JP2018025587A - Secret computation technique and method of the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a secret computation method that can make a plurality of user terminal devices having a different secret key decrypt an encrypted computation result in secret computation processing for conducting a computation in an encrypted state.SOLUTION: According to the present invention solving the problem, a system disclosure key is created from two secret keys separately administered by a user terminal device and a computation device. Then, the system disclosure key is used to encrypt each data. Thereafter, as to each data encrypted by the system disclosure key, secret computation processing is conducted in an encrypted state, and a result of the secret computation processing is re-encrypted by the secret key of the user terminal device. The re-encrypted result is transmitted to the user terminal device, and the user terminal device is configured to use the secret key administered by the user terminal device itself to decrypt the re-encrypted result.SELECTED DRAWING: Figure 4

Description

  The present invention relates to a secret operation method capable of performing a numerical operation in an encrypted state, and can register individual encrypted data from a plurality of registration devices to a server on the cloud, and the encrypted state on the server. The present invention relates to a secret calculation method in which a correct calculation can be performed as it is, and a plurality of user terminal devices can acquire and decrypt an encryption calculation result in the previous period.

  In a situation where confidential data (particularly numeric data) such as personal information and corporate information is managed by a server on the cloud, the data is encrypted in advance to prevent information leakage from the cloud server and at the same time use the information. There is known a cryptographic technique that can be stored in a cloud server after being converted, and can be operated in an encrypted state when using encrypted data stored in the cloud server.

  For example, public key cryptography-based secret computation technology is known that uses cryptographic functions that have homomorphic properties for addition and subtraction, and can perform addition, subtraction, multiplication, and division operations in the encrypted state. (Patent Document 1).

JP 2011-227193 A

  However, in the prior art, each data is encrypted with the public key of the device that obtains the operation result, and is processed in the state encrypted with the public key. At this time, since the calculation result is also encrypted with the public key, the encrypted calculation result can be decrypted only by a device that holds the secret key corresponding to the public key. In other words, in the prior art, if the public key is known, individual data can be encrypted from a plurality of devices, and the encrypted data can be operated in an encrypted state. The calculation result cannot be decoded. Of course, if the same decryption secret key is distributed to multiple devices in advance, the encryption operation result can be decrypted by multiple devices, but multiple devices holding different secret keys can encrypt There has been a problem that the operation result cannot be decoded.

  To explain the above issues more specifically, in order to manage confidential data (particularly numeric data) such as personal information and company information in an encrypted state on the cloud server, and to examine statistical values and the like from the encrypted data When each encrypted data is calculated on the cloud server and the calculation result is used, the device that can use the calculation result is only one device that holds the corresponding secret key, and can access the cloud server. There is a problem that the plurality of apparatuses cannot use the calculation result.

  In the present invention for solving the above problems, a system public key is generated from two secret keys managed separately by a user terminal device and a computing device. Each data is encrypted using the system public key. After that, each data encrypted with the system public key is subjected to a secret calculation process in an encrypted state, and the result is re-encrypted with the secret key of the user terminal device, and the encrypted data is the user terminal device. Send to. The user terminal device decrypts it using a secret key managed by itself.

  According to the present invention, a secret operation method capable of performing numerical operations in an encrypted state allows a plurality of user terminal devices to acquire and decrypt only requested operation results in an encrypted state.

It is a figure which shows the system configuration example of this embodiment. It is a figure which shows the hardware structural example of the totaling device in this embodiment, a reception apparatus, a registration apparatus, and a user terminal device. It is a figure which shows the whole image of the process in this embodiment. It is a sequence diagram which shows the confidential calculation process procedure in this embodiment. It is a flowchart which shows advance preparation processes, such as key generation in this embodiment. It is a flowchart which shows the encryption process of the data in this embodiment. It is a flowchart which shows the arithmetic processing in the encryption state in this embodiment. It is a flowchart which shows the decoding process of the encryption calculation result in this embodiment.

--- System configuration ---
Embodiments of the present invention will be described below in detail with reference to the drawings.

