calculation device 100 includes a first vector calculation unit 110, a second vector calculation unit 120, a permutation calculation unit 130, a third vector calculation unit 140, an output unit 150, and a recording unit 190. The recording unit 190 is a component that records information necessary for the processing of the secret percentile value calculation device 100.

[0040] The operation of the secret percentile value calculation device 100 will be described below with reference to FIG. 6. Let t and u be numbers representing percentiles. → v=(v1, …, v M ) for which percentile values ​​for each group are calculated. M A vector representing → k=(k1, …, k M ) to data v i The number k of the group to which i Let (i=1, …, M) be the elements of a vector. Numbers t, u, vector → k is the anonymized vector [ → k], vector → Let v be the anonymized vector [ → v] is the input of the secret percentile value calculation device 100. → k, → v is a column of a table that makes up a database, for example. In other words, a vector → k, → v is a vector whose elements are the attribute values ​​of the attributes included in the tables that make up the database.

[0041] In S110, the first vector calculation unit 110 calculates the input vector [ → k], [ → v] to the vector [ → k OUT ], [ → k G ], [ → v G ], [ → a], [ → d] (where, → k OUT =(k OUT,1 , …, k OUT,N , null, …, null) (where N is an integer less than or equal to M that represents the number of groups) is a vector → A vector obtained by sorting the elements of a set consisting of k elements in ascending order, → k G =(k G,1 , …, k G,M ) is a vector →The vector obtained by sorting the elements of k in ascending order, → v G =(v G,1 , …, v G,M ) is a vector → The vector obtained by rearranging the elements of v (where v G,i is k G,i =k σ(i) Using substitution σ(i) that satisfies G,i =v σ(i) (expressed as → a=(a1, …, a M ) is a vector → k G A vector representing the ascending order of the elements of each group (where a G,i is k G,i (where the number represents the ascending order of each group) → d=(d1, …, d M ) is a vector → k G A vector representing the descending order of the elements of each group (where d G,i is k G,i For example, the first vector calculation unit 110 calculates and outputs the vector ([ → k OUT ], [ → k G ], [ → v G ], [ → a])←RANK + ([ → k], [ → v]), ([ → k OUT ], [ → k G ], [ → v G ], [ → d])←RANK - ([ → k], [ → v]) gives the vector [ → k OUT ], [ → k G ], [ → v G ], [ → a], [→ d] can be calculated.

[0042] In S120, the second vector calculation unit 120 calculates the vector [ → a], [ → d], [ → v G ] to the vector [ → f], [ → z] (where → f=(f1, …, f M ) is a vector → k G A vector representing the percentile position for each group of f i is k G,i is 1 if the element represents the percentile position for each group, and 0 otherwise). → z=(z1, …, z M ) is a vector → v G A vector of the percentile values ​​of each group of (t+u) multiplied by (z i =((ua i -td i )v G,i-1 +(t+u-ua i +td i )v G,i )f i For example, the second vector calculation unit 120 calculates and outputs [f i ]←IsInRange(u[a i ], t[d i ], t[d i ]+t+u), [x i ]←Mult(u[a i ]-t[d i ], [v G,i-1 ]), [y i ]←Mult(t+uu[a i ]+t[d i ], [v G,i ]), [z i ]←Mult([x i ]+[y i ], [f i]) to find the vector [ → f], [ → z] can be calculated.

[0043] In S130, the permutation calculation unit 130 converts the vector [ → f], we obtain the substitution 〈ρ〉 (where ρ is the vector → For example, the permutation calculation unit 130 calculates and outputs a permutation that rearranges the elements of f in descending order. → f]), the permutation 〈ρ〉 can be calculated.

[0044] In S140, the third vector calculation unit 140 calculates the permutation <ρ> calculated in S130 and the vector [ → z] to the vector [ → z OUT ](however, → z OUT =(z OUT,1 , …, z OUT,N , 0, …, 0) is a vector → v G A vector of the percentile values ​​of each group of (t+u) multiplied by (z OUT,i (i=1, ..., N) is the number (t+u) times the percentile value of the group whose number is i. For example, the third vector calculation unit 140 calculates and outputs [ → z OUT ]←Sort(<ρ>, [ → z]), the vector [ → z OUT ] can be calculated.

