Secure computation client device and computation time analysis method

Abstract

This secure computation client device comprises a secure computation client unit, a recording unit, a function expansion unit, and a computation time prediction unit. The recording unit requests predetermined reference processing from the secure computation client unit, and records a reference computation time that is a measurement result of the computation time performed by secure computation for each reference processing. The function expansion unit repeats processing of a designated function until the processing is represented by only the reference processing, and finds the number of times required for the processing for each reference processing. The computation time prediction unit finds a predicted computation time, which is the time required for processing the designated function, on the basis of the number of times required for the processing for each reference processing found by the function expansion unit and the reference computation time.

Description

Secure computation client device and computation time analysis method

[0001] The present invention relates to a secure computation client device for analyzing the computation time of a secure computation system made up of multiple secure computation servers, and a computation time analysis method.

[0002] While the momentum for data utilization using AI and other technologies is growing, demand for privacy protection is also increasing, creating a demand for an environment where highly confidential data can be analyzed using proven AI algorithms in fields such as healthcare. Secure computing AI is a technology that brings together data accumulated by multiple companies and safely utilizes it. It enables the creation of models and inference (data operations in which only the calculation results are visible to anyone) using extremely secure and diverse AI algorithms while keeping data confidential (secret sharing) and never restoring it. Secure computing AI can realize statistical analysis and machine learning services that can be used while keeping data confidential. However, because analysis and other processing are performed without seeing the data, it is extremely inefficient compared to plain text, and to date, there have been no examples of systems that operate under realistic usage conditions (within acceptable computation time). Non-Patent Documents 1 to 3 discuss ways to speed up secure computing.

[0003] Yuki Yoshida, Kunihiko Sadakane, Kazunari Tozawa, "Oblivious Radix Sort with Less Communication," SCIS2023 (2023 Symposium on Cryptography and Information Security, Fukuoka, Japan), January 24-27, 2023. Kibuki Mishina, Hiroki Hamada, Dai Igarashi, Ryo Kikuchi, "MEVAL AI: A Secure Computation AI Library that can Describe Various Machine Learning," SCIS2023 (2023 Symposium on Cryptography and Information Security, Fukuoka, Japan), January 24-27, 2023. Ryoya Kudo, Muhammad Kamal Ahmad Akmal Aminuddin, Keiichi Iwamura, Katsuki Inamura, "Development of a Secure Computation Library and Implementation of Verifiable Secure Computation Methods," of Secure Computation Libraries and Implementation of Verifiable Secure Computation)”, SCIS2023 (2023 Symposium on Cryptography and Information Security Fukuoka, Japan), Jan. 24-27, 2023.

[0004] However, it is difficult to implement secure computation AI in the form of secure computation itself. In other words, to perform complete secure computation, including model type, parameter depth, structural information, and so on, abstracting all learning would require long calculation times, which would impair usability and make it unrealistic. To efficiently calculate with secure computation AI (select optimal calculation conditions), it is desirable to be able to evaluate the computation time of secure computation, but the algorithm is complex, making analytical evaluation of the computation time difficult. Therefore, the present invention aims to provide a more practical method for analyzing computation time than conventional methods.

[0005] The secure computation client device of the present invention comprises a secure computation client unit, a recording unit, a function expansion unit, and a calculation time prediction unit. The secure computation client unit is connected to a secure computation system consisting of one or more secure computation servers, and transmits a share of instruction information to the secure computation system and receives a share of the result. The recording unit requests a predetermined standard process from the secure computation client unit, and records a standard calculation time, which is the result of measuring the calculation time executed by secure computation for each standard process. The function expansion unit repeats the processing of a specified function until it can be expressed only by the standard process, and determines the number of times for each standard process required for the processing. The calculation time prediction unit calculates a predicted calculation time, which is the time required to process the specified function, based on the number of times for each standard process required for the processing determined by the function expansion unit and the standard calculation time.

[0006] According to the secure computation client device of the present invention, the computation time required for the reference processing is calculated using the actually measured reference computation time, and the function for which the computation time is to be calculated is expanded until it can be expressed using only the reference processing, thereby calculating the predicted computation time, thereby enabling more practical analysis of computation time than before.

[0007] A diagram showing an example of the configuration of a secure computation system consisting of multiple secure computation servers connected via a network, and a secure computation client device. A diagram showing the processing flow of a calculation time analysis method in a secure computation client device. A diagram showing the processing flow of an algorithm limitation method in a secure computation client device. A diagram showing an example of the functional configuration of a computer.

