JP2003218854A - Method, apparatus, and program for carrying out dynamic programming - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To carry out a dynamic programming while concealing input. <P>SOLUTION: Weight w(j, k) of a link (j, k) is made public by giving a weight cipher e<SB>j</SB>,<SB>k</SB>in which w ciphers E(z) of z due to a quasi-isomorphic cipher E arrayed, then n-w (n is the maximum weight) of cipher E(1) of number 1 are arrayed. The product of additional weight ciphers e'<SB>j</SB>,<SB>k</SB>from entire nodes k on the final stage side connected to e<SB>j</SB>,<SB>k</SB>through node units N<SB>j</SB>is obtained, decoding them successively starting with the largest element number, an element number where the result becomes from 1 to z is set to be the maximum weight f(j) of a portion from a terminal node to j, the entire weight ciphers e<SB>i</SB>,<SB>j</SB>connected to the initial stage side of the node j is shifted to the right by f(j), the E(z) are added to the vacant left side, further, the cipher vector is randomized to make it as an additional ciphers e'<SB>i</SB>,<SB>j</SB>, which is carried out for each node, and the maximum weight f(0) at a node 0 is set to be the maximum value. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a safe dynamic programming execution method that can be applied to, for example, a bidding method for a plurality of goods, a node device used for the method, and a program therefor.

[0002]

2. Description of the Related Art Dynamic programming is a combinatorial optimization technique in which an optimal solution is obtained by sequentially expanding a partial optimal solution. It can be applied to a problem that satisfies the "optimality principle" that a part of the optimum solution is also the optimum solution of the subproblem. The longest (shortest) path problem in the graph is famous. For the sake of simplicity, the longest path problem of the one-dimensional effective graph as shown in FIG. 7A will be mainly described as an example. The graph of FIG. 7A shows that node 0,
1, ..., m and some links (j, k) (where j <
k) and each link (j, k) has a weight w (j, k).
Is given. For example, for link (0, 1), weight w
(0,1) = 1, but the link w (0,2) has a weight w (0,
2) = 2 is given.

Now, the weight w from node j to node m
Considering the longest path with respect to all the nodes k on the longest path, the part from the node k to the node m in the longest path is the longest path with respect to the weight w from the node k to the node m. The path problem satisfies the "principle of optimality". Therefore, the longest path regarding the weight w from the node 0 to the node m can be obtained by the dynamic programming as follows. First, node j
Since the part from each node k to node m on the longest path from to node m must also be the longest path,
The longest route from node j to node m is link (j,
k) and the longest route from the node k to the node m. Also, since the longest route from node j to node m is the longest, it is the longest route among the above routes. Therefore, if the longest path length related to the weight w from the node j to the node m is written as f (j), f (j) is the recurrence formula f (j) = max _{(j, k)} of the following dynamic programming method. {W (j, k) + f (k)} is satisfied. Therefore, if f (m) = 0, then j = m
Starting from j = m−1, m−2, ..., 1, 0 are sequentially given and the above recurrence formula is repeatedly applied, and finally f (0) when j = 0 is obtained. Is the longest path length for the weight w up to. Also, f
The longest path that realizes (0) is the link (j, k) that realizes max _{(j, k)} in the direction of j = 1, 2, ... Can be found by sequentially finding

For example, when the longest path length is obtained, when j = 2, the link (2, 3) between the nodes 2 and 3 and the node 2 and m-
Since there is a link (2, m-1) between 1, the link (2, m-1)
The sum w (2,3) + f (3) of the weight w (2,3) of 3) and the longest path length f (3) between the nodes 3 and m, and the weight w of the link (2, m−1). (2, m-1) and node m-1
And the longest path length f (m-1) between m and w (2, m-
The maximum of 1) + f (m-1) is defined as f (2). When finding the longest route, w (2,3) when j = 2
Reverse to node 3 or m-1 connected by the link giving the maximum of + f (3) and w (2, m-1) + f (m-1).

[0005]

[Problems to be Solved by the Invention]
In other words, it has not been proposed to find the optimum value, for example, the longest or shortest route value while keeping the weight of each link secret, and to find only the route having the optimum value while keeping the weights of other routes secret. . If dynamic programming can be executed with the weight kept secret, it can be applied to, for example, a bidding method for multiple goods, which is very convenient. An object of the present invention is to provide a method for executing a dynamic programming method that can obtain an optimum value while keeping weights secret, a node device used for the method, and a program therefor.

