JP5480828B2 - Secret sort system, secret sort device, secret sort method, secret sort program - Google Patents

Description

  The present invention relates to a cryptographic application technique, and more particularly to a secret sort system, a secret sort device, a secret sort method, and a secret sort program that perform function calculation without revealing input data.

  As a method of obtaining a specific calculation result without restoring the encrypted numerical value, for example, there is a method called secret calculation in Non-Patent Document 1. In the method of Non-Patent Document 1, encryption is performed such that numerical fragments are distributed to three secret computing devices, and addition / subtraction, constant sum, multiplication, constant multiplication, logical operation (negative, logical product) are performed without restoring the numerical values. , Logical sum, exclusive logical sum), and data format conversion (integer, binary number) can be held in a state of being distributed to the three secret computing devices, that is, encrypted. Non-Patent Document 2 is characterized in that the correspondence between values before and after sorting is calculated so that no one knows, and a plurality of encrypted data are sorted by values calculated from plaintext. A secret sorting method for calculating the resulting ciphertext has been proposed. In Non-Patent Document 2, an arbitrary comparison sort such as a quick sort is realized on a secret calculation without increasing the number of comparisons.

Koji Senda, Hiroki Hamada, Igarashi Univ., Katsumi Takahashi, “Reconsideration of Lightweight Verifiable 3-Party Secret Function Calculation”, In CSS, 2010. Hiroki Hirota, Dai Igarashi, Koji Senda, Katsumi Takahashi, “Random replacement protocol for computing three-party secret functions”, In CSS, 2010.

  However, the prior art is an algorithm whose behavior is determined according to the result of comparing data while being encrypted, and can be applied only to a sorting algorithm based on the comparison. For this reason, when the number of input data is n, there is a problem that the calculation time cannot be made better than O (n log n). An object of the present invention is to realize a sorting algorithm that is not based on comparison on a secret calculation.

  The secret sort system of the present invention is composed of three or more secret sort devices, and is a table in which the records of Table X are rearranged from Table [X] in which each element of Table X consisting of M records is secretly distributed. Find the secret-distributed table corresponding to. Here, M is an integer of 2 or more, [] is a symbol indicating information in which information in parentheses is secretly distributed for each element, and c is a sequence of different M values. It is information that can uniquely determine the number after sorting. For example, c may be information having M elements in which different values from 1 to M are arranged according to the order after sorting.

The secret sort system of the present invention includes at least random replacement means, decryption means, and sort means. The random replacement means receives the information [c] and the table [X], and maintains the correspondence between the M elements of the information [c] and the M records of the table [X]. Random substitution is performed, and information [c _R ] and a table [X _R ] after random substitution are obtained. The decoding means decodes information [c _R ] to obtain information c _R. The sorting means rearranges the records in the table [X _R ] in the order indicated by the information c _R to obtain the table [X _S ].

  According to the secret sort system of the present invention, it is possible to perform random replacement between records while the rearranged position values are correct. On the other hand, since the correspondence before and after random replacement is not known by performing random replacement between records first, it becomes impossible to track records by random replacement. Therefore, the rearranged position can be decoded without leaking information. Therefore, after that, it is only necessary to move the records in the order after the sorted sort. That is, a sorting algorithm that is not based on comparison can be realized on the secret calculation.

The figure which shows the function structural example of the secret sort system of this invention. The figure which shows the processing flow of the secret sort system of this invention. The figure which shows the processing flow of the secret sort system of the modification 1. The figure which shows the processing flow of the secret sort system of the modification 2 and the modification 3. It shows an exemplary functional configuration of a secret sharing apparatus 100 _n available for private sorting system of the present invention. The figure which shows the example of the 1st process flow of random substitution. The figure which shows the 2nd processing flow example of random substitution.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

FIG. 1 shows a functional configuration example of the secret sort system according to the first embodiment. FIG. 2 shows a processing flow of the secret sort system according to the first embodiment. The secret sort system according to the first embodiment is composed of at least N secret sort apparatuses 10 ₁ ,..., 10 _N connected by a network 1000, and each element of the table X composed of M records is secretly distributed. From [X], a secret-distributed table corresponding to the table in which the records of Table X are rearranged is obtained. M is an integer greater than or equal to 2, N is an integer greater than or equal to 3, m is an integer greater than or equal to 1 and less than or equal to M, n is an integer greater than or equal to 1 and less than or equal to N, and [] is information in which information in parentheses is secretly distributed element by element , Superscript T is a transposition symbol, c is a sequence of different M values, and information that can uniquely determine the number after sorting even if random replacement between records is performed. . For example, c may be information having M elements in which different values from 1 to M are arranged according to the order after sorting.

The secret sort device 10 _n includes a sort control unit 300 _n , a secret sharing device 100 _n , and a recording unit 190 _n . The secret sharing apparatus 100 _n performs individual secret calculations necessary for the processing of the first embodiment in accordance with instructions from the sort control unit 300 _n . Individual secret calculations required for the processing of the present invention include secret sharing, decryption, and limited shuffle. However, the present invention efficiently sorts using these secret calculations, and is not an invention characterized by the secret calculation itself. Therefore, an example of the secret calculation will be described later, and a description thereof will be omitted to facilitate understanding of the points of the present invention. Note that the secret calculation method to be described later is one example, and does not limit the secret calculation that can be used in the first embodiment. The recording unit 190 _n is a component that records information necessary for processing of the secret sort device 10 _n . The selection means 105 shown in FIG. 1 is used in the secret calculation described later, but may not be provided depending on the secret calculation to be used.

In the first embodiment, processing after the order after sorting is given in a secret-distributed state will be described. That is, the information c described above is given in a secret-distributed state (information [c]), and the records are rearranged in the order indicated by the information [c]. For example, if c = (4, 2, 5, 1, 3) ^T , the first record moves to the fourth, the second record moves to the second, and the third record moves to the fifth. The fourth record moves to the first, and the fifth record moves to the third.

The sort control unit 300 _n of each secret sort device 10 _n includes a random replacement unit 310 _n , a decryption unit 320 _n , and a sort unit 330 _n . The random permutation unit 310 (not shown) is random permutation unit ₃₁₀ 1 of the secret sorting systems, ..., is composed of 310 _N, the decoding unit 320 (not shown) decoding unit ₃₂₀ 1, ..., 320 _N The sorting means 330 (not shown) is composed of sorting units 330 ₁ ,..., 330 _N.

The random replacement means 310 randomly replaces records by secret calculation while maintaining the correspondence between the M elements of the information [c] and the M records of the table [X], and randomly replaces the information [c _R ] And table [X _R ] are obtained (S310). Specifically, the random replacement units 310 ₁ ,..., 310 _N (random replacement means 310) are randomized by the same bijection to the secret-distributed information [c] and the secret-distributed table [X]. The replacement is executed by the secret sharing apparatus 100 ₁ ,..., 100 _N.

The decoding unit 320 decodes the information [c _R ] to obtain the information c _R (S320). More specifically, the decryption units 320 ₁ ,..., 320 _N (decryption means 320) cause the secret sharing apparatuses 100 ₁ ,..., 100 _N to decrypt the secret-distributed information [c _R ], and the information c _{Get R.}

The sorting unit 330 rearranges the records in the table [X _R ] in the order indicated by the information c _R to obtain the table [X _S ]. More specifically, the sorting units 330 ₁ ,..., 330 _N (sorting unit 330) rearrange the records in the table [X _R ] in the order indicated by the information c _R to obtain the table [X _S ].

  According to the secret sort system of the first embodiment, the values of the positions after the rearrangement are kept correct, and the records are randomly replaced before the rearrangement. In addition, by performing random replacement between records first, it becomes impossible to know the correspondence before and after random replacement, making it impossible to track records. Therefore, the rearranged position can be decoded without leaking information. In other words, only c is decoded in the middle of the calculation, but c is a list of different M values, and information that can uniquely determine the number after sorting even if random replacement between records is performed. Since it is a value (for example, a value obtained by randomly rearranging integers from 1 to M), significant information cannot be obtained from the decoded value. Therefore, after that, it is only necessary to move the records in the order after the sorted sort. That is, a sorting algorithm that is not based on comparison can be realized on the secret calculation.

