JP2008176193A - Calculation method and device for secrecy function, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce computational quantity when calculating functions using a secrecy circuit calculation without revealing input data. <P>SOLUTION: A code text Z=(E(x<SB>1</SB>, r<SB>1</SB>), ..., E(X<SB>n</SB>, r<SB>n</SB>)) of the set X=(x<SB>1</SB>, ..., x<SB>n</SB>) of n of numerical values is input and calculated while elements of X are kept secret, wherein E is an encrypting function and r<SB>i</SB>is a random number. The calculation is carried out in the following steps: 1. The formula (1) is calculated, wherein r<SB>i</SB>' is a random number, through a permutation π of a set ä1, ..., n} and re-encryption of E to obtain an agitated code text Z' instead of the code text Z as an input to a comparator network (step 1). 2. Each comparator is represented as a logical expression, and the relationship about the size of a normal text corresponding to the input code text Z is obtained by using an existing secrecy circuit calculation (step 2). <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a cryptographic application technique, and more particularly to a technique for performing a function calculation without revealing input data.

  A method of performing a logical operation while keeping input data secret is called secret circuit calculation. By expressing the function to be calculated as a logical expression and executing the secret circuit calculation according to the logical expression, the function can be calculated while keeping the input data secret. As an application example, there is a method in which a calculation target function is a statistical calculation, and from the viewpoint of privacy protection, only statistical data is obtained while keeping private data secret.

Non-Patent Document 1 proposes a technique for performing a logical operation without revealing input data using additive homomorphic ElGamal encryption. Using this technique, for example, A can be sorted without revealing the elements of A for a set of m numerical values A = (a ₁ ,..., A _m ).

G. Yamamoto, K. Chida, A. Nasciment, K.M. Suzuki, and S. Uchiyama, Effcient, non-optimistic secure circuit evaluation based on the ElGamal encryption, WISA 2005, Lecture Notes in Computer Science, pp. 328-343, Springer-Verlag, 2005.

  Hidden circuit calculation requires enormous calculations for each logic element, and it takes much more processing time than the case of not concealing to calculate the target function with the hidden circuit calculation using the hidden circuit calculation. End up.

  Based on this situation, the problem to be solved by the present invention is to focus on a comparator network that can efficiently calculate some operations necessary for statistical processing, and simply express the comparator network by a logical expression and keep it confidential. It is an object to provide a method, apparatus, and program for performing calculation faster than executing circuit calculation.

Ciphertext Z = (E (x ₁ , r ₁ ),..., E (x _n , r _n )) (E: E) of a set of n numerical values X = (x ₁ ,..., x _n ) Consider a calculation with an encryption function, r _i : random number), as an input to the comparator network, while keeping the elements of X secret. At this time, in the present invention, calculation based on the following is performed.
1. By re-encrypting the permutation π and E of the set {1, ..., n}

を計算し（ｒ_i’：乱数）、暗号文Ｚの代わりに攪拌した暗号文Ｚ’を比較器ネットワークの入力とする（ステップ１）。
２．各比較器を論理式表現し、入力の暗号文Ｚに対応する平文の大小関係を既存の秘匿回路計算を用いて求める（ステップ２）。

The calculated (r _i: the input of the comparator network 'random number), the ciphertext Z stirring instead of the ciphertext Z' (Step 1).
2. Each comparator is expressed as a logical expression, and the magnitude relation of plaintext corresponding to the input ciphertext Z is obtained using the existing secret circuit calculation (step 2).

  In normal comparator processing, two values are input, sorted and output in ascending order. That is, the magnitude relationship of the input is exposed, and the confidentiality of the input is not maintained. For this reason, it is necessary to conceal the magnitude relationship of the input by concealment circuit calculation. On the other hand, the agitation calculation in Step 1 is an anonymization process of the input of the comparator network. Thus, even if the magnitude relation of the input of the comparator is exposed, the magnitude relation of the elements of the set X is not exposed. The confidentiality of the input is maintained. That is, it is not necessary to conceal the magnitude relationship of the input by the concealment circuit calculation, and this difference leads to processing reduction. Therefore, if the reduction effect exceeds the agitation calculation in step 1, it can be expected that the calculation can be performed faster than simply expressing the comparator network by a logical expression and executing the secret circuit calculation. The reduction effect increases in proportion to the number of comparators constituting the comparator network, but the agitation calculation in Step 1 is basically independent of the number of comparators. For this reason, depending on the configuration of the comparator network, the present invention can be superior to a solution that simply uses an existing secret circuit calculation.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  The present invention uses a comparator network. The comparator network includes a straight line corresponding to each input value and several comparators connecting two of them, and outputs a target value through the network. For example, the input values can be sorted in ascending order (sorting network), or the t-th largest value can be output (selection network).