[0006]

According to the present invention, the weight issuing device determines the weight w (j, k) of the link (j, k) (0 < j <k < m) (m is the final node). A weighted cipher vector e _{j, k} (w (j, k)) is created and disclosed. The weight number vector e _{j, k} (w (j, k)) is a cipher E _j (z) that encrypts the number z disclosed with the public key PK _j of the homomorphic public key cipher E, and a number 1 is encrypted. And the cipher E _j (1) that has the maximum value n that the weight w can take. When the maximum value is an optimum value, E _j (z) is set to w (j,
k) arranged, E (1) arranged (n−w (j, k)) arranged,
When the minimum value is set to the optimum value, E _j (z) is set to (n−w)
(J, k)) and E _j (1) are arranged by w (j, k). The homomorphic cipher is (1) indistinguishable, that is, E (m _b ) is m _{0 when} looking at plaintext m ₀ , m ₁ and cipher E (m _b ).
It cannot be applied whether it is an encrypted version of m or an encrypted version of m _1. (2) Homomorphic, that is, E (ab) = E
(A) E (b) and (3) re-encryptable, ie E
It is possible to efficiently calculate another ciphertext E ′ (m) of the same plaintext from (m), for example, ElGamal encryption or P
For example, the Aillier cipher. Further, z is preferably a number other than 1 in the range that can be the plaintext of ciphertext.

Each node device N _j obtains the product of the addition weight cryptographic vectors e ′ _{j, k} of all the links on the downstream side (final stage) connected to the node j (j <k < m), and the product vector The elements are sequentially decoded, and the number of element numbers when the decoding result changes from 1 to z is set as the partial optimum value f (j). In addition, the node device N _j has weight cipher vectors e _{i, j} of all links on the preceding stage (first stage) side connected to the node _j .
(0 < i <j) is shifted by f (j), E _i (z) or E _i (1) is added to the vacant element position, and the added vector is randomized to add weight encryption. Create a vector e'i _{, j} and send it to the node device of the corresponding node i. The shift is performed by right-shifting and adding E _i (z) to obtain the maximum value, and left-shifting and adding E _i (1) when obtaining the minimum value.

[0008] sequentially performed toward this fact from the node device N _m-1 to the ingress node device N _0, to expose as the final optimum value for obtaining the suboptimal value obtained in the ingress node device N _0.

[0009]

DETAILED DESCRIPTION OF THE INVENTIONDynamic programming As shown in FIG. 1, a plurality of weight issuing devices 11-1, ..., 1
1-L and a plurality of node devices N₀, ..., N_mAnd communication network 12
And the bulletin board device 13 and the operation device 14 as necessary.
A system to which the method of the present invention is applied is configured.
In the following explanation, for simplification, the longest one-dimensional effective graph
Take the route problem as an example. Each node device N_j(J = 0, ...,
m) is the private key SK of homomorphic public key encryption _jAnd published
Key PK_jPublic key PK_jIs published. This
Is published to the bulletin board device 13_jIdentification information
Anyone can register with the information (ID) and public key PK_jTo
By making it available or registering with a certification authority device
Good.

The weight issuing devices 11-1, ..., 11-L are provided corresponding to the respective links, and issue weights for the links. Link (j, k), (0 <j <k <m) as shown in the weight issuing device 11-j, k, for example 2 to issue weight w (j, k), the public node device N _j Key PK
_j and the published number z are stored in the storage unit 111 as necessary, and when the weight w (j, k) is input from the input unit 112, the weight w (j, k) is input to the encryption unit 113, Weight cipher vector e in which the number of elements consisting of cipher E _j (z) obtained by homomorphic encryption of z and number 1 with public key PK _j and E _j (1) is equal to the number of possible maximum weight n
_{j, k} (w (j, k)) is generated. As shown below, from the first element to the w (j, k) th element is E
E _j (1) is from the _j (z), (w (j, k) +1) th element to the nth element.

1 2 ... W (j, k) w (j, k) +1 n E _j (z), E _j (z), ..., E _j (z) E
_j (1), ..., E _j (1) That is, as shown in FIG. 3, only E _j (1) when the weight w = 0, and when w = 1, only the first element is E _j (z). Yes, w = 2, 1st and 2
Only the th element is E _j (z) and n for w = n−1.
Only the th element is E _j (1), and for w = n all elements are E _j (z). The weight cipher vector e _{j, k} (w (j, k)) (hereinafter also simply referred to as e _{j, k} ) generated by the cipher unit 113 is sent to the bulletin board device 13 by the communication unit 114 on the ID of the link (j, k). Registered and released with. Therefore, in the example shown in FIG. 6, as shown in FIG. 4, the bulletin board device 1 for each link determined by the nodes j and k
3 in the weight storage unit 131. That is, j = 0, k
= ₀ for e _0,1 and j = 0, k = 2 for e
_0,2 is stored in the place of j = 1, k = 2, e _{1,2 and} so on.

