Statistic calculation method, system, device, and program

Abstract

In this statistic calculation method, a database is combined using a combining key created using an oblivious pseudo-random function (OPRF), and a statistic is calculated from the combined database. Because the OPRF can be executed by matrix computation in which no exponentiation computation is performed and most of the OPRF is lightweight, the calculation cost for the generation of the combined database and the calculation of the statistic can be reduced.

Description

Statistical calculation method, system, device and program

[0001] The disclosed technology relates to a technology for combining two databases while keeping them confidential, and calculating statistics from the combined database.

[0002] A technique described in Non-Patent Document 1 is known as a technique for combining two databases while keeping them confidential and calculating statistics from the combined database.

[0003] In the technology described in Non-Patent Document 1, a combined key is generated by converting the IDs held by two parties using a one-way commutative function. Then, one of the two parties encrypts the attribute values ​​associated with the IDs using homomorphic encryption. The combined key and the encrypted attribute values ​​are then passed to the other party. This makes it possible to calculate statistics without revealing the IDs and attribute values ​​to the other party.

[0004] Kazuma Nozawa and 8 others, "Proposal and Evaluation of a Data Integration Method Suitable for Combining Cross-Organizational Personal Data," CSS2022

[0005] However, using a one-way commutative function requires a huge number of power calculations to make it impossible to reverse-calculate the ID from the join key, which increases the computational cost.

[0006] The disclosed technology aims to provide a statistical calculation method, system, device, and program that combines two databases while keeping them confidential, without using a one-way commutative function, and calculates statistics from the combined database.

[0007] A statistical quantity calculation method according to one aspect of the disclosed technology includes the steps of: a first device having a first database, a key set of the first database being a first key set; a second device having a second database, a key set of the second database being a second key set, and π being a permutation; the first device and the second device executing a PC (Permuted Characteristic) protocol using the first key set and the second key set as input, and the first device obtaining a feature vector indicating whether the π(i)-th key of the second key set is included in the first key set; the first device and the second device executing an OPRF (Oblivious Pseudo Random Function) protocol using the first key set as input, and the first device obtaining a first random number sequence that is a sequence of random numbers related to the first key set; the second device obtaining a second random number sequence that is a sequence of random numbers related to the second key set using a pseudorandom function determined by the OPRF protocol executed to obtain the first random number sequence; and the first device and the second device obtaining a set of numbers of elements in the second random number sequence and the feature vector that indicate that the element is not included as a key of the first database. The first device executes an OT (Oblivious Transfer) protocol using the second random number sequence as input to obtain a third random number sequence consisting of random numbers included in the number set from among the random numbers included in the second random number sequence; the first device and the second device execute an OPRF protocol using the second random number sequence as input to obtain a fourth random number sequence which is a sequence of random numbers related to the second random number sequence; and the first device generates a fourth random number sequence by randomizing the random numbers included in the first random number sequence and the random numbers included in the third random number sequence using a pseudorandom function determined by the OPRF protocol executed to obtain the fourth random number sequence. a step in which the first device obtains a fifth random number sequence, which is a sequence; a step in which the first device transmits to the second device an element sequence obtained by rearranging elements, the element sequence including each random number included in the fifth random number sequence and a secret value obtained by encrypting a value included in a set of attribute values ​​of the first database corresponding to each random number using homomorphic encryption or a predetermined value corresponding to each random number; a step in which the second device generates a combined database using the fourth random number sequence and the element sequence, which associates values ​​included in the set of attribute values ​​of the second database with the secret value or the predetermined value of elements included in the element sequence; and a step in which the second device obtains statistics from the combined database.It is equipped with

[0008] According to the disclosed technique, two databases can be combined while remaining confidential, without using a one-way commutative function, and statistics can be calculated from the combined database.

[0009] FIG. 1 is a diagram illustrating an example of the functional configuration of a statistics calculation system. FIG. 2 is a diagram illustrating an example of a processing procedure of a statistics calculation method. FIG. 3 is a diagram illustrating an example of a processing of statistics calculation. FIG. 4 is a diagram illustrating an example of a processing of statistics calculation. FIG. 5 is a diagram illustrating an example of a processing of statistics calculation. FIG. 6 is a diagram illustrating an example of a processing of statistics calculation. FIG. 7 is a diagram illustrating an example of a processing of statistics calculation. FIG. 8 is a diagram illustrating an example of a processing of statistics calculation. FIG. 9 is a diagram illustrating an example of a processing of statistics calculation. FIG. 10 is a diagram illustrating an example of a processing of statistics calculation. FIG. 11 is a diagram illustrating an example of the functional configuration of a computer. FIG. 12 is a diagram illustrating an example of the functional configuration of a statistics calculation system. FIG. 13 is a diagram illustrating an example of a processing procedure of a statistics calculation method. FIG. 14 is a diagram illustrating an example of a processing of statistics calculation. FIG. 15 is a diagram illustrating an example of a processing of statistics calculation. FIG. 16 is a diagram illustrating an example of a processing of statistics calculation. FIG. 17 is a diagram illustrating an example of a processing of statistics calculation. FIG. 18 is a diagram illustrating an example of the functional configuration of a statistics calculation system. Fig. 19 is a diagram showing an example of the processing procedure of a statistics calculation method. Fig. 20 is a diagram for explaining an example of the processing of statistics calculation. Fig. 21 is a diagram for explaining an example of the processing of statistics calculation. Fig. 22 is a diagram showing an example of the functional configuration of a statistics calculation system. Fig. 23 is a diagram showing an example of the processing procedure of a statistics calculation method. Fig. 24 is a diagram for explaining an example of the processing of statistics calculation. Fig. 25 is a diagram for explaining an example of the processing of statistics calculation.