[0045] In S150, the output unit 150 outputs the vector [ → k OUT ] and the vector [ → z OUT ] is output.

[0046] According to an embodiment of the present invention, it is possible to perform secure calculation of percentile values ​​for each group of multiple data classified into one or more groups, in accordance with the definition of percentile values ​​that is often used in the field of statistical processing.

[0047] Second Embodiment A secret percentile value calculation system 10 of this embodiment uses, for example, secret sharing to secretly calculate percentile values ​​for each group of a plurality of data items classified into one or more groups.

[0048] The secret percentile value calculation system 10 will be described below with reference to Figures 6 to 8. Figure 7 is a block diagram showing the configuration of the secret percentile value calculation system 10. The secret percentile value calculation system 10 includes W (W is a predetermined integer of 3 or more) secret percentile value calculation devices 1001, ..., 100 W Secret percentile value calculation devices 1001, ..., 100 W are connected to a network 800 and can communicate with each other. The network 800 may be, for example, a communication network such as the Internet or a broadcast communication path. i 6 is a block diagram showing the configuration of the secret percentile value calculation system 10 (1≦i≦W).

[0049] As shown in FIG. 8, the secret percentile value calculation device 100 i is the first vector calculation unit 110 i and the second vector calculation unit 120 i and the permutation calculation unit 130 i and the third vector calculation unit 140 i and the output unit 150 i and the recording unit 190 i Recording unit 190 i Secret percentile value calculation device 100 excluding iEach component of the above is configured to be able to execute the operations required for the secure computation required to realize the function of the component. In this embodiment, the specific functional configuration for realizing each operation is sufficient if it is a configuration that can execute existing algorithms including the algorithms described in <Technical Background>, and since these are conventional configurations, detailed description will be omitted. i is the secret percentile value calculation device 100 i This is a component that records information necessary for processing.

[0050] W secret percentile value calculation devices 100 i By the collaborative computation by the above, the secret percentile value computation system 10 realizes the secret computation of the percentile value for each group of a plurality of data classified into one or more groups, which is a multi-party protocol. Therefore, the first vector computation means 110 (not shown) of the secret percentile value computation system 10 includes first vector computation units 110, ..., 110 W The second vector calculation means 120 (not shown) is composed of second vector calculation units 1201, ..., 120 W The permutation calculation means 130 (not shown) is composed of permutation calculation units 1301, ..., 130 W The third vector calculation means 140 (not shown) is composed of third vector calculation units 1401, ..., 140 W The output means 150 (not shown) is composed of output units 1501, ..., 150 W It consists of:

[0051] The operation of the secret percentile value calculation system 10 will be described below with reference to FIG. 6. Let t and u be numbers representing percentiles. → v=(v1, …, v M ) for which percentile values ​​for each group are calculated. M A vector representing → k=(k1, …, k M ) to data v i The number k of the group to which i Let (i=1, …, M) be the elements of a vector. Numbers t, u, vector→ k is the anonymized vector [ → k], vector → Let v be the anonymized vector [ → v] is the input of the secret percentile value calculation system 10. → k, → v is a column of a table that makes up a database, for example. In other words, a vector → k, → v is a vector whose elements are the attribute values ​​of the attributes included in the tables that make up the database.

