Secure computation system, secure computation device, and secure computation method

Abstract

Provided are a secure computation system and the like capable of efficiently performing secure computation without acquiring an unnecessary lock. This secure computation system includes a plurality of secure computation devices. Some or all of the plurality of computation devices acquire a shared lock of a reference database, some or all of the plurality of secure computation devices read data from the reference database, some or all of the plurality of secure computation devices release the shared lock, at least some of the secure computation devices which have read the data from the reference database cooperatively perform secure computation on the basis of the read data to acquire a secure computation result, all of the plurality of secure computation devices cooperatively perform secret regeneration using the secure computation result, all of the plurality of secure computation devices acquire an exclusive lock of an update database, all of the plurality of secure computation devices store the secure computation result in the update database, and all of the plurality of secure computation devices release the exclusive lock.

Description

Secure computation system, secure computation device, and secure computation method

[0001] The present invention relates to a secure computation technology for storing secretly shared data and performing secure computation.

[0002] Non-Patent Document 1 is known as a prior art secure computation technique.

[0003] In general cryptography, even if data to be kept secret is encrypted and stored on a server, the value must be decrypted before calculations can be performed. However, secure computing technology allows calculations to be performed on data while it remains encrypted.

[0004] The secure computation system in Non-Patent Document 1 introduces a multi-party protocol in which one numerical value is converted into multiple encrypted shares, N secure computing devices each have a share, and each secure computing device performs addition, multiplication, logical operations, etc. without leaking information about its own share.

[0005] First, an overview of processing in a typical client / server system will be explained.

[0006] In a typical client / server system, exclusive control of a database (hereinafter also referred to as "DB") is performed to prevent the database from becoming inconsistent due to simultaneous requests from multiple clients.

[0007] In a typical system, when trying to achieve exclusive control of a database in a series of steps that involves reading data from the database and storing the calculation results, the flow is as follows:

[0008] S10) The server accepts a request from the client.

[0009] S11) The server that receives the request acquires a lock on the target resource (DB).

[0010] S12) The server that receives the request reads the necessary data from reference table A.

[0011] S13) The server that received the request performs the calculation according to the request.

[0012] S14) The server that received the request stores the calculation result in update table B and updates the data.

[0013] S15) The server that receives the request releases the lock.

[0014] S16) The server that accepted the request sends the processing result to the client.

[0015] Here, when acquiring a lock on the target resource (DB) in S11, it is advisable to acquire a shared lock for table A and an exclusive lock for table B. Note that exclusive locks and shared locks have in common the fact that they prohibit changes from other transactions, but they differ in the following ways. An exclusive lock is a lock for modifying data, and limits the number of transactions that can update data to one, so it can only be acquired by a single transaction. On the other hand, a shared lock is a lock that indicates that the data is being read, and can be acquired by multiple transactions.

[0016] Next, an outline of the processing in a conventional secure computing system will be described. Fig. 1 is a diagram for explaining an outline of the processing in a conventional secure computing system.

[0017] Let us assume that a conventional secure computation system is a client / server system consisting of N servers 90-n and multiple clients 80, where n = 1, 2, ..., N. In a (k,N) secret sharing system, if there are k shares out of N shares, the original value can be restored. Let us assume that N shares are distributed to N servers 90-n. In this case, the number of servers 90-n participating in the secure computation varies depending on the analysis algorithm, and ranges from k to N.

[0018] The secure computation result may be returned to the client and restored, or may be stored in the DB of the server 90-n. When the secure computation result is stored in the DB of the server 90-n, there are N servers 90-n as storage destinations.

[0019] When performing secure computation on M machines (k≦M<N) to achieve exclusive control of a DB, the flow is as follows. In Figure 1, k=M=3, N=4.

[0020] S20) N servers 90-n accept requests from clients.

[0021] S21) N servers 90-n acquire the lock on the target resource.

[0022] S22) M servers 90-n ｍ reads the necessary data from the lookup table A. Note that m=1, 2, ..., M, and n m is the index of the server that performs the secure computation, and n m is one of 1, 2, ..., N, and m' is one of 1, 2, ..., M, and when m ≠ m', then n m ≠n m' Let's say.

[0023] S23) M servers 90-n ｍ performs secret computations on requests.

[0024] S24) N servers 90-n are M servers 90-n ｍ The secret calculation result is secretly reproduced in N servers 90-n.

[0025] S25) The N servers 90-n store the calculation results in update table B and update the data.

