JP2012154968A - Secure aggregate function system, secret aggregate function apparatus, secure aggregate function processing method and secure aggregate function program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform an aggregate function arithmetic operation of which the computational complexity is proportional only to the number of data items, while concealing information.SOLUTION: A secure aggregate function system is comprised of N pieces of secret aggregate function apparatuses and determines a secret distributed totalization result from information ([k], [v]), ..., ([k], [v]) secretly distributing M pieces of information items (k, v), ..., (k, v) including a key kand an attribute value v. The secure aggregate function system includes initialization means and coupling arithmetic operation means. The initialization means sets the M pieces of data items z, ..., zlike z=vand generates information ([k], [z]), ..., ([k], [z]). The coupling arithmetic operation means performs such coupling processing for setting z=z(+)z, z=(0) if a key kand a key kare equal and for setting z=z, z=zif not equal on all the information having equal keys through secret computation.

Description

  The present invention relates to a secure set function system, a secret set function device, a secure set function processing method, and a secure set function program that perform processing called a set function such as aggregation while keeping data secret while grouping.

  The collective function is to perform an operation (commutative monoid) on the entire data group in which unit elements exist and the combination rule and the commutative rule are established. The grouping in the set function is to classify the data group into data groups having the same key attribute and apply the set function to each classified data group.

  As a method of obtaining a specific calculation result without restoring the encrypted numerical value, for example, there is a method called secret calculation in Non-Patent Document 1. In the method of Non-Patent Document 1, encryption is performed such that numerical fragments are distributed to three secret computing devices, and addition / subtraction, constant sum, multiplication, constant multiplication, logical operation (negative, logical product) are performed without restoring the numerical values. , Logical sum, exclusive logical sum), and data format conversion (integer, binary number) can be held in a state of being distributed to the three secret computing devices, that is, encrypted. Non-Patent Document 2 is characterized in that the correspondence between the values before and after the sorting is calculated so that no one knows, and the plurality of encrypted data are sorted by the values calculated from plaintext. A secret sort method for calculating a ciphertext as a result of the execution has been proposed. If such a secret calculation is used, a set function calculation is also possible.

Koji Senda, Hiroki Hamada, Igarashi Univ., Katsumi Takahashi, “Reconsideration of Lightweight Verifiable 3-Party Secret Function Calculation”, In CSS, 2010. Hiroki Hirota, Dai Igarashi, Koji Senda, Katsumi Takahashi, “Random replacement protocol for computing three-party secret functions”, In CSS, 2010.

For example, it is considered possible to perform a set function operation by grouping in the following processing using the conventional secret calculation. Incidentally, the target of the aggregate function operation, the information including a key _{k i} and attribute value _{v i (k i, v i} ).
Repeat for all key attribute values.
1. For the i-th key attribute value k _i , z _i = (0).
2. Repeat for all data.
If the key attribute of the jth data is k _i, then z _i = z _i (+) v _j
If the key attribute is not k _i, z _i = z _i
However, (0) is a unit element, and (+) is a commutative monoid operation of the set function.

  However, in the above method, the calculation amount is proportional to “the number of key attribute values × the number of data”, and the efficiency is poor.

  An object of the present invention is to provide a technique that enables a set function operation independent of the number of key attribute values and having a calculation amount proportional to only the number of data while keeping information secret.

Secure set function system of the present invention, N number of private set function unit _R 1, ..., is composed of _{R N,} M pieces of information including the key _{k m} and attribute values _{v m (k 1, v 1} ), ... , (K _M , v _M ) are secret-distributed information ([k ₁ ], [v ₁ ]),..., ([K _M ], [v _M ]), and a secret-distributed aggregation result is obtained. . Here, M is an integer greater than or equal to 2, N is an integer greater than or equal to 3, m, i, j are integers greater than or equal to 1 and less than or equal to M, [] is a symbol indicating information in which information in parentheses is secretly shared for each element, (+) Is a symbol indicating an operation for obtaining the aggregation result in which the unit element exists and the join rule and the commutative rule are established, and (0) is a symbol indicating the unit element of the operation (+).

The secure set function system includes an initialization unit and a join operation unit. Initialization means, M pieces of data _z 1, ..., a _{z M,} set as z _m = _v m, the information _{([k 1], [z} 1]), ..., ([k M], [Z _M ]). When the key k _i and the key k _j are equal to each other, the join operation means z _j = z _i (+) z _j , z _i = (0)
And if not equal, z _j = z _j , z _i = z _i
Is performed by secret calculation on information having all the equal keys.

  According to the secure set function system of the present invention, it is possible to execute a set function operation in which the amount of calculation is proportional to only the number of data and does not depend on the number of key attribute values while keeping information secret.

The figure which shows the structural example of the secure set function system of Example 1 and Example 2. FIG. The figure which shows the processing flow of the secure set function system of Example 1. FIG. The figure which shows the processing flow of the secure set function system of Example 2. FIG. FIG. 10 is a diagram illustrating a configuration example of a secure set function system according to a third embodiment. FIG. 10 is a diagram illustrating a processing flow of the secure set function system according to the third embodiment. It shows a secure set function system shown in detail an example of the functional configuration of a secret sharing apparatus 100 _n which can be utilized in the present invention. The figure which shows the example of the 1st process flow of random substitution. The figure which shows the 2nd processing flow example of random substitution.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

FIG. 1 shows a configuration example of a secure set function system according to the first embodiment. FIG. 2 shows a processing flow of the secure set function system according to the first embodiment. Secure set function system of Example 1, N pieces of secret set function device ₁₀ 1, ..., 10 is constituted by _N, M pieces of information including the key _{k m} and attribute values _{v m (k 1, v 1} ), ..., (k _M , v _M ) are secret-distributed information ([k ₁ ], [v ₁ ]), ..., ([k _M ], [v _M ]), respectively, Ask. Here, M is an integer greater than or equal to 2, N is an integer greater than or equal to 3, m, i, j are integers greater than or equal to 1 and less than or equal to M, [] is a symbol indicating information in which information in parentheses is secretly shared for each element, (+) Is a symbol indicating an operation for obtaining an aggregation result in which a unit element exists and an associative law and a commutative law are established, and (0) is a symbol indicating a unit element of the operation (+). Specific examples of (+) include a sum (total), a minimum value, and a maximum value.

The secret set function device 10 _n includes a set function control unit 300 _n , a secret sharing device 100 _n , and a recording unit 190 _n . The secret sharing apparatus 100 _n performs individual secret calculations necessary for the processing of the first embodiment in accordance with instructions from the set function control unit 300 _n . Individual secret calculations necessary for the processing of the present invention include secret sharing, decryption, and four arithmetic operations. However, the present invention efficiently performs set function operations using these secret calculations, and is not an invention characterized by the secret calculation itself. Therefore, an example of the secret calculation will be described later, and a description thereof will be omitted to facilitate understanding of the points of the present invention. Note that the secret calculation method to be described later is one example, and does not limit the secret calculation that can be used in the first embodiment. The recording unit 190 _n is a component that records information necessary for processing of the secret set function device 10 _n . The selection means 105 shown in FIG. 1 is used in the secret calculation described later, but may not be provided depending on the secret calculation to be used.

