JP4702777B2 - Secret logic calculation method and apparatus, and program - Google Patents

Description

  The present invention relates to the technical field of information security, and in particular, applies cryptographic information, provides a function in an unanalyzable form, and enables calculation of the function and acquisition of an output result without knowing an input value to the function. Related to technology.

  Conventionally, as a technique that enables calculation of the function and acquisition of an output result without knowing an input value to the function, for example, there are techniques described in Non-Patent Document 1, Non-Patent Document 2, and the like. By using these technologies, a certain number (multiple) is converted by using a certain cryptographic algorithm to conceal the number, and the converted number is used as input to allow a plurality of devices to cooperate in the calculation. By doing so, the output result of the function can be obtained without leaking the (original) numerical value of the input. Furthermore, it is possible to verify the validity of the output result, that is, whether each device has performed the correct processing. If the technique of Non-Patent Document 2 is used, a secret calculation with a reduced calculation time can be realized.

B. Schoenmakers and P.M. Tuyls, “Practical Two-Party Calculation based on the Conditional Gates,” ASIACRYPT 2004, Dec. 2004. Senda, Yamamoto, Suzuki, Uchiyama, "Multi-party secret circuit calculation using ElGamal encryption", SCIS2005, January 25-28, 2005

  If the numerical value of the input consisting of 0 or 1 is encrypted and the result of the addition and exclusive OR (encryption thereof) of the numerical value can be obtained, the logical (OR) and logical product ( AND) result (ciphertext) can be obtained. That is, in theory, many functions can be calculated with the input numerical value encrypted. This is called a secret logic calculation.

  In the existing secret logic calculation method, it is assumed that only the input / output is encrypted, and the content of the operation itself is performed in public. On the other hand, it is an important issue in implementing a digital rights management module, a cryptographic module, and the like to perform a calculation while keeping the contents of the calculation private.

  The present invention provides a function in an unanalyzable form, and allows an arbitrary logic gate to obtain an output result by performing an operation while keeping the operation contents secret without knowing an input value to the function. It is an object to provide a secret logic calculation method and system for realizing the above, and a program.

As an operation x * y of two numerical values x and y, x * y = x is defined when y = 0, and x * y = 1−x when y = 1. And the logic gate
f _{a, b, c, d} (x, y) = a + b * x + c * y + d * (x * y)
Is expressed by a function of the quadratic form of (a, b, c, d are parameters).
With respect to the function expressed in the secondary format, a secret circuit calculation method as described in Non-Patent Document 2 is combined a plurality of times, and the calculation is performed while the input / output values and the calculation contents are kept secret. Since an arbitrary logic gate can be realized by appropriately adjusting a, b, c, and d in the function, an arbitrary logic gate can be realized while keeping both the gate type and input / output secret.

  According to the present invention, without knowing the input value to the function, it is possible to obtain the output result by performing the operation while keeping the contents of the operation secret, and to realize an arbitrary logic gate while keeping both the gate type and the input / output secret. .

Hereinafter, embodiments of the present invention will be described in detail.
Let E be a public key cryptography encryption function that has homomorphism for the product and sum operations. That is, for plaintext x and y, E (x) + E (y) = E (x + y)
E (x) E (y) = E (xy)
Holds. Here, E is an encryption function of public key cryptography having additive homomorphism.

Now, for E, a means for calculating some quadratic expression E (x * y) from ciphertexts E (x) and E (y) is given. “*” Is defined as performing an operation obtained by extending the exclusive OR operation as follows.
When y = 0: x * y = x
When y = 1: x * y = 1−x

Here, consider a quadratic function having parameters a, b, c, and d as follows.
f _{a, b, c, d} (x, y) = a + b * x + c * y + d * (x * y) (1)
The function expressed in the secondary form can realize an arbitrary logic gate function by appropriately adjusting the values of a, b, c, and d.

  In the present invention, by applying the encryption function E of public key cryptography having additive homomorphism to the function expressed by the above-mentioned quadratic form, performing the operation while keeping the input / output and the operation content secret, Get the output result. This makes it possible to calculate an arbitrary logic gate while keeping both the type and input / output of the gate concealed.