[0010] Hereinafter, embodiments of the disclosed technology will be described with reference to the drawings. Note that components having the same functions in the drawings are given the same reference numerals, and redundant description will be omitted.

[0011] [Statistics Calculation System and Method] As shown in Fig. 1, the statistics calculation system includes, for example, a first device A and a second device B. Each of the first device A and the second device B is also a statistics calculation device.

[0012] The first device A includes, for example, a feature vector generation unit A1, a first random number sequence generation unit A2, a third random number sequence generation unit A3, a fifth random number sequence generation unit A4, an encryption unit A5, a decryption unit A6, and a transmission unit A7.

[0013] The second device B includes, for example, a second random number sequence generation unit B1, a fourth random number sequence generation unit B2, a combining unit B3, a statistics acquisition unit B4, a noise addition unit B5, and a transmission unit B6.

[0014] The statistical calculation method is realized, for example, by the first device A and the second device B performing the processes from step S1 to step S13 shown in FIG.

[0015] The database held by the first device A is referred to as the first database. The first database is composed of each key and at least one attribute value corresponding to each key. The set of keys in the first database is referred to as the first key set.

[0016] Similarly, the database held by the second device B is a second database. The second database is composed of each key and at least one attribute value corresponding to each key. The set of keys in the second database is a second set of keys.

[0017] In the following, for the sake of simplicity, an example will be described in which there is one attribute value corresponding to each key.

[0018] The symbol "~" used in text should be written directly above the character immediately following it, but due to limitations in text notation, it is written immediately before the character in question. In drawings, these symbols are written in their proper position, i.e., directly above the character. For example, "~X" in text is written as follows in drawings: <Step S1> The first device A and the second device B execute a PC (Permuted Characteristic) protocol using the first key set and the second key set as input, and the first device A obtains a feature vector e indicating whether the π(i)th key in the second key set is included in the first key set (Step S1).

[0019] π is a permutation. For example, π is a random permutation. π(i) is the value of i permuted by the permutation π.

[0020] The process of step S1 is carried out between the feature vector generation unit A1 of the first device A and the second device B. As a result, the feature vector generation unit A1 of the first device A obtains the feature vector e.

[0021] The PC protocol is a set X = {x1,...,x n} and the set Y={y1,...,y n}, the sender and the receiver keep their inputs hidden from each other, and the sender and the receiver use the permutation π and the feature vector e = (e1, ..., e n ) (where, for i∈{1,...,n}, x π(i) When is included in Y, e i =1, x π(i) When is not included in Y, e i = 0) as output.

[0022] As shown in the example in Figure 3, the first key set ID A ={1,3,5,7}, and the second key set ID B ={3,4,6,7}, and the second key set ID B The set in which the i-th element of is placed in the π(i)th position is ~ID B ={4,7,3,6}. In this case, for example, the feature vector e={0,1,1,0}. Note that the dashed-dotted box BB1 in FIG. 3 indicates that the correspondence is not visible.

[0023] <Step S2> The first device A and the second device B execute an OPRF (Oblivious Pseudo Random Function) protocol using the first key set as input, and the first device A obtains a first random number sequence, which is a sequence of random numbers related to the first key set (step S2). The processing of step S1 is performed between the first random number sequence generation unit A2 of the first device A and the second device B. As a result, the first random number sequence generation unit A2 of the first device A obtains the first random number sequence.

[0024] The OPRF protocol is based on a sender with no input and a set Y = {y1,...,y n}, the sender calculates a key SK of a random pseudo-random function f as the output while hiding each other's input, and the receiver calculates the pseudo-random function values ​​f(SK,y1), ..., f(SK,y n ) as output.

[0025] As shown in the example in Figure 4, the first key set ID A ={1,3,5,7}. In this case, for example, the first random number sequence H1(ID A ) = {H1(1),H1(3),H1(5),H1(7)}. H1 is the SK obtained as an output by the second device B, which is the sender in the definition of the OPRF protocol above. B H1 is a pseudorandom function f determined by the following equation: H1 is, for example, a hash function.

[0026] <Step S3> The second device B obtains a second random number sequence, which is a sequence of random numbers related to the second key set, using a pseudorandom function determined by the OPRF protocol executed to obtain the first random number sequence (step S3).

[0027] The process of step S3 is performed by the second random number sequence generation unit B1 of the second device B. That is, the second random number sequence generation unit B1 of the second device B obtains the second random number sequence.

[0028] ID B ={3,4,6,7}, as in the example of Figure 4, the second random number sequence H1(~ID B ) = {H1(4),H1(7),H1(3),H1(6)}. In this example, ID B~ID replaced by substitution π B As in this example, a second random number sequence may be obtained by further using the permutation π.