[0008] Prior to describing the embodiments, the basic technical concepts used in the present disclosure will be described.

[0009] [Secret Sharing Technology] Secret sharing is a technology that converts data into multiple shares, allowing the original data to be restored using a certain number of shares or more, but making it impossible to restore the original data using shares less than the certain number. (k,n)-secret sharing, a type of secret sharing, divides an input plaintext into n shares, distributes the shares to n computing entities, and allows the plaintext to be restored using any k shares, but no information about the plaintext can be obtained using shares less than k. Here, n and k are integers greater than or equal to 1, and n≧k. A typical example of (k,n)-secret sharing is Shamir secret sharing, described in "A. Shamir, "How to share a secret," Communications of the ACM, Volume 22, Issue 11, pp. 612-613, 1979 (Reference 1)." The secret sharing used in this disclosure may be any method that can utilize secure computation, as described below.

[0010] [Secure computation technology] Secure computation is a technology in which data to be computed is secretly shared and stored among multiple computing entities, and the computing entities cooperate with each other to compute the shared values ​​of a function of the original data without restoring the original data.Secure computation uses secret sharing as an elemental technology.

[0011] The secure computation used in the first embodiment of the present disclosure may be one that allows various computations required for desired data processing to be performed on shared values ​​obtained by a specific secret sharing method. A secure computation technique that performs basic computations such as addition and multiplication on secret shared values ​​is described, for example, in "Koji Senda, Hiroki Hamada, Dai Igarashi, and Katsumi Takahashi, 'Rethinking Lightly Verifiable Three-Party Secure Function Computation,' Computer Security Symposium 2010, 2010 (Reference 2)." A secret matching technique that searches for information from secret shared values ​​of a data string while keeping it secret is described, for example, in "Koji Senda, Masayuki Terada, Takayasu Yamaguchi, Dai Igarashi, Hiroki Hamada, and Katsumi Takahashi, 'Secure Matching Protocol Considering Statistical Disclosure Control,' Information Processing Society of Japan Research Report, 2011-CSEC-52(12), 2011 (Reference 3)." A secret sorting technique for sorting a data string while keeping the secret sharing values ​​of the data string secret is described, for example, in "Hiroki Hamada, Dai Igarashi, Koji Senda, Katsumi Takahashi, "Linear Time Sorting on Secure Function Computation," Computer Security Symposium 2011, 2011 (Reference 4)."

[0012] Hereinafter, embodiments of the present invention will be described in detail. Components having the same functions are given the same numbers, and duplicated explanations will be omitted. First embodiment

[0013] FIG. 1 shows an example of the configuration of a secure computation system and a secure computation client device, which are composed of multiple secure computation servers connected via a network. FIG. 2 shows the processing flow of a calculation time analysis method in the secure computation client device. FIG. 3 shows the processing flow of an algorithm restriction method in the secure computation client device. The secure computation system 10 is composed of X secure computation servers 100-1, ..., X. X may be, for example, 3 or more, but may be any number greater than or equal to 1 as long as the method allows for secure computation, as described below. Existing technologies can be used for the secure computation system 10 (such as the technology disclosed in WO2012 / 046692 (U.S. Patent US8,989,391B2 of the same family) (Reference 5)). For example, when X = 3, one piece of data is converted into three shares, and the three secure computation servers 100-1, 100-2, and 100-3 each record one share. Two shares are required to restore the data. In the secure computation system 10, calculations can be performed while maintaining the data in a secretly shared state (anonymous state), and the results are also recorded in anonymized form as shares of the results in each secure computation server 100-x. If the results are statistics, the statistics can be known by obtaining and restoring two or more shares, but the confidentiality of the original data can be maintained.

[0014] The secure computation client device 200 includes a secure computation client unit 210, a recording unit 290, a function expansion unit 240, a calculation time prediction unit 250, an actual measurement unit 260, an AutoML unit 220, and a communication unit 280. The communication unit 280 may be connected to a user device 300. In this case, encryption technology may be used for communication between the communication unit 280 and the user device 300. The recording unit 290 records records used for training the AI ​​model. Each record is composed of data of multiple attributes. The attributes include, for example, age, gender, basic medical information (such as the values ​​of blood components), and disease name.

