JP2019168590A - Information processing method and information processing system - Google Patents

Abstract

To provide a technology capable of acquiring a processing result while keeping a learning model and processing target data in a concealed state.SOLUTION: A model generation part 110 of a model providing server 1 generates a learning model by using machine learning. An encryption part 112 encrypts the learning model by using a first public key, which is a public key of fully homomorphic encryption and generates an encrypted learning model. A transmission part 12 transmits the encrypted learning model to a service providing server 2. A receiving part 23 of the service providing server 2 receives the encrypted learning model from the model providing server 1 and receives encrypted processing target data obtained by encrypting processing target data by using the first public key from a user terminal 3. A model execution part 210 generates a first encryption output by using the encrypted learning model and the encrypted processing target data. A transmission part 22 transmits a second encryption output obtained by replacing the first encryption output with a cipher by a second public key generated by the user terminal 3 to the user terminal 3.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an information processing method and an information processing system, and more particularly to a technique for concealing a learning model generated using machine learning and data to be processed by the learning model.

  In recent years, the speed of CPU (Central Processing Unit) and GPU (Graphics Processing Unit), the capacity of memory, and machine learning technology have been rapidly advanced. For this reason, machine learning using learning data in the order of hundreds of thousands to millions is possible, and highly accurate identification techniques and classification techniques are being established (see Non-Patent Document 1).

Yangqing Jia, Evan Shelhamer, Jeff Donahue, Sergey Karayev, Jonathan Long, Ross Girshick, Sergio Guadarrama, and Trevor Darrell.Caffe: Convolutional architecture for fast feature embedding.In Proceedings of the 22nd ACM international conference on Multimedia (pp. 675-678 ). ACM.

  In order to execute machine learning based on a large amount of learning data, a large amount of calculation cost is required. In addition, enormous effort is required for preparing a large amount of learning data and preprocessing for processing the prepared learning data for use in machine learning. On the other hand, the learning model generated by machine learning is digital data, and its replication is easy. Therefore, if the learning model creator provides the user with a learning model for the purpose of causing the user to use the learning model, the provided learning model may be used illegally thereafter.

  On the other hand, a mode is also conceivable in which the processing model data is acquired from the user via the communication network and only the processing result of the learning model is provided to the user without providing the learning model itself to the user of the learning model. However, in this aspect, in the case of data that has a problem of leakage due to personal information included in the data input to the learning model, the user may take a second step in using the learning model.

  The present invention has been made in view of these points, and an object of the present invention is to provide a technique capable of acquiring a processing result while keeping a learning model and processing target data concealed.

  A first aspect of the present invention is an information processing method executed in an information processing system including a model providing server, a service providing server, and a user terminal that are connected in a manner capable of communicating with each other via a communication network. In this method, the model providing server generates an encrypted learning model by encrypting a learning model created by using machine learning using a first public key that is a public key of completely homomorphic encryption; The model providing server transmits the encrypted learning model to the service providing server, the model providing server transmits the first public key to the user terminal, and the user terminal includes the model. Encrypting the processing target data of the learning model using the first public key received from the providing server to generate the encryption processing target data, the user terminal including the encryption processing target data, the complete processing target data, Transmitting a second public key, which is a homomorphic public key and different from the first public key, to the service providing server; and the user terminal Transmitting the second public key to the model providing server, and using the second public key received from the user terminal by the model providing server, a first secret key corresponding to the first public key. Generating an encrypted second public key encrypted first secret key, transmitting the second public key encrypted first secret key to the model providing server, and providing the service The processing target data encrypted by the first public key using the encryption learning model received from the model providing server by the server and the encryption processing target data received from the user terminal Obtaining a first encrypted output that is an output of the learning model with the input as input, and the service providing server retransmits the first encrypted output using the second public key. Generating an encrypted double-encrypted output; and wherein the service providing server uses the second public key-encrypted first secret key and is encrypted with the second public key. Obtaining a second encrypted output obtained by decrypting the encryption with the first public key out of the double encrypted output, and the service providing server transmits the second encrypted output to the user terminal And a step in which the user terminal decrypts the second encrypted output received from the service providing server using a second secret key corresponding to the second public key.

