JP6474741B2 - Confidential decision tree calculation system, apparatus, method and program - Google Patents

Description

  The present invention relates to a technique for returning an analysis result based on concealed data while keeping the data concealed.

  In recent years, data mining and estimation have been performed in which knowledge is obtained from a large number of purchase histories and a product B is recommended if an individual purchases the product A. As one method of such estimation, there is a method using a decision tree. Taking a binary tree as an example, a decision tree is a tree that is determined by a large number of nodes and their edges, a node at level 0 called a root node, a node called a leaf node, and no nodes below it. And intermediate nodes that are other nodes. In addition to the leaf node, a conditional expression that determines whether to move to the left or right in the next hierarchy is defined, and a recommended value is defined for the leaf node.

  To obtain a recommended value for certain data using a decision tree, check whether the data satisfies the conditional expression in order from the root node of the tree, transition to the right if satisfied, otherwise left, and finally arrived Get the recommended value corresponding to the leaf.

  When a company creates a decision tree for some kind of analysis, it is difficult for the company to make public because it is the knowledge of the company.

  By the way, in recent years, there has been a widespread movement of utilizing personal data such as personal data and medical data. These data are highly sensitive and it is desirable to perform processing while keeping the data secret.

  There are two users, a user device U and a server device S. The user device U has its own data, and the server device S has a decision tree generated from knowledge obtained through its own service so far.

  In such a case, it is considered that an estimation result is obtained by using data of the user apparatus U as an input and using a decision tree of the server apparatus S.

  So far, the calculation of a decision tree requires both a decision tree and an input, so the user device S must either pass its data to the server or pass the server's decision tree to the user. It was.

  However, in the former case, the user's data is known to the server, and in the latter case, the decision tree of the server may be passed to the user and the knowledge on the server side may be leaked.

  An object of the present invention is to provide a secret decision tree calculation system, device, method, and program for returning a calculated value to a user while keeping the data of the user device and the decision tree of the server device secret from each other.

  A secret decision tree calculation system according to an aspect of the present invention generates a plurality of shares by secretly sharing data X, and transmits the generated plurality of shares from the 0th server apparatus to the n-1th server apparatus And a plurality of shares received by obtaining a disturbed decision tree by disturbing a predetermined decision tree by secret cooperative calculation according to a shuffle bit with secret sharing in which the 0th server device and the (n-1) th server device are unknown 0th server that obtains n shares of values corresponding to data X in a predetermined decision tree by secret cooperative calculation using the decision tree after disturbance and shuffle bits with secret sharing, and transmits them to the user apparatus And the user apparatus determines a predetermined decision using at least k of the received n shares, where k is a predetermined integer less than or equal to n. Restore the value corresponding to data X in the tree.

  The secret decision tree calculation device according to one aspect of the present invention is the 0th server device to the (n-1) th server device of the secret decision tree calculation system.

  The calculated value can be returned to the user while keeping the user device data and the server device decision tree secret.

The block diagram for demonstrating the example of a secrecy decision tree calculation apparatus. The flowchart for demonstrating the example of a secret decision tree calculation method. The figure which shows the example of 1 bit comparison protocol CompBit (x, y). The figure which shows the example of equal sign determination protocol CompInt (X, Y, c). The figure which shows the example of PlefixOR calculation protocol PlefixOR (X). The figure which shows the example of an Off-line calculation protocol. The figure which shows the example of an on-line calculation protocol.

  First, the matter which becomes the basis of this invention is demonstrated.

[notation]
x ← B indicates that if B is a set, it selects an element uniformly from B and assigns it to x. If B is an algorithm, it indicates that B's output is assigned to x. If B is a probability density function, For instance, it means sampling instance x according to its probability density function. In addition, the binary representation of a certain number X _i is x _{i, 0} ... X _{i, M−1} . That is, X _i = Σ _{j <M} 2 ^j x _{i, j} . A predicate is a function whose output is {0,1}, and [[x> _? Y]] is a predicate that returns 1 if x> y holds and 0 otherwise.

