JP4024542B2 - Large / small comparison method, device thereof, mean value registration method, program thereof, and recording medium thereof - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention is an application technology of information security technology, for example, online on the Internet or the like, a plurality of users (users) compare secret values held in secret, the maximum value or the minimum value, The present invention relates to a size comparison method in which only a user having the intended value is specified, its apparatus, a user's intention value registration method, its program, and its recording medium.
[0002]
[Prior art]
An example of online comparison is “electronic bidding”. In the above method, the maximum value or the minimum value and the user who sets the maximum value or the minimum value are specified, but other information can be kept secret.
・ Kobayashi, Morita, “Efficient bidding method using one-way function for large / small comparison”, ISEC99, etc. Also,
・ H.Kikuchi, M.Harkavy, JDTygar, "Multi-round anonymous auction protocols" In IEEE Workshop on Dependable and Real-Time E-Commerce System, 1998, means more or less for a certain number We propose a method that only knows whether there is a user with a medium value.
[0003]
[Problems to be solved by the invention]
In the latter case, when there are multiple users with the maximum or minimum value as the intended value, the user cannot be identified, and the user with the maximum or minimum value as the intended value can know the second numerical value. There was a problem of end.
The object of the present invention is to compare the values that a plurality of users have intended on-line, and to safely and efficiently compare these maximum or minimum values and, if necessary, the desired values. The other is to provide a size comparison method, a device, a user's mean value registration method, a program thereof, and a recording medium for maintaining a secret.
[0004]
[Means for Solving the Problems]
According to the present invention, the plurality of user devices i, i = 1,..., N, and N is an integer equal to or greater than 2, the first and second magnitude comparison devices, the user device, and the first and second The lower limit V determined in advance by the bulletin board device that publishes the information received from the large / small comparison device₁And upper limit V_MMonotonically increasing M values V in the range_wHowever, w = 1,2, ..., M, and the desired value V determined by all users_viFrom their minimum value V_MINAnd the magnitude comparison method for specifying only the user j having the minimum value as the mean value is:
(a) The implied value V input by the user in each of the above user devices i_viFor the above lower limit V₁Above, mean value V_viThe elements corresponding to each other with less than_viAbove, upper limit V_MIn the following, two information sequences s composed of M elements each having mutually different corresponding elements_iAnd t_iAnd secretly transmitting information corresponding thereto to the first and second magnitude comparison devices, respectively, and M is the lower limit value V₁The above upper limit V_MIt represents the number of values that can be selected as the above mean value,
(b) In the first size comparison device, the lower limit V₁Above, upper limit V_MGiven value V below_wFor the above information series s from all user devices_iElements s corresponding to w_{i, w}Element concatenated Seq which are arranged in a predetermined order_{s, w}= S_{1, w}‖S_{2, w}‖… ‖S_{N, w}And ‖ represents data concatenation,
(c) In the second comparison device, the given value V_wThe above information series t from all user devices_iElement t corresponding to each w_{i, w}Element concatenated Seq which are arranged in a predetermined order_{t, w}= T_{1, w}‖T_{2, w}‖… ‖T_{N, w}The steps of creating
(d) In the bulletin board device, the element connection Seq_{s, w}And Seq_{t, w}V, if they are different from each other, without revealing their own values_wIt is determined that there is a user with the following values as intended, and if equal, V_wIt is determined that there is no user who has the following values, and based on the determination, the value of w is changed to change the minimum intention value V_MINAnd publishing the element number MIN,
(e) The element connection Seq corresponding to the element number MIN published by the first and second size comparison devices._{s, MIN}And Seq_{t, MIN}Is transmitted to the bulletin board device and published to each user device, so that the corresponding elements s in the element connection are associated with each other._{i, MIN}And t_{i, MIN}About s_{j, MIN}≠ t_{j, MIN}Enabling to detect that the number j is a user number j that has committed the minimum intention value;
Including.
[0005]
The user device used in the above-described size comparison method according to the present invention has an upper limit V for an integer value to be compared._MAnd lower limit V₁M value, M is an integer greater than or equal to 2_viHow to register
(a) Entered mean value V_viV₁V_viElements corresponding to less than are equal to each other and V_viV_MThe elements corresponding to the following are two information series s consisting of M elements which are different from each other._iAnd t_iA step of generating
(b) Information series above_iAnd t_iIs calculated, and the one-way function for these is calculated and the calculation result H1_i, H2_iA step of outputting
(c) The above information series_iTo the first large / small comparing device, the above information series t_iTo the second large / small comparison device, H1_iAnd H2_iSending each to the bulletin board device,
Including.
[0006]
The user device used in the size comparison method according to the present invention is:
Upper limit V for integer value to be compared_MAnd lower limit V₁A storage unit storing M values of
V₁V_MThe following intended value V_viAn input means for inputting
V_viAnd V₁, V_MIs entered and V₁V_viElements corresponding to less than are equal to each other and V_viV_MThe elements corresponding to the following are two information series s consisting of M elements which are different from each other._iAnd t_iOr V₁V_viThe following elements are different from each other, and V_{Vi + 1}V_MThe elements corresponding to the following are two information sequences s consisting of M elements that are equal to each other._iAnd t_iAn information sequence generation unit that generates and outputs one of₁V_MThe following nominal value V_viIs the number of values that can be selected as
The above information series_iAnd t_iIs calculated, and the one-way function for these is calculated and the calculation result H1_i, H2_iA one-way function calculation unit that outputs
The above information series_iTo the first large / small comparing device, the above information series t_iTo the second large / small comparison device, H1_iAnd H2_iA transmission unit for transmitting the message to the bulletin board device
It is comprised so that it may contain.
[0007]
The size comparison device used in the size comparison method according to the present invention is:
Lower limit value V sent from each user device₁Above, upper limit V_MThe following nominal value V_viA receiving unit that receives an information sequence composed of elements of the number M of values that can be selected as: and receives an integer value w sent from the bulletin board device;
A storage unit for storing the received information series;
A w-th element in the information series received from each user is input, a one-way function is calculated for these connections, and a one-way function calculation unit that outputs the calculation result;
A transmitter for transmitting the one-way function calculation result to the bulletin board device;
It is comprised so that it may contain.
[0008]
In the above, maximum mean value V_MAXTo determine the series of values V₁~ V_MAre assigned numbers 1 to M in descending order, and the implied value V_viIf the number corresponding to is vi, two information series s_i, t_iIs generated when the number element w is 1 or more and less than vi for numbers 1 to M._{i, w}= t_{i, w}And s for vi and above and below M_{i, w}≠ t_{i, w}If the information sequence is generated so that_viMaximum value of V_MAXCan be determined.
The size comparison method by the size comparison device used in the size comparison method according to the present invention is:
(a) From each user device i, i = 1, 2, ..., N, lower limit V₁Above, upper limit V_MSignificant value V among the following M values_viInformation sequence s consisting of M elements as information representing_i= [s_{i, 1}, s_{i, 2},…, S_{i, M}] Each receiving
(b) receiving an integer value w sent from the bulletin board device;
(c) Information series received from each user device_iWth element in_{i, w}And calculating a one-way function for these concatenations;
(d) transmitting the one-way function calculation result to the bulletin board device;
Including.
[0009]
The size comparison device used in the size comparison method according to the present invention is:
Lower limit value V sent from each user device₁Above, upper limit V_MThe following nominal value V_viA receiving unit that receives an information sequence composed of elements of the number M of values that can be selected as: and receives an integer value w sent from the bulletin board device;
A storage unit for storing the received information series;
A w-th element in the information series received from each user is input, a one-way function is calculated for these connections, and a one-way function calculation unit that outputs the calculation result;
A transmitter for transmitting the one-way function calculation result to the bulletin board device;
Is configured to include.
[0010]
Thus, in this invention, each user 11-i (i = 1, 2,..., N)₁V_MThe following intended value V_viIs determined by the user device, and two series of numerical values each consisting of M values are converted to V₁V_viElements corresponding to less than are equal and V_viV_MTwo information series s whose elements corresponding to the following are different from each other_iAnd t_iCreate and s_iTo the first large and small comparison device, t_iAre secretly transmitted to the second size comparison device. s_iOr t_iJust V_viSince no information is available about anyone, even for each large and small comparison device V_viIs never known.
[0011]
Information about the intended value of all users_i, t_iWhen (i = 1, 2,..., N) are complete, the minimum value is determined. Although this procedure is free, as an efficient method, first, two variables w 1 to M are used._min, w_maxLet the initial values of be 1 and M, respectively (w_min+ w_max) / 2 = The largest integer less than (1 + M) / 2 is w and V_wThe first large / small comparison device determines whether there is a user who has the following values as intentional values._iThe w th element from_{i, w}Seq that is arranged in a predetermined order (for example, the user is assigned a number in advance and the number is in that order)_{s, w}= S_{1, w}‖S_{2, w}‖… ‖S_{N, w}(‖ Represents data concatenation), and the second large / small comparison device displays the information sequence t for all users._iTo w th element t_{i, w}Seq, which is arranged in a predetermined order_{t, w}= T_{1, w}‖T_{2, w}‖… ‖T_{N, w}Create and Seq_{s, w}And Seq_{t, w}Are compared using one-way functions or cryptographic functions without revealing their own values, and if they are different, V_wIt is determined that there is a user who has the following values, and the variable w_maxSubstituting w for Seq_{s, w}, Seq_{t, w}And make the comparison and V_wIt is determined that there is no user with the following values as intended, and the variable w_minSubstituting w + 1 for_min= W_maxBy repeating until (= MIN), the minimum value V_MINTo decide.
Finally w_min= w_maxIf = MIN, Seq_{s, MIN}, Seq_{t, MIN}Publishing the minimum value for everyone V_MINCan be identified.
[0012]
DETAILED DESCRIPTION OF THE INVENTION
When performing a size comparison, the upper limit integer value V_M, Lower integer value V₁Assume that a large prime number P has already been determined. The prime number P is a prime number such that P-1 has a large prime factor as a divisor, that is, satisfies a condition of a cryptosystem with a discrete logarithm problem as a place.
First, as a first embodiment, a method will be described in which two users can specify only the minimum value and the user who sets it as the intended value from the intended values of all users using two size comparison devices. Next, as a second embodiment, an example in which security is improved, and as a third embodiment, when three size comparison devices are used, and one of them is in the middle of a size comparison, the system goes down. A method is shown in which only the minimum value and the user who sets the minimum value from the intended value read by the user can be specified.
First embodiment
First, FIG. 1 shows the configuration of the entire system in the first embodiment. User devices 13-1 to 13-N, size comparison devices 15A and 15B, a bulletin board device 21, and a database 23 are provided. The size comparison devices 15 </ b> A and 15 </ b> B can communicate with the bulletin board device 21. The symbol Y indicates browsing information read from the bulletin board device 21. A database 23 is connected to the bulletin board device 21. Note that the size comparison device 15C indicated by a broken line in FIG. 1 is used in a third embodiment to be described later.
[0013]
As shown in FIG. 2, each user device 13-i includes an input unit 30, a random number generation unit 31, a storage unit 32, an information series generation unit 33, an encryption unit 34, a hash function calculation unit 35, The transmitting unit 36, the control unit 37, the connecting unit 38, and the disassembling unit 39 are configured.
