Secure computation system and record extraction method

Abstract

This secure computation system is composed of one or more secure computation servers. Each secure computation server comprises a random number assignment unit, a combination unit, a sorting unit, a comparison unit, a shuffling unit, and a deletion unit. The random number assignment unit associates a share [rn] obtained by secretly sharing a random number rn with each record. The combination unit finds a share [cn∥rn] of a combination cn∥rn of a class cn in the record and a random number rn associated with the record. The sorting unit finds a sorted share [cn∥rn] obtained by sorting the combination cn∥rn. The comparison unit compares the sorted class cn with a class cn-k, and associates the share of a comparison result with the share of the record. The deletion unit deletes the share of the record with which the comparison result indicating a match is associated.

Description

Secure computing system, record extraction method

[0001] The present invention relates to a secure computation system configured with a plurality of secure computation servers and a record extraction method.

[0002] While the momentum for data utilization using AI and other technologies is growing, so too is the demand for privacy protection, creating a need for an environment where highly confidential data can be analyzed using proven AI algorithms in fields such as healthcare. Secure computing AI is a technology that brings together data accumulated by multiple companies and safely utilizes it. It enables the creation of models and inference (data manipulation in which only the calculation results are visible to anyone) using extremely secure and diverse AI algorithms, while keeping the data confidential (secret distribution) and never restoring it. Secure computing AI can realize statistical analysis and machine learning services that can be used while keeping the data confidential, but because analysis and other processing are performed without seeing the data, it is extremely inefficient compared to plain text, and to date, there have been no examples of systems that operate under realistic usage conditions (within acceptable computation time).

[0003] It is difficult to implement secure computation AI in the form of secure computation itself. In other words, to perform complete secure computation, including model type, parameter depth, structural information, and so on, abstracting all learning would require long calculation times, which would impair usability and make it unrealistic. For this reason, there is a demand for technology that can perform secure computation at a practical calculation speed. To execute within an acceptable time, it is necessary to extract and select records to be used for learning and perform an efficient search. For example, stratified sampling (Non-Patent Documents 1 and 2) is a method for thoroughly extracting data from classes with a small number of records.

[0004] Hiroyuki Yoshizawa, Toshikazu Yoshida, Makoto Nakajima, Takuya Yoshida, and Chika Harada, "Effects of Neighborhood Commitment and Atmosphere on Youth Antisociality Mediated by Collective Efficacy: A Multilevel Study with Stratified Sampling," Applied Psychology Research, Vol. 45, No. 1, pp. 35-46, 2019. K. Sechidis, K. Tsoumakas, G. Vlahavas, I. "On the Stratification of Multi-label Data," In: D. Gunopulos, T. Hofmann, D. Malerba, M. Vazirgiannis (eds) Machine Learning and Knowledge Discovery in Databases. ECML PKDD 2011. Lecture Notes in Computer Science(), vol. 6913. Springer, Berlin, Heidelberg, [Retrieved June 13, 2024], Internet<https: / / doi.org / 10.1007 / 978-3-642-23808-6_10> .

[0005] However, the methods for extracting data from classes with a small number of records without omission, as shown in Non-Patent Documents 1 and 2, cannot be simply applied to secure computation AI. Therefore, an object of the present invention is to provide a method for extracting data from classes with a small number of records without omission, using secure computation.

[0006] The secure computation system of the present invention is composed of one or more secure computation servers. Each secure computation server includes a recording unit, a random number providing unit, a combining unit, a sorting unit, a comparing unit, a shuffling unit, and a deleting unit. The random number providing unit provides a random number r ｎ The secretly shared share [r ｎ ] is associated with each record. The join part is the class c in the record.ｎ and a random number r associated with the record ｎ Bond with c ｎ ∥r ｎ Share of [c ｎ ∥r ｎ The sorting part calculates the join c ｎ ∥r ｎ The sorted share [c ｎ ∥r ｎ The comparison part calculates the class c after sorting. ｎ and Class C ｎ－ｋ and associates the shares of the comparison results with the shares of the records. The shuffling unit shuffles the comparison results and determines the shares of the comparison results after shuffling. The deletion unit deletes the shares of the records associated with the comparison results that indicate a match. Either one of the secure computation servers or a secure computation client device connected to the secure computation system includes a restoration unit that restores the comparison results after shuffling using the shares of the comparison results after shuffling.

[0007] According to the secure computation system of the present invention, records are extracted so that the class ratio of the specified attribute is equal, so that a method can be provided for extracting data from classes with a small number of records without omission using secure computation.