  In the information processing method, the model providing server generates a third public key that is a public key of the completely homomorphic encryption and is different from the first public key and the second public key; A server generating a third public key encrypted first private key obtained by encrypting the first private key with the third public key; and the model providing server comprising the third public key and the third public key. Transmitting a key encryption first secret key to the model providing server; and the service providing server encrypts the encryption learning model again using the third public key received from the model providing server. Generating a double encryption learning model, and the service providing server is encrypted with the third public key using the third public key encrypted first secret key received from the model providing server. A step of decoding encrypted by said first public key of said double encrypted training model remains may further include a.

  In the information processing method, the learning model executes the combination of at least one of addition and multiplication of the processing target data of the learning model and the model parameter of the learning model, thereby converting the processing target data. An output of the learning model as an input may be calculated.

  According to a second aspect of the present invention, there is provided an information processing system including a model providing server and a service providing server that are connected to each other through a communication network in a manner that enables communication with each other. In this system, the model providing server encrypts and encrypts the learning model using a model generation unit that generates a learning model using machine learning and a first public key that is a public key of a completely homomorphic encryption An encryption unit that generates a learning model, a transmission unit that transmits the encrypted learning model to the service providing server and transmits the first public key to a user terminal, and a public key of the completely homomorphic encryption. Receiving a second public key different from the first public key from the user terminal. The encryption unit generates a second public key encrypted first secret key obtained by encrypting a first secret key corresponding to the first public key using the second public key, and the transmission unit includes: The second public key encrypted first secret key is transmitted to the model providing server. The service providing server receives the encrypted learning model from the model providing server, and encrypts the processing target data of the learning model using the first public key from the user terminal. Using the receiving unit that receives data, the encrypted learning model, and the encryption processing target data, the learning model output having the processing target data encrypted with the first public key as an input A model execution unit that generates a first encrypted output, an encryption unit that generates a double encrypted output obtained by re-encrypting the first encrypted output using the second public key, and the second A second cipher obtained by decrypting the encryption with the first public key out of the double encrypted output while being encrypted with the second public key using the public key encrypted first secret key Get the output Comprising a decoding unit, and a transmission unit transmitting the second encrypted output to the user terminal.

  ADVANTAGE OF THE INVENTION According to this invention, the technique which can acquire a processing result can be provided with the learning model and the process target data kept secret.

It is a figure which shows typically the outline | summary of a structure of the information processing system which concerns on embodiment. It is a figure which shows typically the function structure of the model provision server which concerns on embodiment, a service provision server, and a user terminal. It is a figure which shows the first half part of the sequence diagram for demonstrating the flow of the process performed with the information processing system which concerns on embodiment. It is a figure which shows the second half part of the sequence diagram for demonstrating the flow of the process performed with the information processing system which concerns on embodiment. It is the figure which put together the list | wrist of the data which the model provision server which concerns on embodiment, a service provision server, and a user terminal each produces | generates or acquires in a tabular form. It is a sequence diagram for demonstrating the update process of the encryption key performed with the information processing system which concerns on embodiment.

<Outline of the embodiment>
FIG. 1 is a diagram schematically illustrating an outline of a configuration of an information processing system S according to an embodiment. Hereinafter, an outline of the embodiment will be described with reference to FIG.

  As shown in FIG. 1, the information processing system S according to the embodiment includes a model providing server 1, a service providing server 2, and a user terminal 3. The model providing server 1, the service providing server 2, and the user terminal 3 are connected to each other via a communication network N in such a manner that they can communicate with each other.

  The model providing server 1 is a device that generates a learning model by machine learning. The learning model generated by the model providing server 1 is digital data configured to receive data to be processed and output some processing result. For example, when image data is input as a processing target, the learning model generated by the model providing server 1 recognizes a subject included in the image data and outputs the type, number, and location of the subject in the image. It is an image recognition engine.

  The service providing server 2 is a device that receives the learning model generated by the model providing server 1 and provides a service to the user. The service providing server 2 receives data to be processed from the user terminal 3 used by the user via the communication network N. Subsequently, the service providing server 2 applies the received data to the learning model and acquires an output. Finally, the service providing server 2 transmits the obtained learning model output to the user terminal 3 via the communication network N.

