JP2022044737A - Input person device, arithmetic support device, device, secret arithmetic device, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To efficiently perform calculation.

SOLUTION: A system performs secret arithmetic between a first integer and a second integer using means that distributes confidential information to n pieces and can restore the confidential information by collecting k distributed values of the n pieces but cannot restore the confidential information with k-L pieces or less, where n denotes an integer, k an integer equal to or less than n, and L an integer of 1 or greater and k or smaller. The system adds a value other than 0 to the confidential information, then multiplies the sum by a random number other than 0 (54), and transmits the product to each machine as is (56).

SELECTED DRAWING: Figure 5

COPYRIGHT: (C)2022,JPO&INPIT

Description

The present invention relates to an input person device, a calculation support device, a device, a secret calculation device, and a program.

The arithmetic support unit and the confidential arithmetic unit relate to distributed management technology for safely distributed management of information. Further, the present invention relates to a concealment operation technique for performing an operation while concealing distributed managed information.

In recent years, with the progress of AI and the like, the utilization of neural networks (hereinafter referred to as NN) is expected. However, in the utilization of NN, if the problem to be solved is leaked, it may affect the privacy of individuals and the confidential information of companies. Therefore, in the utilization of NN, it is desired to be able to conceal the input information and the problem to be solved.

Confidential calculation technology is being researched as a method for realizing calculation while concealing input information. The secret calculation technology can be broadly divided into homomorphic encryption based on public key cryptography, which mainly uses a key to conceal data, and concealment calculation, which uses a secret sharing method to conceal data without using a key. However, homomorphic encryption generally requires a large amount of calculation, and has a problem that it takes a lot of time to process the calculation. On the other hand, when secret sharing is used, a minimum of two devices are required, but it is generally known that three or more separately managed devices are required for secret calculation. There is a problem that the scale becomes large. Therefore, there is a need for a mechanism that enables high-speed concealment calculation and can perform concealment calculation with as few units as possible or with a small device scale.

It is an object of the present invention to provide an input person device, a calculation support device, and a secret calculation device capable of efficiently performing confidential calculation on a small device scale.

The arithmetic support unit of the invention according to claim 1 has n as an integer of 2 or more, k as an integer having a minimum value of 2 and a maximum value of n, and L as an integer of 1 or more and k or less. Confidential information can be restored by collecting k distributed values out of n values, and non-zero values for confidential information in a system that performs confidential operations using means that cannot restore confidential information if the number is k-L or less. It is characterized by having a means for secretly adding the random number of the above and a means for sending the secret addition result as it is to all the secret calculation devices participating in the secret calculation.

In the apparatus of the invention according to claim 2, n is an integer of 2 or more, k is an integer having a minimum value of 2 and a maximum value of n, and L is an integer of 1 or more and k or less, and secret information is distributed to n pieces. Then, in a system in which the secret information can be restored by collecting k distributed values out of n, and the secret operation is performed using a means that cannot restore the secret information if the number is k-L or less, one or more first random numbers. It is characterized by having a means for generating a first random number and a means for multiplying each of the secretly distributed distributed values by each of the first random numbers.

The secret arithmetic unit of the invention according to claim 3 has n as an integer of 2 or more, k as an integer having a minimum value of 2 and a maximum value of n, and L as an integer of 1 or more and k or less. In a system in which the secret information can be restored by collecting k distributed values out of n and the secret information cannot be restored if the number is k-L or less, the different random numbers according to claim 2 are performed. A calculation is performed using a means for applying the concealed secret information disclosed by the apparatus of claim 1 to the distributed value obtained by the method and a distributed value in which different random numbers are applied to the same secret information which is the output of the means. It is characterized by having a means to do so.

The inputter device of the invention according to claim 4 has n as an integer of 2 or more, k as an integer having a minimum value of 2 and a maximum value of n, and L as an integer of 1 or more and k or less, and n pieces of secret information. The number of secret arithmetic devices used in a system that performs a secret operation using a means that can restore secret information by collecting k distributed values out of n and cannot restore confidential information if the number is k-L or less. When t and the number of inputs are u, a means for performing secret sharing with n being ut or more, a means for dividing the distribution value for each n / t and multiplying by different random numbers, and the different random numbers are multiplied. It is characterized by having a means for distributing at least one distribution value from n / t of the distribution values to a secret computing device.

In the confidential operation device of the invention according to claim 5, n is an integer of 2 or more, k is an integer having a minimum value of 2 and a maximum value of n, and L is an integer of 1 or more and k or less, and n pieces of confidential information. In a system that performs a concealment operation using a means that can restore confidential information by collecting k distributed values out of n, and cannot restore confidential information with k-L or less, multiply the distributed values. It is characterized by having a means for performing, a means for deleting a random number from the product of distributed values to which a random number has been applied, and a means for repeating a degree conversion process for the distributed value from which the random number has been deleted one or more times. ..

The concealment arithmetic unit of the invention according to claim 6 has n as an integer of 2 or more, k as an integer having a minimum value of 2 and a maximum value of n, and L as an integer of 1 or more and k or less. Concealment according to claim 1 in a system in which confidential information can be restored by collecting k distributed values out of n, and concealment calculation is performed using a means that cannot restore confidential information with k-L or less. A means for secretly subtracting a constant added in claim 1 from confidential information, a means for verifying whether the secret subtraction result is 0, and a means for generating the reciprocal of the secretly subtracted value when it is not 0. , Have.

The arithmetic support unit of the invention according to claim 7 has n as an integer of 2 or more, k as an integer having a minimum value of 2 and a maximum value of n, and L as an integer of 1 or more and k or less. Dispersion with different random numbers is applied in a system that performs concealment operations using means that can restore secret information by collecting k distribution values out of n, and cannot restore confidential information with k-L or less. It has a means for converting a value into the same random number as other distributed values, and a means for recovering confidential information to which the same random number is applied, or for allowing a secret arithmetic unit to recover.

In the program of the invention according to claim 8, n is an integer of 2 or more, k is an integer having a minimum value of 2 and a maximum value of n, and L is an integer of 1 or more and k or less, and secret information is distributed to n pieces. Then, if k distributed values out of n are collected, the secret information can be restored, and if the number is k-L or less, the secret information cannot be restored. It functions as a means for secretly adding a non-zero integer and a means for sending the secret addition result as it is to all the secret calculation devices participating in the secret calculation.

In the program of the invention according to claim 9, n is an integer of 2 or more, k is an integer having a minimum value of 2 and a maximum value of n, and L is an integer of 1 or more and k or less, and secret information is distributed to n pieces. Then, if k of the n distributed values are collected, the secret information can be restored, and if the number is k-L or less, the secret information cannot be restored. It functions as a means for generating a first random number and a means for multiplying each of the first random numbers by each of the secretly distributed distributed values.

In the program of the invention according to claim 10, n is an integer of 2 or more, k is an integer having a minimum value of 2 and a maximum value of n, and L is an integer of 1 or more and k or less, and secret information is distributed to n pieces. The computer of the secret arithmetic unit in the system that performs the secret calculation by using a means that can recover the secret information by collecting k distributed values out of n and cannot recover the secret information if the number is k-L or less is claimed. A means for applying the concealment secret information disclosed by the device of claim 1 to a distributed value obtained by applying different random numbers according to 2, and a distributed value in which different random numbers are applied to the same secret information output from the means. It functions as a means of calculating using.

In the program of the invention according to claim 11, n is an integer of 2 or more, k is an integer having a minimum value of 2 and a maximum value of n, and L is an integer of 1 or more and k or less, and secret information is distributed to n pieces. Then, if k distributed values out of n are collected, the secret information can be restored, and if the number is k-L or less, the secret information cannot be restored. When the number of arithmetic devices is t and the number of inputs is u, a means for performing secret sharing with n being ut or more, a means for dividing the distribution value into n / t units and multiplying them by different random numbers, and a different random number. It functions as a means for distributing at least one distribution value from the n / t distribution values multiplied by the concealment calculation device.

In the program of the invention according to claim 12, n is an integer of 2 or more, k is an integer having a minimum value of 2 and a maximum value of n, and L is an integer of 1 or more and k or less, and confidential information is distributed to n pieces. Then, if k of the n distributed values are collected, the secret information can be restored, and if the number is k-L or less, the confidential information cannot be restored. It functions as a means for multiplying each other, a means for deleting a random number from the product of distributed values to which a random number is applied, and a means for repeating a degree conversion process for the distributed value from which the random number has been deleted one or more times.

In the program of the invention according to claim 13, n is an integer of 2 or more, k is an integer having a minimum value of 2 and a maximum value of n, and L is an integer of 1 or more and k or less, and secret information is distributed to n pieces. The computer of the secret calculation device in the system that performs the secret calculation by using a means that can recover the secret information by collecting k distributed values out of n and cannot recover the secret information if the number is k-L or less is claimed. Concealment by 1 Means for concealing and subtracting the constant added in claim 1 from confidential information, means for verifying whether the concealment subtraction result is 0, and the inverse number from the concealed subtracted value when it is not 0. It functions as a means of generation.

In the program of the invention according to claim 14, n is an integer of 2 or more, k is an integer having a minimum value of 2 and a maximum value of n, and L is an integer of 1 or more and k or less, and secret information is distributed to n pieces. Then, if k distributed values out of n are collected, the secret information can be restored, and if the number is k-L or less, the secret information cannot be restored. It functions as a means for converting the distributed value with the same random number into the same random number as other distributed values, and as a means for restoring the secret information with the same random number or enabling the secret arithmetic unit to restore it.

The present invention can perform calculations efficiently.

It is a block diagram of the secret information distribution secret operation system of 1st Embodiment. It is a block diagram of the input person apparatus 12 of 1st Embodiment. It is a functional block diagram of the CPU 22 of the input person apparatus 12. It is a functional block diagram of the CPU 22 of the machines 14N0 to 14Nn-1. It is a flowchart of the program of variance 1. It is a flowchart of the program of secret product sum operation 1. It is a flowchart of the program of secret sharing 1. It is a flowchart of the program of concealment division 1. It is a flowchart of the program of variance 1'. It is a flowchart of the program of secret product sum operation 1'. It is a flowchart of the program of secret product sum operation 1'. It is a functional block diagram of the CPU 22 of the input person apparatus 12. It is a flowchart of the program of variance 2. It is a flowchart of the product sum program. It is a flowchart of the program of calculation support 2. It is a flowchart of the program of calculation support 2'. It is a flowchart of the program of concealment division 2. It is a block diagram of the secret information distribution secret operation system of 3rd Embodiment. It is a functional block diagram of the CPU 22 of the input person apparatus 12. It is a functional block diagram of the CPU 22 of the machines 14N0 to 14Nn-1. It is a sequence diagram of random number generation 3 for conversion. It is a sequence diagram of random number generation 3'for conversion. It is a flowchart of the program of variance 3. It is a flowchart of the program of the secret product sum operation 3. It is a block diagram of the secret information distribution secret operation system of the structure of 4th Embodiment. It is a flowchart of the program of variance 4. It is a flowchart of the program of the product-sum operation 4. It is a flowchart of the program of calculation support 4. It is a flowchart of the program of the variance 5 of the input person apparatus 12A. It is a flowchart of the program of the variance 5 of the input person apparatus 12B. It is a flowchart of the program of the dispersion 5 of the input person apparatus 12C. It is a flowchart of the program of the dispersion 5 of the arithmetic support apparatus 16. It is a flowchart of the program of the dispersion 5 of the machine 14NN. It is a sequence diagram of dispersion 5. It is a flowchart of the program of the secret product sum operation 5. It is a flowchart of the program of the secret product sum operation 5. It is a flowchart of the program of calculation support 5.

Hereinafter, an example of an embodiment of the present invention will be described in detail with reference to the drawings.
<First Embodiment>
First, the configuration of the first embodiment will be described.
As shown in FIG. 1, the secret information distribution secret calculation system of the first embodiment has an input user device 12 and a plurality of (N) machines 14N0 to 14Nn-1 connected to each other via a network 10. It is equipped with. The machines 14N0 to 14Nn-1 are neural network machines (NN machines). In the following, each of the machines 14N0 to 14Nn-1 may be marked with the machine 14Ni.

Since the input person device 12 and the machines 14N0 to 14Nn-1 have the same configuration, only the configuration of the input person device 12 will be described with reference to FIG. As shown in FIG. 2, the input device 12 includes a computer, and a CPU 22, a ROM 24, a RAM 26, a memory 28, an input device 30, a transmission / reception device 32, and a display device 34 are connected to each other via a bus 36. Has been done. A program to be described later is stored in the memory 28 of the input user device 12 and the machines 14N0 to 14Nn-1.

Next, with reference to FIG. 3, a function realized by executing a program by the CPU 22 of the input user device 12 will be described. The program has a distributed function. When the CPU 22 executes a program having this function, the CPU 22 functions as a distribution unit 42 as shown in FIG. The above program has a restoration function, and when the CPU 22 executes a program having this function, the CPU 22 functions as a restoration unit (not shown).

Next, with reference to FIG. 4, the functions realized by each CPU 22 of the machines 14N0 to 14Nn-1 executing the program will be described. The program has a secret product-sum calculation function and a secret division function. When the CPU 22 executes a program having this function, the CPU 22 functions as a secret product-sum calculation unit 44 and a secret division unit 46, as shown in FIG.

Next, the operation of this embodiment will be described.

In this embodiment, the secret sharing method is used. First, the secret sharing method will be explained. Shamir's (k, n) threshold secret sharing method (hereinafter referred to as the Shamir method), which is a typical secret sharing method, converts one secret information into n distributed values and distributes them to n servers. The feature of the Shamir method is that the original confidential information can be restored by collecting k distributed values from the distributed n distributed values, but from less than k information, no information related to the confidential information can be obtained. You can't get it. The algorithm of the Shamir method is shown below. Further, there is the TUS method shown below as a secret calculation method using the secret sharing method.

