JP4041746B2 - Multiple goods bidding method, apparatus thereof, and program thereof - Google Patents

Description

【０００７】
つまり図２に示すように数値ｗ＝０の場合Ｅ（１）のみであり、ｗ＝１では１番目の成分のみがＥ（ｚ）であり、ｗ＝２では１番目と２番目の成分のみがＥ（ｚ）であり、ｗ＝ｎ−１ではｎ番目の成分のみがＥ（１）であり、ｗ＝ｎでは全ての成分がＥ（ｚ）である。ここでｚは１以外の暗号文の平文になり得る範囲の整数であり、例えば１０２４ビットの数で表わされる数である。
最大値の計算（図３および図４参照）：ｂ個の暗号文のベクトル

で表わした数値の中の最大値を、各数値ｗ₁ 〜ｗ_b を知ることなく、つまり秘匿したまま以下のようにして求めることができる。まず全ての暗号文ベクトルの成分毎の積を積部でとる（Ｓ１）。

暗号Ｅの準同型的性質、Ｅ（ａ）・Ｅ（ｂ）＝Ｅ（ａ・ｂ）により、式（３）の積演算結果のベクトルｅ（ｗ）の各成分Ｅ_j(ｊ＝１，…，ｎ）は式（４）にな
る。
Ｅ_j ＝Π_i=1 ^bＥ_j,i＝Ｅ（ｚ^s(j)） …（４）
ここで、ｓ（ｊ）＝＃｛ｉ｜ｊ≦ｗ_b ｝はｊ以上の数値の数であり、ｊについて単調に減少している。このことは図２をみれば直に理解されるように数値ｊ以上の暗号文ベクトルｅ（ｗ_i)におけるｊ番目の成分Ｅ_j,iは全てＥ（ｚ）であるから、Π_i=1 ^bＥ_j,i＝Ｅ（ｚ^s(j)）となる。数値ｊ以上の暗号文ベクトルの数ｓ（ｊ）はｊが大きくなるに従って段々減少することになる。そこで積ベクトルｅ（ｗ）の各成分Ｅ_j をｊ＝ｎ，ｎ−１，…，ｌについて順番に復号部で復号し（Ｓ３）、制御部で復号結果Ｄ（Ｅ_j)がｚに等しいか否かを調べＤ（Ｅ_j)＝ｚに最初になった時のｊの値が、暗号文ベクトルｅ（ｗ₁）〜ｅ（ｗ_b）の数値ｗ₁ 〜ｗ_b 中の最大値ｗ_max となる（Ｓ２，Ｓ４，Ｓ５）。このようにしてｅ（ｗ₁）〜ｅ（ｗ_b）の各数値ｗ₁ 〜ｗ_b を秘匿したままその最大値ｗ_max を求めることができる。
【０００８】
定数の加算（図５、図６参照）：暗号文ベクトルｅ（ｗ_i）＝（Ｅ_1,i ，Ｅ_2,i ，…，Ｅ_n,i）で表わされた数値に対して数値ｗ_iを知ることなく公開された定数ｃを加算することができる。まず各成分Ｅ_1,i ，…，Ｅ_n,i が順次格納されたシフトレジスタ（シフト部）を右へｃ段だけシフトして、右のｃ個の成分をシフトレジスタから除去し、左にｃ個の段を空きにして下記のベクトルとする（Ｓ１）。ただし、ｃ≦ｎ−ｗとする。