[Modification 1]
In the first modification, in addition to the definition of the first embodiment, k and D are integers, d is an integer between 1 and D, m is an integer between 1 and M, x ₁ ,..., X _M is a record in Table X , Y ₁ ,..., Y _D are the sorts of orders y ₁ <... <Y _D in which _D is defined, x _m (k) is the kth data of the record x _m , y ₁ ,. one of the values of _{D, a m} is the value of _x m (k). Then, it will be described including the process of obtaining the table [X] the k-th information for sorting such that ascending order based on the values of the data record x _m [c].

The configuration of the secret sort system of this modification is also shown in FIG. The processing flow of the secret sort system of this modification is shown in FIG. In this modification, the sort control unit 300 _n of each secret sort device 10 _n includes a random replacement unit 310 _n , a decryption unit 320 _n , a sort unit 330 _n , a matrix generation unit 340 _n , a column vector conversion unit 350 _n , a column vector. A calculation unit 360 _n , a matrix conversion unit 370 _n , a matrix calculation unit 380 _n , and a sort information calculation unit 390 _n are provided. The matrix generation means 340 (not shown) of the secret sort system is composed of matrix generation units 340 ₁ ,..., 340 _N , and the column vector conversion means 350 (not shown) is a column vector conversion unit 350 ₁ , , 350 _N , column vector calculation means 360 (not shown) is constituted by column vector calculation sections 360 ₁ ,..., 360 _N , and matrix conversion means 370 (not shown) is matrix conversion section 370. ₁ ,..., 370 _N , matrix calculation means 380 (not shown) is constituted by matrix calculation units 380 ₁ ,..., 380 _N , and sort information calculation means 390 (not shown) is sort information calculation. part ₃₉₀ 1, ..., composed of 390 _N.

Matrix generation unit _340, a m = _{y d} or was confirmed by secure _computing, a m = _{y d} if _{H md = 1, a m ≠} y d if _{H md} = a 0 _{H md} m rows d A matrix [H] of M rows and D columns as column elements is generated (S340). More specifically, the matrix generation units 340 ₁ ,..., 340 _N (matrix generation means 340) cause the secret sharing apparatuses 100 ₁ ,..., 100 _N to check whether a _m = y _d by secret calculation, and a _m If y = _d , H _md = 1, and if a _m ≠ y _d , a matrix [H] of M rows and D columns, with H _md being H _md = 0 and having m _md = d elements, is generated. For example, M = 5, D = 3, y ₁ = 0, y ₂ = 1, y ₃ = 2, x ₁ (k) = 2, x ₂ (k) = 1, x ₃ (k) = 2 , X ₄ (k) = 0, x ₅ (k) = 1, a ₁ = y ₃ , a ₂ = y ₂ , a ₃ = y ₃ , a ₄ = y ₁ , a ₅ = y ₂ ,

It becomes. In the case of this example, the matrix generation means 340 obtains a matrix [H] obtained by secretly sharing each element of the matrix H of Expression (1).

If D = 2, y ₁ = 0, y ₂ = 1, whether [a _m ] = 0 is obtained by negating [a _m ], and whether [a _m ] = 1 is [ a _m ] is obtained as it is. Therefore, in step S340, it is not necessary to confirm whether a _m = y _d by a secret calculation, and [H _m1 ] = [1-a _m ], [H _m2 ] = [a _m ] may be set. Thus, depending on how the values of D and y ₁ ,..., Y _D are selected, it may not be necessary to confirm whether a _m = y _d by a secret calculation.

In addition, when confirming whether a _m = y _d by a secret calculation, it is realizable if the technique of the logic circuit accumulated as a prior art is used. For example, the following may be confirmed by negating the logical sum of the exclusive OR of each bit expanded by 2 bits.

C = 1-{(a _mB [∨] y _dB ) ∨ ... ∨ (a _m1 [∨] y _d1 )} (1)
However, [∨] is a symbol indicating an exclusive OR (XOR), ∨ symbols indicating the logical sum _{(OR), a mb} is b-th bit value from the bottom of _{a m} when the two-bit _{expansion, y db} the b-th bit value from the bottom of y _d when the 2-bit expansion, B is the number of digits a _m and y _d when the 2-bit expansion. In the formula (1), if C = 1, a _m = y _d (true), and if C = 0, a _m ≠ y _d (false). In addition, since each calculation of Expression (1) is shown in an example of secret calculation described later, the calculation of Expression (1) can be executed by secret calculation, and secret-distributed [C] is obtained. Therefore, if the branch after confirmation is also kept secret, the secret calculation using [C] may be further combined. Note that the secret calculation described later covers the basic calculation methods for secret sharing of numerical values, decryption of secret-distributed fragments, four arithmetic operations of secret-distributed numerical values, and logical operations for each secret-distributed bit. ing. Therefore, if the logic circuit technique accumulated as the conventional technique is used, a desired calculation can be executed by a combination of secret calculation methods to be described later, like the above-described method of confirming equality.

The column vector conversion means 350 obtains a column vector [h] of the number of elements MD by connecting each column of the matrix [H] vertically from top to bottom in order from the left column (S350). More specifically, the column vector conversion unit 350 ₁ ,..., 350 _N (column vector conversion means 350) converts the matrix [H] into the column vector [h] while maintaining the secret sharing state. For example, in the case of the matrix H in equation (1),
h = (0,0,0,1,0,0,1,0,0,1,1,0,1,0,0) ^T (2)
It becomes. In this example, the column vector conversion unit 350 obtains a column vector [h] obtained by secretly sharing each element of the column vector h in Expression (2).

The column vector calculation means 360 obtains a column vector [u] whose i-th element is the sum from the first element to the i-th element of the column vector [h] by secret calculation (S360). More specifically, the column vector calculation unit 360 ₁ ,..., 360 _N (column vector calculation means 360) includes the secret sharing apparatus 100 ₁ ,..., 100 _N and the i-th element is the column vector [h]. A column vector [u] that is the sum from the first element to the i-th element is obtained by a secret calculation. For example, in the case of the column vector h in equation (2),
u = (0,0,0,1,1,1,2,2,2,3,4,4,5,5,5) ^T (3)
It becomes. In this example, the column vector calculation unit 360 obtains a column vector [u] obtained by secretly sharing each element of the column vector u in Expression (3).

The matrix conversion unit 370 generates a matrix [G] of M rows and D columns by dividing the column vector [u] into M elements and arranging D column vectors in order from the left (S370). More specifically, the matrix conversion units 370 ₁ ,..., 370 _N (matrix conversion unit 370) convert the column vector [u] into the matrix [G] while maintaining the secret sharing state. For example, in the case of the column vector u in equation (3),

It becomes. In the case of this example, the matrix conversion unit 370 obtains a matrix [G] obtained by secretly sharing each element of the matrix G in Expression (4).

The matrix calculation means 380 obtains a matrix [E] of M rows and D columns having a product of each element of the matrix [G] and the matrix [H] as an element by secret calculation (S380). M rows More specifically, the matrix calculator ₃₈₀ 1, ..., is 380 _N, the secret sharing apparatus ₁₀₀ 1, ..., to 100 _N, to the product of each element elements of the matrix [G] and the matrix [H] The matrix [E] of D columns is obtained by secret calculation. For example, in the case of the matrix G of Equation (4) and the matrix H of Equation (1),

It becomes. In the case of this example, the matrix calculation means 380 obtains a matrix [E] obtained by secretly sharing each element of the matrix E in Expression (5).

The sort information calculation means 390 obtains the sum of elements for each row of the matrix [E] by secret calculation, and sets information [c] as information arranged in the order of rows using the respective sums as elements. More specifically, the sorting information calculation unit ₃₉₀ 1, ..., 390 _N (sorting information calculating unit 390) is, secret sharing apparatus ₁₀₀ 1, ..., to 100 _N, the sum of the elements of each row of the matrix [E] Information [c] is obtained from information arranged in the order of rows with each sum as an element. The information [c] obtained in this way corresponds to the information [c] given in the first embodiment. For example, in the case of the matrix E in Equation (5),
c = (4, 2, 5, 1, 3) ^T (6)
It becomes. In this example, the sort information calculation unit 390 obtains information [c] obtained by secretly sharing each element of the information c in Expression (6).

  The random replacement means 310, the decoding means 320, and the sorting means 330 are the same as in the first embodiment, and steps S310, S320, and S330 are also the same as in the first embodiment. That is, the secret sort system according to the present modification can achieve the same effect as the first embodiment with respect to sorting.

