JP5937556B2 - Secret calculation device, secret search system, secret calculation method, secret search method, program - Google Patents

Description

  The present invention relates to a cryptographic application technique, and in particular, a secret calculation device, a secret search system, a secret calculation method, and a secret search that perform an exact match search without revealing input data (search key and search target data) to a data custodian. The present invention relates to a search method and a program.

  As a method for obtaining a calculation result without restoring encrypted data, there is a method called secret calculation. This secret calculation is disclosed in Non-Patent Document 1, for example. In the secret calculation described in Non-Patent Document 1, first, an input numerical value is converted into data called a fragment and held in n secret calculation devices. This procedure is hereinafter expressed as “distributing and holding fragments”. The fragment is a value that changes for each secret computing device depending on the random number, and the original numerical value cannot be estimated from the number of fragments equal to or less than the threshold. That is, since the original numerical value is converted into a fragment, it is concealed. In the secret calculation disclosed in Non-Patent Document 1, a fragment of the result of addition, subtraction, multiplication, size comparison, and data format conversion (integer, binary number) is further calculated using the inputted numerical fragments, and n units Can be held in a secret computing device. However, these operations are performed on the finite field GF (P), where P is a prime number determined as a parameter for the secret calculation. There is a method described in Patent Document 1 as a method using a secret calculation for executing a complete match search and a section search in a state where a record of a database is kept secret. In the method of Patent Document 1, first, sorting is performed in a state where the attributes to be searched are concealed. At the time of the search, a binary search is performed on the sorted concealment data by using a random slide by secret calculation and a size comparison. When the number of records stored in the database is m, the traffic between the secret computing devices required for random slide and binary search is O (m) and O (log (m)), respectively. However, the number n of secret calculation devices and the data size per record are assumed to be constants.

JP 2012-150764 A

Ivan Damgard, Matthias Fitzi, Eike Kiltz, Jesper Buus Nielsen, and Thomas Toft, “Unconditionally Secure Constant-Rounds Multi-party Computation for Equality, Comparison, Bits and Exponentiation,” TCC 2006, LNCS 3876, pp. 285-304, 2006 .

  In the prior art, as the number m of records stored in the database increases, the amount of communication between the secret computing devices required at the time of search increases, which increases the search time. In the conventional method, since a binary search using a secret calculation is performed at the time of search, the communication amount between the secret calculation devices is O (log (m)) with respect to the number m of records in the database, and the records accumulated in the database As the number m increases, the amount of communication increases.

  Accordingly, an object of the present invention is to provide a secret computing device that can reduce the amount of communication between devices.

  The secret calculation device of the present invention includes an attribute random number calculation unit, an attribute random number fragment distribution holding unit, a search random number calculation unit, a search random number fragment distribution holding unit, a format conversion unit, a prime parameter conversion unit, and a tag calculation unit including.

  Assume that the first prime number is equal to twice the second prime number plus one. The attribute random number calculator calculates an attribute random number greater than or equal to 1 and less than the second prime number. The attribute random number fragment distribution holding unit sets n to an integer of 2 or more, and distributes and holds attribute random number fragments among n secret computing devices. The prime parameter of the secret calculation is the second prime number, the product of the intermediate random number that is a random number greater than or equal to 1 and less than the second prime number and its inverse element is equal to the remainder with the second prime number as the divisor and 1 as the dividend. Assume that fragments are distributed and held among n secret computing devices. The search random number calculator obtains a search random number by secret calculation based on the inverse element and the attribute random number. The search random number fragment distribution holding unit holds the search random number fragments in a distributed manner among the n secret computing devices. The format conversion unit converts the data format of the search random number stored in a distributed manner into bit information. The prime parameter conversion unit converts the prime parameter of the secret calculation in each bit of the search random number into the first prime number by secret calculation. The tag calculation unit includes a tag generation argument that is a remainder having a value obtained by dividing the first prime number by a power of an intermediate random number and a hash value generated for the search target data, and a fragment of each bit of the search random number Calculate the tag by secret calculation.

