Computation processing device

Abstract

According to the present invention, a computation processing device for a calculation system that comprises memory, storage, and the computation processing device comprises a computation unit that reads each key of a set of data for secret-shared key-value pairs from the memory and the storage, uses a pseudo-random function to calculate a hash value for each key, calculates a substitution on the basis of the resulting series of hash values, uses the substitution to construct a hash table from the set of data as extracted from the memory and the storage, and uses secret sharing to store the hash table at the memory and the storage.

Description

Processing Unit

[0001] The present invention relates to a method for improving security by applying Oblivious RAM (hereinafter referred to as ORAM) to an example of a distributed computing model.

[0002] Recently, a next-generation computer architecture called disaggregated computing has been attracting attention. Disaggregated computing is a concept that simulates a huge computer by treating each resource (CPU, GPU, FPGA, memory, storage, etc.) of a general computer (such as a server) as an independent resource specialized for each function and communicating with each other over a high-speed network, rather than consolidating all resources into a single machine. This enables distributed computing across multiple locations with greater flexibility and computational efficiency than conventional distributed computing environments that consist of a network of multiple independent machines.

[0003] The computational model that forms the basis of disaggregated computing is an architecture called the Memory Centric Model (Non-Patent Document 1). Unlike conventional computer architectures in which all processing and information transmission is controlled primarily by the CPU, this method places memory at the center of processing, reducing the time required for data transfer and reducing the load on the CPU, thereby improving computation speed.

[0004] In the Memory Centric Model, memory plays a larger role than in conventional computing environments, which raises concerns that side-channel attacks against memory may become more effective. For example, side-channel attacks that can extract machine learning models are known (Non-Patent Document 3). Even in disaggregated computing, there is a possibility that processing content and data may be leaked from the machine or site responsible for memory.

[0005] Anteneh Gebregiorgis, Hoang Anh Du Nguyen, Jintao Yu, Rajendra Bishnoi, Mottaqiallah Taouil, Francky Catthoor, and Said Hamdioui, "A Survey on Memory-Centric Computer Architectures," Association for Computing Machinery, vol.18, 2022.Oded Goldreich and Rafail Ostrovsky, "Software Protection and Simulation on Oblivious RAMs," J. ACM, vol.43, 1996. Ziyu Wang, Fan-hsuan Meng, Yongmo Park, Jason K. Eshraghian, Wei D. Lu, "Side-Channel Attack Analysis on In-Memory Computing Architectures," IEEE Transactions on Emerging Topics in Computing, 2023.

[0006] ORAM is one of the solutions to side-channel attacks. However, conventional ORAM does not provide a technique to conceal access patterns from attackers in a computing system with multiple participants with different roles (e.g., processing unit, memory, storage).

[0007] The present invention has been made in consideration of the above points, and aims to provide a technology that makes it possible to conceal access patterns from attackers in a computing system in which there are multiple participants with different roles.

[0008] According to the disclosed technology, there is provided a processing device in a computing system comprising a memory, a storage, and a processing device, the processing device comprising an operation unit that reads each key in a set of secretly shared key-value pair data from the memory and the storage, calculates a hash value for each key using a pseudo-random function, calculates a permutation based on a sequence of the obtained hash values, constructs a hash table from the set of data retrieved from the memory and the storage using the permutation, and stores the hash table in the memory and the storage in a secretly shared manner.

[0009] The disclosed technology provides a technology that enables concealing access patterns from attackers in a computing system in which multiple participants with different roles exist.

[0010] 1 is a diagram showing a terminal configuration comprising a CPU, a GPU, and a memory. FIG. 2 is a diagram showing a terminal configuration comprising a CPU, a GPU, and a memory. FIG. 3 is a diagram showing a configuration of a computing system in an embodiment of the present invention. FIG. 4 is a diagram showing a configuration of an arithmetic processing unit (arithmetic processing device). FIG. 5 is a diagram showing a hash table. FIG. 6 is a flowchart of Example 1. FIG. 7 is a flowchart of Example 2. FIG. 8 is a flowchart of Example 3. FIG. 9 is a flowchart of Example 4. FIG. 10 is a flowchart of Example 5. FIG. 11 is a flowchart of Example 6. FIG. 12 is a diagram showing an example of a hardware configuration of a device.