The weight cipher vectors for all links are
When it is released, for example, the operation device 14 of the system
Monitor and node device N_m-1In order from
Setting N ₀Run dynamic programming until. The operation device 14 operates
Information of the target graph G that implements dynamic programming, that is, the graph
For each node that makes up G and for each link that connects the nodes
It is assumed that the information to be stored is stored. Node device N_jof
An example of the functional configuration is shown in FIG. 5, and an example of the processing procedure is shown in FIG. 7A.
Show. Final stage (second stage) connected to node j in step S1
Addition weight cipher vector e ′ of all links on the side_{j, k}But
If they are complete, that is, find the partial optimum value (partial maximum value)
Target addition weight encryption vector e ′_{j, k}Have you got
Find out. This is the node device N_jIs added to the bulletin board device 13
The target addition weight cipher vector e ′ is stored in the weight storage unit 132.
_{j, k}Is stored in the same way as the weight storage unit 131.
And you can know. Or executed from the operation device 14
The instruction notification is received, or the node device N at the next stage is received._{j + 1}Or
Process completion (or execution instruction) notification from
Know that the elephant addition weight cipher vectors are complete. For example
Node device N of node 2 in 7A₂And node 2
Addition weight darkness given to the link (2, m-1) of m-1
No. vector e '_{2, m-1}And the link between nodes 2 and 3 (2,
3) Addition weight cipher vector e ′ given to_2,3Assorted
It was confirmed that This confirmation is made through the communication unit 201.
Is done.

In step S2, all the added weight cipher vectors _{e'j, k} that have been collected are loaded from the bulletin board device 13,
In step S3 all but ipecac the weighting factor encryption vector e _'j, the product [pi _k e j of each component of _k, the product of the _k arithmetic unit 20
Calculate with 2. Π _k e _{j, k} = (Π _k e _{j, k, 1} , ..., Π _k e _{j, k, n} ) The homomorphic property E (a) · E (b) = E (ab) of the cipher E
Therefore, each element c _x (x =
1, ..., n) is the _{c x = Π k e j,} k, x = E (z s (x)). Where s (x) = # {k | x < w (j, k)}
Is the number of additive weight cryptographic vectors having a weight of x or more.

In step S4, each element c _{x of the} product vector
, In the order of x = n, n−1, ..., 1 by each element decryption unit 203 with the secret key SK _j , and in step S5, the optimal value determination unit 204 determines whether the decryption result is z first. Then, the elements c _x are sequentially decoded until z is first obtained. In step S6, the element c _{x from} which z is obtained first
The element number x of is stored as the partial maximum value f (j) in the storage unit 225.
Remember. In this way, the maximum weight value f (j) can be obtained while keeping the weight secret. Moreover, the code E
Which additional weight cipher vector e ′ is
It is not possible to know whether the weight of _{j, k} is f (j).
Steps S3 to S6 are processes of detecting a partial optimum value, and the product calculation unit 202, each element decoding unit 203, and the optimum value determination unit 204 constitute a partial optimum value detection unit 205.

In step S7, the preceding stage connected to node j
Weight cipher vector e for all links on the (first stage) side_{i, j}
From the weight storage unit 131 of the bulletin board device 13. Figure
In the case of node 2 in 7A, the link between nodes 1 and 2 (1,
2) Weight cipher vector e _1,2And nodes 0 and 2
Weighted cipher vector e of link (0, 2)_0,2Capture and
Mu. In step S8, the weighted cipher vectors acquired are
E_{i, j}Maximum value f detected by the shift unit 206
Only (j) shifts to the right. In step S9
The publicized number z is extracted from the storage unit 225, and the publicized number z is stored in the encryption unit 207.
Device N_iPublic key PK_iEncrypted by the step
In S10, the code E_i(Z) is a right-shifted weight
Cipher vector e_{i, j}Vacated by each shift of
The addition unit 208 adds the element position. That is, each weight cipher
Vector e_{i, j}Shifts to the right by the cipher E_j(1)
F (j) are removed, and to the left (the side with the smallest element number)
f (j) ciphers E_i(Z) is added.
Due to the re-encryptable nature of cipher E, E_i(Z), E_i(1)
To E ′_i(Z), E '_iCan be calculated efficiently in (1)
It Therefore, the shift and E_iThe addition of (z) is the weight w
Weighting the weight w (i, j) without revealing (i, j)
This means that f (j) is added.

In step S11, the weight cipher vector to which the cipher E (z) is added is randomized by the randomizing unit 209 with the public key PK _i , and the cipher E added is added.
The number of (z), that is, the partial maximum value f (j) is concealed to obtain the addition weight cipher vector e ′ _{i, j} . Shift unit 2
06, encryption unit 207, addition unit 208, and randomization unit 2
Reference numeral 09 forms a weight addition unit 211. Step S1
In step 2, each generated addition weight cipher vector e ′ _{i, j} is sent to the node device N _i of the corresponding node i. This addition weight cipher vector e ′ _{i, j} may be directly transmitted to the node device N _i , or may be transmitted to the bulletin board device 13 and made public, and the node device N _i may take in it. When publishing to the bulletin board device 13, the node device N ₀ may notify the operation device 14 or the node device N _j-1 of the immediately preceding stage that the processing has ended.