[0008] A diagram showing an example of the configuration of a secure computation system and a secure computation client device, which are configured with a plurality of secure computation servers connected via a network. A diagram showing an example of the functional configuration of a secure computation server. A diagram showing the processing flow of a record extraction method according to a first embodiment. A diagram for explaining an image of a record extraction method. A diagram showing an example of a record. A diagram showing an example of generating a random number for each record and combining the random number with data of attribute Y. Combined c ｎ ∥r ｎ 1 is a diagram showing the results of sorting records based on the data obtained by the comparison. 2 is a diagram showing the results of comparing the data k positions before the sorted data. 3 is a diagram showing an example in which records with a comparison result of "1" are deleted without shuffling. 4 is a diagram showing the processing flow of a record extraction method according to a first modified example. 5 is a diagram showing an example of the functional configuration of a computer.

[0009] Prior to describing the embodiments, the basic technical concepts used in the present disclosure will be described.

[0010] [Secret Sharing Technology] Secret sharing is a technology that converts data into multiple shares, allowing the original data to be restored using a certain number of shares or more, but making it impossible to restore the original data using shares less than the certain number. (k,n)-secret sharing, a type of secret sharing, divides an input plaintext into n shares, distributes the shares to n computing entities, and allows the plaintext to be restored using any k shares, but no information about the plaintext can be obtained using shares less than k. Here, n and k are integers greater than or equal to 1, and n≧k. A typical example of (k,n)-secret sharing is Shamir secret sharing, described in "A. Shamir, "How to share a secret," Communications of the ACM, Volume 22, Issue 11, pp. 612-613, 1979 (Reference 1)." The secret sharing used in this disclosure may be any method that can utilize secure computation, as described below.

[0011] [Secure computation technology] Secure computation is a technology in which data to be computed is secretly shared and stored among multiple computing entities, and the computing entities cooperate with each other to compute the shared values ​​of a function of the original data without restoring the original data.Secure computation uses secret sharing as an elemental technology.

[0012] The secure computation used in the first embodiment of the present disclosure may be one that allows various computations required for desired data processing to be performed on shared values ​​obtained by a specific secret sharing method. A secure computation technique that performs basic computations such as addition and multiplication on secret shared values ​​is described, for example, in "Koji Senda, Hiroki Hamada, Dai Igarashi, and Katsumi Takahashi, 'Rethinking Lightly Verifiable Three-Party Secure Function Computation,' Computer Security Symposium 2010, 2010 (Reference 2)." A secret matching technique that searches for information from secret shared values ​​of a data string while keeping it secret is described, for example, in "Koji Senda, Masayuki Terada, Takayasu Yamaguchi, Dai Igarashi, Hiroki Hamada, and Katsumi Takahashi, 'Secure Matching Protocol Considering Statistical Disclosure Control,' Information Processing Society of Japan Research Report, 2011-CSEC-52(12), 2011 (Reference 3)." A secret sorting technique for sorting a data string while keeping the secret sharing values ​​of the data string secret is described, for example, in "Hiroki Hamada, Dai Igarashi, Koji Senda, Katsumi Takahashi, "Linear Time Sorting on Secure Function Computation," Computer Security Symposium 2011, 2011 (Reference 4)."

[0013] Hereinafter, embodiments of the present invention will be described in detail. Components having the same functions are given the same numbers, and duplicated explanations will be omitted. First embodiment

[0014] In the following description, N is the number of records to be used in machine learning, n is an integer between 1 and N, and k is a predetermined positive integer. Fig. 1 shows an example of the configuration of a secure computation system and a secure computation client device, which are composed of multiple secure computation servers connected via a network. Fig. 2 shows an example of the functional configuration of a secure computation server. Fig. 3 shows the processing flow of the record extraction method of Example 1. Fig. 4 is a diagram for explaining an image of the record extraction method.

[0015] The secure computation system 10 is composed of X secure computation servers 100-1, ..., X. X may be, for example, 3 or greater, but may be any number greater than or equal to 1 as long as the method allows for secure computation, as described below. The secure computation system 10 may use existing technology (such as the technology disclosed in WO2012 / 046692 (family U.S. Patent US8,989,391B2) (Reference 5)). For example, when X = 3, one piece of data is converted into three shares, and the three secure computation servers 100-1, 100-2, and 100-3 each record one share. Two shares are required to restore the data. The secure computation system 10 can perform calculations while maintaining the data in a secretly shared state (anonymized state), and the results are also recorded in each secure computation server 100-x as anonymous shares of the results. If the results are statistics, the statistics can be known by obtaining and restoring two or more shares, while maintaining the confidentiality of the original data.

