Secret calculation method, secret calculation server, and program

Abstract

It is desired to store a calculation result in N servers even when secret calculation algorithm is executed by M servers. Therefore, a secret calculation server is provided with a secret calculation request definition unit, a communication unit, a concealment regeneration unit, and a secret calculation program execution unit. The secret calculation request definition unit records data obtained by decomposing a secret calculation procedure into a plurality of program blocks. It is assumed that a set of servers for processing a program block i-1 is Ni-1, a set of servers for processing a program block i is Ni, the servers belonging to Ni-1 form a first server group, and the servers belonging to Ni and not belonging to Ni-1 form a second server group. When a host server belongs to Ni-1 or Ni, the concealment regeneration unit generates, from an intermediate share, a regenerated share to be used by the second server group in cooperation with another secret calculation server. When the host server belongs to Ni, the secret calculation program execution unit processes the program block i by using the intermediate share or the regenerated share.

Description

Secret Calculation Method, Secret Calculation Server, and Program

[0001] The disclosed technology relates to a method in which a secret calculation system that stores secretly distributed data and performs secret calculations performs analysis with the required number of units according to the type of analysis.

[0002] In a general encryption method, even if the data to be concealed is encrypted and stored in a server, when performing calculations using that value, the data is decrypted before the calculations are performed. However, there is a secret calculation technology (Non-Patent Document 1) that can perform calculations while keeping the data encrypted. Non-Patent Document 1 introduces a multi-party protocol that is a secret sharing system in which one numerical value is converted into a plurality of encrypted shares, and N secret calculation devices each have a share, and addition, multiplication, logical operations, etc. are performed without leaking the information of their own share.

[0003] FIG. 1 is a secret calculation system composed of a client / server system consisting of N servers S0, S1,..., S n-1 and a plurality of clients. One client requests analysis (secret calculation) from a plurality of servers, and the servers perform the analysis and return the calculation results to the client.

[0004] In a secret sharing system called (k,N) secret sharing, if there are k shares out of N shares, the original value can be restored. Assuming that the N shares are distributed among N servers. At this time, the number of servers participating in the secret calculation varies depending on the analysis algorithm, ranging from k to N. For example, in the case of k = 2 and N = 4, multiplication can be calculated by 3 servers. In the case of analysis performed by N servers, the client sends a request to N servers, and in the case of analysis performed by M (M < N) servers, the client sends a request to M servers.

[0005] Osamu Igarashi, et al., "Fast Implementation of Secret Sharing Method Extendable to Multi-Party Computation", 2013 Symposium on Cryptography and Information Security (SCIS).

[0006] When sending a secure computation result to a client, the secure computation process according to conventional technology follows the procedure below. <When N servers are required for analysis> (1) The client sends a secure computation request to N servers. (2) Each of the N servers performs a secure computation. (3) The client receives shares of the secure computation result from the N servers and restores them.

[0007] <When M servers are required for analysis> (1) The client sends a secure computation request to M servers. (2) Each of the M servers performs a secure computation. (3) The client receives shares of the secure computation results from the M servers and restores them.

[0008] When it is desired to store the secure computation result in the memory unit of a server, the secure computation process according to the prior art is as follows: <When N servers are required for analysis> (1) The client sends a secure computation request to N servers. (2) Each of the N servers performs a secure computation. (3) Each of the N servers stores the secure computation result in its own memory. (4) The client receives a secure computation completion notification from each of the N servers.

[0009] <When M servers are required for analysis> (1) The client sends a secure computation request to M servers. (2) The M servers each perform a secure computation. (3) The M servers store the secure computation results in their respective memories. (4) The client receives a secure computation completion notification from the M servers.

[0010] As described above, with conventional methods, it was not possible to store the results of an algorithm executed on M servers on N servers. For example, a column join algorithm can be calculated on three servers when k=2 and N=4, but if the results are stored on three servers, they cannot be used for secure computation executed on four servers. Therefore, even if a secure computation algorithm is executed on M servers, it is desirable to store the calculation results on N servers.

[0011] To solve the above problems, the secure computing server according to the disclosed technology includes a secure computing request definition unit, a communication unit, a secret regeneration unit, and a secure computing program execution unit. The secure computing request definition unit records data with IDs assigned by decomposing the secure computing procedure into a plurality of program blocks. The communication unit acquires the ID from the client. Let the set of servers that process program block i-1 be Ni-1, the set of servers that process program block i be Ni, the servers belonging to Ni-1 be the first server group, the servers belonging to Ni and not belonging to Ni-1 be the second server group, and the shares obtained by each server in Ni-1 by processing program block i-1 be intermediate shares. When the server itself belongs to Ni-1 or Ni, the secret regeneration unit cooperates with other secure computing servers to generate the regeneration shares used by the second server group from the intermediate shares. When the server itself belongs to Ni, the secure computing program execution unit processes program block i using the intermediate shares or the regeneration shares.

[0012] According to the disclosed technology, in a secure computing system, the result calculated by M servers (M < N) can be stored in N servers and used by the N servers.