Next, the calculation time required for sorting is evaluated. If each [a _m ] can be calculated in M-independent time, H in O (M) time, M random permutations in O (M) time, and multiplication and addition in M-independent time The total calculation time is O (M). For example, if the random replacement of Non-Patent Document 2 is used in the secret function calculation of Non-Patent Document 1 and D = 2, whether [a _m ] = 0 is obtained by negating [a _m ], and [a _m ] = 1 is obtained with the value of [a _m ] as it is. Therefore, [H] can be calculated by [a _m ] and its negation, and random replacement is also in linear time O (M), so that the whole can be realized in linear time O (M). That is, since the secret sorting system of the first embodiment can realize a sorting algorithm that is not based on comparison on the secret calculation, if the information [c] is obtained as in this modification, the sorting is performed in the calculation time of O (n). It is possible to provide a secret calculation algorithm to be performed.

[Modification 2]
In the second modification, in addition to the definition of the first embodiment, k, B, and D are integers, b is an integer of 1 to B, d is an integer of 1 to D, m is an integer of 1 to M, x ₁ ,..., X _M is a record in Table X, x _m (k) is the k-th data of record x _m and is a B-digit D-ary value, and a _bm is the b-th digit from the lower order of x _m (k) The value of Then, it will be described including the process of obtaining the table [X] the k-th information for sorting such that ascending order based on the values of the data record x _m [c]. In addition, decomposition to D-adic numbers by secret calculation is shown in Reference 1 (Chao Ning, Qiuliang Xu, “Multiparty Computation for Modulo Reduction without Bit-Decomposition and a Generalization to Bit-Decomposition”, ASIACRYPT 2010, pp483-500.) The method shown in FIG.

The configuration of the secret sort system of this modification is also shown in FIG. The processing flow of the secret sort system of this modification is shown in FIG. In this modification, the sort control unit 300 _n of each secret sort device 10 _n includes a random replacement unit 310 _n , a decryption unit 320 _n , a sort unit 330 _n , a matrix generation unit 340 _n , a column vector conversion unit 350 _n , a column vector. A calculation unit 360 _n , a matrix conversion unit 370 _n , a matrix calculation unit 380 _n , and a sort information calculation unit 390 _n are provided. The matrix generation means 340 (not shown) of the secret sort system is composed of matrix generation units 340 ₁ ,..., 340 _N , and the column vector conversion means 350 (not shown) is a column vector conversion unit 350 ₁ , , 350 _N , column vector calculation means 360 (not shown) is constituted by column vector calculation sections 360 ₁ ,..., 360 _N , and matrix conversion means 370 (not shown) is matrix conversion section 370. ₁ ,..., 370 _N , matrix calculation means 380 (not shown) is constituted by matrix calculation units 380 ₁ ,..., 380 _N , and sort information calculation means 390 (not shown) is sort information calculation. part ₃₉₀ 1, ..., composed of 390 _N.

First, the sort control units 300 ₁ ,..., 300 _N initially set b = 1 (S301).

Matrix generation unit _340, the _a bm = d-1 or was confirmed by secure _{computing, a} bm = d-1 if _{H md = 1, a bm ≠} d-1 if _{H md} = 0 a is _{H md} A matrix [H] of M rows and D columns as elements of m rows and d columns is generated (S340). More specifically, the matrix generation units 340 ₁ ,..., 340 _N (matrix generation means 340) cause the secret sharing apparatuses 100 ₁ ,..., 100 _N to check whether a _bm = d−1 by secret calculation, and a _{If bm} = d−1, then H _md = 1, and if a _bm ≠ d−1, a matrix [H] of M rows and D columns with H _md being H _md = 0 and m rows and d columns as elements is generated. In this modification, y _{d of} modification 1 is changed to y _d = d−1.
This corresponds to the setting.

In particular, when D = 2, whether [a _bm ] = 0 is obtained by negating [a _bm ], and whether [a _bm ] = 1 is obtained as it is with the value of [a _bm ]. Therefore, in step S340, it is not necessary to confirm whether a _m = d-1 by secret calculation, and [H _m1 ] = [1-a _m ] and [H _m2 ] = [a _m ] may be set. As described above, depending on the value of D, it may not be necessary to confirm whether a _m = d−1 by secret calculation.

The column vector conversion means 350 obtains a column vector [h] of the number of elements MD by connecting each column of the matrix [H] vertically from top to bottom in order from the left column (S350). More specifically, the column vector conversion unit 350 ₁ ,..., 350 _N (column vector conversion means 350) converts the matrix [H] into the column vector [h] while maintaining the secret sharing state.

The column vector calculation means 360 obtains a column vector [u] whose i-th element is the sum from the first element to the i-th element of the column vector [h] by secret calculation (S360). More specifically, the column vector calculation unit 360 ₁ ,..., 360 _N (column vector calculation means 360) includes the secret sharing apparatus 100 ₁ ,..., 100 _N and the i-th element is the column vector [h]. A column vector [u] that is the sum from the first element to the i-th element is obtained by a secret calculation.

The matrix conversion unit 370 generates a matrix [G] of M rows and D columns by dividing the column vector [u] into M elements and arranging D column vectors in order from the left (S370). More specifically, the matrix conversion units 370 ₁ ,..., 370 _N (matrix conversion unit 370) convert the column vector [u] into the matrix [G] while maintaining the secret sharing state.

The matrix calculation means 380 obtains a matrix [E] of M rows and D columns having a product of each element of the matrix [G] and the matrix [H] as an element by secret calculation (S380). M rows More specifically, the matrix calculator ₃₈₀ 1, ..., is 380 _N, the secret sharing apparatus ₁₀₀ 1, ..., to 100 _N, to the product of each element elements of the matrix [G] and the matrix [H] The matrix [E] of D columns is obtained by secret calculation.

The sort information calculation means 390 obtains the sum of elements for each row of the matrix [E] by secret calculation, and sets information [c] as information arranged in the order of rows using the respective sums as elements. More specifically, the sorting information calculation unit _390. 1, ..., 390 _N (sorting information calculating unit 390) is, secret sharing apparatus ₁₀₀ 1, ..., to 100 _N, the sum of the elements of each row of the matrix [E] Information [c] is obtained from information arranged in the order of rows with each sum as an element. The information [c] obtained in this way corresponds to the information [c] given in the first embodiment.

  The random replacement means 310, the decoding means 320, and the sorting means 330 are the same as in the first embodiment, and steps S310, S320, and S330 are also the same as in the first embodiment.

Next, the sort control units 300 ₁ ,..., 300 _N confirm whether the repetition condition is satisfied (S302). Specifically, it is confirmed whether b = B. If step S302 is Yes, the process ends. If step S302 is No, b + 1 is substituted for b (S302), and the table [X _S ] obtained by the sorting means 330 is set as the table [X] to be sorted next, and the process returns to step S340. In this way, if the sorting for B digits is repeated while changing the sorting target from the lower digit to the upper digit, the sorting for the B-digit D-ary value can be performed.

  Since sorting is performed by such a method, according to the secret sorting system of this modification, the same effect as that of Modification 1 can be obtained.

[Modification 3]
In Modification 3, in addition to the definition in Example 1, B is an _integer, k 1, ..., _{k B} and _D 1, ..., _{D B} is an integer, b is 1 or more B an integer, _{d b} is 1 or more D _b or less, m is an integer from 1 to M, x ₁ ,..., X _M is a record in Table X, y _b (1),..., Y _b (D _b ) is the order y _b (1 ) <... <Y _b (D _b ) defined D _b type value, x _m (k _b ) is the k _b th data of record x _m and y _b (1),..., Y _b (D Any value of _b ), a _bm is the value of x _m (k _b ). Then, information [c] for sorting the table [X] on the basis of the values of the k _1st to k _B Bth data of the record x _m so as to be in ascending order with priority on the larger B is obtained. A description will be given including the processing.