  According to the secret computing device of the present invention, the amount of communication between devices is reduced.

1 is a block diagram illustrating an overview of a secret search system according to a first embodiment. FIG. 2 is a block diagram illustrating a configuration of a data registration unit of the data registration apparatus according to the first embodiment. FIG. 3 is a block diagram illustrating a configuration of a data search unit of the data search apparatus according to the first embodiment. FIG. 3 is a block diagram illustrating a configuration of a first search random number preprocessing unit of the data registration device according to the first embodiment. The block diagram which shows the structure of the 2nd search random number pre-processing part of the data search device of Example 1. FIG. FIG. 3 is a block diagram illustrating a configuration of an attribute random number generation unit of the secret computing device according to the first embodiment. FIG. 3 is a block diagram illustrating a configuration of a search random number generation unit of the secret computing device according to the first embodiment. FIG. 3 is a block diagram illustrating a configuration of a tag generation unit of the secret calculation device according to the first embodiment. FIG. 3 is a block diagram illustrating a configuration of a search unit of the secret computing device according to the first embodiment. FIG. 3 is a sequence diagram illustrating an attribute random number generation operation of the secret search system according to the first embodiment. FIG. 3 is a sequence diagram illustrating a search random number generation operation of the secret search system according to the first embodiment. FIG. 3 is a sequence diagram illustrating a search random number generation operation of the secret search system according to the first embodiment. The sequence diagram which shows the tag calculation operation at the time of the data search of the secret search system of Example 1. FIG. The sequence diagram which shows the tag calculation operation at the time of the data search of the secret search system of Example 1. FIG. The sequence diagram which shows the tag calculation operation | movement at the time of the data registration of the secret search system of Example 1. FIG. FIG. 3 is a sequence diagram illustrating a data search operation of the secret search system according to the first embodiment.

  In the present invention, a tag for identification is assigned at the time of registration of search target data, and the tag is shared by all the secret computing devices. When searching, a tag is generated from data to be searched (for example, “telephone number: 123-456-789”), and the search is realized by comparing with a tag given in advance. Although a secret calculation is necessary to generate a tag, since a tag is uniquely determined with respect to the original data, a general search (for example, search by index) should be used for comparison with a tag assigned in advance. it can. As described above, since the comparison between the generated tag and the tag given in advance can be realized by a general search, a system for generating a tag will be specifically described below as an embodiment of the present invention. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

  Hereinafter, an outline of the secret search system according to the first embodiment of the present invention will be described with reference to FIG. FIG. 1 is a block diagram illustrating an overview of a secret search system 1000 according to the first embodiment. As shown in FIG. 1, the secret search system 1000 of this embodiment includes a data registration device 1 and n (n is an integer of 2 or more) secret calculation devices 2-1, 2-2,. And a data search device 3. Hereinafter, when the secret computing devices 2-1, 2-2,..., 2-n are representatively represented, they are expressed as the secret computing device 2, and the items described for the secret computing device 2 are the secret computing device 2-1. 2-2,..., 2-n are all relevant items. The data registration device 1, the secret calculation device 2, and the data search device 3 are connected via a network 9 so that they can communicate with each other wirelessly or by wire. In this embodiment, the data registration device 1 executes data registration, the data search device 3 executes data search, and the data registration and search are performed by separate devices. The search can be realized by the same device, and there may be a plurality of devices.

  The data registration device 1 includes a data registration unit 11 and a first search random number preprocessing unit 12. The secret computing devices 2-1, 2-2,..., 2-n include an attribute random number generation unit 21, a search random number generation unit 22, a tag generation unit 23, a storage unit 24, and a search unit 25. The data search device 3 includes a data search unit 31 and a second search random number preprocessing unit 32.