  FIG. 1 is a conceptual diagram of a secret logic computer according to the present invention. Here, E (a), E (b), E (c), E (d), E (x), and E (y) are ciphertexts of a, b, c, d, x, and y, respectively. is there. The secret logic computer 10 receives the ciphertexts E (a), E (b), E (c), E (d), E (x), E (y) as input, and E (a + b * x + c * y + d *). (X * y)) is calculated, and the calculation result is output in a secret manner. The calculation of E (a + b * x + c * y + d * (x * y)) is performed by, for example, using a secret circuit calculation method described in Non-Patent Document 2 and repeatedly applying it. However, the method described in Non-Patent Document 2 is not necessarily required.

  According to the concealment logic computing device 10, it is possible to perform the computation of the quadratic function while keeping the computation content concealed, and by adjusting the values of a, b, c, and d appropriately, A logic gate can be realized and the type of gate can be concealed at the same time.

  FIG. 2 shows a processing flow as one embodiment of the secret logic computer 10. Here, it is assumed that the ciphertexts E (a), E (b), E (c), E (d), E (x), and E (y) are generated in advance by a ciphertext generation device or the like. The secret logic computer 10 inputs the ciphertexts E (a), E (b), E (c), E (d), E (x), and E (y) (step 11). 2, the E (b * x) is first calculated from E (b) and E (x) by applying the secret circuit calculation method described in 2 and any other secret calculation method (step 12). E (c * y) is calculated from (c) and E (y) (step 13). Next, E (x * y) is calculated from E (x) and E (y), and E (d * (x * y)) is calculated from E (d) and E (x * y). (Step 14). An intermediate result of the calculation is stored in a storage device or the like. Finally, all of E (a), E (b * x), E (c * y), E (d * (x * y)) are added (step 15), and the calculation result E (a + b * x + c *) y + d * (x * y)) is output (step 16). Steps 12, 13, and 14 are in no particular order. In step 14, E (d * x) is calculated from E (d) and E (x), and E (d * x * y) is calculated from E (d * x) and E (y). Even so, the result is the same.

  FIG. 3 shows a functional block diagram as another embodiment of the secret logic computer 10. Here, 21 to 24 are secret calculation means for calculating E (A * X) by using E (A) and E (X) as inputs, and basically any type of E (A * X) can be calculated. The thing of a structure may be sufficient. Reference numeral 25 denotes a simple addition means.

  As in the case of FIG. 2, the ciphertexts E (a), E (b), E (c), E (d), E (x), E (y) are generated in advance by a ciphertext generator or the like. Suppose that The secret calculation means 21 inputs E (b) and E (x) and outputs E (b * x). Similarly, the secret calculation means 22 inputs E (c) and E (y) and outputs E (c * y). The secret calculation means 23 inputs E (x) and E (y) and outputs E (x * y), and the secret calculation means 24 outputs E (d) and the output E (x * y) of the secret calculation means 23. ) And E (d * (x * y)) is output. The adder 25 outputs the output E (b * x) of the secret calculation means 21, the output E (c * y) of the secret calculation means 22, the output E (d * (x * y)) of the secret calculation means 24, and E Input (a), add them all, and output E (a + b * x + c * y + d * (x * y)).

  In FIG. 3, the secret calculation means 21 to 24 may basically have the same configuration. Therefore, under the control of the control means or the like, the calculation of the secret calculation means 21 to 24 is repeatedly executed by one secret calculation means, and the calculation result is held in the memory or the like and given to the addition means 25. The same operation as described above is possible. The secret calculation means 23 and 24 receive E (d) and E (x) and calculate E (d * x), and the E (d * x) and E (y) The calculation result is the same even if it is replaced with a secret calculation means for calculating E (d * x * y) by inputting.

  Next, a few specific examples are shown. Here, as an example, an AND, OR, XOR (exclusive OR) logic gate is realized. 4A to 4C show the correspondence between AND, OR, and XOR logic gates and the values of parameters a, b, c, and d. Hereinafter, it will be proved that logic gates of AND, OR, and XOR are realized by setting the values of parameters a, b, c, and d to FIGS.