[0013] Figure showing a secret sharing system configured by a client / server system. Functional block diagram of the servers constituting the secret sharing system according to the first embodiment. Flowchart for explaining the operation of the server. Diagram showing a specific example 1 of secure computing request definition data. Diagram showing a specific example 2 of secure computing request definition data. Diagram showing a specific example 3 of secure computing request definition data. Diagram showing an example of the functional configuration of a computer.

[0014] Hereinafter, embodiments of the disclosed technology will be described in detail. Components having the same function are denoted by the same reference numerals, and redundant descriptions are omitted. [[ID=lla]]

[0015] [First Embodiment] The configuration of the secret sharing system according to the first embodiment is the same as that shown in Fig. 1. Fig. 2(a) is a functional block diagram showing an example of the configuration of a server that constitutes the secret sharing system. The server 101 includes a request processing unit 202, a secure computation program execution unit 203, a communication unit 204, a secure computation request definition unit 205, a storage unit 206, and a secret regeneration unit 207.

[0016] The secure computation request definition unit 205 stores a plurality of pieces of secure computation request definition data 210 for each type of secure computation request. The types of secure computation requests are, for example, "perform an analysis requiring M servers and send the results to the client," "perform an analysis requiring M servers and store the results in N servers," "perform analyses requiring M servers in sequence and store intermediate and final results in N servers," etc. Each piece of secure computation request definition data consists of a request definition ID, a maximum number of execution servers, and one or more secure computation program blocks 220.

[0017] 2(c) shows the secure computation program block 220. The secure computation program block 220 consists of a program block ID, the number of execution servers, an execution server ID list, and a secure computation program. The execution server ID list specifies the servers involved in the execution of the secure computation program.

[0018] 3 is a flowchart illustrating an example of the operation of the server 101. The following description will be given with reference to FIGS.

[0019] The client 102 requests secure computation from multiple servers 101 by specifying a request definition ID (step S301). The number of destinations of the secure computation request is the "maximum number of execution servers" described in the secure computation request definition data indicated by the request definition ID. The destinations of the secure computation request will be described later.

[0020] The request processing unit 202 acquires secure computation request definition data corresponding to the request definition ID (step S302), and initializes a counter i to 0 (step S303).

[0021] The request processing unit 202 checks whether the acquired secure computation request definition data contains program block i (step S304). If counter i exceeds the number of program blocks (No in step S304), this means that processing of all program blocks has been completed, and so a return process is performed to the client (step S312). The return process transmits the secretly shared computation result to the client or notifies the client of the completion of the computation, according to the secure computation request definition data. The secretly shared computation result is restored by the client.

[0022] If there is a program block i (Yes in step S304), that is, if there is an unprocessed program block, the request processing unit 202 selects an execution server according to the execution server ID list described in the program block i (step S305). The group of servers selected to execute the program block i is denoted as Ni.

[0023] The request processing unit 202 then determines whether the following three conditions (collectively referred to as condition A) are satisfied (step S306): Condition 1: i>0 Condition 2: A share (a secretly shared calculation result) is handed over from program block i-1 to program block i Condition 3: Let Ni be the set of execution servers for program block i. and Server S x exists.

[0024] <When Condition A is Not Satisfied> i = 0 corresponds to the processing of the first program block. In this case, since the shares of the calculation result do not yet exist, the confidential reproduction process is not necessary, and the process proceeds to step S309. If there is no share transfer between blocks or no new servers participating in the processing of the program block, the confidential reproduction process is also not necessary, and the process proceeds to step S309.

[0025] The request processing unit 202 then determines whether the server 101 itself is involved in the processing of program block i. If not (No in step S309), the process proceeds to step S311, updates i to i+1, and returns to step 304. If involved (Yes in step S309), the secure computing program execution unit 203 executes program block i (step S310). The server 101 then proceeds to step S311, updates i to i+1, and returns to step 304.

[0026] <When Condition A is Satisfied> The server 101 performs the confidential reproduction process and the program block execution process according to condition B (the server 101 itself is included in Ni-1 or Ni) or condition C (the server 101 itself is included in Ni).

[0027] <<When Condition B is Not Met>> If the server 101 itself is not involved in the processing of either program block i-1 or program block i (No in step S307), the request processing unit 202 proceeds to step S311, updates i to i+1, and returns to step 304 to process the next program block.

[0028] <<When Condition B is Satisfied>> If the server 101 itself is involved in the processing of program block i-1 or the processing of program block i (Yes in step S307), the server 101 proceeds to step S308, where the secret regeneration unit 207 performs the "secret regeneration process" described below. The secret regeneration process is a process of granting shares from shares held by servers included in Ni-1 to servers that were not present in Ni-1 but are present in Ni and require shares for secure computation.

[0029] The request processing unit 202 then determines whether the server 101 itself is involved in the processing of program block i. If not (No in step S309), the process proceeds to step S311, where i is updated to i+1, and the process returns to step S304.