[0026] S26) The N servers 90-n release the lock.

[0027] S27) The N servers 90-n transmit the processing results to the client.

[0028] Dai Igarashi and Koji Senda, "Fast Implementation of Secret Sharing Schemes Scalable to Multi-Party Computation," in SCIS, 2013.

[0029] However, in the prior art, P servers 90-n ｐ Although S22) does not refer to data, an unnecessary lock is acquired in S21). However, P=NM, p=1,2,...,P, and n p is the index of the server that does not perform secure computation, and n p is 1, 2, …, N, and n m ≠n pLet p' be 1, 2, ..., P, and when p ≠ p', then n p ≠n p' Let's say.

[0030] In addition, secure computation generally takes a long time to process and does not complete in a short time like normal DB transaction processing, so taking a long lock period significantly reduces system throughput.

[0031] An object of the present invention is to provide a secure computation system, a secure computation device, and a secure computation method that can perform secure computation efficiently without acquiring unnecessary locks.

[0032] In order to solve the above problem, according to one aspect of the present invention, a secure computing system includes a plurality of secure computing devices, wherein some or all of the plurality of secure computing devices acquire a shared lock on a reference database, some or all of the plurality of secure computing devices read data from the reference database, some or all of the plurality of secure computing devices release the shared lock, at least some of the secure computing devices that read data from the reference database cooperatively perform secure computation based on the read data and obtain a secure computation result, all of the plurality of secure computing devices cooperatively perform secret reproduction using the secure computation result, all of the plurality of secure computing devices acquire an exclusive lock on an update database, all of the plurality of secure computing devices store the secure computation result in the update database, and all of the plurality of secure computing devices release the exclusive lock.

[0033] According to the present invention, an effect is achieved in that unnecessary locks are not acquired.

[0034] Fig. 1 is a diagram for explaining an overview of processing in a conventional secure computation system. Fig. 2 is a configuration diagram of a secure computation system according to a first embodiment. Fig. 3 is a diagram showing an example of a processing flow of the secure computation system according to the first embodiment. Fig. 4 is a functional block diagram of a secure computation device according to the first embodiment. Fig. 5 is a diagram showing an example of the configuration of a computer to which the present method is applied.

[0035] Hereinafter, an embodiment of the present invention will be described. In the drawings used in the following description, components having the same functions and steps performing the same processes are denoted by the same reference numerals, and redundant description will be omitted.

[0036] <Key Points of First Embodiment> In this embodiment, the problem is solved by the following procedure.

[0037] In conventional technology, exclusive control is achieved by performing an exclusive lock from data reference (S21 in FIG. 1) to data storage (S25 in FIG. 1). Note that the time period in which an exclusive lock is performed is also called an exclusive lock period, and the time period in which a shared lock is performed is also called a shared lock period.

[0038] In this embodiment, the locks for reading data from the DB and writing calculation results are separated, and no lock is applied during secure computation, thereby shortening the lock period compared to conventional methods. To perform (k,N) secret sharing processing, M server devices that reference data acquire shared locks and set up shared lock intervals, while N server devices that write data acquire exclusive locks and set up exclusive lock intervals. In other words, the lock interval is divided into a shared lock interval for data reference and an exclusive lock interval for data update.

[0039] Furthermore, in this embodiment, by releasing the shared lock before secure computation, even if the secure computation takes a long time to process, the lock can be acquired from other transactions, preventing a decrease in throughput.

[0040] Furthermore, since there is a possibility that unexpected changes may be made to the DB between the release of the shared lock and the acquisition of the exclusive lock, the prerequisites are rechecked immediately before the exclusive lock section.

[0041] For example, split the lock as follows:

[0042] S1) M servers acquire a shared lock on the target resource.

[0043] S2) M servers read the necessary data from reference table A.

[0044] S3) M servers release the shared lock.

[0045] S4) M servers perform secure computations in response to requests. No database access is performed.

[0046] S5) N servers secretly regenerate the secret key on N servers based on the secret calculation results of M servers.

[0047] S6) N servers acquire exclusive locks on the target resource.

[0048] S7) N servers store the calculation results in update table B and update the data.

[0049] S8) N servers release the exclusive lock.

[0050] First Embodiment FIG. 2 is a diagram showing the configuration of a secure computing system according to a first embodiment, and FIG. 3 shows the processing flow thereof.