[AND gate]
When the parameter values (a, b, c, d) = (− 5 × 4 ⁻¹ , 4 ⁻¹ , 4 ⁻¹ , 3 × 4 ⁻¹ ) in FIG. It is expressed as equation (2).
f _AND (x, y) = − 5 × 4 ⁻¹ +4 ⁻¹ * x + 4 ⁻¹ * y + 3 × 4 ⁻¹ * (x * y) (2)
(I) When x = 0 and y = 0 According to the definition of the operation of “*” above, the second term on the right side is 4 ⁻¹ * x = 4 ⁻¹ * 0 = 4 ⁻¹ , and the third term on the right side is also the same. 4 ⁻¹ * y = 4 ⁻¹ * 0 = 4 ⁻¹ . The fourth term on the right side is x * y = 0 * 0 = 0, and 3 × 4 ⁻¹ * (x * y) = 3 × 4 ⁻¹ * 0 = 3 × 4 ⁻¹ . The fourth term on the right side is 3 × 4 ⁻¹ * x = 3 × 4 ⁻¹ * 0 = 3 × 4 ⁻¹ , 3 × 4 ⁻¹ * y = 3 × 4 ⁻¹ * 0 = 3 × 4 ⁻¹ And the result is the same. Therefore,
f _AND (0,0) = − 5 × 4 ⁻¹ +4 ⁻¹ +4 ⁻¹ + 3 × 4 ⁻¹ = 0
(Ii) When x = 1 and y = 0 The second term on the right side is 4 ⁻¹ * x = 4 ⁻¹ * 1 = 1−4 ⁻¹ = 3 × 4 ⁻¹ . The third term on the right side is 4 ⁻¹ * y = 4 ⁻¹ * 0 = 4 ⁻¹ . The fourth term on the right side is x * y = 1 * 0 = 1 and d * (x * y) = 3 × 4 ⁻¹ * 1 = 1−3 × 4 ⁻¹ = 4 ⁻¹ . The fourth term on the right side is 3 × 4 ⁻¹ * x = 3 × 4 ⁻¹ * 1 = 1-3 × 4 ⁻¹ = 4 ⁻¹ , 4 ⁻¹ * y = 4 ⁻¹ * 0 = 4 ^−1. But the result is the same. Therefore,
f _AND (1, 0) = − 5 × 4 ⁻¹ + 3 × 4 ⁻¹ +4 ⁻¹ +4 ⁻¹ = 0
(Iii) When x = 0, y = 1 The second term on the right side is 4 ⁻¹ * x = 4 ⁻¹ * 0 = 4 ⁻¹ . The third term on the right side is 4 ⁻¹ * y = 4 ⁻¹ * 1 = 1−4 ⁻¹ = 3 × 4 ⁻¹ . The fourth term on the right side is x * y = 0 * 1 = 1-0 = 1 and d * (x * y) = 3 × 4 ⁻¹ * 1 = 1-3 × 4 ⁻¹ = 4 ⁻¹ . . The fourth term on the right side is 3 × 4 ⁻¹ * x = 3 × 4 ⁻¹ * 0 = 3 × 4 ⁻¹ , 3 × 4 ⁻¹ * y = 3 × 4 ⁻¹ * 1 = 1−3 × 4 Even if ^-1 = 4 ^-1 , the result is the same. Therefore,
f _AND (0,1) = − 5 × 4 ⁻¹ +4 ⁻¹ + 3 × 4 ⁻¹ +4 ⁻¹ = 0
(Iv) When x = 1, y = 1 The second term on the right side is 4 ⁻¹ * x = 4 ⁻¹ * 1 = 1-4 ⁻¹ = 3 × 4 ⁻¹ , and the third term on the right side is also 4 ⁻¹ * y = 4 ⁻¹ * 1 = 3 × 4 ⁻¹ . The fourth term on the right side is x * y = 1 * 1 = 1−1 = 0, and d * (x * y) = 3 × 4 ⁻¹ * 0 = 3 × 4 ⁻¹ . The fourth term on the right side is 3 × 4 ⁻¹ * x = 3 × 4 ⁻¹ * 1 = 1−3 × 4 ⁻¹ = 4 ⁻¹ , 4 ⁻¹ * y = 4 ⁻¹ * 1 = 1-4. ^The result is the same when ^-1 = 3 × 4 ^-1 . Therefore,
f _AND (1,1) = − 5 × 4 ⁻¹ + 3 × 4 ⁻¹ + 3 × 4 ⁻¹ + 3 × 4 ⁻¹ = 1

