JP5724720B2 - Information processing method and apparatus, and computer system - Google Patents

Description

  The present technology relates to data concealment technology.

For example, consider a case where a monthly sales table for each product at each branch is shared by a server, and a person in charge of aggregation at the headquarters performs various aggregation processes. For example, as shown on the left in FIG. 1, the branch A has a sales table showing the monthly sales of the products A, B, and C, and the branch B also has the same month for the products A, B, and C. It has a sales table showing sales for each. As shown on the right of FIG. 1, the headquarters has a total sales value (for example, X) for each of the products A, B, and C and a total sales value for each month (for example, for all the branches). Y) is calculated. In some cases, the total sales value for a specific product in a specific month (for example, the total sales amount of product A in January Σ _i m _Ai1 (i is a branch parameter)) or an aggregate value such as total sales ( For example, Z) may be calculated.

  In such a case, there is a demand that each branch does not want to notify other sales offices of detailed sales, and that the headquarters should be able to obtain a total value even if it cannot grasp detailed information. However, there is no technology that can sufficiently meet such demands.

  For example, in order to conceal the data, it is conceivable that the data is encrypted and stored in the server. However, when a third party aggregates this data, it must be decrypted eventually, and as a result, the third party sees the data itself.

  In addition, there is a technique that enables cross tabulation with a certain degree of accuracy statistically while concealing the original data by adding noise (that is, a random number) to the original data. In such a totaling system, the specified parameters (specifically, maintenance probabilities) are given to each user to randomize the values, and the totals are calculated. It is a statistical estimation. However, this method has the following problems. That is, if the noise is small with respect to the original data, the approximate value of the original data is known. The aggregate value is an approximate value. Furthermore, another process called a statistical estimation process is performed after the aggregation process on the cloud side. In particular, it may be difficult to add unique functions to other companies' services on the cloud, which may be problematic in practice.

  There is also a technique called homomorphic encryption. If this technique is used, it is possible to calculate the value before encryption while still being encrypted, but until now it has been used for special systems such as a viewing history collection system and an electronic voting system.

JP 2010-108488 A JP 2000-236305 A JP 2010-128865 A

Paillier, P., Public-Key Cryptosystems Based on Composite Degree Residuosity Classes, Proc. Eurocrypt 99, pp.223-238, 1999.

  As described above, in the conventional technology described above, the data in the database cannot be properly concealed in a form suitable for use.

  Accordingly, an object of the present technology is to provide a technology for appropriately concealing data in a database in a form suitable for use, as one aspect.

  An information processing method according to the present technology includes (A) an original matrix stored in a first data storage unit and a mask matrix stored in a second data storage unit and having the same shape as the original matrix. A first process for generating a masked matrix by adding and storing the masked matrix in the third data storage unit, and (B) data on the masked matrix stored in the third data storage unit are transmitted to a plurality of users. And a second process of transmitting the data from the computer to the second computer for storing the data. The mask matrix is generated so as to be a zero matrix when the mask matrices used by a plurality of users are added.

  Data in the database can be properly concealed in a form suitable for use.

FIG. 1 is a diagram for explaining a problem of the prior art. FIG. 2 is a schematic diagram of the entire system according to the embodiment of the present technology. FIG. 3 is a functional block diagram of the mask distribution server. FIG. 4 is a functional block diagram of the user apparatus. FIG. 5 is a functional block diagram of the aggregation server. FIG. 6 is a functional block diagram of the administrator device. FIG. 7 is a diagram showing a processing flow in the present embodiment. FIG. 8 is a diagram showing a processing flow in the present embodiment. FIG. 9 is a functional block diagram of the computer.

First, an outline of an embodiment of the present technology will be described. For each user i, for example, when an original matrix OM _i such as a monthly sales table for each product exists, the mask matrix MM _i is added to the original matrix OM _i . This mask matrix MM _i is generated so as to become a zero matrix when added for all users. However, it is assumed that none of MM _i is a zero matrix.

  Specifically, for the user 1, the following matrix addition operation is performed. Other users perform the same addition operation.

For example, a to d representing element values of the original matrix OM _i represent the product name, the first subscript represents the user number, and the second subscript represents the month number. For example, the first subscript of m representing the element value of the mask matrix MM _i represents the product name, the next subscript represents the user number, and the third subscript represents the month number.

If the masked matrix MKM _i is generated by such an addition operation, the original matrix OM _i cannot be restored, so that basic concealment is achieved.

Then, when the sum of the masked matrix MKM _i is calculated, the sum of the original matrix OM _i is obtained. This is expressed as follows.

