Data utilization system, calculation server, and data utilization method

Abstract

A provider terminal generates a provider public key and a provider private key for use in encryption by homomorphic encryption and uses the provider public key to encrypt original data and generate encrypted original data. A calculation server (30) comprises: a first hash value registration unit (31A) that calculates a first hash value from the encrypted original data and registers the first hash value in a blockchain; a secret calculation unit (31C) that performs a secret calculation on the encrypted original data and generates calculation result data; a server decryption unit (31D) that decrypts the calculation result data by using the provider private key; and a re-encryption unit (31E) that re-encrypts the decrypted calculation result data by using a user public key and generates re-encrypted calculation result data. A user terminal generates a user public key and a user private key, verifies matching of hash values, and decrypts the re-encrypted calculation result data using the user private key.

Description

Data Utilization System, Computing Server, and Data Utilization Method Cross - reference to Related Applications

[0001] This application is based on Japanese Patent Application No. 2024 - 164679 filed in Japan on September 23, 2024, and the content of the base application is incorporated herein by reference in its entirety.

[0002] Related to a data utilization system using blockchain, a computing server included in the system, and a data utilization method.

[0003] Patent Document 1 discloses a technique for verifying the validity of data using blockchain. In the technique disclosed in Patent Document 1, a verification server obtains encrypted verification data from a smart contract server and calculates a hash value from the verification data. Also, the hash value of the measured value is registered in the blockchain. The verification server verifies the validity of the measured value by comparing the hash value calculated from the verification data with the hash value obtained from the blockchain. The description of the prior art document is incorporated herein by reference as an explanation of the technical elements in this specification.

[0004] Japanese Patent Application Laid - Open No. 2022 - 149878

[0005] In the technique disclosed in Patent Document 1, the hash value of the measured value is registered in the distributed ledger of the blockchain network. This improves confidentiality compared to registering the measured value itself in the distributed ledger. However, at the time of verification, the measured value is provided from the smart contract server to the verification server.

[0006] Here, consider the utilization of data. For example, consider the case where original data provided by a data provider is calculated in a computing server and the calculation result data is provided to a data user. In this case, it is necessary to provide the calculation result data to the data user in a usable state. Also, the data user who uses the calculation result data may want to verify that the calculation result data is data calculated from the original data.

[0007] If the technology disclosed in Patent Document 1 is applied to the above-mentioned data utilization, data users can verify that the calculated data is derived from the original data. However, applying the technology disclosed in Patent Document 1 requires providing the original data to the data user for verification. However, data providers may want to keep the provided original data confidential from the data user.

[0008] This disclosure is made in light of these circumstances and aims to provide data users with a data utilization system, computing server, and data utilization method that allows data users to use calculated result data derived from the original data while keeping the original data provided by the data provider confidential, and to verify the original data of the calculated result data.

[0009] The above objectives are achieved by combinations of features described in the independent claims, and the subordinate claims provide further advantageous specific examples. The reference numerals in parentheses in the claims indicate a correspondence with specific embodiments described later as one aspect, and do not limit the scope of the disclosed technical information.

[0010] One disclosure relating to a data utilization system for achieving the above objective is a data utilization system comprising: a provider terminal that provides raw data; a computing server that generates computation result data by performing calculations on the raw data; and a user terminal that acquires the computation result data, wherein the provider terminal comprises: a provider key generation unit that generates a provider public key as a public key for encryption using homomorphic encryption, and a provider private key which is a private key corresponding to the provider public key; and a raw data encryption unit that encrypts the raw data with the provider public key to generate encrypted raw data; the provider terminal or computing server comprises: a first hash value registration unit that calculates a first hash value which is the hash value of the encrypted raw data and registers the first hash value on the blockchain; the computing server comprises: a secure calculation unit that acquires the encrypted raw data, performs secure calculations on the acquired encrypted raw data and generates computation result data; a server decryption unit that acquires the provider private key and decrypts the computation result data using the provider private key; and a re-encryption unit that acquires a user public key which is a public key generated by the user terminal, re-encrypts the computation result data decrypted by the server decryption unit using the user public key and generates re-encrypted computation result data. The user terminal is a data utilization system comprising: a second hash value calculation unit that acquires the original data to be encrypted and calculates the hash value of the original data; a user key generation unit that generates a user public key and a user private key which is the private key corresponding to the user public key; a verification unit that acquires the first hash value registered on the blockchain and verifies that the first hash value matches the second hash value which is the hash value calculated by the second hash value calculation unit; and a user decryption unit that acquires the re-encryption calculation result data, decrypts the re-encryption calculation result data with the user private key, and acquires the calculation result data.

