device

Abstract

A device according to one aspect of the present disclosure is a device serving as a transmitter of a random extraction protocol that is a secret calculation protocol through which a recipient randomly acquires elements from a table held by the transmitter, the device comprising an execution unit that executes an OT protocol that receives: a second order array obtained by shuffling elements of a first order array representing the table and encrypting the elements by using Vernam cipher; and a random number generated by another device serving as the recipient.

Description

Device

[0001] This disclosure relates to an apparatus.

[0002] A secure computation technique is known for which a receiver receives an element randomly selected from a table (multiplex set) prepared by the sender (for example, Non-Patent Document 1). However, the element received by the receiver is encrypted in a format that can be used for secure computation afterward. Furthermore, the receiver cannot know the value of the element they received, and the sender cannot know the value of the element received by the receiver. Protocols that implement such secure computation techniques are also called "secure sampling protocols," but below we will refer to them as "random sampling protocols."

[0003] Masanori Kii, "Secure Sampling for Differential Privacy Using Small Tables," In: Proceedings of the Computer Security Symposium 2022. Computer Security Symposium 2022. Kumamoto Prefecture, Japan, Oct. 24, 2022, p. 8.

[0004] However, the random sampling protocol described in Non-Patent Document 1 requires the entire protocol to be restarted each time an element is selected. Furthermore, because the elements of the table are encrypted using homomorphic encryption, the size of the table becomes large. As a result, the amount of communication between the sender and receiver is not always efficient.

[0005] This disclosure is made in view of the above points and aims to realize an efficient random sampling protocol.

[0006] An apparatus according to one aspect of the present disclosure is an apparatus that acts as a sender of a random sampling protocol, which is a secure computation protocol in which a receiver randomly obtains elements from a table held by the sender, and comprises an execution unit that executes an OT protocol with inputs of a second ordered array obtained by shuffling and encrypting the elements of a first ordered array representing the table using a Vernum cipher, and a random number generated by another apparatus that acts as the receiver.

[0007] This enables the implementation of an efficient random sampling protocol.

[0008] This figure shows an example of the overall configuration of the random sampling system according to this embodiment. This figure shows an example of the functional configuration of the sender device according to Example 1. This figure shows an example of the functional configuration of the receiver device according to Example 1. This is a sequence diagram showing an example of the random sampling process according to Example 1. This figure shows an example of the functional configuration of the sender device according to Example 2. This figure shows an example of the functional configuration of the receiver device according to Example 2. This is a sequence diagram showing an example of the random sampling process according to Example 2. This figure shows an example of the computer hardware configuration.

[0009] One embodiment of the present invention will be described in detail below with reference to the drawings.

[0010] [Conventional Random Sampling Protocols and Their Problems] In the random sampling protocol described in Non-Patent Literature 1, the recipient obtains a single element through the following steps 1 to 3. However, the sender is assumed to possess a table represented by a multiset. In Non-Patent Literature 1, the protocol implemented through the following steps 1 to 3 is called a two-party secure sampling protocol.

[0011] Step 1: The sender shuffles the elements of the table and encrypts each element using homomorphic encryption.

[0012] Step 2: The sender sends the entire table to the recipient.

[0013] Step 3: The recipient selects one element from the table and discards the others.

[0014] This allows the recipient to retrieve a single element from the table. Moreover, because the elements in the table are shuffled and encrypted, the recipient cannot know the value of the element they retrieved, and the sender cannot know the value the recipient retrieved. Therefore, the recipient can use the element they retrieved for secure computation (e.g., differential privacy).

[0015] However, in order to maintain security with the random sampling protocol described in Non-Patent Document 1, the entire protocol must be restarted each time an element is selected. In fact, suppose a table is sent to a recipient, and the recipient selects and uses two or more elements from the same table. In this case, if the recipient selects the same element from the table two or more times, the recipient can determine that the values ​​of those elements are equal, even if they do not know the values ​​of those elements. In general, the situation in which a recipient selects the same element from the same table two or more times occurs with a fairly high probability, and therefore fails to satisfy the definition of cryptographic security.

[0016] Furthermore, a table encrypted with homomorphic encryption becomes more than twice the size of the original table. In many homomorphic encryption schemes, once a vector is encrypted, it is not possible to read or modify only one element of the vector; all operations must be performed on the vector as a whole. For this reason, zero-padding is often necessary when encrypting a table. In such cases, a table encrypted with homomorphic encryption can become up to a thousand times larger than the original table.