[0052] In S110, the first vector calculation means 110 calculates the input vector [ → k], [ → v] to the vector [ → k OUT ], [ → k G ], [ → v G ], [ → a], [ → d] (where, → k OUT =(k OUT,1 , …, k OUT,N , null, …, null) (where N is an integer less than or equal to M that represents the number of groups) is a vector → A vector obtained by sorting the elements of a set consisting of k elements in ascending order, → k G =(k G,1 , …, k G,M ) is a vector → The vector obtained by sorting the elements of k in ascending order, → v G =(v G,1 , …, v G,M ) is a vector → The vector obtained by rearranging the elements of v (where v G,i is k G,i =k σ(i) Using substitution σ(i) that satisfies G,i =v σ(i) (expressed as → a=(a1, …, a M ) is a vector → kG A vector representing the ascending order of the elements of each group (where a G,i is k G,i (where the number represents the ascending order of each group) → d=(d1, …, d M ) is a vector → k G A vector representing the descending order of the elements of each group (where d G,i is k G,i For example, the first vector calculation means 110 calculates a vector ([ → k OUT ], [ → k G ], [ → v G ], [ → a])←RANK + ([ → k], [ → v]), ([ → k OUT ], [ → k G ], [ → v G ], [ → d])←RANK - ([ → k], [ → v]) gives the vector [ → k OUT ], [ → k G ], [ → v G ], [ → a], [ → d] can be calculated.

[0053] In S120, the second vector calculation means 120 calculates the vector [ → a], [ → d], [ → v G ] to the vector [ → f], [ → z] (where → f=(f1, …, f M ) is a vector → k GA vector representing the percentile position for each group of f i is k G,i is 1 if the element represents the percentile position for each group, and 0 otherwise). → z=(z1, …, z M ) is a vector → v G A vector of the percentile values ​​of each group of (t+u) multiplied by (z i =((ua i -td i )v G,i-1 +(t+u-ua i +td i )v G,i )f i For example, the second vector calculation means 120 calculates [f i ]←IsInRange(u[a i ], t[d i ], t[d i ]+t+u), [x i ]←Mult(u[a i ]-t[d i ], [v G,i-1 ]), [y i ]←Mult(t+uu[a i ]+t[d i ], [v G,i ]), [z i ]←Mult([x i ]+[y i ], [f i ]) to find the vector [ → f], [ → z] can be calculated.

[0054] In S130, the permutation calculation means 130 calculates the vector [ → f], we obtain the substitution 〈ρ〉 (where ρ is the vector → For example, the permutation calculation means 130 calculates a permutation that rearranges the elements of f in descending order. → f]), the permutation 〈ρ〉 can be calculated.

[0055] In S140, the third vector calculation means 140 calculates the permutation <ρ> calculated in S130 and the vector [ → z] to the vector [ → z OUT ](however, → z OUT =(z OUT,1 , …, z OUT,N , 0, …, 0) is a vector → v G A vector of the percentile values ​​of each group of (t+u) multiplied by (z OUT,i (i=1, ..., N) calculates the number (t+u) times the percentile value of the group whose number is i. For example, the third vector calculation means 140 calculates → z OUT ]←Sort(<ρ>, [ → z]), the vector [ → z OUT ] can be calculated.

[0056] In S150, the output means 150 outputs the vector [ → k OUT ] and the vector [ → z OUT ] is output.

[0057] According to an embodiment of the present invention, it is possible to perform secure calculation of percentile values ​​for each group of multiple data classified into one or more groups, in accordance with the definition of percentile values ​​that is often used in the field of statistical processing.

[0058] <Additional Note> The processing of each unit of each of the above-described devices may be realized by a computer, in which case the processing content of the functions to be possessed by each device is described by a program. Then, by loading this program into the recording unit 2020 of the computer 2000 shown in Fig. 9 and operating the arithmetic processing unit 2010, the input unit 2030, the output unit 2040, the auxiliary recording unit 2025, etc., the various processing functions of each of the above-described devices are realized on the computer.

[0059] The device of the present invention may, for example, be a single hardware entity that includes an input unit capable of inputting signals from outside the hardware entity, an output unit capable of outputting signals to outside the hardware entity, a communication unit to which a communication device (e.g., a communication cable) can be connected for communication with outside the hardware entity, a CPU (Central Processing Unit) that serves as an arithmetic processing unit, which may also include cache memory and registers, RAM and ROM that serve as memory, an external storage device such as a hard disk, and buses that connect the input unit, output unit, communication unit, CPU, RAM, ROM, and external storage device so that data can be exchanged between them. If necessary, the hardware entity may also be provided with a device (drive) that can read and write recording media such as a CD-ROM. An example of a physical entity equipped with such hardware resources is a general-purpose computer.