Each user 11-i (i = 1, 2,..., N)₁V_MThe following integer value V_viAnd is input to the user device 13-i by the input unit 30 such as a keyboard. The information sequence generation unit 33 of the user device 13-i receives the input V_viAnd two series of information s with the same number of elements M based on the random number generated by the random number generator 31._i= {S_{i, 1}, s_{i, 2},…, S_{i, M}} And t_i= {T_{i, 1}, t_{i, 2},…, T_{i, M}} Is generated. M is V₁To V_MIs the number of values that the user can select as the intent value, and therefore a monotonically increasing series of values V₁~ V_MRespectively correspond to the numbers 1 to M on a one-to-one basis.
[0014]
Here, user 11-i sets the mean value to V_vi2 series s_i, t_iS_{i, 1}= T_{i, 1}, S_{i, 2}= T_{i, 2}, ..., s_{i, vi-1}= T_{i, vi-1}, S_{i, vi}≠ t_{i, vi}, S_{i, vi + 1}≠ t_{i, vi + 1}, ..., s_{i, M}≠ t_{i, M}To be generated. S_iAnd t_iV₁V_viLess than corresponding elements (information) are equal to each other and V_viV_MThe following corresponding elements are generated differently.
FIG. 3 shows such two series of information s._iAnd t_iAn example of the generation procedure is shown.
Step S1: vi-1 random number r having a predetermined number of bits₁, r₂,…, R_(vi-1)Generate these s_{i, m}= t_{i, m}, m = 1,2, ..., vi-1 two subsequences s_{i, 1}, s_{i, 2},…, S_{i, vi-1}And t_{i, 1}, t_{i, 2},…, T_{i, vi-1}And
Step S2: Let m be vi.
Step S3: Two random numbers r_s, r_tIs generated.
Step S4: These two random numbers r_sAnd r_tIf they are equal, the process returns to step S3.
Step S5: If these two random numbers are different from each other, r_sS_{i, m}R_tT_{i, m}And m is incremented by one.
Step S6: If m is smaller than M, the process returns to Step S3.
Step S7: If m is not smaller than M in Step S6, the two partial series s generated in Step S1_{i, 1}, s_{i, 2},…, S_{i, vi-1}And t_{i, 1}, t_{i, 2},…, T_{i, vi-1}Set by repeating steps S3 to S5_{i, vi}, s_{i, vi + 1},…, S_{i, M}And t_{i, vi}, t_{i, vi + 1},…, T_{i, M}2 series information_i= {S_{i, 1}, s_{i, 2},…, S_{i, M}} And t_i= {T_{i, 1}, t_{i, 2},…, T_{i, M}} Is stored in the storage unit 32 of FIG.
[0015]
Random number R1 in the random number generator 31_i, R2_iProduces (s_i, R1_i) To the size comparison device 15A, (t_i, R2_i) Are secretly stored in the size comparison device 15B, for example, the encryption unit 34 uses the encryption function E_A, E_BEncrypted sequence information E_A(s_i‖R1_i), E_B(t_i‖R2_i). Encryption function E_AAnd E_BAre public key encryption functions that can be decrypted only by the size comparison devices 15A and 15B. In addition, the minimum intention value V described later_MINAs the data for verifying the validity of the random number r_iAnd the implied value V at the connecting portion 38._viAnd random number r_iV concatenated_vi‖R_iFurther, r is decomposed by the decomposition unit 39._i= a_i* b_iRandom number information a (* is an operator announced in advance)_i, b_iDecide. Operator * is a_i, b_iIf given_iAs long as it is necessary to be determined uniquely, for example, exclusive OR, subtraction, addition, etc. can be used.
[0016]
Concatenation of each series and random number by hash function calculator 35_i‖R1_iAnd t_i‖R2_iFor the hash value h1 by the hash function h_i= H (s_i‖R1_i), H2_i= H (t_i‖R2_i). The hash function calculation unit 35 further includes a_i, b_i, V_vi‖R_iHash value h (a_i), h (b_i), h (V_vi‖R_i) And all these are transmitted to the bulletin board apparatus 21. The minimum and maximum values V₁, V_M2 series_i, T_i, Random number R1_i, R2_i, Mean value V_vi, Random number r_i, Random number information a_i, b_iIs stored in the storage unit 32, and the transmission unit 36 transmits each information to the size comparison devices 15A and 15B and the bulletin board device 21. Reading / writing with respect to the memory | storage part 32 and the operation instruction | indication with respect to each part are performed by the control part 37. FIG. The user device 13-i may be configured to function by executing a program with a computer.
[0017]
Each user device 13-i has a hash value h (V_vi‖R_i), H1_iAnd H2_iIs sent to the bulletin board device 21 and the value is disclosed to the_viIs committed. In other words, mean value V_viV without revealing_viIs registered as having the desired value. As a result, the implied value V_viCan not be changed, and for whatever reason, the value V_viLarger value is minimum value V_MIN, S_i, R1_i, T_i, R2_iOr (V_vi‖R_i) Is open to the public_viThe minimum value V announced_MINIt can show that it is smaller and can prove fraud. In addition, information series s_i, t_iInstead of hashing each of them individually,_i, t_iAnd random number R1_i, R2_iThe reasons for concatenating and hashing are as follows. That is, H1_i= H (s_i), H2_i= H (t_i) If the number of bits of each element of the information sequence si, ti is reduced and the sequence s_iOr t_iIf one of the users knows in some way, that user can easily estimate the value of the other (thus s_i, t_iKnow V_viThis is to prevent such a situation and increase the secret for the size comparison devices 15A and 15B. However, if the confidentiality may be relaxed to some extent or if the number of bits of each element is large, the random number R1_i, R2_iMay be omitted.
[0018]
As shown in FIG. 4 (and FIG. 5), the configuration of the size comparison device 15A (and 15B) includes a receiving unit 40A (40B), a decrypting unit 47A (47B), a storage unit 47A (47B), and a random number generating unit. 42A, (42B), a hash function calculation unit 43A (43B), a power-residue calculation unit 44A (44B), a transmission unit 45A (45B), and a control unit 46A (46B).
Encrypted sequence information E from each user device 13-i received by the receiving unit 40A of the size comparison device 15A_A(s_i‖R1_i) Is decrypted by the decryption unit 47A and s_i‖R1_i(i = 1, ..., N) is obtained, s as needed_i‖R1_iH (s) by hashing with the hash function calculation unit 43A_i‖R1_i), And this is published on the bulletin board 21_iCan be verified. Obtained s_i‖R1_iFrom information series₁~ S_NAnd random number R1₁~ R1_NSeparated and stored in the storage unit 41A. The large prime number P described above is also stored in advance in the storage unit 41A. Similarly, the encrypted sequence information E from each user device 13-i received by the receiving unit 40B of the size comparison device 15B._B(t_i‖R2_i) Is decoded by the decoding unit 47B and obtained t_i‖R2_iVerify the information series t₁~ T_NAnd random number R2₁~ R2_NAre stored in the storage unit 41B. The large prime number P is stored in the storage unit 41B.
[0019]
The bulletin board device 21 stores the information received from the user devices 13-1 to 13-N and the size comparison devices 15A and 15B in the database 23, and makes the information accessible to any device. It is determined whether the information from the comparison devices 15A and 15B matches, and only the value of w given to the size comparison devices 15A and 15B is updated based on the determination result, and their configuration is not shown.
Encryption information E from all user devices 13-i, i = 1, ..., N_A(s_i‖R1_i), E_B(t_i‖R2_i), Hash value H1_i, H2_i, h (V_vi‖R_i), h (a_i), h (b_i) Transmission is completed, for example, from the bulletin board device 21, two integer variables 1 to M are w._min, w_maxLet the initial values of be 1 and M, respectively (w_min+ w_max) / 2 = Initial value V, where w is the largest integer less than (1 + M) / 2_wIs transmitted to the size comparison devices 15A and 15B and received by the receiving units 40A and 40B. As shown in FIG. 4, the size comparison device 15A receives a random number RA from the random number generator 42A._wAnd the sequence s received from each user device 13-i by the sequence generator 48A_iElement s corresponding to w_{i, w}Of the elements arranged in the order of user 11-1, user 11-2,..., User 11-N._{s, w}= S_{1, w}‖S_{2, w}‖… ‖S_{N, w}Create The hash function calculation unit 43A uses the hash function h ′ to connect the elements Seq_{s, w}Hash value for HS_w= H '(Seq_{s, w}) And the random number RA generated by the coupler 49A_wAnd hash value HS_wConcatenated RA_w‖HS_wHash value HA with hash function h for_w= H (RA_w‖HS_w) And calculate its HS_wAnd random number RA_wIs input to the modular exponentiation unit 44A and the CA_w= HS_w ^RAw(mod P) and calculate them (HA_w, CA_w) Is transmitted from the transmitting unit 45A to the bulletin board apparatus 21 and disclosed. However, the hash function h ′ is a one-way function that copies an arbitrary value uniquely and randomly on the finite field Fp. The hash function h is a versatility function such as SHA-1.
[0020]
As shown in FIG. 5, the size comparison device 15B uses a random number generator 42B to generate a random number RB._wEach information sequence t received from all user devices_iElement t corresponding to w_{i, w}Are stored in the storage unit 41B and are arranged in the order of user 11-1, user 11-2,..., User 11-N._{t, w}= T_{1, w}‖T_{2, w}‖… ‖T_{N, w}Create The hash function calculation unit 43B performs element concatenation Seq using the hash function h ′._{t, w}Hash value HT for_w= H '(Seq_{t, w}) And the random number RB generated by the coupler 49B_wAnd hash value HT by hash function h_wConcatenated RB_w‖HT_wHash value for HB_w= H (RB_w‖HT_w). These HT_wAnd RB_wIs input to the modular exponentiation unit 44B and CB_w= HT_w ^RBw(mod P) and calculate them (HB_w, CB_w) Is transmitted from the transmitting unit 45B to the bulletin board apparatus 21, and is released.
[0021]
Next, the large / small comparison device 15A has the CB released by the bulletin board device 21._wIs input to the power-residue calculating unit 44A and the previously generated random number RA_wWith CB_w ^RAwAnd the calculation result is transmitted to the bulletin board apparatus 21. Similarly, the large / small comparison device 15B is also disclosed by the CA published by the bulletin board device 21._w= HS_w ^RAw(mod P) is read and input to the exponentiation remainder calculation unit 44B_w ^RBw= (HS_w ^RAw)^RBw(mod P) is calculated, and the result is transmitted to the bulletin board apparatus 21.