付加部で空きとなった各シフト段にＥ（ｚ）をｃ個格納してｗ_i にｃを加算した下記のベクトルとする（Ｓ２）。

この暗号文ベクトルをランダム部でランダム化してｗ_iに定数ｃを加算した数値ｗ_i＋ｃの下記別の暗号文ベクトルｅ（ｗ_i＋ｃ）に変更する（Ｓ３）。

このようにして準同型暗号Ｅのランダム化可能という性質により、式（５）の暗号文ベクトルと式（６）の暗号文ベクトルは同一数値ｗ_i ＋ｃを表わすが別の暗号文ベクトルとなっているからｅ（ｗ_i）とｅ（ｗ_i＋ｃ）から定数ｃの情報を知ることは一切できない。この加算時にランダム化をしないと、加算前の暗号文ベクトルと加算後の暗号文ベクトルの各対応成分を比較し、不一致となる成分の個数から加算した定数がわかるから、前記ランダム化を行う。
【０００９】
【特許文献１】
特許公開２０００−２４３３６２公報、段落［０００２］〜［０００６］
【非特許文献１】
佐古和恵「落札値以外を秘匿する全体検証可能な電子入札方式」ＳＣＩＳ'９９ ３５−４０（１９９９）
【非特許文献２】
Makoto Yokoo，Koutarou Suzuki "Secure multi-agent dynamic programming based on homomorphic encryption and its application to combinatorial auctions." Proc. of Autonomous Agents and Multi−Agent Systems 2002，pp.112−119，ACM Press(2002) 第3.2項「Overview」
【００１０】
【発明が解決しようとする課題】
先に述べたように、入札価格を秘匿したままの入札方法は１種類の財についてのみの入札しか提案されていなかった。このため「この財とこの財を一緒に欲しい」など財の組合せに対する要求をする入札を、入札価格を秘密にしたまま行うことができなかった。
この発明の目的は複数種類の財の組合せの入札を入札価格を秘密にしたまま可能とする入札方法、その装置およびそのプログラムを提供することにある。
【００１１】
【課題を解決するための手段】
この発明によれば、開札者装置は各入札者の財の割当Ａ＝｛１，…，ｑ，…，ａ｝の表（財割当表）Ｔ_G と入札できる金額の表（価格表）Ｔ_P と、準同型暗号Ｅとその暗号による暗号文となり得る、１以外の数値ｚを公開し、また財割当表Ｔ_G の各割当Ａに対し、価格０を入札価格とした入札価格ベクトルｂの各成分を、数値１の暗号ｚ（１）のｎ個からなる価格０を表わす価格ベクトルで表現した暗号ベクトルを処理用Ｅ ₀ ＝（ｅ _0,0 ，…，ｅ _a,b ），Ｅ ₁ ＝（ｅ _0,1 ，…，ｅ _a,1 ），…，Ｅ _b ＝（ｅ _0,0 ，…，ｅ _a,b ）をそれぞれ生成し、公開または１つの入札者装置Ｂ_i へ送信する。
【００１２】
入札者装置Ｂ_x は入札価格ｂ_x ＝（ｂ_1,x ，…，ｂ_a,x)が入力されると、Ｅ ₀ 〜Ｅ _b 中のＥ ₀ とＥ _x に対してその各成分の値に対し、対応する入札価格の加算をＥ（ｚ）の付加とランダム化処理により、Ｅ ₀ ，Ｅ _x を復号することなく行って、その各加算結果をＥ ₀ ，Ｅ _x とし、Ｅ ₀ 〜Ｅ _b を公開又は他の入札者装置へ送信する。
全入札者装置での入札処理が終ると、開札者装置は最終のＥ ₀ 〜Ｅ _b について、まずＥ ₀ の各成分ベクトルｅ _0,0 ，…，ｅ _a,0 の積を求め、その積ベクトルの各成分をｎ番目から順次復号して最初に得られたｚの成分番号から、ｅ _0,0 ，…，ｅ _a,0 中の最大値ｍを求め、また各成分ベクトルｅ _0,0 ，…，ｅ _a,0 の第ｍ番目の成分を復号してｚとなる成分ベクトルと対応する財の割当Ａ_q を求め、これを入札価格の和を最大とする財の割当Ａ^* とし、その成分の番号ｑをＱとし、最終ベクトルＥ ₁ ，…，Ｅ _x ，…，Ｅ _b のそれぞれのＡ^* と対応する各成分ベクトルｅ _Q,x （ｘ∈｛１，…，ｂ｝）についてそれぞれｎ番目から順次復号して最初にｚになった成分番号ｗ_Q,x を入札者ｘの割当Ａ^* に対する入札価格、つまり支払価格ｐ_x とし、財の割当Ａ^* と、各支払価格ｐ_x を公開する。
【００１３】
この発明の他の面（一般化Vickrey入札）によれば、開札者装置が行う前処理、つまりＥ ₀ 〜Ｅ _b を公開又は送信するまでは前記発明の一面（通常入札）と同一である。入札者装置Ｂ_x は入札価格ｂ_x ＝（ｂ_1,x ，…，ｂ_a,x ）が入力されると、Ｅ ₀ 〜Ｅ _b 中のＥ _x を除いた全てに対し、対応する入札価格の加算を、Ｅ（ｚ）付加とランダム化処理により、Ｅ ₀ 〜Ｅ _b を復号することなく行い、その演算結果をＥ _x を除くＥ ₀ 〜Ｅ _b とし、これらとＥ _x を公開又は他の入札者装置へ送信する。
【００１４】
全入札者装置での入札処理が終ると、開札者装置は最終のＥ ₀ 〜Ｅ _b について、まずＥ ₀ の各成分ベクトルの最大値ｍを求め、更にその各成分ベクトルのｍ番目の成分を復号することによりΣ_i ｂ_i を最大化する財の割当Ａ^* を求め、これと対応するＥ ₀ 中の成分番号Ｑを求めることは前記発明の一面（通常入札）の場合と同様である。次に各最終ベクトルＥ _x(ｘ∈｛１，…，ｂ｝）のそれぞれのＱ番目の成分ｅ _Q,x のｎ番目の成分から順次復号して最初にｚとなる番号を値ｗ_Q,xとし、更に各最終ベクトルＥ _xの最大値ｗ′_m,xとして、これらベクトルの積を求め、その積ベクトルをｎ番目の成分から順次復号し、最初にｚが得られた成分番号を求める。このｗ′_m,xから各ｗ_Q,x をそれぞれ引算した結果を入札者ｘの支払価格ｐ_x とし、各支払価格と財割当（落札割当）Ａ^* を公開する。
【００１５】
【発明の実施の形態】
図７にこの発明の方法が適用されるシステムの構成例を示す。複数の入札者装置Ｂ₁ ，…，Ｂ_b と開札者装置１１とがインターネットなどの通信網１２を通じてそれぞれ通信することができ、また入札者装置Ｂ₁ ，…，Ｂ_b 相互の通信も可能とされている。更にこの例では通信網１２に掲示板装置１３が接続され、また第３者装置１４が接続されている場合である。
実施形態１（通常入札）
開札者装置１１の処理手順の例を図８に、機能構成を図１０に各々示し、入札者装置の処理手順の例を図９に、その機能構成の例を図１１に各々示す。開札者装置１１は例えばパーソナルコンピュータを主体に構成することができ、入札する複数種類の財と入札者が決まるとその財の割当表Ｔ_G を図１２に示すように財割当表作成部２１で作成し（Ｓ１）、掲示板装置１３に公開する。財割当表Ｔ_G は具体的には前述した図１Ａに示すようなものである。図１２において入札者Ｂ−ｉは財割当番号１…ａにはＡ_i,1 ，…，Ａ_i,a が割当てられていることを示している。各入札者の例えば登録番号についてこの割当られる財がこのように決められているものとする。つまり入札者は財割当表Ｔ_G のどの行欄の割当を自分のものとするかは知ることができる。なお入札者の人数をｅ、財の種類をｇとすると割当番号の最大値ａはｂ^g である。
【００１６】
開札者装置１１は割当られた一組の各財Ａ_q,i(ｉ∈｛１，…，ｂ｝，ｑ∈｛１，…，ａ｝）に対する入札可能な価格を示す価格表Ｔ_P(例えば図１Ｂに示したものと同様なもの）を掲示板装置１３に公開する。また鍵生成部２２で秘密鍵ＳＫとその公開鍵ＰＫを生成して秘密鍵ＳＫを鍵生成部２２内に保持し公開鍵ＰＫを掲示板装置１３に公開し、更に準同型暗号Ｅの暗号文とすることができる、数値１以外の数ｚを掲示板装置１３に公開する（Ｓ２）。
更に零関数を準同型暗号Ｅで暗号化したｂ＋１個のベクトルＥ ₀ …Ｅ _b を零関数生成部２３で生成し（Ｓ３）、この例ではこれらベクトルを入札者装置の１つＢ₁ へ送信する（Ｓ４）。これまでの処理が開札者装置１１における前処理である。入札者装置Ｂ_x は掲示板装置１３から財割当表Ｔ_G 、価格表Ｔ_P 、公開鍵ＰＫと数値ｚを取得し、記憶部４１に格納する（Ｓ１）。入札者は自分に割当られた財（Ａ_1,x ，…，Ａ_q,x ，…Ａ_a,x ）に対し入札価格ｂ_x ＝（ｂ_1,x ，…，ｂ_q,x ，…，ｂ_a,x ）を入力部４２により入力する（Ｓ２）。この状態で入札者装置Ｂ_x-1 からのベクトルＥ ₀ ，…，Ｅ _b の受信を待ち、これが受信されると（Ｓ３）、加算部４３でベクトルＥ ₀ とＥ _x に入札価格ｂ_x を加算する（Ｓ４）。この加算は図５及び図６を参照して説明したようにシフト部４３ａで各ベクトルＥ ₀ とＥ _x の各成分各ｅ _q,0 とｅ _q,x (ｑ∈｛１，…，ａ｝）をそれぞれｂ_q,x 個右にシフトする（Ｓ４ａ）、暗号部４３ｂでｚを準同型暗号Ｅで暗号化した暗号文Ｅ（ｚ）を前記シフトにより空いた部分にｂ_q,x 個だけ付加部４３ｃにより付加し（Ｓ４ｂ）、更にその付加された成分ｅ _q,0 とｅ _q,x を各々ランダム部４３ｄでランダム化する（Ｓ４ｃ）。このようにして入札価格ｂ_x をベクトルＥ ₀ とＥ _x に加算したものを新たにベクトルＥ ₀ とＥ _x として他の加算しなかったベクトルと共に次の入札者装置Ｂ_x+1 へ送信する（Ｓ５）。この入札者装置Ｂ_x+1 に巡回的にベクトルＥ ₀ ，…，Ｅ _b を送信する順番は任意でよいが、予め決めておき最初は開札者装置１１が送信し、最後の入札者装置は開札者装置１１に送信する。このようなベクトルに対する入札価格の加算処理は掲示板装置１３あるいは開札者装置１１を介しながら順に行ってもよい。
【００１７】
図１１に示すように入札者装置は受信部４４、送信部４５、更に各部を動作させる制御部４６を備え、例えばパーソナルコンピュータで構成することができる。
開札者装置１１における開札処理の説明に先立ちベクトルＥ ₀ ，…，Ｅ _b について図１３を参照して説明する。ベクトルＥ ₀ は入札価格ｂ₀ ＝（ｂ_1,0 ，…，ｂ_q,0 …，ｂ_a,0 ）と対応し
（ｅ _1,0 ，…，ｅ _q,0 ，…，ｅ _a,0 ）
でありその成分を代表してｅ _q,0 は
Ｅ（ｂ_q,0 ＝０）＝（Ｅ_1,q,0 ⁽¹⁾，Ｅ_2,q,0 ⁽¹⁾，…，Ｅ_n,q,0 ⁽¹⁾）
である。つまり財の割当の各財に対する組み合わせに対する各入札価格ｂ_q,0(ｑ∈｛１，…，ａ｝）がすべて０であり従って入札価格ｂ_q,0が０の暗号文ベクトルと対応する。他のベクトルＥ ₁ ，…，Ｅ _b も図にＥ _i を代表して示すように成分がａ個であって、それぞれさらに成分がｎ個のＥ（１）よりなる価格０を示す暗号文ベクトルである。ここでｎは価格表Ｔ_P の最大値の例えば２、３倍程度であり、全入札者装置による加算処理を行った状態で加算値がｎを越えないように選定されている。
【００１８】
零関数暗号ベクトルＥ ₀ ，…，Ｅ _b が以上のような構成とされており、入札者装置においては先に述べたように入札価格が加算されてこれらベクトルが更新され次の入札者装置へ送られるため、入札者装置Ｂ_x における入札価格ｂ_x の加算処理は図１４に示す式で表わされることになる。つまりその加算結果としてｂ_x の暗号ベクトルが加算されるからその１つの成分ベクトルについてみれば、入札者装置Ｂ_x-1 からの対応成分ベクトルｅ _q,x-1（＝ｅ（Σ_i=1 ^x-1ｂ_q,i)）に入札価格ｂ_q,xを加算した暗号文が得られ、これが新たなｅ _q,xとされる。従ってすべての入札者装置による処理が終了するとベクトルＥ ₀ はそれが表わす値はΣ_i=1 ^bｂ_i となる。