  Here, the model providing server 1 transmits to the service providing server 2 a learning model obtained by encrypting the learning model with a public key of fully homomorphic encryption (Fully Homomorphic. Encryption). The user terminal 3 receives the public key used for encrypting the learning model from the model providing server 1, encrypts the data to be processed using the public key, and then sends the data to the service providing server 2. Send. That is, the service providing server 2 acquires the learning model encrypted with the same public key and the data to be processed.

The fully homomorphic encryption is an encryption that can perform an addition operation and a multiplication operation while encrypting data. Specifically, the plaintext of the two numerical values is a and b, and the encrypted a and b are Enc (a) and Enc (b). Further, Enc (a + b) is obtained by encrypting the addition a + b of a and b, and Enc (a × b) is obtained by encrypting the multiplication a × b of a and b. At this time, the following equations (1) and (2) are established in perfect homomorphic encryption.
Enc (a) + Enc (b) = Enc (a + b) (1)
Enc (a) x Enc (b) = Enc (a x b) (2)

  The learning model generated by the model providing server 1 according to the embodiment is obtained by executing a combination of at least one of addition and multiplication of the processing target data of the learning model and the model parameter of the learning model. An output of a learning model that receives data is calculated. In other words, the learning model generated by the model providing server 1 according to the embodiment does not include a non-linear function such as a sigmoid function in the middle of processing, and includes only an addition operation or a multiplication operation. As a result, the service providing server 2 according to the embodiment acquires the learning model and the processing target data encrypted with the public key of the completely homomorphic encryption, and the processing target data remains encrypted. Can be applied to the learning model.

  Note that the output obtained by applying the data to be processed by the service providing server 2 to the learning model is also encrypted with the public key generated by the model providing server 1. For this reason, even if the service providing server 2 transmits the encrypted output to the user terminal 3, the user terminal 3 cannot confirm the output content.

  Therefore, the service providing server 2 rewrites the output encrypted with the public key generated by the model providing server 1 into a state encrypted with another public key generated by the user terminal 3, and then transmits it to the user terminal 3. To do. As a result, the user terminal 3 can confirm the output contents by decrypting the output with the private key owned by itself.

  As described above, according to the information processing system S according to the embodiment, the service providing server 2 and the user terminal 3 cannot acquire a learning model in a plain text state. Further, the model providing server 1 and the service providing server 2 cannot acquire processing target data in a plain text state. Nevertheless, the user terminal 3 can acquire the result of applying the processing target data to the learning model. Therefore, the information processing system S according to the embodiment can acquire the processing result while keeping the learning model and the processing target data concealed, and can suppress leakage between the learning model and the processing target data.

<Functional configuration of model providing server 1, service providing server 2, and user terminal 3 according to the embodiment>
FIG. 2 is a diagram schematically illustrating a functional configuration of the model providing server 1, the service providing server 2, and the user terminal 3 according to the embodiment. The model providing server 1 includes a storage unit 10, a control unit 11, a transmission unit 12, and a reception unit 13. The service providing server 2 includes a storage unit 20, a control unit 21, a transmission unit 22, and a reception unit 23. The user terminal 3 includes a storage unit 30, a control unit 31, a transmission unit 32, and a reception unit 33.

  The storage unit 10 includes a ROM (Read Only Memory) that stores a BIOS (Basic Input Output System) of a computer that implements the model providing server 1, a RAM (Random Access Memory) that is a work area of the model providing server 1, an OS ( Operating system), application programs, and mass storage devices such as HDDs (Hard Disk Drives) and SSDs (Solid State Drives) that store various types of information referred to when the application programs are executed.

  Similarly, the storage unit 20 includes a ROM that stores a BIOS of a computer that implements the service providing server 2, a RAM that is a work area of the service providing server 2, an OS, an application program, and various types that are referred to when executing the application program. This is a large-capacity storage device such as an HDD or SSD for storing the information. Further, the storage unit 30 stores a ROM that stores a BIOS of a computer that implements the user terminal 3, a RAM that is a work area of the user terminal 3, an OS, an application program, and various types of information that are referred to when the application program is executed. It is a mass storage device such as an HDD or SSD for storing.