FIG. 6 shows the information sequence s generated by the information sequence generation unit 33 by each user device 13-i._i, t_i, i = 1,..., N are shown schematically vertically. Each pair of series_i= {S_{i, 1}, s_{i, 2},…, S_{i, m},…, S_{i, M}}, T_i= {T_{i, 1}, t_{i, 2}, ..., t_{i, m}, ..., t_{i, M}} Any pair of corresponding elements in_{i, m}, t_{i, m}), m = 1,2, ..., M, the straight line is s_{i, m}= t_{i, m}The zigzag part is s_{i, m}≠ t_{i, m}Represents a partial series. For example, as shown in the figure, the value of m = w_i, t_iFor a set of (s)_{1, w}‖S_{2, w}‖… ‖S_{N, w}) ＝ (t_{1, w}‖T_{2, w}‖… ‖T_{N, w}), Ie Seq_{s, w}= Seq_{t, w}And hence h '(Seq_{s, w}) = h '(Seq_{t, w}), Ie HS_w= HT_wIt can be seen that it is. However, the height of w is at least one set of s_i, t_iIf the height passes through the zigzag part of (s_{1, w}‖S_{2, w}‖… ‖S_{N, w}) ≠ (t_{1, w}‖T_{2, w}‖… ‖T_{N, w}So, HS_w= HT_wThe possibility of becoming small is negligible. Therefore, HS_w≠ HT_wIt becomes.
[0022]
HS_wAnd HT_wIf they are equal, they are sent to the bulletin board device 21 (HT_w ^RBw)^RAw(mod P) and (HS_w ^RAw)^RBw(mod P) is equal. Also, since P is a large prime number and P-1 has a large prime factor as a divisor, HS_wAnd HT_wAre different, (HT_w ^RBw)^RAw(mod P) and (HS_w ^RAw)^RBwThe possibility that (mod P) is equal is negligibly small. Therefore, (HT_w ^RBw)^RAw(mod P) and (HS_w ^RAw)^RBws if (mod P) is equal_{1, w}= T_{1, w}, S_{2, w}= T_{2, w}, ..., s_{N, w}= T_{N, w}Therefore, for each i, s_{i, m}= t_{i, m}, m = 1,…, w and V₁To V_M1st to wth values V of M values₁~ V_wMean value V_viNot, therefore minimum mean value V_MINThere is no. That is, there is a minimum intention value from the (w + 1) th to the Mth. (HT_w ^RBw)^RAw(mod P) and (HS_w ^RAw)^RBwIf (mod P) is different, it is understood with an overwhelming probability that there is a minimum intention value below the w-th.
[0023]
The bulletin board apparatus 21 performs this comparison judgment, and if (HT_w ^RBw)^RAw(mod P) and (HS_w ^RAw)^RBwThe variable w if (mod P) is equal_minIs substituted for w + 1, and if it is different, the variable w_maxThe above operation is repeated by substituting w for. By repeating the above, w in approximately logM times_max= W_min(= MIN). At this time, V₁~ V_MMIN-th value V in_MINIs the minimum intention value.
The above-described minimum value search procedure is shown in FIG.
Step S1: The bulletin board apparatus 21 starts with an integer variable w of 1 to M._minAnd w_maxLet the initial values of be 1 and M, respectively (w_min+ w_max) / 2 or less, and the maximum integer w is transmitted to the size comparison devices 15A and 15B.
Step S2A: Element connection Seq in the size comparison device 15A_{s, w}And random number RA_wGenerates a hash value HS_w= h '(Seq_{s, w}), HA_w= h (RA_w‖HS_w) And power residue CA_w= HS_w ^RAwCalculate (mod P)_w, CA_w) Is transmitted to the bulletin board apparatus 21.
Step S2B: Similarly in the size comparison device 15B, the element connection Seq_{t, w}And random number RB_wProduces HT_w= h '(Seq_{t, w}), HB_w= h (RB_w‖HT_w), CB_w= HT_w ^RBwCalculate (mod P) and (HB_w, CB_w) Is transmitted to the bulletin board apparatus 21.
Step S3A: The size comparison device 15A receives the CB from the bulletin board device 21._wRead CB_w ^RAwmod P = (HT_w ^RBw)^RAwmod P is calculated and transmitted to the bulletin board apparatus 21.
Step S3B: The size comparison device 15B receives the CA from the bulletin board device 21._wRead the CA_w ^RBwmod P = (HS_w ^RAw)^RBwmod P is calculated and transmitted to the bulletin board apparatus 21.
Step S4: The bulletin board apparatus 21 is (HT_w ^RBw)^RAwmod P and (HS_w ^RAw)^RBwCheck whether mod P matches.
Step S5: If they match, w + 1 is w_minAnd
Step S6: If they do not match, w is w_maxAnd
Step S7: w_max= W_minIf not, the process returns to step S1, and the same processing by steps S2A, S2B, S3A, S3B, S4, S5, and S6 is repeated.
Step S8: w in step S7_maxAnd w_minIf they are equal, w_min= MIN and the value corresponding to the number MIN is the minimum intention value V_MINWill be announced together. The size comparison devices 15A and 15B are element connected Seq corresponding to MIN._{s, MIN}, Seq_{t, MIN}Is transmitted to the bulletin board apparatus 21 to thereby correspond to the corresponding element s in the connection of these two elements._{j, MIN}And t_{j, MIN}This makes it possible to identify users 11-j whose mutually differ.
[0024]
In other words, each of the users 11-1 to 11-N_v1~ V_vNThe lowest mean V of those committed as_MINWould have been sought. This minimum mean value V_MINAfter knowing, the size comparison device 15A, 15B_min= w_max= Seq when MIN_{s, MIN}, RA_MIN, Seq_{t, MIN}, RB_MINAre transmitted to the bulletin board apparatus 21, and all the users 11-1 to 11-N are connected to the two elements connected Seq._{s, MIN}, Seq_{t, MIN}The corresponding element of_{i, MIN}And t_{i, MIN}, For each i = 1, ..., N and the corresponding part is s_{j, MIN}≠ t_{j, MIN}The user 11-j corresponding to the j-th part containing the information that is_MINThe mean value V_vjIt can be confirmed. Seq_{s, MIN}, Seq_{t, MIN}Is known, the user j corresponding to the different j-th can be identified.
[0025]
In the first embodiment described above, the size comparison device 15A has the users 11-i, i = 1,._i= a_i* b_iRandom number information a_iThe size comparison device 15B receives random number information b from the user 11-i._iIs receiving. Also, the bulletin board device 21 receives the h (a_i), h (b_i), h (V_vi‖R_i). Therefore, minimum intention value V_MINIf the size comparison device 15A determines that the random number r for all users is_iIf you know about V for each i₁To V_MUp to each value V_wFor h (V_w‖R_i) To calculate the published h (V_vi‖R_i) Matches V_w= V_viTherefore, the bulletin board device 21 is V_MINV before starting the search_MINIs not known from the viewpoint of security. However, in the first embodiment described above, r_i= a_i* b_iRandom number information a_iAnd b_iAre separately supplied to the size comparison devices 15A and 15B, the size comparison devices 15A and 15B are each independently V_MINCannot be explored.
[0026]
Minimum intention value V_MINAfter searching for the minimum mean value V published to the bulletin board device 21_MINCan be verified as follows.
User 11-j h (a_j), h (b_j), h (V_vj‖R_j) Has already been released. The large and small comparison devices 15A and 15B have random number information a_j, b_jIs sent to the bulletin board device 21 and published. Each user device 13-i is a V_vj= V_MIN, r_j= a_j* b_jUse h (V_MIN‖A_j* b_j) And calculate h (V_MIN‖A_j* b_j) = h (V_vj‖R_j) Is verified. If they do not match, it means that the user 11-j has cheated or the size comparison device 15A or 15B has cheated. So a_j, b_jTo h (a_j), h (b_j) And verify that they match what is published. If there is a mismatch, a_j, b_jIt can be determined that the size comparison device that transmitted the mismatched ones made fraud. If both match, the published h (V_vj‖R_j) Can be determined to have been fraudulent.
[0027]
Thus, each user has r_i= a_i* b_iBecome a_i, b_iH (a_i), h (b_i), h (V_vi‖R_i) To the bulletin board device 21, the size comparison devices 15 </ b> A and 15 </ b> B send the bulletin board device 21 a_j, b_jThe verification information h (a) published by the bulletin board device 21 can be confirmed._i), h (b_i) Is proved to belong to user 11-i, a_i, b_iThe same effect as when the user 11-i attaches a signature to guarantee the correctness is obtained, and the calculation processing amount is smaller than when the signature is used, and the user does not need a signature means. . Random number r_iIt is desirable that the size is sufficiently large from the viewpoint of security.
[0028]
In the first embodiment described above, it is assumed that HT_wWhat I knew was HS_wIf it is correct, the value of the other user's intention can be known. However, since P is a large prime number and P-1 has a large prime factor as a divisor, HS_w ^RAwmod P RA_wBecause it is difficult to ask for_wI can't know if is really correct. Therefore, other users cannot know the intended value.
Finally, RA_MIN, RB_MINBy publishing these and Seq_{s, MIN}, Seq_{t, MIN}By using, it is possible to confirm whether the size comparison processing has been performed correctly.
[0029]
In the large / small comparison devices 15A and 15B, reading and writing to the storage units 41A and 41B, processing of received information, sending each piece of transmission information to the corresponding device by the sending units 45A and 45B, and operating the other units, etc. This is performed by the control units 46A and 46B. The size comparison devices 15A and 15B can also function by executing a program with a computer.
The bulletin board device 21 is not particularly shown in its figure, but includes a transmission / reception unit for each user device and the size comparison device 15A, 15B, stores the received information in the database 23 (FIG. 1), and requests browsing If there is, the database 23 reads out the corresponding information and transmits it to the request source, and also performs the processing shown in FIG. 7 and the transmission / reception necessary for its execution. The bulletin board device 21 can also be made to function by executing a program by a computer.
[0030]
In the above, a series of values V₁~ V_MAre associated with numbers 1 to M in ascending order, and the implied value V of all users_viMedium minimum value V_MINWas explained, but the maximum intention value V_MAXTo determine the series of values V₁~ V_MOn the other hand, if numbers 1 to M are associated in descending order, the mean value V_viIf the number corresponding to is vi, two information series s_i, t_iIs generated when the number element w is 1 or more and less than vi for numbers 1 to M._{i, w}= t_{i, w}And s for vi and above and below M_{i, w}≠ t_{i, w}If the information sequence is generated so that_viMaximum value of V_MAXCan be determined. That is, the value V in FIG.₁~ V_MBy simply reversing the top and bottom of_MINTo determine the number MIN giving the maximum mean value V_MANIt can be seen that this is the same as determining the number MAX giving. That is, in the first embodiment described above, V₁~ V_MIf the numbering of 1 to M is reversed to M to 1 and MIN is replaced with MAX, the process of FIG._MAXThe size comparison processing procedure for searching for is shown. The same applies to the following embodiments.
Second embodiment
By the way, in the above-described first embodiment, if a user 11-i collaborates with either one of the size comparison devices, the user 11-i has already reached the mean value V._viDespite being committed, the game can be abandoned (bid cancellation) without being known to other users and other size comparison devices. Here, the abandoned game is the committed intention value V_viIndependently, i.e. the mean value V of all users_v1, V_v2, ..., V_vNMedium, V_viRegardless of whether or not the user 11-i is the smallest, the user 11-i_MINIt means that it is not determined by (do not make a successful bid).