【００１９】
受信したベクトルＥ ₁ ，…，Ｅ _b に対してはＥ _x に対してのみｂ_x を加算するため、すべての入札者装置による処理が終了するとベクトルＥ ₁ ＝Ｅ（ｂ₁），…，Ｅ _b ＝Ｅ（ｂ_b）となる。入札者装置Ｂ₁ ，…，Ｂ_b の処理を簡便に表わすと図１５に示すようになる。
全入札者装置の処理が終了するとそのベクトルＥ ₀ の各成分は図１６に示すようになり、また各ベクトルＥ _i （ｉ∈｛１，…，ｂ｝，ｑ∈｛１，…，ａ｝）の各成分は図１６に示すようになる。
【００２０】
次に図８、図１０を参照して開札処理の例を説明する。
全入札者装置の処理が終ったベクトルＥ ₀ ，…，Ｅ _b を受信するとこれらを記憶部２４に記憶した後（Ｓ５）、そのベクトルＥ ₀ の成分ｅ _q,0 の最大値ｍをＥ ₀ 成分最大値検出部２５で検出する（Ｓ６）。この最大値の検出は図３及び図４を参照して説明したようにまず成分ベクトルｅ _1,0 ，…，ｅ _a,0 の積を求め（Ｓ６ａ）、その積ベクトルをｎ番目の成分から順次復号し（Ｓ６ｂ）、最初にｚが復号された成分番号を最大値ｍとする（Ｓ６ｃ）。
【００２１】
次に割当決定部２６により入札価格の和を最大とする割当、つまり最適割当Ａ^* を決定する（Ｓ７）。このためｑを１とし（Ｓ７ａ）、ベクトルＥ ₀ の成分ｅ _q,0 のｍ番目の成分を復号し（Ｓ７ｂ）、その復号結果がｚと等しいかを調べ（Ｓ７ｃ）、ｚと等しくなければｑを＋１してステップＳ７ｂに戻る（Ｓ７ｄ）。ステップＳ７ｃでｚと等しければその時のｑをＱとしそのｑ＝Ｑに対する割当Ａが求める最適割当Ａ^* とする（Ｓ７ｅ）。
【００２２】
次に支払額決定部２７により各入札者に対する支払価格を決定する（Ｓ８）。このため価格パラメータｗをｎとし（Ｓ８ａ）、各ベクトルＥ _x(ｘ∈｛１，…
，ｂ｝）のＱ番目の成分ｅ _Q,x ＝ｅ（ｂ_Q,x ）のｗ番目の成分を復号し（Ｓ８ｂ）、その結果がｚと等しいかを調べ（Ｓ８ｃ）、等しくなければｗを−１してステップＳ８ｂに戻り（Ｓ８ｄ）、等しければその時のｗを入札者ｘに対する支払額ｐ_x とする（Ｓ８ｅ）。このようにして各入札者ｘに対する支払額ｐ_x が求まる。これら各支払価格ｐ_xと最適割当（落札割当）を掲示板装置１３に公開する。必要に応じて支払額ｐ_x と最適割当Ａ^* あるいはその番号Ｑ又はその割当Ａ^＊中の入札者ｘに対する財とを含む落札通知を通知部２８で作成して入札者装置Ｂ_x へ送信する（Ｓ９）。
図１０において開札者装置は送信部２９、受信部３１も備え、さらに各部を動作させる制御部３２を持ち、例えばパーソナルコンピュータで構成される。
このように各入札者装置においてはその受信ベクトルＥ ₀ ，…，Ｅ _b と送信ベクトルＥ ₀ ，…，Ｅ _b とを比較しても入札価格は隠された状態であり、開札処理においても各入札者の入札価格を明かすことがないので開札者は落札結果以外の入札者とその入札価格との対応を知ることはできない。
【００２３】
実施形態２（一般化 Vickrey 入札）
実施形態２における開札者装置の処理手順を図１７に、機能構成の例を図１９に各々示し、入札者装置の処理手順の例を図１８に示す。開札者装置における前処理は実施形態１のそれ、つまり図８中のステップＳ１乃至Ｓ４までの処理と同一である。入札者装置の機能構成は実施形態１のそれ、つまり図１１に示す構成とほぼ同一であり、その処理もステップＳ１乃至Ｓ３は図９中のステップＳ１乃至Ｓ３と同一である。
この実施形態２においては入札者装置Ｂ_x において受信ベクトルＥ ₀ ，…，Ｅ _b 中のＥ _x 以外のすべてに入札価格ｂ_x を加算し、これらベクトルを更新し（Ｓ４）、ベクトルＥ ₀ ，…，Ｅ _b を入札者装置Ｂ_x+1 へ送信する（Ｓ５）。図１１中に加算部４３の入力としての括弧書き「（Ｅ ₀ ，Ｅ ₁， …，Ｅ _x-1，Ｅ _x+1，…，Ｅ _b）」はこの実施形態２に対するものである。
【００２４】
開札者装置の処理においてこの実施形態２では成分ベクトルの最大値ｍも開札者にわからないようにした場合であってベクトルＥ ₀に乱数ベクトルＲ＝（ｒ₁＝…＝ｒ_a）が加算されたベクトルＥ＋Ｒを加算ベクトル取得部３３で取得する（Ｓ６）。例えば開札処理に当って図７中に示す第３者装置１４にＥ ₀を送り、Ｅ ₀＋Ｒを返送してもらい、あるいは最後に入札処理をした入札者装置はＥ ₀〜Ｅ _bを第３者装置１４へ送信し、第３者装置がＲの加算処理を行い、これを開札者装置１１又は掲示板装置１３へ登録してもよい。この乱数ベクトルの加算は図５、図６を参照して説明したようにシフト処理とＥ（ｚ）の付加とランダム化によって行われる。この加算されたベクトル（Ｅ ₀ ＋Ｒ）の成分の最大値ｍを（Ｅ ₀ ＋Ｒ）最大値検出部３４で求める（Ｓ７）。この場合の最大値ｍを求める処理手順は図８中のステップＳ６のそれと同様に行えばよい。
【００２５】
次に割当決定部３５で最適割当Ａ^* を決定する（Ｓ８）。この処理は加算部３３よりの加算ベクトルに対し最大値検出部３４で求めたｍを用いて図８中のステップＳ７で行ったと同様の処理をすればよい。
このステップＳ７乃至Ｓ８による処理の結果はベクトルＥ ₀ が実施形態１におけるＥ ₀ と同一であり、ただこれに乱数が加算されているだけであって、ベクトルＥ ₀ の成分の最大値を隠した状態で最適割当Ａ^* を求めることができる。
【００２６】
次に第３者装置１４から乱数ベクトルＲ′＝（ｒ′₁＝…＝ｒ′_a)が加算されたベクトルＥ ₁＋Ｒ′，…，Ｅ _b＋Ｒ′を加算ベクトル取得部３６で取得すると（Ｓ９）、これらＥ _x＋Ｒ′(ｘ∈｛１，…，ｂ｝）の成分の最大値ｗ′_m,xを成分最大値検出部３７で求める（Ｓ１０）。この処理も図３及び図４を用いて説明したと同様の処理で求める。ここでベクトルＥ ₁ は入札者装置Ｂ₁ において入札価格ｂ₁ が加算されてない他の入札者の入札価格ｂ₂ ，…，ｂ_b を加算したものであり、同様に各入札者装置Ｂ_x ではＥ_x を除いてｂ_x の加算を行っている（ｘ∈｛１，…，ｂ｝）。従って最大値ｗ′_m,xは入札者ｘの入札価格を除いた他のすべての入札価格の和を最大とする価格、つまり式（１）右辺の第１項に相当する値であることは容易に理解されよう。
【００２７】
次に成分値検出部３８で加算ベクトルＥ _x＋Ｒ′のＱ番目の成分の各価格ｗ_Q,x（ｘ∈｛１，…，ｂ｝）を検出する（Ｓ１１）。この処理は図８中のステップＳ８と同様に行えばよい。得られた各価格ｗ_Q,xは最大値ｗ′_m,xについての説明から理解されるように入札者ｘの入札価格ｂ_x を除いた入札価格の総和、つまり式（１）の右辺第２項と対応するものであることは容易に理解できよう。
そこで減算部３９で最大値ｗ′_m,xからｗ_Q,xを減算して入札者ｘの支払価格ｐ_x を求める（Ｓ１２）。この減算において乱数ｒ′_Q が除去されることに注意されたい。このようにして得られた各入札者ｘの支払価格ｐ_x と最適割当（落札割当）Ａ^* を掲示板装置１３に公開する。必要に応じて支払い価格ｐ_xとＡ^＊またはその割当番号Ｑ、あるいはそのＡ^＊中のその入札者ｘに対する財とを含む落札通知を通知作成部２８で作成して入札者装置Ｂ_x に通知する（Ｓ１３）。あるいは落札割当Ａ^＊と各支払価格ｐ_xを公開する。
【００２８】
この図１９に示す開札者装置において図１０と対応する部分には同一符号を付してある。制御部３２は各部を動作させるものであり、全体としてパーソナルコンピュータを主体に構成することができる。
この実施形態２によれば一般化Vickrey入札をその入札者と入札価格の対応を明かすことなく、かつその最大入札価格も明かすことなく開札処理を行うことができる。最大入札価格を明かしても良い場合は乱数の加算を行わず、つまり加算ベクトル取得部３３および３６を除去し、Ｅ ₀ とＥ ₁ ，…，Ｅ _b を成分最大値検出部３４と３７および成分値検出部３８へ供給すればよい。乱数ＲとＲ′は同一のものでもよい。これらを異なるものとすれば秘匿性がより高くなる。掲示板装置を設けることなく、開札者装置と入札者装置間の通信などで財割当表Ｔ_G、価格表Ｔ_p、公開鍵ＰＫ、数値ｚを入札装置が知ることができればよい。零関数暗号ベクトル、財割当表Ｔ_Gは開札者装置以外の装置が作成してもよい。
【００２９】
上述したように図１０および図１９に示す各開札者装置、また図１１に示す入札者装置はコンピュータにプログラムを実行させて機能させることができる。この場合はＣＤ−ＲＯＭ、磁気ディスク等の記録媒体からあるいは通信回線を介して開札プログラムや入札プログラムをダウンロードしてそのコンピュータに実行させればよい。また上述において開札者装置を複数のサーバーにより構成し、秘密鍵は複数のサーバーにしきい値秘密とされ、しきい値以上のサーバーが協力しなければ復号できないようにして開札者の不正を防ぐようにすることもできる。このように複数の開札者装置を用いる場合は実施形態２において第３者装置による乱数の加算受信に代えて複数の開札装置でそれぞれ乱数を生成加算して全体として乱数ＲとＲ′が加算されたベクトルが取得されるようにしてもよい。
【００３０】
なお、開札者装置は公開鍵暗号もしくは公開鍵暗号と共通鍵暗号を組み合わせたハイブリッド暗号Ｅの公開鍵を公開する。ここで暗号Ｅは識別不能な確率的公開鍵暗号であり、識別不能とは平文に関する情報を一切漏らさないことである。各入札者装置Ｂｘは入札価格ｂｘを公開鍵で暗号化して、Ｅ（ｂ_x）を開札者装置に送信する。
開札者装置は全ての入札者装置からの暗号文Ｅ（ｂ_x）を復号して各入札価格bxを求める。通常入札の場合は全入札価格の和Σibiを最大化する割当てＡ^*と各入札者ｘの支払価格ｐ_x＝ｂ_x（Ａ^*）を決定し、これらを対応する入札者装置へ通知する。一般化Vickrey入札の場合は復号した全てのｂｘを用いて通常入札の場合と同様に最適割当Ａ^*を求め、又、式（１）を前述した様に計算して各入札者ｘの支払価格ｐ_xを決定する。その決定したＰｘとその対応割当Ａ^*中の財をその入札者装置ｂ_xに通知する。この様な入札方法によって、入札価格を第三者と他の入札者に対して秘密にすることができる。
【００３１】
【発明の効果】
この発明によれば、入札結果以外の入札価格に関する情報を第三者のみならず、他の入札者及び開札者に対しても秘密にしておくことができる。特に実施形態２において乱数によりマスクする場合は最高入札価格も誰にも秘密にしておく事ができる。
【図面の簡単な説明】
【図１】Ａは財割当表Ｔ_Gの具体例を示す図、Ｂは価格表Ｔ_Pの一例を示す図である。
【図２】数値（価格）ｗに対する暗号文ベクトルの例を示す図。
【図３】最大値を求める処理手順の例を示す図。
【図４】その機能構成の例を示す図。
【図５】定数加算処理の例を示す流れ図。
【図６】その機能構成を示す図。
【図７】この発明方法が適応されるシステム構成例を示す図。
【図８】実施形態１の開札装置の処理手順例を示す流れ図。
【図９】実施形態１の入札者装置の処理手順例を示す流れ図。
【図１０】実施形態１の開札者装置の機能構成例を示す図。
【図１１】実施形態１の入札者装置の機能構成例を示す図。
【図１２】財割当表Ｔ_Gの例を示す図。
【図１３】零関数暗号ベクトルの構成例を示す図。