  Details of the configuration of the data registration device 1 and the data search device 3 will be described with reference to FIGS. 2, 3, 4, and 5. FIG. 2 is a block diagram showing the configuration of the data registration unit 11 of the data registration apparatus 1 of this embodiment. FIG. 3 is a block diagram showing the configuration of the data search unit 31 of the data search device 3 of this embodiment. FIG. 4 is a block diagram illustrating a configuration of the first search random number preprocessing unit 12 of the data registration device 1 of the present embodiment. FIG. 5 is a block diagram showing the configuration of the second search random number preprocessing unit 32 of the data search device 3 of this embodiment. As shown in FIG. 2, the data registration unit 11 of the data registration device 1 includes an attribute random number generation request unit 110, a first search random number generation request unit 111, a first hash value generation unit 112, and a first argument calculation unit 113. A first argument transmission unit 114, a registration data fragment generation unit 115, and a registration data fragment transmission unit 116. As shown in FIG. 3, the data search unit 31 of the data search device 3 includes a second search random number generation request unit 311, a second hash value generation unit 312, a second argument calculation unit 313, and a second argument transmission unit 314. including. As illustrated in FIG. 4, the first search random number preprocessing unit 12 of the data registration device 1 includes a first intermediate random number generation unit 121, a first inverse element calculation unit 122, a first inverse element fragment distribution holding unit 123, and The first completion notification unit 124 is included. As shown in FIG. 5, the second search random number preprocessing unit 32 of the data search device 3 includes a second intermediate random number generation unit 321, a second inverse element calculation unit 322, and a second inverse element fragment distribution holding unit 323. The second completion notification unit 324 is included.

  Hereinafter, the configuration of the secret computing device 2 will be described in detail with reference to FIG. 6, FIG. 7, FIG. 8, and FIG. FIG. 6 is a block diagram showing a configuration of the attribute random number generation unit 21 of the secret calculation device 2 of the present embodiment. FIG. 7 is a block diagram showing the configuration of the search random number generation unit 22 of the secret calculation device 2 of the present embodiment. FIG. 8 is a block diagram illustrating a configuration of the tag generation unit 23 of the secret calculation apparatus 2 according to the present embodiment. FIG. 9 is a block diagram showing the configuration of the search unit 25 of the secret calculation apparatus 2 of this embodiment. As shown in FIG. 6, the attribute random number generation unit 21 of the secret calculation device 2 includes a prime number generation unit 211, an attribute random number calculation unit 212, an attribute random number fragment distribution holding unit 213, and an attribute random number generation completion notification unit 214. As shown in FIG. 7, the search random number generation unit 22 of the secret calculation device 2 includes a search random number calculation unit 221, a search random number fragment distribution holding unit 222, a format conversion unit 223, a prime parameter conversion unit 224, and a search random number generation. A completion notification unit 225 is included. As shown in FIG. 8, the tag generation unit 23 of the secret calculation device 2 includes a tag calculation unit 231, a tag holding unit 232, and a tag registration completion notification unit 233. As shown in FIG. 9, the search unit 25 of the secret computing device 2 includes a data request unit 251, a data acquisition unit 252, a search execution unit 253, and a search result transmission unit 254. In the present embodiment, the secret calculation device 2 includes the prime number generation unit 211. However, the present invention is not limited to this, and the prime number generation unit 211 may be included in the data registration unit 11 of the data registration device 1. Good.

  To generate a tag, it is necessary to prepare two types of random numbers in advance. Hereinafter, <attribute random number generation operation>, <search random number generation operation>, <tag calculation operation during data search>, <tag calculation operation during data registration (distributed retention of registered data fragments)>, <data search operation> Will be described in order. <Attribute random number generation operation> needs to be executed for each attribute to be searched. <Search random number generation operation> is necessary for each tag generation, but it is possible to generate and store search random numbers in advance. If the search random numbers are stored in advance, the processing of <search random number generation operation> can be omitted at the time of search, and the efficiency at the time of tag generation can be increased. Hereinafter, each operation described above will be described by taking n = 3 as an example.