[0051] The secure computing system includes N server devices 100-n and one or more client devices 200, and the N server devices 100-n and the one or more client devices 200 are communicatively connected via a network.

[0052] Each of the N server devices 100-n receives a request from one of the client devices 200 operated by a user, performs secure computation, and outputs the processing result to the client device 200 that sent the request. The server device 100-n is also referred to as a secure computation device based on the processing content. The content of the secure computation is not particularly limited, but in this embodiment, a case where it is applied to a decision tree will be described. Note that a decision tree is a machine learning technique that finds clusters of data in which specific characteristics frequently appear, and generates classification rules for them.

[0053] The server device 100-n is a special device configured by loading a special program into a publicly known or dedicated computer having, for example, a central processing unit (CPU), a main memory (RAM), etc. The server device 100-n executes each process under the control of, for example, the central processing unit. Data input to the server device 100-n and data obtained from each process are stored, for example, in the main memory, and the data stored in the main memory is read by the central processing unit as needed and used for other processes. At least a portion of each processing unit of the server device 100-n may be configured with hardware such as an integrated circuit. Each storage unit of the server device 100-n may be configured with, for example, a main storage unit such as RAM (Random Access Memory), or middleware such as a relational database or key-value store. However, each storage unit does not necessarily have to be provided internally by the server device 100-n; it may be configured with an auxiliary storage unit configured with a hard disk, optical disk, or semiconductor memory element such as flash memory, and be configured external to the server device 100-n.

[0054] FIG. 4 is a functional block diagram of the server device 100-n.

[0055] The server device 100-n includes a first privacy analysis unit 110, a second privacy analysis unit 120, a data reference unit 140, a data storage unit 150, a control unit 160, a communication unit 170, a lock acquisition unit 180, a lock release unit 190, and a secret sharing value memory unit 195.

[0056] The processing of each unit will be described below according to the processing flow of FIG.

[0057] <Sending a Request (S30)> The client device 200 sends a request to N server devices 100-n, and the N server devices 100-n accept the request from the client device 200 via the communication unit 170. The request includes the request content and, if necessary, parameters, training data, and the like. For example, the request includes a request to execute a decision tree, parameters, and training data. The parameters include the explanatory variable table name, the objective variable table name, each parameter of the decision tree (maximum tree depth, tree type (classification tree, regression tree)), and a training model ID that identifies the created decision tree. The explanatory variables and objective variables are assumed to be secretly shared in advance and stored in a reference table A in the secret sharing value storage unit 195 of the N server devices 100-n. Each parameter is received in plain text.

[0058] The control unit 160 of the server device 100-n checks whether the specified learning model ID is appropriate. For example, if another learning model has already been stored for the learning model ID, the control unit 160 of the server device 100-n determines that this is an error and halts the execution of the decision tree. However, this is just one example of processing, and the control unit 160 may be designed to update and overwrite the stored learning model instead of determining that this is an error.

[0059] <Shared Lock Acquisition (S31)> M server devices 100-n that perform secure computation (for example, the (k,N) secret sharing scheme) ｍ The lock acquisition unit 180 acquires a shared lock for the target resource (for example, reference table A) according to the request content. ｍ It is optimal to acquire shared locks on all N machines, but it is not necessary to acquire M shared locks; it is also possible to acquire shared locks on all N machines. Note that in conventional technology, exclusive locks are acquired on all N machines, which differs from the configuration in which shared locks are acquired on all N machines.

[0060] When executing the decision tree, M server devices 100-n ｍ The lock acquisition unit 180 acquires a shared lock for the explanatory variable and objective variable table.ｍ Therefore, it is possible to obtain a consistent secret sharing value between the two parties.

[0061] <Data Reference (S32)> M server devices 100-n ｍ The data reference unit 140 reads out the necessary data according to the request content from the target resource (for example, reference table A).

[0062] When executing the decision tree, M server devices 100-n ｍ The data reference unit 140 reads out the secret shared explanatory variables and objective variables from the DB (explanatory variable and objective variable table) and stores the read out secret shared values ​​in the on-memory. ｍ Whether to refer to data (S32) and perform secure computation (S34) described later is specified by the client device 200 or defined within the N server devices 100-n.

[0063] <Releasing the shared lock (S33)> M server devices 100-n ｍ The lock release unit 190 releases the shared lock acquired in S31.