The configuration of the secret sort system of this modification is also shown in FIG. The processing flow of the secret sort system of this modification is shown in FIG. In this modification, the sort control unit 300 _n of each secret sort device 10 _n includes a random replacement unit 310 _n , a decryption unit 320 _n , a sort unit 330 _n , a matrix generation unit 340 _n , a column vector conversion unit 350 _n , a column vector. A calculation unit 360 _n , a matrix conversion unit 370 _n , a matrix calculation unit 380 _n , and a sort information calculation unit 390 _n are provided. The matrix generation means 340 (not shown) of the secret sort system is composed of matrix generation units 340 ₁ ,..., 340 _N , and the column vector conversion means 350 (not shown) is a column vector conversion unit 350 ₁ , , 350 _N , column vector calculation means 360 (not shown) is constituted by column vector calculation sections 360 ₁ ,..., 360 _N , and matrix conversion means 370 (not shown) is matrix conversion section 370. ₁ ,..., 370 _N , matrix calculation means 380 (not shown) is constituted by matrix calculation units 380 ₁ ,..., 380 _N , and sort information calculation means 390 (not shown) is sort information calculation. part ₃₉₀ 1, ..., composed of 390 _N.

First, the sort control units 300 ₁ ,..., 300 _N initially set b = 1 (S301).

The matrix generation means 340 confirms whether a _bm = y _b (d _b ) by a secret calculation. If a _bm = y _b (d _b ), then H _md = 1 and a _bm ≠ y _b (d _b ). matrix of M rows D columns of the H _md = 0 a is _{H md} an element of m rows d column to produce the [H] (S340). More specifically, the matrix generation unit 340 ₁ ,..., 340 _N (matrix generation means 340) confirms by secret calculation whether the secret sharing apparatus 100 ₁ ,..., 100 _N is a _bm = y _b (d _b ). is _allowed, M rows row D to _{a bm = y b (d b} ) If _{H md = 1, a bm ≠} y b (d b) if the _{H md} is _{H md} = 0 for m rows d column element Matrix [H] is generated.

If D _b = 2 and y _b (1) = 0, y _b (2) = 1, whether or not [a _bm ] = 0 is obtained by negating [a _bm ], and [a _bm ] = 1 is obtained with the value of [a _bm ] as it is. Therefore, in step S340, it is not necessary to confirm whether a _bm = y _b (d _b ) by a secret calculation. If [H _m1 ] = [1-a _m ] and [H _m2 ] = [a _m ], Good. Thus, depending on how the values of D _b and y _b (1),..., Y _b (D _b ) are selected, it may not be necessary to check whether a _bm = y _b (d _b ) by secret calculation. .

The column vector conversion means 350 obtains a column vector [h] of the number of elements MD by connecting each column of the matrix [H] vertically from top to bottom in order from the left column (S350). More specifically, the column vector conversion unit 350 ₁ ,..., 350 _N (column vector conversion means 350) converts the matrix [H] into the column vector [h] while maintaining the secret sharing state.

The column vector calculation means 360 obtains a column vector [u] whose i-th element is the sum from the first element to the i-th element of the column vector [h] by secret calculation (S360). More specifically, the column vector calculation unit 360 ₁ ,..., 360 _N (column vector calculation means 360) includes the secret sharing apparatus 100 ₁ ,..., 100 _N and the i-th element is the column vector [h]. A column vector [u] that is the sum from the first element to the i-th element is obtained by a secret calculation.

The matrix conversion unit 370 generates a matrix [G] of M rows and D columns by dividing the column vector [u] into M elements and arranging D column vectors in order from the left (S370). More specifically, the matrix conversion units 370 ₁ ,..., 370 _N (matrix conversion unit 370) convert the column vector [u] into the matrix [G] while maintaining the secret sharing state.

The matrix calculation means 380 obtains a matrix [E] of M rows and D columns having a product of each element of the matrix [G] and the matrix [H] as an element by secret calculation (S380). M rows More specifically, the matrix calculator ₃₈₀ 1, ..., is 380 _N, the secret sharing apparatus ₁₀₀ 1, ..., to 100 _N, to the product of each element elements of the matrix [G] and the matrix [H] The matrix [E] of D columns is obtained by secret calculation.

The sort information calculation means 390 obtains the sum of elements for each row of the matrix [E] by secret calculation, and sets information [c] as information arranged in the order of rows using the respective sums as elements. More specifically, the sorting information calculation unit ₃₉₀ 1, ..., 390 _N (sorting information calculating unit 390) is, secret sharing apparatus ₁₀₀ 1, ..., to 100 _N, the sum of the elements of each row of the matrix [E] Information [c] is obtained from information arranged in the order of rows with each sum as an element. The information [c] obtained in this way corresponds to the information [c] given in the first embodiment.

  The random replacement means 310, the decoding means 320, and the sorting means 330 are the same as in the first embodiment, and steps S310, S320, and S330 are also the same as in the first embodiment.

Next, the sort control units 300 ₁ ,..., 300 _N confirm whether the repetition condition is satisfied (S302). Specifically, it is confirmed whether b = B. If step S302 is Yes, the process ends. If step S302 is No, b + 1 is substituted for b (S302), and the table [X _S ] obtained by the sorting means 330 is set as the table [X] to be sorted next, and the process returns to step S340. In this way, repeating the sort while changing the target sorting from lower priority k ₁ th data higher priority k _B th data, based from the _first k on the value of k _B-th data In addition, sorting can be performed with priority given to the larger B.

  Since sorting is performed by such a method, according to the secret sorting system of this modification, the same effect as that of Modification 2 can be obtained.

[Secret calculation]
In the above description, it is assumed that the secret calculation is not limited to one method, and no specific example is shown. In the following description, random replacement performed by the secret sort devices 10 ₁ ,..., 10 _N and other secret calculations will be described. In addition, the description regarding the following secret calculation is an example, and is not limited thereto. Other secret computations may be used in the secret sort system of the present invention.

Random replacement 1
FIG. 5 shows a secret sort system showing in detail a functional configuration example of a secret sharing apparatus 100 _{n that} can be used in the present invention. FIG. 6 shows a first processing flow example of random replacement. In this example, the secret sort system also includes a selection unit 105. _Here, A 1, ..., K-number of numerical values recorded by dispersing the secret sorter 10 _n fragments of _{A K} (K is an integer of 2 or more), number _{A k} the k-th numerical (k is 1 An integer of K or less), a _kn is a k-th fragment recorded by the secret sort device 10 _n . Note that the numerical values A ₁ ,..., _AK are numerical values to be concealed, for example, numerical values to be sorted. The numerical value group as the sorting subject, for example, numerical A _k are considered numeric group shown an annual income of each person. The selection unit 105 may be disposed inside any one of the secret sort devices, or may be a single device.

The secret sort system includes selection means, fragment replacement means, and redistribution means. The secret sharing apparatus 100 _n includes at least a fragment replacement unit 110 _n , a re-distribution unit 120 _n, and a recording unit 190 _n . The recording unit 190 _n records fragments a _1n ,..., A _Kn, etc. The recording unit 190 _n also records information on the number a fragment of the numerical value A _k that the fragment a _kn recorded by itself is.

The selection unit 105 selects a secret sort device 10 _n having a number less than N (S105). For example, in the case of secret sharing in which a numerical value can be restored by collecting N ′ pieces out of N pieces, a secret sort device having N ′ pieces or more and less than N pieces may be selected.

The fragment replacement means includes at least the fragment replacement units 110 ₁ ,..., 110 _N. Then, {1,..., K} → {1,..., Between the fragment replacement units 110 _{i of} the secret sort device 10 _i selected by the selection means 105 (where i is a number indicating the selected secret sort device). A bijection π of K} is created, and the fragment a _{π (k) i} recorded by the recording unit 190 _{i of} the selected secret sort device 10 _i is set as the kth fragment (S110). The bijection π may be obtained by simply rearranging 1 to K at random. Note that the bijection π is preferably rearranged uniformly and randomly. For example, Fisher-Yates shuffle (Reference 1: Richard Durstenfeld, “Algorithm 235: Random permutation”, Communications of the ACM archive, Volume 7, Issue 7, 1964.) etc. The bijection π may be generated between the selected secret sort devices 10 _i , or may be generated by one secret sort device among the selected secret sort devices 10 _i to select the selected secret sort device. You may share between apparatus 10 _i .