[0017] [Proposed Method] Below, we propose a random sampling system 1 that realizes an efficient random sampling protocol (hereinafter also referred to as the "proposed random sampling protocol"). In the proposed random sampling protocol, one element of an encrypted table is obtained using 1-out of-N OT (Oblivious Transfer). By using 1-out of-N OT, the recipient cannot know elements that they have not selected. For this reason, the proposed random sampling protocol encrypts the elements of the table using the Vernam cipher, which is a very simple encryption method in which the ciphertext is the same size as the plaintext. The Vernam cipher cannot maintain security in situations where other elements encrypted with the same key are transmitted to the recipient, but by using OT, the Vernam cipher can be used securely. Furthermore, since the ciphertext of the Vernam cipher can be considered as a share in additive secret sharing, the sender and receiver can perform secure computation using the elements obtained by the receiver.

[0018] - As background knowledge for the proposed random sampling protocol, we will explain the overview of 1-out-of-N OT. 1-out-of-N OT is a basic two-party secure computation protocol in which two people participate: a sender and a receiver. The sender has N messages (m １ ,m ２ , , m Ｎ The recipient has a number c ∈ {1, ..., N} and sends a message m ｃ The recipient receives the message they selected. ｃ The content of messages other than the selected one cannot be known, and the sender cannot know which message the recipient selected. Note that protocols with similar functionality to 1-out-of-N OT but with lower data usage are sometimes called SPIR (Symmetric Private Information Retrieval).

[0019] [Overall Configuration Example] An example of the overall configuration of the random sampling system 1 according to this embodiment will be described with reference to Figure 1. Figure 1 is a diagram showing an example of the overall configuration of the random sampling system 1 according to this embodiment.

[0020] As shown in Figure 1, the random sampling system 1 according to this embodiment includes a sender device 10 and a receiver device 20. The sender device 10 and the receiver device 20 are connected to each other via a communication network 30, including the Internet.

[0021] The sender device 10 is various devices, equipment, or terminals that act as senders of the random sampling protocol related to the proposed method. Examples of sender devices 10 include PCs (personal computers), smartphones, tablet terminals, wearable devices, in-vehicle devices, game consoles, IoT (Internet of Things) devices, general-purpose servers, etc.

[0022] The receiver device 20 is various devices, equipment, terminals, etc. that serve as the receiver of the random extraction protocol according to the proposed method. As the receiver device 20, for example, a PC, smartphone, tablet terminal, wearable device, in-vehicle device, game device, IoT device, general-purpose server, etc. can be used.

[0023] Note that the overall configuration of the random extraction system 1 shown in FIG. 1 is an example and is not limited thereto. For example, a plurality of sender devices 10 may be included in the random extraction system 1, or a plurality of receiver devices 20 may be included in the random extraction system 1.

[0024] [Example 1] Example 1 will be described below. Hereinafter, assuming that the sender device 10 holds a table represented by the ordered array A consisting of elements of the finite field F, where the number of elements N is the order of the array. Also, hereinafter, the nth element of the ordered array A is represented as A[n]. Note that n may be referred to as an index or the like of the elements of the ordered array A.

[0025] <Functional configuration example (Example 1)> - Functional configuration example of the sender device 10 The functional configuration example of the sender device 10 according to Example 1 will be described while referring to FIG. 2. FIG. 2 is a diagram showing an example of the functional configuration of the sender device 10 according to Example 1.

[0026] As shown in FIG. 2, the sender device 10 according to Example 1 includes a transmission-side processing unit 101 and a storage unit 102. The transmission-side processing unit 101 is realized, for example, by the processing executed by an arithmetic device such as a CPU (Central Processing Unit) of one or more programs installed in the sender device 10. The storage unit 102 is realized, for example, by a storage area of a storage device such as an HDD (Hard Disk Drive), SSD (Solid State Drive), or flash memory.

[0027] The transmission-side processing unit 101 executes various processes on the sender side of the random extraction protocol according to the proposed method. The transmission-side processing unit 101 includes a random number generation unit 111, a permutation generation unit 112, a first array creation unit 113, and an OT protocol execution unit 114.