FIG. 1 shows an example of a 7-input sorting network. Here, (x ₁ ,..., X ₇ ) is an input, (y ₁ ,..., Y ₇ ) is an output, and y _i ≦ y _{i + 1} (i = 1,..., 7) It becomes. Each vertical bar in FIG. 1 means a comparator. That is, in FIG. 1, each data flows from the left to the right along the horizontal line, and each comparator crossing the horizontal line takes two data flowing from the left as inputs, outputs the smaller value to the upper horizontal line on the right, and is large. The one value is output to the lower horizontal line on the right. For example, in the comparator a, x ₂ and x ₃ are input, and the smaller value min (x ₂ , x ₃ ) of both is on the upper line, and the larger value max (x ₂ , x ₃ ) is lower. Output to the line. Although stated only the output of the comparator a that receives the FIG. 1, x _2, x _3, similar output is made in each of the comparators, finally output y _1, · · ·, y ₇ is, y ₁ ≦ y ₂ ≦ ・ ・ ・ ≦ y ₇ is satisfied.

  The configuration of the comparator is shown in Non-Patent Document 2, for example. Here, the magnitude comparison logic operation algorithm of the comparator will be described based on that.

K. Kurosawa and W. Ogata, Bit-slice auction circuit, ESORICS 2002, Lecture Notes in Computer Science 2502, pp. 24-38, Springer-Verlag, 2002.

An example of the logical operation of the comparator is given in Non-Patent Document 2 as follows.
First, as a preparation, a magnitude comparison function Bigger ₁ (x, y) and an equality determination function EQ ₁ (x, y) with x, yε {0, 1} as inputs are defined as follows.

ここで、

here,

が成り立つ。
次に０以上２^l未満の整数Ｘ，Ｙを入力とした大小比較関数

Holds.
Next, a magnitude comparison function with integers X and Y between 0 and 2 ^l as input

の論理演算を考える。
Ｘ＝Σ_i=0 ^l-1２ⁱｘ_i，Ｙ＝Σ_i=0 ^l-1２ⁱｙ_i（ｘ_i，ｙ_i∈｛０，１｝）としたとき、（ｘ_l−1，・・・，ｘ₀），（ｙ_l−1，・・・，ｙ₀）を入力して以下の大小比較論理演算アルゴリズムを実行する。

Consider the logical operation of
When X = Σ _{i = 0} ^l−1 2 ⁱ x _i , Y = Σ _{i = 0} ^l−1 2 ⁱ y _i (x _i , y _i ∈ {0, 1}), (x _l−1 , .., X ₀ ), (y _l−1 ,..., Y ₀ ) are input to execute the following magnitude comparison logic operation algorithm.

[Comparison logic algorithm]
1. Let A ← 1, B ← Bigger ₁ (x _l−1 , y _l−1 ).
2. Calculate A ← A∧EQ ₁ (x _i , y _i ), B ← B∨ (Bigger ₁ (x _i−1 , y _i−1 ) ∧A) in the order of i = 1−1,. To do.
3. For i = 0, 1,..., l−1,

を計算して出力する。
上記アルゴリズムについて、Ｂigger_l（Ｘ，Ｙ）＝Σ_i=0 ^l-1２ⁱｚ_iが成り立つ。

Is calculated and output.
For the above algorithm, Bigger _l (X, Y) = Σ _{i = 0} ^l−1 2 ⁱ z _i holds.

  The present invention can be applied to any comparator network regardless of the configuration of the comparator network. The reason for this is that, in the present invention, as a calculation amount reduction method for performing the calculation of the comparator network while keeping the input secret, (1) the re-encryption process and the replacement process are executed only once for each ciphertext of the input. (2) As a calculation method of each comparator constituting the comparator network, instead of calculating a logical expression for rearranging the inputs in ascending order, a logical expression for calculating the magnitude relation of the inputs is calculated. This is because the processing is constant regardless of the configuration of the comparator network.

In this embodiment, as shown in FIG. 2, a set of n integers not less than 0 and less than 2 ^l X = (x ₁ ,..., X _n ), taking a simple comparator network for obtaining the maximum value as an example. A method for obtaining the maximum value x _{k of} X while keeping the elements of X secret from (where x _i = Σ _{j = 0} ^l−1 2 ^j x _{i, j} ∈ {0, 1}) will be described.

  FIG. 3 is a configuration diagram of the present embodiment, and the secret function calculation device 100 includes a public calculation device 110, a cipher replacement device 120, a secret logic operation device 130, and a decryption device 140. Here, the public operation device 110, the secret logic operation device 130, and the decryption device 140 constitute a comparator network. Each of the devices 110 to 140 may be configured integrally or connected through a network. The public computing device 110 executes the given process without requiring any secret key or random number. Therefore, other devices can reproduce the same processing and verify the processing validity of the public computing device 110. The cipher replacement device 120 receives a plurality of ciphertexts as input, replaces and re-encrypts them, and outputs them. The devices may be multiplexed in order to increase resistance against attacks that illegally extract replacement information and random numbers used for re-encryption (stirring) from the devices. The secret logic operation device 130 receives a ciphertext of a plurality of bits and outputs a ciphertext that is a logical operation result. In order to increase resistance against an attack that illegally extracts secret information such as a random number or a decryption key from a device, for example, by a method proposed in Non-Patent Document 1, a plurality of devices cooperate to secrete a device less than a threshold value. A logical operation may be calculated so as to make it difficult to obtain information on plaintext bits even if the information is extracted. The decryption device 140 holds a decryption key therein, and outputs a decryption result with ciphertext as an input. In this case, in order to increase resistance against an attack for illegally extracting the decryption key from the device, the decryption may be performed only when a plurality of devices cooperate.