[0017] by encrypting the weights weights w (i, j) portion detected by the node device N _j to a maximum value f (j) is added link (i, j) in this way the node device N _i The additive weight cipher vector is sent. Similarly node device N _i weighting factor encryption vector weights obtained by adding the detection portion maximum value of the node encrypted from device all nodes on the weight of the links within the node in the subsequent stage side feed to connect with node i to Will be done. This is the node device N
_m-1 is processed _first , and the node devices N _m-2 , N _m-3 ,
... and the device of the node on the first stage side.

Therefore, in the process in the node device N _j , the process of obtaining the partial maximum value f (j) from the addition weight cipher vector is performed by all the nodes k on the downstream side connected to the node j.
The maximum value of the sum w (j, k) + f (k) of the weight w (j, k) between and the partial maximum value f (k) from the final node m to the node k, that is, f (k j) = max _{(j, k)} (w (j, k) + f (k)) is detected. This formula satisfies the recurrence formula of dynamic programming. Note that f (m) = 0.

Therefore, the partial maximum value f (0) detected by the node device N ₀ of the first-stage node 0 becomes the maximum value of the weight in the route between the node 0 and the node m. Therefore, this f (0) is disclosed as the maximum weight value (optimum value). As above, without revealing the weight of each link, execute dynamic programming,
The maximum weight f (0) in the path between nodes 0 and m can be determined. Next, a weight maximum value route that realizes the calculated weight maximum value f (0) is obtained. In this case, the node device N ₀ may be used as a starting point toward the final stage node device N _m , and the link having the maximum weight of the final stage link connected to the node may be sequentially searched for.

In other words, for example, in the node device N _j , in step S13, the reception of the route tracking notification is waited, and when this is received, the partial maximum value f (j) previously detected from the storage unit 225 is set to f in step S14. (J ₀ ), and in step S15, the addition weight cryptographic vectors e ′ _{j, k} of all the links on the rear side connected to the node j are acquired. This acquisition may be acquired from the bulletin board device 13, or may be acquired when the partial maximum value f (j) is detected first and stored in the storage unit 225. Steps S14 and S
Any of 15 may be performed first.

In step S16, the obtained addition weight darkness is obtained.
No. vector e '_{j, k}F (j₀) Element is the private key
SK_jThe one-element decoding unit 215 decodes the
In 17, the decryption result is the addition weight cipher vector of z.
e ′_{j, k}Is determined by the route determination unit 216. This added weight
Only cipher vector e ′_{j, k}K of k₀When expressed as
e ′ _{j, k0}Is the full addition weight cipher vector e ′_{j, k}Heavy inside
The maximum value is the cipher vector corresponding to the weight w.
Easily understood from the structure of Kuttle elements and the arrangement method
U

The addition weight of the maximum weights thus obtained
Only cipher vector e_{j, k0}Is given a link (j,
k₀) Or a node connected to node j by its link
Do k ₀Is published, and f (j₀) Is also published
Both nodes k₀Node device N_k0Send route tracking notification to
It This process is performed in order by the node device that receives the route tracking notification.
By performing the following, the node m is changed to the maximum weight node k₀Tosu
The maximum value f (0) is given by the disclosure of
Each node on the maximum weight path, that is, each link
Be done. The node device N₀Route tracking notifications to
From the device 14 or the node device N₀Is f (0)
After asking, the route tracking notification is automatically received.
You may. Even in this route tracking, other than the maximum weight route
Nodes, links, and their weights remain hidden.

When a plurality of addition weight cryptographic vectors _{e'j, k} have the maximum weight when the partial maximum value f (j) is obtained, that is, the decryption result changes from 1 to z ^P (P > 2). In that case, the element number at that time may be set to f (j), and the route may be traced for a plurality of routes having the maximum weight. In the device configuration shown in FIG. 5, the control unit 217 sequentially operates each unit. It is also possible to obtain the minimum weight and the minimum weight path. In this case, for the weight w, the cipher E (z) is given as the weight cipher vector e.
Are arranged from the smallest element number nw, and then w pieces of encryption E (1) are arranged.
If the same processing as 05 is performed, E (z) is located at a higher element number as the weight w is smaller, due to the change of the element array of the weight cipher vector. Therefore, the detected element number has a partial minimum value f (j). ) Will be represented. The shift unit 206 shifts the weight cipher vector e _{i, j} to the left by f (j),
E (1) is added to the empty element on the right side. The weight of the cipher vector thus obtained is w (i, j) + f
(J), that is, the weight w (i, j) of the link (i, j)
It is a value obtained by adding the partial minimum value f (j) to j). Therefore, the partial optimum value detection unit 205 adds the partial minimum weight f (k) from the node m to the node k to w (j, k) of all the links (j, k) on the final stage connected to the node j. It means that the minimum weight value is obtained from the things. That is, the recurrence formula of the dynamic programming method of f (j) = min _{(j, k)} (w (j, k) + f (k)) is executed. If the same processing as the above is performed for the route tracking, the node device N
_{If the} e ′ _{j, k for} which z can be obtained by decoding the f (j ₀ ) -th element in _j0 is obtained, the path of the minimum weight value is _followed .