[0015] The secure computation client unit 210 is connected to a secure computation system consisting of multiple secure computation servers 100-1, ..., X, and includes a secret sharing unit 211 and a restoration unit 212. The secure computation client unit 210 transmits shares to the secure computation system 10 and receives shares from the secure computation system 10. Here, "transmitting shares to the secure computation system 10" means transmitting shares corresponding to each secure computation server 100-x, and "receiving shares from the secure computation system 10" means receiving shares recorded by each secure computation server 100-x. In other words, the secret sharing unit 211 converts records, instruction information, etc. into multiple shares and transmits the shares corresponding to each secure computation server 100-x. The instruction information is information such as which attribute to use for machine learning of the AI ​​model. The restoration unit 212 receives shares of the calculation results and shares of the evaluation value in the secure computation system 10, and acquires the plaintext calculation results and the evaluation value.

[0016] The secret sharing unit 211 converts a record to be used for machine learning of the AI ​​model into a plurality of shares in advance and transmits the corresponding shares to each secure computation server 100-x. Each secure computation server 100-x records the shares of attribute data that make up the record.

[0017] The measurement unit 260 requests the secure computation client unit 210 to perform a predetermined reference process, and measures the computation time executed by the secure computation for each reference process. The measured reference computation time is recorded in the recording unit 290 (S260). The reference process may include addition, constant multiplication, and multiplication executed in secure computation. Other processes may also be included.

[0018] The user or the secure computation client device 200 extracts functions used in the machine learning algorithm and specifies the functions to the function expansion unit 240 (S241). The function expansion unit 240 repeatedly expands the function until the processing of the specified function can be expressed using only reference processing, and calculates the number of times each reference processing is required for the processing (S242). Here, the concept of "function expansion" is explained. Reference processing (processing such as addition, constant multiplication, and multiplication executed in a pre-set secure computation) is defined as level 0. A secure computation function consisting only of reference processing is defined as level 1. A function consisting of levels 0 to (i-1) is defined as level i. Function expansion means expressing a level i function with a function including level (i-1). By repeating function expansion, all functions can be expressed using level 0 processing. Then, the number of times each level 0 reference processing is calculated. For example, N additions, M constant multiplications, and L multiplications are obtained. Addition, constant multiplication, and multiplication are shown as reference processing. The reference processing may include processing that cannot be expanded.

[0019] Note that when the processing of level i is expanded, intermediate functions that are functions used intermediately may appear multiple times. Therefore, the function expansion unit 240 may record the intermediate functions that are functions used intermediately and the number of times for each reference process required to process the intermediate functions in association with each other. This eliminates the need to repeatedly expand the same function that is used intermediately.

[0020] The calculation time prediction unit 250 calculates the predicted calculation time, which is the time required to process a specified function, based on the number of reference operations required for the processing calculated by the function expansion unit 240 and the reference calculation time (S250). For example, for level 0 calculations (addition, constant multiplication, and multiplication), the actual measurement unit 260 acquires data on the reference calculation time, which is a constant value (e.g., 1 millisecond per addition). Taking addition (level 0) and summation (level 1) as an example, the calculation time is the number of operations (length(x)), where the sum (sum(x)) is the data size and is a variable. In other words, the calculation cost is the number of operations, and the calculation time can be evaluated by counting these and substituting the reference calculation time (sum(x)) for the level 0 operation. Furthermore, the level i function (sum(x)) outputs the result (return r) of the level 0 operation (addition r+ = x[i]) for the number of operations (length(x)). Therefore, by counting the number of additions, it can be predicted that the calculation will take "length(x) × 1 millisecond." Here, the sum function is expressed in the programming language "C" as sum(x) { r=0; for (i = 0; i < length(x); ++i) { r += x[i];} return r;}, and since this is a function that performs additions the number of times equal to the length of the array x, it is evaluated as length(x) additions.

[0021] The AutoML unit 220 calculates the maximum time for the number of processing times for each AI algorithm from the reference calculation time (constant term at level 0) and parameters (number of attributes, number of intermediate layers, number of trees, etc.), and outputs the calculated time. Examples of processing include secure computation addition, constant multiplication, multiplication, number of records, etc., which are parameters. Furthermore, all secure computation iterations can be evaluated using the maximum number of times.