Redispersion means, at least re-dispersing section ₁₂₀ 1, ..., configured to include a 120 _N. The re-distribution means re-distributes using the fragment a _{π (k) i} (replaced k-th ₎ corresponding to the numerical value A _{π (k)} replaced by the fragment replacement means, and performs a new fragment b _k1,. , B _kN are obtained and set as a fragment of the numerical value B _k (S120). That is, the relationship of A _{π (k)} = B _k holds, but the secret sort apparatus that was not selected does not know bijection π, and therefore does not know that A _{π (k)} = B _k . The information that each secret sorter 10 _n recording unit 190 _n of not only recording the fragment b _kn, a fragment of fragment b _kn numerical B _k is the k-th fragment itself is recorded Also record. In addition, if the numerical values B ₁ ,..., _BK are changed to new numerical values A ₁ ,..., _AK and the combination of the secret sort devices selected by the selection means is changed, this process can be repeated (S111, S112).

According to the secret sort system of the present invention, fragments are shuffled between limited secret sort devices. Therefore, the secret sort equipment that has not been chosen, because it does not know the BC π, numerical value A _{1, ...,} A _K and the numerical value B _{1, ...,} do not know the correspondence between the B _K. That is, numerical values A ₁ from a specific secret _sorter, ..., A _K and number B _1, ..., If you wish to state that corresponds is not known with B _K, choose a secret sort apparatus selecting means 105 Thus, the secret sort device to be selected may be determined in advance. Further, if this process is repeated while changing the secret sort device selected by the selection means 105 and all secret sort devices have not been selected, all the secret sort devices have numerical values A ₁ ,. numerical _B 1 that can not be assigned corresponding to the _K, ..., can be obtained _{B K.}

Random replacement 2
FIG. 5 also shows a functional configuration example showing in detail the secret sharing apparatus 100 _n of the secret sort system for the next random replacement. FIG. 7 shows a second processing flow example of random replacement. Also in this example, the secret sort system also includes a selection unit 105. _Here, A 1, ..., K-number of numerical values recorded by dispersing the secret sorter 10 _n fragments of _{A K} (K is an integer of 2 or more), number _{A k} the k-th numerical (k is 1 An integer of K or less), and a _kn is a fragment of the numerical value A _k recorded by the secret sort device 10 _n .

The secret sort system of the present invention includes a selection unit 105, an initial information distribution unit, an initial multiplication unit, a fragment replacement unit, a redistribution unit, a confirmation distribution unit, a confirmation multiplication unit, and a falsification detection unit. The secret sharing apparatus 100 _n includes an initial information distribution unit 130 _n , an initial multiplication unit 140 _n , a fragment replacement unit 110 _n , a redistribution unit 120 _n , a confirmation distribution unit 150 _n , a confirmation multiplication unit 160 _n , and a tampering detection unit 170. _n . The recording unit 190 _n records fragments a _1n ,..., A _Kn, etc. The recording unit 190 _n also records information on the number a fragment of the numerical value A _k that the fragment a _kn recorded by itself is.

The selection means 105 is the same as the random replacement 1. Initial information distribution means, the initial information distribution unit ₁₃₀ 1, ..., and a 130 _N. The initial information distribution unit 130 _i of the secret sorting apparatus 10 _i selected by the selecting means 105, the secret sorting device ₁₀ 1, ..., 10 K pieces of numerical _P 1 does not know any of _N, ..., _{P K} respectively Fragments p _1n ,..., P _Kn are obtained by secret calculation and recorded in the recording unit 190 _n (S130). Specifically, two or more secret sort devices are selected from the secret sort devices selected by the selection unit 105. Then, based on the value created by the selected secret sort device, a fragment of a value unknown to any device may be created. For example, two secret sort devices 10 _i and 10 _j are selected (where i ≠ j), and the numerical fragments generated by the secret sort device 10 _i and the numerical fragments generated by the secret sort device 10 _j are distributed. Record. Then, if the sum of the two numerical values is obtained by secret calculation and the fragments are distributed and recorded so that the result is not known, the fragments of numerical values that are not known by all the secret sort devices can be distributed and recorded. In this example, the number of selected secret computing devices is two, but two or more may be used.

The initial multiplication means, the initial multiplier ₁₄₀ 1, ..., and a 140 _N. The initial multiplication unit ₁₄₀ 1, ..., 140 _{N is, S k = P k × A} k is a numerical value _{S k} fragment _s k1 of, _..., determined by the _{s kN} secure computing, recording unit ₁₉₀ 1, ..., to 190 _N Distributed and recorded (S140).

Fragment replacement means and redispersion means are the same as random replacement 1. The confirmation dispersion means is composed of confirmation dispersion units 150 ₁ ,..., 150 _N. The confirmation dispersion unit 150 ₁ ,..., 150 _N generates a fragment q _k1 ,..., Q _kN of the numerical value Q _k with Q k = Pπ _(k) for _k = _{1 to K} by a secret calculation, and a recording unit 190 _1, ..., distributed and recorded in 190 _N (S150). Specifically, another fragment having a value unknown to any device may be created based on the value created by the secret sort device selected in step S130. For example, the secret sort device 10 _i selected in step S130 generates another numerical value (new fragment) generated for the numerical value P _{π (k)} , and the secret sort device 10 _j selected in step S130 has the numerical value P _{π. (K)} Another piece of the numerical value generated for (a new piece) is distributed and recorded. Then, if the sum of the two numerical values is obtained by secret calculation and the fragments are distributed and recorded so that the result is not known, Q _k = P _{π (k)} and all the secret sort devices do not know Numeric fragments can be distributed and recorded. In this example, two secret sort devices are selected, but two or more secret sort devices may be used as in step S130.

Check multiplying means, check multiplying unit ₁₆₀ 1, ..., and a 160 _N. Check multiplying unit ₁₆₀ 1, ..., 160 _{N is, T k = Q k × B} k is a numerical value _{T k} fragment _t k1 of, _..., determined by the _{t kN} secure computing, recording unit ₁₉₀ 1, ..., to 190 _N Distributed and recorded (S160).

Tampering detection means, the falsification detection unit ₁₇₀ 1, ..., and a 170 _N. The tampering detection units 170 ₁ ,..., 170 _N confirm that T _k = S _{π (k)} for _k = _{1 to K} (S 170). In the case of t _kn ≠ s _{π (k) n} , it is terminated abnormally because tampering has occurred. In addition, if the numerical values B ₁ ,..., _BK are changed to new numerical values A ₁ ,..., _AK and the combination of the secret sort devices selected by the selection means is changed, this process can be repeated (S111, S112).

[Other secret calculations]
Here, an example of secret calculation in the case where the secret sort system is composed of three secret sort devices is shown. Further, since it is not necessary to fix the numbers of the secret sort devices 10 ₁ , 10 ₂ , and 10 ₃ , the secret sort devices 10 _α , 10 _β , and 10 _γ are expressed. That is, (α, β, γ) is any one of (1, 2, 3), (2, 3, 1), and (3, 1, 2).

In the following secret calculation, fragments of the numerical value A recorded by the secret sorting devices 10 _α , 10 _β , 10 _γ are recorded as (a _γα , a _αβ ), (a _αβ , a _βγ ), (a _βγ , a _γα. ), The fragments of the numerical value B are (b _γα , b _αβ ), (b _αβ , b _βγ ), (b _βγ , b _γα ), the fragments of the numerical value C are (c _γα , c _αβ ), (c _αβ , c _βγ). ), (C _βγ , c _γα ). In the following description, W is a predetermined integer of 2 or more, and the calculation result is a remainder obtained by dividing by W. In other words, “mod W” is omitted in the calculation formula described below.

Secret sharing of numerical value A (1) Random numbers a _αβ and a _βγ are generated.
₍₂₎ a γα = computes the _A-a αβ -a βγ, the fragment _{(a γα, a αβ),} (a αβ, a βγ), and _(a βγ, a γα), the secret sorting device 10 _alpha, Record in a dispersed manner at 10 _β and 10 _γ .

Restoring numbers A (1) Secret sorting device 10 _alpha sends a _Ganmaarufa secret sorting device 10 _beta, and transmits the a _.alpha..beta secret sorting apparatus 10 _gamma. The secret sort device 10 _β transmits a _αβ to the secret sort device 10 _γ , and transmits a _βγ to the secret sort device 10 _α . The secret sort device 10 _γ transmits a _βγ to the secret sort device 10 _α , and transmits a _γα to the secret sort device 10 _β .
(2) If the secret sorter 10 _alpha they match and the a _{[beta] [gamma]} received a _{[beta] [gamma]} and from a secret sorter 10 _gamma received from the secret sorter 10 _beta, numerical by calculating _{a αβ + a βγ + a γα} A To restore. The secret sorter 10 _beta they match and the a _Ganmaarufa received a _Ganmaarufa and from a secret sorter 10 _alpha received from the secret sorter 10 _gamma, restores the numeric A by calculating _a αβ + a βγ + a γα . The secret sorter 10 _gamma they match and the a _.alpha..beta received a _.alpha..beta and from a secret sorter 10 _beta received from the secret sorter 10 _alpha, restores the numeric A by calculating _a αβ + a βγ + a γα .