  The control unit 11 is a processor such as a CPU or GPU of the model providing server 1 and functions as a model generation unit 110, a key generation unit 111, and an encryption unit 112 by executing a program stored in the storage unit 10. . Similarly, the control unit 21 is a processor such as a CPU or a GPU of the service providing server 2 and executes a program stored in the storage unit 20 as a model execution unit 210, an encryption unit 211, and a decryption unit 212. Function. Further, the control unit 31 is a processor such as a CPU or a GPU of the user terminal 3 and functions as an encryption unit 310, a key generation unit 311, and a decryption unit 312 by executing a program stored in the storage unit 30. .

  FIG. 2 shows an example in which the model providing server 1 and the service providing server 2 are configured by a single device. However, the model providing server 1 and the service providing server 2 may be realized by calculation resources such as a plurality of processors and memories, for example, like a cloud computing system. In this case, each part which comprises the control part 11 and the control part 21 is implement | achieved when at least any one of a several different processor runs a program.

<Sequence diagram of processing executed in information processing system S>
FIG. 3 is a diagram illustrating a first half of a sequence diagram for explaining a flow of processing executed in the information processing system S according to the embodiment. FIG. 4 is a diagram showing the latter half of the sequence diagram for explaining the flow of processing executed by the information processing system S according to the embodiment. Hereinafter, processing executed in cooperation by the model providing server 1, the service providing server 2, and the user terminal 3 will be described with reference to FIG. 2, FIG. 3, and FIG.

  The model generation unit 110 generates a learning model using machine learning (S2). Specifically, the model generation unit 110 generates a learning model by processing learning data collected in advance by a known machine learning such as a neural network, SVM (Support Vector Machine), or boosting. Here, when a nonlinear function is used in a known learning model, the model generation unit 110 performs learning after replacing the learning model with only a multiplicative operation and an additive operation by approximation with a linear function in advance. To do.

  The key generation unit 111 generates a completely homomorphic public key encryption key (S4). Since it is a public key encryption key, the key generation unit 111 generates a public key and a secret key corresponding to the public key. As will be described later, a public key encryption key of completely homomorphic encryption is also generated by the service providing server 2. Therefore, the public key generated by the key generation unit 111 is described as “first public key pk1” or simply “pk1”. Similarly, the first secret key is described as “first secret key sk1” or simply “sk1”. The key generation unit 111 and the service providing server 2 may use, for example, a BVG (Brakerski-Gentry-Vaikuntanathan cryptosystem) cipher as the completely homomorphic cipher.

  The encryption unit 112 encrypts the learning model using the first public key pk1 to generate an encrypted learning model (S6). Hereinafter, the learning model is referred to as “learning model w” or simply “w”. The learning model w encrypted with the first secret key sk1 is referred to as “encrypted learning model Enc (pk1, w)” or simply “Enc (pk1, w)”. Hereinafter, data obtained by encrypting the data d using the public key pk is described as Enc (pk, d).

  The transmission unit 12 transmits the encrypted learning model Enc (pk1, w) to the service providing server 2 (S8). Further, the transmission unit 12 transmits the first public key pk1 to the user terminal 3 (S10).

  The receiving unit 33 of the user terminal 3 receives the first public key pk1 transmitted from the model providing server 1 (S12). The encryption unit 310 encrypts the processing target data x of the learning model w using the first public key pk1 to generate the encryption processing target data Enc (pk1, x) (S14).

  The key generation unit 311 is a second cipher including a second public key pk2 which is a public key of complete homomorphic encryption and is different from the first public key pk1, and a second secret key sk2 corresponding to the second public key pk2. A key is generated (S16). The transmitting unit 32 transmits the second public key pk2 to the model providing server 1 and the service providing server 2 (S18).

  The receiving unit 13 of the model providing server 1 receives the second public key pk2 from the user terminal 3 (S20). The receiving unit 23 of the service providing server 2 receives the encrypted learning model Enc (pk1, w) from the model providing server 1 (S22). The receiving unit 23 receives the second public key pk2 from the user terminal 3 (S24).