[0064] <Secure computation (S34)> M server devices 100-n ｍ The first privacy analysis unit 110 cooperates with the data reference unit 140 to perform secure computation according to the request content based on the data read by the data reference unit 140, and obtains the share S(n m , [a]). At this time, the first privacy analysis unit 110 performs processing based on the read data and does not access the DB (explanatory variable, objective variable table). Note that the share S(n, [a]) means the share that the server device 100-n has when secretly sharing the plaintext a.

[0065] When executing the decision tree, M server devices 100-n ｍ The first privacy analysis unit 110 performs secret computation on the decision tree to obtain a secret-shared learning model. For the secure computation of the decision tree, for example, reference 1 is used.

[0066] (Reference 1) Hiroki Hamada, "Efficient Decision Tree Learning Algorithm Using Secure Computation," Computer Security Symposium 2020, 26-29 October 2020, pp. 1126-1133. The first privacy analysis unit 110 calculates a decision tree by secure computation using the on-memory secretly shared explanatory variables, objective variables, and parameters specified by the client device 200. Note that although a decision tree is used as an example here, the secure computation to be performed may be any type as long as it does not involve access to a database.

[0067] <Secure computation (S35)> The second privacy analysis unit 120 of the N server devices 100-n computes M shares S(n m ,[a]), they collaborate to perform confidential regeneration to obtain N shares S(n,[a]). Note that confidential regeneration is a method for reconstructing lost shares from a certain number of shares included in the remaining shares without losing confidentiality.

[0068] The M server devices 100-n that performed the secure computation in S34) above ｍ The server devices that are not included in the server device 100-n and are included only in the N server devices 100-n are referred to as server devices 100-n. p,new and the server device 100-n p,new The share held by S(n p,new ,[a]). M shares S(n m The secret regeneration protocol to create a new secret sharing value from (S(n 1,new ,[a]),S(n 2,new ,[a]),…,S(n P,new ,[a]))=createShare(S(n1,[a]),S(n2,[a]),…,S(n M ,[a]),flags) where flags is a flag string corresponding to each server device, and the server device 100-n ｍ The server device 100-n outputs a bit corresponding to p,newThe createShare can be realized by using existing technology, for example, the method described in Reference 2.

[0069] (Reference Document 2) Japanese Patent Application Publication No. 2016-173534 <Exclusive Lock Acquisition (S36)> The lock acquisition unit 180 of each of the N server devices 100-n acquires an exclusive lock on the target resource (update table B) in accordance with the request content. Note that a configuration may be adopted in which the prerequisites are rechecked before the exclusive lock acquisition (S36) is performed. In this case, the control unit 160 of each server device 100-n controls the lock acquisition unit 180 to acquire an exclusive lock on the target resource (update table B) if the target resource (update table B) has not been updated by another transaction between the release of the shared lock (S33) and the acquisition of the exclusive lock (S36). If the target resource (update table B) has been updated, the control unit 160 aborts processing.

[0070] When executing a decision tree, the control unit 160 of the server device 100-n rechecks whether the learning model ID is appropriate. For example, when a request is sent (S30), there is no problem when checking once, but because the processing time of the secure computation (S34) is long, there is a possibility that other learning has been performed and saved using the same learning model ID during that time. By rechecking at this point, it is possible to respond to updates that occurred during the unlocked period. If other learning has been performed and another learning model has been stored, the control unit 160 of the server device 100-n determines this to be an error and stops updating the target resource (update table B). If it is confirmed that no other learning is being performed, the control unit 160 of the server device 100-n acquires an exclusive lock on the table that stores the learning model.

[0071] <Data Storage (S37)> The data storage unit 150 of the N server devices 100-n stores and updates the calculation results in update table B in the secret sharing value storage unit 195. When executing a decision tree, a learning model is stored in a model table. For example, hyperparameters and the decision tree that is the learning result are stored in the table. Hyperparameters are stored as plaintext data, such as the tree type, tree depth, number of records, and number of classes. The learning result decision tree consists of a list of each layer of the tree, and for each record of the explanatory variables and objective variables, (i) a flag indicating which node in the binary tree it belongs to, (ii) node type (leaf, category, numeric value, etc.), (iii) node label, (iv) ID of the explanatory variable to be split, (v) value of the explanatory variable to be split, etc. are stored in secret shared form.

[0072] <Exclusive Lock Release (S38)> The lock release unit 190 of each of the N server devices 100-n releases the lock.

[0073] <Transmission of results (S39)> The N server devices 100-n transmit the processing results to the client device 200 via the communication unit 170. When executing a decision tree, for example, the N server devices 100-n can transmit, as the processing results, information indicating that the execution of the decision tree was successful or information indicating that some kind of error occurred.