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0012] Below, we will first explain in more detail the prior art and its problems, and then explain the technology according to this embodiment using Examples 1 to 7. In the following explanation, references are indicated by numbers such as [1], and the names of the documents corresponding to the numbers are listed at the end of the specification.

[0013] (Regarding Prior Art) As mentioned above, the computational model that forms the basis of disaggregated computing is an architecture called the Memory Centric Model (Reference [2], Non-Patent Document 1). Unlike conventional computer architectures in which all processing and information transmission is controlled primarily by the CPU, this is a method of improving computation speed by placing memory at the center of processing, reducing the time required for data transfer and reducing the load on the CPU.

[0014] For example, in a terminal configuration consisting of a CPU / GPU / memory as shown in Figure 1, in a conventional CPU-centric architecture, even when executing a calculation using the GPU, the CPU first obtains a program instruction related to data transfer from memory (S1 in Figure 1), and then performs processing to transfer the data in memory to the GPU based on this instruction (S2). In this way, in a conventional CPU-centric architecture, the CPU was responsible for controlling all program instructions.

[0015] In contrast, in the Memory Centric Model, memory is the entity that controls these transfer commands, and as shown in Figure 2, for example, program commands that use the GPU are sent directly to the GPU without going through the CPU, thereby reducing the load on the CPU.

[0016] Disaggregated computing requires an architecture that does not require CPU control for data processing in order to maximize the benefits of distributing each function. The Memory Centric Model is a technology that can adequately meet this requirement. However, because memory plays a larger role in the Memory Centric Model than in conventional computing environments, there are concerns that side-channel attacks against memory may be more effective. For example, side-channel attacks that can extract machine learning models are known (Reference [6], Non-Patent Document 3). Even in disaggregated computing, there is a possibility that processing content and data may be leaked from the machine or site responsible for memory.

[0017] ORAM is one solution to these problems. ORAM is an algorithm that allows a client, the owner of data, to securely access a storage server that stores the data, and is realized, for example, by the method shown in Reference [3] (Non-Patent Document 2). One application of ORAM is to counter side-channel attacks by concealing access patterns. This is because ORAM is originally a secure computing technology that safely simulates a computational model called a RAM (Random Access Machine) and allows RAM program execution between a client and a server.

[0018] RAM is a computer model that can be said to be the basis of the CPU-centric architecture mentioned above, in which the CPU that executes instructions (programs) accesses the memory that holds the instructions as appropriate to read and write data and execute instructions.

[0019] ORAM replaces the CPU with the client (the data owner / program executor) and the memory with the server (the data recipient), and uses an algorithm that conceals access patterns to make the data read / write locations appear random to an attacker (server), while still ensuring that the client can correctly load the desired data. This property of concealing access patterns can be used not only in client-server bilateral protocols, but also in data transfers between the CPU and memory on a single computer, making it a countermeasure against side-channel attacks.

[0020] (Regarding the Problem) In this embodiment, the purpose is to realize a technology for concealing access patterns from attackers by applying ORAM in a computing system consisting of three types of participants (processing unit, memory, and storage) described below. This technology makes it possible to realize countermeasures against the side channel attacks described above. Note that the number of types of participants is three is an example. There may be four or more types of participants, including the above three types of participants.

[0021] (Outline of the embodiment) In this embodiment, in a Memory Centric Model different from conventional ORAM, the confidentiality of data and access patterns in a distributed computing model is realized in a form adapted to cases where participants have different roles, in particular. Not only the access patterns of data but also the contents of memory and storage cannot be known.

[0022] (Configuration example of computing system) Fig. 3 shows a configuration example of a computing system in this embodiment. As shown in Fig. 3, this computing system has a processing unit 100, a memory 200, and a storage 300. In this computing system, communication is possible between the processing unit 100 and the memory 200, and between the processing unit 100 and the storage 300. Communication may also be possible between the memory 200 and the storage 300. The functions of each component are as follows.