[0011] In this data utilization system, the original data is not provided to the user's terminal, so the original data provided by the data provider is kept confidential from the data user. On the other hand, the re-encrypted calculation result data is encrypted with the user's public key, so the user's terminal can decrypt the re-encrypted calculation result data with the user's private key and obtain the calculation result data. Therefore, the data user can use the calculation result data.

[0012] Furthermore, the blockchain registers a first hash value, which is the hash value of the encrypted data after the original data has been encrypted. The user's terminal can obtain the encrypted original data, calculate a hash value (second hash value) from the encrypted original data, obtain the first hash value again, and verify that the first and second hash values ​​match to confirm that the original data has not been tampered with. Also, since the data registered on the blockchain for this verification is a hash value, the amount of data can be reduced compared to the encrypted data, making it easier to register to the blockchain compared to when the original data is registered on the blockchain.

[0013] One disclosure relating to a computing server for achieving the above objective is a computing server provided in the above data utilization system. That is, the computing server is a computing server that generates calculation result data by performing calculations on original data, and comprises: a secure calculation unit that performs secure calculations on encrypted original data, which is the original data encrypted with a provider's public key generated by a data provision terminal that provides the original data, and generates calculation result data; a server decryption unit that obtains a provider's private key, which is a private key corresponding to the provider's public key, and decrypts the calculation result data using the provider's private key; and a re-encryption unit that obtains a user's public key generated by a user terminal that uses the calculation result data, re-encrypts the calculation result data decrypted by the server decryption unit using the user's public key, and generates re-encrypted calculation result data, and provides the re-encrypted calculation result data to the user terminal.

[0014] One disclosure relating to a data utilization method for achieving the above objective is a data utilization method that can be implemented by the above data utilization system. The data utilization method is carried out by a provider terminal that provides the original data, a computing server that performs calculations on the original data and generates calculation result data, and a user terminal that acquires the calculation result data, wherein the provider terminal generates a provider public key as a public key for encryption using homomorphic encryption, and generates a provider private key which is the private key corresponding to the provider public key, encrypts the original data with the provider public key to generate encrypted original data, the provider terminal or computing server calculates a first hash value which is the hash value of the encrypted original data and registers the first hash value on the blockchain, the computing server performs a secure calculation on the encrypted original data and generates calculation result data, obtains the provider private key, decrypts the calculation result data using the provider private key, obtains the user public key which is the public key generated by the user terminal, re-encrypts the decrypted calculation result data using the user public key to generate re-encrypted calculation result data, the user terminal acquires the encrypted original data, calculates the hash value of the encrypted original data to use as a second hash value, generates a user public key, and generates a user private key which is the private key corresponding to the user public key, This data utilization method involves obtaining the first hash value registered on the blockchain, verifying the match between the first and second hash values, obtaining the re-encrypted calculation result data, decrypting the re-encrypted calculation result data with the user's private key, and obtaining the calculation result data.

[0015] A diagram showing the configuration of the data utilization system in the first embodiment. A diagram showing the functions performed by the control unit of the provider terminal. A diagram showing the functions performed by the control unit of the computing server. A diagram showing the functions performed by the control unit of the user terminal. A diagram showing the processing related to verification. A diagram showing the processing related to secure computation. A diagram showing the processing related to the utilization of computation results. A diagram showing the configuration of the computing server in the second embodiment.

[0016] <First Embodiment> The embodiments will be described below with reference to the drawings. Figure 1 is a diagram showing the configuration of the data utilization system 10 of the first embodiment. The data utilization system 10 comprises a provider terminal 20, a computing server 30, and a user terminal 40. The data utilization system 10 is a system that provides data users with calculation result data, which is the result of performing predetermined calculations on the original data, while keeping the original data itself confidential from the data users. In addition, the data utilization system 10 is a system that allows data users to verify that the original data of the provided calculation result data has not been tampered with.

[0017] There are no restrictions on the type of source data. For example, data obtained from a vehicle can be used as source data. As an example of using the data utilization system 10, vehicle battery degradation diagnosis can be used. In this example, to diagnose the degradation of a vehicle battery, the system calculates the degree of degradation of the vehicle battery using elapsed days, mileage, and other data necessary for degradation diagnosis as source data, and provides this to the data user.

[0018] The provider terminal 20 is a terminal operated by the data provider who provides the original data. The calculation server 30 is a device that performs predetermined calculations on the original data to generate calculation result data. The user terminal 40 is a terminal operated by the data user who uses the calculation result data. Figure 1 shows one provider terminal 20 and one user terminal 40. However, the data utilization system 10 may have multiple provider terminals 20 and / or user terminals 40.

[0019] Furthermore, the data utilization system 10 includes a blockchain 50. The blockchain 50 is a database stored in a distributed manner across multiple peers. The provider terminal 20, the computing server 30, and the user terminal 40 can send and receive signals to each other via the communication network 60. The provider terminal 20, the computing server 30, and the user terminal 40 can also access the blockchain 50 via the communication network 60.