[Decision tree]
The decision tree is a tree used for an algorithm that finally determines a value (for example, an estimated value) corresponding to input data by conditional branching of the input data.

A decision tree is defined as a set of (h, M, m, R, L, {G _i } _{i <mM} , {G _i } _{mM ≦ i <m} ). h is the (deepest) height, M is the number of leaf nodes, and m is the total number of nodes. Assume that each node is assigned a number from 0 to m-1, and a leaf node is assigned a number from mm to m-1. R, L: Z _m → Z _m is a function that outputs the right and left nodes of the input node. That is, R (i) is a child node on the right side of node i, and L (i) is a child node on the left side of node i. G _i (i = 0,..., MM−1) is a predicate corresponding to the node i. The predicates for each node are only comparison and integration judgment. For example, G _i has the form < _? B, and has a conditional expression < _? And a condition value b. Simply when said condition value G _i means that the condition value b predicate Gi. G _i (i = mM,..., M−1) corresponding to the leaf node i is a value (for example, a recommended value) corresponding to the leaf node i.

  Here, a complete binary tree and a fixed order decision tree are assumed as decision trees.

A complete binary tree is a binary tree in which all leaf nodes have the same height. Thus, a binary tree is assumed in which the heights of the leaf nodes of all the complete binary decision trees are the same. At this time, n = Σ _{k = 0} ^h−1 2 ^k and m = 2 ^h−1 .

A decision tree having a fixed order is a decision tree in which data referred to by the depth is constant. That is, regardless of which node is transitioned, X ₁ is referenced at depth ₁ and X ₂ is referenced at depth 2.

[Secret sharing]
Secret sharing has a certain number (k, n) and is a set of the following two algorithms Share and Rec.

Share: Secret a is input, and shares [a] ₀ , ..., [a] _n-1 are output.

Rec: Share [a] _{i_0} , ..., [a] i_K _-1 is input and secret s is output. Here, K ≧ k, j is an integer, and i_j means i _j .

In addition, as homomorphism, operation (-) with b (-) [a] _i = [ba] _i , operation with [a] _i (+) [b] _i = [a + b] _i (+) Shall exist. These operations (-) (+) can be realized by a known method.

Here, for example, space secrets and Z _2.

[Multiplication protocol]
The multiplication protocol Mult is a protocol for generating a share [xy] _i of multiplication results for each server device S _{i by using} the secret-distributed values [x] _i and [y] _i of each server device S _i as inputs. . For example, the protocol described in Reference 1 can be used as the multiplication protocol Mult.

[Reference 1] Ivan Damgard and Jesper Buus Nielsen, "Scalable and unconditionally secure multiparty computation", In CRYPTO, pp.572-590, 2007.
[Comparison, equality judgment protocol]
It is possible to realize a protocol that performs comparison and equality judgment by combining bit operations.

FIG. 5 shows a specific example of the M-bit comparison and equality determination protocol CompInt (X, Y, c). This equality determination protocol CompInt (X, Y, c) outputs [[X < _? Y]] if the selection bit c is 0, and [[X = _? Y]] if it is 1.

  A specific example of the 1-bit comparison protocol CompBit (x, y) used in the equality determination protocol CompInt (X, Y, c) is shown in FIG.

  Furthermore, a specific example of the PlefixOR calculation protocol PlefixOR (X) used in the equality determination protocol CompInt (X, Y, c) is shown in FIG. The PlefixOR calculation protocol PlefixOR (X) outputs a bit string that is all set to 1 after the bit that becomes 1 at the most significant bit when the input X is expressed in bits.

[Embodiment]
Hereinafter, an embodiment of a secret decision tree calculation system, apparatus, and method will be described with reference to the drawings.

As shown in FIG. 1, the secret decision tree calculation system includes, for example, a user apparatus U and a server apparatus group that is a secret decision tree calculation apparatus. The server group is 0th server device S ₀ is e.g. configured from the n-1 server device S _n-1. As i = 0,..., n−1, the “server device S _i ” in the above-described matter that is the basis of the present invention corresponds to the “i-th server device S _i ”. Also in the following description, the “i-th server device S _i ” may be abbreviated as “server device S _i ”.