FIG. 4 is a processing flowchart of this embodiment. The processing procedure of this embodiment will be described below with reference to FIGS. Note that E is an encryption function of additive homomorphic encryption used in Non-Patent Document 1 and the like.
1. The cipher replacement device 120 inputs a set of ciphertexts Z = (z ₁ ,..., Z _n ) (step 1001). Here, z _i = (E (x _{i, l−1} , r _{i, l−1} ),..., (E (x _{i, 0} , r _{i, 0} )).
2. The cipher replacement device 120 selects one per set π of the set {1,..., N} for Z, applies it to Z, and re-encrypts each ciphertext that is an element of Z. Z ′ = (z ₁ ', ..., z _n ') are calculated (step 1002). here

である。暗号置換装置１２０はＺ’を秘匿論理演算装置１３０に送る。
３．ｉ＝１，・・・，ｎ-１の順に、秘匿論理演算装置１３０、復号装置１４０及び公開演算装置１１０は以下の処理を繰り返す（ステップ１００３）。
（ａ）秘匿論理演算装置１３０は、ｚ_i’，ｚ_i+1’を入力として、大小比較論理演算アルゴリズムのステップ１，２の秘匿回路計算を実行し、実行結果Ｅ（Ｂ，ｒ）を復号装置１４０に送る。また、秘匿論理演算装置１３０はｚ_i’，ｚ_i+1’を公開演算装置１１０に送る。
（ｂ）復号装置１４０は、Ｅ（Ｂ，ｒ）を復号して、復号結果Ｂを公開演算装置１１０に送る。
（ｃ）公開演算装置１１０は、Ｂ＝１であればｚ_i’を大きいほうの値の暗号文として、あらたにｚ_i+1’←ｚ_i’とし、Ｂ＝０であればｚ_i+1’を大きい方の値の暗号文としてそのままｚ_i+1’←ｚ_i+1’とする。公開演算装置１１０は、このｚ_i+1’を秘匿論理演算装置１３０に送る。
４．ｉ＝ｎのとき、公開演算装置１１０はｚ_n’←ｚ_i+1’として、ｚ_n’を復号装置１４０に送る。復号装置１４０はｚ_n’を復号し、当該復号結果を最大値として出力する（ステップ１００４）。

It is. The cipher replacement device 120 sends Z ′ to the secret logic operation device 130.
3. The secret logic operation device 130, the decryption device 140, and the public operation device 110 repeat the following processing in the order of i = 1,..., n−1 (step 1003).
(A) The secret logic operation device 130 performs the secret circuit calculation of steps 1 and 2 of the magnitude comparison logic operation algorithm with z _i ′ and z _{i + 1} ′ as inputs, and obtains the execution result E (B, r). The data is sent to the decryption device 140. Also, the secret logic operation device 130 sends z _i ′, z _{i + 1} ′ to the public operation device 110.
(B) The decryption device 140 decrypts E (B, r) and sends the decryption result B to the public operation device 110.
(C) The public arithmetic unit 110 newly sets z _i ′ as the ciphertext of the larger value if B = 1, and newly sets z _{i + 1} ← z _i ′, and if B = 0, z _{i +} 'as it is z _{i + 1} as the ciphertext of the larger of value' and ← z _{i + 1 '1.} The public operation device 110 sends z _{i + 1} ′ to the secret logic operation device 130.
4). When i = n, public computation device 110 sends z _n ′ to decryption device 140 as z _n ′ ← z _{i + 1} ′. The decoding device 140 decodes z _n ′ and outputs the decoding result as the maximum value (step 1004).

  As described above, compared to the case where the comparator calculation is performed by the comparison logic operation algorithm by the secret circuit calculation, the method of the present embodiment obtains the input size result in the portion corresponding to the comparator calculation. Step 3 of the comparison logic operation algorithm can be omitted, and processing can be reduced.

In the present embodiment, a method for further speeding up the processing procedure of the first embodiment will be described. Similarly to the first embodiment, in this embodiment, a set of n integers not less than 0 and less than 2 ^l X = (x ₁ ,..., X _n ) (example of the simple comparator network shown in FIG. Here, the maximum value of X is obtained from x _i = Σ _{j = 0} ^l−1 2 ^j x _{i, j} (x _{i, j} ∈ {0,1})) while keeping the elements of X secret. .

  FIG. 5 is a configuration diagram of the present embodiment, and the secret function calculation device 200 includes a public calculation device 210, a cipher replacement device 220, a secret logic operation device 230, a decryption device 240, and an encrypted random number multiplication device 250. The Here, the public operation device 210, the secret logic operation device 230, the decryption device 240, and the encrypted random number multiplication device 250 constitute a comparator network. The functions of the public operation device 210, the encryption replacement device 220, the secret logic operation device 230, and the decryption device 240 are basically the same as those in the first embodiment. The encrypted random number multiplication device 250 has a function of receiving a ciphertext as an input and outputting a ciphertext obtained by multiplying a plaintext by a random number. Multiple devices may be multiplexed in order to increase resistance to attacks that illegally extract random numbers from devices.