[0020] The communication network 60 may be either a wireless communication network or a wired communication network, or both. It may also be either a wide-area communication network or a narrow-area communication network, or both. Furthermore, the provider terminal 20, the computing server 30, and the user terminal 40 may be able to communicate directly with each other without going through the communication network 60.

[0021] As shown in Figure 1, the provider terminal 20 comprises a control unit 21, a communication unit 22, and a storage unit 23. The computing server 30 comprises a control unit 31, a communication unit 32, and a storage unit 33. The user terminal 40 comprises a control unit 41, a communication unit 42, and a storage unit 43.

[0022] Each control unit 21, 31, and 41 comprises, as a hardware configuration, at least one of a processor and a circuit. For example, each control unit 21, 31, and 41 can be implemented by a computer equipped with a processor and memory. Alternatively, each control unit 21, 31, and 41 may not include a processor and may be configured with hardware circuits other than a processor, or it may be configured with a processor and hardware circuits other than a processor. When each control unit 21, 31, and 41 performs the functions described below, the data utilization system 10 performs the data utilization method.

[0023] Communication units 22, 32, and 42 transmit and receive signals wirelessly or via wired connections to external devices. Storage units 23, 33, and 43 are sometimes called memory. Storage units 23, 33, and 43 may also be the memory provided by control units 21, 31, and 41. Information can be read from and written to storage units 23, 33, and 43 by control units 21, 31, and 41. Programs executed by control units 21, 31, and 41 may be stored in storage units 23, 33, and 43. The original data is stored in storage unit 23 of the provider terminal 20.

[0024] The control unit 21 of the provider terminal 20 includes, as shown in Figure 2, a provider key generation unit 21A, a source data encryption unit 21B, and a provider secret key provision unit 21C, as functions performed by the hardware configuration of the control unit 21.

[0025] The provider key generation unit 21A generates a public key. The public key generated by the provider key generation unit 21A is hereinafter referred to as the provider public key. The provider key generation unit 21A also generates a private key (hereinafter referred to as the provider private key) corresponding to the provider public key. The provider public key is the key used for encryption using homomorphic encryption.

[0026] The original data encryption unit 21B encrypts the original data stored in the storage unit 23 using the provider's public key generated by the provider key generation unit 21A. The original data encryption unit 21B transmits the encrypted original data (hereinafter referred to as encrypted original data) from the communication unit 22 to the computing server 30. The computing server 30 stores the received encrypted original data in the storage unit 33.

[0027] The provider's private key provision unit 21C obtains the server's public key generated by the computing server 30 via the communication unit 22. The provider's private key provision unit 21C also obtains the provider's private key generated by the provider's key generation unit 21A. The provider's private key provision unit 21C then encrypts the provider's private key with the server's public key. The provider's private key provision unit 21C transmits the encrypted provider's private key to the computing server 30 via the communication unit 22. The computing server 30 is an external device for the provider terminal 20, and transmitting the provider's private key to the computing server 30 is one example of providing the provider's private key to an external device so that the computing server 30 can use it.

[0028] The control unit 31 of the computing server 30 includes, as shown in Figure 3, a first hash value registration unit 31A, a server key generation unit 31B, a secure calculation unit 31C, a server decryption unit 31D, and a re-encryption unit 31E, as functions executed by the hardware configuration of the control unit 31.

[0029] The first hash value registration unit 31A retrieves the encrypted source data transmitted from the provider terminal 20 and stored in the storage unit 33. The first hash value registration unit 31A then calculates a hash value (hereinafter referred to as the first hash value) from the encrypted source data. There are no restrictions on the hash function used to calculate the first hash value. For example, SHA-256 can be used as the hash function. The first hash value registration unit 31A registers the calculated first hash value in the blockchain 50. The first hash value is obtained by the user terminal 40 for verification. The first hash value registration unit 31A transmits the ID of the first hash value to the user terminal 40 so that the user terminal 40 can obtain the first hash value. The first hash value registration unit 31A also transmits the encrypted source data obtained from the storage unit 33 to the user terminal 40.

[0030] The server key generation unit 31B generates a public key. The public key generated by the server key generation unit 31B will be referred to as the server public key. The server key generation unit 31B also generates a private key (hereinafter referred to as the server private key) corresponding to the server public key. The server key generation unit 31B transmits the server public key from the communication unit 32 to the provider terminal 20.

[0031] The secure calculation unit 31C retrieves the original data from the storage unit 33 and performs secure calculations on that original data. Since the original data is encrypted using homomorphic encryption, calculations can be performed without decryption.