Σ _i MKM _i
= Σ _i (OM _i + MM _i )
= Σ _i OM _i + Σ _i MM _i
= Σ _i OM _i +0
= Σ _i OM _i

Since the individual original matrix OM _i cannot be restored from the sum Σ _i OM _i of the original matrix, the basic concealment is made also in this respect.

If such a sum Σ _i OM _i of the original matrix is obtained, the total sales value for each of the products A, B, and C, the total sales value for each product for each month, and the specific month for all users It is also possible to calculate a total value such as the total sales value and total sales for a specific product.

  However, with only simple masking as described above, if the masked matrix is wiretapped or collected, the sum of the original matrix can be obtained as described above. Even if eavesdropping is not performed, for example, when masked matrices are collected in, for example, a cloud system and the sum is calculated by the aggregation server of the cloud system, the sum of the original matrix is exposed to the cloud system when the calculation is completed.

  Therefore, in this embodiment, homomorphic encryption is introduced. Each user acquires the administrator's public key in the homomorphic encryption, and encrypts the masked matrix. In a cloud system, etc., the received masked matrix is received from each user and, for example, in response to a request from the administrator, the encrypted masked matrix is obtained so that the sum of the masked matrices is obtained. Performs operations in homomorphic encryption. There are various types of homomorphic ciphers. For example, when ElGamal cipher or Pillar cipher is adopted, in order to obtain a value obtained by encrypting the addition result in plain text, the encrypted value is multiplied. Become. In this way, an operation to be performed to realize addition in plain text is performed on the encrypted value.

  In this way, the original matrix and the sum of the original matrix can be prevented from being exposed not only in the communication path but also in the aggregation server such as a cloud system.

  On the other hand, an administrator who has a secret key can conceal each original matrix by a mask matrix, but can obtain the sum of the original matrices.

  Hereinafter, a computer system for carrying out such processing will be described with reference to FIGS.

  FIG. 2 shows an example of a computer system according to this embodiment. For example, a computer network 9 such as the Internet includes a plurality of user devices 1 to 3 (the number is not limited to 3 and may be an arbitrary integer), an administrator device 5, and a totaling server 7 arranged in a cloud system or the like. Are connected to a mask distribution server 6 for distributing the mask matrix MM.

The user devices 1 to 3 are computers at each branch, for example, and are connected to other computers at the branch, for example. The manager device 5 is, for example, a computer at the headquarters, and is connected to, for example, another computer at the headquarters. The mask distribution server 6 is managed and operated independently of, for example, a cloud system, an administrator, and a user, and each mask matrix is set to be a zero matrix by adding the mask matrixes MM _i of each user as described above. MM _i is generated and distributed to each user device. The aggregation server 7 accumulates data received from each user device, performs predetermined aggregation processing in response to a request from the administrator device 5, for example, and transmits the aggregation result to the administrator device 5.

  FIG. 3 shows a functional block diagram of mask distribution server 6 according to the present embodiment. The mask distribution server 6 includes a mask generation unit 61, a mask distribution unit 62, and a distribution destination data storage unit 63. The mask distribution server 6 receives the distribution destination data of the mask matrix MM from an administrator or the like in advance and stores it in the distribution destination data storage unit 63. The mask generation unit 61 generates a mask matrix MM having the above-described properties for each user apparatus, for example, periodically or at an arbitrary timing, and outputs the mask matrix MM to the mask distribution unit 62. The mask distribution unit 62 transmits the generated mask matrix MM to each user device according to the distribution destination data stored in the distribution destination data storage unit 63.

  FIG. 4 shows a functional block diagram of a user apparatus (for example, user apparatus 1) according to the present embodiment. The user apparatus 1 includes an original mat risk acquisition unit 101, an original matrix storage unit 102, a mask reception unit 103, a mask storage unit 104, a mask processing unit 105, a masked matrix storage unit 108, and an encryption processing unit. 109, a public key storage unit 110, an encrypted data storage unit 111, and a transmission unit 112.

  The original matrix acquisition unit 101 acquires original matrix data from another computer connected to the user apparatus 1 and stores the data in the original matrix storage unit 102. In some cases, the original matrix acquisition unit 101 generates an original matrix. Further, the mask receiving unit 103 receives the mask matrix MM from the mask distribution server 6 and stores it in the mask storage unit 104.

  The mask processing unit 105 generates a masked matrix MKM by adding the original matrix OM stored in the original matrix storage unit 102 and the mask matrix MM stored in the mask storage unit 104, and generates a masked matrix storage unit It stores in 108.