<Attribute random number generation operation>
The attribute random number generation operation of the secret search system 1000 of this embodiment will be described with reference to FIG. FIG. 10 is a sequence diagram showing the attribute random number generation operation of the secret search system 1000 of this embodiment. As shown in FIG. 10, when the attribute random number has not been generated (see NO frame in FIG. 10), the attribute random number generation request unit 110 of the data registration unit 11 of the data registration device 1 The attribute random number generation request is transmitted to 2-1, 2-2, ..., 2-n (S110). The prime number generator 211 of the attribute random number generator 21 of the secret computing device 2 sets the first prime number p so that the first prime number p is equal to the number obtained by adding 1 to twice the second prime number q (p = 2q + 1). The second prime number q is generated (S211). Note that when the prime number generation unit 211 is included not in the secret calculation device 2 but in the data registration unit 11 of the data registration device 1, the secret calculation device 2 does not execute step S211. In this case, the attribute random number generation unit 21 of the secret computing device 2 acquires the first prime number p and the second prime number q from the prime number generation unit 211 in the data registration unit 11 of the data registration device 1. The attribute random number calculation unit 212 of the attribute random number generation unit 21 calculates an attribute random number r (r is an integer) of 1 or more and less than the second prime number q by secret calculation (S212). The attribute random number fragment distribution holding unit 213 of the attribute random number generation unit 21 distributes and holds the fragments of the attribute random number r among the n secret computing devices (S213). Specific methods of steps S212 and S213 are disclosed in Chapter 2 (Joint Random Non-Zero Sharing) of Reference Non-Patent Document 1, for example. The attribute random number generation completion notification unit 214 of the attribute random number generation unit 21 transmits an attribute random number generation completion notification to the data registration unit 11 of the data registration device 1 (S214).
(Reference Non-Patent Document 1) Naoto Kiribuchi, Ryo Kato, Takashi Nishide, Tsukasa Endo, and Hiroshi Yoshiura, “Accelerating Multiparty Computation by Efficient Random Number Bitwise-Sharing Protocols,” WISA 2011, LNCS 7115, pp. 187-202, 2012 .

<Search random number generation operation>
The search random number generation operation of the secret search system 1000 according to the present embodiment will be described with reference to FIGS. 11 and 12 are sequence diagrams showing search random number generation operation of the secret search system 1000 of the present embodiment. As shown in FIG. 11, when the search random number has not been generated (refer to the NO frame in FIG. 11), the first search random number generation request unit 111 of the data registration unit 11 of the data registration device 1 A request for generating a search random number is transmitted to the processing unit 12 (S111). The first intermediate random number generation unit 121 of the first search random number preprocessing unit 12 of the data registration device 1 generates an intermediate random number R that is 1 or more and less than the second prime number q (S121). The first inverse element calculation unit 122 of the first search random number preprocessing unit 12 makes the product of the intermediate random number R and its inverse element R ⁻¹ equal to the remainder with the second prime number q as the divisor and 1 as the dividend. (R × R ⁻¹ = 1 mod q), the inverse element R ⁻¹ of the intermediate random number R is calculated (S122). The first inverse element fragment distribution holding unit 123 of the first search random number preprocessing unit 12 holds the fragments of the inverse element R- ¹ in a distributed manner among the n secret computing devices (S123).

The search random number calculation unit 221 of the search random number generation unit 22 of the secret calculation device 2 sets the prime parameter P of the secret calculation to the second prime number q, and uses the search random number r by secret calculation based on the attribute random number r and the inverse element R ^−1. '= R × R ⁻¹ is obtained (S221). The search random number fragment distribution holding unit 222 of the search random number generation unit 22 distributes and holds the fragments of the search random number r ′ among the n secret calculation devices (S222). The format conversion unit 223 of the search random number generation unit 22 converts the data format of the search random number r ′ held in a distributed manner from an integer to a binary number (bit information) (S223). As a specific method of step S223, for example, there is a method described in Chapter 3 of Non-Patent Document 1. The prime parameter conversion unit 224 of the search random number generation unit 22 converts the prime parameter P of the secret calculation in each bit of the search random number r ′ from the second prime number q to the first prime number p by secret calculation (S224). As a specific method of step S224, for example, there is a method described in Section 5.2 (Conversion between bit shares) of Reference Non-Patent Document 2. The search random number generation completion notification unit 225 of the search random number generation unit 22 transmits a search random number generation completion notification to the first search random number preprocessing unit 12 of the data registration device 1 (S225). The first completion notification unit 124 of the first search random number preprocessing unit 12 of the data registration device 1 transmits a search random number generation completion notification to the data registration unit 11 when receiving a search random number generation completion notification (S124). ).
(Reference Non-Patent Document 2) Aleksandr Yampolskiy, “Efficient Cryptographic Tools for Secure Distributed Computing,” PhD Thesis, Yale University, 2006.