Prior to the description of the processing procedure of the present embodiment, the expression of Step 2 of the previous magnitude comparison logical operation algorithm is amended as follows without changing the overall processing.
2-1 A _l = 1, B _l-1 = Bigger ₁ (x _l−1 , y _l−1 ), i = l−1,..., 1 in this order A _i = A _{i + 1} ∧EQ ₁ (x _i , y _i ), B _i-1 = Bigger ₁ (x _i-1 , y _i-1 ) ∧A _i is calculated.
2-2B _l-1 ∨B _l-2 ∨... ∨B ₀ is calculated.

FIG. 6 is a processing flowchart of this embodiment. Hereinafter, the processing procedure of this embodiment will be described with reference to FIGS.
1. The cipher replacement device 220 inputs a plurality of ciphertext sets Z = (z ₁ ,..., Z _n ) (step 2001). Here, z _i = (E (x _{i, l−1} , r _{i, l−1} ),..., (E (x _{i, 0} , r _{i, 0} )).
2. The cipher substitution device 220 selects one of the permutations π of the set {1,..., N} for Z, applies it to Z, and re-encrypts each ciphertext that is an element of Z. Z ′ = (z ₁ ', ..., z _n ') are calculated (step 2002). here

である。暗号置換装置２２０はＺ’を秘匿論理演算装置２３０に送る。
３．ｉ＝１，・・・，ｎ-１の順に、秘匿論理演算装置２３０、公開演算装置２１０、暗号化乗算装置２３０及び復号装置２４０は以下の処理を繰り返す（ステップ２００３）。
（ａ）秘匿論理演算装置２３０は、ｚ_i’，ｚ_i+1’を入力として、大小比較論理演算アルゴリズムのステップ１、及び改変後のステップ２-１の秘匿回路計算を実行し、実行結果Ｇ＝（Ｅ（Ｂ_l-1，ｓ_l-1），・・・，（Ｅ（Ｂ₀，ｓ₀）を公開演算装置２１０に送る。秘匿論理演算装置２３０はｚ_i’，ｚ_i+1’も公開演算装置２１０に送る。
（ｂ）公開演算装置２１０は、Ｇを入力として、Ｅの準同型性を利用してＥ（Σ_i=0 ^l-1Ｂ_i，ｓ）を計算し、暗号化乱数乗算装置２５０に送る。ここで、ｓは適当な乱数である。
（ｃ）暗号化乱数乗算装置２５０は、Ｅ（Σ_i=0 ^l-1Ｂ_i，ｓ）を入力として、乱数ｗを生成して、Ｅの準同型性を利用してＥ（ｗΣ_i=0 ^l-1Ｂ_i，ｓ’）を計算し、復号装置２４０に送る。
（ｄ）復号装置２４０は、Ｅ（ｗΣ_i=0 ^l-1Ｂ_i，ｓ’）を復号して、復号結果Ｂ’＝ｗΣ_i=0 ^l-1Ｂ_iを公開演算装置２１０に送る。
（ｅ） 公開演算装置２１０は、Ｂ’≠０であれば、ｚ_i’を大きい方の値の暗号文として、あらたにｚ_i+1’←ｚ_i’とし、Ｂ’＝０であればｚ_i+1’を大きい方の値の暗号文として、そのままｚ_i+1’←ｚ_i+1’とする。公開演算装置２１０は、このｚ_i+1’を秘匿論理演算装置２３０に送る。
４．ｉ＝ｎのとき、公開演算装置２１０はｚ_n’←ｚ_i+1’として、ｚ_n’を復号装置２４０に送る。復号装置２４０はｚ_n’を復号し、当該復号結果を最大値として出力する（ステップ２００４）。

It is. The cipher replacement device 220 sends Z ′ to the secret logic operation device 230.
3. The secret logic operation device 230, the public operation device 210, the encryption multiplication device 230, and the decryption device 240 repeat the following processes in the order of i = 1,..., n−1 (step 2003).
(A) The concealment logic operation device 230 executes the concealment circuit calculation in step 1 of the magnitude comparison logic operation algorithm and the modified step 2-1 with z _i ′ and z _{i + 1} ′ as inputs, and the execution result G = (E (B _l−1 , s _l−1 ),..., (E (B ₀ , s ₀ ) is sent to the public arithmetic unit 210. The secret logic arithmetic unit 230 sends z _i ′, z _{i +. 1} 'is also sent to the public computing device 210.
(B) The public arithmetic unit 210 receives G as an input, calculates E (Σ _{i = 0} ^l−1 B _i , s) using the homomorphism of E, and sends it to the encrypted random number multiplier 250. Here, s is an appropriate random number.
(C) The encrypted random number multiplication device 250 receives E (Σ _{i = 0} ^l−1 B _i , s) as an input, generates a random number w, and uses E's homomorphism to obtain E (wΣ _{i = 0} ^l−1 B _i , s ′) is calculated and sent to the decoding device 240.
(D) The decryption device 240 decrypts E (wΣi _{= 0} ^l−1 B _i , s ′) and sends the decryption result B ′ = wΣi _{= 0} ^l−1 B _i to the public operation device 210.
(E) If B ′ ≠ 0, the public operation device 210 newly sets z _i ′ as the ciphertext of the larger value, and newly sets z _{i + 1} '← z _i ', and if B ′ = 0. Let z _{i + 1} 'be the larger ciphertext, and let z _{i + 1} ' ← z _{i + 1} '. The public operation device 210 sends z _{i + 1} ′ to the secret logic operation device 230.
4). When i = n, the public operation device 210 sends z _n ′ to the decryption device 240 as z _n '← z _{i + 1} '. The decoding device 240 decodes z _n ′ and outputs the decoding result as the maximum value (step 2004).