Shamir's (k, n) threshold secret sharing method (distributed processing)
The user selects an arbitrary prime number p that satisfies the conditions of s <p and n <p.

The user selects n _xi (i = 0, 1, 2, ..., N-1) from the source of GF (p) and uses them as server IDs.

The user selects k-1 random numbers a ( _l = 1, 2, ..., K-1) from the source of GF (p), and generates the following dispersion formula.

Wi _i = s + a ₁ x _i + a ₂ xi ² + ... + a _k-1 x _i ^k-1 (modp)

The user assigns each server ID to _xi in the above equation, calculates the distribution value _Wii , and sends it to each server _Si .

(Restore processing)
The distributed information used for restoration is Wi ( _i = 0, 1, 2, ..., K-1), and the server ID corresponding to the distributed information is _xi .

Substitute x _i and Wi _i into the distributed equation, solve k simultaneous equations, and restore the original secret information s. However, it is convenient to use the Lagrange interpolation formula when restoring the secret information s.

Further, a lamp type secret sharing method is also known in which secret information is divided into L pieces and included as a coefficient of the distributed type. This makes it possible to reduce the size of the variance value.

TUS method In the conventional secret multiplication, the variance value by the Shamir method is used as it is for multiplication, so that the degree of the polynomial changes and the number of variance values required for restoration increases to 2k-1. However, the TUS method proposed in Document 1 below generates confidential secret information by multiplying the secret information by a random number and secretly shares it. When performing secret multiplication, the secret information is temporarily restored and treated as a scalar quantity, and then multiplied with other variance values. As a result, since the degree of the polynomial does not increase when multiplied, it is possible to perform secret multiplication without changing the threshold value. However, since the secret information may be leaked in the secret multiplication, the secret information a and b do not include 0, and the random number does not include 0 (the secret information may include 0 other than the secret multiplication). In the TUS method, all confidential operations including secret sharing processing are performed using p as a method.

Reference 1: Takeshi Jingu, Keiichi Iwamura: "Proposal of a secret calculation method using a secret sharing method applicable to four arithmetic operations including division", Shingaku Giho 115 (122), 51-57, 2015-07- 02.

Reference 2: Takeshi Aoi, Takeshi Jingu, Keiichi Iwamura: "Safety study of confidentiality calculation in n <2k-1 and application with asymmetric secret sharing", Shingaku Giho 116 (129), 237-243, 2016- 07-14.

Problems of the TUS method It is shown in the above document 2 that the TUS method is composed of secret addition / subtraction and secret multiplication / division separately, and it is safe if they are used alone. However, it is not safe to perform a product-sum operation such as f (x) = ab + c by combining secret multiplication and secret addition. The following shows a case where the secret multiplication ab of the TUS method is performed in steps 1 to 5, and the secret addition ab + c is performed in steps 6 to 10. The secret information a, b, c is a, b, c ∈ Z / pZ, and the random numbers α _j, β _j , λ _j , and γ _j generated by the distributed processing and the secret addition are also α _j, β _{j, and} λ. _j, γ _j ∈ Z / pZ (however, a and the random number that are restored once in multiplication are not 0). In the following

Represents the variance value for a. All secret operations, including secret sharing processing, are performed in modulo p.

(Ab + c concealment operation)
input:

output:

を収集し、一時的にαａのスカラー量を復元し、全サーバＳ_ｉに送信する。 Step 1: Server S0 is from _k servers

Is collected, the scalar amount of αa is temporarily restored, and it is transmitted to all servers _Si .

を計算する。

Step 2: All servers _Si use the following formula

To calculate.

と

を収集し、α_ｊとβ_ｊを復元し、α_ｊβ_ｊを計算する。 Step 3: k servers _Sj

When

Is collected, α _j and β _j are restored, and α _j β _j is calculated.

Step 4: The k servers S _j distribute the random numbers α _j β _j to all the servers S _i by Shamir's (k, n) threshold secret sharing method.

を保持する。 Step 5: Server S _i (i = 0, 1, 2, ..., N-1) is used as distributed information regarding the secret information ab.

To hold.

と

を収集し、α_ｊβ_ｊとλ_ｊを復元する。それから、ｋ台のサーバＳ_ｊは乱数γ_ｊを生成し、サーバＳ_０にγ_ｊ／α_ｊβ_ｊ、γ_ｊ／λ_ｊを送信する。 Step 6: k servers _Sj

When

And restore α _j β _j and λ _j . Then, k servers S _j generate a random number γ _j , and transmit γ _j / α _j β _j and γ _j / λ _j to the server S ₀ .

Step 7: Server S ₀ calculates γ / αβ and γ / λ from the following equation using γ _j / α _j β _j and γ _j / λ _j , and sends them to all servers S _i .

を計算する。

Step 8: All servers _Si use the following formula

To calculate.

Step 9: The k servers S _j distribute the random number γ _j to all the servers S _i by Shamir's (k, n) threshold secret sharing method.

を保持する。 Step 10: The server S _i (i = 0, 1, 2, ..., N-1) is used as distributed information regarding the secret information ab + c.

To hold.

(Decryption process)
Procedure a: The restorer collects k pieces of distributed information [ab + c] _j from K servers.

からγ（ａｂ＋ｃ）、γ_０、・・・、γ_ｋ－１を復元し、乱数

を計算する。 Step b: Of the collected distributed information

Restore γ (ab + c), γ _0, ..., γ _k-1 from

To calculate.

Step c: The secret information ab + c is restored from the following equation using the restored secret information γ (ab + c) and the random number γ.
γ (ab + c) × γ ^-1 = ab + c

Since the product-sum operation is a three-input, one-output operation, it is assumed that there are three inputters and one output person. Here, consider the case where the attacker is a restorer and an input person of one value. For example, when the attacker is the inputter and the restorer of the secret information b, the attacker has the secret information b, the random number β, the random number γ for restoring the calculation result, the calculation result ab + c and k-1 entered by the inputter. It has information on αa, γ / αβ, and γ / λ leaked from the server. The attacker can obtain the random number α by using the information of the random numbers β, γ, and γ / αβ. The attacker can calculate the secret information a from the obtained random number α and αa obtained during the calculation. Then, the attacker can know the secret information c by using the secret information a and b and the calculation result ab + c. As a result, if the attacker has the input information of the input person B, the information of the restorer, and the information leaked from the k-1 server, there is a problem that the information of the remaining input persons is leaked. ..

Generally, in confidential calculation for big data, there are multiple inputters of confidential information, and the restorer who restores the confidential operation result is different from the input person or partly the same as the input person, and their interests are others. Suppose that it conflicts with. On the other hand, in NN, the input person is often one person or the same organization (hereinafter referred to as the input person) trying to solve a certain problem, and the input person prepares a lot of learning data and all secrets. Know information and calculation results. Here, it is assumed that the input person wants to conceal the problem of inputting and solving to the NN machine and the attacker who can monitor the NN machine. When secret sharing is used, the minimum is n = 2, but thereafter, we aim for n = 1 and propose an effective secret calculation method for the cases of n = 1 and 2.

First, when trying to solve a problem with an NN machine using secret sharing, even if you want to set n = k = 2, which is the minimum threshold value other than the TUS method, if secret multiplication is included, the number of NN machines corresponding to n is 3. It is known to require more than one. In addition, the TUS method cannot realize a safe product-sum calculation.

Therefore, as the first embodiment, consider a case where the input person and the restorer are the same person and the concealment calculation is realized by a minimum of two NN machines. In this case, the TUS method can be used because it is not guaranteed that the input information will not contain 0 and that the TUS method, in which the input person and the restorer are different and the interests conflict with each other, will be streamlined according to the above situation. The challenge is to realize a product-sum operation that includes 0 in the secret information that did not exist.

The four arithmetic operations can be realized by the combination of the product-sum operation ab + c. The TUS method could not safely execute the product-sum operation, but if the secret product-sum operation can be safely realized, any four arithmetic operations can be realized by the combination. However, in the present embodiment, it is assumed that one input person inputs all the confidential information a, b, and c. In the following, n NN machines will be described as an example, but if it is desired to minimize it, n = k = 2. Further, in the TUS method, since the secret information is directly multiplied by a random number and distributed, when αa is restored as a scalar quantity in the secret multiplication, if the secret information is a = 0, αa = 0, so the secret information includes 0. I couldn't. Further, since αa is not restored by the secret addition, a = 0 may be set, but αa must be secretly distributed, and the random numbers α0, α1, ..., Αk-1 constituting α must be secretly distributed. All information including was required to be secretly shared. Therefore, it takes a lot of time and effort to distribute and restore all the confidential information. In the following, the secret information is not dispersed only by directly applying a random number, and 1 is added to the secret information a. Therefore, even if a = 0, α (a + 1) = 0 does not hold. Therefore, α (a + 1) can be distributed as it is without being dispersed. Also, the input person can use α directly to know all the secrets. That is, it is not necessary to decompose it into α0, α1, ..., αk-1, and the like, which can greatly improve the efficiency of secret sharing.

In the following, the secret information a, b, c is a, b, c <p-1 because 1 is added, and the generated random numbers α, β, γ, δ are α, β, γ, δ ∈ Z / pZ. Yes (however, 0 is not selected as a random number). In addition, all operations including secret sharing processing are performed using p as a method. In addition, the following symbols are defined. Also, publishing a value means sending the value to all machines that perform confidential operations.

(Symbol definition)
[A] i indicates a dispersion value with respect to the value a held by the machine 14Ni.

[Dispersion 1]
Next, with reference to FIG. 5, the distribution 1 executed by the distribution unit 42 in the CPU 22 of the input user device 12 will be described.

In step 52, the dispersion unit 42 generates random numbers α, β, and γ. The random numbers α, β, and γ may be true random numbers or pseudo-random numbers. The same applies to each of the following random numbers.

In step 54, the dispersion unit 42 calculates α (a + 1), β (b + 1), and γ (c + 1) as follows.

α (a + 1) = α × (a + 1)
β (b + 1) = β × (b + 1)
γ (c + 1) = γ × (c + 1)

In step 56, the dispersion unit 42 transmits α (a + 1), β (b + 1), and γ (c + 1) to all machines 14N0 to 14Nn-1.

In step 58, the dispersion unit 42 generates a random number δ, in step 60, the dispersion unit 42 calculates δ / αβ, δ / α, δ / β, δ / γ, δ, and in step 62, the dispersion unit 42 generates a random number δ. Part 42 calculates the dispersion values [δ / αβ] _i , [δ / α] _i , [δ / β] _i , [δ / γ] _i , and [δ] _i of the secret dispersion (i = 0, ..., k-1).

In step 64, the dispersion unit 42 sets the dispersion values [δ / αβ] _i , [δ / α] _i , [δ / β] _i , [δ / γ] _i , and [δ] _i to the corresponding machines 14N0 to It is transmitted to the machine 14Ni in 14Nn-1.

The distribution unit 42 in the CPU 22 of the input person device 12 stores δ in the memory 28 of the input person device 12.

[Concealed multiply-accumulate operation 1]
Next, with reference to FIG. 6, the secret product-sum calculation unit in the CPU 22 of the machines 14N0 to 14Nn-1 having k or more predetermined machines (machine 14Ni (i = 0, ..., K-1)). The secret product-sum operation 1 executed by 44 will be described.
In step 72, the secret product-sum calculation unit 44 calculates the following.
[Δ (ab + c + 1)] _i = α (a + 1) × β (b + 1) × [δ / αβ] _i −α (a + 1) × [δ / α] _i −β (b + 1) × [δ / β] _i + γ ( c + 1) × [δ / γ] _i + [δ] _i

In step 74, the secret product-sum calculation unit 44 restores δ (ab + c + 1) in cooperation with a predetermined k or more machines.

In step 76, the secret product-sum calculation unit 44 stores δ (ab + c + 1) in the memory 28 of each machine 14N0 to 14Nn-1.

When the input person obtains the calculation result, the input person device 12 obtains δ (ab + c + 1) from any machine, divides it by the stored δ, and subtracts 1, to obtain the product-sum operation result ab + c. .. Alternatively, collect [δ] _i , restore it, divide by δ, and subtract 1. Further, 1 is added in the variance 1, but the value to be added is not limited to 1, and if it is another value, for example, 2, the following may be calculated as a product-sum operation.

[Δ (ab + c + 2)] _i = α (a + 2) × β (b + 2) × [δ / αβ] _i -2α (a + 2) × [δ / α] _i -2β (b + 2) × [δ / β] _i + γ ( c + 2) × [δ / γ] _i +4 [δ] _i

Other values may be, for example, values on Z / pZ corresponding to -1 and -2. The input person device 12 may obtain ab + c, which is the result of the product-sum operation, by dividing δ (ab + c-1) by the stored δ and adding 1 (or 2 or the like).

Further, in the secret multiply-accumulate operation 1, if c = 0, it is a secret multiplication, and if a = 1, it is a secret addition. Further, if + γ (c + 1) in step 72 of FIG. 6 is set to −γ (c + 1), the secret subtraction is performed. In the secret product sum operation 1, the information required for the secret product sum operation in step 72 other than the disclosed α (a + 1), β (b + 1), and γ (c + 1) is distributed, and since only the input user device 12 knows, an attack. A person cannot know anything other than publicly available information and is information-theoretically safe.

[Secret sharing 1]

In addition, confidential division is performed as follows. FIG. 7 shows a flowchart of the secret sharing 1 executed by the distribution unit 42 in the CPU 22 of the input person device 12 for the secret division.