【図１４】入札者装置での入札価格加算処理を説明するための図。
【図１５】入札者装置における零関数ベクトルに対する順次加算処理を簡便に表す図。
【図１６】実施形態１における全ての入札者装置による加算処理が終了した状態のベクトルＥ₀，Ｅ_iの構成例を示す図。
【図１７】実施形態２の開札者装置の処理手順例を示す流れ図。
【図１８】実施形態２の入札者装置の処理手順例を示す流れ図。
【図１９】実施形態２の開札者装置の機能構成例を示す図。[0001]
BACKGROUND OF THE INVENTION
In the present invention, a plurality of bidders bid for a combination of a plurality of types of goods by electronic communication using a bidder apparatus distributed on a communication network such as the Internet, and at that time, a bid value The present invention relates to a bidding method, a device thereof, and a program for keeping the information secret.
[0002]
[Prior art]
Non-patent document 1 discloses a method for keeping a bid price secret in an electronic bidding method for only one type of goods. However, no technology has been proposed that keeps bid prices secret for combinations of multiple types of goods.
First, an ordinary bidding method and a generalized Vickrey bidding method will be described as an electronic bidding method for a combination of multiple types of goods.
Suppose that bidding is performed for a combination of allocation of g types of goods G = {1, 2,..., j,..., g} to b bidders B = {1, 2,. . In this case, allocation B of goods G to B^G= {A: G → B} is b^gIt becomes street. For example, when b = 2 and g = 2, the goods allocation table T_GAs shown in FIG. 1A, when goods B = 1 and G = 2 are assigned to bidder B = 1, and no goods are assigned to bidder B = 2, A₁And G = 1 for B = 1 and G = 2 for B = 2₂When G = 2 is assigned to B = 1 and G = 1 is assigned to B = 2_ThreeThen, there are four ways of assigning G = 1 and G = 2 to B = 2 without assigning any to B = 1. Note that an assignment that has goods that cannot be assigned to any bidder can be represented by inserting a dummy bidder.
[0003]
Such goods allocation table T_GAnd a table T of bidable prices P = {1, 2,..., K,._P(FIG. 1B) opens the bidder to the bidder in advance. Bidder B = i is assigned to each goods A₁, A₂, ..., A_q, ..., A_a(A = b^g) For price list T_PThe bid price is determined by one of the amounts shown in_i= (B_{1, i}, ..., b_{q, i}, ..., b_{a, i}: B^G→ Send P to the bidder.
In the case of normal combination bidding, bidders will be the sum of all bid prices Σ_ib_iAllocation A that maximizes^* ∈B^GAnd its allocation A^* Payment price p of each bidder x in_x= B_x(A^*). Each bidder x is assigned A^* Receive the goods according to the payment price p_xTo pay according to.
[0004]
In the case of generalized Vickrey bids, bidders will be the sum of all bid prices Σ_ib_iAllocation A that maximizes^* ∈B^GAnd the payment price of each bidder x is obtained by the following equation.
p_x= Σ_{i ≠ x}b_i(A^* _x) −Σ_{i ≠ x}b_i(A^*(1)
A^* _x∈B^GIs max_AΣ_{i ≠ x}b_iThis is an allocation that maximizes (A).
The first term on the right side of Equation (1) is the maximum sum when the bidder x does not participate in bidding, and the second term is the sum of the prices excluding the bid price of the bidder x. Each bidder x is assigned A^* Receive the goods according to the payment price p_xTo pay according to. This technique is described in Patent Document 1, for example.
[0005]
For example, when two bidders B = {1,2} and two types of goods G = {1,2}, the allocation of goods A₁, A₂, A_Three, A_FourIs as shown in FIG. 1A, and bid price b of bidder B = 1 for this₁= (B_1,1, B_2,1, B_3,1, B_4,1) = (3,2,2,0), bid price b of bidder B = 2₂= (B_1,2, B_2,2, B_3,2, B_4,2) = (0, 2, 0, 3). In other words, bidder B = 1 buys goods G = 1 and G = 2₁Bid price b_1,1A = 3 yen and buy only goods G1₂Bid price b_2,1 A = 2 yen and buy only goods G2_ThreeFor b_3,1 A = 2 yen and not buy anything_FourFor b_4,1 = 0 yen. Sum of all bid prices in this case
b₁+ B₂= (3,4,2,3)
And Σ_{i = 1,2}b_iA to maximize (A)^* Is A₂It becomes. Substituting the value corresponding to equation (1),
p₁= B₂(A_Four) (= B_4,2-B₂(A₂) (= B_2,2) = 3-2 = 1
p₂= B₁(A₁) (= B_1,1-B₁(A₂) (= B_2,1) = 3-2 = 1
It becomes. A₂According to bidder B = 1 goods G = 1 price p₁= 1 and bidder B = 2 buys goods 2 at price p₂= 1 will be purchased.
[0006]
Next, a technique for obtaining the maximum value of a plurality of values using the homomorphic encryption E, adding a certain value to a certain value, and not knowing which value has been added will be described. This technique is disclosed in Non-Patent Document 2, for example, and this invention uses this technique.
Homomorphic encryption E is (1) indistinguishable, that is, plaintext m₀, M₁And encryption E (m_b), E (m_b) Is m₀Is encrypted or m₁(2) Homomorphic, ie E (a · b) = E (a) E (b), and (3) Re-encryptable, ie E (m) Thus, another ciphertext E ′ (m) of the same plaintext can be efficiently calculated, for example, ElGamal cipher or Palier cipher. The numerical value w (1 ≦ w ≦ n) is expressed by ciphertext E (z) from the first component to the wth component and ciphertext E (1) from the (w + 1) th component to the nth component as follows: ) Vectore(W)