  The transmission unit 32 of the user terminal 3 transmits the encryption processing target data Enc (pk1, x) to the service providing server 2 (S26). The receiving unit 23 of the service providing server 2 receives the encryption processing target data Enc (pk1, x) from the user terminal 3 (S28).

  The encryption unit 112 of the model providing server 1 uses the second public key pk2 received from the user terminal 3 to encrypt the first secret key sk1, and the second public key encrypted first secret key Enc (pk2, sk1). Is generated (S30). The transmission unit 12 transmits the second public key encrypted first secret key Enc (pk2, sk1) to the service providing server 2 (S32).

The receiving unit 23 of the service providing server 2 receives the second public key encrypted first secret key Enc (pk2, sk1) from the model providing server 1 (S34). The model execution unit 210 uses the encrypted learning model Enc (pk1, w) and the encryption processing target data Enc (pk1, x) to process the processing target data x in a state encrypted with the first public key pk1. first encryption output Enc is the output of the learning model w to input to generate a _{(pk1, f w (x)} ) (S36).

Encryption unit 211 first encrypts the output _{Enc (pk1, f w (x} )) , and the second two were re-encrypted using the public key pk2 double encrypted output Enc received from the user terminal 3 (pk2, _{Enc (pk1, f w (x} ))) to generate a (S38).

The decryption unit 212 uses the second public key encrypted first secret key Enc (pk2, sk1) received from the model providing server 1, and performs double encryption output while being encrypted with the second public key pk2. _{Enc (pk2, Enc (pk1,} f w (x))) first second encryption output Enc obtained by decrypting the encrypted public key _{pk1 (pk2, f w (x} )) to get out of ( S40). Transmission unit 22 transmits the second encrypted output _{Enc (pk2, f w (x} )) to the user terminal 3 (S42).

Receiver 33 of the user terminal 3 receives from the service providing server 2 second encrypted output _{Enc (pk2, f w (x} )) (S44). Decoding unit 312, using the second secret key sk2, second encrypted output second encrypted output Enc received from the service providing server _{2 (pk2, f w (x} )) for decoding the (S46). Thereby, the user terminal 3 can obtain the output f _w (x) of the learning model w that receives the unencrypted processing target data x.

  FIGS. 5A to 5C are diagrams in which a list of data generated or acquired by the model providing server 1, the service providing server 2, and the user terminal 3 according to the embodiment is summarized in a table format. As shown in FIG. 5A, the model providing server 1 generates a learning model w, a first public key pk1, and a first secret key sk1, and acquires a second public key pk2 from the user terminal 3. The model providing server 1 further generates a second public key encrypted first secret key Enc (pk2, sk1) obtained by encrypting the first secret key sk1 using the second public key pk2.

  As shown in FIG. 5B, the service providing server 2 receives the encrypted learning model Enc (pk1, w) and the second public key encrypted first secret key Enc (pk2, sk1) from the model providing server 1. get. In addition, the service providing server 2 acquires the second public key pk2 and the encryption processing target data Enc (pk1, x) from the user terminal 3.

The service providing server 2 generates the first encrypted output Enc (pk1, f _w (x)) based on the encryption learning model Enc (pk1, w) and the encryption processing target data Enc (pk1, x). To do. The service providing server 2, the first encrypted output Enc using the second public key _{pk2 (pk1, f w (x} )) by encrypting the double-encrypted output _{Enc (pk2, Enc (pk1,} f w (x ))). Further, the service providing server 2 decrypts the double encrypted output Enc (pk2, Enc (pk1, f _w (x))) using the second public key encrypted first secret key Enc (pk2, sk1). Te second encrypted output _{Enc (pk2, f w (x} )) is also generated.

As shown in FIG. 5C, the user terminal 3 generates processing target data x, a second public key pk2, and a second secret key sk2. The user terminal 3 acquires the first public key pk1 from the model providing server 1. The user terminal 3 generates encrypted processing target data Enc (pk1, x) obtained by encrypting the processing target data x using the first public key pk1. Furthermore, the user terminal 3 acquires from the service providing server 2 second encrypted output _{Enc (pk2, f w (x} )). The user terminal 3 uses the second secret key sk2 to decrypt the second encrypted output Enc (pk2, f _w (x)), thereby outputting the output f _w ( x).