[0030] If it is involved (Yes in step S309), the secure computing program execution unit 203 executes the program block i (step S310). The server 101 then proceeds to step S311, updates i to i+1, and returns to step S304.

[0031] <Secret regeneration process> The set of servers involved in the processing of program block i is The set of servers involved in the processing of program block i-1 is Let N i-1 Not included in N i Servers included only in Then, server S x Let S be the secret sharing value (share) of value a held by x [a] is written as N new The secret regeneration protocol to create new secret shares for servers belonging to The flags are a string of flags corresponding to each server, with the input server being true and the output server being false. createShare is implemented using existing technology (Reference 1: Patent No. 5968484).

[0032] <Destination of secure computation request from client> The server that executes the secure computation program is specified in the execution server ID list of the program block 220. In this case, the execution server ID is not fixedly associated with the real server ID, but is assigned within the request when the client calls the server. (Example of program block description) Number of execution servers: 3 Execution server ID list: S tmp1 , S tmp2 , S tmp3

[0033] The client selects the maximum number of secure computation servers, and tmp The server determines the correspondence and sends the request to the selected server. (Example of a client request) Server ID 1 in the request S tmp1 = Server ID 2 in S2 request S tmp2= Server ID3 in S1 request tmp3 = Server ID4 in S4 request S tmp4 = S3: Since there are protocols in the secure computation that have asymmetric loads, the load on each server is assumed to be evened out by randomizing the order of designation. For example, if there are four servers, three servers are randomly designated to participate in the computation.

[0034] The above is the description of the first embodiment.

[0035] Here are some specific examples of secure computation request definition data. <Specific Example 1> Fig. 4 shows secure computation request definition data when calculation results from M servers are stored in N servers. A secure regeneration process is performed between program block 1 and program block 2. <Specific Example 2> Fig. 5 shows secure computation request definition data when calculations are performed on M servers and the calculation results are returned to the client. In this case, there is no need to separate the program blocks. <Specific Example 3> Fig. 6 shows secure computation request definition data when intermediate calculation results are stored. This definition data is used when storing the learning results of each round in neural network model learning.

[0036] [Program, Recording Medium] The functions realized by the components described in this specification may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), CPUs (Central Processing Units), conventional circuits, and / or combinations thereof, programmed to realize the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may be a programmed processor that executes a program stored in a memory.

[0037] In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions.

[0038] If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0039] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 7, and operating the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc.

[0040] The program describing the processing contents can be recorded on a computer-readable recording medium, which may be, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or any other suitable recording medium.

[0041] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0042] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. Furthermore, the server computer may execute the process at the terminal using a so-called SaaS (Software as a Service) service, which allows users to use part of a server computer along with the program. In this embodiment, the program includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that dictate computer processing).

[0043] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0044] REFERENCE SIGNS LIST 101 Server 102 Client 202 Request processing unit 203 Secure computation program execution unit 204 Communication unit 205 Secure computation request definition unit 206 Storage unit 207 Secret regeneration unit 210 Secure computation request definition data 220 Program block 2000 Computer 2010 Control unit 2020 Recording unit 2030 Input unit 2040 Output unit 2050 Display unit

Claims

1. A method for performing secure computation by multiple servers at the request of a client, wherein the server holds request definition data in which a secure computation procedure is broken down into multiple program blocks and assigned IDs, the client requests the server to perform secure computation using the ID, the set of servers processing program block i-1 is called Ni-1, the set of servers processing program block i is called Ni, the servers belonging to Ni-1 are called a first server group, the servers belonging to Ni but not Ni-1 are called a second server group, and the share obtained by each server in Ni-1 in processing program block i-1 is called an intermediate share, the first server group generates recycled shares using the intermediate shares and provides the recycled shares to the second server group, and each server in Ni processes the program block i using the intermediate shares or the recycled shares.

2. A server constituting a system in which a client requests multiple servers to perform secure computation, comprising: a secure computation request definition unit that records data in which a secure computation procedure is decomposed into multiple program blocks and to which IDs are assigned; a communication unit that acquires the IDs from the client; a secure reproduction unit; and a secure computation program execution unit, wherein a set of servers that process program block i-1 is defined as Ni-1, a set of servers that process program block i is defined as Ni, servers that belong to Ni-1 are defined as a first server group, servers that belong to Ni but not Ni-1 are defined as a second server group, and shares obtained by each server in Ni-1 by processing program block i-1 are defined as intermediate shares, and when the server itself belongs to Ni-1 or Ni, the secure reproduction unit cooperates with other secure computation servers to generate reproduced shares to be used by the second server group from the intermediate shares, and when the server itself belongs to Ni-1, the secure computation program execution unit processes the program block i using the intermediate shares or the reproduced shares.

3. A secure computation server according to claim 2, wherein the secure computation request definition unit holds a temporary ID that specifies a server that executes the program block from among the plurality of servers, and the secure computation server acquires correspondence information between the temporary ID and the plurality of servers from a client.

4. A program for causing a computer to function as the secure computation server according to claim 2 or 3.

Images