The set function control unit 300 _n of each secret set function device 10 _n includes an initialization unit 320 _n , a combination calculation unit 330 _n , and a deletion unit 340 _n . The initialization unit 320 (not shown) of the secure set function system is composed of initialization units 320 ₁ ,..., 320 _N , and the combination calculation unit 330 (not shown) is the combination calculation unit 330 ₁ ,. , 330 _N , and the deleting means 340 (not shown) includes deleting units 340 ₁ ,..., 340 _N.

Initializing means 320, M pieces of data _z 1, ..., a _{z M,} set as z _m = _v m, the information _{([k 1], [z} 1]), ..., ([k M] , [Z _M ]) is generated (S340). More specifically, the initialization unit ₃₂₀ 1, ..., 320 _N (initializing means 320), secret sharing apparatus ₁₀₀ 1, ..., data _{v m} with the same fragment fragment attribute value _{v m} with a 100 _N Fragments are generated, and information ([k ₁ ], [z ₁ ]),..., ([K _M ], [z _M ]) is generated by secretly sharing each fragment.

When the key k _i and the key k _j are equal to each other, the join calculation means 330 z _j = z _i (+) z _j , z _i = (0)
And if not equal, z _j = z _j , z _i = z _i
Until the combination process is executed for all pieces of information having the same key (S330). For example, a logic circuit that confirms that the key k _i and the key k _j are equal can be realized by using the logic circuit technology stored as the prior art. The following may be confirmed by negating the logical sum of the exclusive OR of the two bits of the key k _i and the key k _j expanded.

C = 1-{(k _iB [∨] k _jB ) ∨ ... ∨ (k _i1 [∨] k _j1 )} (1)
[∨] is a symbol indicating an exclusive OR (XOR), ∨ is a symbol indicating a logical sum (OR), k _ib is a value of the b-th bit from the bottom of the key k _i when two bits are expanded, and B the number of digits of the key k _i at the time of the 2-bit deployment. In equation (1), if C = 1, the key k _i and the key k _j are equal (true), and if C = 0, the key k _i and the key k _j are different (false). In addition, since each calculation of Expression (1) is shown in an example of secret calculation described later, the calculation of Expression (1) can be executed by secret calculation, and secret-distributed [C] is obtained. Therefore, if the branch after confirmation is also kept secret, the secret calculation using [C] may be further combined. Note that the secret calculation described later covers the basic calculation methods for secret sharing of numerical values, decryption of secret-distributed fragments, four arithmetic operations of secret-distributed numerical values, and logical operations for each secret-distributed bit. ing. Therefore, if the logic circuit technology accumulated as the prior art is used, a desired operation such as an operation for comparing magnitude comparisons can be performed by a combination of secret calculation methods described later, as in the above-described method for confirming equality. Can be executed.

Furthermore, in the case of information in which information ([k ₁ ], [z ₁ ]),..., ([K _M ], [z _M ]) is arranged at random, a join operation is performed on all combinations of i and j. The processing of the means 330 needs to be performed. On the other hand, if information ([k ₁ ], [z ₁ ]),..., ([K _M ], [z _M ]) are arranged according to some rule, it is not necessary to execute all combinations of i and j. . For example, information _{([k 1], [z} 1]), ..., ([k M], [z M]) in the case that has been sorted on the basis of the key _{k m,} i from 1 M- Z _j = z _i (+) z _j , z _i = (0) when the key k _i and the key k _j are equal to j = i + 1 while sequentially increasing the value to 1.
And if not equal, z _j = z _j , z _i = z _i
And it is sufficient. Alternatively, when i is decreased in order from M to 2, when j = i−1 and key k _i is equal to key k _j , z _j = z _i (+) z _j , z _i = (0)
And if not equal, z _j = z _j , z _i = z _i
And it is sufficient. If the information has been sorted in this way, it is possible to perform the set function operation on all pieces of information having the same value key only by sequentially comparing adjacent information, and finally set the set function to z _j that is combined. The result of the operation can be summarized. Therefore, processing can be performed with a calculation amount of O (M).

Deletion means 340, after processing of the join operation means 330, M pieces of information _{([k m], [z} m]) were randomly replaced with the secure computing, _{z m} after random substitution (0) or a secure computing Confirm with, and restore the confirmation result. That is, [C] with respect to z _m and (0) is obtained by Equation (1), and [C] is restored to obtain C. _Then, the z m = For (0) (the case of long if C = 1 in formula (1)) information _{([k m], [z} m]) Remove (S340). Removing step S340, the number of remaining information, the information _{([k m], [z} m]) may be deleted until the lesser of the number of values of the number and key. If the information ([k ₁ ], [z ₁ ]),..., ([K _M ], [z _M ]) is originally arranged at random, the random replacement is not necessary and the deletion unit 340 is omitted. May be. Information _{([k 1], [z} 1]), ..., the confirmation result _{([k M], [z} M]) if it is sorted based is the key _{k m, z m = (0} ) When the information is restored, information about the key such as how many pieces of information have the same key value and what number of boundaries is leaked. Therefore, random substitution is required.

FIG. 1 shows a configuration example of a secure set function system according to the second embodiment. FIG. 3 shows a processing flow of the secure set function system according to the second embodiment. Secure set function systems Example 2, N pieces of secret set function device ₁₀ 1, ..., 10 is constituted by _N, M pieces of information including the key _{k m} and attribute values _{v m (k 1, v 1} ), ..., (k _M , v _M ) are secret-distributed information ([k ₁ ], [v ₁ ]), ..., ([k _M ], [v _M ]), respectively, Ask. Here, M is an integer greater than or equal to 2, N is an integer greater than or equal to 3, m, i, j are integers greater than or equal to 1 and less than or equal to M, [] is a symbol indicating information in which information in parentheses is secretly shared for each element, (+) Is a symbol indicating an operation for obtaining an aggregation result in which a unit element exists and an associative law and a commutative law are established, (0) is a symbol indicating a unit element of the operation (+), and T is (log ₂ M) is a minimum integer of −1 or more, t is an integer of 0 or more and T or less, and ^ is a symbol indicating a power. In Example 2, the information _{([k 1], [v} 1]), ..., ([k M], [v M]) is the sorted information based on the key _{k m.}

The secret set function device 10 _n includes a set function control unit 300 _n , a secret sharing device 100 _n , and a recording unit 190 _n . The secret sharing device 100 _n , the recording unit 190 _n , and an initialization unit 320 of the set function control unit 300 _n . _n and the deletion unit 340 _n are the same as those in the first embodiment. The difference is the combination calculation unit 330 _n . That is, the initialization unit 320 and the deletion unit 340 are the same as those in the first embodiment, and the combination calculation unit 330 is different.

The coupling operation unit 330 _{n according to the} second embodiment includes a first coupling unit 331 _n , a second coupling unit 332 _n , and a third coupling unit 333 _n . The first coupling means 331 (not shown) is composed of first coupling parts 331 ₁ ,..., 331 _N , and the second coupling means 332 (not shown) is second coupling parts 332 ₁ ,. 332 _N , and the third coupling means 333 (not shown) is composed of third coupling portions 333 ₁ ,..., 333 _N. Further, the combination calculation unit 330 includes a first combination unit 331, a second combination unit 332, and a third combination unit 333.