[0016] The secure computation client device 200 includes a secure computation client unit 210, an AutoML unit 220, a communication unit 280, and a recording unit 290. The communication unit 280 may be connected to a user device 300. In this case, encryption technology may be used for communication between the communication unit 280 and the user device 300. The recording unit 290 records records used for training the AI ​​model. Each record is composed of data of multiple attributes. The attributes include, for example, age, gender, basic medical information (such as the values ​​of blood components), and disease name.

[0017] The secure computation client unit 210 is connected to a secure computation system consisting of multiple secure computation servers 100-1, ..., X, and includes a secret sharing unit 211 and a restoration unit 212. The secure computation client unit 210 transmits shares of records and shares of instruction information to the secure computation system 10, and receives shares of calculation results and shares of evaluation values ​​from the secure computation system 10. Here, "transmitting shares to the secure computation system 10" means transmitting shares corresponding to each secure computation server 100-x, and "receiving shares from the secure computation system 10" means receiving shares recorded by each secure computation server 100-x. In other words, the secret sharing unit 211 converts records, instruction information, etc. into multiple shares and transmits shares corresponding to each secure computation server 100-x. The instruction information is information such as which attributes are used to perform machine learning of the AI ​​model. The restoration unit 212 receives shares of calculation results and shares of evaluation values ​​from the secure computation system 10, and acquires plaintext calculation results and evaluation values.

[0018] The secret sharing unit 211 converts a record to be used for machine learning of the AI ​​model into multiple shares in advance, and transmits the corresponding shares to each secure computation server 100-x. Each secure computation server 100-x records the shares of attribute data that make up the record in the recording unit 190.

[0019] As shown in Fig. 2, the secure computation server 100-x includes a recording unit 190, a random number assignment unit 110, a combining unit 120, a sorting unit 130, a comparison unit 140, a shuffling unit 150, a deletion unit 160, and a restoration unit 180. In the present invention, records are extracted from a collection of records so that records of the same class as a specified attribute are evenly distributed. The collection in Fig. 4 contains four types of circles, but there is a bias in the number of these circles. If circles are extracted randomly from the collection, more circles that are present in large numbers in the collection will be extracted, and the number of circles that are rare will decrease. On the other hand, if the four types of circles are extracted in an equal distribution, it is possible to extract both abundant and rare circles evenly.

[0020] For example, consider the use of AI in medical diagnosis. In the case of health checkup data, the most common result is that no further examination is necessary, and even when further examination is necessary, there are diseases that are common and diseases that are rare. In order to perform effective machine learning, it is necessary to avoid deleting records (data) for diseases with few cases when extracting records. Furthermore, when using AI to make a primary judgment on the need for further examination based on the results of a health checkup, it is desirable to output more results indicating that further examination may be necessary. Therefore, in this invention, secure computation is used to extract records so that the class ratio of specified attributes is equal, thereby extracting data from classes with few records without omission.

[0021] 5 shows an example of records. There are 20 records, and each record has data of attribute Y. There are five classes of attribute Y: "0", "1", "2", "3", and "4". The random number assigning units 110 of the secure computation servers 100-1, . . . , X cooperate to assign random numbers r ｎ Generate a random number r ｎ The secretly shared share [r ｎ ] is associated with each record (S110). Regarding "cooperation", it is the same as the existing secure computation technology (the technology shown in WO2012 / 046692 (US Patent US8,989,391B2 of the same family) (Reference 5)), so it is sufficient to use the existing technology. The combining unit 120 of the secure computation servers 100-1,...,X cooperates to associate the class c ｎ and a random number r associated with the record ｎ Bond with c ｎ ∥r ｎ Share of [c ｎ ∥r ｎ 6 shows an example in which a random number is generated for each record and linked to the data of attribute Y.

[0022] The sorting units 130 of the secure computation servers 100-1, . . . , X cooperate to ｎ ∥r ｎ The sorted share [c ｎ ∥r ｎ ] is calculated (S130). ｎ ∥r ｎThis shows the result of sorting the records based on the join c ｎ ∥r ｎ In sorting, data c ｎ Sort together.