[0007]
That is, as shown in FIG. 2, when the numerical value w = 0, only E (1) is obtained, when w = 1, only the first component is E (z), and when w = 2, only the first and second components are present. Is E (z). When w = n−1, only the nth component is E (1), and when w = n, all components are E (z). Here, z is an integer in a range that can be a plaintext of ciphertext other than 1, for example, a number represented by a number of 1024 bits.
Maximum value calculation (see FIGS. 3 and 4): b ciphertext vectors

The maximum value among the numerical values represented by₁~ W_bWithout knowing, that is, it can be obtained in the following manner while keeping it secret. First, the product for every component of all ciphertext vectors is taken in the product section (S1).

The vector of the product operation result of Expression (3) by the homomorphic property of the cipher E, E (a) · E (b) = E (a · b)eEach component E of (w)_j(j = 1,..., n) is expressed by equation (4)
The
E_j= Π_{i = 1} ^bE_{j, i}= E (z^{s (j)}(4)
Here, s (j) = # {i | j ≦ w_b} Is the number of numerical values greater than or equal to j, and monotonously decreases with respect to j. This can be easily understood by referring to FIG.e(W_iJ-th component E)_{j, i}Are all E (z), so Π_{i = 1} ^bE_{j, i}= E (z^{s (j)}) The number s (j) of ciphertext vectors greater than or equal to the numerical value j gradually decreases as j increases. So product vectoreEach component E of (w)_jAre sequentially decoded by the decoding unit for j = n, n-1,..., L (S3), and the decoding result D (E_j) Is equal to z and D (E_j) = The value of j at the beginning of z is the ciphertext vectore(W₁) ~e(W_b) Number w₁~ W_bMaximum value w_max(S2, S4, S5). In this waye(W₁) ~e(W_b) Each numerical value w₁~ W_bThe maximum value w while keeping secret_maxCan be requested.
[0008]
Addition of constants (see FIGS. 5 and 6): ciphertext vectore(W_i) = (E_{1, i}, E_{2, i}, ..., E_{n, i}) For the numerical value represented by_iThe published constant c can be added without knowing. First, each component E_{1, i}, ..., E_{n, i}Are sequentially shifted to the right by c stages, c components on the right are removed from the shift register, and c stages on the left are vacant to form the following vector ( S1). However, c ≦ n−w.

Store c E (z) in each shift stage that is vacant in the appending unit, and w_iThe following vector obtained by adding c to (S2).

This ciphertext vector is randomized by the random part and w_iA numerical value w obtained by adding a constant c to_i+ C another ciphertext vectore(W_i+ C) (S3).