[0031]
For example, whenever the user 11-i collaborates with the size comparison device 15B and w is given from the bulletin board device 21 in the size comparison processing of FIG. 7, the sequence element t of the user 11-i is obtained in step S2B._{i, w}The element concatenation Seq_{t, w}Instead of embedding in, the sequence element s informed by user 11-i_{i, w}By embedding the value of_{i, w}≠ t_{i, w}Where s should be_{i, w}= t_{i, w}By doing so, even if user 11-i's mean value V_viIs the minimum value V_MINEven if the user 11-i is the minimum value V in the minimum value search by the bulletin board device 21_MINWill no longer be determined as one of the remaining users V_MINIt will be decided. Such a decision is not justified. This minimum value V_MINAs for the validity of the decision, the above-mentioned validity verification method uses the minimum value V_MINDetermined and published intention value V_vjAnd for user 11-j only h (V_vj‖R_j) And h (a_j‖B_j) Cannot be detected because the user 11-i collides with the size comparison device 15B.
[0032]
In the following, a size comparison method of an embodiment improved so as to prevent fraud by collusion between such a user and a size comparison device will be described.
The feature of this second embodiment is that the information series s of each user 11-i pair in the first embodiment_i, t_iThe feature is the sequence s of M elements._i= {S_{i, 1},…, S_{i, M}} And t_i= {T_{i, 1}, ..., t_{i, M}}, The generation of the m-th element is to generate it based on the information of all elements that go back to it. Therefore, the series s_{i, 1}, s_{i, 2},…, S_{i, M}The mth element s_{i, m}T_{i, m}Or any other value s'_{i, m}Replace with the series s_{i, 1}, s_{i, 2},…, S '_{i, m},…, S_{i, M}Element s' in_{i, m}Is an element that goes back_{i, 1}, s_{i, 2},…, S_{i, m-1}Not based on the information of, and subsequent elements_{i, m + 1},…, S_{i, M}Also elements_{i, m}Since it is not based on previous elements, its unauthorized replacement can be detected. The second embodiment will be specifically described below.
[0033]
FIG. 8 shows the configuration of the user device 13-i for carrying out the size comparison method according to the second embodiment. In this configuration, the connecting unit 38 and the disassembling unit 39 are removed from the user apparatus of FIG. 2, and the information series generating unit 33 is configured as shown in FIG. The random number generation unit 31 uses the random number R1 as in the embodiment of FIG._i, R2_iAnd s as the initial random number_{i, M + 1}, t_{i, M + 1}, ca_i, cb_iIs generated. The information sequence generator 33 sequentially s_{i, M}, s_{i, M-1},…, S_{i, 1}, And s_{i, 0}And t_{i, M}, t_{i, M-1}, ..., t_{i, 1}Is generated.
FIG. 9 shows a configuration example of the information series generation unit 33. In FIG. 9, the information sequence generator 33 includes hash calculators 33-1A and 33-1B, couplers 33-2A and 33-2B, hash calculators 33-3A and 33-3B, and a coupler 33-4. It consists of. Hash calculators 33-1A and 33-1B have initial random numbers ca_i, cb_iAre given, and their hash value h (ca_i), h (cb_i), And the next time and after, the calculation results are repeatedly hashed. The coupler 33-2A_iThe sequence information and the output of the hash calculators 33-1A and 33-1B at that time are connected. The coupler 33-2B is t_iThe sequence information and the output of the hash calculators 33-1A and 33-1B at that time are connected. The hash calculators 33-3A and 33-3B calculate the hash value from the outputs of the couplers 33-2A and 33-2B, respectively, and the sequence elements s of that time_{i, m}, t_{i, m}Output as. The outputs of the hash calculators 33-1A and 33-1B input to the couplers 33-2A and 33-2B for the m-th hash calculation by the hash calculators 33-3A and 33-3B are This is the hash operation output.
[0034]
s_{i, m}≠ t_{i, m}Subseries of_{i, m}, t_{i, m}In the process of generating_iSeries information and t_iS as the initial value of the series information_{i, M + 1}, t_{i, M + 1}Is input to the connectors 33-2A and 33-2B, and the first hash output of the hash devices 33-1A and 33-1B is input to both connectors 33-2A and 33-2B, and the outputs of those connectors S after the second hash value_iSeries information and t_iAs series information, it is given as an input to couplers 33-2A and 33-2B.
When generation of the partial series from m = M to m = v ends, the expected value V_viThe output s of coupler 33-4 at m = vi-1 corresponding to_{i, vi}‖T_{i, vi}To both couplers 33-2A and 33-2B_iSeries information and t_iThe hash value is calculated by the hash calculators 33-3A and 33-3B, which are input as series information and the concatenation results. In this process, the same series information s as the output of the same hash calculator 33-1A, 33-1B_{i, vi}‖T_{i, vi}Is given to both couplers 33-2A and 33-2B, the output s of the hash calculators 33-3A and 33-3B at m = vi-1_{i, m}And t_{i, m}Are equal.
[0035]
After that, the output of the hash calculators 33-3A, 33-3B again_{i, m}, t_{i, m}Are input to the couplers 33-2A and 33-2B as series information, respectively, and s is obtained by repeating the sequential calculation for m = vi-2, vi-3,._{i, m}= t_{i, m}Are generated.
FIG. 10 shows a processing procedure of the user device 13-i in the second embodiment.
Step S1: User 11-i receives initial random number R1_i, R2_i, ca_i, cb_i, s_{i, M + 1}, t_{i, M + 1}Is generated.
Step S2: The initial value of m is set to M, and the mean value V_iSequentially for m = M, M-1, ..., vi
s_{i, m}= H (s_{i, m + 1}‖H^{M + 1-m}(ca_i) ‖H^{M + 1-m}(cb_i))
t_{i, m}= H (t_{i, m + 1}‖H^{M + 1-m}(ca_i) ‖H^{M + 1-m}(cb_i))
Calculate s_{i, m}≠ t_{i, m}Save as a partial series.
Step S3: Series elements for m = vi-1
s_{i, m}= T_{i, m}= H (s_{i, m + 1}‖T_{i, m + 1}‖H^{M + 1-m}(ca_i) ‖H^{M + 1-m}(cb_i))
Calculate and save.
Step S4: m = vi-2, vi-3,...
s_{i, m}= t_{i, m}= H (s_{i, m + 1}‖H^{M + 1-m}(ca_i) ‖H^{M + 1-m}(cb_i))
Calculate s_{i, m}= t_{i, m}Save as a partial series.
Step S5: R1_i, s_i= [s_{i, 1}, s_{i, 2},…, S_{i, M}] Encrypted and obtained E_A(s_i‖R1_i) To the size comparison device 15A, R2_i, t_i= [t_{i, 1}, t_{i, 2}, ..., t_{i, M}] Encrypted and obtained E_B(t_i‖R2_i) Is transmitted to the size comparison device 15B.
Step S6: H1_i= h (s_i‖R1_i), H2_i= h (t_i‖R2_i), s_{i, 0}, h^{M + 1}(ca_i), h^{M + 1}(cb_i) Is sent to the bulletin board device 21 and released.
[0036]
Size comparison processing by the bulletin board device 21 and the size comparison devices 15A and 15B, that is, the minimum mean value V_MINThe search process is the same as in FIG.
Minimum intention value V_MINAfter the identification, the bulletin board device 21 receives the h (ca received from each user device 13-i._i), h (cb_i) By hashing M + 1-MIN times^{M + 1-MIN}(ca_i), h^{M + 1-MIN}(cb_i), i = 1,2, ..., N and release them. The validity of these values is that the value obtained by further hashing these values MIN times is the public information h^{M + 1}(ca_i), h^{M + 1}(cb_i) To ensure that it matches. In addition, each user's s_{i, MIN}, t_{i, MIN}, h^{M + 1-MIN}(ca_i), h^{M + 1-MIN}(cb_i) Are publicly available, so that any user can s_{i, 0}Can be calculated.
[0037]
Here, if the user 11-i and the size comparison device 15A or 15B collide as described above,_{i, w}And t_{i, w}Replace these_{i, MIN}And t_{i, MIN}If you are going against_{i, 0}Different values are calculated. That is, this replacement is detected. However, this verification is inefficient on the order of the product MN of the number M of selectable values and the number N of users. However, since the original purpose is to derive the winner and its intention value, the “validity verification phase” of this loser is not essential, and in practice it is sufficient to do it after the end of the protocol.
Third embodiment
In the first and second embodiments described above, two size comparison devices are used, and each user device has two series of information s._i, t_iIn the third embodiment, three size comparison devices are used in addition to the third size comparison device 15C indicated by a broken line in FIG. Each user has 3 lines of information_i, t_i, u_iS for m = 1, 2, ..., vi-1 as in the previous embodiment._{i, m}= t_{i, m}= u_{i, m}And s for m = vi, vi + 1, ..., M_{i, m}≠ t_{i, m}≠ u_{i, m}Are secretly sent to the three size comparison devices, and the size comparison processing is performed by the two size comparison devices and the bulletin board device as in the first embodiment. In this case, if one of the two fails, the process can be executed in place of the failure of the third size comparison device. Since the basic operation is the same as that of the first embodiment, it will be described below with reference to those drawings.
[0038]
User 11-i (i = 1,2, ..., N)₁V_MThe following integer value V_viAnd the information sequence generator 33 in the user device 13-i in FIG.₁V_viAll the information corresponding to less than is equal, V_viV_MInformation corresponding to the following 3 types of information that are all different_i, T_i, U_iCreate Further, the random number generator 31 performs random number R1._i, R2_i, R3_iAnd ri, and r_i= a_i* b_i* c_iRandom number information a_i, b_i, c_iDecide. (s_i, R1_i) And information a_iTo the size comparison device 15A, (t_i, R2_i) And information b_iTo the large and small comparison device 15B, (u_i, R3_i) And information c_iAre transmitted secretly (that is, encrypted) to the size comparison device 15C. In addition, each group connection_i‖R1_i, T_i‖R2_i, U_i‖R3_iHash value H1 by hash function h_i= H (s_i‖R1_i), H2_i= H (t_i‖R2_i), H3_i= H (u_i‖R3_i) And the hash value h (a_i), h (b_i), h (c_i) And implied value V_viAnd random number r_iHash value h (V_vi‖R_i) And the hash value h (a_i), h (b_i), h (c_i) And implied value V_viAnd random number r_iHash value h (V_vi‖R_i) Are calculated, transmitted to the bulletin board apparatus 21, and released.
[0039]
Each user 11-i is H1_i, H2_i, H3_iAnd h (V_vi‖R_i) Is sent to the bulletin board device 21 and the value is disclosed to V_viIs committed. As a result, the intended value cannot be changed from now on._i, R1_i), (T_i, R2_i) 、 (U_i, R3_iIt is possible to show that the desired value is the minimum value by publishing at least two sets of). However, if at least two pairs are prepared, r_iCan be calculated.
Since the subsequent size comparison processing can be performed if the bulletin board device 21 and the two size comparison devices are provided as shown in the first embodiment, the two size comparison devices, for example, 15A and 15B are used and the processing procedure of FIG. Execute.