[0032] The server decryption unit 31D obtains the encrypted provider's private key transmitted from the provider terminal 20. The provider's private key is encrypted with the server's public key. The server decryption unit 31D decrypts the encrypted provider's private key with the server's private key. This allows the plaintext provider's private key to be obtained.

[0033] Furthermore, the server decryption unit 31D obtains the calculation result (hereinafter referred to as calculation result data) calculated by the secure calculation unit 31C. The calculation result data is data encrypted with the provider's public key. As described above, the provider's private key in plaintext has been obtained. The server decryption unit 31D decrypts the calculation result data with the provider's private key and obtains the calculation result data in plaintext.

[0034] The re-encryption unit 31E obtains the user's public key generated by the user terminal 40. Then, using that user's public key, it re-encrypts the plaintext calculation result data decrypted by the server decryption unit 31D. The re-encryption unit 31E transmits the re-encrypted calculation result data from the communication unit 32 to the user terminal 40.

[0035] The control unit 41 of the user terminal 40 includes, as shown in Figure 4, a second hash value calculation unit 41A, a user key generation unit 41B, a verification unit 41C, and a user decryption unit 41D, as functions performed by the hardware configuration of the control unit 41.

[0036] The second hash value calculation unit 41A obtains the encrypted source data transmitted from the calculation server 30 via the communication unit 42. The second hash value calculation unit 41A calculates a hash value from the encrypted source data using the same hash function used by the first hash value registration unit 31A. Hereinafter, the hash value calculated by the second hash value calculation unit 41A will be referred to as the second hash value.

[0037] The user key generation unit 41B generates a public key. The public key generated by the user key generation unit 41B is hereinafter referred to as the user public key. The user key generation unit 41B also generates a private key (hereinafter referred to as the user private key) corresponding to the user public key. The user key generation unit 41B transmits the generated user public key to the computing server 30 via the communication unit 42.

[0038] The verification unit 41C obtains the first hash value from the blockchain 50. The verification unit 41C also obtains the second hash value calculated by the second hash value calculation unit 41A. Then, it verifies whether the first hash value and the second hash value match.

[0039] The user decryption unit 41D receives the re-encrypted calculation result data transmitted from the calculation server 30 via the communication unit 42. The re-encrypted calculation result data is encrypted with the user's public key. Therefore, the user decryption unit 41D decrypts the re-encrypted calculation result data with the user's private key to obtain the plaintext calculation result data. The user decryption unit 41D stores this plaintext calculation result data in the storage unit 43.

[0040] FIG. 5 is a flowchart showing processes related to verification executed by the control unit 21 of the provider terminal 20, the control unit 31 of the calculation server 30, and the control unit 41 of the user terminal 40.

[0041] In S1, the provider key generation unit 21A generates a provider public key and a provider secret key. S2 and S3 are executed by the original data encryption unit 21B. In S2, the original data is encrypted with the provider public key generated in S21 to obtain encrypted original data. In S3, the encrypted original data is transmitted from the communication unit 22 to the calculation server 30.

[0042] S4, S5, S6, and S7 are executed by the first hash value registration unit 31A of the calculation server 30. In S4, the encrypted original data transmitted from the provider terminal 20 and received by the communication unit 32 is acquired. In S5, the encrypted original data acquired in S4 is transmitted from the communication unit 32 to the user terminal 40. In S6, a first hash value is calculated from the encrypted original data acquired in S4 using a pre-set hash function. In S7, the first hash value calculated in S6 is registered in the blockchain 50.

[0043] S8 and S9 are executed by the second hash value calculation unit 41A of the user terminal 40. In S8, the encrypted original data transmitted in S5 and received by the communication unit 42 is acquired. In S9, a second hash value is calculated from the encrypted original data acquired in S8 using the same hash function as that used in S6. S10 and S11 are executed by the verification unit 41C. In S10, the first hash value is acquired from the blockchain 50. In S11, it is verified whether the second hash value calculated in S9 matches the first hash value acquired in S10.

[0044] FIG. 6 is a flowchart showing processes related to secret calculation executed by the control unit 21 of the provider terminal 20 and the control unit 31 of the calculation server 30.

[0045] S21 and S22 are executed by the server key generation unit 31B. In S21, a server public key and a server secret key are generated. In S22, the server public key generated in S21 is transmitted from the communication unit 32 to the provider terminal 20.

[0046] S23, S24, and S25 are executed by the provider private key providing unit 21C. In S23, the server public key transmitted in S22 and received by the communication unit 22 is obtained from the communication unit 22. In S24, the provider private key generated in S1 is encrypted with the server public key obtained in S23. In S25, the encrypted provider private key obtained in S24 is transmitted to the calculation server 30.