Next, a specific example will be described. Shown in Figure 7B
Take a one-dimensional graph as an example. The nodes are 0, 1, 2, 3
Link (0,1), (1,2), (1,3),
Each weight of (2,3) w (0,1) = 3, w (1,2) =
2, weighted darkness with w (1,3) = 1 and w (2,3) = 0
The No. vector is as follows. Let n = 6. e_1,2 = {E₀(Z), E₀(Z), E₀(Z), E
₀(1), E₀(1), E₀(1)} e_1,2 = {E₁(Z), E₁(Z), E₁(1), E
₁(1), E₁(1), E₁(1)} e_1,3 = {E₁(Z), E₁(1), E₁(1), E
₁(1), E₁(1), E₁(1)} e_2,3 = {E₂(1), E₂(1), E₂(1), E
₂(1), E₂(1), E₂(1)} Node device N₂Is e_2,3To decode f (2) = 0
Ask, e_1,2Randomize without shifting e ′_1,2(W (1,2) + f (2)) = {E₁(Z), E₁(Z), E₁(1), E
₁(1), E₁(1), E ₁(1)} is made. max
Knowing {w (1,2) + f (2), w (1,3)}
Node device N₁Is e '_1,2And e ′_1,3Find the product of
Meru.

E ′ _1,2 · e ′ _1,3 = {E
₁ (z ² ), E ₁ (z), E ₁ (1), E ₁ (1), E
₁ (1), E ₁ (1)} The sixth, fifth, fourth, third, and second of this product vector
Each of the th elements is sequentially decoded to obtain the decoding result z for the first time, and f (1) = max {w (1,2) + f (2), w
It can be seen that (1,3)} = 2. Next, the node equipment N ₁ shifts e ′ _0,1 to the right by f (1) = 2, and E ₀
(Z) and E (z) are added to the left, and randomized to _e'0,1 (w (0,1) + f (1)) = {E
₀ (z), E ₀ (z), E ₀ (z), E ₀ (z), E ₀
(Z), E ₀ (1)} is obtained. This e ′ _0,1 is sequentially decoded into the sixth and fifth elements to obtain f (0) = 5.

As for the optimum route, the node device N ₁ decodes each f (1) = second element of e ′ _1,2 and e _1,3 to obtain z and 1, respectively, and the link (1, 2) Is max {w (1,
2) + f (2), w (1,3)} = 2. Application example The dynamic programming method that executes the bidding method while keeping the bid value confidential is described below. (1) Multi-item bidding There are m items of a single type, and each bidder B _k (k = 1, ...,
K) is j = 0,1, ..., the bid price to buy m number of goods b _k
(J), that is, the price to buy one is b _k (1), and the price to buy three is b _k (3). An appropriate number is given to the bidder B _k , and a state in which a total of s items are sold to k bidders is a node (k, s) as shown in FIG. 8, and a link between the nodes is a bid price. In other words, the node is 1 in FIG.
The node on the row is in a state of selling s = 0,1, ..., m items to k = 1 people, and the node on the second line is s = 0,1, ..., k to k = 2 people, respectively. It is a state in which m pieces are sold, and the last row (K-th row) is a state in which goods are sold to k = K persons by s = 0, 1, ..., M pieces.

The device of the _first bidder B ₁ is b ₁ (0),
..., b ₁ (m), the nodes k = 1, s = 0, 1, in the first row
The initial values f (1,0), f of the node device N _{1, j} of m
The second bidder B with (1,1), ..., f (1, m)
₂ of the bid price _{b 2 (j) (j =} 0, ..., m) , and to be as sold a total of s number of goods to the two bidders, the first row of the node (1, s- j) and the node (2, s) in the second row are linked by a link, and the bid price b ₂ corresponding to the link
(J) is given as the link weight. For example, the bid price b ₂ (1) where the _second bidder buys one good is a node (k =
1, s = 0) and nodes (k = 2, s = 1),
Nodes (k = 1, s = 1) and nodes (k = 2, s = 2)
Link between nodes, node (k = 1, s = 2) and node (k =
, S = 3) are given as weights.