In step 82, the dispersion unit 42 generates a random number α', and in step 84, the dispersion unit 42 calculates α'/ α.

In step 86, the distribution unit 42 calculates the distribution value of the secret distribution of α ′ / α and the secret distribution value of α ′.

In step 88, the distribution unit 42 transmits the distribution value of the secret distribution of α'/ α and the secret distribution value of α'to the corresponding machine 14Ni.

[Confidential division 1]
FIG. 8 shows a flowchart of the secret division 1 executed by the secret division unit 46 in each CPU 22 of the machines 14N0 to 14Nn-1.

In step 92, the secret division unit 46 calculates:
[Α'a] _i = α (a + 1) × [α'/ α] _i- [α'] _i

In step 94, the secret division unit 46 cooperates with another machine to restore [α'a] i.

In step 96, the concealment division unit 46 determines whether or not α'a = 0. If α'a = 0, the concealment division 1 ends.

If α'a = 0, in step 98, the concealment division unit 46 calculates 1 / α'a.

In step 100, the secret division unit 46 sends 1 / α'a as α (a + 1) to the secret product-sum calculation unit 44 for the secret product-sum operation 1. As a result, the secret product-sum calculation unit 44 obtains the result of changing multiplication to division. However, the calculation of −β (b + 1) × [δ / β] _i in step 72 of the secret product sum operation 1 is omitted because 1 is not added to 1 / α'a.

In the above secret division, when α'a = 0, it leaks that a = 0, but when the divisor is 0, the calculation cannot be performed and it is necessary to detect it and stop the calculation. Therefore, the division is divided. It is no problem to know that is 0. Therefore, the input person may generate [α'a] _i in advance and input it when necessary.

When the operations are continuous, the restored δ (ab + c + 1) is set as one of α (a + 1), β (b + 1), and γ (c + 1), and the other concealed operation results calculated by the same operation are α (a + 1). , Β (b + 1), γ (c + 1). Further, δ may be newly generated, and δ / αβ, δ / α, δ / β, δ / γ, and δ may be calculated for the random numbers that have become α, β, and γ.

In addition, although the input can be concealed by the above, since the four rules operation can be expressed by a combination of product-sum operations, if the problem to be solved is a dummy product-sum operation (a = b = c = 0, a dummy for addition). It is a product-sum operation process, and if a = b = 0 and c = 1, it is a dummy product-sum operation process for multiplication). Can also be kept secret.

Further, when the calculation is repeated, the distribution unit 42 in the CPU 22 of the input user device 12 newly generates δ in the distribution 1 (see FIG. 5), and δ / for the newly generated random numbers α, β, and γ. αβ, δ / α, δ / β, δ / γ, and δ are calculated, but if the calculation procedure is known in advance, it can be calculated in advance.

However, in this case, the dispersion unit 42 needs to calculate in advance according to the calculation procedure, and the burden on the distribution unit 42 may be large. Therefore, when it is desired to reduce the load on the distribution unit 42, the distribution unit 42 only needs to generate a random number and distribute it according to the following, and the subsequent processing can be executed only by the machines 14N0 to 14Nn-1. In the following, it is assumed that the machine 14Ni that performs the calculation from the n machines with n = k is fixed, and the case where the random numbers constituting α are directly sent to the machines will be described. If the variance 1'and the secret product sum operation 1'are not performed consecutively and the machine 14Ni to perform the operation is not determined, α _i , β _i , γ _i (i = 0, ..., k-1). Etc. may be secretly distributed to n machines, and the machines participating in the operation at the time of the secret operation may collect and restore k distributed values of the corresponding random numbers.

[Dispersion 1']
Next, the dispersion 1'executed by the dispersion unit 42 in the CPU 22 of the input user device 12 in the above case will be described with reference to FIG.

In step 102, the dispersion unit 42 has a set of k random numbers α ₀ , α ₁ , ..., α _k-1 and β ₀ , β ₁ , ..., β _k-1 , γ ₀ , γ ₁ . , ..., γ _k-1 is generated.

In step 104, the dispersion unit 42 calculates the following.

First, the dispersion unit 42 calculates α = α ₀ × α ₁ × ... × α _k-1 , and α (a + 1) = α × (a + 1).

The dispersion unit 42 calculates β = β ₀ × β ₁ × ... × β _k-1 , and β (b + 1) = β × (b + 1).

The dispersion unit 42 calculates γ = γ ₀ × γ ₁ × ... × γ _k-1 , and calculates γ (c + 1) = γ × (c + 1).

In step 106, the dispersion unit 42 transmits α (a + 1), β (b + 1), and γ (c + 1) to all machines 14N0 to 14Nn-1.

In step 110, the dispersion unit 42 transmits αi, βi, γi (i = 0, ..., K-1) to the corresponding machine 14Ni.

In step 112, the dispersion unit 42 has a set of k random numbers ε ₀ , ε ₁ , ..., ε _k-1 and φ ₀ , φ ₁ , ..., φ _k-1 , λ ₀ , λ ₁ . , ..., λ _k-1 , η ₀ , η ₁ , ..., η _k-1 , μ ₀ , μ ₁ , ..., Μ _k-1 .

In step 114, the dispersion unit 42 calculates the following:

ε ＝ ε ₀ × ε ₁ × ・ ・ ・ × ε _k-1
φ ＝ φ ₀ × φ ₁ × ・ ・ ・ × φ _k-1
λ = λ ₀ × λ ₁ × ・ ・ ・ × λ _k-1
η = η ₀ × η ₁ × ・ ・ ・ × η _k-1
μ = μ ₀ × μ ₁ × ・ ・ ・ × μ _k-1
In step 116, the dispersion unit 42 calculates the dispersion values [ε] _i , [φ] _i , [λ] _i , [η] _i , and [μ] _i of ε, φ, λ, η, and μ.

In step 118, the dispersion unit 42 has the dispersion values [ε] _i , [φ] _i , [λ] _i , [η] _i , [μ] _i and ε _i , φ _i , λ _i , η _i , μ _i . To the corresponding machine.

[Confidential multiply-accumulate operation 1']
Next, the secret product-sum calculation 1'executed by the secret product-sum calculation unit 44 in each of the CPUs 22 of the machines 14N0 to 14Nn-1 will be described with reference to FIG.

In step 122, the secret product-sum calculation unit 44 generates a random number δ _i .

In step 124, the concealed sum-of-sum calculation unit 44 has δ _i / α _i β _i ε _i , δ _i / α _i φ _i , δ _i / β _i λ _i, δ _i / γ _i η _i , δ _i μ _i . To calculate.

In step 126, the concealed sum-of-sum calculation unit 44 has δ _i / α _i β _i ε _i , δ _i / α _i φ _i , δ _i / β _i λ _i, δ _i / γ _i η _i , δ _i μ _i . Is transmitted to a predetermined machine 14N0 (when n = k = 2, two machines may exchange each other).

As shown in FIG. 11, the secret product-sum calculation unit 44 in the CPU 22 of the predetermined machine 14N0 calculates the following δ / αβε, δ / αφ, δ / βλ, δ / γη, μ in step 142. , In step 146, each value calculated in step 142 is transmitted to all machines (when the values are exchanged with each other in step 126, the processing of FIG. 11 is unnecessary, and all machines have δ / αβε and δ / αφ. , Δ / βλ, δ / γη, μ. That is, step 128 is changed to “calculate δ / αβε, δ / αφ, δ / βλ, δ / γη, μ”).

とは同じである。 In addition, with "φ"

Is the same as.

In step 128, the secret product-sum calculation unit 44 receives δ / αβε, δ / αφ, δ / βλ, δ / γη, μ transmitted from the predetermined machine 14N0.

In step 130, the secret product-sum calculation unit 44 calculates the following.
[Αβε (a + 1) (b + 1)] _i = α (a + 1) × β (b + 1) × [ε] _i
[Αφ (a + 1)] _i = α (a + 1) × [φ] _i , [βλ (b + 1)] _i = β (b + 1) × [λ] _i , [γη (c + 1)] _i = γ (c + 1) × [ η] _i

In step 132, the secret product-sum calculation unit 44 calculates the following.
[Δ (ab + c + 1)] _i = δ / αβε × [αβε (a + 1) (b + 1)] _i －δ / αφ × [αφ (a + 1)] _i －δ / βλ × [βλ (b + 1)] _i + δ / γη × [Γη (c + 1)] _i + δ / μ × [μ] _i

Generated in steps 112 to 118 in dispersion 1'and sent to each machine ([ε] _i , ε _i ), ([φ] _i , φ _i ), ([λ] _i , λ _i ), ([η) ] _i , η _i ), ([μ] _i , μ _i ) are called conversion random numbers as described later, but they do not necessarily have to be generated by the inputter device, as shown in the third embodiment. It may be generated between machines or by other machines. Also, ([ε] _i , ε _i ), ([φ] _i , φ _i ), ([λ] _i , λ _i ), ([η] _i , η _i ), ([μ] _i , μ _i ). ) May be prepared in advance. In the secret product sum operation 1', the δ corresponding to the next α, β, γ is distributed during the operation, and the new δ is also generated by the machines 14N0 to 14Nn-1 during the operation. Calculation can be continued without processing.

In recent years, there has been a growing movement to make NN machines publicly available for free use. When there are two such public NN machines, it is safe as long as the information of all NN machines is not leaked according to the first embodiment, and only two NN machines are prepared, which is an advantage that cannot be realized by the conventional method. Can be realized. In addition, it is possible to efficiently obtain the concealed operation result while concealing the problem solved by the fixed combination of the product-sum operation that could not be safely performed by the TUS method. Further, the input person device is a restorer device, and many processes can be streamlined because all the information is known. This allows an individual or the same organization to use a publicly available NN machine to perform desired concealment operations without leaking their confidential information and the problem they are trying to solve to an NN machine or attacker.

<Second embodiment>
Since the secret information distribution secret calculation system of the second embodiment has the same configuration as that of the first embodiment, the same components are designated by the same reference numerals and the description thereof will be omitted. However, the input person device 12 is also a calculation support device.

Further, in the second embodiment, one predetermined machine 14NN among the machines 14N0 to 14Nn-1 performs the concealment operation.

In the secret sharing method, the number of distributed secret information and the number of machines performing operations are the same. In this embodiment, since the number of machines performing operations and the number of variances in secret sharing are different, the number of machines performing operations is set to N (1 in this embodiment), and the number of variances and thresholds related to secret sharing are n and. It is expressed by k (n and k can be any number, but in the following, the minimum value is n = k = 2 for the sake of simplicity).

How to safely execute a secret operation using secret sharing on one machine 14NN, or how to perform a secret operation when the number of machines to perform the operation and the number of distributed secret information are different is a big issue. No example has ever achieved that.

In the second embodiment, in order to safely execute secret sharing on one NN machine, two random numbers δ ₀ and δ ₁ are introduced, which will be described in detail later, and different random numbers are generated for each distribution value. It is characterized by performing calculations by multiplying.

Next, the function realized by executing the program by the CPU 22 of the input person apparatus 12 in the second embodiment will be described. The program has a distributed function and a calculation support function. When the CPU 22 executes a program having these functions, the CPU 22 functions as a distribution unit 42 and a calculation support unit 150, as shown in FIG.

[Dispersion 2]
First, with reference to FIG. 13, the distribution 2 executed by the distribution unit 42 in the CPU 22 of the input user device 12 will be described.

In step 152, the dispersion unit 42 generates random numbers α, β, and γ.

In step 154, the dispersion unit 42 calculates α (a + 1), β (b + 1), and γ (c + 1) as follows.
α (a + 1) = α × (a + 1)
β (b + 1) = β × (b + 1)
γ (c + 1) = γ × (c + 1)

In step 156, the dispersion unit 42 transmits α (a + 1), β (b + 1), and γ (c + 1) to one machine 14NN.

In step 158, the dispersion unit 42 generates random numbers δ ₀ and δ ₁ .

In step 160, the dispersion unit 42 calculates the dispersion value of the secret dispersion of δ ₀ / αβ, δ ₀ / α, δ ₀ / β, δ ₀ / γ, and [δ ₀ / αβ] ₀ , [δ ₀ /]. α] ₀ , [δ ₀ / β] ₀ , [δ ₀ / γ] ₀ and δ ₀ / αβ] ₁ , [δ ₀ / α] ₁ , [δ ₀ / β] ₁ , [δ ₀ / γ] ₁ To get.

In step 162, the variance unit 42 calculates the following (δ = δ ₀ δ ₁ ).
[Δ / αβ] ₁ = δ ₁ × [δ ₀ / αβ] ₁
[Δ / α] ₁ = δ ₁ × [δ ₀ / α] ₁
[Δ / β] ₁ = δ ₁ × [δ ₀ / β] ₁
[Δ / γ] ₁ = δ ₁ × [δ ₀ / γ] ₁
In step 164, the dispersion unit 42 has [δ ₀ / αβ] ₀ , [δ ₀ / α] ₀ , [δ ₀ / β] ₀ , [δ ₀ / γ] ₀ and [δ / αβ] ₁ , [δ]. / Α] ₁ , [δ / β] ₁ , [δ / γ] ₁ are transmitted to the machine 14NN.

[Multiply-accumulate calculation 2]

Next, the product-sum calculation 2 executed by the secret product-sum calculation unit 44 in the CPU 22 of the machine 14NN will be described with reference to FIG.