[0047] S26 and S27 are executed by the server decryption unit 31D of the calculation server 30. In S26, the encrypted provider private key transmitted in S25 and received by the communication unit 32 is obtained. In S27, the provider private key obtained in S26 is decrypted with the server private key generated in S21. S28 and S29 are executed by the secret calculation unit 31C. In S28, secret calculation is performed on the encrypted source data obtained in S4 to obtain calculation result data. In S29, the calculation result data obtained in S28 is decrypted using the provider private key decrypted in S27 to obtain plaintext calculation result data.

[0048] FIG. 7 is a flowchart showing the processing related to the use of the calculation result executed by the control unit 31 of the calculation server 30 and the control unit 41 of the user terminal 40.

[0049] S31 and S32 are executed by the user key generation unit 41B. In S31, a user public key and a user private key are generated. In S32, the user public key generated in S31 is transmitted from the communication unit 42 to the calculation server 30.

[0050] S33, S34, and S35 are executed by the re-encryption unit 31E. In S33, the user public key transmitted in S32 and received by the communication unit 32 is obtained from the communication unit 32. In S34, the plaintext calculation result data obtained in S29 is re-encrypted using the user public key obtained in S33 to obtain re-encrypted calculation result data. In S35, the re-encrypted calculation result data obtained in S34 is transmitted from the communication unit 32 to the user terminal 40.

[0051] S36 and S37 are executed by the user decryption unit 41D. In S36, the re-encryption calculation result data transmitted in S35 and received by the communication unit 42 is obtained from the communication unit 42. In S37, the re-encryption calculation result data obtained in S36 is decrypted using the user secret key generated in S31, and the plaintext calculation result data is obtained.

[0052] [Summary of the First Embodiment] In the data utilization system 10 of the first embodiment described above, the original data is not provided to the user terminal 40, so the original data provided by the data provider is kept secret from the data user. On the other hand, the re-encrypted calculation result data is encrypted with the user's public key (S34). Therefore, the user terminal 40 can decrypt the re-encrypted calculation result data with the user's private key and obtain the calculation result data (S37). Thus, the data user can use the calculation result data.

[0053] Furthermore, the blockchain 50 registers a first hash value, which is the hash value of the encrypted data obtained by encrypting the original data (S7). The user terminal 40 can obtain the encrypted original data, calculate a hash value (second hash value) from the encrypted original data (S9), and also obtain the first hash value (S10). By verifying that the first hash value and the second hash value match, it can verify that the original data has not been tampered with (S11). Also, since the data registered in the blockchain 50 for this verification is a hash value, the amount of data can be made smaller than that of encrypted data, making registration to the blockchain 50 easier compared to the case where the original data is registered in the blockchain 50.

[0054] The computing server 30 generates a server public key and a server private key (S21), and the provider terminal 20 encrypts the provider private key with the server public key and provides it to the computing server 30 (S23, S24, S25). The computing server 30 can decrypt the encrypted provider private key with the server private key and obtain the provider private key (S26). In this way, the computing server 30 can obtain the provider private key while reducing the possibility of a third party knowing the provider private key. Then, the computing server 30 can decrypt the calculation result data with this provider private key (S29) and re-encrypt it with the user public key (S33, S34).

[0055] <Second Embodiment> Next, a second embodiment will be described. In this second embodiment and subsequent descriptions, elements having the same reference numerals as those used up to that point are the same as the elements with the same reference numerals in the previous embodiments, unless otherwise specified. Also, when only a part of the configuration is described, the previously described embodiments can be applied to the other parts of the configuration.

[0056] Figure 8 shows the computing server 130 of the second embodiment. The configuration of the control unit 131 of the computing server 130 of the second embodiment differs from that of the control unit 31 of the first embodiment. The control unit 131 includes an isolated environment 134. The isolated environment 134 is an environment generated by hardware. When the isolated environment 134 is generated, the control unit 131 has both the isolated environment 134 and an environment that is not the isolated environment 134. The isolated environment 134 can be generated, for example, by TEE (Trusted Execution Environment) technology. The isolated environment 134 is isolated from the environment that is not the isolated environment 134. The isolated environment 134 can also be called a confidential environment. For example, the processor (for example, CPU) of the control unit 131, a protected area set in a part of the memory, and the communication path between the processor and the protected area of ​​the memory constitute the isolated environment 134.

[0057] In the second embodiment, the server decryption unit 31D and the re-encryption unit 31E are executed in the isolated environment 134. The first hash value registration unit 31A, the server key generation unit 31B, and the secure calculation unit 31C are executed in an environment other than the isolated environment 134.