  The encryption processing unit 109 encrypts the masking matrix MKM with the public key for the administrator device 5 stored in the public key storage unit 110 in accordance with a predetermined homomorphic encryption method. Generated matrix data E (MKM) is stored in the encrypted data storage unit 111. The transmission unit 112 transmits the encrypted matrix data E (MKM) stored in the encrypted data storage unit 111 to the aggregation server 7 in the cloud system.

  FIG. 5 shows a functional block diagram of the aggregation server 7 according to the present embodiment. The aggregation server 7 includes a data receiving unit 71, a database (DB) 72, an aggregation request processing unit 73, and a data storage unit 74. The aggregation request processing unit 73 includes a calculation unit 731 that performs a calculation for realizing addition of plaintext while being encrypted in the adopted homomorphic encryption method. For example, in order to obtain a value obtained by encrypting the addition result of plaintext, the encrypted data is multiplied.

  When receiving the encrypted matrix data E (MKM) from the user devices 1 to 3, the data receiving unit 71 stores the encrypted matrix data E (MKM) in the DB 72. The DB 72 is a database for the user devices 1 to 3 and stores data to be subjected to aggregation processing based on the aggregation request from the administrator device 5. That is, it is managed separately for each group of users. In addition, when the aggregation request processing unit 73 receives the aggregation request from the administrator device 5, the aggregation request processing unit 73 reads the encrypted matrix data E (MKM) from each user device from the DB 72. Then, the calculation unit 731 of the aggregation request processing unit 73 performs a predetermined calculation on the encrypted matrix data E (MKM) as described above. Data in the middle of processing and processing results are stored in the data storage unit 74.

As described above, by performing such processing, encrypted data E (Σ _i OM _i ) of the sum Σ _i OM _i of the original matrix can be obtained.

The aggregation request processing unit 73 transmits the encrypted data E (Σ _i OM _i ) of the sum of the original matrix to the manager device 5.

  FIG. 6 shows a functional block diagram of the administrator device 5 according to the present embodiment. The administrator device 5 includes a totaling request unit 51, a received data storage unit 52, a decryption processing unit 53, a secret key storage unit 54, a decrypted data storage unit 55, and an output processing unit 57.

When the aggregation request unit 51 is instructed to transmit the aggregation request from, for example, another computer connected to the administrator device 5, the aggregation request unit 51 transmits the aggregation request to the aggregation server 7. Encrypted data E (Σ _i OM _i ) is received and stored in the received data storage unit 52.

The decryption processing unit 53 decrypts the encrypted data E (Σ _i OM _i ) of the sum of the original matrix using the secret key stored in the secret key storage unit 54, and stores it in the decrypted data storage unit 55. Store.

The output processing unit 57 outputs the sum Σ _i OM _i of the original matrix stored in the decoded data storage unit 55 as it is to, for example, another computer connected to the administrator device 5. Note that the aggregation process may be further performed from the sum Σ _i OM _i of the original matrix. For example, the total sales value for all users and all products in January may be calculated, or the total sales value for all users and products A from January to June may be calculated.

Next, a processing flow in the system shown in FIG. 2 will be described with reference to FIGS. First, the mask generation unit 61 of the mask distribution server 6 generates a mask matrix MM _i so as to satisfy Σ _i MM _i = 0 periodically or at an arbitrary timing, and outputs it to the mask distribution unit 62 (FIG. 7: Step S1). For example, the generation number N is specified from the distribution destination data stored in the distribution destination data storage unit 63, and each element value of the (N-1) mask matrixes MM is generated with a random number. Then, to generate the (N-1) its code by inverting the by calculating the sum of the number of the mask matrix MM, N-th mask matrix MM _N. In addition, N may be divided into a plurality of groups, and the mask matrix MM may be generated so that the sum of the mask matrices MM in the group becomes 0 by the method described above in each group. Further, it is assumed that the shape (number of dimensions and size of each dimension) of the mask matrix MM is given in advance.

Mask delivery portion 62 of the mask distribution server 6 distributes the address of the user device the mask matrix MM _i received from the mask generating unit 61, is stored in the destination data storage unit 63 (step S3). Note that communication between the mask distribution server 6 and each user device is concealed by encryption such as a public key cryptosystem.

For example, the mask receiving unit 103 of the user device 1 receives the mask matrix MM ₁ from the mask distribution server 6 and stores it in the mask storage unit 104 (step S5). Thereafter, the following processing is performed at an arbitrary timing or periodically.