[0029] For example, the second random number sequence generation unit B1 of the second device B generates the SK B H1 is calculated using a pseudorandom function f determined by:

[0030] <Step S4> The first device A and the second device B execute an OT (Oblivious Transfer) protocol using as input the second random number sequence and a set of numbers of elements in the feature vector e that indicate that they are not included as keys in the first database, and the first device A obtains a third random number sequence composed of random numbers of numbers included in the set of numbers from among the random numbers included in the second random number sequence (step S4).

[0031] The process of step S4 is carried out between the third random number sequence generation unit A3 of the first device A and the second device B. As a result, the third random number sequence generation unit A3 of the first device A obtains the third random number sequence.

[0032] For example, if the feature vector e={0,1,1,0}, the number set will be {1,4}. In this case, as shown in the example of FIG. 5, the third random number sequence H1(~ID B )={H1(4),⊥,⊥,H1(6)}, where ⊥ is a predetermined dummy value. The dummy value is, for example, a random value.

[0033] The OT protocol is a set X = {x1,...,x n} and a receiver with a set S ⊆ {1,...,n}, each input is hidden. The sender does not get any information, and the receiver gets {x i} i∈S It is a protocol that calculates as output.

[0034] <Step S5> The first device A and the second device B execute the OPRF protocol using the second random number sequence as input, and the second device obtains a fourth random number sequence, which is a sequence of random numbers related to the second random number sequence (step S5).

[0035] The process of step S5 is carried out between the fourth random number sequence generation unit B2 of the second device B and the first device A. As a result, the fourth random number sequence generation unit B2 of the second device B obtains a fourth random number sequence.

[0036] Second random number sequence H1(~ID B )={H1(4),H1(7),H1(3),H1(6)}, as in the example of FIG. 6, the fourth random number sequence H2(H1(~ID B )) = {H2(H1(4)),H2(H1(7)),H2(H1(3)),H2(H1(6))}. H2 is the SK obtained as an output by the first device A, which is the sender in the definition of the OPRF protocol. A H2 is a pseudorandom function f determined by the following equation: H2 is, for example, a hash function.

[0037] <Step S6> The first device A obtains a fifth random number sequence, which is a sequence of random numbers obtained by perturbing the random numbers included in the first random number sequence and the random numbers included in the third random number sequence using a pseudo-random function determined by the OPRF protocol executed to obtain the fourth random number sequence (step S6).

[0038] The process of step S6 is performed by the fifth random number sequence generation unit A4 of the first device A. That is, the fifth random number sequence generation unit A4 of the first device A obtains the fifth random number sequence.

[0039] First random number sequence H1(ID A ) = {H1(1),H1(3),H1(5),H1(7)}, and the third random number sequence H1(~ID B )={H1(4),⊥,⊥,H1(6)}, as in the example of FIG. 6, the fifth random number sequence H2(H1(ID U ) = {H2(H1(1)), ..., H2(H1(7)), H2(H1(4)), H2(H1(6))}. As in this example, the third random number sequence H1(~ID B The dummy value ⊥ in the fifth random number sequence may not be randomized or inserted into the fifth random number sequence. For example, the fifth random number sequence generation unit A4 of the first device A may generate the fifth random number sequence SK obtained in step S5. A The calculation of H2 is performed using a pseudorandom function f determined by the following equation: The calculation of H2 is an example of randomization performed by the fifth random number sequence generation unit A4 of the first device A.

[0040] <Step S7> The first device A transmits to the second device B a sequence of elements obtained by rearranging elements including each random number included in the fifth random number sequence and a secret value obtained by encrypting a value included in the set of attribute values ​​in the first database corresponding to each random number using homomorphic encryption or a predetermined value corresponding to each random number (step S7).

[0041] The process of step S7 is performed by the encryption unit A5 of the first device A.

[0042] The rearrangement is performed, for example, randomly.

[0043] In the example of FIG. 7 , attribute a is a categorical attribute, and its attribute value is one of α, β, and γ. Furthermore, the attribute value of attribute a corresponding to H2(H1(1)) is γ, ..., the attribute value of attribute a corresponding to H2(H1(7)) is β. In this case, the encryption unit A5 sets the attribute value of attribute a corresponding to H2(H1(1)) to (E(0),E(0),E(1)), ..., the attribute value of attribute a corresponding to H2(H1(7)) to (E(0),E(1),E(0)). In this way, the encryption unit A5 may convert each attribute value into a one-hot vector and then encrypt each element of the converted one-hot vector. E indicates encryption using homomorphic encryption. Since H2(H1(4)) and H2(H1(6)) are derived from the second database, the encryption unit A5 assigns predetermined values ​​(E(0), E(0), E(0)) to H2(H1(4)) and H2(H1(6)), respectively. In this case, the element sequence sent to the second device B is, for example, as shown in SE1 in FIG. 7. In the element sequence SE1, the fifth random number sequence H2(H1(ID U The part between H2(H1(1)) and H2(H1(7)) in

[0044] If the attribute is a numerical attribute rather than a categorical attribute, the encryption unit A5 may directly encrypt the numerical value, which is the attribute value, using homomorphic encryption.

[0045] <Step S8> The second device B uses the fourth random number sequence and the element sequence to generate a combined database in which values ​​included in the set of attribute values ​​of the second database correspond to secret values ​​or predetermined values ​​of elements included in the element sequence (step S8).