[0023] The processing unit 100 is a functional unit that has a role corresponding to a CPU, a GPU, etc. In this embodiment, the processing unit 100 is considered to be a participant that can view data in plaintext (i.e., a trusted participant that cannot be an attacker) according to the standard ORAM model.

[0024] The memory 200 is a functional unit whose main role is to store data. The memory 200 can be an attacker who spies on access patterns and data. In the Memory Centric Model, the memory 200 is also given a lightweight computing capability, so in this embodiment, it is assumed that simple calculations can be performed by the memory 200 as well.

[0025] The storage 300 is a main pool of data. In this embodiment, the storage 300 is assumed to be a participant that can become an attacker, just like the memory 200, but is also assumed not to collude with the memory 200. The storage 300 does not have computing power and can only read and write data.

[0026] The processing unit 100, memory 200, and storage 300 may be independent devices, or the processing unit 100, memory 200, and storage 300 may be provided in one device. Also, any two of the processing unit 100, memory 200, and storage 300 may be provided in one device, and the remaining one may be provided in another device.

[0027] The arithmetic processing unit 100 may also be referred to as an arithmetic processing device 100. Fig. 4 shows an example of the configuration of the arithmetic processing unit 100 (arithmetic processing device 100). As shown in Fig. 4, the arithmetic processing unit 100 (arithmetic processing device 100) has an arithmetic unit 110. In each embodiment described below, the processing of the arithmetic processing unit 100 (arithmetic processing device 100) is executed by the arithmetic unit 110.

[0028] Below, an algorithm (processing procedure) that allows the processing unit 100 to flexibly manipulate data in a state where the data is distributed between the memory 200 and the storage 300 will be described.

[0029] (Preparation) First, the (n, n)-additive secret sharing scheme, pseudorandom function, and hash table used in the algorithm will be explained.

[0030] <(n,n)-additive secret sharing scheme> The (n,n)-additive secret sharing scheme is ｐ The secret value s∈Z above ｐ n random values ​​s １ , ..., s ｎ ∈Z ｐ Σ ｎ ｉ＝１ s ｉ = s (i.e., s ｉ is selected so that the sum of (n, n) is s), and the value is kept secret by distributing it among n participants. A secure computation method that realizes secret addition and multiplication based on an additive secret sharing scheme is known as prior art (Reference [4]). Note that in this embodiment, the (n, n)-additive secret sharing scheme is used as the secret sharing scheme, but this is not limiting, and secret sharing schemes other than the (n, n)-additive secret sharing scheme may also be used.

[0031] <Pseudorandom Function> A pseudorandom function (PRF) is a function that takes a key s and a value k as input and obtains an output that is so random that it is difficult to distinguish it from a uniform random number. Hash functions and block ciphers are generally known as instances of pseudorandom functions. Even under secret sharing, it is possible to calculate a PRF while keeping input and output secret, for example, by using the technology disclosed in Reference [1]. In this embodiment, the output from the PRF is called a hash value.

[0032] <Hash Table> A hash table is a data structure for storing and efficiently referencing a large amount of data, and is one of the important components of ORAM. Here, we assume that each piece of data is a key-value pair (k, v), and that the value can be searched for using the key. In a hash table, a hash function (PRF) is applied to key k, and the output value determines where in the table the data is stored. Due to the (pseudo)randomness of the PRF, the storage location of the data appears random regardless of the content of the data. On the other hand, when retrieving data, the determinism of the PRF ensures that the hash value corresponding to key k is uniquely determined, making it easy to search.

[0033] An image of a hash table is shown in Fig. 5. In the example of Fig. 5, data (k, v) is stored at a location (address) indicated by the hash value h(k) of key k. The hash value h(k) here is an example of a value obtained by inputting key s and value k into the PRF.

[0034] The algorithm according to this embodiment will be described below using Examples 1 to 7. Note that any combination of Examples 1 to 7 can be implemented.

[0035] First Embodiment First, a description will be given of a first embodiment. In the first embodiment, a method for constructing a hash table between the processing unit 100, the memory 200, and the storage 300 in the computing system shown in FIG. 3 while concealing access patterns in the memory 200 and the storage 300 will be described.