[0040]
That is, the bulletin board apparatus 21 first (w_min+ w_max) / 2 = (1 + M) / 2 or less is sent to the magnitude comparison devices 15A and 15B as an initial value. The large / small comparison device 15A uses a random number RA._wGenerated and received from all user equipments_iElements of_{i, w}, And the concatenation Seq of the elements arranged in the order of users 11-1, 11-2,…, 11-N_{s, w}= S_{1, w}‖S_{2, w}‖… ‖S_{N, w}Create Furthermore, the hash value HS by the hash function h ′_w= H '(Seq_{s, w}), Hash value HA by hash function h_w= H (RA_w‖HS_w) And power residue CA_w= HS_w ^RAw(mod P) and calculate them (HA_w, CA_w) Is sent to the bulletin board apparatus. The size comparison device 15B uses a random number RB_wGenerated and received from all user devices t_iElement t_{i, w}Element concatenated Seq in the order of users 11-1, 11-2, ..., 11-N_{t, w}= T_{1, w}‖T_{2, w}‖… ‖T_{N, w}And hash value HT by hash function h '_w= H '(Seq_{t, w}), Hash value HB by hash function h_w= H (RB_w‖HT_w) And CB_w= HT_w ^RBw(mod P) and calculate them (HB_w, CB_w) Is sent to the bulletin board apparatus.
[0041]
Next, the large / small comparison device 15A has the CB released from the bulletin board device 21._w= HT_w ^RBwLoad (mod P) and CB_w ^RAwmod P = (HT_w ^RBw)^RAw(mod P) is calculated and transmitted to the bulletin board device 21, and the large / small comparison device 15 </ b> B makes the CA publicized by the bulletin board device 21._w= HS_w ^RAwLoad (mod P) and CA_w ^RBwmod P = (HS_w ^RAw)^RBw(mod P) is calculated and transmitted to the bulletin board apparatus 21.
HS_wAnd HT_wAre equal (HT_w ^RBw)^RAw(mod P) and (HS_w ^RAw)^RBwSince (mod P) is equal, P is a large prime number, and P-1 has a large prime factor in the divisor, HS_wAnd HT_wIs different (HT_w ^RBw)^RAw(mod P) and (HS_w ^RAw)^RBwThe possibility that (mod P) is equal is negligibly small. Therefore, (HT_w ^RBw)^RAw(mod P) and (HS_w ^RAw)^RBwMinimum mean value V if (mod P) is equal_MINIs V_{w + 1}Above, if different, V_wIt can be seen from the overwhelming probability that Variable w if equal_minIs substituted for w + 1, and if it is different, the variable w_maxBy substituting w for and repeating the above operation, w_max= W_min(= MIN). Value V at this time_MINIs the minimum intention value. Hereinafter, as shown in FIG._i, t_iV inside_MINThe element number corresponding to.
[0042]
Minimum intention value V_MINAfter knowing, the size comparison device 15A_j, Seq_{s, MIN}, RA_MINThe size comparison device 15B is b_j, Seq_{t, MIN}, RB_MINThe size comparison device 15C is c_jAre transmitted to the bulletin board device 21 and released to the public, so that all users can obtain the minimum value V corresponding to the part containing different information for the two series._MINIt can be specified that the user 11-j has a value as intended.
In the above process, it is assumed that one size comparison device, for example, the system of 15B is down due to a trouble. However, since the information held by the size comparison device 15B and the information held by the size comparison device 15C are essentially the same, the size comparison device 15C can take over the operation of the size comparison device 15B as it is.
[0043]
Minimum intention value V_MINAfter searching for the minimum mean value V published to the bulletin board device 21_MINFor the legitimacy of H (A_j), H (B_j), H (C_j) For example as shown in Shamir, A, "How to Share a Secret," Comm. Assoc. Comput. March., Vol. 22, no. 11, pp. 612-613 (Nov. 1979) By applying the secret sharing technology, any at least two of the three large and small comparison devices cooperate, and the user's committed value A_j, B_j, C_jCan be disclosed. That is, H (V_min‖A_j* B_j* C_j) Can be verified.
[0044]
The size comparison devices 15A and 15B are connected elements Seq._{s, MIN}, Seq_{t, MIN}Is sent to the bulletin board device 21 and published._{s, z}, Seq_{t, z}(z = 1, 2,..., MIN), which is used for the size comparison process is transmitted to the bulletin board apparatus 21, and V_MINYou may clarify that is correct.
As described above, in the present invention, the key is the element s corresponding to the value w specified by the bulletin board device 21 in the size comparison devices 15A and 15B._{i, w}, t_{i, w}Each series_i, t_iElement connected Seq extracted from (i = 1, ..., N) and arranged in a predetermined order_{s, w}And Seq_{t, w}And compare these without revealing, V or_wOr less (V for maximum value_wIn the above, it is determined whether there is a user who has the desired value, and w may be changed based on the determination result. The size comparison devices 15A and 15B are power-residue operations CA._w= HS_w ^RAw(mod P), CB_w= HT_w ^RBw(mod P) is not used, and in steps S2A and S2B of FIG._w= h (Seq_{s, w}) And HT_w= h (Seq_{t, w}) May be generated and transmitted to the bulletin board apparatus 21, and these may be compared in step S4 to determine whether they match. However, in this case, the series s_i, t_iFor example, if each element of has a simple configuration of 1 bit, element concatenation Seq_{s, w}Becomes a simple one like (0‖1‖1‖0‖1‖0 し ま い 0)._{s, w}, And calculate its hash value and make it public_w= h (Seq_{s, w}) Is not preferable for safety because it becomes easy to find a bit string that matches) by trial and error. On the other hand, as in the embodiment of FIG._wAnd HT_wRandom number RA_w, RB_wHS by concatenating with and hashing_w, HT_wIf you conceal_i, t_iIt is safe to use 1 element as 1 bit. Series_i, t_iEncryption element E transmitted from the user device to the size comparison devices 15A and 15B._A(s_i‖R1_i), E_B(t_i‖R2_i) Data amount and communication capacity can be reduced.
[0045]
Hash value for verification H1_i= h (s_i‖R1_i), H2_i= h (t_i‖R2_i) Is transmitted to the bulletin board apparatus 21 in the same manner as the random number R1._i, R2_iHas improved safety and is not necessarily used. Therefore H1_i= H (s_i), H2_i= H (t_i) May be transmitted to the bulletin board apparatus.
In the above description, the Seq created by the size comparison devices 15A and 15B is used._{s, w}, Seq_{t, w}Used a one-way function to compare without revealing its own value, but for example, with the same encryption key,_{s, w}, Seq_{t, w}The result may be transmitted to the bulletin board device 21 for comparison.
[0046]
In the first and third embodiments described above, the two-sequence information s generated by the information sequence generator 33_i, T_iFor example, when obtaining the minimum value, a predetermined common one-way function F is used, and the mean value V_viF^d(s'_i) ≠ F^d(t '_i), (D = 0, 1,…, M-vi) and F^e(s'_i) ＝ F^e(t '_i), (E = M-vi + 1,…, M-1)_i, t '_iYou may decide. Where for example F^Three(s'_i) Is F (F (F (s'_i))) Is a multiple function. Therefore, the information series s_i, t_iEach
s_i= {S_{i, 1}= F^M-1(s'_i), s_{i, 2}= F^M-2(s'_i),…, S_{i, vi-1}= F^{M-vi + 1}(s'_i), s_{i, vi}= F^M-vi(s'_i),…, S_{i, M-1}= F (s'_i), s_{i, M}= S '_i}
t_i= {T_{i, 1}= F^M-1(t '_i), t_{i, 2}= F^M-2(t '_i),…, T_{i, vi-1}= F^{M-vi + 1}(t '_i), t_{i, vi}= F^M-vi(t '_i),…, T_{i, M-1}= F (t '_i), t_{i, M}= t '_i}
It becomes. In this series generation method, the seed value s'_i, t '_i, All elements s using a common one-way function F_{i, 1},…, S_{i, M}And t_{i, 1}, ..., t_{i, M}Can be obtained by calculation. Therefore, the encrypted sequence information E sent from the user device to the size comparison devices 15A and 15B._A(s_i‖R1_i) And E_B(t_i‖R2_i) Series_i, t_iSheet value s' without incorporating the whole of_i, t '_iOnly, ie E_A(s'_i‖R1_i), E_B(t '_i‖R2_i), The size comparison devices 15A and 15B use the common one-way function F to generate the seed value s ′._i, t '_iSeries from_i, t_iCan be generated.
[0047]
Such seed value s'_i, t '_iBased on information series_i, t_iA method for determining the multiple function F (x) for generating and the seed value will be described below.
The user apparatus 11-i selects prime numbers p and q having an appropriate size and calculates a composite number n = p * q. The composite number n is the one used in RSA cryptography and the like based on the prime factorization problem. From the viewpoint of security, it is preferable that p and q are about 512 bits or 1024 bits, and p-1 and q-1 each have a large prime factor.
Subsequently, for k = 0 to m, a random number a between 0 and n-1_kProduces a polynomial
F (x) = a_m* x^m+ A_m-1* x^m-1+… + A₁* x + a₀
Create Next, a random number s' between 0 and n-1_i, t '_iAre used as seed values. Next, although the method is free, for example, find a collision for F (x) mod n by:
Step 1: F for u = 1,2, ..., c^u(s'_i) mod n is calculated and the result F (s'_i), F²(s'_i), ..., F^c(s'_i) Is memorized. Here, c is a parameter determined by the user, and F^u(x) is a u-fold multiple function.
Step 2: Set flag = 0, v = 0, mx = c ′. Here, c ′ is a parameter determined by the user.
Step 3: F^v(t '_i) mod n is calculated, the result of the calculation is stored, and the value of F (s' stored in step 1 is stored._i), F²(s'_i), ..., F^c(s'_i) Is checked, and if there is a match, flag = 1 is set.
Step 4: If flag = 1 or v = c ′, the process is terminated; otherwise, v is incremented by 1 and the process returns to Step 3.
[0048]
In this case, finally flag = 1 is equivalent to the collision being found. However, in general, since F (x) mod n takes a wide range (about 1024 bits or 2048 bits), it is expected that a collision cannot be easily found. Therefore, by selecting a natural number n ′ smaller than n and replacing the original output F (x) mod n with (F (x) mod n) mod n ′, it is easy to find a collision by reducing it to a small range. it can. Here, for example, (35mod15) mod3 is 5mod3 = 2. In any case, the following explanation will be made assuming that a collision has been found.
[0049]
F^u'-1(s'_i) ≠ F^v'-1(t '_i), F^{u '}(s'_i) ＝ F^{v '}(t '_i), Intended value V_viIs the minimum value V₁Assuming that it is the w-th counting from, if M−w + 1 ≦ u ′ and M−w + 1 ≦ v ′, then s_i, t_iCan be configured. That is,
s_i= {S_{i, 1}= F^{u '+ w-2}(s'_i), ..., s_{i, w}= F^u'-1(s'_i), ..., s_{i, M}= F^{u '+ wM-1}(s'_i)}
t_i= {T_{i, 1}= F^{v '+ w-2}(t '_i), ..., t_{i, w}= F^v'-1(t '_i), ..., t_{i, M}= F^{v '+ wM-1}(t '_i)}
And it is sufficient.