[0046] The process of step S8 is performed by the combining unit B3 of the second device B. For example, the combined database is generated using the fourth random number sequence and the random number H2(H1(ID)) included in the element sequence as a combining key.

[0047] In the example of Figure 7, attribute b is a categorical attribute, and its attribute value is either # or $. Also, in the second database, the attribute value of attribute b corresponding to H2(H1(4)) is #, the attribute value of attribute b corresponding to H2(H1(7)) is $, the attribute value of attribute b corresponding to H2(H1(3)) is #, and the attribute value of attribute b corresponding to H2(H1(6)) is $. In this case, the combined database generated by the combining unit B3 will be, for example, DB1 in Figure 7.

[0048] <Step S9> The second device B obtains statistics from the combined database (step S9).

[0049] The processing of step S9 is performed by the statistics acquisition unit B4 of the second device B. Because the attribute value of attribute a is encrypted using homomorphic encryption, the statistics acquisition unit B4 can obtain statistics of the attribute value of attribute a in its encrypted state without decrypting it.

[0050] Examples of statistics include the mean, median, mode, variance, and standard deviation calculated from attribute values, although other predetermined statistics may be calculated.

[0051] The statistics may be the results of the counting. In other words, the statistics acquisition unit B4 may perform the counting from the combined database.

[0052] In the example of Fig. 8, the statistics acquisition unit B4 tally up the frequencies of the attribute values ​​of attribute a and attribute b, thereby obtaining a tally table SS1 in Fig. 8.

[0053] <Step S10> The second device B adds noise to the calculated statistics (step S10).

[0054] The process of step S10 is performed by the noise adding unit B5 of the second device B.

[0055] The noise addition is what is called privacy noise addition. For example, the noise addition can be performed by the existing techniques described in References 1 and 2.

[0056] [Reference 1] Kii Masanori, "Secure Sampling for Differential Privacy Using Small Tables", CSS2022 [Reference 2] Kii Masanori, Ichikawa Atsutake, Senda Koji, Hamada Hiroki, "A Non-Interactive Two-Party Protocol for Generating Encrypted Discrete Scattered Numbers for Differentially Private Secure Computation", 186th Multimedia Communications and Distributed Processing / 92nd Computer Security Joint Research Symposium, (2021) Noise addition may be performed using the method described in Reference 3 below.

[0057] [Reference 3] Masanobu Kii, Atsunori Ichikawa, Takayuki Miura, "Lightweight Two-Party Secure Sampling Protocol for Differential Privacy", Proceedings on Privacy Enhancing Technologies, 2025. The noise addition described below may also be performed using the methods described in References 1 to 3.

[0058] When the summary table SS1 of FIG. 8 is obtained as a statistic in the process of step S9, the summary table SS2 after noise is added is obtained as a statistic by the process of the noise adding section B5, as shown in FIG.

[0059] <Step S11> The second device B transmits the statistics to which noise has been added to the first device A (step S11).

[0060] The processing of step S11 is performed by the transmitting unit B6 of the second device B.

[0061] <Step S12> The first device A decodes the statistics to which noise has been added, received from the second device B (step S12).

[0062] The process of step S12 is performed by the decoding unit A6 of the first device A.

[0063] The decryption unit A6 performs decryption using, for example, a decryption key corresponding to the homomorphic encryption used in the process of step S7.

[0064] When the summary table SS2 of FIG. 9 is obtained as statistics with noise added in the process of step S11, a decoded summary table SS3 is obtained by the process of the decoding unit A6 as shown in FIG.

[0065] <Step S13> The first device A transmits the decoded statistics to the second device B (step S13).

[0066] The process of step S13 is performed by the transmitting unit A7 of the first device A.

[0067] This allows the second device B to obtain the same statistics as the first device A.

[0068] In this way, instead of using a one-way commutative function, an obscured pseudorandom function (OPRF) is used to generate the join key (H2(H1(ID)) in the above example). An OPRF is a one-way function that allows one party to obtain the output value of a function while keeping the function it holds secret from the other party and the input value it holds secret from the other party. By performing this twice, with the roles swapped, the ID can be converted into a join key without revealing it to the other party. In addition, because OPRF does not involve power operations and most of the work can be performed using lightweight matrix operations, the computational costs of generating a join database and calculating statistics can be reduced compared to conventional methods.

[0069] [[When there are multiple second devices B]] There may be multiple second devices B. For example, as shown in Fig. 12, there may be N second devices B1, ..., BN, where N is a predetermined integer equal to or greater than 2. Fig. 13 shows an example of processing in this case.

[0070] Each of the second devices B1, ..., BN is the second device B illustrated in Fig. 1. As indicated by the dashed line in Fig. 1, each of the second devices B1, ..., BN may further include a processing unit B7.

[0071] The first device A and each of the second devices B1, ..., BN perform the processing from step S1 to step S9 described above, and the second device Bn obtains the statistical quantity A x Bn, where n = 1, ..., N (steps S1 to S9).