  FIG. 1 is a diagram illustrating an example of the overall configuration of a secret calculation system 1 in the present embodiment. In this figure, an example of a functional configuration of each computer constituting the secret calculation system 1 is also shown along with the overall configuration. The secret calculation system 1 shown in FIG. 1 encrypts encrypted data registered in the totaling device 10 from each registration device 30 in the totaling device 10 in accordance with a request from the user terminal device 40 via the receiving device 20. Addition / subtraction calculation processing is performed as it is, and the calculation result is returned to the user terminal device 40 in an encrypted state, and the user terminal device 40 decrypts the encrypted calculation result and acquires the calculation result. System.

  The concealment system 1 according to the present embodiment is a computer in which a counting device 10, a receiving device 20, a registration device 30, and a user terminal device 40 are communicably connected via an appropriate network 50 such as the Internet. It is a network system. There are a plurality of registration devices 30 and user terminal devices 40.

  As illustrated in FIG. 1, the aggregation device 10 includes an information generation unit 101, an encryption processing unit 102, a data transmission / reception unit 103, an information input unit 104, an information output unit 105, a primary storage unit 106, a data storage unit 107, and a key storage unit. 108.

Among them, the information generation unit 101 generates information such as a secret key of the aggregation device 10 and a system public key of the secret calculation system 1. For example, the information generation unit 101 receives a signal input from the information input unit 104 or a data transmission / reception unit 103. Information is generated based on the obtained data. Also, the encryption processing unit 102 performs operations on encrypted data received mainly from the registration device 30 in an encrypted state. The key storage unit 108 manages the secret key generated by the information generation unit 101 safely. The primary storage unit 106 is a primary storage area using a semiconductor.
The data storage unit 107 manages the encrypted data received from the registration device 30 in an encrypted state. The data transmitting / receiving unit 103 transmits / receives encrypted data. The information input unit 104 receives a signal corresponding to input of information generated by the information generation unit 101. Further, the information output unit 105 displays a signal input by the information input unit 104 or the like.

  The tabulation apparatus 10 having such a function can be realized by a general information processing apparatus 60 as illustrated in FIG. For example, the information generation unit 101, the encryption processing unit 102, the data transmission / reception unit 103, the information input unit 104, and the information output unit 105 can be implemented as a computer program executed by a CPU 605 such as a CPU (CENTRAL PROCESSING UNIT). Such a computer program can be stored in advance in a storage device 604 such as a hard disk, or can be distributed from the network 50 and used. Further, the data storage unit 107 and the key storage unit 108 can also be realized as the above-described storage device 604. Note that the key storage unit 108 may be realized by using a secure module device called HSM (Hardware Security Module).

  The primary storage unit 106 can be realized by the memory 603. The information output unit 105 can be realized as an input / output device 601 such as a liquid crystal display device or an organic EL (ELECTRO LUMINESENCE) display. Further, the information input unit 104 can be realized as an input / output device 601 such as a keyboard or a mouse that receives an instruction and input from a user.

  In addition, the aggregation device 10 includes a communication device 602 that communicates with other devices via the network 50, and is configured on the information processing device 60 connected by an internal communication line (hereinafter referred to as a bus) 606 such as a bus. Can do.

  As shown in FIG. 1, the accepting device 20 includes an information generation unit 201, an encryption processing unit 202, a data transmission / reception unit 203, an information input unit 204, an information output unit 205, a primary storage unit 206, a data storage unit 207, a key The storage unit 208 can be configured.

  Among these, the information generation unit 201 generates information such as a secret key and a public key of the reception device 20 and information such as an access right to the user terminal device 40. For example, a signal input from the information input unit 204 Information is generated based on data received by the data transmission / reception unit 203. The encryption processing unit 202 mainly processes the encryption operation result received from the totalization device 10. The key storage unit 208 manages the secret key generated by the information generation unit 201 safely. The primary storage unit 206 is a primary storage area using a semiconductor. The data storage unit 207 manages information such as access rights to the user terminal device 40. The data transmission / reception unit 203 transmits / receives encrypted data. The information input unit 204 receives a signal corresponding to input of information generated by the information generation unit 201. The information output unit 205 displays a signal input by the information input unit 204 or the like.