[0060] The external storage device of the hardware entity stores the programs required to realize the above-mentioned functions and the data required for processing these programs (the programs may be stored in a ROM, which is a read-only storage device, for example, instead of an external storage device). Data obtained by processing these programs is stored in RAM, the external storage device, etc. as appropriate.

[0061] In the hardware entity, each program stored in an external storage device (or ROM, etc.) and the data required to process each program are loaded into memory as needed, and interpreted, executed, and processed by the CPU as appropriate. As a result, the CPU realizes predetermined functions (each component represented as a "... unit," "... means," etc.). In other words, each component of the embodiments of the present invention may be configured by a processing circuitry.

[0062] As described above, when the processing functions of the hardware entities (apparatuses of the present invention) described in the above embodiments are realized by a computer, the processing contents of the functions that the hardware entities should have are described by a program. Then, by executing this program on a computer, the processing functions of the hardware entities are realized on the computer.

[0063] The program describing the processing contents can be recorded on a computer-readable recording medium, such as a non-transitory recording medium, specifically a magnetic recording device, an optical disk, or the like.

[0064] The program may be distributed, for example, by selling, transferring, lending, etc. a portable recording medium such as a DVD or CD-ROM on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to another computer via a network, thereby distributing the program.

[0065] A computer that executes such a program, for example, first stores the program recorded on a portable recording medium or transferred from a server computer in its own non-transitory storage device, the auxiliary storage unit 2025. Then, when executing a process, the computer loads the program stored in its own non-transitory storage device, the auxiliary storage unit 2025, into the storage unit 2020 and executes processing in accordance with the loaded program. Alternatively, as another execution mode of this program, the computer may load the program directly from a portable recording medium into the storage unit 2020 and execute processing in accordance with the program. Furthermore, the computer may execute processing in accordance with the received program each time a program is transferred from the server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the processing function by issuing an execution instruction and obtaining the results, thereby executing the above-described processing through a so-called ASP (Application Service Provider) type service. Note that the program in this embodiment includes information used for processing by a computer that is equivalent to a program (such as data that is not a direct instruction to the computer but has properties that define computer processing).

[0066] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0067] The present invention is not limited to the above-described embodiment, and various modifications can be made without departing from the spirit of the present invention.

Claims

1. A secret percentile value calculation device that secretly calculates a percentile value for each group for multiple data classified into one or more groups, comprising: → v = (v1, …, v M ) for which percentile values ​​for each group are to be calculated. M A vector representing → k=(k1, …, k M ) to data v i The number k of the group to which i Let (i=1, …, M) be a vector with elements, and let [ → k], [ → v] to the vector [ → k OUT ], [ → k G ], [ → v G ], [ → a], [ → d] (where: → k OUT =(k OUT,1 , …, k OUT,N , null, …, null) (where N is an integer less than or equal to M that represents the number of groups) is a vector → A vector obtained by sorting the elements of a set of k elements in ascending order, → k G =(k G,1 , …, k G,M ) is a vector → A vector obtained by sorting the elements of k in ascending order. → v G =(v G,1 , …, v G,M ) is a vector → The vector obtained by rearranging the elements of v (where v G,i k G,i =k σ(i) Using the substitution σ(i) that satisfies G,i =v σ(i) (expressed as → a = (a1, …, a M ) is a vector → k G A vector representing the ascending order of the elements of each group (where a G,i k G,i (where is a number representing the ascending rank of each group) → d = (d1, …, d M ) is a vector → k G A vector representing the descending rank of each group of elements in (where d G,i k G,i a first vector calculation unit for calculating a vector [ → a], [ → d], [ → v G ] to the vector [ → f], [ → z] (where → f = (f1, …, f M ) is a vector → k G A vector representing the percentile position for each group of f i k G,i is 1 if is the percentile position for each group, 0 otherwise) → z=(z1, …, z M ) is a vector → v G A vector of the percentiles of each group of t+u multiplied by (t+u) (where z i =((ua i -td i )v G,i-1 +(t+u-ua i +td i )v G,i )f i A second vector calculation unit for calculating a vector [ → f], we obtain the substitution 〈ρ〉 (where ρ is the vector → A permutation calculation part calculates the permutation <ρ> and the vector [ → z] to the vector [ → z OUT ](however, → z OUT =(z OUT,1 , …, z OUT,N , 0, …, 0) is a vector → v G A vector of the percentiles of each group of t+u multiplied by (t+u) (where z OUT,i (i=1, …, N) is a third vector calculation unit that calculates the number (t+u) times the percentile value of the group whose number is i; → k OUT ], [ → z OUT ]; and an output unit that outputs 2. A secret percentile value calculation device according to claim 1, wherein the first vector calculation unit calculates ([ → k OUT ], [ → k G ], [ → v G ], [ → a])←RANK + ([ → k], [ → v]), ([ → k OUT ], [ → k G ], [ → v G ], [ → d])←RANK - ([ → k], [ → v]) to the vector [ → k OUT ], [ → k G ], [ → v G ], [ → a], [ → d], and the second vector calculation unit calculates [f i ]←IsInRange(u[a i ], t[d i ], t[d i ]+t+u), [x i ]←Mult(u[a i ]-t[d i ], [v G,i-1 ]), [y i ]←Mult(t+uu[a i ]+t[d i ], [v G,i ]), [z i ]←Mult([x i ]+[y i ], [f i ]) to find the vector [ → f], [ → z], and the permutation calculation unit calculates <ρ>←GenPerm(1-[ → f]) to calculate the permutation <ρ>, and the third vector calculation unit → z OUT ]←Sort(<ρ>, [ → z]), the vector [ → z OUT ].