[0072] For example, as shown in FIG. 14, assume that a first device A has a database DA. Also, assume that a second device Bn has a database DBn, where n = 1, ..., N. In this case, the first device A and the second devices B1, ..., BN each perform the processes of steps S1 to S9, and the second devices B1, ..., BN obtain statistics A x B1, ..., A x BN, respectively. Where n = 1, ..., N, the statistics A x Bn are the aggregation results obtained from the combined database A-Bn of the first device A and the second device Bn. Note that the databases, combined databases, and aggregation results shown in FIG. 14 are actually encrypted.

[0073] For n' = 1, ..., N-2, the second device Bn' transmits statistics to the second device Bn'+1, the second device Bn'+1 integrates the received statistics with the statistics A × Bn'+1, and the integrated statistics is the statistics to be transmitted to the second device Bn'+2. Then, the second device BN-1 transmits statistics to the second device BN, integrates the received statistics with the statistics A × BN, and transmits the integrated statistics to the first device A (step S21).

[0074] For example, as shown in FIG. 15 , the second device B1 transmits its own statistic A×B1 to the second device B2. The second device B2 then integrates the received statistic A×B1 and statistic A×B2. In this example, integration is a process in which statistics, which are the aggregation results, are added together. The integration process is performed in an encrypted state. The second device B2 transmits the integrated statistic to the second device B3. The second devices B3, ..., BN-1 sequentially perform the same process. The second device BN integrates the statistic received from the second device BN-1 with the statistic A×BN, and transmits the integrated statistic to the first device A.

[0075] The first device A decodes the received statistics (step S22).

[0076] The first device A transmits the decoded statistics to the second devices B1, . . . , BN (step S23).

[0077] For example, the process of step S21 is performed by the processing unit B7 and the transmission unit B6 shown by the dashed lines in Fig. 1. For example, the process of step S22 is performed by the decoding unit A6, and the process of step S23 is performed by the transmission unit A7.

[0078] In addition, when adding noise to statistics, the second device B1 may add noise as shown in Fig. 16. In this case, the second device B1 adds noise to its own statistics A x B1 and transmits the noise-added statistics to the second device B2. The subsequent processing is the same as described above.

[0079] It is sufficient that at least one of the second devices B1, ..., BN integrates the statistics A x B1, ..., A x BN. In this case, the integrated amount is transmitted to the first device A. An example of the integration process is a process in which the statistics, which are the aggregation results, are summed. The subsequent process is the same as described above.

[0080] For example, one of the second devices B1, ..., BN may integrate the statistics A x B1, ..., A x BN. In this case, the other second devices transmit their own statistics to the second device that performs the integration. In the example of FIG. 17, the second device B1 performs the integration process. The second device that performs the integration integrates the received statistics and transmits the integrated statistics to the first device A. An example of the integration process is a process in which the statistics that are the aggregation results are added up. The subsequent process is the same as above.

[0081] [[When there are multiple first devices A]] There may be multiple first devices A. For example, as shown in Fig. 18, there may be K first devices A1, ..., AK, where K is a predetermined integer equal to or greater than 2. Fig. 19 shows an example of processing in this case.

[0082] Each of the first devices A1, . . . , AK is the first device A illustrated in FIG.

[0083] Each of the first devices A1, ..., AK and the second device B perform the processing of steps S1 to S9 described above, and the second device B obtains K statistics A1 x B, ..., AK x B (steps S1 to S9).

[0084] For example, as shown in FIG. 20, let us say that a first device Ak has a database DAk, where k = 1, ..., K. Let us also say that a second device B has a database DB. In this case, the first devices A1, ..., AK and the second device B each perform the processes of steps S1 to S9, and the second device B obtains statistics A1 x B, ..., AK x B. With k = 1, ..., K, the statistics Ak x B are the aggregation results obtained from the combined database Ak-B of the first device Ak and the second device B. Note that the databases, combined databases, and aggregation results shown in FIG. 20 are actually encrypted.

[0085] The second device B aggregates the K statistics A1×B, ..., AK×B, encrypts the aggregated statistics, and transmits the encrypted statistics to each of the K first devices A1, ..., AK (step S21).

[0086] Each of the K first devices A1, . . . , AK decodes the received statistics (step S22).

[0087] At least one of the K first devices A1, . . . , AK may transmit the decoded statistics to a second device B (step S23).

[0088] For example, the process of step S21 is performed by the processing unit B7 and the transmission unit B6 shown by the dashed lines in Fig. 1. For example, the process of step S22 is performed by the decoding unit A6, and the process of step S23 is performed by the transmission unit A7.

[0089] Note that when adding noise to statistics, this is done after the second device B integrates the K statistics A1×B, ..., AK×B. In this case, the second device B encrypts the noise-added statistics and transmits the encrypted statistics to each of the K first devices A1, ..., AK. Subsequent processing is the same as above.

[0090] 21 , the statistic obtained by integrating K statistics A1×B, ..., AK×B is expressed as statistic A×B. The second device B encrypts the statistic A×B and transmits the encrypted statistic to each of the K first devices A1, ..., AK. When adding noise, the second device B adds noise to the statistic A×B.

[0091] [[When there are multiple first devices A and multiple second devices B]] There may be multiple first devices A and multiple second devices B. For example, as shown in Figure 22, there may be K first devices A1, ..., AK, where K is a predetermined integer greater than or equal to 2. Furthermore, there may be N second devices B1, ..., BN, where N is a predetermined integer greater than or equal to 2. Figure 23 shows an example of processing in this case.