  It is equivalent that B ′ ≠ 0 in step 2003 (e) and B = 1 in step 1003 (c) of the first embodiment. Similarly, B ′ = 0 in step 2003 (e) is equivalent to B = 0 in step 1003 (c) of the first embodiment.

  As described above, in this embodiment, the secret circuit calculation in step 2-2 after modification is not necessary, and a reduction in processing can be expected.

  In the third embodiment, a method for increasing the confidentiality of the methods of the first and second embodiments will be described. In the methods of the first and second embodiments, the anonymization of the input by re-encryption and random replacement makes it possible for the information on the magnitude relationship of the input data of each comparator not to impair the confidentiality of the input of the comparator network. It used to reduce the amount of calculation. However, since the value B appearing during the processing of the first embodiment and the value B ′ appearing during the processing of the second embodiment appear as plain text, unnecessary information regarding the input data may be exposed. That is, with respect to the plain text X and Y of the input data, if X> Y, B = 1 (B ′ ≠ 0 in the second embodiment), otherwise B = 0 (B ′ = 0 in the second embodiment). Therefore, if B = 1 (B ′ ≠ 0 in the second embodiment), it will be understood that X ≠ Y. In the present embodiment, a method for preventing exposure of unnecessary information other than the final output of the comparator network will be described. In short, if X = Y, an operation is added such that B (B ′ in the second embodiment) becomes a random number bit (B ′ = 0 with a probability of 1/2 in the second embodiment). Hereinafter, specific procedures will be described based on the first embodiment.

  FIG. 7 is a configuration diagram of the present embodiment, and the secret calculation device 300 includes a public calculation device 310, a cipher replacement device 320, a secret logic operation device 330, a decryption device 340, and an encrypted random number generation device 350. Here, the public operation device 310, the secret logic operation device 330, the decryption device 340, and the encryption random number generation device 350 constitute a comparator network.゜

  The public computing device 310 executes the given process without requiring any secret key or random number. Therefore, other devices can reproduce the same processing and verify the processing validity of the public computing device 310. The cipher replacement device 320 takes a plurality of ciphertexts as input, replaces and re-encrypts them, and outputs them. The devices may be multiplexed in order to increase resistance to attacks that illegally extract replacement information and random numbers used for re-encryption from the devices. The encrypted random number generator 350 generates a 1-bit random number, encrypts it, and outputs it. The random number cannot be known unless the internal state of the encrypted random number generator 350 is obtained. In order to increase the confidentiality of the random number, a plurality of devices cooperate to generate a 1-bit random number ciphertext, and the random number cannot be known unless the internal state of all the devices is obtained. Also good. Further, the device may prove that the ciphertext is obtained by correctly encrypting 1-bit data by using the zero knowledge proof, thereby preventing an illegal act of the device. Since the method for generating a 1-bit random number ciphertext is described in Non-Patent Document 3 below, it is omitted here.

B. Schoenmakers and P. Tuy1s, Effcient binary conversion for Paillier encrypted values, EUROCRYPT 2006, LNCS 4004, PP. 522-537, Springer-Verlag, 2006.

  The secret logic operation device 330 receives a ciphertext of a plurality of bits and outputs a ciphertext as a logical operation result. In order to increase resistance against attacks that illegally extract secret information such as random numbers and decryption keys from devices, for example, a method proposed in Non-Patent Document 1 allows a plurality of devices to cooperate to keep secrets of devices less than the host A logical operation may be calculated so as to make it difficult to obtain information on plaintext bits even if the information is extracted. The decryption device 340 holds a decryption key therein and outputs a decryption result with ciphertext as an input. In order to increase resistance to an attack that illegally extracts a decryption key from a device, decryption may be performed only when a plurality of devices cooperate.

FIG. 8 is a processing flowchart of this embodiment. Hereinafter, the processing procedure of this embodiment will be described with reference to FIGS. Note that E is an encryption function of additive homomorphic encryption used in Non-Patent Document 1 and the like.
0. The encrypted random number generation device 350 generates the random number bit b in advance, calculates data E (b, r _b ) obtained by encrypting the random number bit b, and sends the data E (b, r _b ) to the secret logic operation device 330 (step 3000). Here r _b is a random number.
1. The cipher replacement device 320 inputs a plurality of ciphertext sets Z = (z ₁ ,..., Z _n ) (step 3001). Here, z _i = (E (x _{i, l−1} , r _{i, l−1} ),..., (E (x _{i, 0} , r _{i, 0} )).
2. The cipher substitution device 320 selects one of the permutations π of the set {1,..., N} for Z, applies it to Z, and re-encrypts every ciphertext that is an element of Z. Z ′ = (z ₁ ', ..., z _n ') are calculated (step 3002). here