  The reception device 20 having such a function can be realized by a general information processing device 60 as illustrated in FIG. For example, the information generation unit 201, the encryption processing unit 202, the data transmission / reception unit 203, the information input unit 204, and the information output unit 205 can be realized as a computer program executed by a CPU 605 such as a CPU (CENTRAL PROCESSING UNIT). Such a computer program can be stored in advance in a storage device 604 such as a hard disk, or can be distributed from the network 50 and used. Further, the data storage unit 207 and the key storage unit 208 can also be realized as the storage device 604 described above. Note that the key storage unit 208 may be realized using a secure module device called HSM (Hardware Security Module).

  Further, the primary storage unit 206 can be realized by the memory 603. Further, the information output unit 205 can be realized as an input / output device 601 such as a liquid crystal display device or an organic EL (ELECTRO LUMINESENCE) display. Further, the information input unit 204 can be realized as an input / output device 601 such as a keyboard and a mouse that receives instructions and inputs from the user.

  In addition, the receiving device 20 includes a communication device 602 that communicates with another device via the network 50 and is configured on the information processing device 60 connected by an internal communication line (hereinafter referred to as a bus) 606 such as a bus. Can do.

  As illustrated in FIG. 1, the registration device 30 includes an information generation unit 301, an encryption processing unit 302, a data transmission / reception unit 303, an information input unit 304, an information output unit 305, a primary storage unit 306, and a data storage unit 307. Can do.

  Among them, the information generation unit 301 generates information such as numerical data to be registered in the totaling device 10. For example, the information generation unit 301 generates information based on a signal input from the information input unit 304 or data received by the data transmission / reception unit 303. Is to be generated. The encryption processing unit 302 performs encryption processing of the numerical data. The primary storage unit 306 is a primary storage area using a semiconductor. The data storage unit 307 manages numerical data to be registered in the totaling device 10 and the system public key of the secret calculation system 1. Further, the data transmission / reception unit 303 receives the system public key of the secret computation system 1 from the aggregation device 10 or transmits encrypted data to the aggregation device 10. The information input unit 304 receives a signal corresponding to input of information generated by the information generation unit 301. The information output unit 305 displays the signal input by the information input unit 304.

  The registration apparatus 30 having such a function can be realized by a general information processing apparatus 60 as illustrated in FIG. For example, the information generation unit 301, the encryption processing unit 302, the data transmission / reception unit 303, the information input unit 304, and the information output unit 305 can be realized as a computer program executed by a CPU 605 such as a CPU (CENTRAL PROCESSING UNIT). Such a computer program can be stored in advance in a storage device 604 such as a hard disk, or can be distributed from the network 50 and used. The data storage unit 307 can also be realized as the storage device 604 described above. The primary storage unit 306 can be realized by the memory 603. The information output unit 305 can be realized as an input / output device 601 such as a liquid crystal display device or an organic EL (ELECTRO LUMINESENCE) display. Further, the information input unit 304 can be realized as an input / output device 601 such as a keyboard and a mouse that receives instructions and inputs from the user.

  In addition, the registration device 30 includes a communication device 602 that communicates with other devices via the network 50 and is configured on the information processing device 60 connected by an internal communication line (hereinafter referred to as a bus) 606 such as a bus. Can do.

  As shown in FIG. 1, the user terminal device 40 includes an information generation unit 401, an encryption processing unit 402, a data transmission / reception unit 403, an information input unit 404, an information output unit 405, a primary storage unit 406, and a data storage unit 407. The key storage unit 408 can be configured.

  Among these, the information generation unit 401 generates information such as a secret key and a public key of the user terminal device 40 and information such as a secret calculation request sent to the aggregation device 10 via the reception device 20. Information is generated based on a signal input from the input unit 404. The encryption processing unit 402 mainly performs decryption processing of the encryption operation result received from the counting device 10 via the receiving device 20. The key storage unit 408 manages the secret key generated by the information generation unit 401 safely. The primary storage unit 406 is a primary storage area using a semiconductor. The data storage unit 407 manages information such as the decoded calculation result. Further, the data transmission / reception unit 403 transmits a confidential calculation request to the aggregation device 10 via the reception device 20 or receives an encryption calculation result from the aggregation device 10 via the reception device 20. The information input unit 404 receives a signal corresponding to an input of information generated by the information generation unit 401. The information output unit 405 displays a signal input by the information input unit 404 or the like.