[0036] Assume that all input data are key-value pairs that have been additively secret shared between memory 200 and storage 300, and the output is a hash table and its PRF key that have also been additively secret shared between memory 200 and storage 300. The hash table is constructed by each party performing the following procedure. The procedure of Example 1 will be described with reference to the flowchart of FIG.

[0037] In S101 (step 101), the processing unit 100 generates a random PRF key s and distributes all secret shared keys k from the memory 200 and the storage 300. ｉ and calculate the corresponding hash value for the key k. ｉ The hash value corresponding to the PRF is ｉ is obtained as an output from the PRF by inputting

[0038] In S102, the processing unit 100 calculates a permutation π for converting (rearranging) the current data order into a hash table based on the string of hash values ​​obtained in S101. The permutation π is a permutation for converting the current data order into the data order in the hash table.

[0039] In S103, the processing unit 100 retrieves all data from the memory 200 and the storage 300, applies the permutation π to construct a hash table, and secretly shares and stores the constructed hash table in the memory 200 and the storage 300 again. At the same time, the key s is also secretly shared and stored in the memory 200 and the storage 300. The permutation π is also a random permutation π. １ , π ２ ;π １ 〇π ２ =π and stored in the memory 200 and the storage 300. For convenience of description, in the text of this specification, the combination of permutations is indicated by "◯". For example, if π is stored in the memory 200, １ and stores π in the storage 300. ２ Save.

[0040] (Example 2) Next, Example 2 will be described. In Example 2, a method for acquiring specified data (desired data) from the hash table constructed in Example 1 will be described. The input in the procedure of Example 2 is a key k of the desired data, and the arithmetic processing unit 100 holds the key k in plaintext. The output is data corresponding to k. The procedure of Example 2 will be described with reference to the flowchart of FIG.

[0041] In S201, the processing unit 100 obtains and restores the secret shared PRF key s from the memory 200 and the storage 300, and inputs s and k to the PRF to obtain the required hash value from the PRF.

[0042] In S202, the processing unit 100 specifies the hash value calculated in S201 to the memory 200 and the storage 300, and retrieves the data stored in the hash table.

[0043] (Example 3) Next, Example 3 will be described. In Example 3, a method for decomposing the hash table constructed in Example 1 and restoring it to the original data string will be described. The input in the procedure of Example 3 is a secret shared hash table, and the output is a data string. The procedure of Example 3 will be described with reference to the flowchart of FIG. 8.

[0044] In S301, the processing unit 100 performs a hash table distribution process using the memory 200 and the storage 300. １ , π ２ are read and restored to plain text.

[0045] In S302, the processing unit 100 adds the inverse permutation π of the permutation π acquired in S301 to the hash table acquired in S301. －１ By multiplying this, the hash table is returned to its original data sequence.

[0046] In S303, the processing unit 100 secretly shares the data string acquired in S302 and stores it in the memory 200 and the storage 300.

[0047] (Fourth Embodiment) Next, a fourth embodiment will be described. In the fourth embodiment, which is an extension of the first embodiment, a method for constructing a hash table without the processor 100 seeing any data other than the data that is truly necessary (i.e., keeping the data secret even from the processor 100) will be described. In the fourth embodiment (and in the fifth and sixth embodiments), the processor 100 also has a computing capacity, and a calculation equivalent to that in the first embodiment is performed by two-party secure calculation between the processor 100 and the memory 200. The procedure of the fourth embodiment will be described with reference to the flowchart in FIG. 9.

[0048] In S401, the processing unit 100 and the memory 200 each generate a random value, and assign this to s １ , s ２ The processing unit 100 also reads out one half of the secret shared key (a set of the other half of the key) from the storage 300. １ , s ２ is the secret s=s １ +s ２ is the value used as the key for the PRF.