[0058] Since the re-encryption unit 31E is executed in the isolated environment 134, the risk of leakage of the plaintext provider's private key and the plaintext calculation result data when the server decryption unit 31D obtains the plaintext provider's private key and the plaintext calculation result data, and the re-encryption unit 31E re-encrypts the plaintext calculation result data, can be reduced. Furthermore, since the risk of leakage of the plaintext provider's private key can be reduced, the risk of leakage of the original data that can be decrypted using that plaintext provider's private key can also be reduced.

[0059] In addition, since the re-encryption unit 31E is executed in the isolated environment 134, and other functions are not executed in the isolated environment 134, even if the person operating the computing server 30 is malicious, it becomes difficult for them to retrieve the plaintext calculation result data and the original data outside the isolated environment 134.

[0060] Although embodiments have been described above, the disclosed technology is not limited to the embodiments described above. The following modifications are also included within the scope of disclosure, and further modifications can be made in various ways without departing from the gist of the invention.

[0061] <Modification 1> In the first embodiment, the server key generation unit 31B transmitted the server public key to the provider terminal 20. However, the server key generation unit 31B may register the server public key in the blockchain 50. In this case, the server key generation unit 31B transmits the ID of the server public key to the provider private key provision unit 21C. The provider private key provision unit 21C obtains the server public key from the blockchain 50 based on that ID. By registering the server public key in the blockchain 50, tampering with the server public key is suppressed.

[0062] <Modification 2> In the first embodiment, the provider's private key provision unit 21C transmitted the encrypted provider's private key to the computing server 30. However, the provider's private key provision unit 21C may register the encrypted provider's private key to the blockchain 50. In this case, the provider's private key provision unit 21C transmits the ID of the provider's private key to the server decryption unit 31D. The server decryption unit 31D retrieves the encrypted provider's private key from the blockchain 50 based on that ID.

[0063] Blockchain 50 is a database distributed across multiple peers, or terminals. Registering an encrypted provider's private key in Blockchain 50 means providing the encrypted provider's private key to the peer, which is an external device, so that the computing server 30 can use it.

[0064] Since the provider's private key is encrypted, there is little risk of the plaintext provider's private key being obtained by a third party even if it is registered with Blockchain 50. Furthermore, registration with Blockchain 50 also helps to prevent the encrypted provider's private key from being tampered with.

[0065] <Modification 3> In the first embodiment, the user key generation unit 41B transmitted the user public key to the computing server 30. However, the user key generation unit 41B may also register the user public key to the blockchain 50. In this case, the user key generation unit 41B transmits the ID of the user public key to the re-encryption unit 31E. The re-encryption unit 31E retrieves the user public key from the blockchain 50 based on that ID. By registering the user public key to the blockchain 50, tampering with the user public key is suppressed.

[0066] <Modification 4> In the first embodiment, the source data for encryption was transmitted from the provider terminal 20 to the computing server 30, and the first hash value registration unit 31A of the computing server 30 calculated a first hash value from the encrypted data and registered that first hash value in the blockchain 50. However, the provider terminal 20 may also be equipped with a first hash value registration unit 31A, and the provider terminal 20 may calculate a first hash value from the encrypted data and register that first hash value in the blockchain 50.