It should be noted that the composite number n based on the prime factorization problem is used as the modulus (mod) when there is a constant x ′ and the polynomial F ′ (F (x) −x ′ = 0 mod n This is because the factorization of x) = F (x) / (x−x ′) cannot be easily performed. For example, s_iS which is one of the elements of_{i, k}F (z) = s_{i, k}There is only one z that satisfies mod n, ie s_{i, k + 1}Obviously, user 11-i is V_kIt can be seen that is not taken as a mean value.
[0050]
In the collision search method described above, there is a risk that information on the mean value will be leaked, so it is necessary to pay attention to how n ′ is taken. Conversely, s_i, t_iIf the above configuration condition is not satisfied, the collision search steps 1 to 4 may be performed again.
A hash function may be used as the function F (x). Even in that case, it is generally expected that the collision is not easily found, but the collision can be easily found by reducing the output to a small range by the same method as described above. However, depending on the size to be reduced, it may be necessary to pad the input.
[0051]
According to the method of sending only the seed value as described above, it is possible to reduce the communication capacity and communication time for transmitting the sequence information to the size comparison device. Also, mean value V_viEven if the number M of selectable values increases, only the seed value is sent, and the communication capacity does not change. On the other hand, when generating a sequence using random numbers as in the first embodiment, if the number M of values that can be selected as the mean value increases, the number of elements in the sequence increases in proportion to that and the communication capacity increases. To do.
Similarly, when obtaining the maximum value, all elements of the sequence may be generated from the seed value using a one-way function.
[0052]
In the above embodiment, the intended value V of all users_viMedium minimum value V_MINWas determined, but the maximum intention value V_MAXThe determination can be made in the same manner. In this case, 2 series information_iAnd t_iAs V₁V_viInformation corresponding to_iAnd t_iAnd V_{vi + 1}V_MInformation corresponding to_iAnd t_iAnd be equal. Seq corresponding to each selected w_{s, w}And Seq_{t, w}Comparison, HS_w= H '(Seq_{s, w}) And HT_w= H '(Seq_{t, w}) Comparison, (HT_w ^RBw)^RAwmod P and (HS_w ^RAw)^RBwV if different in mod P comparison_wIt is determined that there is a user who has the above values, and if they are equal, V_wIt is determined that there is no user with the above values, and if they are equal, w-1 is set to w_maxIf they are different, w is w_minThe same process may be repeated.
[0053]
If w is determined as described above, the minimum value or the maximum value can be efficiently obtained.₁Or V_MIt is also possible to make a size comparison by sequentially changing the order. Further, one size comparison device determines the first w, sends w to the other size comparison device via the bulletin board device 21, receives the necessary information from the bulletin board device 21, and performs the processing shown in FIG. Also good.
[0054]
【The invention's effect】
As described above, according to the present invention, the user can efficiently specify the maximum value or the minimum value by transmitting information about the intended value only once to each size comparison device and bulletin board device, and is necessary. Therefore, it is possible to realize a highly confidential size comparison that can be specified only by a user who sets the value to the desired value.
[Brief description of the drawings]
FIG. 1 is a diagram showing an example of the overall system configuration of a first embodiment.
FIG. 2 is a diagram illustrating an example of a main functional configuration of a user apparatus.
FIG. 3 is a flowchart showing a procedure for generating two-line information.
FIG. 4 is a diagram illustrating an example of a main functional configuration of a size comparison device 15A.
FIG. 5 is a diagram showing an example of a main functional configuration of a size comparison device 15B.
FIG. 6 is a diagram schematically showing two-series information of each set.
FIG. 7 is a flowchart for specifying a minimum value.
FIG. 8 is a block diagram showing a functional configuration of a user apparatus in the second embodiment.
9 is a block diagram showing a functional configuration of an information series generation unit 33 in FIG.
FIG. 10 is a flowchart showing a processing procedure of a user apparatus in the second embodiment.

Claims (30)

A plurality of user devices i, i = 1,..., N, and N is an integer greater than or equal to 2, received from the first and second size comparison devices, the user device and the first and second size comparison devices by a signboard assembly publishing information, predetermined lower limit value V ₁ and increases monotonically in the range between the upper limit value V _M M number of values V _w, however, w = 1, 2, ..., M in, all users Is a magnitude comparison method for specifying only the minimum value V _MIN and the user j having the minimum value as the intention value from the intention value V _vi determined by
(a) With respect to the intention value V _vi input by the user in each of the user devices i, elements corresponding to each other at the lower limit value V ₁ or more and less than the intention value V _vi are equal, and the intention value V _vi Two information sequences s _i and t _i each of which is composed of M elements that are different from each other in the range from _{vi to the} upper limit value V _M are generated, and the corresponding information is secretly stored in the first and the second transmitting to the second quantitative competition apparatus, M represents the number of selectable values as the intention value of the upper limit value V _M or less in the above lower limit value V ₁ or more,
(b) in the first quantitative competition apparatus, the lower limit V ₁ or more, for the upper limit value V _M or less of a given value V _w, corresponding to respective w of said information in the sequence s _i from all the user equipment Extracting elements s _{i, w} and arranging them in a predetermined order Seq _{s, w} = s _{1, w} ‖s _{2, w} ‖… ‖s _{N, w} Represents concatenation,
(c) in the second quantitative competition apparatus, for the given value V _w, elements t _i corresponding to w each of the information in the sequence t _i from all user _devices, removed _w, were determined them Creating element concatenation Seq _{t, w} = t _{1, w} ‖t _{2, w} ‖ ... ‖t _{N, w} arranged in order;
(d) In the above bulletin board apparatus, the above-mentioned element concatenation Seq _{s, w} and Seq _{t, w} are compared without revealing their own values, and if they are different from each other, V _w or less is set as the intended value. It is determined that there is a user, and if equal, it is determined that there is no user who has an intended value of V _w or less, and based on this determination, the minimum intention value V _MIN is determined by changing the value of w. , Publishing element number MIN,
(e) By transmitting the corresponding element concatenation Seq _{s, MIN} and Seq _{t, MIN} to the bulletin board apparatus for the element number MIN announced by the first and second size comparison devices, and publishing them, For each of the above-mentioned user devices, a user who has committed the minimum mean value by a number j such that s _{j, MIN} ≠ t _{j, MIN} for the corresponding elements s _{i, MIN} and t _{i, MIN} in the element connection Making it possible to detect that the number is j,
A size comparison method characterized by including. The size comparison method according to claim 1,
In the step (a), random numbers R1 _i and R2 _i are generated in the user device of each user i, and the set of (R1 _i , s _i ) is assigned to the first magnitude comparison device as (R2 _i , t _i ) Secretly transmitting each set to the second size comparison device,
In addition, hash values H1 _i = h (R1 _i ‖s _i ) and H2 _i = h (R2 _i ‖t _i ) are calculated by the hash function h for each of the above-mentioned concatenated R1 _i ‖s _i and R2 _i ‖t _i. And sending them to the bulletin board device,
The step (d) includes a step of publicizing the hash values H1 _i , H2 _i , i = 1, 2,..., N as commits of all users in the bulletin board apparatus. In the size comparison method according to claim 2,
In the step (b), a hash value HS _w = h (Seq _{s, w} ) is calculated by the hash function h for the element concatenated Seq _{s, w in} the first magnitude comparison device, and is transmitted to the bulletin board device. Including steps,
The step (c) calculates a hash value HT _w = h (Seq _{t, w} ) by the hash function h for the element concatenated Seq _{t, w in} the second magnitude comparison device and transmits it to the bulletin board device. Including steps,
In the step (d), the hash values HS _w and HT _w received from the first and second size comparison devices are disclosed by the bulletin board device and compared, and if they are different, V _w or less is intended. It is determined that there is a user with a value of け れ ば, and if equal, it is determined that there is no user with a value of V _w or less as a mean value, and the step of determining the minimum mean value V _MIN by changing w is included. A size comparison method characterized by that. In the size comparison method according to claim 2,
The first and second magnitude comparison devices store a prime number P disclosed in advance by the bulletin board device, and the prime number P is a prime number having a large prime number P-1 as a divisor. The two magnitude comparison device selects a common integer value w,
In the step (b), the hash value HS _w = h ′ is calculated by using the hash function h ′ that uniquely and randomly maps an arbitrary integer for the element concatenation Seq _{s, w} on the finite field Fp by the first magnitude comparison device. (Seq _{s, w} ) is calculated, a random number RA _w is generated, a hash value HA _w = h (RA _w wHS _w ) is calculated for the concatenated RA _w ‖HS _w by the hash function h, and HS _w ^RAw (mod P) and ^sending the set (HA _w , HS _w ^RAw (mod P)) to the bulletin board device,
The step (c) calculates a hash value HT _w = h ′ (Seq _{t, w} ) by the hash function h ′ for the element concatenated Seq _{t, w in} the second magnitude comparison device, and generates a random number RB _w , Calculate a hash value HB _w = h (RB _w ‖HT _w ) with a hash function h for the concatenated RB _w ‖HT _w , calculate HT _w ^RBw (mod P), and set the pair (HB _w , HT _w ^RBw sending (mod P)) to the bulletin board device,
Step (d) is the first quantitative competition apparatus calculates the HT _w ^RBW from the bulletin board system to read ^{_{(mod P) (HT w RBw}} ) RAw (mod P), and transmitted to the bulletin board system, a step of said second quantitative competition apparatus reads said HS _w ^RAw (mod P) from said bulletin board apparatus ^{_{(HS w RAw) RBw (mod}} P) is calculated and transmitted to the bulletin board system,
The bulletin board device publishes and compares (HT _w ^RBw ) ^RAw (mod P) and (HS _w ^RAw ) ^RBw (mod P) received from the first and second size comparison devices. the following V _w is determined that the user is who the value of intention if, determines that the user is not that the following V _w to the value of the intention equal, the first and second quantitative competition apparatus changes the w And a step of determining a minimum mean value V _MIN by doing. 5. The size comparison method according to claim 3, wherein the first and second size comparison devices have w _min = 1, w _max = M as initial values, and w is (w _min + w _max ) / 2 = (1 + M) / 2 is shared as the largest integer less than or equal to 2 and the above step (d) assigns w to the variable w _max when it is determined that there is a user who has a desired value less than or equal to V _w not when the variable w _min to w + 1 are substituted with the step (b) to the execution _{(c), w max = w} mi n = minimum intention value corresponding to the mIN repeatedly until mIN A method for comparing magnitudes, comprising the step of obtaining V _MIN and sequentially disclosing the process by the bulletin board apparatus. 5. The size comparison method according to claim 4, wherein each element of the information series s _i and t _i is 1 bit. 7. The size comparison method according to claim 4 or 6, wherein said step (e) includes a step in which said first and second size comparison devices transmit random numbers RA _MIN and RB _MIN to said bulletin board device and disclose them. A feature size comparison method. The size comparison method according to any one of claims 1 to 4, comprising three or more L size comparison devices,
In step (a), each of the user equipment is equal all information corresponding to less than V _vi When inputted V ₁ or V _vi, all different kind of L number information corresponding to the following V _vi than V _M an information sequence _{s ik, k = 1,2, ...} , to create the L, at least 2 sequences s _ia among the L pieces of information sequence _{s ik, s ib, a ≠} b, those V _vi can be seen if aligned And secretly transmitting the sequence s _ik to the kth magnitude comparison device,
A size comparison method characterized in that a size comparison is performed by two size comparison devices, and when a trouble occurs in the size comparison device, the comparison operation is continuously performed using another normal size comparison device. The size comparison method according to claim 1,
In the step (a), each of the user devices transmits the seed values s ′ _i and t ′ _i as information corresponding to the information series s _i and t _i in secret to the first and second magnitude comparison devices, respectively. The seed values s ′ _i , t ′ _i are defined as _vi, where the element number corresponding to the mean value V _vi is
For a one-way function F, d = 0, 1, ..., M-vi, F ^d (s ' _i ) = F ^d (t' _i ), and e = M-vi + 1, ..., M- 1 so that F ^e (s ′ _i ) ≠ F ^e (t ′ _i ), and the above two information sequences s _i and t _i are respectively
s _i = {s _{i, 1} = F ^M-1 (s ' _i ), s _{i, 2} = F ^M-2 (s' _i ),…, s _{i, vi-1} = F ^{M-vi + 1} ( s ' _i ), s _{i, vi} = F ^M-vi (s' _i ),…, s _{i, M-1} = F (s ' _i ), s _{i, M} = s' _i }
t _i = {t _{i, 1} = F ^M-1 (t ' _i ), t _{i, 2} = F ^M-2 (t' _i ),…, t _{i, vi-1} = F ^{M-vi + 1} ( t ' _i ), t _{i, vi} = F ^{M -vi} (t' _i ),…, t _{i, M-1} = F (t ' _i ), t _{i, M} = t' _i }
A size comparison method characterized by being given by The size comparison method according to claim 1,
The step (a) includes generating initial random numbers R1 _i , R2 _i , ca _i , cb _i , s _{i, M + 1} , t _{i, M + 1} in each of the user devices;
m initial value of is set to M, with respect to element number vi corresponding to the intention value _{V vi, m = M, M} -1, ..., sequentially for vi
s _{i, m} = h (s _{i, m + 1} ‖h ^{M + 1-m} (ca _i ) ‖h ^{M + 1-m} (cb _i ))
t _{i, m} = h (t _{i, m + 1} ‖h ^{M + 1-m} (ca _i ) ‖h ^{M + 1-m} (cb _i ))
And a subsequence with s _{i, m} ≠ t _{i, m} ,
Series elements for m = vi-1
s _{i, m} = t _{i, m} = h (s _{i, m-1} ‖t _{i, m-1} ‖h ^{M + 1-m} (ca _i ) ‖h ^{M + 1-m} (cb _i ))
When,
elements for m = vi-2, vi-3,…, 0
s _{i, m} = t _{i, m} = h (s _{i, m + 1} ‖h ^{M + 1-m} (ca _i ) ‖h ^{M + 1-m} (cb _i ))
And subsequence of s _{i, m} = t _{i, m}
A step of obtaining a sequence of elements s _{i, m} , t _{i, m} of m = M, M-1,..., 1 as the information series s _i , t _i and obtaining a value s _{i, 0} of m = 0 , And
The step (a) is further performed by each of the user devices.