[0049] In S402, the processing unit 100 and the memory 200 receive the secret s=s １ +s ２ Based on the secret shared key and the secret computation, a sequence of secret hash values ​​is obtained by performing a secret computation of the PRF. Only these hash values ​​are disclosed to the processing unit 100. In other words, the processing unit 100 obtains only the hash values ​​in plaintext. The processing unit 100 derives a permutation π for rearranging the sequence of hash values. The permutation π is a permutation for converting the current order of hash values ​​(corresponding to the order of data) to the order of hash values ​​in the hash table (corresponding to the order of data).

[0050] In S403, the processing unit 100 applies the permutation π to the set of secretly shared key-value pair data in cooperation with the memory 200 and the storage 300. In this case, the permutation π can be performed without revealing the permutation π to the other party, for example, by using a permutation network (Reference [5]).

[0051] In S404, the processing unit 100 １is stored in the storage 300, and a random permutation π １ , π ２ ;π １ 〇π ２ =π is distributed and stored in the memory 200 and the storage 300.

[0052] Next, a fifth embodiment will be described. In the fifth embodiment, a method of referring to a hash table so that the processing unit 100 looks at only the contents of necessary data will be described, similar to the fourth embodiment. The procedure of the fifth embodiment will be described with reference to the flowchart of FIG.

[0053] In S501, the processing unit 100 receives the secret shared s １ and obtain the key k corresponding to the desired data by random k １ , k ２ ; k １ +k ２ = k, and k ２ is transmitted to the memory 200.

[0054] In S502, the processing unit 100 and the memory 200 calculate a hash value corresponding to s and k by secure computation of the PRF, and the memory 200 restores this value.

[0055] In S503, the memory 200 shares the restored hash value with the storage 300, and the memory 200 and the storage 300 each transmit the data in the hash table corresponding to the hash value to the processing unit 100.

[0056] In S504, the processing unit 100 restores the data received from the memory 200 and the storage 300, respectively, and acquires the desired data.

[0057] Sixth Embodiment Next, a sixth embodiment will be described. In the sixth embodiment, a method in which the processing unit 100 decomposes a hash table without looking at the contents of the data will be described. The procedure of the sixth embodiment will be described with reference to the flowchart in FIG.

[0058] In S601, the processing unit 100 receives the distributed permutation π from the memory 200 and the storage 300. １ , π ２and restore the permutation π.

[0059] In S602, the processing unit 100 applies the inverse permutation π to the (secretly shared) hash tables of the memory 200 and the storage 300. －１ This returns the hash table to the original data string, but the processing unit 100 cannot see the data string.

[0060] (Example 7) Finally, Example 7 will be described. In Example 7, a hierarchical ORAM such as that shown in Reference [3] can be configured by using the hash tables described in Examples 1 to 3 or the hash tables described in Examples 4 to 6.

[0061] As shown in Reference [3], the hierarchical ORAM itself is an existing technology. In Example 7, the hash tables described in Examples 1 to 3 and Examples 4 to 6 can be used as each of the multiple hash tables of different sizes used in the hierarchical ORAM.

[0062] (Hardware Configuration Example) Any of the devices (arithmetic processing unit (arithmetic processing device), memory, storage, etc.) described in this embodiment can be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0063] That is, the device can be realized by executing a program corresponding to the processing performed by the device using hardware resources such as a CPU and memory built into a computer. The program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The program can also be provided via a network such as the Internet or email.

[0064] Fig. 12 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 12 includes a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are interconnected via a bus B. The computer may further include a GPU.

[0065] The program that realizes the processing on the computer is provided by a recording medium 1001, such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0066] The memory device 1003 reads and stores a program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes functions related to the device in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) or the like according to the program. The input device 1007 is composed of a keyboard, mouse, buttons, a touch panel, etc., and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0067] (Summary of the embodiment, effects, etc.) As described above, the technology described in this embodiment makes it possible to conceal access patterns from attackers in a computing system in which multiple participants with different roles exist.

[0068] The following additional notes are provided regarding the above-described embodiments.