  The search random number generation operation in the data search device 3 is the same as described above. As shown in FIG. 12, the search random number generation operation is executed in the same manner as in FIG. Specifically, the operations of the data search unit 31 and the data registration unit 11, and the operations of the second search random number preprocessing unit 32 and the first search random number preprocessing unit 12 are the same. Accordingly, the operations of the first search random number generation request unit 111 and the second search random number generation request unit 311, the operations of the first intermediate random number generation unit 121 and the second intermediate random number generation unit 321, the first inverse element calculation unit 122 and the second The operations of the inverse element calculation unit 322, the operations of the first inverse element fragment distribution holding unit 123 and the second inverse element fragment distribution holding unit 323, and the operations of the first completion notification unit 124 and the second completion notification unit 324 are the same. .

<Tag calculation operation during data retrieval>
The tag calculation operation at the time of data search of the secret search system 1000 of the present embodiment will be described with reference to FIGS. FIG. 13 and FIG. 14 are sequence diagrams showing the tag calculation operation at the time of data search of the secret search system 1000 of this embodiment. Data to be searched is represented as x.
As illustrated in FIG. 13, the first hash value generation unit 112 of the data registration unit 11 of the data registration device 1 generates a hash value w for the search target data x based on a cryptographic hash function, for example, SHA-256. (S112). The first argument calculation unit 113 of the data registration unit 11 calculates, as a tag generation argument c, a remainder in which a first prime number p is a divisor and a hash value w is a power (an intermediate random number ^R ) (w ^R ) as a dividend. c = w ^R mod p, S113). The first argument transmission unit 114 of the data registration unit 11 transmits the tag generation argument c to the n secret calculation devices 2-1, 2-2,..., 2-n (S114).

  The tag calculation unit 231 of the tag generation unit 23 of the secret calculation device 2 calculates the tag y = cr ′ by secret calculation from the fragment of each bit of the tag generation argument c and the search random number r ′ (S231). As a specific method, for example, there is a method described in Section 5.6.1 of Reference Non-Patent Document 2. The tag holding unit 232 of the tag generation unit 23 holds y as a tag in the storage unit 24 (S232). The tag registration completion notification unit 233 of the tag generation unit 23 transmits a tag registration completion notification to the data registration unit 11 of the data registration device 1 (S233).

  The tag calculation operation at the time of data search in the data search device 3 is the same as described above. As shown in FIG. 14, the tag calculation operation at the time of data search is executed in the same manner as in FIG. Specifically, the operations of the data search unit 31 and the data registration unit 11 are the same. Accordingly, the operations of the first hash value generator 112 and the second hash value generator 312, the operations of the first argument calculator 113 and the second argument calculator 313, the first argument transmitter 114 and the second argument transmitter 314. The operations are the same.