[OR gate]
Equation (1) is obtained by substituting the parameter values (a, b, c, d) = (− 3 × 4 ⁻¹ , 4 ⁻¹ , 4 ⁻¹ , 4 ⁻¹ ) in FIG. It is expressed as (3).
f _OR (x, y) = − 3 × 4 ⁻¹ +4 ⁻¹ * x + 4 ⁻¹ * y + 4 ⁻¹ * (x * y) (3)
(I) When x = 0, y = 0 The second term on the right side is 4 ⁻¹ * x = 4 ⁻¹ * 0 = 4 ⁻¹ , and the third term on the right side is also 4 ⁻¹ * y = 4 ^−1. * 0 = 4 ^-1 . The fourth term on the right side is x * y = 0 * 0 = 0 and d * (x * y) = 4 ⁻¹ * 0 = 4 ⁻¹ . The fourth term on the right side has the same result even when 4 ⁻¹ * x = 4 ⁻¹ * 0 = 4 ⁻¹ , 4 ⁻¹ * y = 4 ⁻¹ * 0 = 4 ⁻¹ . Therefore,
f _OR (0,0) = − 3 × 4 ⁻¹ +4 ⁻¹ +4 ⁻¹ +4 ⁻¹ = 0
(Ii) When x = 1 and y = 0 The second term on the right side is 4 ⁻¹ * x = 4 ⁻¹ * 1 = 1−4 ⁻¹ = 3 × 4 ⁻¹ . The third term on the right side is 4 ⁻¹ * y = 4 ⁻¹ * 0 = 4 ⁻¹ . The fourth term on the right side is x * y = 1 * 0 = 1 and d * (x * y) = 4 ⁻¹ * 1 = 1−4 ⁻¹ = 3 × 4 ⁻¹ . The fourth term on the right side is 4 ⁻¹ * x = 4 ⁻¹ * 1 = 3 × 4 ⁻¹ , 3 × 4 ⁻¹ * y = 3 × 4 ⁻¹ * 0 = 3 × 4 ^−1. The same. Therefore,
f _OR (1, 0) = − 3 × 4 ⁻¹ + 3 × 4 ⁻¹ +4 ⁻¹ + 3 × 4 ⁻¹ = 1
(Iii) When x = 0, y = 1 The second term on the right side is 4 ⁻¹ * x = 4 ⁻¹ * 0 = 4 ⁻¹ . The third term on the right side is 4 ⁻¹ * y = 4 ⁻¹ * 1 = 3 × 4 ⁻¹ . The fourth term on the right side is x * y = 0 * 1 = 1-0 = 1, d * (x * y) = 4 ⁻¹ * 1 = 1 ^{−1 −1} = 3 × 4 ⁻¹ . The 4th term on the right side is 4 ^-1 * x = 4 ^-1 * 0 = 4 ^-1 , 4 ^-1 * y = 4 ^-1 * 1 = 1 -4 ^-1 = 3 × 4 ^-1 The same. Therefore,
f _OR (0,1) = − 3 × 4 ⁻¹ +4 ⁻¹ + 3 × 4 ⁻¹ + 3 × 4 ⁻¹ = 1
(Iv) When x = 1 and y = 1 The second term on the right side is 4 ⁻¹ * x = 4 ⁻¹ * 1 = 1−4 ⁻¹ = 3 × 4 ⁻¹ . Similarly, the third term on the right side is 4 ⁻¹ * y = 4 ⁻¹ * 1 = 3 × 4 ⁻¹ . The fourth term on the right side is x * y = 1 * 1 = 0 and d * (x * y) = 4 ⁻¹ * 0 = 4 ⁻¹ . The fourth term on the right side is 4 ⁻¹ * x = 4 ⁻¹ * 1 = 3 × 4 ⁻¹ , 3 × 4 ⁻¹ * y = 3 × 4 ⁻¹ * 1 = 1−3 × 4 ⁻¹ = 4 Even at ^-1 , the result is the same. Therefore,
f _OR (1,1) = − 3 × 4 ⁻¹ + 3 × 4 ⁻¹ + 3 × 4 ⁻¹ +4 ⁻¹ = 1