F ((k, s)) is the maximum price when a total of s goods are sold to k people, and its initial value f ((1, j)) is b ₁
(J), m + 1 nodes (k = 1, 1) in the first row
Starting from (s = 0), ..., (k = 1, s = m), m + 1 nodes (k = K, s = 0) of the K-th row (final row),
, (K = K, s = m), the total value of the bid prices, that is, the maximum value of the total weight is calculated, and the maximum value f ((K , S)) can be determined by executing the following recurrence formula.

[0029]

[Equation 1]

That is, by solving this dynamic programming method, a value that maximizes the total weight, that is, a route that maximizes the winning bid price can be obtained, and goods can be distributed through the route. Therefore, as described above, the bid price b _k (j) is used as the link weight from the bidder device (weight issuing device) to generate the weight cipher vector e _{j, k} , and f ((k-1, s-
j)) is added weight cipher vector e ′ _{j, k} encrypted as described above _, and f is used as a partial optimum value f (j).
The bid price by obtaining ((k, s)), the highest bid price f ((K, s)) with the bidder kept secret,
Further, by tracing the route, only the number of each successful bidder, the goods, and the winning bid price can be disclosed. (2) Linear goods bid linear goods bid goods 1 as shown in FIG. 9, good 2, ..., with respect to the m goods ordered to goods m and linear, consecutive intervals have Bidder B _k [u bid price b _{k for} goods of _k , v _k ]
([U _k , v _k ]) is given. For example, the bid price of bidder B ₂ for goods 1 and goods 2 is b ₂ ([0, 2]), and the bid price of bidder B ₅ for goods 3 to goods m-1 is b
₅ ([3, m-1]). In this case, goods 1, 2, ...
Are sequentially connected via nodes 1, 2, ... As the minimum section link, the end of the connection on the item 1 side is node 0, the end on the item m side is node m, and the section [u _k , v _k ] is Node u _k
And v _k as the link weight w (u _k ,
v _k) as the bid price b _k (given the _{[u k, v k])} ,
The dummy link (j-1, j) and its weight W are included in order to prevent the route from being cut off because there is an unbidded section.
It is known that if (j-1, j) = 0, the successful bid result corresponds to the longest route from node 0 to node m in the graph shown in FIG. That is

[0031]

[Equation 2]

It suffices to find the solution of the recurrence formula
It Therefore, the bidder device (weight issuing device) is_k，
v_k] Bid price b_k([U_k, V_k]), Link
(U_k, V _k) Weight w (u_k, V_k) As weight cipher
Vector e_{uk, vk}Is issued and the same as above in the node device
The bid price and bidders are hidden by
You can obtain the winning bid as f (0)
By tracking the route, each successful bid section and its bid price can be
It is possible to obtain the bill price without revealing the section. (3) Route bidding For example, given the effective graph G shown in FIG.
B_kIs the effective side (link) d of this graph G Entering
Bill price b_kBid (d). Nodes 0, 1, ..., 4
Each represents a city, and luggage from node 0 to node 1
The bid price of the shipping fee is the weight w of the link (0, 1)
Give as (0,1) and bid on the shipping fee for each link
Calculate the price and minimize the shipping fee from node 0 to node 4
The route to f (j) = min_{(j, k)}(W (j, k) + f (k)) It can be obtained by solving the recurrence formula of. Therefore
Also in this case, the bidder bids for the route from the weight issuing device.
Enter the price as the link weight and enter the weight cipher vector
e_{j, k}And perform the same processing as described above on the node device.
From the optimum value f (0) to the minimum winning bid
Can be requested with the bid price and link kept secret.
Similarly, the shortest route can be traced to other bid prices,
You can request while keeping the link confidential. (4) Combined bidding All the different m pieces of goods M = {1,2, ..., m}
For each S, each bidder B _kIs the bid price b_kGive (S)
It For example, if the set M of goods is three goods 1, 2, 3
The minute set S⊂M is 2 as shown in FIG.³There are these
Let the eight subsets S be nodes. For every k
And connect all subsets S to the empty set (without goods) {}
Gulink (S, {})_k, Then the number of elements | C | is the number of elements
A link connecting a subset C⊃S of more than half of | S |
(S, C)_kAnd create w ((S, {})_k) = B
_k(S), w ((S, C)_k) = B_kLink with (S, C)
Determine the weight of.

In this way, the route from the empty set {} to the entire set {1, 2, 3} having the maximum total weight can be obtained by using the dynamic programming method, and the winning bid price can be obtained. it can. By performing the above-mentioned processing by the node device, the winning bid price f (0) can be obtained while keeping the bid price secret. In the same way, the route tracking is weighted on other than the route,
You can publish the link while keeping it secret. The node device N _j can also be caused to function by executing a program by a computer. In this case, for example, the computer of the node device N _j may execute a processing program that enables the computer to execute the method shown in FIG.
Install from ROM, flexible magnetic disk, etc.
Alternatively, it will be downloaded and used via a communication line.

