JP2018124513A - Classification device, classification method, and classification program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a classification device, a classification method, and a classification program for a plurality of principals to cluster secret data without sharing the data with other principals.SOLUTION: A server S includes: a first reception part 11 receiving a plurality of data encrypted by a public key by a fully homomorphic encryption method from a plurality of terminals P; an operation part 12 which performs arithmetic to obtain a magnitude relation between Euclidean distance and a prescribed distance among data in an encrypted state; a first transmission part 13 transmitting a result of arithmetic to a plurality of parties; a second reception part 14 which receives a determination value of the magnitude relation obtained by a value decoding a result of arithmetic by multi-party calculation using a secret key of each of the parties; a clustering part 15 generating a cluster that classifies a plurality of data on the basis of the determination value; and a second transmission part 16 encrypting information of the cluster by the public key and transmitting it to the plurality of parties.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a classification device, a classification method, and a classification program for classifying confidential data.

Conventionally, a clustering technique called DBSCAN (Density-Based Spatial Clustering of Applications with Noise) has been used.
Users who own personal or confidential information may want to use DBSCAN to extract meaningful information from an integrated data set without revealing the data of one party to the other party. Non-Patent Documents 1 and 2 propose a distributed DBSCAN protocol for protecting privacy and clustering data of two parties.
Further, Non-Patent Document 3 proposes a calculation method using homomorphic encryption of secret data of a plurality of parties.

J. et al. Liu, L. Xiong, J. et al. Luo, and J.M. Z. Huang, “Privacy preserving distributed DBSCAN clustering,” Trans. Data Privacy, vol. 6, no. 1, pp. 69-85, 2013. K. A. Kumar and C.K. P. Rangan, “Privacy preserving dbscan algorithm for clustering,” in International Conference on Advanced Data Mining and Applications. Springer, 2007, pp. 57-68. A. Lopez-Alt, E.E. Tromer, and V.M. Vaikuntanathan, “Cloud-assisted multiparty completion full homology encryption.” IACR Cryptology ePrint Archive, vol. 2011.

  However, the conventional DBSCAN protocol cannot efficiently handle three or more parties.

  An object of the present invention is to provide a classification device, a classification method, and a classification program for clustering a plurality of parties without sharing confidential data with other parties.

  The classification device according to the present invention includes a first receiving unit that receives a plurality of data encrypted with a public key from a plurality of parties using a completely homomorphic encryption method, and a Euclidean distance between the data and a predetermined distance. A calculation unit that performs an operation for obtaining the magnitude relationship in an encrypted state, a first transmission unit that transmits a result of the calculation to the plurality of parties, and a secret key of each party using the calculation result. A second receiving unit that receives the determination value of the magnitude relationship obtained by a value decoded by multi-party calculation; a clustering unit that generates a cluster in which the plurality of data is classified based on the determination value; and the cluster And a second transmission unit that encrypts the information with the public key and transmits the information to the plurality of parties.

  The calculation unit calculates encryption data of a difference value between the square of the Euclidean distance and the square of the predetermined distance, and the second reception unit determines the magnitude relationship based on the difference value May be received.

  The classification method according to the present invention includes a first reception step of receiving a plurality of data encrypted with a public key from a plurality of parties using a completely homomorphic encryption method, and a Euclidean distance between the data and a predetermined distance. A calculation step for performing the calculation for obtaining the magnitude relationship in an encrypted state, a first transmission step for transmitting the result of the calculation to the plurality of parties, and using the secret key of each party for the result of the calculation A second receiving step for receiving a determination value of the magnitude relation obtained by a value decoded by multi-party calculation; a clustering step for generating a cluster in which the plurality of data are classified based on the determination value; and the cluster The computer executes a second transmission step of encrypting the information with the public key and transmitting the information to the plurality of parties.

  The classification program according to the present invention includes a first reception step of receiving a plurality of data encrypted with a public key from a plurality of parties using a completely homomorphic encryption method, and a Euclidean distance between the data and a predetermined distance. A calculation step for performing the calculation for obtaining the magnitude relationship in an encrypted state, a first transmission step for transmitting the result of the calculation to the plurality of parties, and using the secret key of each party for the result of the calculation A second receiving step for receiving a determination value of the magnitude relation obtained by a value decoded by multi-party calculation; a clustering step for generating a cluster in which the plurality of data are classified based on the determination value; and the cluster And a second transmission step of encrypting the information with the public key and transmitting the information to the plurality of parties.

  According to the present invention, a plurality of parties can perform clustering without sharing confidential data with other parties.

It is a figure showing the composition of the classification system concerning an embodiment. It is a figure which shows the function structure of the server which concerns on embodiment. It is a flowchart which shows the classification method which concerns on embodiment.