[0092] Each of the first devices A1, . . . , AK is the first device A illustrated in FIG.

[0093] Each of the second devices B1, ..., BN is the second device B illustrated in Fig. 1. As indicated by the dashed line in Fig. 1, each of the second devices B1, ..., BN may further include a processing unit B7.

[0094] For k = 1, ..., K, the first device Ak and each of the second devices B1, ..., BN perform the processing from step S1 to step S9 described above, and the N second devices B1, ..., BN each obtain statistics Ak × B1, ..., Ak × BN (steps S1 to S9).

[0095] Also, for k = 1, ..., K, n' = 1, ..., N-2, the second device Bn' transmits statistics to the second device Bn'+1, integrates the statistics received by the second device Bn'+1 with the statistics Ak × Bn'+1, and defines the integrated statistics as the statistics to be transmitted to the second device n'+2; the second device BN-1 transmits statistics to the second device BN, integrates the statistics received by the second device BN with the statistics Ak × BN, and defines the integrated statistics as the statistics Ak (step S211).

[0096] For example, as shown in Fig. 24, suppose that a first device Ak has a database DAk, where k = 1, ..., K. Also, suppose that a second device Bn has a database DBn, where n = 1, ..., N.

[0097] In this case, first, the first device A1 and the second devices B1, ..., BN each perform the processes of steps S1 to S9 to obtain statistics A1 x B1, ..., A1 x BN. Where n = 1, ..., N, the statistics A1 x Bn are the aggregated results obtained from the combined database A1-B of the first device A1 and the second device Bn. The second devices B1, ..., BN obtain statistics A1 by integrating the statistics A1 x B1, ..., A1 x BN through a process similar to that described in [[When there are multiple second devices B]]. This statistics A1 is finally generated by device BN and is therefore stored in device BN.

[0098] The processes of steps S1 to S9 and the process of obtaining integrated statistics are similarly performed for each of the other first devices A2, ..., AN. As a result, statistics A2, ..., AN are obtained. These statistics A2, ..., AN are ultimately generated by device BN and are therefore stored in device BN.

[0099] It should be noted that the database and the counting results shown in FIG. 24 are actually encrypted.

[0100] The second device BN aggregates the K statistics A1, ..., AK and transmits the aggregated statistics to each of the K first devices A1, ..., AK (step S212).

[0101] Each of the K first devices A1, . . . , AK decodes the received statistics (step S22).

[0102] At least one of the K first devices A1, . . . , AK may transmit the decoded statistics to a second device B (step S23).

[0103] For example, the processes of steps S211 and S212 are performed by a processing unit B7 and a transmission unit B6, which are indicated by dashed lines in Fig. 1. For example, the process of step S22 is performed by a decoding unit A6, and the process of step S23 is performed by a transmission unit A7.

[0104] Note that when adding noise to statistics, this is done after the second device BN integrates the K statistics A1, ..., AK. In this case, the second device BN encrypts the statistics to which noise has been added and transmits the encrypted statistics to each of the K first devices A1, ..., AK. Subsequent processing is the same as described above.

[0105] 25, the statistic obtained by integrating K statistics A1, ..., AK is expressed as statistic A × B. The second device NB encrypts the statistic A × B and transmits the encrypted statistic to each of the K first devices A1, ..., AK. When adding noise, the second device B adds noise to the statistic A × B.

[0106] [Modifications] The specific configurations of the embodiments of the disclosed technology are not limited to the configurations described above. The specific configurations of the embodiments of the disclosed technology can be appropriately modified in design, etc., within the scope of the spirit of the embodiments of the disclosed technology.

[0107] The various processes described in the embodiments of the disclosed technology may not only be performed chronologically in the order described, but may also be performed in parallel or individually depending on the processing capacity of the device performing the processes or as needed.

[0108] For example, the order of the processing in step S1 and the processing in step S2 may be reversed.

[0109] In addition, at least one of the processes from step S10 to step S13 may not be performed. In this case, the first device A may not include at least one of the decoding unit A6 and the transmission unit A7. In addition, the second device B may not include at least one of the statistics acquisition unit B4, the noise addition unit B5, and the transmission unit B6.

[0110] Data may be exchanged directly between the components of the first device A and the second device B, or may be exchanged via a storage unit (not shown).

[0111] Furthermore, a device (terminal) for using the device, system, or method of the present invention via a network (telecommunications line) may also be provided. The "device (terminal) for use" may be provided with functions (e.g., control function, decoding function, restoration function, input / output function, etc.) necessary to obtain the effects of implementing the device, system, or method of the present invention.

[0112] It goes without saying that other modifications are possible without departing from the spirit of the present invention.

[0113] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference.

[0114] [Program, Recording Medium] The functions realized by the components described in this specification may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), CPUs (Central Processing Units), conventional circuits, and / or combinations thereof, programmed to realize the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may also be a programmed processor that executes a program stored in a memory.

[0115] In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions.

[0116] If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0117] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 11 and operating the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc.

[0118] The program describing the processing contents can be recorded on a computer-readable recording medium, which may be, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or any other suitable recording medium.