[0067] (Disclosure of Technical Ideas) This specification discloses several technical ideas as described in the following paragraphs. Some paragraphs may be written in a multiple dependent form, where subsequent paragraphs optionally refer to preceding paragraphs. Furthermore, some paragraphs may be written in a multiple dependent form, where they refer to other multiple dependent forms. These paragraphs written in multiple dependent forms define several technical ideas.(Technical Concept 1) A data utilization system comprising: a provider terminal (20) that provides raw data; a computing server (30, 130) that performs calculations on the raw data and generates calculation result data; and a user terminal (40) that acquires the calculation result data, wherein the provider terminal comprises: a provider key generation unit (21A) that generates a provider public key as a public key for encryption using homomorphic encryption and generates a provider private key which is a private key corresponding to the provider public key; a raw data encryption unit (21B) that encrypts the raw data with the provider public key and generates encrypted raw data; the provider terminal or the computing server comprises: a first hash value registration unit (31A) that calculates a first hash value which is the hash value of the encrypted raw data and registers the first hash value on the blockchain; the computing server comprises: a secure calculation unit (31C) that acquires the encrypted raw data, performs secure calculations on the acquired encrypted raw data and generates calculation result data; and a server decryption unit (31D) that acquires the provider private key and decrypts the calculation result data using the provider private key. A data utilization system comprising: a re-encryption unit (31E) that acquires a user public key which is a public key generated by the user terminal, re-encrypts the calculation result data decrypted by the server decryption unit using the user public key to generate re-encrypted calculation result data; the user terminal comprises: a second hash value calculation unit (41A) that acquires the original data to be encrypted and calculates the hash value of the original data to be encrypted; a user key generation unit (41B) that generates the user public key and generates a user private key which is a private key corresponding to the user public key; a verification unit (41C) that acquires the first hash value registered in the blockchain and verifies that the first hash value matches the second hash value which is a hash value calculated by the second hash value calculation unit; and a user decryption unit (41D) that acquires the re-encrypted calculation result data, decrypts the re-encrypted calculation result data with the user private key to acquire the calculation result data.(Technical Idea 2) The data utilization system according to Technical Idea 1, wherein the computing server comprises a server key generation unit (31B) that generates a server public key as a public key and a server private key which is a private key corresponding to the server public key, the provider terminal comprises a provider private key provision unit (21C) that acquires the server public key, encrypts the provider private key with the server public key, and provides the encrypted provider private key to an external device so that the computing server can use it, and the server decryption unit decrypts the encrypted provider private key with the server private key to acquire the provider private key. (Technical Idea 3) The data utilization system according to Technical Idea 1 or 2, wherein the server decryption unit and the re-encryption unit are executed in an isolated environment (134) generated by hardware. (Technical Idea 4) The data utilization system according to Technical Idea 2, wherein the server key generation unit registers the server public key with the blockchain, and the provider private key provision unit acquires the server public key from the blockchain. (Technical Idea 5) The data utilization system according to Technical Idea 2 or 4, wherein the provider's private key provisioning unit registers the encrypted provider's private key on the blockchain, and the server decryption unit obtains the encrypted provider's private key from the blockchain. (Technical Idea 6) The data utilization system according to any one of Technical Ideas 1 to 5, wherein the user key generation unit registers the user's public key on the blockchain, and the re-encryption unit obtains the user's public key from the blockchain.(Technical Concept 7) A user terminal that acquires calculation result data showing the result of calculations performed on source data generated externally, comprising: a user key generation unit (41B) that generates a user public key as a public key and a user private key which is a private key corresponding to the user public key; a second hash value calculation unit (41A) that acquires encrypted source data which is the source data encrypted and calculates the hash value of the encrypted source data; a verification unit (41C) that acquires a first hash value which is the hash value of the encrypted source data and is registered in the blockchain, and verifies that the first hash value matches the second hash value which is the hash value calculated by the second hash value calculation unit; and a user decryption unit (41D) that acquires encrypted calculation result data which is data encrypted with the user public key, decrypts the encrypted calculation result data with the user private key and generates the calculation result data. (Technical Idea 8) A method for providing computation result data, comprising: obtaining encrypted source data encrypted with a provider's public key generated by a data provider operating a data provision terminal that provides the encrypted source data; performing a secure computation on the obtained encrypted source data to generate computation result data; obtaining a provider's private key which is a private key corresponding to the provider's public key; decrypting the computation result data using the provider's private key; obtaining a user's public key generated by a user terminal that uses the computation result data; re-encrypting the decrypted computation result data using the user's public key to generate re-encrypted computation result data; and providing the re-encrypted computation result data to the user terminal.

[0068] (Addendum) In the scope of this disclosure or claims, the term “processor” means one or more hardware processors configured to execute the processing defined by computer program code (i.e., one or more instructions of a computer program) contained in a computer program by reading the computer program code each time. In other words, a “processor” is a hardware device that executes one or more programmed processes. Therefore, computer program code can also be said to be software that can define the processing of the processor according to its content. A “processor” can be a general-purpose or specific-purpose processor, and may be, but is not limited to, a CPU, microprocessor, GPU, and DFP (Data Flow Processor).

[0069] In this disclosure or claims, the term “memory” refers to one or more hardware memories that are non-transitional tangible recording media configured to record computer program code and / or data in a manner accessible by a processor. “Memory” can be implemented by memory technologies such as SRAM, SDRAM, non-volatile / flash type memory, or other types of memory. The computer program code that constitutes the program is recorded in memory and executed by the processor, thereby enabling the processor to perform the various functions described above.

[0070] In this disclosure or claims, the term “circuit” refers to a logic circuit as one or more pieces of hardware, configured to perform specific processing defined by a pre-designed circuit configuration. In other words (and, in contrast to “processor”), “circuit” in this disclosure or claims refers to a hardware device that performs specific processing based on a circuit configuration, rather than processing defined by software such as the computer program code described above. For example, “circuit” may include custom ICs such as ASICs (Application Specific Integrated Circuits) and FPGAs (Field Programmable Gate Arrays) designed with Hardware Description Language (HDL). That is, “circuit” in this disclosure or claims includes all hardware circuits except for the processor described above, which performs processing by reading computer program code.

[0071] Furthermore, within the scope of this disclosure or claims, the expression "at least one processor and circuit" should be interpreted as a disjunctive (logical OR) and not as at least one processor and at least one circuit.