Hereinafter, an example of an embodiment of the present invention will be described.
FIG. 1 is a diagram showing a configuration of a classification system 100 according to the present embodiment.
The classification system 100 includes terminals P _i (1 ≦ i ≦ N) of a plurality of (N) parties that hold confidential data and a server S as a classification device, and are connected to each other via a network.

The terminal P _i can perform data encryption and decryption by cooperating with a multiparty calculation (multi-party calculation) described later. The terminal P _i acquires the clustering calculation result without revealing the data sets held by each of the terminals P _i to each other and also to the third party server S.
The server S receives the secret data by the homomorphic encryption from the terminal P _i and performs a clustering operation by the DBSCAN described later.

First, elemental technologies used in the classification system 100 will be described.
[Multipartity Computation (MPC)]
In the MPC protocol, each user's public key pk ₁ ,..., _{Pk N} to combined public key pk and each user's private key sk ₁ ,. _A combined secret key sk is generated from _N. Each user can encrypt their own possessed data with the combined public key pk. In this protocol, encrypted data is decrypted by using secret keys sk _i (1 ≦ i ≦ t) of t (<N) users.

[Homomorphic encryption]
The completely homomorphic encryption method has the following two characteristics for the elements m ₁ and m ₂ in the message space M.
decrypt (encrypt (m ₁ ) + encrypt (m ₂ )) = m ₁ + m ₂
decrypt (encrypt (m ₁ ) × encrypt (m ₂ )) = m ₁ × m ₂
The operations “+” and “×” are addition and multiplication for each element.

[DBSCAN]
Definition 1: Density-reachable
If a certain radius (ε) from an object (data point) p _i includes a minimum number of data points MinPts or more, the data point p _{i + 1} within the radius ε can reach the density directly from the data point p _i .
If there is a finite sequence of data points p ₁ ,..., _{Pn that} can reach the density directly, the data point p can reach the density from the data point q, _assuming that p ₁ = q, _pn = q.

Definition 2: Density-connected
If there is a data point o such that both the data point p and the data point q are reachable from the data point o, the data point p and the data point q are in a density-connected relationship.

Definition 3: Cluster D is a set of data points. Cluster C is a non-empty subset of D that satisfies the following conditions:
Cluster C is a maximal set of data points that can reach the density with respect to all data points included in all data sets D (maximum).
All data points in cluster C are related to each other in density connection (connectivity).

Definition 4: Noise Noise is a set of data points in set D that does not belong to cluster C.

  Here, when there is a data point equal to or larger than MinPts within a radius ε from a certain data point p, this data point p is called a core point. The core point is inside the cluster. The boundary point is in the vicinity of the core point, but there are fewer data points within the radius ε than MinPts. A noise point is any point that is not a core point or boundary point.

Next, a clustering method by the classification system 100 will be described.
FIG. 2 is a diagram illustrating a functional configuration of the server S according to the present embodiment.
The server S includes a first reception unit 11, a calculation unit 12, a first transmission unit 13, a second reception unit 14, a clustering unit 15, and a second transmission unit 16.

The first receiving unit 11 receives a plurality of data encrypted with a public key from a plurality of party terminals P _i by a completely homomorphic encryption method.

  The computing unit 12 performs computation for obtaining a magnitude relationship between the Euclidean distance dist between the data and a predetermined distance (the aforementioned radius ε) in an encrypted state. Specifically, the calculation unit 12 calculates encrypted data of a difference value between the square of dist and the square of ε.

The first transmission unit 13 transmits the result of the operation by the arithmetic unit 12 to the terminal P _i of the plurality of parties.
The terminal P _{i that} has received the operation result decrypts the operation result by MPC using the secret key of each party, and determines the magnitude relationship between dist and ε from the difference value that is the decryption result.

Second receiver 14 from the terminal _{P i,} receives the decision value of the magnitude relationship between the dist and epsilon.
For example, the second receiving unit 14 receives “1” when dist ≦ ε and “0” when dist> ε.

  The clustering unit 15 generates a cluster in which a plurality of data is classified by DBSCAN based on the determination value received by the second receiving unit 14.

The second transmission unit 16 encrypts the cluster information with the public key and transmits the encrypted information to the terminals P _i of a plurality of parties.
The terminal P _i decodes the received data by MPC and acquires the clustering result.

FIG. 3 is a flowchart showing the classification method according to this embodiment.
In step S1, the terminal P _{i of} each party encrypts the data x _i (c _i = Enc _pk (x _i )) and generates encrypted data c _i .
In step S2, the terminal P _i transmits the encrypted data c _i to the server S.