For example, when the original matrix acquisition unit 101 acquires the original matrix OM ₁ to be transmitted to the aggregation server 7 and stores it in the original matrix storage unit 102, the mask processing unit 105 stores the mask matrix stored in the mask storage unit 104. The masked matrix MKM ₁ is generated by adding MM ₁ and the original matrix OM ₁ stored in the original matrix storage unit 102 and stored in the masked matrix storage unit 108 (step S 7).

After that, the encryption processing unit 109 encrypts the masking matrix MKM ₁ by the homomorphic encryption method with the administrator's public key stored in the public key storage unit 110, and stores it in the encrypted data storage unit 111. Store (step S11). Then, the transmission unit 112 transmits the encrypted masked matrix E (MKM ₁ ) stored in the encrypted data storage unit 111 to the aggregation server 7 (step S13).

On the other hand, the data receiving unit 71 of the aggregation server 7 receives the encrypted masked matrix E (MKM _i ) from each user device and stores it in the DB 72 (step S15). If the encrypted masked matrix E (MKM _i ) is received from all user devices to which the mask matrix MM _i is distributed, the following processing can be performed.

Next, the totaling request unit 51 of the manager device 5 transmits a totaling request for the sum of the masked matrix to the totaling server 7 (FIG. 8: Step S21). On the other hand, the aggregation request processing unit 73 of the aggregation server 7 receives a totalization request for the sum of masked matrices from the administrator device 5 (step S23). Then, the aggregation request processing unit 73 reads the encrypted masked matrix E (MKM _i ) from the DB 72, and the calculation unit 731 performs encryption so that the sum of the encrypted masked matrices can be obtained. Then, a predetermined calculation is performed, and the calculation result (E (Σ _i MKM _i )) is stored in the data storage unit 74 (step S25). However, E (Σ _i MKM _i ) = E (Σ _i OM _i )

Then, the aggregation request processing unit 73 transmits the calculation result (E (Σ _i MKM _i )) to the management device 5 that is the request transmission source (step S27). On the other hand, the aggregation request unit 51 of the management device 5 receives the calculation result (E (Σ _i MKM _i )) from the aggregation server 7 and stores it in the received data storage unit 52 (step S29). The decryption processing unit 53 decrypts the calculation result using the secret key stored in the secret key storage unit 54 and stores the result in the decrypted data storage unit 55 (step S31). As a result, as described above, the sum Σ _i OM _i of the original matrix is obtained.

  Thereafter, the output processing unit 57 performs various tabulation operations in response to a request from the administrator, and outputs the result to another computer connected to the administrator device 5 (step S33).

For example, in the example of FIG. 1, as shown on the right side of FIG. 1, for all branches, the total sales value (for example, X) for each of the products A, B, and C, and the monthly sales total value for all products A total value such as (for example, Y) is calculated. In some cases, the total sales value for a specific product in a specific month (for example, the total sales amount of product A in January Σ _i m _Ai1 (i is a branch parameter)) or an aggregate value such as total sales ( For example, Z) may be calculated. The sum Σ _i OM _i of the original matrix may be output as it is.

By performing the processing as described above, the administrator cannot refer to the individual data of each user, but the total of the original matrix is kept confidential to the aggregation server 7 for the data of the entire user. The administrator can obtain Σ _i OM _i . When the sum Σ _i OM _i of the original matrix is obtained, it is possible to perform further aggregation processing using the sum.

  Although the embodiment of the present technology has been described above, the present technology is not limited to this. For example, if the secrecy of the aggregation server 7 is ensured by another method, another encryption method may be adopted between devices without using the homomorphic encryption method.

  In the above example, the aggregation server 7 performs the calculation for the aggregation. However, the administrator device 5 may perform the calculation itself by simply storing data.

  In addition, as long as the processing result does not change, the processing order may be changed or executed in parallel. Furthermore, the functional block diagram described above is merely an example, and may not necessarily match the actual program module configuration.

  Furthermore, each device may be implemented by a single computer or a plurality of computers. Further, the mask matrix may be separately distributed by mail or other methods without providing the mask distribution server 6.