[0034]

As described above, according to the present invention, the optimum solution can be obtained by executing the dynamic programming without leaking the input information. The reason is that the input is represented by a vector of the homomorphic ciphertext, the maximum value or the minimum value is obtained by taking the product of each element, and the constant can be added by shifting the element right or left. is there. If the bid price is used as the input, the winning bid can be determined while keeping the bid price confidential.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration example of a system to which the method of the present invention is applied.

FIG. 2 is a diagram showing a functional configuration example of a weight issuing device in FIG.

FIG. 3 is a diagram showing an example of the relationship between weights and their cipher vectors.

FIG. 4 is a diagram showing a storage example of weighted cryptographic vectors disclosed on a bulletin board device.

5 is a diagram showing an example of a functional configuration of a node device in FIG.

FIG. 6 is a flowchart showing an example of a processing procedure of a node device.

FIG. 7 is a diagram showing an example of a graph.

FIG. 8 is a diagram showing an example of the relationship between nodes and links in bidding for multiple goods.

FIG. 9 is a diagram showing an example of a relationship between a node and a link in a linear goods bid.

FIG. 10 is a diagram showing an example of a graph G in route bidding.

FIG. 11 is a diagram showing an example of the relationship between nodes and links in combined bidding.

Claims (11)

[Claims] 1. A plurality of weight issuing devices and nodes for each node
Equipped with a communication device that connects them. Each node device N_j(J = 0,1, ..., m) is homomorphic
Public key PK of key cipher E _jPublished Each weight issuing device has a link (j, k) between a pair of nodes.
(0<j <k<Disclosure according to the weight w (j, k) of m)
The number z other than 1 in the range that can be the plaintext of the ciphertext being used
Public key PK_jEncryption E using encryption E_j(Z)
And the cipher E of number 1_jOne of (1) and w (j, k) pieces
The maximum value n from which the weight can take the other is w (j, k)
Cipher vector e arranged by the number of subtracted values_{j, k}(W
(J, k)), Each node device N_jIs connected to node j
Addition weight cipher vector e ′ of all links_{j, k}Product of
Obtained, sequentially decode each element of the product vector, the decoded value
From the element number when changes from one of 1 and z to the other
Find the optimum value f (j) for the minute and connect to the node j
Weight cipher vector e of all links on the preceding stage side_{i, j}(W
(I, j)) (0<i <j) is a partial optimum value f
Shifted by the number of (j), and encrypted E at the empty element position.
_i(Z) and E_iAdd one of (1) and P
K_iRandomize with link and add (i, j) weight cryptography
Vector e ′_{i, j}Find (w (i, j) + f (j))
Corresponding node device N_iSend to This is the node device N_m-1From the first step,
Device N₀The partial optimum value f (0) obtained in
Method of dynamic programming characterized by being published as
Law. 2. The node apparatus N _j0 notified of the route tracking is a partial optimum value f (of the node apparatus N _j0 of the addition weight cryptographic vectors e ′ _{j0, k} of all links at the _subsequent stages connected to the node j _0. j ₀₎ th element decodes the decoding result notified path tracking the node device N _k0 node k ₀ connected by links with additive weights encryption vector is z, node k
₀ to publish that to achieve sub-optimal value f (j _0), sequentially performs this from the node device N _0, the node device N
_{2. The} method for executing dynamic programming according to claim 1, wherein the optimum route is obtained by going up to _m-1 . 3. A storage unit for the secret key SK _j of the apparatus N _j homomorphic public key encryption E is stored, weighting factor encryption vectors of all the second-stage link for the node j of the self-device N _j input Then, the product arithmetic unit for obtaining these products and the weight vector are the encryption E (z) and the equation 1 using the public key of the number z other than 1 in the range that can be a plaintext for the weight w. Of the encryption E (1) of (1) are arranged, and the other is arranged by the number of values obtained by subtracting w from the maximum value n that can be taken by the weight. Is input, and each element decryption unit that decrypts with the secret key SK _j and the decryption result of each of the above element decryption units are input, and the value of the element number from 1 to z is set as the partial optimum value f (j). Optimum value determination unit to perform, and partial optimum value f (j) and all preceding links connected to node j Of the weight cipher vector input, a shift unit for shifting these weights encryption vector by f (j), the z or 1 is input, which the node device N _i of each node i to connect with each of the former side link An encryption unit that obtains the encryption E _i (z) or E _i (1) by encryption with the public key PK _i, and the above-mentioned encryption E _i (z) at the element number position vacated by the shift of each of the shifted weighted encryption vectors. Or E _i (1)