In step S3, the server S selects the encrypted data c _i as the data point p, and calculates the encrypted Euclidean distance dist between p and another data point p ′ as follows.
dist ² = (Enc _pk (p) −Enc _pk (p ′)) ^{2
_{= Enc pk (p) 2 -2Enc}} pk (p) Enc pk (p ') + Enc pk (p') 2
Further, the server S performs the following calculation as an operation for comparing dist and ε.
d _i ² = Enc _pk (dist ² ) + Enc _pk (−ε ² )
= Enc _pk (dist ² -ε ² )

In step S4, the server S transmits the encrypted data d _i ² to the plurality of terminals P.
In step S5, the plurality of terminals P cooperate with the MPC to decode d _i ² and determine the magnitude relationship between dist and ε.

  In step S6, one of the terminals P transmits the determination result in step S5 to the server S in plain text. Specifically, for example, “1” is transmitted when dist ≦ ε, and “0” is transmitted when dist> ε.

In step S7, the server S obtains all points that can reach the density with respect to ε and MinPts from the data point p according to the DBSCAN protocol.
At this time, if p is a core point, a cluster is formed.

  In step S8, the server S determines whether all data points have been processed. If this determination is YES, the process moves to step S9. If the determination is NO, the process returns to step S3 and the next data point is selected.

In step S9, the server S encrypts the formed cluster information with the public key.
In step S10, the server S transmits the encrypted cluster information to the terminals P of a plurality of parties.
In step S11, the plurality of terminals P decrypt the encrypted data received in step S9 in cooperation with the MPC, and acquire cluster information.

According to the present embodiment, in the classification system 100, a plurality of parties can perform clustering calculation by DBSCAN without sharing a data set with each other and without being known to the server S by a completely homomorphic encryption method. Is executed by the server S. At this time, the server S calculates the magnitude relationship between the Euclidean distance between the data and the predetermined distance while being encrypted, but acquires only the result by MPC by a plurality of parties.
Specifically, the server S can obtain the result only by addition and multiplication by calculating the magnitude relationship as a square difference, and thus can operate with encryption using a completely homomorphic encryption method. .

  In this manner, the classification system 100 outsources high-load operations to the server S, thereby reducing the processing load on the multi-party terminal P, and without exposing the data set to the server S. Clustering can be performed safely.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. Further, the effects described in the present embodiment are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the present embodiment.

  The classification method by the classification system 100 is realized by software. When realized by software, a program constituting the software is installed in an information processing apparatus (computer). These programs may be recorded on a removable medium such as a CD-ROM and distributed to the user, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded.

P terminal S server 11 first receiving unit 12 computing unit 13 first transmitting unit 14 second receiving unit 15 clustering unit 16 second transmitting unit 100 classification system

Claims (4)

A first receiving unit that receives a plurality of data encrypted with a public key from a plurality of parties by a completely homomorphic encryption method;
A calculation unit that performs an operation for obtaining a magnitude relationship between the Euclidean distance between the data and a predetermined distance in an encrypted state;
A first transmitter that transmits the result of the calculation to the plurality of parties;
A second receiving unit that receives the determination value of the magnitude relation obtained by a value obtained by decrypting a result of the calculation by multi-party calculation using a secret key of each party;
A clustering unit that generates a cluster in which the plurality of data is classified based on the determination value;
A second transmission unit that encrypts the cluster information with the public key and transmits the encrypted information to the plurality of parties. The calculation unit calculates encrypted data of a difference value between the square of the Euclidean distance and the square of the predetermined distance;
The classification device according to claim 1, wherein the second receiving unit receives the determination value of the magnitude relationship based on the difference value. A first receiving step of receiving, from a plurality of parties, a plurality of data encrypted with a public key by a completely homomorphic encryption method;
A calculation step of performing an operation for obtaining a magnitude relationship between the Euclidean distance between the data and a predetermined distance in an encrypted state;
A first transmission step of transmitting a result of the calculation to the plurality of parties;
A second receiving step of receiving the determination value of the magnitude relationship obtained by a value obtained by decrypting a result of the calculation by multi-party calculation using a secret key of each party;
A clustering step of generating a cluster in which the plurality of data is classified based on the determination value;
A classification method in which a computer executes a second transmission step of encrypting the cluster information with the public key and transmitting the encrypted information to the plurality of parties. A first receiving step of receiving, from a plurality of parties, a plurality of data encrypted with a public key by a completely homomorphic encryption method;
A calculation step of performing an operation for obtaining a magnitude relationship between the Euclidean distance between the data and a predetermined distance in an encrypted state;
A first transmission step of transmitting a result of the calculation to the plurality of parties;
A second receiving step of receiving the determination value of the magnitude relationship obtained by a value obtained by decrypting a result of the calculation by multi-party calculation using a secret key of each party;
A clustering step of generating a cluster in which the plurality of data is classified based on the determination value;
A classification program for causing a computer to execute a second transmission step of encrypting the cluster information with the public key and transmitting the encrypted information to the plurality of parties.

Images