The join calculation means 330 substitutes 0 for t (S336). For i = 1, 2,..., M−2 ^ t, the first combining means 331 uses z _{i + 2 ^ t} ′ = z _i (+) z _{i + 2 ^ t} when k _i and k _{i + 2 ^ t} are equal.
And if not equal z _{i + 2 ^ t} '= z _{i + 2 ^ t}
(S331). More specifically, the first combining units 331 ₁ ,..., 331 _N (first combining means 331) send the secret sharing apparatuses 100 ₁ ,..., 100 _N to i = 1, 2,. For t, whether or not k _i and k _{i + 2 ^ t} are equal is confirmed by, for example, the secret calculation of equation (1). Then, based on the result, the secret calculation of z _{i + 2 ^ t} '= z _i (+) z _{i + 2 ^ t} or z _{i + 2 ^ t} ' = z _{i + 2 ^ t} is executed. Note that the processes for i = 1, 2,..., M−2 ^ t in step S331 can be processed in parallel because they do not affect each other.

The second combining means 332 is configured such that z _i = z _i ′ for i = 1, 2,.
(S332). Note that step S332 can also be processed in parallel because the processes for i = 1, 2,..., M do not affect each other. Then, the join calculation unit 330 checks whether t = T (S337). If Yes, the process proceeds to step S333. If No, t + 1 is substituted for t (S338), and the process returns to step S331.

In step S333, when the third combining means has i = 1, 2,..., M−1, and k _i and k _{i + 1} are equal, z _i = z _i
And then, when unequal z _i = (0)
(S333).

  The processes in steps S320 and S340 are the same as those in the first embodiment.

  As described above, the combination calculation unit 330 repeats the processing (S331, S332) of the first combination unit 331 and the second combination unit 332 for t = 0, 1, 2,. The process (S333) is performed. Further, since steps S331 and S332 can be performed in parallel, even if the number of operations increases, it is possible to perform operations at a higher speed than the method of the first embodiment in which repeated operations must be executed in order. More specifically, the calculation amount of the secure set function system according to the second embodiment is O (M log M) with respect to the number of data M. Therefore, it increases from O (M) in the first embodiment. On the other hand, since Example 1 needs to be processed in order, the number of stages (the number of calculations that must be processed in series) is also O (M). However, in the second embodiment, since the degree of parallelism is significantly increased, the number of stages is reduced to O (log M).

FIG. 4 shows a configuration example of the secure set function system according to the third embodiment. FIG. 5 shows a processing flow of the secure set function system according to the third embodiment. Secure set function system of the third embodiment also, N pieces of secret set function device ₁₀ 1, ..., 10 is constituted by _N, M pieces of information including the key _{k m} and attribute values _{v m (k 1, v 1} ), ..., (k _M , v _M ) are secret-distributed information ([k ₁ ], [v ₁ ]), ..., ([k _M ], [v _M ]), respectively, Ask. Here, M is an integer greater than or equal to 2, N is an integer greater than or equal to 3, m, i, j are integers greater than or equal to 1 and less than or equal to M, [] is a symbol indicating information in which information in parentheses is secretly shared for each element, (+) Is a symbol indicating an operation for obtaining an aggregation result in which a unit element exists and an associative law and a commutative law are established, (0) is a symbol indicating a unit element of the operation (+), and s is predetermined. M an integer, K is the number of possible values of the key k _m. In Example 3, information _{([k 1], [v} 1]), ..., ([k M], [v M]) is the sorted information based on the key _{k m.}

The secret set function device 10 _n includes a set function control unit 300 _n , a secret sharing device 100 _n , and a recording unit 190 _n . The secret sharing device 100 _n , the recording unit 190 _n , and an initialization unit 320 of the set function control unit 300 _n . _n , the combination calculation unit 330, and the deletion unit 340 _n are the same as those in the first or second embodiment. The difference is the pre-processing unit 310 _n . That is, the initialization unit 320, the combination calculation unit 330, and the deletion unit 340 are the same as those in the first or second embodiment.

The pre-processing unit 310 _n includes a first pre-initialization unit 311 _n , a second pre-initialization unit 312 _n , a pre-combination unit 313 _n , a storage unit 314 _n , a second pre-repetition unit 315 _n , and a pre-delete unit 316 _n. , having a first pre-repetition unit 317 _n. The first pre-initialization means 311 (not shown) includes first pre-initialization units 311 ₁ ,..., 311 _N , and the second pre-initialization means 312 (not shown) initializing unit ₃₁₂ 1, ..., is composed of 312 _N, pre-coupling means 313 (not shown) is preconnected unit ₃₁₃ 1, ..., is composed of 313 _N, storage means 314 (not shown) is stored part ₃₁₄ 1, ..., is composed of 314 _N, the second pre-repeating unit 315 (not shown) and the second pre-repetition unit ₃₁₅ 1, ..., is composed of 315 _N, in advance deleting means 316 (shown have not) pre deleting unit ₃₁₆ 1, ..., is composed of 316 _N, the first pre-repeating unit 317 (not shown) is first pre-repetition unit ₃₁₇ 1, ..., and a 317 _N. The preprocessing unit 310 includes a first preinitializing unit 311, a second preinitializing unit 312, a precombining unit 313, a storing unit 314, a second prerepetitive unit 315, a predeleting unit 316, and a first prerepetitive unit. Return means 317 is provided.

The first pre-initialization unit 311 sets M ′ = M (S311). The second pre-initializing unit 312 sets t = 0 and M ″ = M ′ (S312). The pre-combining unit 313 substitutes t + 1 for t, and increases from 1 to a maximum integer equal to or less than M ″ / 2. For i, when k _2i−1 and k _2i are equal, z _2i = z _2i−1 (+) z _2i , z _2i−1 = (0)
And if not equal, z _2i = z _2i , z _2i-1 = z _2i-1
(S313). Note _that comparison of _{k 2i-1} and _{k 2i} are preconnected unit ₃₁₃ 1, ..., 313 _N (pre-coupling means 313), secret sharing apparatus ₁₀₀ 1, ..., to 100 _N, for example of formula (1) What is necessary is just to perform a secret calculation using a logical expression. In addition, since operations for different i do not affect each other, operations for different i can be performed in parallel.

Storage means 314, odd-numbered information _{([k m '], [} z m']) and save withdrawn, the remaining information new information _{([k m], [z} m]) and the new information ( _[k m], check the _[z m] number of) new M "and (S314). the second pre-repeating unit 315, M" Do 2K or less (second pre repeat condition), the Until the two pre-repetition conditions are satisfied, the processing of the pre-coupling means 313 (S313) and the processing of the storage means 314 (S314) are repeated (S315).

Pre-Delete means S316, all of the information storage means 314 is saved _{([k m '], [} z m']) and the remaining information _{([k m], [z} m]) on that together and , Perform random replacement by secret calculation, confirm whether z _m after random replacement is (0) by secret calculation, and delete information ([k _m ], [z _m ]) if z _m = (0) and, the remaining information new information _{([k m], [z} m]) and then, new information _{([k m], [z} m]) and M 'number of (S316). Note that the number M ′ of new information (remaining information) is tK + (the number of information remaining in the last step S315).
The information can be deleted in step S316 until.

  The first pre-repetition unit S317 confirms whether M ′ is smaller than s (first pre-repetition condition), and the process of the second pre-initialization unit 312 until the first pre-repetition condition is satisfied (S312), The processing of the pre-coupling means 313 (S313), the processing of the storage means 314 (S314), the second pre-repetition means 315 (S315), and the pre-deletion means 316 (S316) are repeated (S317).