  In this embodiment, the decision tree is calculated while the data of the user device U is kept secret, and the recommendation result is returned to the user device U.

  Each device of the secret decision tree calculation system performs the process of each step in FIG. 2 to realize the secret decision tree calculation method. The general flow in this embodiment is as follows. First, “Off-line phase” processing is performed, and then “On-line” processing is performed. When the “Off-line phase” process is performed in advance, the “Off-line phase” process may not be performed prior to the “On-line” process.

"Off-line phase"
Step A1: The server apparatus S _i selects the condition value G _i (i = 0,..., MM-1) and the value G _i (i = mM,. _i ∈ {0,1} is secretly shared.

Step A2: The server apparatus S _i generates a random number of shuffle bits r _i ← {0,1} for the node i other than the leaf so that it does not know itself.

Step A3: The server apparatus S _i shuffles the decision tree according to the shuffle bit r _i .

"On-line phase"
Step B1: the user device U to secret sharing its data to S _i. At this time, the data is divided into bits and then secret sharing is performed, or the data is distributed without being divided into bits and then decomposed into bits on the server side.

Step B2: the server device S _i calculates the conditions using a variance value, and variance value of the shuffle bit of the condition value of the root node of its own which is populated with the values and Off-line phase, which is secret sharing, to restore. For example, when the restored value is 0, it transitions to the left, and when it is 1, it transitions to the right. Thereafter, the same calculation is performed until the leaf node is reached.

Step B3: sending the server S _i is a value corresponding to a leaf node has been reached to the user device U (e.g., recommended value) share of the user equipment U.

  Step B4: The user apparatus U restores the share and obtains a value corresponding to the data.

The user data is X = (X ₀ ,..., X _h-1 ), the decision tree is completely bisected and fixed in order, and at depth i, comparison or equality judgment is performed with reference to c _i To do.

If a node i in the middle of the decision tree are thinking tree and the root node corresponds to the node j of the tree j ^- (j superscript -) and is a level above one of the i, i When considering a tree rooted at a node m that has transitioned in a different direction, the transition from m to j is the same as the transition from i to j.

  Hereinafter, the process of each step of the “Off-line phase” will be described. An example of an off-line calculation protocol for realizing the processing of each step is shown in FIG.

<Step A1>
The 0th server device S _i to the (n-1) th server device S _n-1 have condition values G _j (j = 0,..., MM−1) and values G _j (j = mM,. , m−1), and secretly distribute selected bits c _j ε {0, 1} for determining whether they are comparisons or equal signs to obtain [G _j ], [c _j ] (step A1).

  This processing corresponds to “1:” of the off-line calculation protocol in FIG.

<Step A2>
The 0th server device _Si to the (n-1) th server device _Sn-1 cooperate with the node j other than the leaves so that the 0th server device _Si to the n-1th server device _Sn-1 cannot be known. To generate a share [r _j ] of shuffle bits r _j ← {0, 1} (step A2).

  This processing corresponds to “2:” of the off-line calculation protocol in FIG.

<Step A3>
The 0th server device S _i to the (n−1) th server device S _n-1 are predetermined according to the shuffle bits r _i whose secrets are distributed so that the 0th server device S _i to the n−1th server device S _n-1 are not known. The decision tree after disturbance is obtained by disturbing the decision tree by secret cooperative calculation (step A3).

This processing corresponds to “3:” to “9:” of the off-line calculation protocol in FIG. In the off-line calculation protocol “3:” to “9:” in FIG. 6, when the shuffle bit r _i = 1 of the note i, the tree with L (i) as the root and R (i) as the root The decision tree is disturbed by replacing all the nodes other than the leaf node with a process of not replacing the tree when the shuffle bit r _i = 0 of the note i is replaced.

As described above, the 0th server device _Si to the (n-1) th server device _Sn-1 each have a tree and a right child rooted at the left child node of each node for each node of a predetermined decision tree. A perturbed decision tree may be obtained by performing a process of replacing a tree rooted at a node when the shuffle bit corresponding to the node is a predetermined value by a secret cooperative calculation. An example of the predetermined value is 1. Of course, the predetermined value may be a value other than 1.