<Tag calculation operation during data registration (distributed retention of registered data fragments)>
A tag is generated by the same method at the time of data registration, and the tag is assigned to the corresponding fragment. This will be specifically described with reference to FIG. FIG. 15 is a sequence diagram showing a tag calculation operation at the time of data registration of the secret search system 1000 of this embodiment. In this specification, this section is described after <attribute random number generation operation>. However, the present invention is not limited to this, and the order of execution may be reversed. As shown in FIG. 15, the registration data fragment generation unit 115 of the data registration unit 11 of the data registration device 1 generates a fragment of registration data (S115). The registration data fragment transmission unit 116 of the data registration unit 11 transmits the registration data fragment to the n secret computing devices 2-1, 2-2,..., 2-n (S116). The tag calculation unit 231 of the tag generation unit 23 of the secret calculation device 2 calculates a tag in the same manner as described above (S231A). The tag holding unit 232 of the tag generation unit 23 holds the tag in the storage unit 24 as described above (S232A). As described above, the tag registration completion notification unit 233 of the tag generation unit 23 transmits a fragment registration completion notification to the data registration unit 11 of the data registration device 1 (S233A). “Distributed retention of registered data fragments” is a process different from tag generation. In the secret calculation described in the background art section, “input numerical values are converted into data called fragments to generate n This refers to the part that is kept in the secret computing device.

<Data search operation>
When searching, a tag is generated from the data to be searched. If the data to be searched and the registered data are the same, the tag is also the same. Therefore, the tag assigned in advance is compared with the tag generated at the time of search, and the search can be performed by a general search (for example, hash value search). This will be specifically described with reference to FIG. FIG. 16 is a sequence diagram showing a data search operation of the secret search system 1000 of this embodiment. The sequence of FIG. 16 is executed following the sequence of FIG. As shown in FIG. 16, the data request unit 251 of the search unit 25 of the secret computing device 2 refers to the tag y and requests the storage unit 24 to output search target data (S251). The data acquisition unit 252 of the search unit 25 acquires search target data from the storage unit 24 (S252). The search execution unit 253 executes a search (S253). The search result transmission unit 254 of the search unit 25 transmits the search result to the data search unit 31 of the data search device 3 (S254).

  According to any one of the secret search system 1000, the data registration device 1, the secret calculation device 2, and the data search device 3 according to the present embodiment, the communication between the secret calculation devices necessary for the search is only the secret calculation portion related to tag generation. For this reason, the communication amount that has conventionally been O (log (m)) is reduced to O (1) regardless of the number of records m.

  The various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good.

  Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer). In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

Claims (5)