Then, the secure set function system, the M, pre-processing process means 310 (S310) after the information _{([k m], [z} m]) to change the number of the processing of pre-processing means 310 (S310) after For the information ([k _m ], [z _m ]), the process of the initialization unit 320 (S320) and the process of the join operation unit 330 (S330) shown in the first or second embodiment are executed. .

  The processing of the pre-processing means 310 of the third embodiment has an effect of reducing the amount of calculation when the number of information M is very large compared to the number K of values that can be taken by the key. On the other hand, when the values of M and K are close to each other, the amount of calculation can be reduced by the process (S330) of the combination calculation unit 330 of the first and second embodiments. Therefore, when M is very large compared to K, the number M of information is reduced by using the pre-processing unit 310, and when the M approaches K, the operation is switched to the combination calculation unit 330 of the first embodiment or the second embodiment. Is efficient. More specifically, the calculation amount of the secure set function system of the third embodiment is O (M + K log M), and the number of stages is O (log M). S determined in advance is a value that determines how much M is switched to near K, and may be determined as appropriate so that the total calculation amount is reduced. Thus, according to the secure set function system of the third embodiment, the amount of calculation can be reduced when the number of information M is very large compared to the number K of values that can be taken by the key.

[Specific examples of computational complexity]
It is assumed that the number of information M = 1000 and the number of possible values K = 10. In step S314 of the third embodiment, M "= 500 at the first time, M" = 250 at the second time, M "= 16 at the sixth time, and the number of join operations so far is 985 times, and the rest The number of information is as follows.

tK + (number of information remaining in the last step S315) = 6 × 10 + 16 = 76
When this is repeated once again, t = 2, M ″ = 19, the number of join operations is increased 57 times, 1042 times, and the maximum number of remaining information (actually a number less than this number) is 2 × 10 + 19. For example, if s is set to 40, step S317 is completed, and the process proceeds to step S320, and if steps S320, S330, and S340 are executed by the method of the first embodiment, the number of join operations is 1080. The number of stages is 46. If steps S320, S330, and S340 are executed by the method of the second embodiment, the number of join operations is 1213 and the number of stages is 14. For comparison, the number of stages of the first embodiment is as follows. In the case of the method, the number of join operations is 999, the number of stages is 999, the number of join operations in the case of the method of the second embodiment is 8977, the number of stages is 10, and the number of information M can be a key. value If substantially greater than the number K, the method of Example 3 it can be seen that excellent balance between computational and stages. In the case of the conventional method, the number of binding operations 9990 times, the number of stages is 10 stages.

[Secret calculation]
In the above description, it is assumed that the secret calculation is not limited to one method, and no specific example is shown. In the following description, random replacement performed by the secret set function devices 10 ₁ ,..., 10 _N and other secret calculations will be described. In addition, the description regarding the following secret calculation is an example, and is not limited thereto. Other secret computations may be used in the secure set function system of the present invention.

Random replacement 1
FIG. 6 shows a secure set function system showing in detail a functional configuration example of the secret sharing apparatus 100 _{n that} can be used in the present invention. FIG. 7 shows a first processing flow example of random replacement. In this example, the secure set function system also includes selection means 105. Here, A ₁ ,..., A _K are K numerical values (K is an integer of 2 or more) recorded by each secret set function device 10 _n in a distributed manner, and the numerical values A _k are k-th numerical values (k is An integer of 1 or more and K or less), and a _kn is a k-th fragment recorded by the secret set function device 10 _n . Note that the numerical values A ₁ ,..., _AK are numerical values to be concealed, for example, numerical values to be sorted. The numerical value group as the sorting target, for example, numerical A _k are considered numeric group shown an annual income of each person. The selection unit 105 may be arranged inside any secret set function device or may be a single device.

The secure set function system includes a selection unit, a fragment replacement unit, and a redistribution unit. The secret sharing apparatus 100 _n includes at least a fragment replacement unit 110 _n , a re-distribution unit 120 _n, and a recording unit 190 _n . The recording unit 190 _n records fragments a _1n ,..., A _Kn, etc. The recording unit 190 _n also records information on the number a fragment of the numerical value A _k that the fragment a _kn recorded by itself is.

The selection unit 105 selects a secret set function device 10 _n that is less than N (S105). For example, in the case of secret sharing in which a numerical value can be restored by collecting N ′ out of N fragments, a secret set function device having N ′ or more and less than N fragment replacement means may be selected.

The fragment replacement means includes at least the fragment replacement units 110 ₁ ,..., 110 _N. Then, {1,..., K} → {1, between the fragment replacement units 110 _{i of} the secret set function device 10 _i selected by the selection means 105 (where i is a number indicating the selected secret set function device). ..., create a bijective [pi of K}, the recording unit 190 _i of the secret set function device 10 _i to the selected fragment a _{π (k) i} to k-th fragment to be recorded (S110). The bijection π may be obtained by simply rearranging 1 to K at random. Note that the bijection π is preferably a uniform and random permutation, such as Fisher-Yates shuffle (Reference 1: Richard Durstenfeld, “Algorithm 235: Random permutation”, Communications of the ACM archive, Volume 7, Issue 7, 1964.) etc. Further, it may be generated between the bijective π secret set function device 10 selected is _i, and generates a single, secret set function unit of the secret set function device 10 _i which is selected, is selected The secret set function device 10 _i may be shared.

Redispersion means, at least re-dispersing section ₁₂₀ 1, ..., configured to include a 120 _N. The re-distribution means re-distributes using the fragment a _{π (k) i} (replaced k-th ₎ corresponding to the numerical value A _{π (k)} replaced by the fragment replacement means, and performs a new fragment b _k1,. , B _kN are obtained and set as a fragment of the numerical value B _k (S120). That is, the relationship of A _{π (k)} = B _k holds, but the secret set function device that was not selected does not know bijection π, and therefore does not know that A _{π (k)} = B _k . Note that that each secret recording unit 190 _n of the set function device 10 _n has not only to record the fragment b _kn, fragment b _kn is the k-th fragment itself is recorded is a fragment of numbers B _k Also record information. Further, if the numerical values B ₁ ,..., _BK are changed to new numerical values A ₁ ,..., _AK and the combination of the secret set function devices selected by the selection means is changed, this process can be repeated (S111, S112). .

According to the secure set function system of the present invention, fragments are shuffled between limited secret set function devices. Therefore, secret set function device has not been chosen, because it does not know the BC π, numerical value A _{1, ...,} A _K and the numerical value B _{1, ...,} do not know the correspondence between the B _K. That is, numerical values A ₁ from a specific secret set function _device, ..., A _K and number B _1, ..., If you wish to state that corresponds is not known with B _K, the selection means 105 the secret set function device The secret set function device to be selected may be determined in advance so as not to select it. In addition, if this process is repeated while changing the secret set function device selected by the selection means 105 and all secret set function devices have not been selected, all secret set function devices have numerical values A ₁ , ..., numeric _B 1 that can not be assigned corresponding to _{a K,} ..., can be obtained _{B K.}

Random replacement 2
FIG. 6 also shows a functional configuration example showing in detail the secret sharing apparatus 100 _n of the secure set function system for the next random replacement. FIG. 8 shows a second processing flow example of random replacement. Also in this example, the secure set function system also includes a selection unit 105. Here, A ₁ ,..., A _K are K numerical values (K is an integer of 2 or more) recorded by each secret set function device 10 _n in a distributed manner, and the numerical values A _k are k-th numerical values (k is An integer from 1 to K), and let a _{kn be} a fragment of a numerical value A _k recorded by the secret set function device 10 _n .