R1 _i , s _i = [s _{i, 1} , s _{i, 2} ,..., S _{i, M} ] is encrypted with the encryption function E _A , and the obtained E _A (s _i ‖R1 _i ) R2 _i , t _i = [t _{i, 1} , t _{i, 2} , ..., t _{i, M} ] is encrypted with the encryption function E _B and the obtained E _B (t _i ‖ Transmitting R2 _i ) to the second magnitude comparison device;
H1 _i = h (s _i ‖R1 _i ), H2 _i = h (t _i ‖R2 _i ), s _{i, 0} , h ^{M + 1} (ca _i ), h ^{M + 1} (cb _i ) And a step of sending to the public. A plurality of user devices i, i = 1,..., N, and N is an integer greater than or equal to 2, received from the first and second size comparison devices, the user device and the first and second size comparison devices by a signboard assembly publishing information, predetermined lower limit value V ₁ and the upper limit value V _M monotonically increasing M values V _w in the range of, but, w = 1, 2, ..., M, in all users It is a magnitude comparison method that specifies only the maximum value V _MAX and the user j having the maximum value as the intention value from the determined intention value V _vi ,
(a) With respect to the mean value V _vi inputted by the user in each of the user devices i, elements corresponding to each other differ from the lower limit value V _{min to} the mean value V _vi , and the mean value V _vi Two information sequences s _i and t _i each including M elements that exceed _vi and are equal to or _smaller than the upper limit value V _M are generated, and information corresponding to them is secretly stored in the first And the step of transmitting to the second magnitude comparison device, M represents the number of values that can be selected as the mean value that is not less than the lower limit value V _{1 and not} more than the upper limit value,
(b) in the first quantitative competition apparatus, the lower limit V ₁ or more, for the upper limit value V _M or less of a given value V _w, the element number w in the information sequence s _i from all user equipment elements s _{i, w} is extracted, and element concatenation Seq _{s, w} = s _{1, w} ‖s _{2, w} ‖… ‖s _{N, w} is created, and ‖ is data concatenation Represents
(c) in the second quantitative competition apparatus, for the given value w, the information sequence t _i elements t _i corresponding to w respectively in from all user _devices, removed _w, the order in which they were determined Creating element concatenation Seq _{t, w} = t _{1, w} ‖t _{2, w} ‖ ... ‖t _{N, w} arranged by
(d) In the above bulletin board device, the above-mentioned element connection Seq _{s, w} and Seq _{t, w} are compared without revealing their own values, and if they are different from each other, V _w or more is set as the intended value. It is determined that there is a user, and if they are equal, it is determined that there is no user having an intended value of V _w or higher. Based on this determination, the maximum value V _MAX is determined by changing the value of w, Publishing the number MIN,
(e) By transmitting the corresponding element concatenation Seq _{s, MAX} and Seq _{t, MAX} to the bulletin board apparatus for the published element number MAX in the first and second size comparison apparatuses, and publishing them, For each of the user devices, a number j such that s _{j, MAX} ≠ t _{j, MAX} for the elements s _{i, MAX} and t _{i, MAX} corresponding to each other in the element concatenation Seq _{s, MAX} and Seq _{t, MAX} is described above. Making it possible to detect that the number j of the user who committed the maximum mean value is committed,
A size comparison method characterized by including. The size comparison method according to claim 11,
In the step (a), random numbers R1 _i and R2 _i are generated in the user device of each user i, and the set of (R1 _i , s _i ) is assigned to the first magnitude comparison device as (R2 _i , t _i ) Secretly transmitting each set to the second size comparison device,
In addition, hash values H1 _i = h (R1 _i ‖s _i ) and H2 _i = h (R2 _i ‖t _i ) are calculated by the hash function h for each of the above-mentioned concatenated R1 _i ‖s _i and R2 _i ‖t _i. And sending them to the bulletin board device,
The step (d) includes a step of publicizing the hash values H1 _i , H2 _i , i = 1, 2,..., N as commits of all users in the bulletin board apparatus. The size comparison method according to claim 12,
In the step (b), a hash value HS _w = h (Seq _{s, w} ) is calculated by the hash function h for the element concatenated Seq _{s, w in} the first magnitude comparison device, and is transmitted to the bulletin board device. Including steps,
The step (c) calculates a hash value HT _w = h (Seq _{t, w} ) by the hash function h for the element concatenated Seq _{t, w in} the second magnitude comparison device and transmits it to the bulletin board device. Including steps,
In step (d), the hash values HS _w and HT _w received from the first and second size comparison devices are disclosed by the bulletin board device and compared, and if they are different, V _w or more is intended. It is determined that there is a user with a value of _W , and if equal, it is determined that there is no user with a predetermined value of V _w or more, and the maximum intention value V _MAX is determined by changing w. A size comparison method characterized by that. The size comparison method according to claim 12,
The first and second magnitude comparison devices store a prime number P disclosed in advance by the bulletin board device, and the prime number P is a prime number having a large prime number P-1 as a divisor. The two size comparison devices select and share a common integer value w,
In the step (b), the hash value HS _w = h is calculated by the hash function h ′ that uniquely and randomly copies an arbitrary integer with respect to the element concatenation Seq _{s, w} on the finite field Fp by the first magnitude comparison device. '(Seq _{s, w} ) is calculated, random number RA _w is generated, hash value HA _w = h (RA _w ‖HS _w ) is calculated by hash function h for concatenated RA _w ‖HS _w , and HS _w ^RAw ( mod P) and ^sending the set (HA _w , HS _w ^RAw (mod P)) to the bulletin board device,
The step (c) calculates a hash value HT _w = h ′ (Seq _{t, w} ) by the hash function h ′ for the element concatenated Seq _{t, w in} the second magnitude comparison device, and generates a random number RB _w , Calculate a hash value HB _w = h (RB _w ‖HT _w ) with a hash function h for the concatenated RB _w ‖HT _w , calculate HT _w ^RBw (mod P), and set the pair (HB _w , HT _w ^RBw sending (mod P)) to the bulletin board device,
Step (d) is the first quantitative competition apparatus calculates the HT _w ^RBW from the bulletin board system to read ^{_{(mod P) (HT w RBw}} ) RAw (mod P), and transmitted to the bulletin board system, a step of said second quantitative competition apparatus reads said HS _w ^RAw (mod P) from said bulletin board apparatus ^{_{(HS w RAw) RBw (mod}} P) is calculated and transmitted to the bulletin board system,
The bulletin board device publishes and compares (HT _w ^RBw ) ^RAw (mod P) and (HS _w ^RAw ) ^RBw (mod P) received from the first and second size comparison devices. the above V _w is determined that the user is who the value of intention if, determines that the user is not that the above V _w and the value of the intention equal, the first and second quantitative competition apparatus changes the w And a step of determining a maximum value. 15. The size comparison method according to claim 13 or 14, wherein w _min and w _max are integer variables of 1 to M, and the first and second size comparison devices have initial values of w _min = 1, w _max = M. In some cases, _w is shared as the largest integer less than or equal to (w _min + w _max ) / 2 = (1 + M) / 2, and in step (d) above, there is a user whose intended value is greater than or equal to V _w When it is determined that w _max = w _min , substituting w into the variable w _max , otherwise substituting w + 1 into the variable w _min and executing steps (b) and (c) above. = repeatedly obtains a maximum value V _MAX corresponding to MAX in until MAX, compares how the process characterized in that it comprises a step of sequentially exposed by the bulletin board apparatus. 15. The size comparison method according to claim 14, wherein each element of the information series s _i and t _i is 1 bit. 17. The size comparison method according to claim 14 or 16, wherein the step (e) is performed by the first and second size comparison devices, wherein the random number RA _MAX and the RB _MAX are respectively sent to the bulletin board for the published element number MAX. A size comparison method comprising a step of transmitting to a device and publishing. The size comparison method according to any one of claims 11 to 14, further comprising three or more L size comparison devices,
In step (a), each of the user equipment all the information corresponding to the following V _vi When inputted V ₁ or V _vi equal, as all information corresponding to the following V _M exceeds the V _vi different L pieces of information sequence _{s ik, k = 1,2, ...} , to create the L, at least 2 sequences s _ia among the L pieces of information sequence _{s ik, s ib, a ≠} b, is the V _vi would be nice seen And secretly transmitting the sequence s _ik to the kth magnitude comparison device,
A size comparison method characterized in that a size comparison is performed by two size comparison devices, and when a trouble occurs in the size comparison device, the comparison operation is continuously performed using another normal size comparison device. The size comparison method according to claim 11,
In the step (a), each of the user devices transmits the seed values s ′ _i and t ′ _i as information corresponding to the information series s _i and t _i in secret to the first and second magnitude comparison devices, respectively. The seed values s ′ _i , t ′ _i are defined as _vi, where the element number corresponding to the mean value V _vi is
D = 0, 1 respect to one-way function F, ..., in ^{vi-1 F d (s '} i) = F d (t' i) , and the and e = vi, ..., in M-1 F ^e (s ′ _i ) ≠ F ^e (t ′ _i ), and the above two information sequences s _i and t _i
s _i = {s _{i, 1} = F ^M-1 (s ' _i ), s _{i, 2} = F ^M-2 (s' _i ),…, s _{i, vi-1} = F ^{M-vi + 1} ( s ' _i ), s _{i, vi} = F ^M-vi (s' _i ),…, s _{i, M-1} = F (s ' _i ), s _{i, M} = s' _i }
t _i = {t _{i, 1} = F ^M-1 (t ' _i ), t _{i, 2} = F ^M-2 (t' _i ),…, t _{i, vi-1} = F ^{M-vi + 1} ( t ' _i ), t _{i, vi} = F ^M-vi (t' _i ),…, t _{i, M-1} = F (t ' _i ), t _{i, M} = t' _i }
A size comparison method characterized by being given by The size comparison method according to claim 11,
The step (a) includes generating initial random numbers R1 _i , R2 _i , ca _i , cb _i , s _{i, M + 1} , t _{i, M + 1} in each of the user devices;
m initial value of is set to M, with respect to element number vi corresponding to the intention value _{V vi, m = M, M} -1, ..., sequentially for vi + 1
s _{i, m} = t _{i, m} = h (s _{i, m + 1} ‖h ^{M + 1-m} (ca _i ) ‖h ^{M + 1-m} (cb _i ))
And a subsequence with s _{i, m} = t _{i, m} ,
Series elements for m = vi
s _{i, m} = t _{i, m} = h (s _{i, m-1} ‖t _{i, m-1} ‖h ^{M + 1-m} (ca _i ) ‖h ^{M + 1-m} (cb _i ))
When,
elements for m = vi-1, vi-2,…, 0
s _{i, m} = t _{i, m} = h (s _{i, m + 1} ‖h ^{M + 1-m} (ca _i ) ‖h ^{M + 1-m} (cb _i ))
t _{i, m} = h (t _{i, m + 1} ‖h ^{M + 1-m} (ca _i ) ‖h ^{M + 1-m} (cb _i ))
And subsequence of s _{i, m} ≠ t _{i, m} ,
A step of obtaining a sequence of elements s _{i, m} , t _{i, m} of m = M, M-1,..., 1 as the information series s _i , t _i and obtaining a value s _{i, 0} of m = 0 , And
The step (a) is further performed by each of the user devices.