[0074] <Effects> The above configuration enables efficient secure computation without acquiring unnecessary locks.

[0075] <Modifications> Furthermore, a device (terminal) for using the device of the present invention, the system of the present invention, or the method of the present invention via a network (telecommunications line) may also be included. The "device (terminal) for use" may be equipped with functions (e.g., control function, decryption function, restoration function, input / output function, etc.) necessary to obtain the effects of implementing the device of the present invention, the system of the present invention, or the method of the present invention. Note that a configuration including a device (terminal) for using the device of the present invention or the method of the present invention via a network (telecommunications line) is also referred to as a secure computing system.

[0076] <Hardware, Programs, and Recording Media> The functions realized by the components described in this specification may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), a CPU (a Central Processing Unit), conventional circuits, and / or combinations thereof, programmed to realize the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may also be a programmed processor that executes a program stored in a memory.

[0077] In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions.

[0078] If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0079] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 5, and operating the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc.

[0080] The program describing the processing contents can be recorded on a computer-readable recording medium, which may be, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or any other suitable recording medium.

[0081] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0082] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. Furthermore, the server computer may execute the process at the terminal using a so-called SaaS (Software as a Service) service, which allows users to use part of a server computer along with the program. In this embodiment, the program includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that dictate computer processing).

[0083] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0084] <Other Modifications> The present invention is not limited to the above-described embodiments and modifications. For example, the various processes described above may not only be executed in chronological order as described, but may also be executed in parallel or individually depending on the processing capacity of the device that executes the processes or as needed. Other modifications are possible as long as they do not deviate from the spirit of the present invention.

Claims

1. A secure computing system including a plurality of secure computing devices, wherein some or all of the plurality of secure computing devices acquire a shared lock on a reference database, some or all of the plurality of secure computing devices read data from the reference database, some or all of the plurality of secure computing devices release the shared lock, at least some of the secure computing devices that read the data from the reference database cooperate to perform secure computation based on the read data and obtain a secure computation result, all of the plurality of secure computing devices cooperate to perform secret reproduction using the secure computation result, all of the plurality of secure computing devices acquire an exclusive lock on an update database, all of the plurality of secure computing devices store the secure computation result in the update database, and all of the plurality of secure computing devices release the exclusive lock.

2. A secure computing device included in a secure computing system, comprising: a lock acquisition unit, a data reference unit, a lock release unit, a first privacy analysis unit, a second privacy analysis unit, and a data storage unit; wherein the lock acquisition unit acquires a shared lock of a reference database together with other secure computing devices included in the secure computing system; the data reference unit reads data from the reference database; the lock release unit releases the shared lock together with the other secure computing devices included in the secure computing system; the first privacy analysis unit performs secure computation in cooperation with at least some of the other secure computing devices that read the data from the reference database based on the read data and acquires a secure computation result; the second privacy analysis unit performs secure reproduction in cooperation with all other secure computing devices included in the secure computing system using the secure computation result and the secure computation result acquired by some of the other secure computing devices; the lock acquisition unit acquires an exclusive lock of an update database together with all other secure computing devices; The secure computing device, wherein the data storage unit stores a secure computation result of the secure computing device in the update database, and the lock release unit releases the exclusive lock.

3. A secure computing device according to claim 2, further comprising a control unit that controls the lock acquisition unit to acquire an exclusive lock on the update database if the update database has not been updated by another transaction between the time the shared lock is released and the time the exclusive lock is acquired.

4. A secure computation method using a plurality of secure computing devices, comprising: a shared lock acquisition step in which some or all of the plurality of secure computing devices acquire a shared lock for a reference database; a data reference step in which some or all of the plurality of secure computing devices read data from the reference database; a shared lock release step in which some or all of the plurality of secure computing devices release the shared lock; a first secure computation step in which at least some of the secure computing devices that have read the data from the reference database cooperate to perform secure computation based on the read data and obtain a secure computation result; a second secure computation step in which all of the plurality of secure computing devices cooperate to perform secret reproduction using the secure computation result; an exclusive lock acquisition step in which all of the plurality of secure computing devices acquire an exclusive lock for an update database; a data storage step in which all of the plurality of secure computing devices store the secure computation result in the update database; and an exclusive lock release step in which all of the plurality of secure computing devices release the exclusive lock.

Images