[0028] The random number generation unit 111 generates a random number m ∈ F. The permutation generation unit 112 generates a permutation π on {0, ···, N - 1}. The first array creation unit 113 creates an ordered array A' by shuffling and encrypting each element of the ordered array A using the random number m and the permutation π. The ordered array A' is an ordered array in which the order of each element of the ordered array A is replaced by the permutation π and each element is encrypted by the Vernam cipher using the random number m as the key. The OT protocol execution unit 114 executes a 1-out-of-N OT protocol with the receiver device 20, where the sender inputs the ordered array A' and the receiver inputs a random number c ∈ {0, ···, N - 1} described later.

[0029] The storage unit 102 stores the ordered array A. In addition to the ordered array A, the storage unit 102 stores various data (e.g., random number m, ordered array A', etc.).

[0030] - Functional configuration example of the receiver device 20 Regarding the functional configuration example of the receiver device 20 according to the first embodiment, it will be described while referring to FIG. 3. FIG. 3 is a diagram showing an example of the functional configuration of the receiver device 20 according to the first embodiment.

[0031] As shown in FIG. 3, the receiver device 20 according to the first embodiment includes a receiving-side processing unit 201 and a storage unit 202. The receiving-side processing unit 201 is realized, for example, by the processing executed by an arithmetic device such as a CPU for one or more programs installed in the receiver device 20. The storage unit 202 is realized, for example, by the storage area of a storage device such as an HDD, SSD, or flash memory.

[0032] The receiving-side processing unit 201 executes various processes on the receiver side of the random extraction protocol according to the proposed method. The receiving-side processing unit 201 includes a random number generation unit 211, an OT protocol execution unit 212, and a result acquisition unit 213.

[0033] The random number generation unit 211 generates a random number c ∈ {0, ···, N - 1}. The OT protocol execution unit 212 executes a 1-out-of-N OT protocol with the sender device 10, where the sender inputs the ordered array A' and the receiver inputs the random number c. The result acquisition unit 213 acquires the execution result A'[c] of the 1-out-of-N OT protocol.

[0034] The memory unit 202 stores various data (e.g., the number of elements N in an ordered array A, a random number c, the execution result A'[c] of the 1-out of-N OT protocol, etc.).

[0035] <Random Sampling Process (Example 1)> An example of the random sampling process according to Example 1 will be explained with reference to Figure 4. Figure 4 is a sequence diagram showing an example of the random sampling process according to Example 1.

[0036] The random number generation unit 111 of the transmitting processing unit 101 generates a random number m ∈ F (step S101).

[0037] The substitution generation unit 112 of the transmitting processing unit 101 generates substitution π on {0, ..., N-1} (step S102).

[0038] The first array creation unit 113 of the transmitting processing unit 101 creates an ordered array A' from an ordered array A using a random number m and a substitution π (step S103). Specifically, the first array creation unit 113 creates an ordered array A' by A' = [A[π(0)] - m, ..., A[π(N-1)] - m]. This means that the order of each element of the ordered array A is substituted by the substitution π, and then each element is encrypted using a Vernam cipher with the random number m as the key.

[0039] The random number generation unit 211 of the receiving-side processing unit 201 generates a random number c ∈ {0, ..., N-1} (step S104).

[0040] The OT protocol execution unit 114 of the transmitting processing unit 101 and the OT protocol execution unit 212 of the receiving processing unit 201 execute a 1-out of N OT protocol, with the OT protocol execution unit 114 taking the ordered array A' as input and the OT protocol execution unit 212 taking the random number c as input (step S105). As a result, the OT protocol execution unit 212 of the receiving processing unit 201 receives A'[c]. Note that any existing 1-out of N OT protocol may be used as the 1-out of N OT protocol.

[0041] The result acquisition unit 213 of the receiving - side processing unit 201 acquires the execution result A'[c] of the 1 - out - of - N OT protocol (step S106). Thereby, the receiver device 20 can obtain A'[c]=A[π(c)]−m. Since A'[c]=A[π(c)]−m can be regarded as a share of the additive secret sharing of the ordered array A, secret calculation can then be performed between the sender device 10 and the receiver device 20.