The first prime number is equal to twice the second prime number plus 1;
An attribute random number calculation unit for calculating an attribute random number greater than or equal to 1 and less than the second prime number;
n is an integer greater than or equal to 2,
An attribute random number fragment distribution holding unit for distributing and holding fragments of the attribute random numbers among n secret computing devices;
The prime parameter of the secret calculation is the second prime number,
A product of an intermediate random number that is a random number greater than or equal to 1 and less than the second prime number and its inverse element is equal to a remainder with the second prime number as a divisor and 1 as a dividend, and the inverse element fragments are the n secret computations. It shall be distributed and held among devices,
A search random number calculation unit for obtaining a search random number by a secret calculation based on the inverse element and the attribute random number;
A search random number fragment distribution holding unit that holds the search random number fragments distributed among the n secret computing devices;
A format converter for converting the data format of the search random number stored in a distributed manner into bit information;
A prime parameter conversion unit for converting the prime parameter of the secret calculation in each bit of the search random number into the first prime by secret calculation;
From the tag generation argument which is a remainder with the first prime number as a divisor and the hash value generated for the search target data raised to the power of the intermediate random number as a dividend, and a fragment of each bit of the search random number, a secret A secret calculation device including a tag calculation unit for calculating a tag by calculation. A secure search system including n as an integer of 2 or more, n secret calculation devices, and a data registration device,
The secret computing device is
The first prime number is equal to twice the second prime number plus 1;
An attribute random number calculation unit for calculating an attribute random number greater than or equal to 1 and less than the second prime number;
An attribute random number fragment distribution holding unit for distributing and holding the attribute random number fragments among the n secret computing devices;
The data registration device includes:
An intermediate random number generator that generates an intermediate random number that is greater than or equal to 1 and less than the second prime number;
An inverse element calculation unit for calculating the inverse element so that a product of the intermediate random number and its inverse element is equal to a remainder having the second prime number as a divisor and 1 as a dividend;
An inverse element fragment distribution holding unit that distributes and holds the inverse element fragments among the n secret computing devices;
The secret computing device further includes:
A search random number calculation unit that obtains a search random number by a secret calculation based on the attribute random number and the inverse element;
A search random number fragment distribution holding unit that holds the search random number fragments distributed among the n secret computing devices;
A format converter for converting the data format of the search random number stored in a distributed manner into bit information;
A prime parameter conversion unit that converts the prime parameter of the secret calculation in each bit of the search random number into the first prime by secret calculation;
The data registration device further includes:
A hash value generation unit that generates a hash value for the search target data based on a hash function;
An argument calculation unit that calculates a remainder that uses the first prime number as a divisor and the hash value that is a power of the intermediate random number as a dividend as a tag generation argument;
An argument transmitting unit that transmits the tag generation argument to the n secret computing devices;
The secret computing device further includes:
A secret search system including a tag calculation unit that calculates a tag by secret calculation from a fragment of each bit of the tag generation argument and the search random number. The first prime number is equal to twice the second prime number plus 1;
An attribute random number calculation step of calculating an attribute random number greater than or equal to 1 and less than the second prime number;
n is an integer greater than or equal to 2,
An attribute random number fragment distribution holding step for distributing and holding the attribute random number fragments among n secret computing devices;
The prime parameter of the secret calculation is the second prime number,
A product of an intermediate random number that is a random number greater than or equal to 1 and less than the second prime number and its inverse element is equal to a remainder with the second prime number as a divisor and 1 as a dividend, and the inverse element fragments are the n secret computations. It shall be distributed and held among devices,
A search random number calculation step for obtaining a search random number by a secret calculation based on the inverse element and the attribute random number;
A search random number fragment distribution holding step for distributing and holding the search random number fragments among the n secret computing devices;
A format conversion step of converting the data format of the search random number stored in a distributed manner into bit information;
A prime parameter conversion step of converting the prime parameter of the secret calculation in each bit of the search random number into the first prime by secret calculation;
From the tag generation argument which is a remainder with the first prime number as a divisor and the hash value generated for the search target data raised to the power of the intermediate random number as a dividend, and a fragment of each bit of the search random number, a secret A secret calculation method including a tag calculation step of calculating a tag by calculation. n is an integer greater than or equal to 2, n secret calculation devices, and a secret search method executed by a data registration device, wherein the secret calculation device includes:
The first prime number is equal to twice the second prime number plus 1;
An attribute random number calculation step of calculating an attribute random number greater than or equal to 1 and less than the second prime number;
Performing an attribute random number fragment distribution holding step for distributing and holding the attribute random number fragments among the n secret computing devices;
The data registration device includes:
An intermediate random number generating step for generating an intermediate random number greater than or equal to 1 and less than the second prime number;
An inverse element calculation step for calculating the inverse element so that a product of the intermediate random number and its inverse element is equal to a remainder with the second prime number as a divisor and 1 as a dividend;
Performing an inverse fragment distribution holding step for distributing and holding the inverse fragment among the n secret computing devices;
The secret computing device further includes:
A search random number calculation step for obtaining a search random number by secret calculation based on the attribute random number and the inverse element, wherein the prime parameter of secret calculation is the second prime number;
A search random number fragment distribution holding step for distributing and holding the search random number fragments among the n secret computing devices;
A format conversion step of converting the data format of the search random number stored in a distributed manner into bit information;
Performing a prime parameter conversion step of converting the prime parameter of the secret calculation to each first bit of the search random number by the secret calculation;
The data registration device further includes:
A hash value generation step for generating a hash value for the search target data based on a hash function;
An argument calculation step of calculating a remainder with the first prime number as a divisor and a value obtained by dividing the hash value by a power of the intermediate random number as a tag generation argument;
Performing an argument transmission step of transmitting the tag generation argument to the n secret computing devices;
The secret computing device further includes:
A secret search method for executing a tag calculation step of calculating a tag by secret calculation from a fragment of each bit of the tag generation argument and the search random number.   A program for causing a computer to function as the secret calculation device according to claim 1.

Images