  Note that the above-described user device, administrator device 5, mask distribution server 6 and aggregation server 7 are computer devices, and as shown in FIG. 9, a memory 2501, a CPU 2503, a hard disk drive (HDD) 2505, and the like. A display control unit 2507 connected to the display device 2509, a drive device 2513 for a removable disk 2511, an input device 2515, and a communication control unit 2517 for connecting to a network are connected by a bus 2519. An operating system (OS) and an application program for executing the processing in this embodiment are stored in the HDD 2505, and are read from the HDD 2505 to the memory 2501 when executed by the CPU 2503. The CPU 2503 controls the display control unit 2507, the communication control unit 2517, and the drive device 2513 according to the processing content of the application program, and performs a predetermined operation. Further, data in the middle of processing is mainly stored in the memory 2501, but may be stored in the HDD 2505. In an embodiment of the present technology, an application program for performing the above-described processing is stored in a computer-readable removable disk 2511 and distributed, and installed from the drive device 2513 to the HDD 2505. In some cases, the HDD 2505 may be installed via a network such as the Internet and the communication control unit 2517. Such a computer apparatus realizes various functions as described above by organically cooperating hardware such as the CPU 2503 and the memory 2501 described above and programs such as the OS and application programs. .

  The above-described embodiment can be summarized as follows.

  The information processing method according to the present embodiment includes (A) an original matrix stored in the first data storage unit, and a mask matrix stored in the second data storage unit and having the same shape as the original matrix. To generate a masked matrix and store it in the third data storage unit, and (B) a plurality of data about the masked matrix stored in the third data storage unit. A second step of transmitting data from the user's computer to a second computer that stores the data. The mask matrix is generated to be a zero matrix when the mask matrices used by a plurality of users are added.

  By doing so, the original matrix of each user is concealed, but if the masked matrices of all users are added, the sum of the original matrices can be obtained. Then, various aggregation processing results can be obtained.

  In the second step described above, the masking matrix is encrypted with a public key of a specific user in the homomorphic encryption method, and the encrypted masking matrix is transmitted to the second computer. It may be included. By adopting the homomorphic encryption method in this way, it is possible to perform an operation to obtain the sum of the masked matrix while being encrypted by the second computer.

  Further, in this information processing method, (C) the second computer can obtain the total sum of the masked matrices encrypted with respect to the encrypted masked matrices from the computers of a plurality of users. A third step of performing a predetermined operation while being encrypted by the homomorphic encryption method, and storing the operation result in the fourth data storage unit; and (D) the second computer has the fourth data storage unit And a fourth step of transmitting the calculation result stored in the computer to a computer of a specific user (for example, an administrator). Since there are various types of homomorphic encryption, an operation for obtaining a value obtained by encrypting the plaintext addition result is performed.

  In this information processing method, (E) a specific user's computer decrypts the calculation result from the second computer with the specific user's private key to generate a sum of masked matrices, and The fifth data storage unit may further include a fifth step.

  It is possible to create a program for causing a computer to carry out the processing described above, such as a flexible disk, an optical disk such as a CD-ROM, a magneto-optical disk, and a semiconductor memory (for example, ROM). Or a computer-readable storage medium such as a hard disk or a storage device. Note that data being processed is temporarily stored in a storage device such as a RAM.

  The following supplementary notes are further disclosed with respect to the embodiments including the above examples.

(Appendix 1)
An information processing method executed by a computer,
A masked matrix is generated by adding the original matrix stored in the first data storage unit and the mask matrix stored in the second data storage unit and having the same shape as the original matrix; A first process stored in the data storage unit 3;
A second process of transmitting data about the masked matrix stored in the third data storage unit to a second computer that accumulates data from a plurality of users'computers;
Including
The information processing method, wherein the mask matrix is generated to be a zero matrix by adding the mask matrices used by the plurality of users.

(Appendix 2)
The second process includes
The information processing method according to claim 1, further comprising: encrypting the masked matrix with a public key of a specific user in a homomorphic encryption method, and transmitting the encrypted masked matrix to the second computer.

(Appendix 3)
The second computer encrypts with the homomorphic encryption method so that the sum of the masked matrices encrypted with respect to the masked matrices encrypted from the plurality of users' computers is obtained. A third process for performing a predetermined calculation while storing the result and storing the calculation result in a fourth data storage unit;
A fourth process in which the second computer transmits a calculation result stored in the fourth data storage unit to the computer of the specific user;
The information processing method according to appendix 2, further comprising:

(Appendix 4)
The computer of the specific user decrypts the calculation result from the second computer with the secret key of the specific user, thereby generating a sum of the masking matrix and storing it in a fifth data storage unit. The information processing method according to appendix 3, further including a fifth process of storing.