[0042] According to the definition of the security of the OT protocol, the sender cannot know which element among the elements of the ordered array A' has been received. Also, even if the receiver looks at the element A'[c]=A[π(c)]−m that it has received, it cannot know the value of the original element A[π(c)]. Therefore, the random extraction process according to Example 1 is secure against semi - honest attackers.

[0043] [Example 2] Hereinafter, Example 2 will be described. Elements of the finite field F are transmitted and received between the sender device 10 and the receiver device 20. Often, elements of the finite field F can be represented by about 8 bits or 16 bits. On the other hand, there are existing implementations of OT protocols that can only transmit and receive bit strings of about 128 bits in length all the time. Although it is possible to embed a 16 - bit bit string into a 128 - bit bit string for transmission and reception, in this case, the communication volume will increase.

[0044] Therefore, consider the following measure to minimize the communication volume. For example, assuming that an element of the finite field F is represented by 16 bits, let the ordered array composed of elements of the finite field F be X. At this time, with the key of the Bernam cipher as m∈F, the transmission of the ciphertext A[c]−m obtained by encrypting a certain element A[c] of the ordered array A by the Bernam cipher is divided into the transmission of A[0]−m ０ , ···, A[8−1]−m ８－１ and the transmission of m ｃ −m$. The former 8=(128 / 16) elements can be transmitted in one OT by a method called "packing". Thereby, the receiver can obtain (A[c]−m ｃ )+(m ｃ −m)=A[c]−m, and no other value in the form of A[·]−m can be obtained.

[0045] In the above, we assumed that 128 bits are transmitted and received at once in OT, and 16 bits are required to represent the elements of a finite field F. However, in Example 2, we will describe a case where the amount of communication is minimized under more general settings.

[0046] In the following, we assume that the number of bits transmitted and received at once by OT is at least κ times the number of bits required to represent the elements of a finite field F, where κ is an integer greater than or equal to 1.

[0047] Furthermore, similar to Example 1, let A be an ordered array of element number N composed of elements of a finite field F. However, p zeros are added as elements to the end of the ordered array A so that N is a multiple of κ. Moreover, p is assumed to be a public parameter.

[0048] <Example of Functional Configuration (Example 2)> - Example of Functional Configuration of the Transmitter Device 10 An example of the functional configuration of the transmitter device 10 according to Example 2 will be explained with reference to Figure 5. Figure 5 is a diagram showing an example of the functional configuration of the transmitter device 10 according to Example 2.

[0049] As shown in Figure 5, the transmitter device 10 according to Embodiment 2 has a transmitting-side processing unit 101 and a storage unit 102. The transmitting-side processing unit 101 is realized, for example, by causing one or more programs installed in the transmitter device 10 to be executed by a processing unit such as a CPU. The storage unit 102 is realized, for example, by the storage area of ​​a storage device such as an HDD, SSD, or flash memory.

[0050] The transmitting-side processing unit 101 executes various sender-side processes of the random sampling protocol related to the proposed method. The transmitting-side processing unit 101 includes a random number generation unit 111, a substitution generation unit 112, a first sequence creation unit 113, an OT protocol execution unit 114, and a second sequence creation unit 115. The random number generation unit 111 generates random numbers m, m ０ , , m κ－１ The permutation generation unit 112 generates a permutation π on {0, ..., N-1} such that π(n) = n for N-p ≤ n ≤ N-1. The first array creation unit 113 generates a random number m ０ , , mκ－１ Using the permutation π, an ordered array A' is created by shuffling and encrypting each element of ordered array A in units of κ to form a single ordered array A'. For each of the κ elements of ordered array A, the order of those elements is replaced by the permutation π, and a random number m is also generated. ０ , , m κ－１ Each of the elements is encrypted using a Vernam cipher with each of the keys, and the bit sequences are concatenated to form a single ordered array. The OT protocol execution unit 114 executes a 1-out of-(N / κ) OT protocol with the receiver device 20, where the sender inputs the ordered array A' and the receiver inputs c∈{0, ..., N / κ-1}, which will be described later. The OT protocol execution unit 114 also executes a 1-out of-κ OT protocol with the receiver device 20, where the sender inputs the ordered array B, which will be described later, and the receiver inputs the random number d, which will be described later. The second array creation unit 115 sets the ordered array B = [m ０ -m, ..., m κ－１ Create -m.