Claims

1. A data utilization system comprising: a provider terminal (20) that provides raw data; a computing server (30, 130) that performs calculations on the raw data and generates calculation result data; and a user terminal (40) that acquires the calculation result data, wherein the provider terminal comprises: a provider key generation unit (21A) that generates a provider public key as a public key for encryption using homomorphic encryption and generates a provider private key which is a private key corresponding to the provider public key; a raw data encryption unit (21B) that encrypts the raw data with the provider public key and generates encrypted raw data; the provider terminal or the computing server comprises: a first hash value registration unit (31A) that calculates a first hash value which is the hash value of the encrypted raw data and registers the first hash value on the blockchain; the computing server comprises: a secure calculation unit (31C) that acquires the encrypted raw data, performs secure calculations on the acquired encrypted raw data and generates calculation result data; and a server decryption unit (31D) that acquires the provider private key and decrypts the calculation result data using the provider private key. A data utilization system comprising: a re-encryption unit (31E) that acquires a user public key which is a public key generated by the user terminal, re-encrypts the calculation result data decrypted by the server decryption unit using the user public key to generate re-encrypted calculation result data; the user terminal comprises: a second hash value calculation unit (41A) that acquires the original data to be encrypted and calculates the hash value of the original data to be encrypted; a user key generation unit (41B) that generates the user public key and generates a user private key which is a private key corresponding to the user public key; a verification unit (41C) that acquires the first hash value registered in the blockchain and verifies that the first hash value matches the second hash value which is a hash value calculated by the second hash value calculation unit; and a user decryption unit (41D) that acquires the re-encrypted calculation result data, decrypts the re-encrypted calculation result data with the user private key to acquire the calculation result data.

2. The data utilization system according to claim 1, wherein the computing server comprises a server key generation unit (31B) that generates a server public key as a public key and a server private key which is a private key corresponding to the server public key, the provider terminal comprises a provider private key provision unit (21C) that acquires the server public key, encrypts the provider private key with the server public key, and provides the encrypted provider private key to an external device so that the computing server can use it, and the server decryption unit decrypts the encrypted provider private key with the server private key to acquire the provider private key.

3. The data utilization system according to claim 1 or 2, wherein the server decryption unit and the re-encryption unit are executed in an isolated environment (134) generated by hardware.

4. The data utilization system according to claim 2, wherein the server key generation unit registers the server public key in the blockchain, and the provider private key provision unit obtains the server public key from the blockchain.

5. The data utilization system according to claim 2 or 4, wherein the provider's private key provision unit registers the encrypted provider's private key on the blockchain, and the server decryption unit obtains the encrypted provider's private key from the blockchain.

6. The data utilization system according to claim 1, wherein the user key generation unit registers the user public key on the blockchain, and the re-encryption unit obtains the user public key from the blockchain.

7. A computing server (30, 130) that generates calculation result data by performing calculations on original data, comprising: a secure calculation unit (31C) that performs secure calculation on encrypted original data, which is the original data encrypted with a provider's public key generated by a data providing terminal that provides the original data, and generates calculation result data; a server decryption unit (31D) that obtains a provider's private key which is a private key corresponding to the provider's public key and decrypts the calculation result data using the provider's private key; and a re-encryption unit (31E) that obtains a user's public key generated by a user terminal that uses the calculation result data, re-encrypts the calculation result data decrypted by the server decryption unit using the user's public key, and generates re-encrypted calculation result data, and provides the re-encrypted calculation result data to the user terminal.

8. A data utilization method implemented by a provider terminal (20) that provides raw data, a computing server (30, 130) that performs calculations on the raw data and generates calculation result data, and a user terminal (40) that acquires the calculation result data, wherein the provider terminal generates a provider public key as a public key for encryption using homomorphic encryption, and generates a provider private key which is a private key corresponding to the provider public key, encrypts the raw data with the provider public key to generate encrypted raw data, the provider terminal or the computing server calculates a first hash value which is the hash value of the encrypted raw data, and registers the first hash value on the blockchain, the computing server performs a secure calculation on the encrypted raw data to generate calculation result data, obtains the provider private key, decrypts the calculation result data using the provider private key, obtains the user public key which is a public key generated by the user terminal, re-encrypts the decrypted calculation result data using the user public key to generate re-encrypted calculation result data, the user terminal acquires the encrypted raw data, calculates the hash value of the encrypted raw data to get a second hash value, A data utilization method comprising: generating the user public key and the user private key which is the private key corresponding to the user public key; obtaining the first hash value registered in the blockchain; verifying the agreement between the first hash value and the second hash value; obtaining the re-encryption calculation result data; decrypting the re-encryption calculation result data with the user private key; and obtaining the calculation result data.

Images