C = A + B secret calculation (1) The secret sort device 10 _α calculates and records (c _γα , c _αβ ) = (a _γα + b _γα , a _αβ + b _αβ ), and the secret sort device 10 _β (c _αβ , C _βγ ) = (a _αβ + b _αβ , a _βγ + b _βγ ), and the secret sort apparatus 10 _γ calculates (c _βγ , c _γα ) = (a _βγ + b _βγ , a _γα + b _γα ). And record.

C = A−B secret calculation (1) The secret sort device 10 _α calculates and records (c _γα , c _αβ ) = (a _γα -b _γα , a _αβ -b _αβ ), and the secret sort device 10 _β (C _αβ , c _βγ ) = (a _αβ −b _αβ , a _βγ −b _βγ ) is calculated and recorded, and the secret sort device 10 _γ is (c _βγ , c _γα ) = (a _βγ −b _βγ , _{aγα− bγα} ) is calculated and recorded.

Secret calculation of C = A + S (where S is a known constant)
(1) The secret sort device 10 _α calculates and records (c _γα , c _αβ ) = (a _γα + S, a _αβ ), and the secret sort device 10 _γ has (c _βγ , c _γα ) = (a _βγ , a _γα + S) is calculated and recorded. There is no processing of the secret sort device _10β .

C = AS secret calculation (where S is a known constant)
(1) The secret sort device 10 _α calculates and records (c _γα , c _αβ ) = (a _γα S, a _αβ S), and the secret sort device 10 _β has (c _αβ , c _βγ ) = (a _αβ S, a _βγ S) is calculated and recorded, and the secret sort apparatus 10 _γ calculates and records (c _βγ , c _γα ) = (a _βγ S, a _γα S).

C = AB Secret Calculation (1) The secret sort device 10 _α generates random numbers r ₁ , r ₂ , c _γα , and c _αβ = (a _γα + a _αβ ) (b _γα + b _αβ ) −r ₁ −r _{2 -C} Calculate _γα . Then, the secret sorting device 10 _alpha is the secret sorting apparatus 10 _beta a _(r 1, c _αβ), and transmits the secret sorting apparatus 10 _gamma a _(r 2, c _γα).
(2) The secret sort device 10 _β calculates y = a _αβ b _βγ + a _βγ b _αβ + r ₁ and transmits it to the secret sort device 10 _γ .
(3) The secret sort device 10 _γ calculates z = a _βγ b _γα + a _γα b _βγ + r ₂ and transmits it to the secret sort device 10 _α .
(4) The secret sort device 10 _β and the secret sort device 10 _γ calculate c _βγ = y + z + a _βγ b _βγ , respectively.
(5) The secret sort device 10 _α records (c _γα , c _αβ ), the secret sort device 10 _β records (c _αβ , c _βγ ), and the secret sort device 10 _γ is (c _βγ , c _γα ). Record.

Secret calculation of negation of bit A (C = 1−A) The secret sort device 10 _α is (c _γα , c _αβ ) = (1−a _γα , −a _αβ mod W).
Is calculated and recorded, and the secret sort device 10 _β is (c _αβ , c _βγ ) = (− a _αβ mod W, −a _βγ mod W)
Is calculated and recorded, and the secret sort device 10 _γ is (c _βγ , c _γα ) = (− a _βγ mod W, 1−a _γα ).
Calculate and record.

Secure computing <br/> secret sorter 10-bit logical product _{(C = A∧B = AB) α} , 10 β, is 10 _gamma, the same processing as secure computing integer multiplication (C = AB mod W) Do.

Secret calculation of logical OR of bits (C = A∨B = A + B−AB) (1) The secret sort devices 10 _α , 10 _β , 10 _γ are the same processing as the secret calculation of integer addition (C = A + B mod W) As a result of C ′ = A + B, the secret sort device 10 _α uses the fragment (c _γα ′, c _αβ ′), the secret sort device 10 _β uses the fragment (c _αβ ′, c _βγ ′), and the secret sort device 10 _γ records the fragment (c _βγ ′, c _γα ′). The secret sort devices 10 _α , 10 _β , 10 _γ perform the same processing as the secret calculation of integer multiplication (C = AB mod W), and as a result of C ″ = AB, the secret sort device 10 _α is a fragment ( c _γα ″, c _αβ ″), the secret sort device 10 _{β records the} fragment (c _αβ ″, c _βγ ″), and the secret sort device 10 _γ records the fragment (c _βγ ″, c _γα ″).
(2) The secret sort devices 10 _α , 10 _β , 10 _γ perform the same processing as the secret calculation (where S is a known constant) of integer multiplication (C = AS mod W) with S = -1. As a result of '''=-C'', the secret sort device 10 _α is a fragment (c _γα ''', c _αβ '''), and the secret sort device 10 _β is a fragment (c _αβ ''', c _βγ '''), The secret sort device 10 _γ records the fragments (c _βγ ′ ″, c _γα ′ ″).
(3) The secret sort devices 10 _α , 10 _β , 10 _γ perform the same process as the secret calculation of addition of integers (C = A + B mod W), and as a result of C = C ′ + C ′ ″, the secret sort device 10 _{α records} the fragment (c _γα , c _αβ ), the secret sort device 10 _{β records} the fragment (c _αβ , c _βγ ), and the secret sort device 10 _γ records the fragment (c _βγ , c _γα ).

Secret calculation of exclusive OR of bits (C = A [∨] B = A + B−2AB) (1) Secret sort devices 10 _α , 10 _β , 10 _γ are secrets of integer addition (C = A + B mod W) The same processing as the calculation is performed, and as a result of C ′ = A + B, the secret sort device 10 _α uses the fragment (c _γα ′, c _αβ ′), and the secret sort device 10 _β uses the fragment (c _αβ ′, c _βγ ′). The secret sort device 10 _γ records the fragment (c _βγ ′, c _γα ′). The secret sort devices 10 _α , 10 _β , 10 _γ perform the same processing as the secret calculation of integer multiplication (C = AB mod W), and as a result of C ″ = AB, the secret sort device 10 _α is a fragment ( c _γα ″, c _αβ ″), the secret sort device 10 _{β records the} fragment (c _αβ ″, c _βγ ″), and the secret sort device 10 _γ records the fragment (c _βγ ″, c _γα ″).
(2) The secret sort devices 10 _α , 10 _β , and 10 _γ perform the same processing as the secret calculation of an integer multiplication (C = AS mod W) with S = -2 (where S is a known constant). As a result of C ″ ′ = − 2C ″, the secret sort device 10 _α is a fragment (c _γα ′ ″, c _αβ ′ ″), and the secret sort device 10 _β is a fragment (c _αβ ′ ″, c _βγ ′ ″), and the secret sort device 10 _γ records the fragments (c _βγ ′ ″, c _γα ′ ″).
(3) The secret sort devices 10 _α , 10 _β , 10 _γ perform the same process as the secret calculation of addition of integers (C = A + B mod W), and as a result of C = C ′ + C ′ ″, the secret sort device 10 _{α records} the fragment (c _γα , c _αβ ), the secret sort device 10 _{β records} the fragment (c _αβ , c _βγ ), and the secret sort device 10 _γ records the fragment (c _βγ , c _γα ).

Secret calculation of integer conversion of bits A (n), n = 0,..., N−1 Integer conversion of bits A (n) is

Is to seek. Further, the fragments of the bits A (n) recorded by the secret sort devices 10 _α , 10 _β , 10 _γ in a distributed manner are represented as (a (n) _γα , a (n) _αβ ), (a (n) _αβ , a ( n) _βγ ), (a (n) _βγ , a (n) _γα ). The secret sort device 10 _α

The secret sort device 10 _β is calculated and recorded

The secret sort device 10 _γ is calculated and recorded as

Calculate and record.