[0051] The memory unit 102 stores the sequential array A. In addition to the sequential array A, the memory unit 102 also stores various other data (e.g., random numbers m, m). ０ , , m κ－１ Ordered arrays (such as A' and B) are stored.

[0052] - Example of the Functional Configuration of the Receiver Device 20 An example of the functional configuration of the receiver device 20 according to Embodiment 2 will be explained with reference to Figure 6. Figure 6 is a diagram showing an example of the functional configuration of the receiver device 20 according to Embodiment 2.

[0053] As shown in Figure 6, the receiver device 20 according to Embodiment 2 has a receiving-side processing unit 201 and a storage unit 202. The receiving-side processing unit 201 is realized, for example, by causing one or more programs installed on the receiver device 20 to be executed by a processing unit such as a CPU. The storage unit 202 is realized, for example, by the storage area of ​​a storage device such as an HDD, SSD, or flash memory.

[0054] The receiving-side processing unit 201 performs various receiver-side processes for the random sampling protocol related to the proposed method. The receiving-side processing unit 201 includes a random number generation unit 211, an OT protocol execution unit 212, a result acquisition unit 213, and a splitting unit 214.

[0055] The random number generation unit 211 generates a random number c ∈ {0, ..., N / κ-1} and a random number d ∈ {0, ..., κ-1}. However, if c = N / κ-1, the random number generation unit 211 generates a random number d ∈ {0, ..., κ-p-1}. The OT protocol execution unit 212 executes a 1-out of (N / κ) OT protocol with the sender device 10, where the sender inputs an ordered array A' and the receiver inputs a random number c. The OT protocol execution unit 212 also executes a 1-out of κ OT protocol with the sender device 10, where the sender inputs an ordered array B and the receiver inputs a random number d. The result acquisition unit 213 acquires the execution result A'[c] of the 1-out of (N / κ) OT protocol and the execution result B[d] of the 1-out of κ OT protocol. Furthermore, the result acquisition unit 213 uses the d-th element of the κ elements obtained by dividing A'[c] by the division unit 214, and B[d], to obtain an element (specifically, A[π(c・κ+d)]-m) that has been encrypted using a Vernam cipher for a certain element of the ordered array A. The division unit 214 divides A'[c] into κ elements.

[0056] The memory unit 202 stores various data (e.g., the number of elements N in the ordered array A, public parameter p, random number c, random number d, execution result A'[c] of the 1-out of (N / κ) OT protocol, execution result B[d] of the 1-out of κ OT protocol, etc.).

[0057] <Random Sampling Process (Example 2)> An example of the random sampling process according to Example 2 will be explained with reference to Figure 7. Figure 7 is a sequence diagram showing an example of the random sampling process according to Example 2.

[0058] The random number generation unit 111 of the transmitting processing unit 101 generates m, m ０ , , m κ－１ Generate ∈F (step S201).

[0059] The substitution generation unit 112 of the transmitting processing unit 101 generates a substitution π on {0, ..., N-1} such that π(n) = n for N-p ≤ n ≤ N-1 (step S202). That is, the substitution generation unit 112 generates a substitution π that does not change the order of the last p zeros in the ordered array A.

[0060] The first array creation unit 113 of the transmitting processing unit 101 generates a random number m ０ , , m κ－１ Using and substitution π, an ordered array A' is created by substituting and encrypting each element of ordered array A in units of κ elements (step S203). Specifically, the first array creation unit 113 creates κ elements A[π(i・κ+j)]-m for each i=0, ..., N / κ-1. ｊ Let A'[i] be the element obtained by concatenating (j=0, ..., κ-1) as a bit string, and create an ordered array A' by A' = [A'[0], ..., A'[N / κ-1]]. Note that if the concatenation of bit strings is represented by ||, then A'[i] = A[π(i・κ+0)] - m ０ ||・・・||A[π(i・κ+κ−1)]−m κ－１ This is achieved by substituting the order of each of the κ elements of the ordered array A by permutation π, and also by generating a random number m. ０ , , m κ－１ This means encrypting each of the κ elements using the Vernam cipher with each key, and then concatenating the bit sequences of the κ ciphertexts.

[0061] The random number generation unit 211 of the receiving processing unit 201 generates a random number c ∈ {0, ..., N / κ-1} (step S204).