[0022] Before performing machine learning, the secure computation client device 200 may calculate a computation cost for each machine learning algorithm based on the data size and the predicted computation time of the function to be used. This will be described more specifically with reference to FIG. 3 . The secure computation client device 200 selects an AI algorithm to be used for machine learning (S251). The computation time prediction unit 250 acquires a function to be used for the selected AI algorithm (S252). The computation time prediction unit 250 calculates the predicted computation time of the function based on function expansion and a reference computation time (S253). The secure computation client device 200 acquires the data size (number of records, number of attributes, etc.) to be used for machine learning (S254). The computation time prediction unit 250 evaluates the computation cost taking the data size into consideration (S255). The secure computation client device 200 checks whether the evaluation of the AI ​​algorithm has been completed, and if it has not been completed (if S256 is No), returns to the selection of the AI ​​algorithm (S251) (S256). The secure computation client device 200 excludes AI algorithms that are determined to take too much time from the processing of the AutoML unit 220 (S257). The criteria for determining whether an algorithm takes too much time can be set appropriately. For example, a possible criterion would be to exclude AI algorithms that are evaluated to have a computation cost five times or more higher than the AI ​​algorithm with the lowest computation cost. By limiting the AI ​​algorithms in advance in this way, the processing load on the AutoML unit 220 can be reduced. Therefore, more practical machine learning can be realized.

[0023] According to the secure computation client device 200, the computation time required for a reference process is calculated using an actually measured reference computation time, and the function for which the computation time is to be calculated is expanded until it can be expressed using only the reference process, thereby calculating the predicted computation time. This enables more practical computation time analysis than before. More specifically, computation time can be evaluated and estimated by pre-calculating a maximum execution time evaluation formula using step-by-step function evaluation. Optimal computation conditions can be selected through estimation, enabling more efficient secure computation. Calculation conditions that result in more practical computation speeds can be determined, allowing secure computation to be completed within an acceptable computation time. Secure computation AI, which was previously unrealizable, can be implemented under realistic conditions (computation time within an acceptable range), enabling overall data confidentiality. Data accumulated by multiple companies can be brought together and used safely. Furthermore, the applicability of secure computation AI (such as data analysis using AI) can be expanded, and ease of implementation (such as business asset collaboration) can be improved, enabling deployment to a wide range of users.

[0024] [Processor, Program, Recording Medium] The functions performed by the components described herein may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), a CPU (a Central Processing Unit), conventional circuits, and / or combinations thereof, programmed to perform the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may also be a programmed processor that executes a program stored in a memory.

[0025] In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions.

[0026] If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0027] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 4, and operating the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc.

[0028] The program describing the processing contents can be recorded on a computer-readable recording medium, which may be, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or any other suitable recording medium.

[0029] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0030] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. Furthermore, the server computer may execute the process at the terminal using a so-called SaaS (Software as a Service) service, which allows users to use part of a server computer along with the program. In this embodiment, the program includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that dictate computer processing).

[0031] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0032] 10 Secure computation system 100 Secure computation server 200 Secure computation client device 210 Secure computation client unit 211 Secret sharing unit 212 Restoration unit 220 AutoML unit 240 Function expansion unit 250 Computation time prediction unit 260 Actual measurement unit 280 Communication unit 290 Recording unit 300 User device

Claims

1. A secure computation client device comprising: a recording unit connected to a secure computation system consisting of one or more secure computation servers, which requests a predetermined standard processing from a secure computation client unit that sends shares of instruction information to the secure computation system and receives shares of results, and records the standard computation time, which is the result of measuring the computation time performed by the secure computation for each standard processing; a function expansion unit that repeatedly expands the processing of a specified function until it can be expressed only by the standard processing, and determines the number of times for each standard processing required for the processing; and a computation time prediction unit that predicts the computation time, which is the time required to process the specified function, based on the number of times for each standard processing required for the processing determined by the function expansion unit and the standard computation time.

2. A secure computation client device according to claim 1, wherein the function expansion unit records intermediate functions, which are functions used intermediately, in association with the number of times each reference process is required to process the intermediate functions.

3. A secure computation client device according to claim 1 or 2, characterized in that it calculates the computation cost for each machine learning algorithm based on the data size and the predicted computation time of the function to be used.

4. A computation time analysis method using a secure computation client device connected to a secure computation system consisting of one or more secure computation servers, which sends shares of instruction information to the secure computation system and receives shares of results, the computation time analysis method comprising the steps of: requesting a predetermined standard process, measuring the computation time performed by the secure computation for each standard process, acquiring and recording the standard computation time; repeatedly expanding the processing of a specified function until it can be expressed only by the standard process, determining the number of times for each standard process required for the processing; and determining a predicted computation time, which is the time required to process the specified function, based on the number of times for each standard process required for the determined processing and the standard computation time.

Images