The secure set function system of the present invention includes a selection unit 105, an initial information distribution unit, an initial multiplication unit, a fragment replacement unit, a redistribution unit, a confirmation distribution unit, a confirmation multiplication unit, and a falsification detection unit. The secret sharing apparatus 100 _n includes an initial information distribution unit 130 _n , an initial multiplication unit 140 _n , a fragment replacement unit 110 _n , a redistribution unit 120 _n , a confirmation distribution unit 150 _n , a confirmation multiplication unit 160 _n , and a tampering detection unit 170. _n . The recording unit 190 _n records fragments a _1n ,..., A _Kn, etc. The recording unit 190 _n also records information on the number a fragment of the numerical value A _k that the fragment a _kn recorded by itself is.

The selection means 105 is the same as the random replacement 1. Initial information distribution means, the initial information distribution unit ₁₃₀ 1, ..., and a 130 _N. The initial information distribution unit 130 _i of the secret set function device 10 _i selected by the selecting means 105, the secret set function device ₁₀ 1, ..., K-number of numerical _P 1 does not know any of 10 _N, ..., P _The respective fragments p _1n ,..., P _Kn of _K are obtained by secret calculation and recorded in the recording unit 190 _n (S130). Specifically, two or more secret set function devices are selected from the secret set function devices selected by the selection means 105. Then, based on the value created by the selected secret set function device, a fragment of a value unknown to any device may be created. For example, two secret set function devices 10 _i and 10 _j are selected (where i ≠ j), and a numerical fragment generated by the secret set function device 10 _i and a numerical fragment generated by the secret set function device 10 _j Are distributed and recorded. Then, if the sum of the two numerical values is obtained by secret calculation and the fragments are distributed and recorded so that the result is not known, the fragments of numerical values that are not known to all the secret set function devices can be distributed and recorded. In this example, two selected secret set function devices are used, but two or more secret set function devices may be used.

The initial multiplication means, the initial multiplier ₁₄₀ 1, ..., and a 140 _N. The initial multiplication unit ₁₄₀ 1, ..., 140 _{N is, S k = P k × A} k is a numerical value _{S k} fragment _s k1 of, _..., determined by the _{s kN} secure computing, recording unit ₁₉₀ 1, ..., to 190 _N Distributed and recorded (S140).

Fragment replacement means and redispersion means are the same as random replacement 1. The confirmation dispersion means is composed of confirmation dispersion units 150 ₁ ,..., 150 _N. The confirmation dispersion unit 150 ₁ ,..., 150 _N generates a fragment q _k1 ,..., Q _kN of the numerical value Q _k with Q k = Pπ _(k) for _k = _{1 to K} by a secret calculation, and a recording unit 190 _1, ..., distributed and recorded in 190 _N (S150). Specifically, another fragment having a value unknown to any device may be created based on the value created by the secret set function device selected in step S130. For example, another fragment (new fragment) of the numerical value generated by the secret set function device 10 _i selected in step S130 for the numerical value P _{π (k)} and the secret set function device 10 _j selected in step S130 are numerical values. Another piece (new piece) of the numerical value generated for _{Pπ (k)} is distributed and recorded. Then, if the sum of the two numerical values is obtained by secret calculation and the fragments are distributed and recorded so that the result is not known, Q _k = P _{π (k)} and all secret set function devices are known. It is possible to record pieces with no numerical value. In this example, two selected secret set function devices are used, but two or more secret set function devices may be used as in step S130.

Check multiplying means, check multiplying unit ₁₆₀ 1, ..., and a 160 _N. Check multiplying unit ₁₆₀ 1, ..., 160 _{N is, T k = Q k × B} k is a numerical value _{T k} fragment _t k1 of, _..., determined by the _{t kN} secure computing, recording unit ₁₉₀ 1, ..., to 190 _N Distributed and recorded (S160).

Tampering detection means, the falsification detection unit ₁₇₀ 1, ..., and a 170 _N. The tampering detection units 170 ₁ ,..., 170 _N confirm that T _k = S _{π (k)} for _k = _{1 to K} (S 170). In the case of t _kn ≠ s _{π (k) n} , it is terminated abnormally because tampering has occurred. Further, if the numerical values B ₁ ,..., _BK are changed to new numerical values A ₁ ,..., _AK and the combination of the secret set function devices selected by the selection means is changed, this process can be repeated (S111, S112). .

[Other secret calculations]
Here, an example of secret calculation when the secure set function system is configured by three secret set function devices is shown. Further, since it is not necessary to fix the numbers of the secret set function devices 10 ₁ , 10 ₂ , and 10 ₃ , they are expressed as secret set function devices 10 _α , 10 _β , and 10 _γ . That is, (α, β, γ) is any one of (1, 2, 3), (2, 3, 1), and (3, 1, 2).

In the following secret calculation, the fragments of the numerical value A recorded by the secret set function devices 10 _α , 10 _β , 10 _γ are recorded as (a _γα , a _αβ ), (a _αβ , a _βγ ), (a _βγ , a _γα ), the fragments of the numerical value B are (b _γα , b _αβ ), (b _αβ , b _βγ ), (b _βγ , b _γα ), the fragments of the numerical value C are (c _γα , c _αβ ), (c _αβ , c _βγ ), (c _βγ , c _γα ). In the following description, W is a predetermined integer of 2 or more, and the calculation result is a remainder obtained by dividing by W. In other words, “mod W” is omitted in the calculation formula described below.

Secret sharing of numerical value A (1) Random numbers a _αβ and a _βγ are generated.
(2) a _γα = A−a _αβ −a _βγ is calculated, and the fragments are set to (a _γα , a _αβ ), (a _αβ , a _βγ ), (a _βγ , a _γα ), and the secret set function device 10 _α , 10 _β and 10 _γ .

Restoring numbers A (1) Secret set function device 10 _alpha sends a _Ganmaarufa secret set function device 10 _beta, and transmits the a _.alpha..beta secret set function device 10 _gamma. Secret set function device 10 _beta sends a _.alpha..beta secret set function device 10 _gamma, transmits the a _{[beta] [gamma]} to the secret set function device 10 _alpha. The secret set function device 10 _γ transmits a _βγ to the secret set function device 10 _α , and transmits a _γα to the secret set function device 10 _β .
(2) Secret set function device 10 _alpha If they match and the a _{[beta] [gamma]} received from a _{[beta] [gamma]} and the secret set function device 10 _gamma received from the secret set function device 10 _beta, calculates the _a αβ + a βγ + a γα To restore the numerical value A. If the secret set function device 10 _beta match and the a _Ganmaarufa received from a _Ganmaarufa private set function device 10 _alpha received from the secret set function device 10 _gamma, numerical by calculating _{a αβ + a βγ + a γα} A To restore. If the secret set function device 10 _gamma match and the a _.alpha..beta received from a _.alpha..beta private set function device 10 _beta received from the secret set function device 10 _alpha, numerical by calculating _{a αβ + a βγ + a γα} A To restore.