[0062] The OT protocol execution unit 114 of the transmitting processing unit 101 and the OT protocol execution unit 212 of the receiving processing unit 201 execute the 1-out of (N / κ) OT protocol, with the OT protocol execution unit 114 taking the ordered array A' as input and the OT protocol execution unit 212 taking the random number c as input (step S205). As a result, the OT protocol execution unit 212 of the receiving processing unit 201 receives A'[c]. Note that any existing 1-out of (N / κ) OT protocol may be used.

[0063] The result acquisition unit 213 of the receiving processing unit 201 acquires the execution result A'[c] of the 1-out of-(N / κ) OT protocol (step S206). As a result, the receiving device 20 calculates A'[c] = A[π(c・κ+0)]-m ０ ||・・・||A[π(c・κ+κ−1)]−m κ－１ You can obtain this.

[0064] The division section 214 of the receiving processing unit 201 divides A'[c] into κ elements A[π(c・κ+j)]-m ｊ The signal is divided into (j=0, ..., κ-1) (step S207). As a result, the receiver device 20 receives A[π(c・κ+j)]-m ｊ (j=0, ..., κ-1) can be obtained.

[0065] The second array creation unit 115 of the transmitting processing unit 101 determines the sequential array B = [m ０ -m, ..., m κ－１ Create -m (step S208).

[0066] The random number generation unit 211 of the receiving processing unit 201 generates a random number d ∈ {0, ..., κ-1} (step S209). However, if c = N / κ-1, the random number generation unit 211 generates a random number d ∈ {0, ..., κ-p-1}.

[0067] The OT protocol execution unit 114 of the transmitting processing unit 101 and the OT protocol execution unit 212 of the receiving processing unit 201 execute the 1-out of κ OT protocol, with the OT protocol execution unit 114 taking the ordered array B as input and the OT protocol execution unit 212 taking the random number d as input (step S210). As a result, the OT protocol execution unit 212 of the receiving processing unit 201 receives B[d]. Note that any existing 1-out of κ OT protocol may be used as the 1-out of κ OT protocol.

[0068] The result acquisition unit 213 of the transmitting processing unit 101 acquires the execution result B[d] of the 1-out of-κ OT protocol (step S211). As a result, the receiving device 20 determines that B[d] = m ｄ -m can be obtained.

[0069] The result acquisition unit 213 of the transmitting processing unit 101 calculates (A[π(c・κ+d)]-m ｄ |) + (m ｄ Step S212 obtains A[π(c・κ+d)]-m. As a result, the receiver device 20 can obtain A[π(c・κ+d)]-m. Similar to Example 1, A[π(c・κ+d)]-m can be considered as a share of the additive secret sharing of the ordered array A, and thereafter, it becomes possible to perform a secret calculation between the sender device 10 and the receiver device 20. Also, similar to Example 1, the random sampling process according to Example 2 is secure against semi-honest attackers. Moreover, in the random sampling process according to Example 2, it is possible to reduce the number of elements of OT from N to N / κ+κ, and the amount of communication can be made more efficient compared to Example 1.

[0070] [Hardware Configuration Example] The sender device 10 and receiver device 20 according to this embodiment are realized, for example, by the hardware configuration of the computer 500 shown in Figure 8. Figure 8 is a diagram showing an example of the hardware configuration of the computer 500.

[0071] The computer 500 shown in Figure 8 includes an input device 501, a display device 502, an external interface 503, a communication interface 504, a RAM (Random Access Memory) 505, a ROM (Read Only Memory) 506, an auxiliary storage device 507, and a processor 508. Each of these hardware components is connected to the others via a bus 509 for communication.

[0072] The input device 501 is, for example, a keyboard, mouse, touch panel, physical buttons, etc. The display device 502 is, for example, a display, display panel, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502.

[0073] The external I / F 503 is an interface with external devices such as the recording medium 503a. Examples of the recording medium 503a include flexible disks, CDs (Compact Discs), DVDs (Digital Versatile Disks), SD memory cards (Secure Digital memory cards), and USB (Universal Serial Bus) memory cards.

[0074] The communication interface 504 is an interface for connecting to the communication network 30. The RAM 505 is a volatile semiconductor memory (storage device) that temporarily holds programs and data. The ROM 506 is a non-volatile semiconductor memory (storage device) that can retain programs and data even when the power is turned off. The auxiliary storage device 507 is, for example, a storage device (storage device) such as an HDD, SSD, or flash memory. The processor 508 is, for example, an arithmetic unit such as a CPU.