Thus, the ciphertext vector of equation (5) and the ciphertext vector of equation (6) have the same numerical value w due to the property that the homomorphic encryption E can be randomized._i+ C, but it is a separate ciphertext vectore(W_i)Whene(W_iInformation on the constant c cannot be obtained from + c). If randomization is not performed at the time of addition, the corresponding components of the ciphertext vector before addition and the ciphertext vector after addition are compared, and the added constant is found from the number of components that do not match, so the randomization is performed.
[0009]
[Patent Document 1]
Patent Publication 2000-243362, paragraphs [0002] to [0006]
[Non-Patent Document 1]
Kazue Sako “Entirely verifiable electronic bidding method concealing other than the winning bid value” SCIS '99 35-40 (1999)
[Non-Patent Document 2]
Makoto Yokoo, Koutarou Suzuki "Secure multi-agent dynamic programming based on homomorphic encryption and its application to combinatorial auctions." Proc. Of Autonomous Agents and Multi-Agent Systems 2002, pp.112-119, ACM Press (2002), Section 3.2 "Overview"
[0010]
[Problems to be solved by the invention]
As mentioned above, the bid method with the bid price kept secret has only been proposed for one type of goods. For this reason, a bid requesting a combination of goods such as “I want this goods and this goods together” could not be made with the bid price kept secret.
An object of the present invention is to provide a bidding method, an apparatus therefor, and a program therefor that enable bidding of combinations of a plurality of types of goods while keeping the bid price secret.
[0011]
[Means for Solving the Problems]
According to this invention, the bid opener device assigns each bidder's goods allocation A = {1,..., Q,._GAnd price list (price list) T_PAnd a homomorphic cipher E and a numerical value z other than 1 that can be a ciphertext by the cipher, and a goods allocation table T_GFor each allocation A, the encryption vector expressing each component of the bid price vector b with the price 0 as the bid price is represented by a price vector representing the price 0 consisting of n pieces of the numerical value 1 cipher z (1).E ₀= (e _0,0, ...,e _{a, b} ),E ₁= (e _0,1, ...,e _{a, 1}), ...,E _b= (e _0,0, ...,e _{a, b} ), Respectively, and public or one bidder device B_iSend to.
[0012]
Bidder device B_xIs the bid price b_x= (B_{1, x}, ..., b_{a, x}) Is entered,E ₀~E _bInE ₀WhenE _xFor each component value, the corresponding bid price is added by adding E (z) and randomizing.E ₀,E _xWithout decrypting the result of each additionE ₀,E _xage,E ₀~E _bTo the public or to other bidder devices.
When the bidding process is completed on all bidder devices, the bidder deviceE ₀~E _bAbout firstE ₀Each component vector ofe _0,0, ...,e _{a, 0}From the component number of z obtained first by sequentially decoding each component of the product vector from the nth,e _0,0, ...,e _{a, 0}Find the maximum value m, and each component vectore _0,0, ...,e _{a, 0}Allocation of goods corresponding to the component vector z which is decoded from the m-th component of_qAllocation of goods that maximizes the sum of bid prices A^*And the component number q is Q and the final vectorE ₁, ...,E _x, ...,E _bEach A^* And corresponding component vectorse _{Q, x}The component number w that first becomes z after sequentially decoding from nth for (x∈ {1,..., B})_{Q, x}Is assigned to bidder x^*Bid price for, ie payment price p_xAllocation of goods A^*And each payment price p_xPublish.
[0013]
According to another aspect of the invention (generalized Vickrey bidding), the pre-processing performed by the bid opener device, that is,E ₀~E _bIs the same as one aspect of the invention (ordinary bid) until it is disclosed or transmitted. Bidder device B_xIs the bid price b_x= (B_{1, x} , ..., b_{a, x} ) Is entered,E ₀~E _bInE _xFor all except, add the corresponding bid price by adding E (z) and randomizing,E ₀~E _bWithout decrypting the resultE _xexcept forE ₀~E _bAnd with theseE _xTo the public or to other bidder devices.
[0014]
When the bidding process is completed on all bidder devices, the bidder deviceE ₀~E _bAbout firstE ₀By calculating the maximum value m of each component vector and decoding the m-th component of each component vector_ib_iAllocation of goods that maximizes A^* And respond to thisE ₀The determination of the component number Q is the same as in the case of one aspect of the invention (ordinary bid). Then each final vectorE _xEach Qth component of (x∈ {1, ..., b})e _{Q, x}Decode sequentially from the n-th component of the first and the number that becomes z first is the value w_{Q, x}And each final vectorE _xMaximum value of w ′_{m, x}Then, the product of these vectors is obtained, the product vector is sequentially decoded from the nth component, and the component number from which z is obtained first is obtained. This w '_{m, x}To each w_{Q, x} The result of subtracting each is the payment price p of bidder x_xEach payment price and goods allocation (successful bid allocation) A^*Publish.
[0015]
DETAILED DESCRIPTION OF THE INVENTION
FIG. 7 shows a configuration example of a system to which the method of the present invention is applied. Multiple bidder devices B₁, ..., B_bCan communicate with the bid opener device 11 through the communication network 12 such as the Internet.₁, ..., B_bMutual communication is also possible. Further, in this example, a bulletin board device 13 is connected to the communication network 12 and a third party device 14 is connected.
Embodiment 1 (Normal bidding)
An example of the processing procedure of the bid opener apparatus 11 is shown in FIG. 8, the functional configuration is shown in FIG. 10, an example of the processing procedure of the bidder apparatus is shown in FIG. The bid opener device 11 can be composed mainly of, for example, a personal computer. When a plurality of types of goods to be bid and bidders are determined, the allocation table T of the goods is determined._G12 is created by the goods allocation table creating unit 21 as shown in FIG. 12 (S 1) and published to the bulletin board apparatus 13. Goods allocation table T_GSpecifically, as shown in FIG. 1A described above. In FIG. 12, the bidder Bi is assigned the goods allocation number 1._{i, 1}, ..., A_{i, a}Is assigned. It is assumed that the allocated goods are determined in this way for each bidder, for example, the registration number. In other words, the bidder must_GIt is possible to know which line column of the assignment is to be yours. If the number of bidders is e and the type of goods is g, the maximum value a of the assigned number is b^gIt is.
[0016]
The bid opener device 11 has a set of allotted goods A_{q, i}Price table T indicating the bidable price for (i∈ {1,..., b}, q∈ {1,..., a})_P(For example, the same as shown in FIG. 1B) is released to the bulletin board apparatus 13. In addition, the key generation unit 22 generates a secret key SK and its public key PK, holds the secret key SK in the key generation unit 22, publishes the public key PK to the bulletin board apparatus 13, The number z other than the numerical value 1 that can be made is disclosed to the bulletin board apparatus 13 (S2).
Furthermore, b + 1 vectors obtained by encrypting the zero function with the homomorphic encryption EE ₀...E _bIs generated by the zero function generator 23 (S3), and in this example, these vectors are converted into one of the bidder devices B₁(S4). The processing so far is the preprocessing in the bid opener device 11. Bidder device B_xIs the goods allocation table T from the bulletin board device 13._G, Price list T_PThe public key PK and the numerical value z are acquired and stored in the storage unit 41 (S1). The bidder must assign the goods (A_{1, x}, ..., A_{q, x}, ... A_{a, x}Bid price b)_x= (B_{1, x}, ..., b_{q, x}, ..., b_{a, x}) Is input by the input unit 42 (S2). Bidder device B in this state_x-1Vector fromE ₀, ...,E _bWhen this is received (S3), the adder 43 generates a vector.E ₀WhenE _xBid price b_xAre added (S4). As described with reference to FIG. 5 and FIG.E ₀WhenE _xEach component of eache _{q, 0}Whene _{q, x}(q∈ {1, ..., a}) to b_{q, x}Shift right (S4a), and the ciphertext E (z) obtained by encrypting z with the homomorphic cipher E by the encryption unit 43b is transferred to the portion vacated by the shift._{q, x}Are added by the adding unit 43c (S4b), and the added components are added.e _{q, 0}Whene _{q, x}Are randomized by the random part 43d (S4c). In this way bid price b_xVectorE ₀WhenE _xNew vector added toE ₀WhenE _xNext bidder device B along with other unadded vectors_{x + 1} (S5). This bidder device B_{x + 1} Vector cyclicallyE ₀, ...,E _bThe order of transmitting the URLs may be arbitrary, but is determined in advance and transmitted by the bid opener device 11 first, and the last bidder device transmits it to the bid opener device 11. The addition process of the bid price for such a vector may be sequentially performed via the bulletin board device 13 or the bidder device 11.
[0017]
As shown in FIG. 11, the bidder apparatus includes a receiving unit 44, a transmitting unit 45, and a control unit 46 for operating each unit, and can be constituted by a personal computer, for example.
Prior to the description of the bid opening process in the bid opener device 11, the vectorE ₀, ...,E _bWill be described with reference to FIG. vectorE ₀Is the bid price b₀= (B_1,0 , ..., b_{q, 0} ..., b_{a, 0} Corresponding to
(e _1,0 , ...,e _{q, 0} , ...,e _{a, 0} )
On behalf of its ingredientse _{q, 0} Is
E (b_{q, 0} = 0) = (E_{1, q, 0} ⁽¹⁾, E_{2, q, 0} ⁽¹⁾, ..., E_{n, q, 0} ⁽¹⁾)
It is. That is, each bid price b for the combination of goods allocation for each goods b_{q, 0}(q∈ {1, ..., a}) are all 0, so the bid price b_{q, 0}Corresponds to a ciphertext vector of zero. Other vectorsE ₁, ...,E _bAlso in the figureE _iIs a ciphertext vector indicating a price of 0 having a component and n components each including E (1). Where n is the price list T_PFor example, it is selected so that the addition value does not exceed n in a state where the addition processing is performed by all bidder apparatuses.
[0018]
Zero-function cryptographic vectorE ₀, ...,E _bSince the bidder device adds the bid price and updates these vectors to be sent to the next bidder device as described above, the bidder device B is configured as described above._xBid price at_xIs represented by the equation shown in FIG. In other words, the addition result is b_xSince one of the component vectors is added, the bidder apparatus B is added._x-1Corresponding component vector frome _{q, x-1}(= E (Σ_{i = 1} ^x-1b_{q, i})) Bid price b_{q, x}The ciphertext is obtained by addinge _{q, x}It is said. Therefore, when processing by all bidder devices is complete,E ₀Is the value it represents_{i = 1} ^bb_iIt becomes.
[0019]
Received vectorE ₁, ...,E _bAgainstE _xOnly for b_xWhen all the bidder devices have finished processing, the vectorE ₁= E (b₁), ...,E _b= E (b_b) Bidder device B₁, ..., B_bFIG. 15 is a simplified representation of this process.
When all bidders have finished processing, the vectorE ₀The components of are as shown in FIG.E _iEach component of (i∈ {1,..., B}, q∈ {1,..., A}) is as shown in FIG.
[0020]
Next, an example of the bid opening process will be described with reference to FIGS.
Vector after all bidders have been processedE ₀, ...,E _bAre stored in the storage unit 24 (S5), and then the vectorE ₀Ingredientse _{q, 0}The maximum value of mE ₀This is detected by the component maximum value detection unit 25 (S6). The detection of the maximum value starts with the component vector as described with reference to FIGS.e _1,0, ...,e _{a, 0}(S6a), the product vector is sequentially decoded from the nth component (S6b), and the component number from which z is first decoded is set to the maximum value m (S6c).
[0021]