  Thus, the learning model w generated by the model providing server 1 according to the embodiment is not transmitted to the service providing server 2 or the user terminal 3 in plain text. In addition, neither the service providing server 2 nor the user terminal 3 acquires a secret key for decrypting the encrypted learning model w. Therefore, the information processing system S according to the embodiment can conceal the learning model w and can prevent the learning model w from leaking.

  Further, the processing target data x generated by the user terminal 3 according to the embodiment is not transmitted to the model providing server 1 or the service providing server 2 in plain text. Furthermore, neither the model providing server 1 nor the service providing server 2 acquires a secret key for decrypting the encrypted processing target data x. Therefore, the information processing system S according to the embodiment can conceal the processing target data x and can suppress the processing target data x from leaking.

(Renewal of encryption key of learning model w)
As described above, the model providing server 1 according to the embodiment transmits the learning model w to the service providing server 2 in an encrypted state. Here, if the public key for encrypting the learning model w can be updated periodically, the learning model can be protected from leakage even if the private key corresponding to the public key is leaked. Therefore, a public key update process for encrypting the learning model w will be described below.

  FIG. 6 is a sequence diagram for explaining encryption key update processing executed in the information processing system S according to the embodiment. The key generation unit 111 of the model providing server 1 corresponds to a third public key pk3 and a third public key pk3 that are public keys of completely homomorphic encryption and are different from the first public key pk1 and the second public key pk2. A third encryption key including the third secret key sk3 is generated (S48).

  The encryption unit 112 generates a third public key encrypted first secret key Enc (pk3, sk1) obtained by encrypting the first secret key sk1 with the third public key pk3 (S50). The transmission unit 12 transmits the third public key pk3 and the third public key encrypted first secret key Enc (pk3, sk1) to the service providing server 2 (S52).

  The receiving unit 23 of the service providing server 2 receives the third public key pk3 and the third public key encrypted first secret key Enc (pk3, sk1) from the model providing server 1 (S54). The encryption unit 211 re-encrypts the encrypted learning model Enc (pk1, w) using the third public key pk3, and double-encrypted learning model Encrypted learning model Enc (pk3, Enc (pk1, w)) ) Is generated (S56).

  The decryption unit 212 uses the third public key encrypted first secret key Enc (pk3, sk1) to keep the double encrypted learning model encrypted learning model Enc ( The encryption with the first public key pk1 in pk3, Enc (pk1, w)) is decrypted (S58). Thereby, the decryption unit 212 can generate Enc (pk3, w) that is the learning model w encrypted with the third public key pk3.

  As described above, the information processing system S can update the encryption key of the learning model w held by the service providing server 2. For example, the learning model w generated by machine learning using a large amount of learning data on the order of hundreds of thousands to millions has a large data size, and the data size after encryption is also the same. Therefore, as compared with the case where the model providing server 1 encrypts the learning model w with the third public key pk3 and then transmits it to the service providing server 2, the encryption key update processing described above is data that passes through the communication network N. This is advantageous in that the amount can be greatly reduced.

<Effects produced by model providing server 1 according to the embodiment>
As described above, according to the model providing server 1 according to the embodiment, the processing result can be acquired while the learning model and the processing target data are kept secret.

  As mentioned above, although this invention was demonstrated using embodiment, the technical scope of this invention is not limited to the range as described in the said embodiment, A various deformation | transformation and change are possible within the range of the summary. is there. For example, the specific embodiments of device distribution / integration are not limited to the above-described embodiments, and all or a part of them may be configured to be functionally or physically distributed / integrated in arbitrary units. Can do. In addition, new embodiments generated by any combination of a plurality of embodiments are also included in the embodiments of the present invention. The effect of the new embodiment produced by the combination has the effect of the original embodiment.