In step 172, the secret product-sum calculation unit 44 calculates the following.
[Δ ₀ (ab + c)] ₀ = α (a + 1) × β (b + 1) × [δ ₀ / αβ] ₀ -α (a + 1) × [δ ₀ / α] ₀ -β (b + 1) × [δ ₀ / β ] ₀ + γ (c + 1) × [δ ₀ / γ] ₀
[Δ (ab + c)] ₁ = α (a + 1) × β (b + 1) × [δ / αβ] ₁ -α (a + 1) × [δ / α] ₁ -β (b + 1) × [δ / β] ₁ + γ ( c + 1) × [δ / γ] ₁

[Calculation support 2]

Next, when the calculation is continued or terminated, the calculation support 2 executed by the calculation support unit 150 in the CPU 22 of the input person device 12 will be described with reference to FIG.

In step 182, the arithmetic support unit 150 collects [δ ₀ (ab + c)] ₀ and [δ (ab + c)] ₁ .

In step 184, the calculation support unit 150 calculates [δ (ab + c)] ₀ = δ ₁ [δ ₀ (ab + c)] ₀ .

In step 186, the arithmetic support unit 150 restores δ (ab + c).

In step 187, the calculation support unit 150 determines whether or not to continue the calculation. This is determined by whether the arithmetic processing being executed ends there or there is processing to continue, that is, it depends on the program set by the input person. When continuing the calculation, in step 188, the calculation support unit 150 calculates δ (ab + c + 1) = δ (ab + c) + δ.

Then, in step 190, the arithmetic support unit 150 transmits δ (ab + c + 1) to the machine 14NN.

When the calculation result is obtained without continuing the calculation, in step 192, the calculation support unit 150 divides δ (ab + c) by δ to calculate ab + c.

However, when performing an operation to continue addition / subtraction, the addition / subtraction may be continued by combining the coefficients with other [δ ₀ (ab + c)] ₀ and [δ (ab + c)] ₁ without performing the operation support 2. Further, the multiplication / division balance can be directly repeated as α (a + 1) × β (b + 1). That is, it is not necessary to perform the calculation support process in the repetition of addition / subtraction or multiplication / division, and it may be performed once when the addition / subtraction and multiplication / division such as the product-sum operation are combined. Since [δ ₀ (ab + c)] ₀ and [δ (ab + c)] ₁ calculated in the product-sum operation 2 are multiplied by different random numbers δ ₀ and δ that are independently determined, they are correct even if k = 2. It cannot be restored and information-theoretic security can be achieved.

[Operation support 2']

Next, the calculation support 2'executed by the calculation support unit 150 in the CPU 22 of the input person device 12 will be described with reference to FIG.

In step 202, the calculation support unit 150 collects [δ ₀ (ab + c)] ₀ and [δ (ab + c)] ₁ .

In step 203, the calculation support unit 150 calculates the following.
[Δ ₀ (ab + c + 1)] ₀ = [δ ₀ (ab + c + 1)] ₀ + [0] ₀ + δ ₀
[Δ (ab + c + 1)] ₁ = [δ (ab + c + 1)] ₁ + [0] ₁ + δ
Here, [0] ₀ and [0] ₁ are variance values of the constant term 0 and can be prepared in advance.

In step 204, the calculation support unit 150 determines whether or not to continue the calculation.

If the calculation is to be continued, the calculation result is transmitted to the machine 14NN in step 205.

When the calculation is not continued (step 204: N), in step 206, the calculation support unit 150 multiplies [δ ₀ (ab + c + 1)] ₀ by δ ₁ to generate [δ (ab + c + 1)] ₀ . Then, in step 207, [δ (ab + c + 1)] ₀ and [δ (ab + c + 1)] ₁ are restored to δ (ab + c + 1), divided by δ, and 1 is subtracted to obtain ab + c.

By doing so, the trouble of restoring the input user device 12 is eliminated except when the final calculation result is obtained by the calculation support 2'.

If the machine 14NN restores δ (ab + c + 1) and makes it one of α (a + 1), β (b + 1), and γ (c + 1), it is clear that the operation can be continued.

Further, in the secret multiply-accumulate operation, if c = 0, it is a secret multiplication, and if a = 1, it is a secret addition. Further, in step 172 of FIG. 14, if + of ab + c is set to − and ab−c is set, that is, + γ (c + 1) is set to −γ (c + 1), the secret subtraction is performed.

[Confidential division 2]

Next, the concealment division 2 executed by the calculation support unit 150 (may be the distribution unit 42) in the CPU 22 of the input person device 12 will be described with reference to FIG. The distribution unit 42 in the CPU 22 of the input person device 12 for the confidential division executes steps 82 to 86 in FIG. 7.

In step 220, the calculation support unit 150 generates a random number α ″.

In step 222, the calculation support unit 150 calculates the following.
[Α ″ / α] ₁ = (α ″ / α ′) [α ′ / α] ₁
[Α ″] ₁ = (α ″ / α ′) [α ′] ₁

In step 226, the concealment division unit 46 transmits [α'/ α] ₀ , [α'] ₀ , [α ″ / α] ₁ , and [α ″] ₁ to the machine 14NN.

The machine 14NN calculates the following and sends it to the input person device 12.

[Α'a] ₀ = α (a + 1) × [α'/ α] _0- [α'] ₀
[Α ″ a] ₁ = α (a + 1) × [α ″ / α] _1- [α ″] ₁

Therefore, in step 228, the calculation support unit 150 receives [α'a] ₀ and [α ″ a] ₁ .

In step 230, the arithmetic support unit 150 restores α ″ a from [α ″ a] ₀ = (α ″ / α ′) [α ′ a] ₀ and [α ″ a] ₁ .

In step 232, the calculation support unit 150 determines whether or not α ″ a = 0. If α ″ a = 0, the concealment division 2 is terminated.

If α "a = 0, the calculation support unit 150 calculates 1 / α" a in step 234.

In step 236, the calculation support unit 150 sends 1 / α ″ a as α (a + 1) to the secret product-sum calculation unit 44 for the secret product-sum calculation 2, whereby the secret product-sum calculation unit 44 multiplies. However, since 1 is not added to 1 / α ″ a, the calculation of subtracting β (b + 1) in step 172 of the secret multiply-accumulate operation 2 is omitted.

In the secret division 2, steps 222 to 228 in FIG. 17 can be executed in advance, and steps 230 to 236 provide arithmetic support in the secret division. Further, the processing of steps 228 to 236 may not be performed by the calculation support unit, but may be performed by the machine 14NN as it is.

Further, if the process of secretly dispersing α, β, and γ is added after step 156 of FIG. 13 of the dispersion 2, and the process of restoring α, β, and γ is added after step 164, the process of dispersion 2 from step 152 to Even if the execution start times differ greatly between 156 and steps 158 to 164, the distribution unit 42 in the CPU 22 of the input user device 12 stores α, β, and γ used for concealing confidential information. It can be executed without any calculation, and even if steps 158 to 164 are not calculated in advance, it can be processed during the calculation as calculation support.

According to the second embodiment, even if there is only one machine 14NN, the confidential information of the input user device 12 and the problem to be solved can be prevented from being leaked. Conventionally, when there is only one NN machine, the secret sharing method cannot be applied and there is no choice but to use homomorphic encryption which requires a huge amount of calculation, but this problem can be solved by the second embodiment.

<Third embodiment>
Next, a third embodiment will be described. Since the configuration of the third embodiment has the same parts as the configuration of the first embodiment, the same parts are designated by the same reference numerals and detailed description thereof will be omitted.

As shown in FIG. 18, the secret information distribution secret calculation system of the third embodiment is connected to each other via the network 10, for example, three inputter devices 12A to 12C, and a plurality (N). The machines 14N0 to 14Nn-1 and the restorer device 18 are provided. The third embodiment is different from the first embodiment in that it includes three inputter devices 12A to 12C having confidential information a, b, and c, respectively, and includes the following restorer device 18. ..

Next, the function realized by executing the program by the CPU 22 of the restorer device 18 in the third embodiment will be described. The program has a restore function that collects distributed values and restores confidential information. When the CPU 22 executes a program having these functions, the CPU 22 of the restorer device 18 functions as a restore unit 242 as shown in FIG.

Next, the functions realized by each CPU 22 of the machines 14N0 to 14Nn-1 in the third embodiment will be described. The program has a random number generation function for conversion, a secret product-sum calculation function, and a secret division function. When the CPU 22 executes a program having this function, the CPU 22 functions as a conversion random number generation unit 244, a secret product-sum calculation unit 44, and a secret division unit 46, as shown in FIG.

The machines 14N0 to 14Nn-1 further function as a conversion random number generator.

In the third embodiment, the plurality of (for example, three) inputter devices 12A to 12C and the restorer device 18 that knows the result are different, and the plurality of machines (minimum is n = k = 2) 14N0 to 14Nn. Consider the case of confidential calculation with -1.

In the TUS method, secret addition and secret multiplication are safe by themselves, but it is known that if multiplication and addition are combined like a product-sum operation, there is a safety problem such as leakage of confidential information of the input person. .. Therefore, even in such a case, the generation of a random number for conversion becomes an issue so that the confidential calculation can be safely realized. Since the same input / output person device is assumed in the first and second embodiments, the above problem occurs because there are no plurality of input / output persons having conflicting interests even if the product-sum operation is performed by the TUS method. I didn't.

Here, the input person device having the confidential information a, b, and c (hereinafter, also referred to as “input person” in the third embodiment) is different, and the restorer device (hereinafter, also referred to as “input person” in the third embodiment) is different. (Also called "restorer") is also different, and consider the case where interests conflict. Further, it is assumed that there are a plurality of machines (minimum is N = n = k = 2). It also generates the following conversion random numbers to protect its confidential information from other inputters and restorers. It was not known how to secretly generate this conversion random number by multiple untrusted inputters. For example, as in steps 112 to 118 of FIG. 9 of the variance 1'of the first embodiment, a method of generating by one input person is known, but this input person knows the value of the random number for conversion. .. Therefore, if the input person device is an attacker, the confidential calculation using it is not safe, and the input person device must be reliable as in the first embodiment. On the other hand, the generation method in which the conversion random number is not specified even if there is no reliable input person is shown below.

Documents 3 and 4 below show a method of converting a variance value generated by using a polynomial of order 2k into a variance value for a polynomial of order k. For example, in the method of Document 3, the following matrix A whose elements are constants generated by a certain rule is used for the variance vector W = (W0, W1, ..., W2k-1) for a polynomial of order 2k. R = WA can be calculated and converted into a variance vector R = (R0, R1, ..., R2k-1) for a polynomial of degree k (the method of Document 4 is also processed in almost the same manner). realizable). However, the methods of Documents 3 and 4 are effective when the number of machines N is N ≧ 2k-1, but in this embodiment N <2k-1, that is, the actual number of machines N satisfies N ≧ 2k-1. Handle the case that does not exist.

Reference 3: M. Ben-Or, S. Goldwasser, and A. Wigderson, “Completeness theorems for non-cryptographic fault-tolerant distributed computation,” STOC '88, 1988, pp. 1-10, ACM Press.

Reference 4: Rosario Gennaro, Michael O. Rabin, and Tal Rabin, “Simplified VSS and fast-track multiparty computations with applications to threshold cryptography,” In Brian A. Coen and Yehuda Afek, editors, PODC, 1998, pp. 101- 111, ACM.

Hereinafter, a case where the conversion random number generation unit by u inputters generates the conversion random number using the conversion random number generation unit 244 of N = t = k machines will be described with reference to FIG. 21. .. In the following, the input person means an input person device, and _Si can be a machine 14Ni. However, this input person, _Si , etc. do not have to be the same as each device that performs the secret product-sum calculation described later, and may be generated by another secret calculation system, or the system itself may be a random number generation system for conversion. It may be dedicated as.

[Random number generation for conversion 3]

(Process 3 (1))
The input person i (i = 0, ..., U-1) is a random number λ _{i, 0} , ..., λ _{i, t-1} , α _{i, 0} , ..., α _{i, t-1} , Generate β _{i, 0} , ..., β _{i, t-1} , ..., γ _{i, 0} , ..., γ _{i, t-1} , and calculate the following.
λ _i = λ _{, 0} × ・ ・ ・ × λ _{i, t-1} , α _i = α _{i, 0} × ・ ・ ・ × α _{i, t-1} , β _i = β _{i, 0} × ・ ・ ・ × β _{i, t-1} , ..., γ _i = γ _{i, 0} × ... × γ _{i, t-1}

(Process 3 (2))
The input person i is k = t, n = ut (strictly speaking, n = u (k-1) + 1 or more), and λ _i is secretly distributed using the Shamir method, and [λ _i ] ₀ , ..., [Λ _i ] Obtain _ut-1 .

(Process 3 (3))

The input person i divides the generated variance value every t and multiplies it by a random number as follows.
[Α _i λ _i ] _t = α _i × [λ _i ] _t , ..., [α _i λ _i ] _2t-1 = α _i × [λ _i ] _2t-1 ,
[Β _i λ _i ] _2t = β _i × [λ _i ] _2t , ..., [β _i λ _i ] _3t-1 = β _i × [λ _i ] _3t-1 ,
:
[Γ _i λ _i ] _{(u-1) t} = γ _i × [λ _i ] _{(u-1) t} , ..., [γ _i λ _i ] _ut-1 = γ _i × [λ _i ] _{ut- 1}

(Process 3 (4))
The input person i is [λ _i ] _j , [α _i λ _i ] _{j + t} , [β _i λ _i ] _{j + 2t} , ..., [γ _i λ _i ] _{j + (u-1) t} , λ _{i, j} , α. _{i, j} , β _{i, j} , ..., γ _{i, j} are sent to machine S _j (j = 0, ..., t-1) which is machine 14Nj.