C = A + B secret calculation (1) The secret set function device 10 _α calculates and records (c _γα , c _αβ ) = (a _γα + b _γα , a _αβ + b _αβ ), and the secret set function device 10 _β c _αβ , c _βγ ) = (a _αβ + b _αβ , a _βγ + b _βγ ) is calculated and recorded, and the secret set function device 10 _γ is (c _βγ , c _γα ) = (a _βγ + b _βγ , a _γα + b _γα ) Is calculated and recorded.

C = A−B secret calculation (1) Secret set function device 10 _α calculates and records (c _γα , c _αβ ) = (a _γα -b _γα , a _αβ -b _αβ ), and sets the secret set function device 10 _β calculates and records (c _αβ , c _βγ ) = (a _αβ −b _αβ , a _βγ −b _βγ ), and the secret set function device 10 _γ has (c _βγ , c _γα ) = (a _βγ − b _{[beta] [gamma],} and records the Get _a γα -b γα).

Secret calculation of C = A + S (where S is a known constant)
(1) The secret set function device 10 _α calculates and records (c _γα , c _αβ ) = (a _γα + S, a _αβ ), and the secret set function device 10 _γ has (c _βγ , c _γα ) = (a _{[ beta] [gamma]} , a [ _{gamma] [alpha]} + S) is calculated and recorded. There is no processing of the secret set function device _10β .

C = AS secret calculation (where S is a known constant)
(1) The secret set function device 10 _α calculates and records (c _γα , c _αβ ) = (a _γα S, a _αβ S), and the secret set function device 10 _β has (c _αβ , c _βγ ) = ( a _αβ S, a _βγ S) is calculated and recorded, and the secret set function device 10 _γ calculates and records (c _βγ , c _γα ) = (a _βγ S, a _γα S).

C = AB Secret Calculation (1) The secret set function device 10 _α generates random numbers r ₁ , r ₂ , c _γα , and c _αβ = (a _γα + a _αβ ) (b _γα + b _αβ ) −r ₁ −r _2- c _γα is calculated. Then, the secret set function device 10 _alpha, and transmits the secret set function device 10 _beta a _(r 1, c _αβ), a secret set function device 10 _gamma a _(r 2, c _γα).
(2) The secret set function device 10 _β calculates y = a _αβ b _βγ + a _βγ b _αβ + r ₁ and transmits it to the secret set function device 10 _γ .
(3) the secret set function device 10 _gamma, calculates a _{z = a βγ b γα + a} γα b βγ + r 2, and transmits the secret set function device 10 _alpha.
(4) The secret set function device 10 _β and the secret set function device 10 _γ calculate c _βγ = y + z + a _βγ b _βγ , respectively.
(5) The secret set function device 10 _α records (c _γα , c _αβ ), the secret set function device 10 _β records (c _αβ , c _βγ ), and the secret set function device 10 _γ is (c _βγ , c _γα ).

Secret calculation of negation of bit A (C = 1−A) The secret set function device 10 _α is (c _γα , c _αβ ) = (1−a _γα , −a _αβ mod W).
And the secret set function device 10 _β is (c _αβ , c _βγ ) = (− a _αβ mod W, −a _βγ mod W)
And the secret set function device 10 _γ is (c _βγ , c _γα ) = (− a _βγ mod W, 1−a _γα )
Calculate and record.

Secure computing <br/> secret set function unit 10-bit logical product _{(C = A∧B = AB) α} , 10 β, 10 γ is the same process as secure computing integer multiplication (C = AB mod W) I do.

Secret calculation of bit logical sum (C = A∨B = A + B−AB) (1) Secret set function devices 10 _α , 10 _β , 10 _γ are the same as the secret calculation of integer addition (C = A + B mod W) As a result of C ′ = A + B, the secret set function device 10 _α is a fragment (c _γα ′, c _αβ ′), and the secret set function device 10 _β is a fragment (c _αβ ′, c _βγ ′). secret set function device 10 _gamma fragments _{(c βγ ', c γα'} ) for recording. The secret set function devices 10 _α , 10 _β , 10 _γ perform the same processing as the secret calculation of integer multiplication (C = AB mod W), and as a result of C ″ = AB, the secret set function device 10 _α The fragment (c _γα ″, c _αβ ″) is _recorded , the secret set function device 10 _{β records the} fragment (c _αβ ″, c _βγ ″), and the secret set function device 10 _γ records the fragment (c _βγ ″, c _γα ″). To do.
(2) The secret set function device 10 _α , 10 _β , 10 _γ performs the same processing as the secret calculation (where S is a known constant) of integer multiplication (C = AS mod W) with S = −1, As a result of C ′ ″ = − C ″, the secret set function device 10 _α is a fragment (c _γα ′ ″, c _αβ ′ ″), and the secret set function device 10 _β is a fragment (c _αβ ′ ″, c _βγ ′ ″), the secret set function device 10 _γ records the fragments (c _βγ ′ ″, c _γα ′ ″).
(3) The secret set function device 10 _α , 10 _β , 10 _γ performs the same processing as the secret calculation of integer addition (C = A + B mod W), and as a result of C = C ′ + C ′ ″, the secret set The function device 10 _{α records} the fragment (c _γα , c _αβ ), the secret set function device 10 _{β records} the fragment (c _αβ , c _βγ ), and the secret set function device 10 _γ records the fragment (c _βγ , c _γα ). .

Secret calculation of exclusive OR of bits (C = A [∨] B = A + B−2AB) (1) Secret set function devices 10 _α , 10 _β , 10 _γ are integer additions (C = A + B mod W) The same processing as the secret calculation is performed, and as a result of C ′ = A + B, the secret set function device 10 _α is a fragment (c _γα ′, c _αβ ′), and the secret set function device 10 _β is a fragment (c _αβ ′, c _βγ '), The secret set function device 10 _γ records the fragment (c _βγ ', c _γα '). The secret set function devices 10 _α , 10 _β , 10 _γ perform the same processing as the secret calculation of integer multiplication (C = AB mod W), and as a result of C ″ = AB, the secret set function device 10 _α The fragment (c _γα ″, c _αβ ″) is _recorded , the secret set function device 10 _{β records the} fragment (c _αβ ″, c _βγ ″), and the secret set function device 10 _γ records the fragment (c _βγ ″, c _γα ″). To do.
(2) The secret set function device 10 _α , 10 _β , 10 _γ is the same processing as the secret calculation of an integer multiplication (C = AS mod W) with S = −2 (where S is a known constant). As a result of C ′ ″ = − 2C ″, the secret set function device 10 _α is a fragment (c _γα ″ ″, c _αβ ′ ″), and the secret set function device 10 _β is a fragment (c _αβ ′). ″, C _βγ ′ ″), and the secret set function device 10 _γ records the fragment (c _βγ ′ ″, c _γα ′ ″).
(3) The secret set function device 10 _α , 10 _β , 10 _γ performs the same processing as the secret calculation of integer addition (C = A + B mod W), and as a result of C = C ′ + C ′ ″, the secret set The function device 10 _{α records} the fragment (c _γα , c _αβ ), the secret set function device 10 _{β records} the fragment (c _αβ , c _βγ ), and the secret set function device 10 _γ records the fragment (c _βγ , c _γα ). .