  The user terminal device 40 having such a function can be realized by a general information processing device 60 as illustrated in FIG. For example, the information generation unit 401, the encryption processing unit 402, the data transmission / reception unit 403, the information input unit 404, and the information output unit 405 can be realized as a computer program executed by a CPU 605 such as a CPU (CENTRAL PROCESSING UNIT). Such a computer program can be stored in advance in a storage device 604 such as a hard disk, or can be distributed from the network 50 and used. Further, the data storage unit 407 and the key storage unit 408 can also be realized as the storage device 604 described above. Note that the key storage unit 408 may be realized using a secure module device called HSM (Hardware Security Module).

  The primary storage unit 406 can be realized by the memory 603. The information output unit 405 can be realized as an input / output device 601 such as a liquid crystal display device or an organic EL (ELECTRO LUMINESENCE) display. Further, the information input unit 404 can be realized as an input / output device 601 such as a keyboard and a mouse that receives instructions and inputs from the user.

  In addition, the user terminal device 40 includes a communication device 602 that communicates with another device via the network 50, and is configured on the information processing device 60 connected by an internal communication line (hereinafter referred to as a bus) 606 such as a bus. can do.

--- Processing procedure example ---
Hereinafter, the procedure in the present embodiment will be described with reference to the drawings. Various operations corresponding to the secret calculation processing described below are executed by each device constituting the secret calculation system 1, that is, the totaling device 10, the receiving device 20, the registration device 30, and the user terminal device 40, which are read into a memory or the like. Realized by a program that

FIG. 3 is a diagram showing an overall image of processing in the present embodiment. In FIG. 3, there are a plurality of registration devices 30 and user terminal devices 40. Here, the message m _jk is an integer value. For example, the registration device 30 _k (k = 1, 2,..., M) stores the medical expenses and care expenses paid by the individual or the personal income amount in the cloud. The user terminal device 40 _i (i = 1, 2,..., N) is registered in the cloud as a reception device on the cloud. 20 performs a concealment calculation request so as to calculate a value obtained by subtracting the amount of income from the medical expenses and nursing care expenses paid by the individual (here, ID ₁ ). An operation is performed, and the encrypted operation result is transmitted to the requesting user terminal device 40 _i via the accepting device 20, and the user terminal device 40 _i decrypts the encrypted operation result and obtains the operation result. .

At this time, the user terminal device 40 _i does not know the individual payment amount or income amount of the individual, but can obtain only the calculation result obtained by subtracting the income amount from the medical expenses and the care expenses. In addition, the risk of unnecessary information leakage can be reduced by concealing not only the individual values but also the calculation results in the counting device 10 and the receiving device 20.

  This mechanism can be expected to be applied to, for example, a high-cost medical treatment / high-care long-term care expense system that exempts the payment of medical expenses or nursing care expenses when the calculation result exceeds a certain upper limit. In addition, it can be expected to be applied to a system in which individual values are kept secret and only the total value is provided to a plurality of users who have the authority to decrypt, such as counting of voting results in an electronic election system and counting in a questionnaire system. .

  FIG. 4 is a sequence diagram showing a secret calculation processing procedure in the present embodiment.

  In this embodiment, it is roughly divided into two phases, one is a preliminary preparation phase (steps S001 to S002, S101 to S103, S201 to S202), and the other is a secret calculation processing phase (steps S301 to S307). It is.

  First, the advance preparation phase will be described. The advance preparation phase is further divided into a system public key generation process (steps S001 to S002), an encrypted data registration process (steps S101 to S103), and a user terminal device initial registration process (steps S201 to S202).

  In the system public key generation process, the reception device 20 generates a key pair (public key and secret key) of the reception device 20, and transmits the public key of the reception device 20 to the aggregation device 10 (step S001). The aggregation device 10 generates a secret key of the aggregation device 10, and receives the public key of the receiving device 20 and the secret key of the aggregation device 10 to generate a system public key of the secret calculation system 1. Then, the system public key is transmitted to all the registration devices 30 (step S002).