である。暗号置換装置１２０はＺ’を秘匿論理演算装置３３０に送る。
３．ｉ＝１，・・・，ｎ-１の順に、秘匿論理演算装置３３０、復号装置３４０及び公開演算装置３１０は以下の処理を繰り返す（ステップ３００３）。
（ａ）秘匿論理演算装置３３０は、ｚ_i’，ｚ_i+1’を入力として、先の大小比較論理演算アルゴリズムのステップ１、２の秘匿回路計算を実行し、実行結果Ｇ＝（Ｅ（Ｂ，ｒ）およびＡの暗号文を得る。なお、秘匿論理演算装置３３０はｚ_i’，ｚ_i+1’を公開演算装置３１０に送る。
（ｂ）さらに、秘匿論理演算装置３３０は、Ｅ（Ｂ，ｒ），Ｅ（Ｂ，ｒ_b）およびＡの暗号文を入力として秘匿回路計算を実行し、Ｂ∨（ｂ∧Ａ）の暗号文Ｃを計算する。秘匿論理演算装置３３０は、このＣを復号装置３４０に送る。
（ｃ）復号装置３４０は、Ｃを復号して、復号結果Ｂ”＝Ｂ∨（ｂ∧Ａ）を公開演算装置３１０に送る。
（ｄ） 公開演算装置３１０は、Ｂ”＝１であれば、ｚ_i’を大きい方の値の暗号文として、あらたにｚ_i+1’←ｚ_i’とし、Ｂ”＝０であればｚ_i+1’を大きい方の値の暗号文として、そのままｚ_i+1’←ｚ_i+1’とする。公開演算装置３１０は、このｚ_i+1’を秘匿論理演算装置３３０に送る。
４．ｉ＝ｎのとき、公開演算装置３１０はｚ_n’←ｚ_i+1’として、ｚ_n’を復号装置３４０に送る。復号装置３４０はｚ_n’を復号し、当該復号結果を最大値として出力する（ステップ３００４）。

It is. The cipher replacement device 120 sends Z ′ to the secret logic operation device 330.
3. In the order of i = 1,..., n−1, the secret logic operation device 330, the decryption device 340, and the public operation device 310 repeat the following processing (step 3003).
(A) The secret logic operation device 330 receives the z _i ′ and z _{i + 1} ′ as inputs and executes the secret circuit calculation in steps 1 and 2 of the previous magnitude comparison logic operation algorithm, and the execution result G = (E ( The ciphertexts of B, r) and A are obtained, and the secret logic operation device 330 sends z _i ′ and z _{i + 1} ′ to the public operation device 310.
(B) Furthermore, the cipher logic operation device 330 performs cipher circuit calculation with E (B, r), E (B, r _b ) and A ciphertexts as input, and encrypts B∨ (b∧A). Compute sentence C. The secret logic operation device 330 sends this C to the decryption device 340.
(C) The decryption device 340 decrypts C and sends the decryption result B ″ = B∨ (b∥A) to the public operation device 310.
(D) If B ″ = 1, the public operation device 310 newly sets z _i ′ as the ciphertext of the larger value, and newly sets z _{i + 1} '← z _i ′, and if B ″ = 0. Let z _{i + 1} 'be the larger ciphertext, and let z _{i + 1} ' ← z _{i + 1} '. The public operation device 310 sends z _{i + 1} ′ to the secret logic operation device 330.
4). When i = n, the public operation device 310 sends z _n ′ to the decryption device 340 as z _n ′ ← z _{i + 1} ′. The decoding device 340 decodes z _n ′ and outputs the decoding result as the maximum value (step 3004).

For the ciphertexts z _i ′ and z _{i + 1} ′ that are the inputs of the comparator, if the decrypted data is equal, B = 0, and A = 1 only if the data are equal. That is, when the data is different, A = 0, so B = B ″, and when the data is equal, B = 0 and B ″ = B∨b, so B ″ = b. In the present embodiment, B = 0 is output if the data is equal, but in this embodiment, B ″ is output instead of B. Therefore, if the data is equal, the random number bit b is output. If the data is different, the output is the same as that of the first embodiment. From the above, it can be understood that exposure of unnecessary information can be prevented.

  The specific procedure based on the first embodiment has been described above, but the feature of the method described in the present embodiment is that the comparator uses a ciphertext of random number bits generated by the encrypted random number generator 340. This means that when the plaintext corresponding to the input ciphertext has the same value, the random number bit is output, and can be similarly applied to the second embodiment without performing special processing. A description of the specific procedure based on Example 2 is omitted.

  Finally, as a fourth embodiment, a description will be given of a method of performing calculation while keeping inputs other than L concealed in the comparator network as shown in FIG. The comparator network of FIG. 9 is for determining whether each input is greater than L or not. The difference from the first to third embodiments is that a part of the input (L in this embodiment) does not have to be concealed. Thereby, as shown below, the amount of calculation can be reduced compared to the case where all the inputs are concealed.