Secret calculation of integer conversion of bits A (n), n = 0,..., N−1 Integer conversion of bits A (n) is

Is to seek. Further, the fragments of the bits A (n) recorded by the secret set function devices 10 _α , 10 _β , 10 _γ in a distributed manner are represented as (a (n) _γα , a (n) _αβ ), (a (n) _αβ , a (N) _βγ ), (a (n) _βγ , a (n) _γα ). The secret set function device 10 _α is

The secret set function device 10 _β is calculated and recorded as

The secret set function device 10 _γ is calculated and recorded

Calculate and record.

The secret calculation x (n) of the binary conversion of the N-bit integer A shall indicate the lower n + 1th bit of x.
(1) For n = 0 to N−1, the secret set function device 10 _β secretly distributes (a _αβ + a _βγ mod W) (n), and the secret set function devices 10 _α , 10 _β , 10 _γ are (a _αβ + a _βγ mod W) (fragment _{n) (b (n) γα} , b (n) αβ), (b (n) αβ, b (n) βγ), (b (n) βγ, b (n) _γα ) is distributed and recorded. For n = 0 to N−1, the secret set function device 10 _γ secretly distributes (a _γα ) (n), and the secret set function devices 10 _α , 10 _β , 10 _γ are fragments of (a _γα ) (n) ((A _γα ) (n) _γα , (a _γα ) (n) _αβ ), ((a _γα ) (n) _αβ , (a _γα ) (n) _βγ ), ((a _γα ) (n) _βγ , (A _γα ) (n) _γα ) are recorded in a dispersed manner.
(2) c _γα = 0, and the processes from (2-1) to (2-3) are repeatedly executed for n = 0 to N-1.
(2-1) d _n = b (n) + (a _γα ) (n) _-2b (n) (a _γα ) (n)
And _dn fragments are distributed and recorded.
_{(2-2) a (n) =} d n + c n -2d n c n
The secret calculation is performed and the pieces of a (n) are distributed and recorded.
(2-3) If n <N-1,
_{c n + 1 = b (n} ) (a γα) (n) + d n c n -b (n) (a γα) (n) d n c n
And _{cn + 1} fragments are distributed and recorded.

[Program, recording medium]
The various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

10 _1, ..., 10 _N secret set function device 100 _1, ..., 100 _N secret sharing device 105 selecting unit 110 _1, ..., 110 _N fragment replacement unit ₁₂₀ 1, ..., 120 _N redispersion unit 130 _1, ..., 130 _N initial information distribution unit ₁₄₀ 1, ..., 140 _N initial multiplier unit 0.99 _1, ..., 0.99 _N confirmation dispersion unit ₁₆₀ 1, ..., 160 _N confirmation multiplying unit 170 _1, ..., 170 _N falsification detecting unit ₁₉₀ 1, ..., 190 _N recording unit 300 ₁ ,..., 300 _N set function control unit 310 pre-processing means 310 ₁ ,..., 310 _N pre-processing unit 311 first pre-initializing means 311 ₁ , ..., 311 _N first pre-initialization unit 312 the second pre-initializing means 312 _1, ..., 312 _N second pre initializing unit 313 pre-coupling means 313 _1, ..., 313 _N preconnected unit 314 storage unit 314 _1, ... , 314 _N storage unit 315 second pre-repetition unit 315 ₁ , ..., 315 _N second pre-repetition unit 316 pre-deletion unit 316 ₁ , ..., 316 _N pre-deletion unit 317 first pre-repetition unit 317 ₁ , ... , 317 _N first pre-repetition unit 320 initialization means 320 _1, ..., 320 _N initialization unit 330 coupled calculating means 330 _1, ..., 330 _N bond calculation unit 331 first coupling means 331 _1, ..., 331 _N first 1 coupling portion 332 second coupling means 332 _1, ..., 332 _N second coupling portion 333 third connecting means 333 _1, ..., 333 _N third coupling portion 340 deleting unit 340 _1, ..., 340 _N deletion unit 1000 network

Claims (10)