(Appendix 5)
A masked matrix is generated by adding the original matrix stored in the first data storage unit and the mask matrix stored in the second data storage unit and having the same shape as the original matrix; A mask processing unit stored in the data storage unit 3;
An output unit that transmits data about the masked matrix stored in the third data storage unit to a second information processing device that accumulates data from information processing devices of a plurality of users;
Have
The information processing apparatus, wherein the mask matrix is generated to be a zero matrix when the mask matrices used by the plurality of users are added.

(Appendix 6)
The output unit is
Appendix 5 including an encryption processing unit that encrypts the masked matrix with a public key of a specific user in the homomorphic encryption method, and transmits the encrypted masked matrix to the second information processing apparatus. Information processing device.

(Appendix 7)
The information processing apparatus according to appendix 6,
The second information processing apparatus;
Have
The second information processing apparatus is
The encrypted masked matrix from the information processing apparatuses of the plurality of users is encrypted with the homomorphic encryption method so as to obtain an encrypted sum of the masked matrix. Performing the operation, storing the operation result in the fourth data storage unit, and transmitting the operation result stored in the fourth data storage unit to the information processing apparatus of the specific user.
Computer system.

(Appendix 8)
The information processing apparatus of the specific user is further included,
The information processing apparatus of the specific user is
The computer according to appendix 7, wherein the calculation result from the second information processing device is decrypted with the secret key of the specific user to generate a sum of the masked matrixes and store the sum in the fifth data storage unit system.

1-3 User device 5 Administrator device 6 Mask distribution server 7 Total server 101 Original matrix acquisition unit 102 Original matrix storage unit 103 Mask reception unit 104 Mask storage unit 105 Mask processing unit 108 Masked matrix storage unit 109 Encryption processing unit 110 Public key storage unit 111 Encrypted data storage unit 112 Transmission unit 51 Total request unit 52 Received data storage unit 53 Decryption processing unit 54 Private key storage unit 55 Decrypted data storage unit 57 Output processing unit 61 Mask generation unit 62 Mask distribution unit 63 Distribution destination data storage unit 71 Data reception unit 72 DB
73 Total Request Processing Unit 74 Data Storage Unit

Claims (4)

An information processing method executed by each computer of a plurality of users and a second computer that accumulates data from each computer ,
Each of the computers adds a mask matrix having an original matrix stored in the first data storage unit and a mask matrix stored in the second data storage unit and having the same shape as the original matrix. A first process of generating and storing in a third data storage unit;
Wherein each computer, the mask-matrix stored in the third data storage unit, and encrypted with the public key of the specific person in the homomorphic encryption method, the mask-matrix encrypted, the first A second process for transmitting to the second computer;
The second computer is encrypted with the homomorphic encryption method so that the sum of the masked matrices encrypted with respect to the masked matrix encrypted from each computer is obtained. A third process for performing a predetermined calculation and storing the calculation result in a fourth data storage unit;
A fourth process in which the second computer transmits a calculation result stored in the fourth data storage unit to the computer of the specific person;
Including
An information processing method wherein a mask matrix, to the said mask matrix said plurality of users used to focus calculated, characterized in that it is generated as a zero matrix. The information processing method is further executed by a computer of the specific person,
The specific person computers, by decoding the operation result from said second computer with the private key of the specific person, to generate a sum of the mask-matrix, the data storage unit of the fifth the fifth information processing method according to claim 1, wherein the process further comprises the storing. Each information processing device of a plurality of users, and a second information processing device for storing data from each information processing device,
Each of the information processing devices masks by adding the original matrix stored in the first data storage unit and the mask matrix stored in the second data storage unit and having the same shape as the original matrix. A mask processing unit that generates a quantization matrix and stores it in a third data storage unit;
The third said masking matrix is stored in the data storage unit, and encrypted with the public key of the specific person in the homomorphic encryption method, the mask-matrix encrypted, the second information processing apparatus An output section to send to,
Have
In the homomorphic encryption method, the second information processing apparatus obtains a total sum of the masked matrices encrypted with respect to the encrypted masked matrix from each information processing apparatus. Predetermined calculation is performed with encryption, the calculation result is stored in the fourth data storage unit, and the calculation result stored in the fourth data storage unit is transmitted to the information processing apparatus of the specific person And
Computer system the mask matrix, to the said mask matrix said plurality of users used to focus calculated, characterized in that it is generated as a zero matrix. The information processing apparatus of the specific person is further included,
The information processing apparatus of the specific person is
The calculation result from the second information processing device is decrypted with the secret key of the specific person , thereby generating the sum of the masked matrix and storing it in the fifth data storage unit
The computer system according to claim 3 .

Images