The secret calculation x (n) of the binary conversion of the N-bit integer A shall indicate the lower n + 1th bit of x.
(1) For n = 0 to N−1, the secret sort device 10 _β secretly distributes (a _αβ + a _βγ mod W) (n), and the secret sort devices 10 _α , 10 _β , 10 _γ are (a _αβ + a _βγ mod W) (n) fragments (b (n) _γα , b (n) _αβ ), (b (n) _αβ , b (n) _βγ ), (b (n) _βγ , b (n) _γα ) Are distributed and recorded. For n = 0 to N−1, the secret sort device 10 _γ secretly distributes (a _γα ) (n), and the secret sort devices 10 _α , 10 _β , 10 _γ are fragments of (a _γα ) (n) (( _aγα ) (n) _γα , ( _aγα ) (n) _αβ ), (( _aγα ) (n) _αβ , ( _aγα ) (n) _βγ ), (( _aγα ) (n) _βγ , (a _γα ) (n) _γα ) are dispersed and recorded.
(2) c _γα = 0, and the processes from (2-1) to (2-3) are repeatedly executed for n = 0 to N-1.
(2-1) d _n = b (n) + (a _γα ) (n) _-2b (n) (a _γα ) (n)
And _dn fragments are distributed and recorded.
_{(2-2) a (n) =} d n + c n -2d n c n
The secret calculation is performed and the pieces of a (n) are distributed and recorded.
(2-3) If n <N-1,
_{c n + 1 = b (n} ) (a γα) (n) + d n c n -b (n) (a γα) (n) d n c n
And _{cn + 1} fragments are distributed and recorded.

[Program, recording medium]
The various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

10 _1, ..., 10 _N secret sorting apparatus 100 _1, ..., 100 _N secret sharing device 105 selecting unit 110 _1, ..., 110 _N fragment replacement unit ₁₂₀ 1, ..., _{120 N} redispersion unit 130 _1, ..., 130 _N The initial information distribution unit ₁₄₀ 1, ..., 140 _N initial multiplier unit 0.99 _1, ..., 0.99 _N confirmation dispersion unit ₁₆₀ 1, ..., 160 _N confirmation multiplying unit 170 _1, ..., 170 _N falsification detecting unit ₁₉₀ 1, ..., 190 _N recording unit 300 _1, ..., 300 _N sort controller 310 randomly substituted means 310 _1, ..., 310 _N random replacement unit 320 decoding unit 320 _1, ..., 320 _N decoding unit 330 sorting unit 330 _1, ..., 330 _N sorting part 340 matrix generation unit 340 _1, ..., 340 _N matrix generator 350 column vector converting unit 350 _1, ..., 350 _N column vector Section 360 column vector calculating means 360 _1, ..., 360 _N column vector calculation section 370 matrix transformation means 370 _1, ..., 370 _N matrix conversion unit 380 matrix calculation unit 380 _1, ..., 380 _N matrix calculating unit 390 sorts information calculation Means 390 ₁ ,..., 390 _N sort information calculation unit 1000 network

Claims (10)