3. A secret percentile value calculation method in which a secret percentile value calculation device secretly calculates a percentile value for each group for a plurality of data classified into one or more groups, the method comprising the steps of: → v = (v1, …, v M ) for which percentile values ​​for each group are to be calculated. M A vector representing → k=(k1, …, k M ) to data v i The number k of the group to which i (i=1, ..., M) is a vector having elements, and the secret percentile value calculation device calculates the vector [ → k], [ → v] to the vector [ → k OUT ], [ → k G ], [ → v G ], [ → a], [ → d] (where: → k OUT =(k OUT,1 , …, k OUT,N , null, …, null) (where N is an integer less than or equal to M that represents the number of groups) is a vector → A vector obtained by sorting the elements of a set of k elements in ascending order, → k G =(k G,1 , …, k G,M ) is a vector → A vector obtained by sorting the elements of k in ascending order. → v G =(v G,1 , …, v G,M ) is a vector → The vector obtained by rearranging the elements of v (where v G,i k G,i =k σ(i) Using the substitution σ(i) that satisfies G,i =v σ(i) (expressed as → a = (a1, …, a M ) is a vector → k G A vector representing the ascending order of the elements of each group (where a G,i k G,i (where is a number representing the ascending rank of each group) → d = (d1, …, d M ) is a vector → k G A vector representing the descending rank of each group of elements in (where d G,i k G,i a first vector calculation step of calculating a secret percentile value from the numbers t, u and a vector [ → a], [ → d], [ → v G ] to the vector [ → f], [ → z] (where → f = (f1, …, f M ) is a vector → k G A vector representing the percentile position for each group of f i k G,i is 1 if is the percentile position for each group, 0 otherwise) → z=(z1, …, z M ) is a vector → v G A vector of the percentiles of each group of t+u multiplied by (t+u) (where z i =((ua i -td i )v G,i-1 +(t+u-ua i +td i )v G,i )f i a second vector calculation step of calculating a vector [ → f], we obtain the substitution 〈ρ〉 (where ρ is the vector → a permutation calculation step of calculating a permutation <ρ> for rearranging the elements of f in descending order; and → z] to the vector [ → z OUT ](however, → z OUT =(z OUT,1 , …, z OUT,N , 0, …, 0) is a vector → v G A vector of the percentiles of each group of t+u multiplied by (t+u) (where z OUT,i a third vector calculation step in which the secret percentile value calculation device calculates a vector [ → k OUT ], [ → z OUT ]; and an output step of outputting the secret percentile value calculation method.

Images