R1 _i , s _i = [s _{i, 1} , s _{i, 2} ,..., S _{i, M} ] is encrypted with the encryption function E _A , and the obtained E _A (s _i ‖R1 _i ) R2 _i , t _i = [t _{i, 1} , t _{i, 2} , ..., t _{i, M} ] is encrypted with the encryption function E _B and the obtained E _B (t _i ‖ Transmitting R2 _i ) to the second magnitude comparison device;
H1 _i = h (s _i ‖R1 _i ), H2 _i = h (t _i ‖R2 _i ), s _{i, 0} , h ^{M + 1} (ca _i ), h ^{M + 1} (cb _i ) And a step of sending to the public. 12. The size comparison method according to claim 1 or 11, wherein the step (a) generates random numbers r _i in each of the user devices, determines random information a _i and b _{i such} that r _i = a _i * b _i , * Is a predetermined common operator, and the random number information a _i and t _i are sent to the first and second magnitude comparison devices, respectively, and hashed to h (a _i ) and h (b _i ), respectively. , h (V _iv ‖r _i ) to the bulletin board device, and after the step (d) determines the minimum value V _MIN or the maximum value V _MAX , the magnitude comparison device sends the above a _j and b _j to the bulletin board device. The above user equipment verifies the public h (a _j ), h (b _j ) by a _j , b _j and verifies h (V _j ‖r _j ) = h (V _j ‖a _j * b _j ) A size comparison method comprising the step of: The user apparatus used for the magnitude comparison method according to claim 1 is a mean value selected from the values of the upper limit V _M and the lower limit V ₁ for the integer value to be compared, and M is an integer of 2 or more. a method for registering a V _vi,
to the intention value V _vi, which is (a) input, elements corresponding to less than V ₁ or V _vi are equal to each other, elements corresponding to the following V _vi or V _M consists of M elements each different from each other 2 Generating two information sequences s _i and t _i ;
(b) inputting the above information series s _i and t _i , calculating a one-way function for these, and outputting calculation results H1 _i and H2 _i ;
(c) transmitting the information series s _i to the first magnitude comparison device, the information series t _i to the second magnitude comparison device, and H1 _i and H2 _i to the bulletin board device,
And a mean value registration method characterized by comprising: The user apparatus used in the quantitative competition method of claim 11, wherein the, M of LIMIT V _M and lower V ₁ of the on integer values to be compared, M is an integer of 2 or more, intention value V selected from the values of A method of registering _vi ,
(a) on the input intention value V _vi, different from each other are elements corresponding to the following V ₁ or V _vi, elements corresponding to the following V _{Vi + 1} or V _M consists of M elements each equal Generating and outputting two information sequences s _i and t _i ;
(b) inputting the above information series s _i and t _i , calculating a one-way function for these, and outputting calculation results H1 _i and H2 _i ;
(c) transmitting the information series s _i to the first magnitude comparison device, the information series t _i to the second magnitude comparison device, and H1 _i and H2 _i to the bulletin board device,
And a mean value registration method characterized by comprising: A user device used in the size comparison method according to claim 1,
A storage unit for M values of the upper limit V _M and lower V ₁ of the on integer values to be compared is stored,
An input means for inputting a desired value V _vi between V ₁ and V _M , and
V _vi and V _1, V _M is input, elements corresponding to less than V ₁ or V _vi are equal to each other, elements corresponding to the following V _vi or V _M consists of M elements each different from one another two information sequences s _i and t _i , or elements corresponding to V ₁ or more and V _vi or less are different from each other, and elements corresponding to V _{Vi + 1} or more and V _M or less are equal to each other, two information sequences s _i and An information sequence generation unit that generates and outputs one of t _i , and M is the number of values that can be selected as the mean value V _vi between V _{1 and} V _M ,
A one-way function calculation unit that receives the information series s _i and t _i , calculates a one-way function for them, and outputs calculation results H1 _i and H2 _i ;
A user apparatus comprising: a transmission unit that transmits the information series s _i to the first magnitude comparison apparatus, the information series t _i to the second magnitude comparison apparatus, and H1 _i and H2 _i to the bulletin board apparatus. . A user device used in the size comparison method according to claim 11,
A storage unit in which _M values of an upper limit V _M and a lower limit V ₁ for an integer value to be compared, M is an integer of 2 or more, are stored;
An input means for inputting a desired value V _vi between V ₁ and V _M , and
V _vi and V ₁ , V _M are input, and the elements corresponding to V _{1 and} V _vi are different from each other, and the elements corresponding to V _{Vi + 1 and} V _M are equal to each other. An information sequence generator for generating and outputting information sequences s _i and t _i ;
A one-way function calculation unit that receives the information series s _i and t _i , calculates a one-way function for them, and outputs calculation results H1 _i and H2 _i ;
A user apparatus comprising: a transmission unit that transmits the information series s _i to the first magnitude comparison apparatus, the information series t _i to the second magnitude comparison apparatus, and H1 _i and H2 _i to the bulletin board apparatus. . A size comparison apparatus used in the size comparison method according to claim 1 or 11,
Sent from each user apparatus, the lower limit value V ₁ above, receives the information sequence consisting of elements of the number M of selectable values as the upper limit value V _M following intention value V _vi, sent from the bulletin board apparatus integer A receiving unit for receiving the numerical value w;
A storage unit for storing the received information series;
A w-th element in the information series received from each user is input, a one-way function is calculated for these connections, and a one-way function calculation unit that outputs the calculation result;
A size comparison apparatus, comprising: a transmission unit that transmits the one-way function calculation result to the bulletin board apparatus. A size comparison method using a size comparison device used in the size comparison method according to claim 1 or 11,
(a) From each user device i, i = 1, 2,..., N, M elements as information representing a mean value V _vi among M values not less than the lower limit value V _{1 and not} more than the upper limit value V _M Each receiving an information sequence s _i = [s _{i, 1} , s _{i, 2} , ..., s _{i, M} ] comprising:
(b) receiving an integer value w sent from the bulletin board device;
(c) inputting the w-th element s _{i, w} in the information sequence s _i received from each user device, and calculating a one-way function for these connections;
(d) transmitting the one-way function calculation result to the bulletin board device;
A size comparison method characterized by including. A size comparison apparatus used in the size comparison method according to claim 1 or 11,
Sent from each user apparatus, the lower limit value V ₁ above, receives the information sequence consisting of elements of the number M of selectable values as the upper limit value V _M following intention value V _vi, sent from the bulletin board apparatus integer A receiving unit for receiving the numerical value w;
A storage unit for storing the received information series;
A w-th element in the information series received from each user is input, a one-way function is calculated for these connections, and a one-way function calculation unit that outputs the calculation result;
A size comparison apparatus, comprising: a transmission unit that transmits the one-way function calculation result to the bulletin board apparatus. A program for executing the processing of the user device used in the size comparison method according to claim 1 or 11 on a computer,
(a) The elements corresponding to V ₁ or more and less than V _vi are equal to the input desired value V _vi of the upper limit value V _M or less and the lower limit value V ₁ or more of the integer value to be compared. , V _vi above, V _M corresponding elements below consists of M elements each different from one another two information sequences s _i and t _i, or V ₁ or more, elements corresponding to the following V _vi are different from each other, V _vi A process for generating one of two information sequences s _i and t _i each having M elements equal to or greater than _{+1 and} equal to or less than V _{M ;} and M is greater than or equal to the lower limit value V ₁ and the upper limit The number of values that can be selected as the nominal value V _vi below the value V _M ,
(b) the information sequence s _i and t _i, respectively to calculate the one-way function to be calculation results H1 _i, and outputting the H2 _i,
(c) a process of transmitting the information series s _i to the first magnitude comparison device, the information series t _i to the second magnitude comparison device, and H1 _i and H2 _i to the bulletin board device;
Including. A computer-readable recording medium on which the program according to claim 29 is recorded.

Images