  In the encrypted data registration process, the registration device 30 encrypts each data (integer value) with the system public key (step S101), and registers the encrypted data in the counting device 10 (step S102). The aggregation device 10 stores the encrypted data in the data storage unit 107 (step S103). This encrypted data registration process is performed at any time according to the necessity of data registration.

  In the user terminal device initial registration process, each user terminal device 40 generates a key pair (public key and secret key) in public key cryptography such as RSA cryptography that is widely used in general (step S201). The public key of the user terminal device 40 is sent to the receiving device 20. Further, the secret key generated in step S201 is stored in the key storage unit 408 of the user terminal device 40. The receiving device 20 that has received the public key of the user terminal device 40 stores the public key of the user terminal device 40 in the data storage unit 207 (step S202).

  Next, the secret computation processing phase will be described.

  The user terminal device 40 makes a secret calculation request to the accepting device 20 (step S301). The accepting device 20 relays the confidential calculation request to the counting device 10 (step S302). The aggregation device 10 selects the corresponding encrypted data from the encrypted data stored in step S103 based on the confidential calculation request, and performs the calculation process in the encrypted state (step S303). Then, the encryption calculation result is transmitted to the accepting device 20. The accepting device 20 performs a partial decryption process on the result of the encryption operation using the private key of the accepting device 20 (step S304), and transmits the processed data 1 to the counting device 10. The aggregation device 10 performs a partial decryption process on the processing data 1 with the secret key of the aggregation device 10 (step S305), and transmits the processing data 2 to the reception device 20 as processing data 2. The accepting device 20 performs a partial decryption process on the processing data 2 with the private key of the accepting device 20 (step S306), and transmits the processed data 3 to the user terminal device 40. The user terminal device 40 decrypts the processing data 3 with the secret key of the user terminal device 40 and acquires the requested calculation result. Steps S304 to S307 are processes in which each device performs decryption via communication using the secret key of the totaling device 10, the secret key of the accepting device 20, and the secret key of the user terminal 40. Will be described later with reference to the flowchart of FIG.

  5 to 8 are flowcharts for explaining details of each process in the present embodiment.

  FIG. 5 is a flowchart of the system public key generation process (steps S001 to S002) in the advance preparation phase.

  FIG. 6 is a flowchart of encrypted data registration processing (steps S101 to S103) in the advance preparation phase.

  FIG. 7 is a flowchart from the confidential calculation processing phase (step S301) to the confidential calculation processing (step S303).

  FIG. 8 is a flowchart up to the decryption process (steps S304 to S307) in the confidential calculation process phase.

  In the user terminal device initial registration process, the user terminal device 40 generates a key pair (public key and secret key) in public key cryptography such as RSA cryptography which is widely used in general, and the user terminal device This is a process of registering the public key of the device 40 in the accepting device 20, and in particular, the description using the flowchart is omitted.

  First, the system public key generation processing (steps S001 to S002) flow in the preparation phase will be described with reference to FIG.

  The accepting device 20 selects large prime numbers p and q (flow F001). At this time, p ′ = (p−1) / 2 and q ′ = (q−1) / 2 are also selected to be prime numbers.

  Next, the accepting device 20 calculates n = p · q (flow F002). Here, the operator “·” means multiplication.

Next, the accepting device 20 arbitrarily selects a random number kεZ _n (flow F003) and calculates g = 1 + k · n mod n ² (flow F004).

  Then, the reception device 20 stores the prime numbers p and q selected in the flow F001 in the key storage unit 208 as a secret key of the reception device 20 (flow F005).

  In addition, the reception device 20 transmits n and g calculated in the flow F002 and the flow F004 to the aggregation device 10 as the public key of the reception device 20 (flow F006).

Upon receiving the public key (n, g) of the accepting apparatus 20 (flow F007), the aggregating apparatus 10 arbitrarily selects aεZ _n (flow F008) and obtains a ′ where a ′ · a = 1 mod n. Normally, a ′ can be obtained by performing a calculation called the Euclidean mutual division method (flow F009).

The collection apparatus 10 ^calculates the G = g a mod ^{n 2} (Flow F010).