Note that the additive homomorphic cipher E used in the present embodiment is obtained with respect to the ciphertexts E (x, r), E (y, s) of x, y and the constant c.
E (x, r) × E (y, s) = E (x + y, t),
E (x, r) / E (y, s) = E (xy, u),
E (x, r) ^c = E (xc, v)
(R, s, t, u, v: appropriate random numbers). As a cipher that satisfies such properties, the Paillier cipher is known.

Hereinafter, a description will be given based on the first embodiment. The apparatus configuration in this embodiment may be the same as that in the first embodiment. The procedure is also almost the same as that in the first embodiment, but only (a) in step 1003 of the first embodiment is different. Specifically, among the processing of (a) in step 1003, EQ (x _i , y _i ) and Bigger ₁ (x _i−1 ,..., Y _i− of step 2 of the magnitude comparison logic operation algorithm are performed. ₁ ) The calculation method is different. In the first embodiment, the calculation of EQ (x _i , y _i ) = 2x _i y _i −x _i −y _i +1 and Bigger ₁ (x _i−1 , y _i−1 ) = − x _i y _i + x _i is confidential. Although the calculation is performed by circuit calculation, when L = Σ _{i = 0} ^l−1 2 ⁱ y _i , y _i may be disclosed, so that the secret circuit calculation is not necessary.

Specifically, in the calculation of EQ (x _i , y _i ) of (a) in step 1003 of the first embodiment, the secret logic operation device (or any other device) performs the following.
[Input] E (x _i , y _i ), y _i (r _i ; random number)
[Output] EQ (x _i , y _i ) = 2x _i y _i −x _i −y _i +1
1.1-y _i ciphertext _{E (1-y i, w} ) of calculating the (w: random number).
2. C = (E ((x _i , y _i ) ² y _i / E (x _i , r _i )) × E (1−y _i , w) is calculated.

In the above calculation, it can be seen that C is a ciphertext of 2x _i y _i -x _i -y _i +1, that is, a ciphertext of EQ (x _i , y _i ) due to the additive quasi-oka type of E. . Obviously, the calculation of Bigger ₁ (x _i−1 , y _i−1 ) = − x _i y _i + x _i can be similarly performed by additive homomorphism.

  Although four embodiments have been described above, according to the present invention, calculation using a comparator network can be processed more efficiently than a conventional method while keeping input data secret. Examples of the calculation using the comparator network include the sort, the maximum value derivation, the range designation, and the median and first quartile derivation described above. Since these calculations are often used in statistical processing or the like, the present invention is effective when the data provided by an individual is kept secret and only statistical data obtained from a plurality of personal data is obtained.

  It should be noted that some or all of the processing functions of each unit in the apparatus shown in FIG. 3, FIG. 5, FIG. 7, etc. are configured by a computer program, and the program is executed using the computer to realize the present invention. It goes without saying that the processing procedures shown in FIG. 4, FIG. 6, FIG. 8, etc. can be configured by a computer program and the program can be executed by the computer. In addition, a computer-readable recording medium such as an FD, MO, ROM, memory card, CD, or the like is stored in the computer. In addition, the program can be recorded and stored on a DVD, a removable disk, etc., and the program can be distributed through a network such as the Internet.

The figure which shows an example of a comparator network. The figure which shows another example of a comparator network. The block diagram of Example 1 of this invention. FIG. 3 is a process flow diagram of Embodiment 1. The block diagram of Example 2 of this invention. FIG. 6 is a processing flow diagram of Embodiment 2. The block diagram of Example 3 of this invention. FIG. 6 is a processing flow diagram of Embodiment 3. The figure which shows another example of a comparator network.

Explanation of symbols

110, 210, 310 Public operation device 120, 220, 320 Cryptographic substitution device 130, 230, 330 Secret logic operation device 140, 240, 340 Decryption device 250 Encrypted random number multiplication device 350 Encrypted random number generation device

Claims (7)

Ciphertext Z = (E (x ₁ , r ₁ ),..., E (x _n , r _n )) (E: E) of a set of n numerical values X = (x ₁ ,..., x _n ) A secret function calculation method in which an encryption function, r _i : random number) is input to a comparator network, and a logical operation is performed while keeping an element of X secret.
Ciphertext re-encrypted for each element of Z by selecting permutation π of set {1,..., N} and applying it to ciphertext Z

And Z instead of ciphertext Z is input to the comparator network,
The comparator network calculates the plaintext magnitude relationship corresponding to the input ciphertext without leaking the plaintext information.
The secret function calculation method characterized by the above. The method for calculating a secret function according to claim 1,
Using a cipher replacement device, a public operation device, a secret logic operation device, and a decryption device,
The cipher replacement device has a set of n integers not less than 0 and less than 2 ^l X = (x ₁ ,..., X _n ) (where x _i = Σ _{j = 0} ^l−1 2 ^j x _{i, j} Ciphertext Z = (z ₁ ,..., Z _n ) of (x _{i, j} ∈ {0, 1}) (where z _i = (E (x _{i, l−1} , r _{i, l− 1} ),..., E (x _{i, 0} , r _{i, 0} ))), select one permutation π of the set {1,. Re-encrypted every time