[0119] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0120] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. Furthermore, the server computer may execute the process at the terminal using a so-called SaaS (Software as a Service) service, which allows users to use part of a server computer along with the program. In this embodiment, the program includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that dictate computer processing).

[0121] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

Claims

1. A database held by a first device is a first database, a key set of the first database is a first key set, a database held by a second device is a second database, a key set of the second database is a second key set, π is a permutation, the first device and the second device execute a PC (Permuted Characteristic) protocol using the first key set and the second key set as input, and the first device obtains a feature vector indicating whether the π(i)th key of the second key set is included in the first key set; the first device and the second device execute an OPRF (Oblivious Pseudo Random Function) protocol using the first key set as input, and the first device obtains a first random number sequence that is a sequence of random numbers related to the first key set; and the second device obtains a second random number sequence that is a sequence of random numbers related to the second key set using a pseudorandom function determined by the OPRF protocol executed to obtain the first random number sequence. a step in which the first device and the second device execute an OT (Oblivious Transfer) protocol using as input the second random number sequence and a set of numbers of elements in the feature vector that indicate that they are not included as keys in the first database, and the first device obtains a third random number sequence consisting of random numbers included in the second random number sequence that are included in the set of numbers; a step in which the first device and the second device execute an OPRF protocol using as input the second random number sequence, and the second device obtains a fourth random number sequence that is a sequence of random numbers related to the second random number sequence; and a step in which the first device obtains a fifth random number sequence that is a sequence of random numbers obtained by randomizing the random numbers included in the first random number sequence and the random numbers included in the third random number sequence using a pseudo-random function determined by the OPRF protocol executed to obtain the fourth random number sequence. a step in which the first device transmits to the second device a sequence of elements obtained by rearranging elements including each random number included in the fifth random number sequence and a secret value obtained by encrypting a value included in a set of attribute values ​​of the first database corresponding to each random number using homomorphic encryption or a predetermined value corresponding to each random number;a step by the second device of generating a combined database using the fourth random number sequence and the element sequence, in which values ​​included in a set of attribute values ​​of the second database correspond to secret values ​​or predetermined values ​​of elements included in the element sequence; and a step by the second device of obtaining statistics from the combined database.

2. The method of claim 1, further comprising the step of said second device adding noise to said calculated statistics.

3. The method of calculating statistics according to claim 2, further comprising the steps of: the second device transmitting the statistics to which noise has been added to the first device; and the first device decoding the statistics to which noise has been added.

4. A statistical calculation system including a first device and a second device, wherein the database held by the first device is a first database, a key set of the first database is a first key set, the database held by the second device is a second database, a key set of the second database is a second key set, π is a permutation, the first device and the second device execute a PC (Permuted Characteristic) protocol using the first key set and the second key set as input, and the first device obtains a feature vector indicating whether the π(i)th key of the second key set is included in the first key set, the first device and the second device execute an OPRF (Oblivious PseudoRandom Function) protocol using the first key set as input, and the first device obtains a first random number sequence that is a sequence of random numbers related to the first key set, and the second device obtains a second random number sequence that is a sequence of random numbers related to the second key set using a pseudorandom function determined by the OPRF protocol executed to obtain the first random number sequence, The first device and the second device execute an OT (Oblivious Transfer) protocol using as input the second random number sequence and a set of numbers of elements in the feature vector that indicate that they are not included as keys in the first database, so that the first device obtains a third random number sequence consisting of random numbers included in the second random number sequence that are included in the set of numbers; the first device and the second device execute an OPRF protocol using the second random number sequence as input, so that the second device obtains a fourth random number sequence that is a sequence of random numbers related to the second random number sequence; the first device obtains a fifth random number sequence that is a sequence of random numbers obtained by randomizing the random numbers included in the first random number sequence and the random numbers included in the third random number sequence using a pseudo-random function determined by the OPRF protocol executed to obtain the fourth random number sequence; a step in which the first device transmits to the second device a sequence of elements obtained by rearranging elements including each random number included in the fifth random number sequence and a secret value obtained by encrypting a value included in a set of attribute values ​​of the first database corresponding to each random number using homomorphic encryption or a predetermined value corresponding to each random number;the second device uses the fourth random number sequence and the element sequence to generate a combined database in which values ​​included in a set of attribute values ​​of the second database correspond to secret values ​​or predetermined values ​​of elements included in the element sequence, and the second device obtains statistics from the combined database.