Further, totaling device 10 chooses the U∈Z _N arbitrarily. For convenience, describe the ^{n 2} and N here (Flow F011).

  The aggregation device 10 stores the a ′ obtained in the flow F009 and u selected in the flow F011 in the key storage unit 108 as the secret key of the aggregation device 10 (flow F012).

  Further, the counting device 10 selects the parameter b from natural numbers smaller than n / 2 (flow F013). The parameter b is the maximum number of terms to be calculated. That is, in this embodiment, up to b additions or subtractions can be performed.

  Then, the aggregation device 10 transmits n received from the reception device 20 in the flow F007 and G calculated in the flow F010 to each registration device 30 as the system public key of the secret calculation system 1. Further, b selected in the flow F013 is also transmitted to each registration device 30 as a public parameter of the secret calculation system 1 (flow F014).

  Next, the flow of encrypted data registration processing (steps S101 to S103) in the preparation phase will be described with reference to FIG.

The registration device 30 selects mεZ _{((n / 2b) −1)} as the data to be encrypted (integer value) (flow F101).

Next, the registration device 30 arbitrarily selects a random number rεZ _n (flow F102), and the secret computation system sent from the counting device 10 to the registration device 30 in flow F014 for the data m selected in flow F101. Encrypted data c = G ^m · r _n mod n ² is calculated using the system public key (n, G) of 1 and the random number r selected in flow F102 (flow F103).

Then, the registration device 30 provides attribute information (for example, information indicating that the data is “medical expenses” of “ID ₁ ” (see table 109 in FIG. 3)) indicating what the encrypted data c is. In addition, the encrypted data c is transmitted to the collection device 10 (flow F104).

The counting device 10 that has received the encrypted data c (flow F105) extracts the secret key u stored in the key storage unit 108 in flow F012, converts the encrypted data c into c = c + u mod n ² In accordance with the attribute information (for example, information indicating that the data is “medical expenses” of “ID ₁ ” (see table 109 in FIG. 3)), the converted c is registered in the data storage unit 107 of the tabulation device 10 ( Flow F106).

  Next, the flow of the secret calculation processing (step S303) from the secret calculation request (step S301) in the secret calculation processing phase will be described with reference to FIG.

The user terminal device 40 designates a calculation range (for example, information indicating that the user wants to know the sum of “medical expenses” and “care expenses” of “ID ₁ ” (see FIG. 3, table 109)) A secret calculation request is transmitted to the apparatus 20 (flow F201).

  The accepting device 20 that has received the confidential calculation request from the user terminal device 40 (flow F202) determines whether the user terminal device 40 is initially registered in the user terminal device initial registration process (step S202). It is confirmed whether the access is from an apparatus that can use the system 1 (flow F203). If it is an access from an unauthorized device, the confidential calculation request is rejected. If the access is from a legitimate device, the public key of the user terminal device 40 stored in the data storage unit 207 is extracted in step S202, and the public key of the user terminal device 40 is received in flow F202. It transmits to the totalization apparatus 10 with a secret calculation request (flow F204).

The aggregation device 10 that has received the confidential calculation request from the accepting device 20 (flow F205) acquires the corresponding encrypted data from the data storage unit 107 based on the calculation range specified in the flow F201 (flow F206). Here, “encrypted data for medical expenses with ID ₁ ” is assumed to be “c ₁ ”, and “encrypted data with respect to nursing expenses for ID ₁ ” is assumed to be “c ₂ ”.

The tally device 10 that has acquired the corresponding encrypted data extracts the secret key u of the tally device 10 from the key storage unit 108, and c ₁ and c ₂ are c ₁ = c ₁ −u mod n ² and c ₂ =, respectively. Replace with c ₂ -u mod n ² (flow F207).

Here, the aggregation device 10 determines whether the requested operation is a sum or a difference (flow F208), and if it is a sum, c ′ = (c ₁ · c ₂ ) mod n ² is calculated ( If flow F209 ₁ ) or difference, c ′ = (c ₁ / c ₂ ) mod n ² is calculated (flow F209 ₂ ).