(Process 3 (5))
S _i (i = 0, ..., T-1) calculates the following. However, since the following multiplication is a multiplication of variance values, the multiplication result is equivalent to the variance value by the Shamir method in which k = u (t-1) + 1 and n = ut.
[Λ ₀ λ ₁ ... λ ₃ ] _i = [λ ₀ ] _i × [λ ₁ ] _i × ・ ・ ・ × [λ _u-1 ] _i ,

[Α ₀ α ₁ ... α ₃ λ ₀ λ ₁ ... λ ₃ ] _{i + t} = [α ₀ λ ₀ ] _{i + t} × [α ₁ λ ₁ ] _{i + t} × ・ ・ ・ × [α _u-1 λ _{u- 1} ] _{i + t}
[Β ₀ β ₁ ... β ₃ λ ₀ λ ₁ ... λ ₃ ] _{i + 2t} = [β ₀ λ ₀ ] _{i + 2t} × [β ₁ λ ₁ ] _{i + 2t} × ・ ・ ・ × [β _u-1 λ _{u- 1} ] _{i + 2t}
:
[Gamma ₀ γ ₁ ... γ ₃ λ ₀ λ ₁ ... λ ₃ ] _{i + (u-1) t} = [γ ₀ λ ₀ ] _{i + (u-1) t} × [γ ₁ λ ₁ ] _{i + ( u-1) t} × ・ ・ ・ × [γ _u-1 λ _u-1 ] _{i + (u-1) t}

(Process 3 (6))
S _i (i = 0, ..., t-1) is α _{0, i} × α _{1, i} ... × α _{u-1, i} , β _{0, i} × β _{1, i} ... × β _{u-1, i} , ..., γ _{0, i} × γ _{1, i} ... × γ _{u-1, i} is calculated and sent to S ₀ . In addition, λ'i = λ _{0, i ×} λ _{1, i} × λ _{2, i} × ... × λ _{u-1, i} is calculated.

(Process 3 (7))

S ₀ is the product of all the sent α _{0, i} × α _{1, i} ... × α _{u-1, i} , and α ₀ α ₁ ... α _u-1 , β _{0, i} × β. _{1, i} ... × β _u-1 is multiplied to β ₀ β ₁ ... β _u-1 , ..., γ _{0, i} × γ _{1, i} ... × γ _{u-1, i} Multiply γ ₀ γ ₁ ... γ _u-1 is calculated and sent to all machines.

(Process 3 (8))

S _i (i = 0, ..., T-1) calculates the following. However, λ = λ ₀ λ ₁ ... λ _u-1 .
[Λ] _{i + t} = [α ₀ α ₁ ... α ₃ λ ₀ λ ₁ ... λ ₃ ] _{i + t} / (α ₀ α ₁ ... α ₃ )
[Λ] _{i + 2t} = [β ₀ β ₁ ... β ₃ λ ₀ λ ₁ ... λ ₃ ] _{i + 2t} / (β ₀ β ₁ ... β ₃ )
:
[Λ] _{i + (u-1) t} = [γ ₀ γ ₁ ... γ ₃ λ ₀ λ ₁ ... λ ₃ ] _{i + (u-1) t} / (γ ₀ γ ₁ ... γ ₃ )

(Process 3 (9))
S _i (i = 0, ..., T-1) calculates [0 _i ] _j secretly distributed using the Shamir method with 0 as k = u (t-1) / 2 + 1, n = ut / 2. Then, the following is calculated and R _{i, j} , R _{i, j + t} , ..., R _{i, j + u't} are sent to S _j . However, h = 0, ..., 2t-1, u'= u / 4, and _{ai and h} are elements of the matrix A.
R _{i, h} = _{ai, h} × [λ] _i + a _{i + t, h} × [λ] _{i + t} + a _{i + 2t, h} × [λ] _{i + 2t} + ... + a _i + _{(u-1) t, h} × [λ ] _{I + (u-1) t} + [0 _i ] _h ,

(Process 3 (10))

S _i (i = 0, ..., T-1) is obtained by calculating the following [λ] _i , ..., [λ] _{i + u "-1} and the order is halved (u" + 1 , Ut / 2). However, u "= u (t-1) / 2
[Λ] _i = R _{0, i} + ... + R _{t-1, i} , [λ] _{i + u'} = R _{0, i + u'} + ... + R _{t-1, i + u'} ,,,

(Process 3 (11))

S _i (i = 0, ..., T-1) repeats the order conversion process of (9) and (10) until the required order is reached, and the conversion random number {λ} _i = ([λ] _i , λ). ′ _I ) is generated.

Since the above description is complicated, the case of u = 4, N = t = k = 2 will be specifically described below (see also FIG. 22).

[Random number generation for conversion 3']
(Processing 3'(1))
Input person 0 generates random numbers λ ₀ , 0, λ ₀ , 1, α ₀ , 0, α 0, ₁ , β ₀ , 0, β 0, ₁ , γ ₀ , 0, γ ₀ , 1, and the following calculate.
λ ₀ = λ 0, ₀ × λ ₀ , 1, α ₀ = α 0, ₀ × α ₀ , 1, β ₀ = β 0, ₀ × β ₀ , 1, γ ₀ = γ 0, ₀ × γ _{0, 1}

(Processing 3'(2))
The input person 0 secretly shares λ ₀ by the (2,8) Shamir method to obtain [λ ₀ ] ₀ , ..., [λ ₀ ] ₇ .

(Processing 3'(3))
Input person 0 calculates the following.
[Α ₀ λ ₀ ] ₂ = α ₀ × [λ ₀ ] ₂ , [α ₀ λ ₀ ] ₃ = α ₀ × [λ ₀ ] ₃
[Β ₀ λ ₀ ] ₄ = β ₀ × [λ ₀ ] ₄ , [β ₀ λ ₀ ] ₅ = β ₀ × [λ ₀ ] ₅
[Γ ₀ λ ₀ ] ₆ = γ ₀ × [λ ₀ ] ₆ , [γ ₀ λ ₀ ] ₇ = γ ₀ × [λ ₀ ] ₇

(Processing 3'(4))
Input person 0 is [λ ₀ ] ₀ , [α ₀ λ ₀ ] ₂ , [β ₀ λ ₀ ] ₄ , [γ ₀ λ ₀ ] ₆ , λ ₀ , 0, α ₀ , 0, β ₀ , 0, γ Send _0,0 to machine _S0 .

(Processing 3'(5))
Input person 0 is [λ ₀ ] ₁ , [α ₀ λ ₀ ] ₃ , [β ₀ λ ₀ ] ₅ , [γ ₀ λ ₀ ] ₇ , λ ₀ , 1, α ₀ , 1, β ₀ , 1, γ _{Send 0,1} to machine S1.

(Processing 3'(6))
Input person 1 generates random numbers λ _1,0 , λ _1,1 , α _1,0 , α _1,1 , β _1,0 , β _1,1 , γ _1,0 , γ ₁ , 1, and the following calculate.
λ ₁ = λ _1,0 × λ _1,1 , α ₁ = α _1,0 × α _1,1 , β ₁ = β _1,0 × β _1,1 , γ ₁ = γ _1,0 × γ _{1, 1}

(Processing 3'(7))
The input person 1 secretly shares λ ₁ by the (2,8) Shamir method to obtain [λ ₁ ] ₀ , ..., [λ ₁ ] ₇ .

(Processing 3'(8))
Input person 1 calculates the following.
[Α ₁ λ ₁ ] ₂ = α ₁ × [λ ₁ ] ₂ , [α ₁ λ ₁ ] ₃ = α ₁ × [λ ₁ ] ₃
[Β ₁ λ ₁ ] ₄ = β ₁ × [λ ₁ ] ₄ , [β ₁ λ ₁ ] ₅ = β ₁ × [λ ₁ ] ₅
[Γ ₁ λ ₁ ] ₆ = γ ₁ × [λ ₁ ] ₆ , [γ ₁ λ ₁ ] ₇ = γ ₁ × [λ ₁ ] ₇

(Processing 3'(9))
Inputter 1 is [λ ₁ ] ₀ , [α ₁ λ ₁ ] ₂ , [β ₁ λ ₁ ] ₄ , [γ ₁ λ ₁ ] ₆ , λ 1, ₀ , α 1, ₀ , β 1, ₀ , γ _{Sends 1,0} to machine S0.

(Processing 3'(10))
Inputter 1 is [λ ₁ ] ₁ , [α ₁ λ ₁ ] ₃ , [β ₁ λ ₁ ] ₅ , [γ ₁ λ ₁ ] ₇ , λ ₁ , 1, α ₁ , 1, β ₁ , 1, γ. Sends ₁ and ₁ to machine S0.

(Processing 3'(12))
Inputters 2 and 3 also perform the same processing. Therefore, S ₀ holds the following.

[Λ ₀ ] ₀ , [λ ₁ ] ₀ , [λ ₂ ] ₀ , [λ ₃ ] ₀ , [α ₀ λ ₀ ] ₂ , [α ₁ λ ₁ ] ₂ , [α ₂ λ ₂ ] ₂ , [α ₃ λ ₃ ] ₂ , [β ₀ λ ₀ ] ₄ , [β ₁ λ ₁ ] ₄ , [β ₂ λ ₂ ] ₄ , [β ₃ λ ₃ ] ₄ , [γ ₀ λ ₀ ] ₆ , [γ ₁ λ ₁ ] ₆ , [γ ₂ λ ₂ ] ₆ , [γ ₃ λ ₃ ] ₆ ,
λ ₀ , 0, λ 1, ₀ λ 2, ₀ λ ₃ , 0, α ₀ , 0, α ₁ , 0, α ₂ , 0, α ₃ , 0, β ₀ , 0, β 1, ₀ , β _{2 , 0} , β _3,0 , γ ₀ , 0, γ _1,0 , γ _2,0 , γ _3,0

(Processing 3'(13))
S ₁ holds the following.

[Λ ₀ ] ₁ , [λ ₁ ] ₁ , [λ ₂ ] ₁ , [λ ₃ ] ₁ , [α ₀ λ ₀ ] ₃ , [α ₁ λ ₁ ] ₃ , [α ₂ λ ₂ ] ₃ , [α ₃ λ ₃ ] ₃ , [β ₀ λ ₀ ] ₅ , [β ₁ λ ₁ ] ₅ , [β ₂ λ ₂ ] ₅ , [β ₃ λ ₃ ] ₅ , [γ ₀ λ ₀ ] ₇ , [γ ₁ λ ₁ ] ₇ , [γ ₂ λ ₂ ] ₇ , [γ ₃ λ ₃ ] ₇ ,
λ ₀ , 1, λ 1, ₁ λ ₂ , 1 λ ₃ , 1, α ₀ , 1, α _{1, 1} , α ₂ , 1, α ₃ , 1, β ₀ , 1, β 1, ₁ , β _{2 , 1} , β _3,1 , γ ₀ , 1, γ ₁ , 1, γ ₂ , 1, γ 3, ₁

(Processing 3'(14))
S ₀ calculates the following. The multiplication result is equivalent to the variance value by the (5,8) Shamir method.
[Λ ₀ λ ₁ λ ₂ λ ₃ ] ₀ = [λ ₀ ] ₀ × [λ ₁ ] ₀ × [λ ₂ ] ₀ × [λ ₃ ] ₀ ,
[Α ₀ α ₁ α ₂ α ₃ λ ₀ λ ₁ λ ₂ λ ₃ ] ₂ = [α ₀ λ ₀ ] ₂ × [α ₁ λ ₁ ] ₂ × [α ₂ λ ₂ ] ₂ × [α ₃ λ ₃ ] ₂
[Β ₀ β ₁ β ₂ β ₃ λ ₀ λ ₁ λ ₂ λ ₃ ] ₄ = [β ₀ λ ₀ ] ₄ × [β ₁ λ ₁ ] ₄ × [β ₂ λ ₂ ] ₄ × [β ₃ λ ₃ ] ₄
[Gamma ₀ γ ₁ γ ₂ γ ₃ λ ₀ λ ₁ λ ₂ λ ₃ ] ₆ = [γ ₀ λ ₀ ] ₆ × [γ ₁ λ ₁ ] ₆ × [γ ₂ λ ₂ ] ₆ × [γ ₃ λ ₃ ] ₆

(Processing 3'(15))

S ₁ calculates the following. The multiplication result is equivalent to the variance value by the (5,8) Shamir method.
[Λ ₀ λ ₁ λ ₂ λ ₃ ] ₁ = [λ ₀ ] ₁ × [λ ₁ ] ₁ × [λ ₂ ] ₁ × [λ ₃ ] ₁ ,
[Α ₀ α ₁ α ₂ α ₃ λ ₀ λ ₁ λ ₂ λ ₃ ] ₃ = [α ₀ λ ₀ ] ₃ × [α ₁ λ ₁ ] ₃ × [α ₂ λ ₂ ] ₃ × [α ₃ λ ₃ ] ₃
[Β ₀ β ₁ β ₂ β ₃ λ ₀ λ ₁ λ ₂ λ ₃ ] ₅ = [β ₀ λ ₀ ] ₅ × [β ₁ λ ₁ ] ₅ × [β ₂ λ ₂ ] ₅ × [β ₃ λ ₃ ] ₅
[Gamma ₀ γ ₁ γ ₂ γ ₃ λ ₀ λ ₁ λ ₂ λ ₃ ] ₇ = [γ ₀ λ ₀ ] ₇ × [γ ₁ λ ₁ ] ₇ × [γ ₂ λ ₂ ] ₇ × [γ ₃ λ ₃ ] ₇

(Processing 3'(16))

S ₀ is α _0,0 × α _1,0 × α _2,0 × α _3,0 , β _0,0 × β _1,0 × β _2,0 × β _3,0 , γ _0,0 × γ _{1 , 0} × γ _2,0 × γ _3,0 is calculated. In addition, λ ′ ₀ = λ _0,0 × λ _1,0 × λ _2,0 × λ _3,0 is calculated.