Is calculated and output,
The public operation device, the secret logic operation device, and the decryption device are in the order of i = 1,..., N−1.
(A) The concealment logic operation device receives z _i ′ and z _{i + 1} ′ as inputs, executes a magnitude comparison logic operation without leaking plaintext information of z _i ′ and z _{i + 1} ′, and executes an execution result. Output E (B, r),
(B) The decoding device receives E (B, r), decodes it, and outputs a decoding result B.
(C) publish computing device, 'as ciphertext greater value to, z _{i + 1'} z i if B = 1 and outputs a 'z _{i + 1} as' ← z _i, at B = 0 directly outputs _{z i + 1 'z i +} 1 as a ciphertext greater value' if,
Repeat the process
The public operation device outputs z _n 'as z _n ' ← z _{i + 1} 'when i = n, and the decryption device inputs z _n ' to decrypt and outputs the decryption result,
The secret function calculation method characterized by the above. The method for calculating a secret function according to claim 1,
Using an encryption replacement device, a public operation device, a secret logic operation device, a decryption device, and an encrypted random number multiplication device,
The cipher replacement device has a set of n integers not less than 0 and less than 2 ^l X = (x ₁ ,..., X _n ) (where x _i = Σ _{j = 0} ^l−1 2 ^j x _{i, j} Ciphertext Z = (z ₁ ,..., Z _n ) of (x _{i, j} ∈ {0, 1}) (where z _i = (E (x _{i, l−1} , r _{i, l− 1} ),..., E (x _{i, 0} , r _{i, 0} ))), select one permutation π of the set {1,. Re-encrypted every time

Is calculated and output,
The public operation device, the secret logic operation device, the decryption device, and the encrypted random number multiplication device are in the order of i = 1,..., N−1.
(A) The concealment logic operation device receives z _i ′ and z _{i + 1} ′ as inputs, executes a magnitude comparison logic operation without leaking plaintext information of z _i ′ and z _{i + 1} ′, and executes an execution result. G = (E (B _l−1 , s _l−1 ),..., (E (B ₀ , s ₀ ) is output)
(B) The public computing device calculates E (Σ _{i = 0} ^l−1 B _i , s) (where s is an appropriate random number) using G's homomorphism using G as an input. Output,
(C) The encrypted random number multiplication device receives E (Σ _{i = 0} ^l−1 B _i , s) as an input, generates a random number w, and uses E's homomorphism to obtain E (wΣ _{i = 0} ^l-1 B _i , s ′) is calculated and output,
(D) The decoding device inputs E (wΣi _{= 0} ^l−1 B _i , s ′) and decodes, and outputs a decoding result B ′ = wΣi _{= 0} ^l−1 B _i .
(E) public computing device, 'if ≠ a _{0, z i' B z i} + 1 as _{z i + 1 '← z i} ' as the cipher text of the larger value 'outputs, B' = 'as ciphertext larger value, z i _{+ 1'} 0 a z _{i + 1} if directly outputs,
Repeat the process
The public operation device outputs z _n 'as z _n ' ← z _{i + 1} 'when i = n, and the decryption device inputs z _n ' to decrypt and outputs the decryption result,
The secret function calculation method characterized by the above. The method for calculating a secret function according to claim 1,
Using an encryption replacement device, a public operation device, a secret logic operation device, a decryption device, and an encrypted random number generation device,
The encrypted random number generator generates a random number bit b, calculates and outputs data E (b, r _b ) (where r _b is a random number) obtained by encrypting the random number bit b,
The cipher replacement device has a set of n integers not less than 0 and less than 2 ^l X = (x ₁ ,..., X _n ) (where x _i = Σ _{j = 0} ^l−1 2 ^j x _{i, j} Ciphertext Z = (z ₁ ,..., Z _n ) of (x _{i, j} ∈ {0, 1}) (where z _i = (E (x _{i, l−1} , r _{i, l− 1} ),..., E (x _{i, 0} , r _{i, 0} ))), select one permutation π of the set {1,. Re-encrypted every time

Is calculated and output,
The public operation device, the secret logic operation device, and the decryption device are in the order of i = 1,..., N−1.
(A) The concealment logic operation device receives z _i ′ and z _{i + 1} ′ as inputs, executes a magnitude comparison logic operation without leaking plaintext information of z _i ′ and z _{i + 1} ′, and executes an execution result. G = (E (B, r) and get the ciphertext of A,
(B) secret logic unit, E (B, r), E (B, r b) as, and A inputs the cipher text, and calculates and outputs ciphertext C of B∨ (b∧A) ,
(C) The decoding device inputs C to decode and outputs a decoding result B ″ = B ＝ (b∨A).
(D) publishing computing device, B "if = 1, and outputs a 'z _{i + 1 as' ← z i 'z i +} 1 as a ciphertext larger value' z _i, B" = directly outputs 'z _{i + 1} as a ciphertext larger value' 0 and z _{i + 1} if,
Repeat the process
The public operation device outputs z _n 'as z _n ' ← z _{i + 1} 'when i = n, and the decryption device inputs z _n ' to decrypt and outputs the decryption result,
The secret function calculation method characterized by the above.   2. The secret function calculation method according to claim 1, wherein only one numerical value of the input of each comparator of the comparator network is concealed.   A secret function calculation apparatus using the secret function calculation method according to claim 1.   A program for causing a computer to execute the secret function calculation method according to any one of claims 1 to 5.

Images