The c 'totaling device 10 calculating the can optionally select s∈Z _n, s' seek · s = 1 mod n becomes s', stored in the primary storage instrumentation unit 106 or data storage instrumentation unit 107 (Flow F210).

Further, the aggregation device 10 arbitrarily selects vεZ _n and obtains v ′ where v ′ · v = 1 mod n (flow F211). Then, the aggregation device 10 encrypts v ′ with the public key of the corresponding user terminal 40 sent from the reception device 20 in the flow F204 (flow F212).

Further, the tally device 10 calculates an encryption operation result C = (c ′) ^{s · v} mod n ² from c ′ calculated in the flow F209 and s and v selected in the flow F210 and the flow F211, and the flow F212. And v ′ encrypted in the above-described manner, is transmitted to the accepting device 20 (flow F213).

  Finally, the flow of the decryption process (steps S304 to S307) in the confidential calculation process phase will be described with reference to FIG.

The accepting device 20 that has received the encryption operation result C and v ′ encrypted with the public key of the corresponding user terminal 40 receives M = L ((C ^λ mod n ² ) / L (g ^λ mod n ² )). Mod n is calculated. Here, L (x) = (x−1) / n and λ = 1 cm (p−1, q−1) (flow F301).

Further, the accepting device 20 arbitrarily selects tεZ _n , obtains t ′ where t ′ · t = 1 mod n, and stores it in the primary storage unit 206 or the data storage unit 207 (flow F302). .

  The accepting device 20 calculates C ′ = M · t mod n using M calculated in the flow F301 and t selected in the flow F302, and transmits C ′ as processing data 1 to the counting device 10 (flow). F303).

  The counting device 10 that has received C ′ (flow F304), a ′ stored in the key storage unit 108 in flow F012, and s ′ stored in the primary storage unit 106 or the data storage unit 107 in flow F210. Then, C ″ = a ′ · s ′ · C ′ mod n is calculated (flow F304). Then, the aggregation device 10 transmits C ″ as processing data 2 to the reception device 20 (flow F306).

  The receiving apparatus 20 that has received C ″ (flow F307) extracts t ′ stored in the primary storage unit 206 or the data storage unit 207 in flow F302, and C ′ ″ = t ′ as processing data 3 Calculate C ″ mod n (flow F308).

  Then, the accepting device 20 performs a secret operation on v ′ encrypted with the public key of the corresponding user terminal 40 sent from the counting device 10 in the flow F213 and C ′ ″ (processing data 3) calculated in the flow F304. The request is transmitted to the user terminal 40 that is the request source (flow F309).

  The user terminal 40 that has received v ′ encrypted with the public key of the user terminal 40 and C ′ ″ that is the processing data 3 (flow F310), first of the user terminal device 40 generated in step S201. The private key is extracted from the key storage unit 408, and v 'encrypted with the public key of the user terminal 40 is decrypted to obtain v' (flow F311).

  Then, the user terminal device 40 calculates m ′ = v ′ · C ′ ″ mod n from C ′ ″ received in the flow F310 and v ′ decoded in the flow F311 (flow F312).

If m ′ <n / 2, then m ′ = m ′ (flow F314 ₁ ), and if m ′ ≧ n / 2, m ′ = m′−n (flow F314 ₂ ).

  Then, the user terminal device 40 acquires m ′ as the calculation result that requested it (flow F315).

It can be seen from the following that m ′ is the calculated result.
The encrypted data _{c 1} and _{c 2,}
c ₁ = G ^m1 · r ₁ ⁿ = g ^{a · m1} · r ₁ ⁿ mod n ² ,
When c ₂ = G ^m2 · r ₂ ⁿ = g ^{a · m2} · r ₂ ⁿ mod n ² ,
c ′ = c ₁ · c ₂ = g ^{a · (m1 + m2)} · (r ₁ · r ₂ ) ⁿ mod n ²
C = (c ′) ^{s · v} = ga ^{· (m1 + m2) · s · v} · (r ₁ · r ₂ ) ^{n · s · v} mod n ²
Then, the calculation of L ((C ^λ mod n ² ) / L (g ^λ mod n ² )) mod n outputs the value of the exponent part of g.
M = a · (m1 + m2) · s · v mod n
C ′ = a · (m1 + m2) · s · v · t mod n.
And C ″ = (a ′ · s ′) · C ′ = (m1 + m2) · v · t mod n,
C ′ ″ = t ′ · C ″ = (m1 + m2) · v mod n.
And
m ′ = v ′ · C ′ ″ = (m1 + m2) mod n.