(Processing 3'(17))

S ₁ is α _0,1 × α _1,1 × α _2,1 × α _3,1 , β _0,1 × β _1,1 × β _2,1 × β _3,1 , γ _0,1 × γ _{1 , 1} × γ _2,1 × γ _3,1 is calculated and sent to _S0 . Also, λ ′ ₁ = λ _0,1 × λ _1,1 × λ _2,1 × λ _3,1 is calculated.

(Processing 3'(18))
S ₀ calculates the following and sends it to S ₁ .

α ₀ α ₁ α ₂ α ₃ = α _0,0 α _1,0 α _2,0 α _3,0 × α _0,1 α _1,1 α _2,1 α _3,1 ,
β ₀ β ₁ β ₂ β ₃ = β _0,0 β _1,0 β _2,0 β _3,0 × β _0,1 β _1,1 β _2,1 β _3,1 ,
γ ₀ γ ₁ γ ₂ γ ₃ = γ _0,0 γ _1,0 γ _2,0 γ _3,0 × γ _0,1 γ _1,1 γ _2,1 γ _3,1
(Processing 3'(19))
S ₀ calculates the following. However, λ = λ ₀ λ ₁ λ ₂ λ ₃

(Processing 3'(20))
S1 calculates the following.

(Processing 3'(21))

For S ₀ , 0 is secretly distributed by the (3,4) Shamir method [0 ₀ ] _j is calculated, and the following is calculated to send R ₀ , 1 and R ₀ , 3 to S ₁ . However, _{ai and} j are elements at positions i and j in the matrix A that transforms a quaternary expression into a quadratic expression.
R _0,0 = a _0,0 × [λ] ₀ + a _2,0 × [λ] ₂ + a _4,0 × [λ] ₄ + a _6,0 × [λ] ₆ + [0 ₀ ] ₀ ,
R _0,1 = a _0,1 x [λ] ₀ + a _2,1 x [λ] ₂ + a _4,1 x [λ] ₄ + a _6,1 x [λ] ₆ + [0 ₀ ] ₁ ,
R _0,2 = a _0,2 x [λ] ₀ + a _2,2 x [λ] ₂ + a _4,2 x [λ] ₄ + a _6,2 x [λ] ₆ + [0 ₀ ] ₂ ,
R _0,3 = a _0,3 x [λ] ₀ + a _2,3 x [λ] ₂ + a _4,3 x [λ] ₄ + a _6,3 x [λ] ₆ + [0 ₀ ] ₃ ,

(Processing 3'(22))

S ₁ calculates [0 ₁ ] _j in which 0 is secretly distributed by the (3, 4) Shamir method, calculates the following, and sends R 1, ₀ and R 1, ₂ to S ₀ .

R _1,0 = a _1,0 x [λ] ₁ + a _3,0 x [λ] ₃ + a _5,0 x [λ] ₅ + a _7,0 x [λ] ₇ + [0 ₁ ] ₀ ,
R _1,1 = a _1,1 x [λ] ₁ + a _3,1 x [λ] ₃ + a _5,1 x [λ] ₅ + a _7,1 x [λ] ₇ + [0 ₁ ] ₁ ,
R _1,2 = a _1,2 x [λ] ₁ + a _3,2 x [λ] ₃ + a _5,2 x [λ] ₅ + a _7,2 x [λ] ₇ + [0 ₁ ] ₂ ,
R _1,3 = a _1,3 x [λ] ₁ + a _3,3 x [λ] ₃ + a _5,3 x [λ] ₅ + a _7,3 x [λ] ₇ + [0 ₁ ] ₃ ,

(Processing 3'(23))
For S ₀ , [λ] ₀ = R _0,0 + R _1,0 , [λ] ₂ = R _0,2 + R ₁ , 2 are the dispersion values in the (3,4) Shamir method, and the (2,2) Shamir method. Calculate the secret-shared [0 ₀ ] _j in and calculate the following. S _{0 sends R'0,1} to S1. However, a'i, j are elements at positions _i , j in the matrix A'that transforms a quadratic expression into a linear expression.
_R'0,0 = _a'0,0 x [λ] ₀ + _a'2,0 x [λ] ₂ + [0 ₀ ] ₀ ,
R ′ _0,1 = a ′ _0,1 × [λ] ₀ + a ′ _2,1 × [λ] ₂ + [0 ₀ ] ₁ ,

(Processing 3'(24))

For S ₁ , [λ] ₁ = R _0,1 + R _1,1 , [λ] ₃ = R _0,3 + R _1,3 are used as the variance values in the (3,4) Shamir method, and the (2,2) Shamir method is used. Calculate the secret-shared [0 ₀ ] _j in and calculate the following. S ₁ sends _R'1,0 to _S0 .
_R'1,0 = _a'1,0 x [λ] ₁ + _a'3,0 x [λ] ₃ + [0 ₁ ] ₀ ,
_R'1,1 = _a'1,1 x [λ] ₁ + _a'3,1 x [λ] ₃ + [0 ₁ ] ₁ ,

(Processing 3'(25))
For S ₀ , [λ] ₀ = _R'0,0 + _R'1,0 is the dispersion value in the (2,2) Shamir method, and {λ} ₀ = ([λ] ₀ , _λ'0 ) is a random number for conversion. And.

(Processing 3'(26))
For S ₁ , [λ] ₁ = _R'0,1 + _R'1,1 is the variance value in the (2,2) Shamir method, and {λ} ₁ = ([λ] ₁ , λ'1) is _a random number for conversion. And.

If u = 2 and k = 2 in the random number generation 3 for conversion, α ₀ α ₁ is restored in (7), but if the input person can observe one machine, then he / she inputs, for example, α ₀ . It can be seen that the result of dividing α ₀ α ₁ by is the α ₁ of the other input person. Therefore, the secret information of the other input person is concealed by α ₁ , but since it is released and the two distributed values are known, the secret information λ 1 is restored and leaked. If there are three or more input users, α ₀ α ₁ α ₂ is restored, but since the remaining random numbers cannot be decomposed, the confidential information of each input person is not leaked. However, if u = 2, one input person becomes the input person 0, 1, and the other input person becomes the input person 2, 3, and if four secret information and random numbers are used, for example, the input person 0, Since 1 cannot decompose α ₂ α ₃ of the input persons 2 and 3, individual confidential information is not leaked. Therefore, if the machines S0 and S1 are inputters 0 and 1 and inputters 2 and 3, respectively, conversion random numbers can be automatically generated between the machines. On the contrary, even if u> 4, it is clear that the processing of (1) to (4) can be realized by each input person. Further, for example, the input person i (i = 0, 1, 2) secretly shares the secret information λi by the (3,12) Shamir method with u = 3, t = 4, k = 3, and multiplies the three distribution values. Then, the multiplication result corresponding to the (7,12) Shamir method is obtained, but if the order conversion process is performed once, the conversion random number corresponding to the (4,6) Shamir method can be obtained. Since each machine has one conversion random number corresponding to the (4,6) Shamir method, it can be a conversion random number corresponding to the (4,4) Shamir method. Therefore, it is not necessary that the number of machines t and k for performing the calculation are the same, and the finally set k can be changed from the initial k. Further, the number of times of order conversion of (9) to (10) also differs depending on the setting of u, t, k and the order of the finally required distributed expression. The reason for setting u = 4 in the random number generation 3'for conversion needs to be u> 2 from the above, and if u = 3 and t = k = 2, the multiplication result is a cubic expression from u (k-1). This is because it cannot be halved.

In addition, the following can be said as the security of random number generation for conversion. In the conversion random number generation 3', for example, S ₀ is [λ ₃ ] ₀ , [α ₃ λ ₃ ] ₂ , [β ₃ λ ₃ ] ₄ , [γ ₃ λ ₃ ] ₆ and 4 for one secret information λ ₃ . Although they have individual dispersion values, they cannot be solved even if k = 2 because they are multiplied by different random numbers. Further, the random numbers are removed in the processes 3'(19) and (20), for example, S ₀ has four variance values of [λ] ₀ , [λ] ₂ , [λ] ₄ , and [λ] ₆ . Since this variance value is the result of multiplication of the variance values, it cannot be solved unless five are collected. Further, in (23), the order is halved and it is sufficient to collect three pieces, but S ₀ has only two pieces, [λ] ₀ and [λ] ₂ . Finally, the order is reduced once more, and it is sufficient to collect two, but S ₀ has only [λ] ₀ , so it cannot be solved. Therefore, the value of the conversion random number generated by this method is a value that no one knows unless two or more inputrs collude. Therefore, it can be said that this method has information-theoretic security. However, in the above, the product of the matrices A and A'may be set as A', and each element thereof may be multiplied to perform two degree conversions once.

が事前に準備されているとする。 In the following, the conversion random number is generated by the above conversion random number generation process.

Is prepared in advance.

[Dispersion 3]

Next, the distribution 3 executed by the distribution unit 42 in the CPU 22 of the input user device 12A will be described with reference to FIG. 23.

In step 402, the dispersion unit 42 generates k random numbers α ₀ , α ₁ , ..., α _k-1 .

In step 404, the variance unit 42 calculates:

α (a + 1) = α × (a + 1) (α = α ₀ α ₁ ... α _k-1 )

In step 406, the dispersion unit 42 transmits the random numbers αi constituting α = α ₀ α ₁ ... α _k-1 to the corresponding machine 14Ni.

The input user devices 12B and 12C also execute the same processing as in FIG. 23. For example, in step 404, the dispersion portions 42 of the input user devices 12B and 12C generate β ₀ , β ₁ , ..., β _k-1 , γ ₀ , γ ₁ , ..., γ _k-1 , respectively. And calculate the following.

β (b + 1) = β × b (β = β ₀ β ₁ ... β _k-1 )

γ (c + 1) = γ × c (γ = γ ₀ γ ₁ ... γ _k-1 )

α _i , β _i , γ _i (i = 0, ..., K-1) may be secretly distributed, and the machine S _i may restore α _i , β _i , γ _i when necessary.

[Concealed multiply-accumulate calculation 3]

Next, the secret product-sum calculation 3 executed by the secret product-sum calculation unit 44 in the CPU 22 of the machines 14N0 to 14Nn-1 will be described with reference to FIG. 24.

In step 412, the secret product-sum calculation unit 44 calculates the following.
[Φωαβ (a + 1) (b + 1)] _i = α (a + 1) × β (b + 1) × [φ] _i
[Εηα (a + 1)] _i = α (a + 1) × [ε] _i
[Λμβ (b + 1)] _i = β (b + 1) × [μ] _i
[Τργ (c + 1)] _i = γ (c + 1) × [ρ] _i

In step 414, the secret product-sum calculation unit 44 generates a random number δj ∈ Z / pZ.

In step 416, the secret product-sum calculation unit 44 calculates the following, and in step 418, the secret product-sum calculation unit 44 transmits the following calculated values to the predetermined machine 14N0.

Since the predetermined machine 14N0 calculates the following and transmits it to another machine, in step 420, the secret product-sum calculation unit 44 receives the following calculated value.

In step 422, the secret product-sum calculation unit 44 calculates the following.

In step 424, the secret product-sum calculation unit 44 saves δ _j .

δ _j may be secret-shared by S _j and restored by an authorized restorer when necessary.

To obtain the calculation result, the restoration unit 242 of the restorer device 18 collects and restores k [δ (ab + c)] _i , collects the stored δ _i , and divides by the restored δ to obtain the product-sum operation result. Ab + c is obtained.

Further, in the secret multiply-accumulate operation, if c = 0, it is a secret multiplication, and if a = 1, it is a secret addition. Further, if the + before γ (c + 1) in step 422 is set to −, the secret subtraction is performed.

(Confidential division 3)

In addition, confidential division is performed as follows. However, in the dispersion 3, the machine 14Ni has a dispersion value [α'a] _i for gradual calculation and _α'i constituting α'.

The predetermined machine 14N0 collects [α'a] i from k servers and temporarily restores α'a. At this time, when α'a = 0, the divisor is 0, so the calculation is stopped. If α'a = 0, the machine 14N0 calculates 1 / α'a and sends it to another machine. After that, the concealment division is executed by treating 1 / α'a as α (a + 1) in the product-sum operation 3. However, since 1 is not added to 1 / α'a, the process of reducing μβ (b + 1) in step 422 is omitted.

It is clear that the continuity of the operations and the concealment of the operations can be realized in the same manner as in the first embodiment. In addition, since no one knows the random number for conversion, even if the one-input inputter who is the attacker and the restorer collude, it is not possible to know the random number applied to the secret information, which was explained in the problem of the TUS method. It becomes impossible to analyze, and information-theoretic safe secret product-sum operation is realized even between input / output parties with conflicting interests.

According to the third embodiment, many people or organizations can cooperate to realize learning of the NN machine. As a result, the input information of each input person device is not leaked to other input person devices and the restorer device, and the learning result and the like can be disclosed. Further, the third embodiment can be realized by a minimum of n = k = 2 NN machines, is safe as long as the information of at least one NN machine is not leaked, and can be applied to general big data. .. Therefore, according to the third embodiment, a secure concealment operation that can be applied in any case including a product-sum operation that could not be realized by the TUS method is realized.