[XOR gate]
(1) formula, 4 parameter values (c) (a, b, c, d) = (- 1,2 -1, 2 -1, 0) Substituting, as the following formula (4) Represented.
f _XOR (x, y) = − 1 + 2 ⁻¹ * x + 2 ⁻¹ * y + 0 * x * y (4)
(I) When x = 0, y = 0 The second term on the right side is 2 ⁻¹ * x = 2 ⁻¹ * 0 = 2 ⁻¹ , and the third term on the right side is also 2 ⁻¹ * y = 2 ^−1. * 0 = 2 ^-1 . The fourth term on the right side is x * y = 0 * 0 = 0 and d * (x * y) = 0 * 0 = 0. The fourth term on the right side has the same result even when 0 * x = 0 * 0 = 0 and 0 * y = 0 * 0 = 0. Therefore,
f _XOR (0,0) = − 1 + 2 ⁻¹ +2 ⁻¹ + 0 = 0
(Ii) When x = 1 and y = 0 The second term on the right side is 2 ⁻¹ * x = 2 ⁻¹ * 1 = 1−2 ⁻¹ = 2 ⁻¹ . The third term on the right side is 2 ⁻¹ * y = 2 ⁻¹ * 0 = 2 ⁻¹ . The fourth term on the right side is x * y = 1 * 0 = 1 and d * (x * y) = 0 * 1 = 1-0 = 1. The fourth term on the right side has the same result even if 0 * x = 0 * 1 = 1-0 = 1, 1 * y = 1 * 0 = 1. Therefore,
f _XOR (1, 0) = − 1 + 2 ⁻¹ +2 ⁻¹ + 1 = 1
(Iii) When x = 0 and y = 1 The second term on the right side is 2 ⁻¹ * x = 2 ⁻¹ * 0 = 2 ⁻¹ . The third term on the right side is 2 ⁻¹ * y = 2 ⁻¹ * 1 = 2 ⁻¹ . The fourth term on the right side is x * y = 0 * 1 = 1-0 = 1, and d * (x * y) = 0 * 1 = 1-0 = 1. The fourth term on the right side has the same result even when 0 * x = 0 * 0 = 0, 0 * y = 0 * 1 = 1-0 = 1. Therefore,
f _XOR (0, y) = − 1 + 2 ⁻¹ +2 ⁻¹ + 1 = 1
(Iv) When x = 1 and y = 1 The second term on the right side is 2 ⁻¹ * x = 2 ⁻¹ * 1 = 2 ⁻¹ . Similarly, the third term on the right side is 2 ^-1 * y = 2 ^-1 * 1 = 2 ^-1 . The fourth term on the right side is x * y = 1 * 1 = 1−1 = 0 and d * (x * y) = 0 * 0 = 0. The fourth term on the right side has the same result even when 0 * x = 0 * 1 = 1-0 = 1, 1 * y = 1 * 1 = 1-1 = 0. Therefore,
f _XOR (1,1) = − 1 + 2 ⁻¹ +2 ⁻¹ + 0 = 0

  As described above, the case of AND, OR, and XOR logic gates has been shown as an example. Similarly, any logic gate can be realized by adjusting the values of a, b, c, and d in equation (1). . According to the present invention, it is possible to execute the calculation while concealing the type and contents of the logic gate while the input / output is encrypted.