N number of private set function unit _R 1, ..., is composed of _{R N,} M pieces of information including the key _{k m} and attribute values _{v m (k 1, v 1} ), ..., (k M, v M) is A secure set function system for obtaining a secret-distributed aggregation result from secret-distributed information ([k ₁ ], [v ₁ ]), ..., ([k _M ], [v _M ]),
M is an integer greater than or equal to 2, N is an integer greater than or equal to 3, m, i, j are integers greater than or equal to 1 and less than or equal to M, [] is a symbol indicating information in which information in parentheses is secretly shared for each element, (+) Is a symbol indicating an operation for obtaining the aggregation result in which the unit element exists and the join rule and the commutative rule are established, and (0) is a symbol indicating the unit element of the operation (+),
M data _z 1, ..., a _{z M,} set as z _m = _v m, the information _{([k 1], [z} 1]), ..., ([k M], [z M]) Initialization means for generating
When the key k _i is equal to the key k _j (where i ≠ j), z _j = z _i (+) z _j , z _i = (0)
And if not equal, z _j = z _j , z _i = z _i
A join operation means for executing a join process with secret calculation on information having all equal keys;
A secure set function system comprising: The secure set function system according to claim 1,
Information _{([k 1], [v} 1]), ..., and _{([k M], [v} M]) information is sorted on the basis of the key _{k m,}
After the processing of the joint operation means, M pieces of information ([k _m ], [z _m ]) are randomly replaced by secret calculation, and it is confirmed whether z _m after the random replacement is (0), z _m = ( information in the case of 0) _([k m], also comprising deleting means for deleting the _[z m]),
The joint calculation means includes
Perform the above-mentioned combining process for j = i + 1 while increasing the value in order from 1 to M−1, or set j = i−1 while decreasing the value in order from M to 2. A secure set function system characterized in that the joining process is performed on the secure set function system. The secure set function system according to claim 1,
T is the smallest integer greater than or equal to (log ₂ M) −1, t is an integer greater than or equal to 0 and less than or equal to T, ^ is a symbol indicating power, information ([k ₁ ], [v ₁ ]),... ([K _M ], and _[v M]) information is sorted based on the key _{k m,}
After the processing of the joint operation means, M pieces of information ([k _m ], [z _m ]) are randomly replaced by secret calculation, and it is confirmed whether z _m after the random replacement is (0), z _m = ( information in the case of 0) _([k m], also comprising deleting means for deleting the _[z m]),
The joint calculation means includes
When i = 1, 2,..., M−2 ^ t, when k _i and k _{i + 2 ^ t} are equal, z _{i + 2 ^ t} ′ = z _i (+) z _{i + 2 ^ t}
And if not equal z _{i + 2 ^ t} '= z _{i + 2 ^ t}
A first coupling means,
i = 1, 2,..., M z _i = z _i ′
A second coupling means,
For i = 1, 2,..., M−1, when k _i and k _{i + 1} are equal, z _i = z _i
And then, when unequal z _i = (0)
A third coupling means, and
, And for t = 0, 1, 2,..., T, the processing of the third combining means is performed after the processing of the first combining means and the second combining means is repeated. Function system. A secure set function system according to claim 2 or 3,
s The predetermined M an integer, K is the number of possible values of the key k _m,
First pre-initialization means for M ′ = M;
second pre-initialization means for t = 0, M ″ = M ′;
Substitute t + 1 for t,
Z _2i = z _2i-1 (+) z _2i , z _2i-1 = (0) when k _2i-1 and k _2i are equal for i from 1 to the maximum integer of M ″ / 2 or less
And if not equal, z _2i = z _2i , z _2i-1 = z _2i-1
Pre-joining means,
Odd-numbered information _{([k m '], [} z m']) that extracts the saved, remaining information new information _{([k m], [z} m]) and the new information _([k m], [Z _m ]) a number of new M ″ storage means;
A second pre-repetition unit that repeats the processes of the pre-coupling unit and the storage unit until M ″ becomes 2K or less;
The storage means are all stored information _{([k m '], [} z m']) and the remaining information _{([k m], [z} m]) on which the combined and randomly replaced with secure computing and, _{z m} after the random substitution check to see _{(0), z m = (} 0) in the case of the information _{([k m], [z} m]) to remove the, the remaining information new information ( [K _m ], [z _m ]), and M ′ the number of new information ([k _m ], [z _m ]),
A first pre-repetition unit that repeats the processes of the second pre-initialization unit, the pre-combination unit, the storage unit, the second pre-repetition unit, and the pre-deletion unit until M ′ becomes smaller than s; Including pre-processing means having
The M, the pre-processing means of the processed information _{([k m], [z} m]) to change the number of the pre-processing means of the processed information _{([k m], [z} m] ), The process of the initialization means is executed. M pieces of information, including the key _{k m} and attribute values _{v m (k 1, v 1} ), ..., (k M, v M) information that has been each secret sharing _{([k 1], [v} 1]), ..., ([k _M ], [v _M ]), a secret set function device among N secret set function devices constituting a secure set function system for obtaining a secret-distributed aggregation result,
M is an integer greater than or equal to 2, N is an integer greater than or equal to 3, m, i, j are integers greater than or equal to 1 and less than or equal to M, [] is a symbol indicating information in which information in parentheses is secretly shared for each element, (+) Is a symbol indicating an operation for obtaining the aggregation result in which the unit element exists and the join rule and the commutative rule are established, and (0) is a symbol indicating the unit element of the operation (+),
M data _z 1, ..., a _{z M,} set as z _m = _v m, the information _{([k 1], [z} 1]), ..., ([k M], [z M]) An initialization unit for generating
When the key k _i is equal to the key k _j (where i ≠ j), z _j = z _i (+) z _j , z _i = (0)
And if not equal, z _j = z _j , z _i = z _i
A join operation unit for executing a join process with secret calculation for information having all equal keys;
A secret set function device comprising: N number of secret set function apparatus _R 1, ..., by using the _{R N,} M pieces of information, including the key _{k m} and attribute values _{v m (k 1, v 1} ), ..., (k M, v M) is A secure set function processing method for obtaining a secret-distributed aggregation result from secret-distributed information ([k ₁ ], [v ₁ ]), ..., ([k _M ], [v _M ]),
M is an integer greater than or equal to 2, N is an integer greater than or equal to 3, m, i, j are integers greater than or equal to 1 and less than or equal to M, [] is a symbol indicating information in which information in parentheses is secretly shared for each element, (+) Is a symbol indicating an operation for obtaining the aggregation result in which the unit element exists and the join rule and the commutative rule are established, and (0) is a symbol indicating the unit element of the operation (+),
M data _z 1, ..., a _{z M,} set as z _m = _v m, the information _{([k 1], [z} 1]), ..., ([k M], [z M]) An initialization step to generate
When the key k _i is equal to the key k _j (where i ≠ j), z _j = z _i (+) z _j , z _i = (0)
And if not equal, z _j = z _j , z _i = z _i
A join operation step for performing a join process with secret calculation on information having all equal keys;
A secure set function processing method comprising: The secure set function processing method according to claim 6,
Information _{([k 1], [v} 1]), ..., and _{([k M], [v} M]) information is sorted on the basis of the key _{k m,}
Wherein after binding operation step, M pieces of information _{([k m], [z} m]) were randomly replaced with the secure computing, and confirms _{z m} after random substitution or _{(0), z m = (} 0) in the case of the information _{([k m], [z} m]) has also delete step of deleting,
The join operation step includes
Perform the above-mentioned combining process for j = i + 1 while increasing the value in order from 1 to M−1, or set j = i−1 while decreasing the value in order from M to 2. A secure set function processing method, wherein the joining process is performed. The secure set function processing method according to claim 6,
T is the smallest integer greater than or equal to (log ₂ M) −1, t is an integer greater than or equal to 0 and less than or equal to T, ^ is a symbol indicating power, information ([k ₁ ], [v ₁ ]),... ([K _M ], and _[v M]) information is sorted based on the key _{k m,}
Wherein after binding operation step, M pieces of information _{([k m], [z} m]) were randomly replaced with the secure computing, and confirms _{z m} after random substitution or _{(0), z m = (} 0) in the case of the information _{([k m], [z} m]) has also delete step of deleting,
The join operation step includes
When i = 1, 2,..., M−2 ^ t, when k _i and k _{i + 2 ^ t} are equal, z _{i + 2 ^ t} ′ = z _i (+) z _{i + 2 ^ t}
And if not equal z _{i + 2 ^ t} '= z _{i + 2 ^ t}
A first combining sub-step,
i = 1, 2,..., M z _i = z _i ′
A second combining sub-step,
For i = 1, 2,..., M−1, when k _i and k _{i + 1} are equal, z _i = z _i
And then, when unequal z _i = (0)
A third combining sub-step,
, And for t = 0, 1, 2,..., T, the third coupling substep is performed after repeating the first coupling substep and the second coupling substep. Processing method. The secure set function processing method according to claim 7 or 8,
s The predetermined M an integer, K is the number of possible values of the key k _m,
A first pre-initialization substep with M ′ = M;
a second pre-initialization substep with t = 0, M ″ = M ′;
Substitute t + 1 for t,
Z _2i = z _2i-1 (+) z _2i , z _2i-1 = (0) when k _2i-1 and k _2i are equal for i from 1 to the maximum integer of M ″ / 2 or less
And if not equal, z _2i = z _2i , z _2i-1 = z _2i-1
A pre-join substep with
Odd-numbered information _{([k m '], [} z m']) that extracts the saved, remaining information new information _{([k m], [z} m]) and the new information _([k m], A storage sub-step with the number of [z _m ]) as the new M ″;
A second pre-repeating sub-step that repeats the pre-binding sub-step and the storage sub-step until M ″ is 2K or less;
The storage sub-step are all stored information _{([k m '], [} z m']) and the remaining information _{([k m], [z} m]) on which the combined and, random secure computing substituted, confirmed _{z m} after the random substitution or _(0), information in the case of z m = (0) is _{([k m], [z} m]) to remove the, the remaining information new information _{([k m], [z} m]) and the new information _{([k m], [z} m]) and pre-delete substep of the M 'number of,
A first pre-repetition that repeats the second pre-initialization sub-step, the pre-combination sub-step, the storage sub-step, the second pre-repetition sub-step, and the pre-deletion sub-step until M ′ becomes smaller than s. A preprocessing step with a return substep,
The M, the pre-processing step after the information _{([k m], [z} m]) to change the number of the pre-processing information after step _{([k m], [z} m]) with respect to A process of the initialization step is executed. A secure set function processing method, comprising: A secure set function program for causing a computer to function as each secret set function device of the secure set function system according to claim 1.

Images