  Hereinafter, the process of each step of the “On-line phase” will be described. FIG. 7 shows an example of an on-line calculation protocol for realizing the processing of each step.

<Step B1>
The user device U generates a plurality of shares by secretly sharing the data X based on a predetermined algorithm Share, and the generated plurality of shares are transmitted from the 0th server device _Si to the (n-1) th server device _{Sn. -1} (step B1).

  The processing in step B1 corresponds to “1:” of the on-line calculation protocol in FIG.

<Step B2>
The 0th server device _Si to the (n-1) th server device _Sn-1 use the received plurality of shares, the determined decision tree after the disturbance, and the shuffle bits subjected to the secret sharing to transmit data in the predetermined decision tree. N shares of the value corresponding to X are obtained by secret cooperative calculation (step B2).

  The processing of step B2 corresponds to “2:” to “11:” of the on-line calculation protocol of FIG.

In the on-line calculation protocol “2:” to “11:” in FIG. 7, each hierarchy i (i = 0) of the decision tree after the disturbance from the highest hierarchy of the decision tree after the disturbance to the hierarchy of the leaf node ,..., H-2), (1) when the shuffle bit corresponding to the node is 0 and X _i satisfies the condition of the node, the node transitions to the right child node of the node; (2) the shuffled bits are shuffled bit is 0 and X _i corresponding to that node, if the condition is not satisfied in the node transitions to the left child node of the node, corresponding to (3) the node If X is 1 and X _i satisfies the condition of that node, transition to the left child node of that node. (4) The shuffle bit corresponding to that node is 1 and X _i is the condition of that node. If the condition is not satisfied, transition to the child node to the right of that node The leaf node that finally transitions is obtained by performing secret cooperative calculation, and the value corresponding to the obtained leaf node is set as the value corresponding to the data X in the predetermined decision tree.

In this way, the 0th server device _Si to the (n-1) th server device _Sn-1 each of the hierarchy i of the decision tree after the disturbance from the highest hierarchy of the decision tree after the disturbance to the hierarchy of the leaf node. i = 0, ..., h-2) (1) If the shuffle bit corresponding to the node is not a predetermined value and X _i satisfies the condition of the node, one child of the node (2) When the shuffle bit corresponding to the node is not a predetermined value and X _i does not satisfy the condition of the node, the node transitions to the other child node of the node. When the shuffle bit corresponding to the node has a predetermined value and X _i satisfies the condition of the node, the node transits to the other child node of the node, and (4) the shuffle bit corresponding to the node is predetermined. when a value and X _i does not satisfy the conditions of that node The leaf node that finally transitions is obtained by performing the process of transitioning to the above one child node of the node by the secret cooperative calculation, and the value corresponding to the obtained leaf node corresponds to the data X in the predetermined decision tree Value. An example of the predetermined value is 1, an example of one child node is a right child node, and an example of the other child node is a left child node.

  The predetermined value may be a value other than 1. Further, when it is determined that the predicate is satisfied and the transition to the left child node is made, one child node may be the left child node, and the other child node may be the right child node.

  In this way, when the shuffle bit is a predetermined value, the transition should be made to the child node that is not the child node that should be originally transitioned. It is possible to finally transition to the leaf node, and the value (for example, recommended value) of the leaf node corresponding to the data in the decision tree before the disturbance can be acquired.

<Step B3>
The 0th server device _Si to the (n-1) th server device _Sn-1 transmit n shares obtained by performing the secret cooperative calculation to the user device U (step B3).

  The processing in step B3 corresponds to “12:” of the on-line calculation protocol in FIG.

<Step B4>
The user apparatus U restores the value corresponding to the data X in the predetermined decision tree using at least k of the received n shares based on the predetermined algorithm Rec (step B4).

  The processing in step B4 corresponds to “14:” of the on-line calculation protocol in FIG.

  By performing such processing, it is possible to return a value (for example, a recommended value) while concealing the data of the user device and the decision tree of the server device.