[0075] The sender device 10 and receiver device 20 according to this embodiment can realize the random sampling process according to Embodiments 1 and 2 by having the hardware configuration of the computer 500 shown in Figure 8. Note that the hardware configuration of the computer 500 shown in Figure 8 is just an example and is not limited thereto. For example, the computer 500 may have multiple auxiliary storage devices 507 and multiple processors 508, it may not have some of the illustrated hardware, or it may have various hardware other than the illustrated hardware.

[0076] [Summary] As described above, the random sampling system 1 according to this embodiment uses OT and a Vernam cipher to realize an efficient random sampling protocol with significantly less communication volume compared to existing random sampling protocols.

[0077] The present invention is not limited to the embodiments specifically disclosed above, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0078] 1 Random Sampling System 10 Sender Device 20 Receiver Device 30 Communication Network 101 Transmitter Processing Unit 102 Storage Unit 111 Random Number Generation Unit 112 Replacement Generation Unit 113 First Sequence Creation Unit 114 OT Protocol Execution Unit 115 Second Sequence Creation Unit 201 Receiver Processing Unit 202 Storage Unit 211 Random Number Generation Unit 212 OT Protocol Execution Unit 213 Result Acquisition Unit 214 Splitting Unit 500 Computer 501 Input Device 502 Display Device 503 External I / F 503a Recording Medium 504 Communication I / F 505 RAM 506 ROM 507 Auxiliary Storage Device 508 Processor 509 Bus

Claims

1. A device that acts as a sender of a random sampling protocol, which is a secure computation protocol in which a receiver randomly obtains elements from a table held by the sender, the device having an execution unit that executes an OT protocol that takes as input a second ordered array obtained by shuffling and encrypting the elements of a first ordered array representing the table using a Vernum cipher, and a random number generated by another device that acts as the receiver.

2. A device that acts as a receiver for a random sampling protocol, which is a secure computation protocol in which the receiver randomly obtains elements from a table held by the sender, comprising: a generation unit that generates random numbers from the index of elements of a first ordered array representing the table; an execution unit that executes an OT protocol with input the random numbers and a second ordered array created by shuffling the elements of the first ordered array and encrypting them using a Vernum cipher performed by another device acting as the sender; and an acquisition unit that obtains the element of the index represented by the random numbers from the elements of the second ordered array as a result of the OT protocol.

3. A device that acts as a sender of a random sampling protocol, which is a secure computation protocol in which a receiver randomly obtains elements from a table held by the sender, comprising: a first creation unit that creates a second ordered array by shuffling the elements, encrypting them using a Vernum cipher with a predetermined number of keys, and concatenating bit sequences for each of a predetermined number of elements in a first ordered array representing the table; a first execution unit that executes a first OT protocol with the second ordered array and a first random number generated by another device that acts as the receiver as input; a second creation unit that creates a third ordered array whose elements are values ​​obtained by subtracting a predetermined random number from each of the predetermined number of keys; and a second execution unit that executes a second OT protocol with the third ordered array and a second random number generated by the other device as input.

4. A device that acts as a receiver for a random sampling protocol, which is a secure computation protocol in which the receiver randomly obtains elements from a table held by the sender, comprising: a first generation unit that generates a first random number from an index greater than or equal to 0 and less than a predetermined integer; a first execution unit that executes a first OT protocol with inputs the first random number and a second ordered array created by shuffling a predetermined number of elements of a first ordered array representing the table, encryption using a Vernum cipher with the predetermined number of keys, and concatenation of bit strings performed by another device acting as the sender; a second generation unit that generates a second random number from an index greater than or equal to 0 and less than a predetermined number of integers; and a second execution unit that executes a second OT protocol with inputs the second random number and a third ordered array created by the other device using the values ​​obtained by subtracting a predetermined third random number from each of the predetermined number of keys as elements. An apparatus comprising: an acquisition unit that uses the results of the first OT protocol and the results of the second OT protocol to acquire elements from the elements of the first ordered array, where the index element is determined by the first random number, the second random number, the integer represented by the predetermined number, and the permutation that realizes the shuffling, and is encrypted with the third random number.

Images