, A randomizing unit that randomizes the weight cipher vectors to which the respective ciphers are added with a corresponding public key PK _i to create an addition weight cipher vector of the preceding link, and an addition of the latter link. get the weight cipher vector, a communication unit for transmitting to the corresponding node device N _i of weighting factor encryption vector of the front side link, sequential operation is to control unit and including a dynamic programming execution node device the respective units . 4. The addition weight cipher vectors of all the links on the latter stage side and the partial optimum value f (j) are input, and the partial optimum value f (j) th element of each of the addition weight cipher vectors is secret key SK, respectively. _The one-element decryption unit that decrypts at _j , and the route determination unit that determines the node k ₀ connected to the link of the addition weight cryptographic vector whose decryption result by the one-element decryption unit is z 4. The dynamic programming method execution node device according to claim 3, wherein the node device of the node k ₀ performs a route tracking notification. 5. When the addition weight cryptographic vectors of all the links at the subsequent stages connected to the node j of the own device N _j are prepared, a product vector of these addition weight cryptographic vectors is obtained, and the weight cryptographic vectors are disclosed here. The value of the weight w is one of the cipher E (z) using the public key of the homomorphic public key cipher E of a number z other than 1 in the range that can be the plaintext of the ciphertext , And the other is the maximum value n from the maximum weight
The number of values obtained by subtracting is obtained. Each element of the product vector is sequentially decrypted by the secret key SK _j of the own device, and it is determined whether the decryption result has changed from 1 to z. When the element number is set to a partial optimum value f (j), the weight cipher vectors e _{i, j} of all the links on the upstream side connected to the node _j are acquired, and these weight cipher vectors e _{i, j} are respectively set to f (j). _Ei (z) or E _i (1) obtained by encrypting z or 1 with the public key PK _i of each node device N _i is vacated by shifting each weighted cipher vector e _{i, j} added to the element, these weights encryption vectors e _i added with each of the _encryption, to randomize the _j with the public key PK _i 'generates a _{i, j,} these weighting factor encryption vector e' weighting factor encryption vector e _{i, j} dynamic, characterized in that sending a to the node device N _i of node i, respectively Method of processing image process execution node device. 6. When the partial optimum value f (j) is obtained, this f (j) is held in a storage unit, and when a route tracking notification is received, all the links on the downstream side connected to the node j of the own device N _j. Addition weight cipher vector e ′ of
_{j, k} is obtained, the partial optimum value f (j) is extracted, and the f (j) th element of each addition weight cipher vector e ′ _{j, k} is set as the secret key SK.
decoded by _j, the node k ₀ the decoded result is z e _{'j, link k} is given (j, k) to lead the node k as k ₀
The method for processing a node device for dynamic programming method execution according to claim 5, characterized in that the route tracking notification is sent to the node device N _k0 of the node k ₀ by publishing that is on the optimum route. 7. A processing program for a dynamic programming method execution node device for causing a computer to execute the processing method according to claim 5 or 6. 8. A total of s for k people for a single type of m goods.
The state of selling individual goods is set as a node [k, s], and a weight cryptographic vector having a bid price as a weight is input to each node device of the node [1, s] from the weight issuing device of the first bidder as an initial value. Then, the bid price b ₂ (j) from the weight issuing device of the second bidder is set to node [1, s-j] and node [2,
s], a weight cipher vector that is the weight of the corresponding ones of the links connecting between [s] is issued, and the bid price b _k (j) is sequentially output from the weight issuing device of each bidder to the nodes [k, s−j] and [k + 1, [s]], a weight cipher vector that is the weight of the corresponding one of the links connecting [s] is issued, and each maximum value f [K, s] that reaches the node device of node [K, s] is obtained. 3. The dynamic programming method according to claim 1, wherein the value is a winning bid. 9. m linearly ordered goods {1,
2, ..., M}, the bidder's weight issuing device issues a weight cryptographic vector having the bid price for the goods in the section [j, k] as the weight w (j, k) of the link (j, k). 3. The item 1, 2, ..., M is associated with a node, the maximum weight value f (0) from the node 0 to the node m is obtained, and this is set as the winning bid price. To implement dynamic programming. 10. A bid cipher vector having a bid price as a weight for a link of graph G is issued from a bidder's weight issuing device, and an optimum value from a certain node in graph G to a certain node is set as a winning bid price. The method for executing dynamic programming according to claim 1 or 2, which is characterized in that. 11. A link (S, S, which connects each subset and an empty set, with all subsets of m different goods as nodes.
0), and C is a subset of S and the number of elements of C is one-half or more of the number of elements of S.
C), the bidder's weight issuing device links the bid price for the goods obtained by removing the set C from the set S by the weight cryptographic vector having the bid price for the set S as the weight of the link (S, 0) (S, C). ) Is issued, and the maximum weight f from the empty set node to all goods set nodes is issued.
The method of executing dynamic programming according to claim 1 or 2, wherein (0) is a winning bid.