5. A database held by a first device is a first database, a key set of the first database is a first key set, a database held by a second device is a second database, a key set of the second database is a second key set, π is a permutation, a vector indicating whether the π(i)th key of the second key set is included in the first key set, which is obtained by the first device and the second device executing a PC (Permuted Characteristic) protocol using the first key set and the second key set as input, is a feature vector, a sequence of random numbers related to the first key set, which is obtained by the first device and the second device executing an OPRF (Oblivious PseudoRandom Function) protocol using the first key set as input, is a first random number sequence, a second random number sequence generation unit that obtains a second random number sequence that is a sequence of random numbers related to the second key set using a pseudorandom function determined by the OPRF protocol executed to obtain the first random number sequence, a fourth random number sequence generation unit that executes an OPRF protocol together with the first device using the second random number sequence as input to obtain a fourth random number sequence that is a sequence of random numbers related to the second random number sequence, by using the second random number sequence and a set of numbers of elements in the feature vector that indicate that the elements are not included as keys in the first database; a fifth random number sequence that is a sequence of random numbers obtained by the first device shuffling the random numbers included in the first random number sequence and the third random number sequence using a pseudo-random function determined by the OPRF protocol executed to obtain the fourth random number sequence; and a first device transmits to the second device an element sequence obtained by rearranging elements including each random number included in the fifth random number sequence and a secret value obtained by encrypting a value included in a set of attribute values ​​in the first database corresponding to each random number using homomorphic encryption or a predetermined value corresponding to each random number.a combining unit that uses the fourth random number sequence and the element sequence to generate a combined database in which values ​​included in a set of attribute values ​​of the second database correspond to secret values ​​or predetermined values ​​of elements included in the element sequence; and a statistics obtaining unit that obtains statistics from the combined database.

6. A database held by a first device is a first database, a key set of the first database is a first key set, a database held by a second device is a second database, a key set of the second database is a second key set, π is a permutation, a vector indicating whether the π(i)th key of the second key set is included in the first key set, which is obtained by the first device and the second device executing a PC (Permuted Characteristic) protocol using the first key set and the second key set as input, is a feature vector, a sequence of random numbers related to the first key set, which is obtained by the first device and the second device executing an OPRF (Oblivious PseudoRandom Function) protocol using the first key set as input, is a first random number sequence, a second random number generation step of obtaining a second random number sequence which is a sequence of random numbers related to the second key set, using a pseudorandom function determined by the OPRF protocol executed to obtain the first random number sequence; a fourth random number generation step of executing an OPRF protocol together with the first device using the second random number sequence as input to obtain a fourth random number sequence that is a sequence of random numbers related to the second random number sequence, by using the second random number sequence and a set of numbers of elements in the feature vector that indicate that the elements are not included as keys in the first database; a fifth random number sequence, a sequence of random numbers obtained by the first device shuffling the random numbers included in the first random number sequence and the random numbers included in the third random number sequence using a pseudo-random function determined by the OPRF protocol executed to obtain the fourth random number sequence; and a first device transmitting to the second device an element sequence obtained by rearranging elements including each random number included in the fifth random number sequence and a secret value obtained by encrypting a value included in a set of attribute values ​​in the first database corresponding to each random number using homomorphic encryption or a predetermined value corresponding to each random number.a combining step of generating a combined database in which values ​​included in a set of attribute values ​​of the second database correspond to secret values ​​or predetermined values ​​of elements included in the element sequence using the fourth random number sequence and the element sequence; and a statistics obtaining step of obtaining statistics from the combined database.

7. A program for causing a computer to execute each step of the statistical quantity acquisition method of claim 6.

8. A statistics calculation method, where N is a predetermined integer equal to or greater than 1, comprising the steps of claim 1, where first device A is the first device and each of N second devices B1, ..., BN is a second device, and includes the steps of: a step in which second device Bn obtains statistics A x Bn, where n = 1, ..., N, by performing the processing of each step of the statistics calculation method of claim 1; a step in which second device Bn' transmits statistics to second device Bn'+1, where n' = 1, ..., N-2, and second device Bn'+1 integrates the received statistics with statistics A x Bn'+1, and transmits the integrated statistics to second device Bn'+2, and second device BN-1 transmits statistics to second device BN, and second device BN integrates the received statistics with statistics A x BN, and transmits the integrated statistics to first device A; and a step in which first device A decodes the received statistics.

9. A statistics calculation method comprising the steps of: a step in which K is a predetermined integer equal to or greater than 2, and K first devices A1, ..., AK are designated as first devices, and a second device B is designated as a second device, whereby the second device B obtains K statistics A1 x B, ..., AK x B by processing each step of the statistics calculation method of claim 1; a step in which the second device B integrates the K statistics A1 x B, ..., AK x B, encrypts the integrated statistics, and transmits the encrypted statistics to each of the K first devices A1, ..., AK; and a step in which each of the K first devices A1, ..., AK decrypts the received statistics.

10. A step in which K is a predetermined integer of 2 or more, N is a predetermined integer of 2 or more, k=1,...,K, where a first device Ak is the first device and each of N second devices B1,...,BN is a second device, and N second devices B1,...,BN perform processing of each step of the statistical quantity calculation method of claim 1 to obtain statistical quantities Ak×B1,...,Ak×BN, respectively; a step in which k=1,...,K,n'=1,...,N-2, where a second device Bn' transmits statistical quantities to a second device Bn'+1, integrates the received statistical quantities with the statistical quantities Ak×Bn'+1, and defines the integrated statistical quantities as the statistical quantities to be transmitted to a second device n'+2, and a step in which a second device BN-1 transmits statistical quantities to a second device BN, integrates the received statistical quantities with the statistical quantities Ak×BN, and defines the integrated statistical quantities as the statistical quantities Ak; A method for calculating statistics, comprising: a step in which a second device (BN) aggregates K statistics A1, ..., AK and transmits the aggregated statistics to each of the K first devices A1, ..., AK; and a step in which each of the K first devices A1, ..., AK decodes the received statistics.

Images