DESCRIPTION OF SYMBOLS 1 ... Model provision server 10 ... Memory | storage part 11 ... Control part 110 ... Model generation part 111 ... Key generation part 112 ... Encryption part 12 ... Transmission part 13 ... Receiving unit 2 ... service providing server 20 ... storage unit 21 ... control unit 210 ... model execution unit 211 ... encryption unit 212 ... decryption unit 22 ... transmission unit 23 ...・ Receiving unit 3... User terminal 30... Storage unit 31... Control unit 310.・ Receiver N ... Communication network S ... Information processing system

Claims (4)

An information processing method executed in an information processing system including a model providing server, a service providing server, and a user terminal connected in a manner capable of communicating with each other via a communication network,
The model providing server encrypts a learning model created using machine learning using a first public key which is a public key of perfect homomorphic encryption to generate an encrypted learning model;
The model providing server transmitting the encrypted learning model to the service providing server;
The model providing server transmitting the first public key to the user terminal;
The user terminal encrypting processing target data of the learning model using the first public key received from the model providing server to generate encryption processing target data;
The user terminal transmitting the encryption processing target data and a second public key that is a public key of the completely homomorphic encryption different from the first public key to the service providing server;
The user terminal transmitting the second public key to the model providing server;
The model providing server generates a second public key encrypted first secret key obtained by encrypting a first secret key corresponding to the first public key using the second public key received from the user terminal. When,
The model providing server transmitting the second public key encrypted first secret key to the model providing server;
The service providing server uses the encrypted learning model received from the model providing server and the encryption processing target data received from the user terminal, and is encrypted with the first public key. Obtaining a first encrypted output that is an output of the learning model that receives processing target data;
The service providing server generating a double encrypted output obtained by re-encrypting the first encrypted output using the second public key;
The service providing server uses the second public key encrypted first secret key to encrypt with the first public key out of the double encrypted output while being encrypted with the second public key. Obtaining a second encrypted output obtained by decrypting;
The service providing server transmitting the second encrypted output to the user terminal;
The user terminal decrypting the second encrypted output received from the service providing server using a second private key corresponding to the second public key;
An information processing method including: The model providing server generates a third public key which is a public key of the completely homomorphic encryption and is different from the first public key and the second public key;
The model providing server generating a third public key encrypted first secret key obtained by encrypting the first secret key with the third public key;
The model providing server transmitting the third public key and the third public key encrypted first secret key to the model providing server;
The service providing server re-encrypts the encrypted learning model using the third public key received from the model providing server to generate a double encrypted learning model;
The service providing server uses the third public key encrypted first secret key received from the model providing server and remains encrypted with the third public key. Decrypting the encryption with the first public key;
The information processing method according to claim 1, further comprising: The learning model executes the combination of at least one of addition and multiplication of the processing target data of the learning model and the model parameter of the learning model, thereby inputting the processing target data. Configured to calculate the output of the
The information processing method according to claim 1 or 2. An information processing system including a model providing server and a service providing server that are connected in a manner capable of communicating with each other via a communication network,
The model providing server is:
A model generation unit that generates a learning model using machine learning;
An encryption unit that generates an encrypted learning model by encrypting the learning model using a first public key that is a public key of fully homomorphic encryption;
A transmitter that transmits the encrypted learning model to the service providing server and transmits the first public key to a user terminal;
A receiving unit that receives a second public key that is a public key of the completely homomorphic encryption and is different from the first public key, from the user terminal,
The encryption unit uses the second public key to generate a second public key encrypted first secret key obtained by encrypting a first secret key corresponding to the first public key,
The transmitting unit transmits the second public key encrypted first secret key to the model providing server,
The service providing server includes:
A receiving unit that receives the encrypted learning model from the model providing server, and receives encrypted processing target data obtained by encrypting the processing target data of the learning model using the first public key from the user terminal;
Using the encrypted learning model and the encryption processing target data, a first encrypted output that is an output of the learning model that receives the processing target data encrypted with the first public key. A model execution unit to be generated;
An encryption unit for generating a double encrypted output obtained by re-encrypting the first encrypted output using the second public key;
Obtained by decrypting the encryption with the first public key out of the double encrypted output using the second public key encrypted first secret key while being encrypted with the second public key A decryption unit for obtaining a second encrypted output;
A transmission unit that transmits the second encrypted output to the user terminal,
Information processing system.

Images