Since m1 and m2εZ _{((n / 2b) −1)} , m1 + m2 <n / 2,
m ′ is found m ′ = m1 + m2.

  With the configuration described above, in this embodiment, each data encrypted using a system public key generated from two secret keys can be operated in an encrypted state on a server on the cloud. It is.

  Further, by managing the two secret keys by different devices, it is possible to keep the confidentiality of each data and calculation result from the server as long as there is no collusion of each device.

  In addition, by further encrypting a part of the operation result calculated in the encrypted state (partial information generated when performing the operation) with the public key of the user terminal device that uses the operation result, the corresponding user Only the terminal device can decrypt the encryption operation result. In other words, the same decryption secret key is distributed in advance by encrypting a part of the calculation result (partial information generated when the calculation is performed) with the public key of the destination user terminal. Thus, the calculation result can be safely provided to a plurality of user terminal devices.

  In order to decrypt the encrypted calculation result, two secret keys corresponding to the system public key in which each data is encrypted and the secret key of the user terminal device using the calculation result are necessary. By processing through the communication between the devices, the encrypted user result is processed so that the corresponding user terminal can decrypt it, so that the corresponding user terminal device can decrypt the encrypted operation result. .

DESCRIPTION OF SYMBOLS 1 Secret operation system 10 Counting apparatus 20 Reception apparatus 30 Registration apparatus 40 User terminal device 50 Network 101 Information generation part 102 Encryption processing part 103 Data transmission / reception part 104 Information input part 105 Information output part 106 Primary storage part 107 Data storage part 108 Key Storage unit 109 Table 201 Information generation unit 202 Encryption processing unit 203 Data transmission / reception unit 204 Information input unit 205 Information output unit 206 Primary storage unit 207 Data storage unit 208 Key storage unit 301 Information generation unit 302 Encryption processing unit 303 Data transmission / reception unit 304 Information Input unit 305 Information output unit 306 Primary storage unit 307 Data storage unit 401 Information generation unit 402 Encryption processing unit 403 Data transmission / reception unit 404 Information input unit 405 Information output unit 406 Primary storage unit 407 Data storage unit 408 Key storage unit 601 Input / output device 602 Communication device 603 Memory 604 Storage device 605 CPU

Claims (7)

A secret calculation method for calculating data with encryption,
A system public key generation step of generating a system public key from two secret keys provided in the user terminal device and the computing device;
An encryption step of encrypting the data with the system public key;
A calculation step for performing a secret calculation process on the encrypted data;
A re-encryption step of re-encrypting the operation result of the operation step with a secret key provided in the user terminal device;
A sending step of sending the re-encrypted data to the user terminal device;
Decrypting the re-encrypted data with a secret key provided in the user terminal device; and
A secret calculation method comprising: The secret calculation method according to claim 1,
In the re-encryption step, a part of the calculation result is encrypted with another public key. The secret calculation method according to claim 2,
In the decryption step, the two secret keys used for generating the system public key and a secret key corresponding to a public key obtained by further encrypting a part of the calculation result are obtained as the user terminal device and the calculation device. A secret calculation method, wherein decryption processing is performed via communication between the two. An arithmetic device that operates while encrypting data,
A storage unit for storing data encrypted by a system public key generated from two private keys;
For the data, a calculation unit that performs a secret calculation process;
An encryption processing unit for re-encrypting a calculation result by the calculation unit with a secret key included in the user terminal device;
A transmission unit for sending the re-encrypted data to the user terminal device;
An arithmetic device comprising: The arithmetic unit according to claim 4,
The arithmetic device characterized in that the two secret keys are secret keys included in the user terminal device and the arithmetic device. The arithmetic unit according to claim 5,
The cryptographic processing unit encrypts a part of the calculation result with another public key.   A secret computation system comprising: the computation device according to claim 5; and the user terminal device.

Images