[0023] The comparison units 140 of the secure computation servers 100-1, . . . , X cooperate to find the class c ｎ and Class C ｎ－ｋ are compared, and the share of the comparison result is associated with the share of the record (S140). k is an integer specified by the secure computation client device 200 to the secure computation system 10, and indicates how many records of the same class are to be left. Fig. 8 is a diagram showing the result of a comparison with the kth data after sorting. If the data is different from the kth data after sorting, "0" is output as the comparison result, and if the data is the same, "1" is output as the comparison result. In the example of Fig. 8, k=2.

[0024] The shuffling units 150 of the secure computation servers 100-1, ..., X cooperatively shuffle the comparison results and obtain the shares of the comparison results after shuffling (S150). The restoration unit 180 of any of the secure computation servers 100-x or the restoration unit 212 of the secure computation client device 200 connected to the secure computation system 10 restores the comparison results after shuffling using the shares of the comparison results after shuffling (S212). Only the comparison results are restored, and the data of attribute Y itself is not restored. The example in FIG. 3 is an example restored by the restoration unit 212 of the secure computation client device 200.

[0025] Thereafter, the deletion units 160 of the secure computation servers 100-1, ..., X cooperatively delete the shares of records associated with comparison results indicating a match (S160). Fig. 9 shows an example in which records with a comparison result of "1" are deleted without shuffling. In the example of Fig. 8, k = 2 and there were five types of classes, so in Fig. 9, 10 records remain.

[0026] The data of attribute Y is secretly shared and recorded on the secure computation servers 100-1, ..., X, and records are extracted using secure computation. Therefore, records can be extracted so that the class ratio of attributes is equal while maintaining the confidentiality of the data. Furthermore, the equal allocation method can eliminate the impact of attribute bias on AI learning by equalizing the class ratio of specified attributes. This allows data from classes with a small number of records to be extracted without omission, while enabling faster processing of AI analysis.

[0027] As described above, the present invention compares two records and eliminates duplicates, enabling the equal allocation method to be implemented with secure computing AI, thereby reducing the number of records to be learned and enabling faster AI analysis. Stratified sampling allows for extraction of any number of records by ensuring a range of the desired number k to be extracted and comparing them, rather than the immediately preceding number. Equal allocation, one of the stratified sampling methods, eliminates the impact of attribute bias by equalizing the class ratio of a specified attribute. Equal allocation only determines whether the current record is in the same class as the k records before it, i.e., whether the same class occurs k times in a row, so data from classes with a small number of records can be extracted without omission. The only determination is whether the records are in the same class or different classes; there is no need to determine which class the contents of the different classes are, and there is no need to change the processing, enabling high-speed processing.

[0028] By realizing the equipartition method as a record extraction method for secure computation AI and speeding up processing, it is possible to implement secure computation AI under realistic conditions (within an acceptable calculation time), which was previously unrealizable, and keep data confidential as a whole. When record extraction is performed efficiently using simple random sampling, there is a risk that data from classes with a small number of records will not be extracted. However, with the equipartition method, when the number of records is k or less, all records can be extracted without being simply deleted. Data accumulated by multiple companies can be pooled together and used safely. In addition, the applicability of secure computation AI is expanded (data analysis using AI, etc.) and ease of implementation is improved (business asset collaboration, etc.), making it possible to deploy it to a wide range of users. [Variation 1]

[0029] However, if there are fewer than k records of the same class, the number of remaining records will be less than the number obtained by multiplying the class type by k. In this case, it is possible to determine how many data records of the same class there are that have fewer than k records. Therefore, in Modification 1, a process is added that determines whether or not there is data with fewer than k records of the same class. As shown in FIG. 2, the secure computation server 100-x also includes a record number acquisition unit 170, a shortage number calculation unit 175, and a dummy addition unit 185. FIG. 10 shows the process flow of the record extraction method of Modification 1.

[0030] Steps S110 to S140 are the same as those in FIG. 3. The record number acquisition units 170 of the secure computation servers 100-1, . . . , X cooperate to acquire the number of records of class c ｎ For each, the number of records in the same class m Ｌ Share of [m Ｌ ] (S170). The shortage calculation units 175 of the secure computation servers 100-1, . . . , X cooperate to calculate the number of records m Ｌ For classes with less than k, the shortage is si = k - m Ｌ The shares [si] of all the shortages si thus calculated are calculated, and the shares [S] of the total S of all the shortages si thus calculated are calculated (S175). The dummy adding units 185 of the secure computation servers 100-1, ..., X cooperate to add S shares of dummy data to the shares of the records (S185). Steps S150 and S212 are the same as in the first embodiment.