Next, the allocation deciding unit 26 allocates the maximum bid price, that is, the optimal allocation A^* Is determined (S7). Therefore, q is set to 1 (S7a), and the vectorE ₀Ingredientse _{q, 0}The m-th component is decoded (S7b), and it is checked whether the decoding result is equal to z (S7c). If it is not equal to z, q is incremented by 1 and the process returns to step S7b (S7d). If it is equal to z in step S7c, q at that time is set as Q, and the optimal allocation A obtained by allocation A for q = Q is obtained.^* (S7e).
[0022]
Next, the payment amount determination unit 27 determines a payment price for each bidder (S8). Therefore, the price parameter w is set to n (S8a), and each vectorE _x(x∈ {1, ...
, B}) Qth componente _{Q, x}= E (b_{Q, x}) Is decoded (S8b), and whether the result is equal to z is checked (S8c). If not equal, w is decremented by 1 and the process returns to step S8b (S8d). Payment p for person x_x(S8e). In this way, the payment amount p for each bidder x_xIs obtained. Each of these payment prices p_xAnd the optimum allocation (successful bid allocation) are disclosed to the bulletin board apparatus 13. Payment amount p if necessary_xAnd optimal allocation A^* Or its number Q or its allocation A^*The notification unit 28 creates a successful bid notification including the goods for the bidder x in the bidder device B_x(S9).
In FIG. 10, the bid opener apparatus also includes a transmission unit 29 and a reception unit 31, and further includes a control unit 32 that operates each unit, and is configured by a personal computer, for example.
Thus, in each bidder device, its reception vectorE ₀, ...,E _bAnd send vectorE ₀, ...,E _bSince the bid price is hidden even if compared with the bid opening process, the bid opener does not reveal the bid price of each bidder, so the bid opener knows the correspondence between bidders other than the successful bid result and the bid price It is not possible.
[0023]
Embodiment 2 (generalization Vickrey bid)
FIG. 17 shows a processing procedure of the bid opener apparatus according to the second embodiment, FIG. 19 shows an example of the functional configuration, and FIG. 18 shows an example of a processing procedure of the bidder apparatus. The pre-processing in the bid opener apparatus is the same as that of the first embodiment, that is, the processing from steps S1 to S4 in FIG. The functional configuration of the bidder apparatus is substantially the same as that of the first embodiment, that is, the configuration shown in FIG. 11, and the processing is also the same as steps S1 to S3 in FIG.
In this embodiment 2, bidder apparatus B_xReceive vector atE ₀, ...,E _bInE _xBid price b for everything except_xAre added, and these vectors are updated (S4).E ₀, ...,E _bBidder device B_{x + 1}(S5). In FIG. 11, parentheses “((E ₀,E ₁, …,E _x-1,E _{x + 1}, ...,E _b) "Is for the second embodiment.
[0024]
In the processing of the bid opener device, in the second embodiment, the maximum value m of the component vector is also made unknown to the bid opener.E ₀A random vectorR= (R₁= ... = r_a) Added vectorE+RIs acquired by the addition vector acquisition unit 33 (S6). For example, the third party device 14 shown in FIG.E ₀SendE ₀+RThe bidder device that has returnedE ₀~E _bIs transmitted to the third party device 14, and the third party deviceRMay be registered in the bid opener device 11 or the bulletin board device 13. This random number vector addition is performed by shift processing, addition of E (z) and randomization as described with reference to FIGS. This added vector (E ₀+R) Component maximum value m (E ₀+R) Obtained by the maximum value detector 34 (S7). The processing procedure for obtaining the maximum value m in this case may be performed similarly to that in step S6 in FIG.
[0025]
Next, in the allocation determination unit 35, the optimal allocation A^* Is determined (S8). This process may be the same as that performed in step S7 in FIG. 8 by using m obtained by the maximum value detection unit 34 for the addition vector from the addition unit 33.
The result of the processing in steps S7 to S8 is a vectorE ₀Is in Embodiment 1.E ₀, Just a random number is added to this and the vectorE ₀The optimal allocation A with the maximum value of the components of^* Can be requested.
[0026]
Next, the random number vector from the third party device 14R′ = (R ′₁= ... = r '_a) Added vectorE ₁+R′,…,E _b+R'Is acquired by the addition vector acquisition unit 36 (S9), theseE _x+R′ (X∈ {1,..., B}) component maximum value w ′_{m, x}Is obtained by the component maximum value detection unit 37 (S10). This process is also obtained by the same process as described with reference to FIGS. Vector hereE ₁Is bidder device B₁Bid price b₁Bid price b of other bidders that are not added₂, ..., b_bIn the same way, each bidder device B_xThen E_xExcept b_x(X∈ {1,..., B}). Therefore, the maximum value w ′_{m, x}It can be easily understood that is a price that maximizes the sum of all other bid prices excluding the bid price of bidder x, that is, a value corresponding to the first term on the right side of Equation (1).
[0027]
Next, an addition vector is detected by the component value detection unit 38.E _x+REach price w of Q 'ingredient of'_{Q, x}(Xε {1,..., B}) is detected (S11). This process may be performed in the same manner as step S8 in FIG. Each price w obtained_{Q, x}Is the maximum value w '_{m, x}As can be understood from the explanation about the bid price b of the bidder x_xIt can be easily understood that the sum of the bid prices excluding, that is, the one corresponding to the second term on the right side of Equation (1).
Therefore, the subtraction unit 39 uses the maximum value w ′._{m, x}To w_{Q, x}Subtracting the payment price p of bidder x_xIs obtained (S12). In this subtraction, a random number r ′_QNote that is removed. The payment price p of each bidder x obtained in this way_xAnd optimal allocation (successful bid allocation) A^* To the bulletin board apparatus 13. Payment price p as required_xAnd A^*Or its assigned number Q or its A^*The notice creation unit 28 creates a successful bid notification including the goods for the bidder x in the bidder device B_x(S13). Or successful bid allocation A^*And each payment price p_xPublish.
[0028]
In the bid opener apparatus shown in FIG. 19, the same reference numerals are given to the portions corresponding to those in FIG. The control unit 32 operates each unit, and can be configured mainly with a personal computer as a whole.
According to the second embodiment, the bid opening process can be performed for the generalized Vickrey bid without revealing the correspondence between the bidder and the bid price and without revealing the maximum bid price. When the maximum bid price may be disclosed, random number addition is not performed, that is, the addition vector acquisition units 33 and 36 are removed,E ₀WhenE ₁, ...,E _bMay be supplied to the component maximum value detectors 34 and 37 and the component value detector 38. random numberRWhenR'May be the same. If these are different, the confidentiality will be higher. Goods allocation table T by communication between bidder device and bidder device without providing bulletin board device_G, Price list T_pIt is only necessary for the bidding device to know the public key PK and the numerical value z. Zero-function cryptographic vector, goods allocation table T_GMay be created by a device other than the bid opener device.
[0029]
As described above, each of the bid opener devices shown in FIGS. 10 and 19 and the bidder device shown in FIG. 11 can function by causing a computer to execute a program. In this case, a bid opening program or a bidding program may be downloaded from a recording medium such as a CD-ROM or a magnetic disk or via a communication line and executed by the computer. Also, in the above, the bid opener device is configured by a plurality of servers, and the secret key is set as a threshold secret to a plurality of servers, so that it cannot be decrypted unless the servers above the threshold cooperate to prevent fraud of the bid opener. It can also be. When a plurality of bid opener devices are used in this way, random numbers are generated and added by a plurality of bid opening devices instead of the random number addition reception by the third party device in the second embodiment, so that the random number as a whole.RWhenRA vector obtained by adding ′ may be acquired.
[0030]
The bid opener device publishes the public key of the hybrid cipher E that combines public key cryptography or public key cryptography and common key cryptography. Here, the cipher E is an indistinguishable probabilistic public key cipher, and indistinguishable means that no information about plaintext is leaked. Each bidder apparatus Bx encrypts the bid price bx with the public key, and E (b_x) To the bid opener device.
The bid opener device sends the ciphertext E (b from all bidder devices._x) To obtain each bid price bx. Allocation A that maximizes the sum of all bid prices Σibi for normal bidding^*And the payment price p of each bidder x_x= B_x(A^*) And notify the corresponding bidder apparatus. In the case of generalized Vickrey bidding, the optimal allocation A is used as in the case of normal bidding using all the decoded bx.^*And the payment price p of each bidder x by calculating the equation (1) as described above._xDecide. The determined Px and its corresponding allocation A^*Bid device b in the goods inside_xNotify By such a bidding method, the bid price can be kept secret from third parties and other bidders.
[0031]
【The invention's effect】
According to the present invention, information related to the bid price other than the bid result can be kept secret not only for third parties but also for other bidders and bidders. In particular, when masking with random numbers in the second embodiment, the highest bid price can be kept secret to anyone.
[Brief description of the drawings]
FIG. 1 A is a goods allocation table T_G, B shows price list T_PIt is a figure which shows an example.
FIG. 2 is a diagram showing an example of a ciphertext vector for a numerical value (price) w.
FIG. 3 is a diagram showing an example of a processing procedure for obtaining a maximum value.
FIG. 4 is a diagram showing an example of the functional configuration.
FIG. 5 is a flowchart showing an example of constant addition processing.
FIG. 6 is a diagram showing a functional configuration thereof.
FIG. 7 is a diagram showing a system configuration example to which the method of the present invention is applied.
FIG. 8 is a flowchart showing a processing procedure example of the bid opening device according to the first embodiment;
FIG. 9 is a flowchart showing an example of a processing procedure of the bidder apparatus according to the first embodiment.
FIG. 10 is a diagram illustrating a functional configuration example of the bid opener device according to the first embodiment.
FIG. 11 is a diagram illustrating a functional configuration example of the bidder apparatus according to the first embodiment.
[Figure 12] Goods allocation table T_GFIG.
FIG. 13 is a diagram showing a configuration example of a zero function encryption vector.
FIG. 14 is a view for explaining bid price addition processing in the bidder apparatus;
FIG. 15 is a diagram simply illustrating sequential addition processing for a zero function vector in a bidder apparatus.
FIG. 16 is a vector E in a state where the addition processing by all bidder apparatuses in the first embodiment is completed;₀, E_iFIG.
FIG. 17 is a flowchart showing a processing procedure example of the bid opener device according to the second embodiment;
FIG. 18 is a flowchart showing an example of a processing procedure of the bidder apparatus according to the second embodiment.
FIG. 19 is a diagram illustrating a functional configuration example of the bid opener device according to the second embodiment.