A secret-distributed table corresponding to a table in which the records of Table X are rearranged from the table [X] that is composed of three or more secret sort devices and each element of Table X consisting of M records is secret-distributed A secret sorting system for
M is an integer of 2 or more, [] is a symbol indicating information in which information in parentheses is secretly distributed for each element, c is a sequence of different M values, and what is after sorting even if random replacement is performed between records Information that can uniquely determine whether
While maintaining the correspondence between the M elements of the information [c] and the M records of the table [X], the records are randomly replaced by secret calculation, and the randomly replaced information [c _R ] and the table [X _R A random replacement means for obtaining
Decoding means for decoding information [c _R ] and obtaining information c _R ;
A secret sorting system comprising: sorting means for rearranging the records of the table [X _R ] in the order indicated by the information c _{R and} obtaining the table [X _S ]. The secret sorting system according to claim 1,
k, D is an integer, d is 1 or more D an integer, m is an integer of 1 to _{M, x 1, ...,} x _M Table X _records, y 1, ..., _{y D} is the sequence _{y 1} to be sorted <... <D type D value in which _D is defined, x _m (k) is the k-th data of the record x _m , and any value of y ₁ ,..., Y _D , a _m is x _m (k value of) the table [X] is to be sorted so that the ascending order based on the value of the k-th data record x _m,
further,
a _m = _{y d} if _{H md = 1, a m ≠} y matrix of M rows D column the _d if _{H md} = 0 a is _{H md} the elements of m rows d column matrix generating for generating a [H] Means,
Column vector conversion means for determining the column vector [h] of the number of elements MD by connecting the columns of the matrix [H] vertically from top to bottom in order from the left column;
column vector calculation means for obtaining a column vector [u] in which the i-th element is the sum from the first element to the i-th element of the column vector [h] by secret calculation;
Matrix conversion means for dividing the column vector [u] into M elements and generating a matrix [G] of M rows and D columns in which D column vectors are arranged in order from the left;
Matrix calculation means for obtaining a matrix [E] of M rows and D columns having a product of each element of the matrix [G] and the matrix [H] as an element by secret calculation;
Sort information calculation means that obtains the sum of elements for each row of the matrix [E] by secret calculation, and sets the information [c] as information arranged in the order of rows using the sum as an element;
Secret sorting system with The secret sorting system according to claim 1,
k, B, D are integers, b is an integer from 1 to B, d is an integer from 1 to D, m is an integer from 1 to M, x ₁ ,..., x _M is a record in Table X, x _m (K) is the k-th data of the record x _m and is the B-digit D-ary value, a _bm is the value of the b-th digit from the lower order of x _m (k), and the table [X] is the k-th value of the record x _m Sorted in ascending order based on the data value of,
further,
If a _bm = d−1, H _md = 1, and if a _bm ≠ d−1, then H _md = 0. Generate an M row D column matrix [H] with H _md as an element of m rows d columns. Matrix generating means;
Column vector conversion means for determining the column vector [h] of the number of elements MD by connecting the columns of the matrix [H] vertically from top to bottom in order from the left column;
column vector calculation means for obtaining a column vector [u] in which the i-th element is the sum from the first element to the i-th element of the column vector [h] by secret calculation;
Matrix conversion means for dividing the column vector [u] into M elements and generating a matrix [G] of M rows and D columns in which D column vectors are arranged in order from the left;
Matrix calculation means for obtaining a matrix [E] of M rows and D columns having a product of each element of the matrix [G] and the matrix [H] as an element by secret calculation;
Sort information calculation means that obtains the sum of elements for each row of the matrix [E] by secret calculation, and sets the information [c] as information arranged in the order of rows using the sum as an element;
With
Processing of the matrix generation means, the column vector conversion means, the column vector calculation means, the matrix conversion means, the matrix calculation means, the sort information calculation means, the random replacement means, the decoding means, and the sort means, The secret sort system characterized by repeating from b = 1 to b = B while using the table [X _S ] obtained by the sorting means as the next sort target table [X]. The secret sorting system according to claim 1,
B is an _{integer, k 1, ...,} k _B and _D 1, ..., _{D B} is an integer, b is 1 or more B an integer, _{d b} is 1 or more _{D b} an integer, m is an integer of 1 to M , _x 1, ..., _{x M} Table X _{records, y b (1), ...} , y b (D b) the order _y b (1) to be sorted _{<... <y b (D b} ) is defined The value of D _b type, x _m (k _b ) is the k _b th data of record x _m and is one of y _b (1),..., Y _b (D _b ), a _bm is x _m ( The value of k _b ), table [X] is sorted in ascending order based on the values of the k ₁ th to k _B th data of the record x _m giving priority to the larger B,
further,
A matrix of M rows and D _b columns where the element of m rows and d _b columns is 1 if a _bm = y _b (d _b ), and the elements of m rows and d _b columns are 0 if a _bm ≠ y _b (d _b ). Matrix generating means for generating [H];
And a column vector conversion means for obtaining a column vector of concatenated longitudinally number of elements MD _b [h] from top to bottom of each column from the left column in the order of the matrix [H],
column vector calculation means for obtaining a column vector [u] in which the i-th element is the sum from the first element to the i-th element of the column vector [h] by secret calculation;
Matrix conversion means for dividing the column vector [u] into M elements and generating a matrix [G] of M rows and D _b columns in which D column vectors are arranged in order from the left;
Matrix calculation means for obtaining a matrix [E] of M rows and D _b columns having a product of each element of the matrix [G] and the matrix [H] as an element by secret calculation;
Sort information calculation means that obtains the sum of elements for each row of the matrix [E] by secret calculation, and sets the information [c] as information arranged in the order of rows using the sum as an element;
With
Processing of the matrix generation means, the column vector conversion means, the column vector calculation means, the matrix conversion means, the matrix calculation means, the sort information calculation means, the random replacement means, the decoding means, and the sort means, The secret sort system characterized by repeating from b = 1 to b = B while using the table [X _S ] obtained by the sorting means as the next sort target table [X]. Consists of three or more secret sort devices for obtaining a secret-distributed table corresponding to a table in which the records of Table X are rearranged from a table [X] in which each element of Table X consisting of M records is secretly distributed A secret sorting device in a secret sorting system,
M is an integer of 2 or more, [] is a symbol indicating information in which information in parentheses is secretly distributed for each element, c is a sequence of different M values, and what is after sorting even if random replacement is performed between records Information that can uniquely determine whether
While maintaining the correspondence between the M elements of the information [c] and the M records of the table [X], the records are randomly replaced by secret calculation, and the randomly replaced information [c _R ] and the table [X _R A random replacement part for obtaining
A decoding unit for decoding information [c _R ] and obtaining information c _R ;
A secret sort device comprising: a sort unit for rearranging the records of the table [X _R ] in the order indicated by the information c _{R and} obtaining the table [X _S ]. A table [X] in which each element of the table X composed of M records is secretly distributed using a secret sort system including three or more secret sort devices and having random replacement means, decryption means, and sort means . A secret sorting method for obtaining a secret-distributed table corresponding to a table in which the records of Table X are rearranged,
M is an integer of 2 or more, [] is a symbol indicating information in which information in parentheses is secretly distributed for each element, c is a sequence of different M values, and what is after sorting even if random replacement is performed between records Information that can uniquely determine whether
The random replacement means performs random replacement between records by secret calculation while maintaining the correspondence between the M elements of the information [c] and the M records of the table [X], and randomly replaces the information [c _R And a table [X _R ] to obtain a random replacement step;
A decoding step in which the decoding means decodes information [c _R ] to obtain information c _R ;
A sorting method in which the sorting means has a sorting step of rearranging the records of the table [X _R ] in the order indicated by the information c _R to obtain the table [X _S ]. The secret sorting method according to claim 6,
k, D is an integer, d is 1 or more D an integer, m is an integer of 1 to _{M, x 1, ...,} x _M Table X _records, y 1, ..., _{y D} is the sequence _{y 1} to be sorted <... <D type D value in which _D is defined, x _m (k) is the k-th data of the record x _m , and any value of y ₁ ,..., Y _D , a _m is x _m (k value of) the table [X] is to be sorted so that the ascending order based on the value of the k-th data record x _m,
The secret sort system further includes matrix generation means, column vector conversion means, column vector calculation means, matrix conversion means, matrix calculation means, and sort information calculation means,
The matrix generation unit, _a m = _{y d} if _{H md = 1, a m ≠} y d if _{H md} = 0 a is _{H md} a matrix of M rows D columns having elements of m rows d column [H A matrix generation step for generating
The column vector conversion means, and a column vector conversion step of obtaining a column vector [h] of connecting longitudinally number of elements MD from top to bottom in this order from the column to the left column of the matrix [H],
A column vector calculating step in which the column vector calculating means obtains a column vector [u] whose i-th element is a sum from the first element to the i-th element of the column vector [h] by secret calculation;
It said matrix transformation means, and a matrix conversion step of generating a column vector [u] a matrix of M rows D columns the D column vectors by dividing arranged from left to right for each M elements [G],
The matrix calculation means, the matrix [G] and the matrix a matrix of M rows row D to the product of each element of [H] Elements [E], and matrix calculation step of obtaining a secret computation,
A sort information calculation step in which the sort information calculation means obtains a sum of elements for each row of the matrix [E] by secret calculation, and sets the information [c] as information arranged in the order of rows using the sum as an element;
A secret sorting method. The secret sorting method according to claim 6,
k, B, D are integers, b is an integer from 1 to B, d is an integer from 1 to D, m is an integer from 1 to M, x ₁ ,..., x _M is a record in Table X, x _m (K) is the k-th data of the record x _m and is the B-digit D-ary value, a _bm is the value of the b-th digit from the lower order of x _m (k), and the table [X] is the k-th value of the record x _m Sorted in ascending order based on the data value of,
The secret sort system further includes matrix generation means, column vector conversion means, column vector calculation means, matrix conversion means, matrix calculation means, and sort information calculation means,
The matrix generation means, the matrix of M rows row D to _a bm = d-1 if _{H md = 1, a bm ≠} d-1 if _{H md} = 0 at which the _{H md} of m rows d column element A matrix generation step of generating [H];
The column vector conversion means, and a column vector conversion step of obtaining a column vector [h] of connecting longitudinally number of elements MD from top to bottom in this order from the column to the left column of the matrix [H],
A column vector calculating step in which the column vector calculating means obtains a column vector [u] whose i-th element is a sum from the first element to the i-th element of the column vector [h] by secret calculation;
It said matrix transformation means, and a matrix conversion step of generating a column vector [u] a matrix of M rows D columns the D column vectors by dividing arranged from left to right for each M elements [G],
The matrix calculation means, the matrix [G] and the matrix a matrix of M rows row D to the product of each element of [H] Elements [E], and matrix calculation step of obtaining a secret computation,
A sort information calculation step in which the sort information calculation means obtains a sum of elements for each row of the matrix [E] by secret calculation, and sets the information [c] as information arranged in the order of rows using the sum as an element;
Have
The matrix generation step, the column vector conversion step, the column vector calculation step, the matrix conversion step, the matrix calculation step, the sort information calculation step, the random replacement step, the decoding step, the sort step, the sort step, The secret sorting method is characterized by repeating from b = 1 to b = B while using the table [X _S ] obtained by the above as the table [X] to be sorted next. The secret sorting method according to claim 6,
B is an _{integer, k 1, ...,} k _B and _D 1, ..., _{D B} is an integer, b is 1 or more B an integer, _{d b} is 1 or more _{D b} an integer, m is an integer of 1 to M , _x 1, ..., _{x M} Table X _{records, y b (1), ...} , y b (D b) the order _y b (1) to be sorted _{<... <y b (D b} ) is defined The value of D _b type, x _m (k _b ) is the k _b th data of record x _m and is one of y _b (1),..., Y _b (D _b ), a _bm is x _m ( The value of k _b ), table [X] is sorted in ascending order based on the values of the k ₁ th to k _B th data of the record x _m giving priority to the larger B,
The secret sort system further includes matrix generation means, column vector conversion means, column vector calculation means, matrix conversion means, matrix calculation means, and sort information calculation means,
M the matrix generation means, to _{a bm = y b (d b} ) if m rows _{d b} elements of columns _{1, a bm ≠ y b (} d b) if m rows _{d b} elements of column 0 A matrix generation step of generating a matrix [H] of row D _b column;
The column vector conversion means, a matrix and a column vector conversion step of obtaining a column vector [h] of the number of elements MD _b by connecting vertically down each column from top left column in order of [H],
A column vector calculating step in which the column vector calculating means obtains a column vector [u] whose i-th element is a sum from the first element to the i-th element of the column vector [h] by secret calculation;
It said matrix transformation means, and a matrix conversion step of generating a matrix of M rows D _b columned D column vectors from the left by dividing the column vector [u] for each M elements [G],
The matrix calculation means, a matrix a matrix of M rows D _b columns to the product of each element of [G] and the matrix [H] Elements [E], and matrix calculation step of obtaining a secret computation,
A sort information calculation step in which the sort information calculation means obtains a sum of elements for each row of the matrix [E] by secret calculation, and sets the information [c] as information arranged in the order of rows using the sum as an element;
Have
The matrix generation step, the column vector conversion step, the column vector calculation step, the matrix conversion step, the matrix calculation step, the sort information calculation step, the random replacement step, the decoding step, the sort step, the sort step, The secret sorting method is characterized by repeating from b = 1 to b = B while using the table [X _S ] obtained by the above as the table [X] to be sorted next.   The secret sort program for functioning a computer as each secret sort apparatus of the secret sort system in any one of Claim 1 to 4.

Images