<Fourth Embodiment>

As shown in FIG. 25, the configuration of the fourth embodiment has the same configuration as the configuration of the third embodiment (FIG. 18), so that the same parts are designated by the same reference numerals. The explanation is omitted and the different parts are explained. In the fourth embodiment, the arithmetic support device 16 is provided. The inputter devices 12A0 to 12C0 in the fourth embodiment do not include a calculation support unit. The calculation support device 16 includes a calculation support unit. In the fourth embodiment, one predetermined machine 14NN (number of machines N = 1, n = k = 2) among the machines 14N0 to 14Nn-1 performs the concealment operation. However, since the arithmetic support device 16 can also perform restoration processing as described later, the restorer device 18 may not be necessary. As in the second embodiment, n and k regarding the secret sharing will be described as the minimum value of 2 (any number can be selected).

As shown in FIG. 3, the functional unit of each CPU 22 of the input person devices 12A to 12C includes a distributed unit 42. As shown in FIG. 4, the functional unit of the CPU 22 of the machine 14NN includes a secret product-sum calculation unit 44 and a secret division unit 46. As shown in FIG. 12, the functional unit of the CPU 22 of the calculation support device 16 includes a distribution unit 42 and a calculation support unit 150.

In the fourth embodiment, the plurality of confidential information inputter devices 12A to 12C and the restorer device 18 that knows the result are different, and the concealment calculation is executed by one calculation support device and one machine 14NN. do.

In the fourth embodiment, it is assumed that there is one reliable calculation support device in order to realize the confidential calculation by one machine 14NN between the inputter devices 12A to 12C having conflicting interests. Further, it is assumed that each input person device 12A to 12C secures a secure communication path using the calculation support device and encryption or the like.

The arithmetic support device may require much smaller processing than the machines 14N0 to 14Nn-1, and the attacker can know the processing of the machine 14NN, but the processing of the arithmetic support device is not leaked.

The details will be described later, but the major difference from the second embodiment in which the concealment calculation is performed by one NN machine is that an attack from an input person is assumed. The input person in the second embodiment does not need to attack in order to know all the information, and only the NN machine and the person who can observe it were the attackers. On the other hand, the input person in the present embodiment knows only partial information and may make an attack to know other input persons and the operation result. Therefore, the product-sum operation itself is concealed from the input person. Therefore, instead of a constant such as 1, the first random number a1 is added to the secret information and α (a + a1) multiplied by the second random number α is disclosed. This prevents attacks by the input person.

[Dispersion 4]

The distribution 4 executed by the distribution unit 42 in the CPU 22 of the calculation support device for the secret information a, b, c obtained from the input person devices 12A to 12C via the secure communication path will be described with reference to FIG. 26.

In step 432, the dispersion unit 42 generates random numbers α, β, γ and random numbers a1, b1, and c1.

In step 434, the dispersion unit 42 calculates the following.
α (a + a1) = α × (a + a1)
β (b + b1) = β × (b + b1)
γ (c + c1) = γ × (c + c1)

In step 436, the dispersion unit 42 transmits α (a + a1), β (b + b1), and γ (c + c1) to one machine 14NN.

In step 438, the dispersion unit 42 generates random numbers δ ₀ and δ ₁ .

In step 440, the dispersion unit 42 calculates δ ₀ / αβ, δ ₀ b1 / α, δ ₀ a1 / β, and δ ₀ / γ.

In step 442, the dispersion unit 42 has the following dispersion values [δ ₀ / α β] ₀ , [δ ₀ b1] in the secret dispersion of δ ₀ / α β, δ ₀ b1 / α, δ ₀ a1 / β, δ ₀ / γ. / Α] ₀ , [δ ₀ a1 / β] ₀ , [δ ₀ / γ] ₀ and [δ ₀ / αβ] ₁ , [δ ₀ b1 / α] ₁ , [δ ₀ a1 / β] ₁ , [δ] ₀ / γ] ₁ is calculated.

In step 444, the dispersion unit 42 performs the following calculation (δ = δ ₀ δ ₁ ).
[Δ / αβ] ₁ = δ ₁ [δ ₀ / αβ] ₁
[Δb1 / α] ₁ = δ ₁ [δ ₀ b1 / α] ₁
[Δa1 / β] ₁ = δ ₁ [δ ₀ a1 / β] ₁
[Δ / γ] ₁ = δ ₁ [δ ₀ / γ] ₁

In step 446, the dispersion unit 42 has [δ ₀ / αβ] ₀ , [δ ₀ b1 / α] ₀ , [δ ₀ a1 / β] ₀ , [δ ₀ / γ] ₀ and [δ / αβ] ₁ , [Δb1 / α] ₁ , [δa1 / β] ₁ , and [δ / γ] ₁ are transmitted to one machine 14NN.

[Multiply-accumulate calculation 4]
Next, the product-sum calculation 4 executed by the secret product-sum calculation unit 44 in the CPU 22 of the machine 14NN will be described with reference to FIG. 27.

In step 452, the secret product-sum calculation unit 44 performs the following calculation.
[Δ ₀ {(ab + c)-(a1b1-c1)}] ₀ = α (a + a1) × β (b + b1) × [δ ₀ / αβ] ₀ -α (a + a1) × [δ ₀ b1 / α] ₀ -β (B + b1) × [δ ₀ a1 / β] ₀ + γ (c + c1) × [δ ₀ / γ] ₀
[Δ {(ab + c)-(a1b1-c1)}] ₁ = α (a + 1) × β (b + 1) × [δ / αβ] ₁ -α (a + 1) × [δb1 / α] ₁ -β (b + 1) × [Δa1 / β] ₁ + γ (c + 1) × [δ / γ] ₁

[Operation support 4]
Next, the calculation support 4 executed by the calculation support unit in the CPU 22 of the calculation support device 16 will be described with reference to FIG. 28.

In step 462, the arithmetic support unit collects [δ ₀ {(ab + c)-(a1b1-c1)}] ₀ and [δ {(ab + c)-(a1b1-c1)}] ₁ .

In step 464, the calculation support unit calculates the following.
[Δ {(ab + c)-(a1b1-c1)] ₀ = δ ₁ [δ ₀ {(ab + c)-(a1b1-c1)}] ₀

In step 466, the arithmetic support unit changes from [δ {(ab + c)-(a1b1-c1)}] 0 and [δ {(ab + c)-(a1b1-c1)}] 1 to δ {(ab + c)-(a1b1-). Restore c1).

In step 468, the calculation support unit calculates δ (ab + c + d1). Here, d1 = (c1-a1b1) may be set, but δ (a1b1-c1) may be added to δ {(ab + c)-(a1b1-c1)}, and a newly generated random number δd1 may be added.

In step 470, the calculation support unit determines whether or not to continue the calculation, and if the calculation is not continued, in step 472, the calculation support unit divides by δ without adding δd1 in the above. Calculate ab + c.

When the calculation is continued, the processing of steps 438 to 444 of FIG. 26 of the variance 4 can be executed in advance if the calculation procedure is known. Therefore, the operation support process 4 is the only essential operation support process performed during the operation. Further, the calculation support process may be executed as needed without being executed for each product-sum operation. For example, in the process of Σδ0 (ai + 1) (bi + 1), it is only necessary to perform the operation support process once after the operation.

[Confidential division 4]
Next, the concealment division 4 executed by the calculation support unit 254 in the CPU 22 of the calculation support device 16 will be described. In the secret division 4 in the present embodiment, in the above-mentioned secret division 2 (FIG. 17), the calculation support unit 254 in the CPU 22 of the calculation support device 16 performs the processing executed by the calculation support unit 150 in the CPU 22 of the input person device 12. Only the points to be executed are different, so the description thereof will be omitted.

According to the fourth embodiment, the combination of one machine 14NN and one arithmetic support device enables safe concealment calculation even if the interests of the input person device and the restorer device conflict with each other. In general, the machine 14NN often operates as a set with an IC chip in charge of its control or a dedicated control device. Therefore, if the IC chip or the dedicated control device is provided with tamper resistance and the calculation support function according to the fourth embodiment is added, the present embodiment can be realized without major system changes. That is, the machine 14NN operates as a high-speed arithmetic unit, and if the IC chip or the control device is safe even if the operation is observed, a system can be configured in which the input information and the problem to be solved are not leaked. However, since the calculation support device 16 knows all the information as in the case of one inputter device in the second embodiment, the secret information and the secret calculation result are leaked when the calculation support device 16 is analyzed.

<Fifth Embodiment>
Next, a fifth embodiment will be described.
Since the configuration of the fifth embodiment is the same as the configuration of the fourth embodiment (see FIG. 25), the description thereof will be omitted.

In the fifth embodiment, consider a method that can realize the safety as in the third embodiment without making the arithmetic support device absolute as in the fourth embodiment. In the fourth embodiment, if the arithmetic support device can be analyzed, all the confidential information will be leaked. This is because the arithmetic support device centrally manages all the information like the input person in the second embodiment. By adding the elements of the third embodiment to this, it is necessary to analyze both one machine 14NN and the calculation support device while taking advantage of the feature that the processing amount in secret sharing is large for the NN machine and the calculation support device is small. The challenge is to prevent the leakage of confidential information. Also in the fifth embodiment, it will be described as N = 1, n = k = 2.

In the fourth embodiment, since the calculation support device knows all the secret information, if only the calculation support device can attack, all the secret information will be leaked. Therefore, as in the fourth embodiment, it is possible to perform calculation with one machine even between inputter devices having conflicting interests, and as in the third embodiment, one machine and a calculation support device are used. An embodiment that is safe unless analyzed is shown. Further, the conversion random number is generated in the same manner as in the third embodiment, but since the calculation support device is reliable, the conversion random number is calculated and supported in the same manner as in (1-2) of the first embodiment. Generated by the device. Therefore, it is assumed that the conversion random numbers {μ'} i, {ν'} i, {ε'} i, {ρ'} i, and {ω'} i are prepared in the variance 5.

[Dispersion 5]
The distribution 5 is shown as a flowchart of the distribution 5 program of the input user device 12A (FIG. 29A), a flowchart of the distribution 5 program of the input user device 12B (FIG. 29B), and a flowchart of the distribution 5 program of the input user device 12C (FIG. 29C). ), The flowchart of the program of the distribution 5 of the calculation support device 16 (FIG. 29D), the flowchart of the program of the distribution 5 of the machine 14NN (FIG. 29E), and the sequence diagram of the distribution 5 (FIG. 29F).

(Dispersion 5 (1))
The inputter device 12A generates random numbers α ′ ₀ and α ′ ₁ and calculates the following to transmit α ′ (a + 1) to the machine 14NN and the calculation support device 16, and sends α ′ ₀ to the machine 14NN to perform the calculation. _Α'1 is transmitted to the support device 16 (see also steps 502A to 508A in FIG. 29A, step 512 in FIG. 29D, and step 552 in FIG. 29E).
α ′ = α ′ ₀ × α ′ ₁ , α ′ (a + 1) = α ′ × (a + 1)

The inputter device 12B generates random numbers β ′ ₀ and β ′ ₁ and calculates the following to send β ′ (b + 1) to the machine 14NN and the calculation support device 16, and sends β ′ ₀ to the machine 14NN to perform the calculation. Β ′ ₁ is transmitted to the support device 16 (see also steps 502B to 508B in FIG. 29B, step 514 in FIG. 29D, and step 554 in FIG. 29E).
β ′ = β ′ ₀ × β ′ ₁ , β ′ (b + 1) = β ′ × (b + 1)

The inputter device 12C generates random numbers γ'0 and _γ'1 and calculates the following to send γ'(c + ₁ ) to the machine 14NN and the calculation support device 16, and sends _γ'0 to the machine 14NN for calculation. Gamma ′ ₁ is transmitted to the support device 16 (see also steps 502C to 508C in FIG. 29C, step 516 in FIG. 29D, and step 556 in FIG. 29E).
γ' ₌ γ'0 x γ'1, γ'(c + ₁ ) = γ'x (c + 1)

α'i, β'i, _γ'i ( _i = 0, ..., k-1) are secretly distributed, and when necessary, the machine _14NN and the arithmetic support device 16 perform _α'i , _β'i , γ'. _i may be restored.

(Dispersion 5 (2))

The machine 14NN generates two or more random numbers a0 ₀ , a01 ₁ , calculates a0 = a0 ₀ × a01 ₁ , calculates a0'= a0-1 from a0, and random numbers ξ _a0 , 0, ξ _{a0. 1} and _ξ'a0 , 0, _ξ'a0.1 are generated, ξ _a0 = ξ _{a0, 0 × ξ a0.1, ξ'a0 = ξ a0 × a0 is} calculated, and ξ'a0 × _a0 ' , Ξ _a0.1 , _ξ'a0 , ₁ , a01 1 are transmitted to the calculation support device 16 (see steps 558 to 568 in FIG. 29E and steps 518 in FIG. 29D).

(Dispersion 5 (3))

The arithmetic support device 16 generates _non -zero random numbers a1 ₀ , a1 ₁ , ξ a1, 0, ξ _a1.1 and calculates a1 = a1 ₀ × a1 ₁ , ξ _a1 = ξ a1, 0 × ξ _{a1.1 .} Then, ξ _a1 × a1 and ξ a1, 0 are transmitted to the machine _14NN (see steps 520 to 524 in FIG. 29D and steps 570 in FIG. 29E).

The machine 14NN generates random numbers α ₀ and α ′ ₀ (see step 572 in FIG. 29E), the arithmetic support device 16 generates random numbers α ₁ and α ′ ₁ (step 526 in FIG. 29D), and the machine 14NN generates the following random numbers α 1 and α ′ 1. (Step 574 in FIG. 29E), the calculation support device 16 calculates the following and sends it to the machine 14NN (see step 528 in FIG. 29D and step 576 in FIG. 29E) (hereinafter, the machine 14NN has i = 0 and calculation support. The device 16 performs the calculation corresponding to i = 1).