  It should be noted that some or all of the processing functions of each unit in the apparatus shown in FIG. 3 and the like can be configured by a computer program and the program can be executed using the computer to implement the present invention, or FIG. It goes without saying that the processing procedure shown by the above can be constituted by a computer program, and the program can be executed by the computer. In addition, a computer-readable recording medium such as an FD, MO, ROM, memory card, CD, or the like is stored in the computer. In addition, the program can be recorded and stored on a DVD, a removable disk, etc., and the program can be distributed through a network such as the Internet.

The conceptual diagram of the secret logic computer by this invention. The processing flowchart of one Example of this invention. The functional block diagram of the other Example of this invention. The figure which shows an example of the correspondence of a logic gate and a parameter value.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Secret logic calculation apparatus 21-24 Secret calculation means 25 Addition means

Claims (9)

An operation x * y of two numerical values x and y is defined as x * y = x when y = 0, and x * y = 1−x when y = 1,
The logic gates are _expressed as f _{a, b, c, d} (x, y) = a + b * x + c * y + d * (x * y)
Expressed in a quadratic function of (a, b, c, d are parameters),
Secret logic calculation that realizes an arbitrary logic gate by applying an encryption function E having additive homomorphism and calculating the function while keeping input / output values and calculation contents secret by a secret logic calculation device A method,
With ciphertexts E (a), E (b), E (c), E (d), E (x), E (y) of a, b, c, d, x, y as inputs,
E (b * x) is calculated from E (b) and E (x), E (c * y) is calculated from E (c) and E (y), and E (x) and E (y) are calculated. E (x * y) is calculated, E (d * (x * y)) is calculated from E (d) and E (x * y),
E (a) and E (b * x), E (c * y), E (d * (x * y)) are added together,
E (a + b * x + c * y + d * (x * y))
A secret logic calculation method characterized by:   2. The secret logic calculation method according to claim 1, wherein the parameters (a, b, c, d) are adjusted to predetermined values in advance. 3. The method according to claim 2, wherein an AND gate is realized with parameters (a, b, c, d) = (− 5 × 4 ⁻¹ , 4 ⁻¹ , 4 ⁻¹ , 3 × 4 ⁻¹ ). A secret logic calculation method characterized by: 3. The secret logic calculation method according to claim 2, wherein an OR gate is realized with parameters (a, b, c, d) = (− 3 × 4 ⁻¹ , 4 ⁻¹ , 4 ⁻¹ , 4 ⁻¹ ). A secret logic calculation method characterized by In confidential logical calculation method according to claim 2, wherein the parameters (a, b, c, d ) = (- 1,2 -1, 2 -1, 0) as the concealment logic, characterized in that to realize a XOR gate Method of calculation. As an operation of two numerical values x and y, when y = 0, it is defined as x * y = x, and when y = 1, x * y = 1−x,
The logic gates are _expressed as f _{a, b, c, d} (x, y) = a + b * x + c * y + d * (x * y)
Expressed in a quadratic function of (a, b, c, d are parameters),
A secret logic calculation device that realizes an arbitrary logic gate by applying an encryption function E having additive homomorphism and calculating the function while keeping input / output values and calculation contents secret,
input means for inputting ciphertexts E (a), E (b), E (c), E (d), E (x), E (y) of a, b, c, d, x, y;
First secret calculation means for calculating E (b * x) from E (b) and E (x);
A second secret calculation means for calculating E (c * y) from E (c) and E (y);
A third secret calculation means for calculating E (x * y) from E (x) and E (y);
E (d), fourth secret calculation means for calculating E (d * (x * y)) from E (x * y) obtained by the third secret calculation means;
E (a), E (b * x), E (c * y), E (d * (x, y)) of the calculation results of the first, second and fourth secret calculation means are added together , E (a + b * x + c * y + d * (x * y)) adding means,
A secret logic computer characterized by comprising:   7. The secret logic calculation apparatus according to claim 6, wherein the first, second, third and fourth secret calculation means are composed of the same secret calculation means.   A program for causing a computer to execute the secret logic calculation method according to any one of claims 1 to 5.   A recording medium storing a program for causing a computer to execute the secret logic calculation method according to claim 1.

Images