[0069] <Additional Notes> (Additional Item 1) The processing device in a computing system comprising a memory, a storage, and a processing device, comprising: a processing unit that reads each key in a set of secretly shared key-value pair data from the memory and the storage, calculates a hash value for each key using a pseudo-random function, calculates a permutation based on a sequence of the obtained hash values, constructs a hash table from the set of data retrieved from the memory and the storage using the permutation, and stores the hash table in the memory and the storage in a secretly shared manner. (Additional Item 2) The processing device according to Additional Item 1, wherein the processing unit obtains and restores the secretly shared key of the pseudo-random function from the memory and the storage, obtains a hash value from the key corresponding to desired data and the key of the pseudo-random function, and obtains the desired data by specifying the hash value to the memory and the storage. (Supplementary Item 3) The processing device in a computing system comprising a memory, a storage, and a processing device, comprising: a processing unit that, together with the memory, executes secure computation of a pseudorandom function to obtain a sequence of hash values ​​for a set of data of key-value pairs that have been secretly shared in the memory and the storage, and calculates a permutation based on the sequence of hash values, and builds a secret shared hash table by applying the permutation to the set of secretly shared data in cooperation with the memory and the storage. (Supplementary Item 4) The processing device according to Supplementary Item 3, wherein the processing unit, together with the memory, executes secure computation of a pseudorandom function to calculate a hash value from a key corresponding to desired data and a key of the pseudorandom function, and the hash value is shared between the memory and the storage, and the processing unit obtains the desired data from data corresponding to the hash value transmitted from the memory and the storage, respectively.

[0070] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims.

[0071] (References) [1] Martin R. Albrecht, Christian Rechberger, Thomas Schneider, Tyge Tiessen, and Michael Zohner, "Ciphers for MPC and FHE," Cryptology ePrint Archive, 2016. [2] Anteneh Gebregiorgis, Hoang Anh Du Nguyen, Jintao Yu, Rajendra Bishnoi, Mottaqiallah Taouil, Francky Catthoor, and Said Hamdioui, "A Survey on Memory-Centric Computer Architectures," Association for Computing Machinery, vol.18, 2022. [3] Oded Goldreich and Rafail Ostrovsky, "Software Protection and Simulation on Oblivious RAMs," J. ACM, vol.43, 1996. [4] Marcel Keller, "MP-SPDZ: A Versatile Framework for Multi-Party Computation," Cryptology ePrint Archive, 2020. [5] Abraham Waksman, "A Permutation Network," J. ACM, vol. 15, 1968. [6] Ziyu Wang, Fan-hsuan Meng, Yongmo Park, Jason K. Eshraghian, Wei D. Lu, "Side-Channel Attack Analysis on In-Memory Computing Architectures," IEEE Transactions on Emerging Topics in Computing, 2023.

[0072] 100 Processing unit / processing device 110 Processing unit 200 Memory 300 Storage 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input device 1008 Output device

Claims

1. A processing unit in a computing system comprising a memory, a storage, and a processing unit, the processing unit comprising: a processing unit that reads each key in a set of secretly shared key-value pair data from the memory and the storage, calculates a hash value for each key using a pseudo-random function, calculates a permutation based on the sequence of the obtained hash values, constructs a hash table from the set of data retrieved from the memory and the storage using the permutation, and stores the hash table in the memory and the storage in a secretly shared manner.

2. The processing device according to claim 1, wherein the calculation unit obtains and restores the secretly shared key of the pseudorandom function from the memory and the storage, obtains a hash value from the key corresponding to desired data and the key of the pseudorandom function, and acquires the desired data by specifying the hash value to the memory and the storage.

3. A processing unit in a computing system comprising a memory, a storage, and a processing unit, the processing unit comprising: a computing unit that, together with the memory, executes a secret calculation of a pseudo-random function to obtain a sequence of hash values ​​for a set of secretly shared key-value pair data in the memory and the storage, calculates a permutation based on the sequence of hash values, and, in cooperation with the memory and the storage, applies the permutation to the set of secretly shared data to construct a secretly shared hash table.

4. The processing device according to claim 3, wherein the calculation unit calculates a hash value from a key corresponding to desired data and a key of the pseudorandom function by performing a secret calculation of a pseudorandom function together with the memory, and the hash value is shared between the memory and the storage, and the calculation unit obtains the desired data from data corresponding to the hash value transmitted from each of the memory and the storage.

Images