  In this embodiment, although off-line calculation is required, calculation when data comes from the user apparatus can be performed in a linear order of the height of the decision tree. That is, by shuffling based on random numbers in advance in the Off-line phase, it is only necessary to follow one path in the On-line phase, and the amount of exponential order calculation of the decision tree is not required.

[Program and recording medium]
The processes described in the secret decision tree calculation apparatus and method are not only executed in time series according to the order of description, but may also be executed in parallel or individually as required by the processing capability of the apparatus executing the process or as required. Good.

  When each process in the secret decision tree calculation apparatus is realized by a computer, the processing contents of the functions that the secret decision tree calculation apparatus should have are described by a program. Then, by executing this program on a computer, each process is realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  Each processing means may be configured by executing a predetermined program on a computer, or at least a part of these processing contents may be realized by hardware.

[Modification]
Needless to say, other modifications are possible without departing from the spirit of the present invention.

Claims (5)

A user device that generates a plurality of shares by secretly sharing data X, and transmits the generated plurality of shares from the 0th server device to the n-1th server device,
A predetermined decision tree is disturbed by secret cooperative calculation according to a secret-shuffled bit in which the (n-1) -th server device is unknown from the 0th server device to obtain a disturbed decision tree, and the received multiple shares and the above Using the decision tree after disturbance and the shuffled bits that are secret-distributed, the n shares of the value corresponding to the data X in the predetermined decision tree are obtained by secret cooperative calculation and transmitted to the user device Including the 0th server device to the (n-1) th server device,
The user apparatus restores a value corresponding to the data X in the predetermined decision tree using k as a predetermined integer equal to or less than n and using at least k of the received n shares.
Secret decision tree calculation system. In the secret decision tree calculation system according to claim 1,
The data X is X = (X ₀ ,..., X _h-1 ), and the predetermined decision tree is a complete binary tree and a fixed order decision tree,
From the 0th server device to the (n-1) th server device, for each node of the predetermined decision tree, a tree rooted at the left child node of each node and a tree rooted at the right child node When the shuffle bit corresponding to the node has a predetermined value, the replacement process is performed by secret cooperative calculation to obtain the decision tree after the disturbance, and the leaf node is determined from the highest hierarchy of the decision tree after the disturbance. In each node i (i = 0, ..., h-2) of the decision tree after disturbance up to the layer, (1) the shuffle bit corresponding to the node is not a predetermined value and X _i is the node (2) If the above shuffle bit corresponding to the node is not a predetermined value and X _i does not satisfy the condition of the node Transition to the other child node of the node, (3) The shuffled bits the shuffled bits corresponding to the node in the case given the value and X _i satisfies the condition that node transits to the other child nodes of the node, corresponding to (4) the node Is a predetermined value and when X _i does not satisfy the condition of the node, the process of transitioning to the one child node of the node is performed by secret cooperative calculation to obtain a leaf node that finally transitions, A value corresponding to the obtained leaf node is set as a value corresponding to the data X in the predetermined decision tree.
Secret decision tree calculation system.   The secret decision tree calculation apparatus which is the said 0th server apparatus to the n-1th server apparatus of the secret decision tree calculation system of Claim 1. The user device generates a plurality of shares by secretly sharing the data X, and transmits the generated plurality of shares from the 0th server device to the (n-1) th server device;
After disturbance from the 0th server device to the (n-1) th server device by disturbing a predetermined decision tree by secret cooperative calculation according to the secret-shuffled shuffle bits from which the 0th server device to the (n-1) th server device are not known Using the received multiple shares, the perturbed decision tree, and the secret-shuffled shuffle bits, the n shares of the value corresponding to the data X in the predetermined decision tree are secretly obtained. Obtaining by cooperative calculation and transmitting to the user device;
The user equipment, using k as a predetermined integer less than or equal to n, restoring the value corresponding to the data X in the predetermined decision tree using at least k of the received n shares;
A secret decision tree calculation method including   A program for causing a computer to function as the secret decision tree calculation apparatus according to claim 3.

Images