[0031] Thereafter, the deletion units 160 of the secure computation servers 100-1, ..., X cooperatively delete the shares of the records associated with the comparison results indicating a match and the shares of the dummy data (S161). Note that if it is desired to actively notify the total number of shortages S, the restoration unit 180 of any of the secure computation servers 100-x or the restoration unit 212 of the secure computation client device 200 connected to the secure computation system 10 may restore the total number S using the shares [S].

[0032] In this modified example, as in the first embodiment, records can be extracted so that the class ratio of attributes is equal while maintaining data confidentiality. Furthermore, the equal allocation method can eliminate the impact of attribute bias on AI learning by equalizing the class ratio of specified attributes. This allows for faster processing of AI analysis while extracting data from classes with a small number of records without omission.

[0033] [Processor, Program, Recording Medium] The functions performed by the components described herein may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), a CPU (a Central Processing Unit), conventional circuits, and / or combinations thereof, programmed to perform the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may also be a programmed processor that executes a program stored in a memory.

[0034] In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions.

[0035] If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0036] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 11 and operating the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc.

[0037] The program describing the processing contents can be recorded on a computer-readable recording medium, which may be, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or any other suitable recording medium.

[0038] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0039] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. Furthermore, the server computer may execute the process at the terminal using a so-called SaaS (Software as a Service) service, which allows users to use part of a server computer along with the program. In this embodiment, the program includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that dictate computer processing).

[0040] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0041] 10 Secure computation system 100 Secure computation server 110 Random number assignment unit 120 Combination unit 130 Sorting unit 140 Comparison unit 150 Shuffling unit 160 Deletion unit 170 Record number acquisition unit 175 Deficiency number calculation unit 180 Restoration unit 185 Dummy addition unit 190 Recording unit 200 Secure computation client device 210 Secure computation client unit 211 Secret sharing unit 212 Restoration unit 220 AutoML unit 280 Communication unit 290 Recording unit 300 User device

Claims

1. A secure computation system consisting of one or more secure computation servers, where N is the number of records to be used for machine learning, n is an integer between 1 and N, and k is a predetermined positive integer, and each secure computation server has a recording unit that records the shares obtained by secretly sharing the records, and a random number r ｎ The secretly shared share [r ｎ ] for each record, and a random number assignment part that associates the class c in the record ｎ and a random number r associated with the record ｎ Bond with c ｎ ∥r ｎ Share of [c ｎ ∥r ｎ ] and bond c ｎ ∥r ｎ The sorted share [c ｎ ∥r ｎ a sorting unit for obtaining a class c after the sorting ｎ and Class C ｎ－ｋ a comparison unit that compares the records and associates the shares of the comparison result with the shares of the records; a shuffling unit that shuffles the comparison results and determines the shares of the comparison results after shuffling; and a deletion unit that deletes the shares of the records associated with the comparison results that indicate a match, wherein any of the secure computation servers or a secure computation client device connected to the secure computation system comprises a restoration unit that restores the comparison results after shuffling using the shares of the comparison results after shuffling.

2. The secure computation system according to claim 1, wherein each secure computation server is a class c ｎ For each, the number of records in the same class m Ｌ Share of [m Ｌ ] and the number of records in the same class m Ｌ For classes with less than k, the shortage is si = k - m Ｌ and a dummy adding unit that adds S shares of dummy data to the shares of the record.

3. A secure computation system according to claim 1 or 2, further comprising a secure computation client device for using said secure computation system via a network.

4. A record extraction method using a secure computation system consisting of one or more secure computation servers, in which N is the number of records to be used for machine learning, n is an integer between 1 and N, and k is a predetermined positive integer, and each secure computation server records a secretly shared share of the records in a recording unit, and each secure computation server cooperates to generate a random number r ｎ The secretly shared share [r ｎ ] for each record, and class c in the record ｎ and a random number r associated with the record ｎ Bond with c ｎ ∥r ｎ Share of [c ｎ ∥r ｎ ] and bond c ｎ ∥r ｎ The sorted share [c ｎ ∥r ｎ ], and the sorted class c ｎ and Class C ｎ－ｋ a record extraction method for comparing records, associating a share of the comparison result with a share of the record; shuffling the comparison result, determining a share of the comparison result after shuffling; and deleting a share of the record associated with a comparison result indicating a match.

Images