Claims (11)

A bidder device, a plurality of bidder devices B ₁ ,..., B _b, and a communication network capable of connecting them,
Each bidder apparatus B _x (x∈ {1,..., B}) has a plurality of goods G = {1,..., G} assigned to each bidder B∈ {1,. For each price of bid price b _x = (b _{1, x} ,..., B _{a, x} ) (a = b ^g ) input based on _TG , the public key PK of the homomorphic public key encryption E of the bidder apparatus The number E of the numbers z other than the number 1 is encrypted by the number of the price values.
Component vector having a total of n components of wε {0,..., n} ciphers E (z) and n−w ciphers E (1) encrypted with the public key PK. , B + 1 processing vectors E ₀ ,..., E _{b of which} are added as components, respectively, by adding the bid price to the generated E ₀ and E _x and adding the generated encryption E (z) and randomizing processing performed, the addition result of processing vector E ₀ respectively as E ₀ and E _x, ..., and transmits the E _b, where E _0, ..., each component of all encryption initial value every component vector of E _b E (1), the component number of the component vector is E (z) when the component number is small, and E (1) when the component number is large. This addition processing (also referred to as bidding processing) is performed by the bidder device that performs the initial E _0, ..., with respect to E _b, other bidders device E ₀ that has been processed, ..., sequentially performed with respect to E _b,
Tender opening's device all bidders device processing vector E ₀ bid process has been performed by, ..., the E _b, the first product of the component vector of E ₀ determined, the components of the product vector from component number n The component number for which z is obtained first by sequential decoding is set as the maximum value m in these component vectors,
The allocation of the goods corresponding to the component vector obtained by decoding the component number m of each component vector of E ₀ and obtaining z is the optimal allocation A ^* , the component number at E ₀ of the component vector is Q, The component vector of the component number Q of the processing vector E _x (x∈ {1,..., B}) is sequentially decoded from the component number n, and the component number w _{Q, x} that becomes z first is optimal for the bidder x. A multi-goods bidding method characterized in that a bid price (payment price) p for the allocation A ^{* is} used. A bidder device, a plurality of bidder devices B ₁ ,..., B _b, and a communication network capable of connecting them,
Each bidder apparatus B _x (x∈ {1,..., B}) has a plurality of goods G = {1,..., G} assigned to each bidder B∈ {1,. The public key PK of the homomorphic public key encryption E of the bidder apparatus for each price of bid price b _x = (b _{1, x} ,..., B _{a, x} ) (a = b ^g ) bid based on T _G The number E of the numbers z other than the number 1 is encrypted by the number of the price values.
Component vector having a total of n components of wε {0,..., n} ciphers E (z) and n−w ciphers E (1) encrypted with the public key PK. b + 1 pieces of processing vector E ₀ to a number of respective components, ..., to E _b, with the exception of E _x, the sum of bid, by the addition and randomization process generated encryption E (z) performed, the addition result of each _{E 0, ..., E x-} 1, E x + 1, ..., processing vector E ₀ as E _b, ..., and transmits the E _b, where E _0, ..., E _b The initial values of all of the component vectors are all encrypted E (1), the component number of the component vector is E (z) where the smaller number is E (1),
This addition process (also written to the bidding process) is E ₀ bidders device initial of the first to do, ..., with respect to E _b, other E ₀ bidder device has been processing of, ..., sequentially performed with respect to E _b,
Tender opening's device all bidders device processing vector E ₀ bid process has been performed by, ..., the E _b, the first product of the component vector of E ₀ determined, the components of the product vector from component number n The component number for which z is obtained first by sequential decoding is set as the maximum value m in these component vectors,
The allocation of the goods corresponding to the component vector obtained by decoding the component number m of each component vector of E ₀ and obtaining z is the optimal allocation A ^* , the component number at E ₀ of the component vector is Q,
The product of the components of each processing vector E _x (x∈ {1,..., B}) is obtained, the product vector is sequentially decoded from the component number n, and the component number from which z is obtained first is represented by w ′ _{m, x} ,
The component vector of each component number Q in each processing vector E _x (xε {1,..., B}) is sequentially decoded from the component number n, and the component number from which z is obtained first is represented by w _{Q, x.} And subtracting w _{Q , x} from w ′ _{m, x} to obtain a payment price p _x for the bidder x. Tender opening's device random number R = a processing vector _{E 0 (r 1 = r 2} = ... = r a) obtains the vector E ₀ + R of the addition, to this vector E ₀ + R, the component vector The maximum value m is obtained, the component of the component number m of the vector E ₀ + R is decoded to obtain the optimum allocation A ^* and the component number Q,
Each processing vector E _x (x∈ {1,..., B}) has a random number R ′ = (r ′ ₁ = r ′ ₂ = ... = r ′ _a ) is added to obtain a vector E _x + R ′, a product of components of E _x + R ′ is obtained, and w ′ _{m, x} is obtained,
3. The multi-goods bidding method according to claim 2 _{, wherein} w _{Q, x} is obtained from the component vector of each component number Q of each added vector E _x + R ′ (x∈ {1,..., B}). . A plurality of bidders device B _1, ..., a B _b, a plurality of types of goods G = {1, ..., g } each bidder B∈ the {1, ..., b} on the basis of the goods assigned table T _G assigned to bid treated b + 1 pieces of processing vector E _0, ..., a bid opening's apparatus for performing tender opening process to E _b,
Each of the processing vectors E _x (x∈ {1,..., B}) has component vectors a (= b ^g ) in the goods allocation table T _G , and each of these component vectors is a bidder device. Wε {0,..., N} of ciphers E (z) obtained by encrypting a number z other than the number 1 with the public key PK of the homomorphic public key cipher E, and the number 1 encrypted with the public key PK It has a total of n components with nw of the code E (1),
A storage unit storing a secret key SK paired with the public key PK;
A receiving unit for receiving the processing vectors E ₀ ,..., E _b ;
The processing vector E ₀ is input, the product of each component vector is calculated, each component of the product vector is sequentially decoded from the component number n, and the component number for which z is obtained first is the maximum in these component vectors. A component maximum value detection unit that outputs the value m;
The processing vector E ₀ and the maximum value m are input, and the component number Q at E ₀ of the component vector obtained by decoding the component of the component number m of each component vector of E ₀ and obtaining z is a successful bid in the property allocation table. An allocation determination unit that outputs as an allocation number;
The processing vector E ₁ ,..., E _b and the component number Q are input, and the component vector of the component number Q of each processing vector E _x (x∈ {1,..., B}) is sequentially decoded from the component number n. A bidder apparatus comprising a payment price determining unit that outputs the component number w _{Q, x} that is first z as a bid price (payment price) px for the bidder _x . A plurality of bidders device B _1, ..., a B _b, a plurality of types of goods G = {1, ..., g } each bidder B∈ the {1, ..., b} on the basis of the goods assigned table T _G assigned to bid treated b + 1 pieces of processing vector E _0, ..., a bid opening's apparatus for performing tender opening process to E _b,
Each of the processing vectors E _x (x∈ {1,..., B}) has a component vector, and each of these component vectors is a public key PK of the homomorphic public key cryptography E of the bidder device. N is the total of wε {0,..., N} of ciphers E (z) obtained by encrypting a number z other than n and n−w ciphers E (1) obtained by encrypting the number 1 using a public key PK. Having components,
A storage unit storing a secret key SK paired with the public key PK;
A receiving unit for receiving the processing vectors E ₀ ,..., E _b ;
The processing vector E ₀ is input, the product is calculated, each component of the product vector is sequentially decoded from the component number n, and the component number from which z is first obtained is output as the maximum value m in these component vectors. A component maximum value detection unit;
The processing vector E ₀ and the maximum value m are inputted, and the component number Q at E ₀ of the component vector obtained by decoding the component of the component number m of each component vector of E ₀ is obtained in the allocation table of goods. An allocation determination unit that outputs the successful bid allocation number;
Processing vectors E ₁ ,..., E _b are input, and the product of the components of E _x is calculated.
A second component maximum value detection unit that sequentially decodes the product vector from the component number n and outputs the component number from which z is first obtained as w ′ _{m, x} ;
The component number Q is input to the processing vectors E ₁ ,..., E _b, and the component vector of each component number Q in each processing vector E _x (x∈ {1,..., B}) is sequentially started from the component number n. A component value detector that decodes and outputs the component number from which z is first obtained as w _{Q, x} ;
Said w _{'m, x} and the w' _{Q, x} is the input, w _{'m, x} from w _Q, bid opening's apparatus and a subtraction unit for outputting as the payment price p _x for subtraction to bidders x a _x . The processing vector E ₀ is perturbed by _a random number vector R = (r ₁ ,..., _Ra ), and the processing vectors E ₁ ,..., E _b are respectively random number vectors R ′ = (r ′ ₁ 6. The bid opener apparatus according to claim 5, wherein the bidder apparatus is disturbed by = r ′ ₂ =... = R ′ _a ). A bidder apparatus that performs a bid process based on a goods allocation table T _{G in} which a plurality of types of goods G = {1,..., G} are assigned to each bidder Bε {1,.
A storage unit for storing the public key PK of the homomorphic public key cipher E of the bid opener device;
An encryption unit that encrypts a number z other than Equation 1 with the public key PK and outputs the encryption E (z), and wε {1,..., N of the encryption E (z) processed by the bidder apparatus B _x } And b + 1 processing vectors each having a component of a = b ^g component vectors having n-w components in total and n−w components of the cipher E (1) encrypted with the public key PK. A receiving unit for receiving E ₀ ,..., E _b ;
An input unit for inputting _a bid price b _x = (b _{1, x} ,..., B _{a, x} );
The number of ciphers E (z corresponding to each price of the processing vectors E ₀ and E _x (x∈ {1,..., B}) and the bid price b _x = (b _{1, x} ,..., B _{a, x} ) ), And by adding the encryption E (z) to E ₀ and E _x and randomizing processing, the processing vector E ₀ is obtained by adding the bid price b _x to the values represented by E ₀ and E _x , respectively. An adder that outputs E _x ;
A bidder apparatus comprising: a transmission unit that transmits processing vectors E ₀ and E _x from the adding unit and other received processing vectors for processing of the bidder device B _{x + 1} . A bidder apparatus that performs a bid process based on a goods allocation table T _{G in} which a plurality of types of goods G = {1,..., G} are assigned to each bidder Bε {1,.
A storage unit for storing the public key PK of the homomorphic public key cipher E of the bid opener device;
An encryption unit that encrypts a number z other than Equation 1 with the public key PK and outputs the encryption E (z), and wε {1,..., N} of the encryption E (z) processed by the bidder apparatus B _x B + 1 processing vectors E each having a component of a = b ^{g of} component vectors having a total of n-w components of the cipher E (1) obtained by encrypting the number 1 and the number 1 with the public key PK. A receiving unit for receiving ₀ ,..., E _b ;
An input unit for inputting _a bid price b _x = (b _{1, x} ,..., B _{a, x} );
Other than E _x (x∈ {1,..., B}) in the processing vector E ₀ ,..., E _b and each price of the bid price b _x = (b _{1, x} ,..., B _{a, x} ) The number of ciphers E (z) corresponding to each of the processing vectors is input, and the bid price b is applied to the values respectively represented by the processing vectors by adding and randomizing the encryption E (z) to the input processing vectors. an adder that outputs a processing vector obtained by adding _x ;
A bidder apparatus comprising: a processing unit that transmits the processing vector added by the adding unit and the received processing vector E _x for processing of the bidder apparatus B _{x + 1} . The adding unit shifts each component vector of each input processing vector E and each component of e _q (qε {1,..., A}) by b _{q, x to the} side with the larger component number; And an addition unit for respectively adding the code E (z) to the component number portion vacant from the shift, and a random unit for randomizing and outputting the components of component numbers 1 to n from the addition unit. The bidder device according to claim 7 or 8. A bid opening program for causing a computer to function as the bid opener device according to any one of claims 4 to 6. A bidding program for causing a computer to function as the bidder apparatus according to claim 7.

Images