(Dispersion 5 (4))

Machine 14NN

Is multiplied for i = 0, 1 and (A), (B), (C), (D), (E), that is, each

Is calculated and sent to the calculation support device 16 (see step 578 and 580 in FIG. 29E and step 530 in FIG. 29D).

(Dispersion 5 (5))

The machine 14NN calculates the following equation corresponding to i = 0 (step 582 in FIG. 29E), and the arithmetic support device 16 calculates the following equation corresponding to i = 1 (step 532 in FIG. 29D). However, a0 + a1 = a2.

(Dispersion 5 (6))

The arithmetic support device 16 transmits [α ″ a2] ₁ and [α (a + a2)] ₁ corresponding to i = 1 to the machine 14NN (see step 534 in FIG. 29D and step 584 in FIG. 29E), and the machine 14NN is α. "A2, α (a + a2) is restored (see step 586 in FIG. 29E).

(Dispersion 5 (7))

The machine 14NN and the arithmetic support device 16 also execute the variances 5 (1) to (6) for b and c to obtain β (b + b2), β ″ b2, γ (c + c2), and γ ″ c2 (FIG. 29D). 536, step 588 of FIG. 29E, also see FIGS. 29A-29C).

(Dispersion 5 (8))

The arithmetic support device 16 generates a random number χ and random numbers ε, τ, ω, λ, κ, ζ, secretly distributes ε, τ, ω, λ, κ, ζ and calculates the following, and converts the random number { Send ε}, {τ}, {ω}, {λ}, {κ}, {ζ} to machine 14N0 (see steps 540, 542 in FIG. 29D).
[Χε] ₁ = χ × [ε] ₁
[Χτ] ₁ = χ × [τ] ₁
[Χφω] ₁ = χ × [φ] ₁
[Χλ] ₁ = χ × [λ] ₁
[Χκ] ₁ = χ × [κ] ₁
[Χζ] ₁ = χ × [ζ] ₁
{Ε} = ([ε] ₀ , [χε] ₁ , ε ₀ )
{Ρ} = ([ρ] ₀ , [χρ] ₁ , ρ ₀ )
{Ω} = ([ω] ₀ , [χω] ₁ , ω ₀ )
{Μ} = ([μ] ₀ , [χμ] ₁ , μ ₀ )
{Ν} = ([ν] ₀ , [χν] ₁ , ν ₀ )
{Ζ} = ([ζ] ₀ , [χζ] ₁ , ζ ₀ )

When the conversion random number is generated using the conversion random number generation 3'by the plurality of inputters described in the third embodiment, the arithmetic support device 16 corresponding to S1 is the final result, for example, [ε]. ₁ and ε ₁ are obtained, and the machine 14N0 corresponding to S0 has already obtained [ε] ₀ and ε ₀ . In this case, the arithmetic support device 16 can omit the random number generation in step 538, and after performing the processing in step 540, for example, only [χε] ₁ may be sent to the machine 14N0 in step 542 (other τ, ω, λ). , Kappa, ζ as well).
[Concealed multiply-accumulate calculation 5]

Next, the secret product-sum calculation 5 executed by the secret product-sum calculation unit 44 in the CPU 22 of the machine 14NN and the calculation support 5 executed by the calculation support unit 150 in the CPU 22 of the calculation support device 16 are shown in FIGS. 30 and 31, respectively. Will be described with reference to.

In step 602 of FIG. 30, the secret product-sum calculation unit 44 of the machine 14NN generates a random number δ ₀ ∈ Z / pZ.

In step 612 of FIG. 31, the arithmetic support unit 150 of the arithmetic support device 16 generates a random number δ ₁ ∈ Z / pZ.

In step 604 of FIG. 30, the secret product-sum calculation unit 44 of the machine 14NN calculates the following with i = 0.

To send.

In step 614 of FIG. 31, the calculation support unit 150 of the calculation support device 16 calculates the following with i = 1 and sends the following to the machine 14NN in step 616.

In step 606 of FIG. 30, the secret product-sum calculation unit 44 in the CPU 22 of the machine 14NN multiplies the above two equations (i = 0, 1) and calculates the following.

In step 608 of FIG. 30, the secret product-sum calculation unit 44 in the CPU 22 of the machine 14NN calculates the following.

[Operation support process 5]
Next, the calculation support process 5 executed by the calculation support unit 150 in the CPU 22 of the calculation support device 16 will be described with reference to FIG. 32.

In step 622, the arithmetic support unit 150 collects [δ ₀ (ab + c)] ₀ and [δ (ab + c)] ₁ .

In step 624, the calculation support unit 150 calculates the following.
[Δ {(ab + c)] ₀ = δ ₁ [δ ₀ (ab + c)] ₀

In step 626, the arithmetic support unit 150 restores δ (ab + c) from [δ (ab + c)] ₀ and [δ (ab + c)] ₁ .

When the calculation is continued, the machine 14N0 and the calculation support device 16 newly generate random numbers corresponding to a0 and a1, and the new α ″ a2 and the restored δ (ab + c) and α ″ are obtained by secretly adding them. A new α (a + a2) may be obtained by secretly adding a2.

Concealment graduation can be similarly realized if a2 is a1 in concealment graduation 4.

In the present embodiment, the arithmetic support device 16 does not know the secret information a, b, c, and without restoring them, the arithmetic support device 16 performs a secret addition of random numbers generated by the machine 14NN, and the input person knows. Adds the first random number and multiplies the second random number. Therefore, the secret information is not leaked only by the attacker attacking the calculation support device 16, and the secret information is not leaked unless the machine 14NN is also analyzed. Therefore, according to the fifth embodiment, a safe system can be constructed even if only the arithmetic support device is analyzed.

Further, when the calculation is continued in the second and fourth embodiments, the input user device 12 generates a new δ ₀ for the new α, β, γ, and δ ₀ / α β, δ ₀ / α. , Δ ₀ / β, δ ₀ / γ, but as in the present embodiment, for example, a conversion random number such that {ε} = ([ε] ₀ , [χε] ₁ , ε ₀ ). Is sent to the machine 14NN (same for other conversion random numbers), and if the same operations as the secret product sum operations 5 are performed in the secret product sum operations 2 and 4, δ ₀ / αβ and δ ₀ / are performed in order to continue the operations. It is no longer necessary to calculate α, δ ₀ / β, δ ₀ / γ during the calculation (however, in FIG. 30, a0 = b0 = 0, α ″ = β ″ = γ ″ = 0, and the second embodiment is performed. Only the form is a1 = b1 = c2 = 1. Accordingly, the operations of FIGS. 30 and 31 relating to a0, b0, etc. are omitted). That is, {ε} = ([ε] ₀ , [χε] ₁ , ε ₀ . It suffices if a conversion random number in the form of) is prepared in advance.

In the first embodiment to the fifth embodiment, one or two machines for concealment calculation have been described as an example, but general purpose is used when concealment calculation is performed using one or two machines. Can be used as a target.

From the above, when there is one machine for confidential calculation, the second embodiment is the fastest if there is one inputter device, and there are multiple machines and the calculation support device has tamper resistance. For example, when the fourth embodiment has a plurality of names and there is a possibility that the arithmetic unit may also be analyzed, the fifth embodiment is recommended.

Further, when two machines for confidential calculation can be used, the first embodiment is the fastest if there is one inputter device, and the third embodiment is recommended if there are a plurality of machines.

12 Input user device 14N0-14Nn-1 machine

Claims (14)

Let n be an integer of 2 or more, k be an integer with a minimum value of 2 and a maximum value of n, and L be an integer of 1 or more and k or less. In a system that performs a secret operation using a means that can restore secret information with less than kl, and cannot restore secret information with less than kl, a means to secretly add a non-zero integer to the secret information and the result of the secret addition. A calculation support device characterized by having a means for sending a message as it is to a total secret calculation device that participates in a secret calculation. Let n be an integer of 2 or more, k be an integer with a minimum value of 2 and a maximum value of n, and L be an integer of 1 or more and k or less. In a system that performs a secret operation using a means that can restore secret information with less than kl and cannot restore confidential information, a means for generating one or more first random numbers and a means for generating the first random number A device comprising: means for applying each to each of the secretly distributed distributed values. Let n be an integer of 2 or more, k be an integer with a minimum value of 2 and a maximum value of n, and L be an integer of 1 or more and k or less. In a system in which the confidential information can be restored by collecting the secret information and the confidential information cannot be restored if the number is k-L or less, claim 1 or claim 2 is applied to the variance value obtained by applying different integers according to claim 2. It is characterized by having a means for operating the confidential secret information disclosed by the device of the above-mentioned device and a means for calculating using a distributed value in which different random numbers are applied to the same secret information which is the output of the means. Concealed arithmetic device. Let n be an integer of 2 or more, k be an integer with a minimum value of 2 and a maximum value of n, and L be an integer of 1 or more and k or less. In a system that performs a secret operation using a means that cannot restore the secret information if the number is k-L or less, when the number of secret operation devices used is t and the number of inputs is u, n is A means for performing secret sharing with u (k-1) +1 or more, a means for dividing the distribution value into n / t pieces and multiplying them by different integers, and a distribution value n / t pieces obtained by multiplying the different random numbers. An input person device characterized by having a means for distributing at least one distributed value to a secret arithmetic device. Let n be an integer of 2 or more, k be an integer with a minimum value of 2 and a maximum value of n, and L be an integer of 1 or more and k or less. In a system that performs concealment operations using means that can restore confidential information with less than kl, and cannot restore confidential information with less than kl, a means for multiplying distributed values and a means for multiplying distributed values with random numbers A concealment arithmetic device comprising: a means for deleting a random number from a product and a means for repeating a degree conversion process once or more for a distributed value from which the random number has been deleted. Let n be an integer of 2 or more, k be an integer with a minimum value of 2 and a maximum value of n, and L be an integer of 1 or more and k or less. Confidential information can be restored by collecting the secret information, and in a system that performs a concealment operation using a means that cannot restore the confidential information if the number is k-L or less, the concealment according to claim 1 The constant added in claim 1 is concealed from the confidential information. A secret arithmetic device having a means for subtracting, a means for verifying whether the secret subtraction result is 0, and a means for generating the reciprocal of the secretly subtracted value when the subtraction result is not 0. Let n be an integer of 2 or more, k be an integer with a minimum value of 2 and a maximum value of n, and L be an integer of 1 or more and k or less. Confidential information can be restored by collecting the secret information, and in a system that performs a confidential operation using a means that cannot restore confidential information if the number is k-L or less, a means for converting a distributed value with a different random number into the same random number as another distributed value. A calculation support device having a means for recovering confidential information to which the same random number is applied, or a means for enabling a secret calculation device to recover. Let n be an integer of 2 or more, k be an integer with a minimum value of 2 and a maximum value of n, and L be an integer of 1 or more and k or less. A means to secretly add a non-zero integer to the secret information by using the computer of the calculation support device in the system that performs the secret calculation by using a means that cannot recover the secret information if the number of secret information is k-L or less. , And a program that functions as a means to send the secret addition result as it is to all the secret calculation devices that participate in the secret calculation. Let n be an integer of 2 or more, k be an integer with a minimum value of 2 and a maximum value of n, and L be an integer of 1 or more and k or less. The computer of the device in the system that performs the secret operation by using the means that can recover the secret information with less than kl, and the means to generate one or more first random numbers, and the first A program that functions as a means to apply each of the integers of 1 to each of the secretly distributed distributed values. Let n be an integer of 2 or more, k be an integer with a minimum value of 2 and a maximum value of n, and L be an integer of 1 or more and k or less. The computer of the concealment calculation device in the system that performs the concealment calculation by means that the secret information cannot be restored with k-L or less can be charged to the distributed value to which different random numbers are applied according to claim 2. A program that functions as a means for operating the confidential secret information disclosed by the device of Item 1 and a means for calculating using a distributed value in which different random numbers are applied to the same secret information that is the output of the means. Let n be an integer of 2 or more, k be an integer with a minimum value of 2 and a maximum value of n, and L be an integer of 1 or more and k or less. The number of secret calculation devices used is t, and the number of inputs is u. Then, from the means for performing secret sharing with n being ut or more, the means for dividing the distribution value into n / t pieces and multiplying them by different random numbers, and the distribution value n / t pieces multiplied by the different random numbers. A program that functions as a means of distributing at least one distributed value to a secret computing device. Let n be an integer of 2 or more, k be an integer with a minimum value of 2 and a maximum value of n, and L be an integer of 1 or more and k or less. The secret information can be restored by collecting the secret information, and the computer of the secret arithmetic unit in the system that performs the secret calculation by the means that the secret information cannot be restored with k-L or less is multiplied by the means for multiplying the distributed values and the integer. A program that functions as a means for deleting a random number from the product of the distributed values and a means for repeating the order conversion process for the distributed value from which the random number has been deleted. Let n be an integer of 2 or more, k be an integer with a minimum value of 2 and a maximum value of n, and L be an integer of 1 or more and k or less. The computer of the concealment calculation device in the system that performs the concealment calculation by means that the confidential information cannot be restored with kl or less can be recovered from the concealment secret information according to claim 1. A program that functions as a means for secretly subtracting an added constant, a means for verifying whether the secret subtraction result is 0, and a means for generating the reciprocal of the secretally subtracted value when it is not 0. Let n be an integer of 2 or more, k be an integer with a minimum value of 2 and a maximum value of n, and L be an integer of 1 or more and k or less. The computer of the arithmetic support unit in the system that performs the secret operation by the means that the secret information cannot be restored with less than kl, and the distributed value with different integers is different from the other distributed values. A program that functions as a means to convert to the same integer, and to restore confidential information with the same integer, or to enable a secret arithmetic unit to restore it.

Images