JP6693503B2 - Secret search system, server device, secret search method, search method, and program - Google Patents

Description

  The present invention relates to a search system for searching data, and more particularly to a secret search system capable of concealing a search condition and held data when the data is distributed and held in plural.

  There is known a service in which a user deposits information in an external server device such as a cloud. In such a service, a method of concealing data by encryption or the like is generally adopted in order to prevent the deposited data from being leaked. The general concealment method has the following problems. Specifically, when the server device side searches for the desired data from the concealed data, the retrieval can be performed by restoring the concealed data on the server device side. However, with such a method involving restoration on the server device side, there is a risk of data leakage from the server device.

  For this reason, various secret search technologies have been proposed that can search the concealed data while keeping it secret.

  A multi-party computation (MPC) technique is known as one technique for realizing a secret search (see, for example, Patent Documents 1 and 2).

In MPC, two or more server devices each having secret information cooperate with each other to calculate an arbitrary function value to which secret information is input, without leaking each secret information. The confidential search using MPC is realized as follows. First, the data to be deposited is distributed and held in the two or more server devices by the secret sharing method (see Non-Patent Document 1, for example).
Then, the function is defined as "a function that returns 1 when data including a certain partial data is secretly shared and stored in the server device, and returns 0 when it is not".

  As an implementation method of MPC, there is Shamir's threshold secret sharing scheme (TSSS) described in Non-Patent Document 1. First, Non-Patent Document 1 will be described.

  The threshold type secret sharing method (TSSS) is a method of restoring secret information by converting the secret information into a plurality of pieces of shared information and collecting a number of pieces of the converted shared information equal to or larger than a threshold value. In the threshold type secret sharing method, the original secret information is not leaked from the number of pieces of shared information equal to or less than the threshold value.

  The threshold secret sharing method (TSSS) of Non-Patent Document 1 is a method of secretly distributing the number a belonging to the finite field Zp among N server devices, and uses a k−1 order polynomial f_a (x). In this method, for example, f_a (0) = a, and points f_a (i) on the polynomial are distributed to the i-th server device (1 ≦ i ≦ N). The distributed information f_a (i) is called distribution information of x in the threshold secret sharing scheme (TSSS). At this time, if the k server devices cooperate, the k−1-degree polynomial f_a (x) can be uniquely restored from the k points on the polynomial, and thus the secret information f_a (0) must be obtained. You can

  The distribution information of the secret information a, which is generated when the secret information a is distributed by N server devices using the polynomial f_a (x) modulo p, is [a] _p = (f_a (1) , F_a (2), ..., f_a (N)). At this time, it is assumed that f_a (i) is held in the i-th server device having the identifier i (1 ≦ i <N).

  Non-Patent Document 2 is an MPC method in which a plurality of server devices that hold distributed information by the threshold secret sharing method (TSSS) of Non-Patent Document 1 perform arithmetic operations without restoring secret information by cooperative calculation. Is disclosed. Next, the method of Non-Patent Document 2 will be described.

  In the method of Non-Patent Document 1, a polynomial f_ (a + b) (x) that disperses secret information a + b is a polynomial f_a (x) that disperses secret information a and a polynomial f_b (x) that disperses secret information b. Can be written in Japanese. That is, f_ (a + b) (x) = f_a (x) + f_b (x) mod p. Due to this property, each server device having the identifier i may individually calculate the shared information of the secret information a + b from the shared information of the secret information a and the shared information of the secret information b. That is, each server device individually calculates f_ (a + b) (i) = f_a (i) + f_b (i) mod p to secretly distribute the sum of the secret information without communication between the server devices. Can be held.

  Similarly, it is possible to secretly distribute the product of secret information. However, communication of N (N-1) times is required to calculate the product.

  In Non-Patent Document 2, a method of secretly distributing the sum and product of such secret information is combined to calculate an arbitrary function that can be calculated by addition and multiplication.

  As described above, an arbitrary function can be calculated by the method of Non-Patent Document 2 and a character string search can be realized. The secret search using the method of Non-Patent Document 1 is realized as follows.

  The client device requesting the search generates the distributed information for the search request data s and sends it to each server device. Each of the N server devices has distributed data [t'_1] _p, ..., [t'_l] _p of partial information of the data t held by itself, and distributed information [s] _p of s which is search request data. Then, [s-t'_1] _p, [s-t'_2] _p, ..., [s-t'_l] _p are calculated by the multi-party calculation (MPC) of Non-Patent Document 2. Note that the difference value becomes 0 when there is distributed data that matches the search request data. After that, the N server devices share the random number distribution information, mask the difference information by the product calculation of the secret information described in Non-Patent Document 1, and share the masked difference information as the search result distribution information. Output as.

  On the other hand, Non-Patent Document 3 discloses a method of reducing the size of distributed information of random numbers. In Non-Patent Document 3, a replicated secret sharing scheme (RSSS) is used.

  First, the method of the replica secret sharing method (RSSS) described in Non-Patent Document 3 will be described. RSSS is a method of secretly distributing integers b belonging to a finite field Zq among N server devices, and secret information is distributed by the following method.

  , N_1 random numbers b_1, b_2, ..., B_ (N-1) are selected, and b_N = b- (b_1 + b_2 + ... + b_ (N-1)) mod q (q is a prime number). Note that when b_1, b_2, ..., b_ (N-1), b_N are all added, the original secret information b is restored. By appropriately allocating b_1, b_2, ..., b_ (N-1), b_N to the server apparatus, a plurality of server apparatuses cooperate to obtain b_1, b_2, ..., b_ (N-1), b_N. The secret information can be restored only when all items are gathered. A combination of server devices capable of restoring the secret information can be arbitrarily designed depending on how b_1, b_2, ..., B_ (N-1), b_N are assigned.

  For example, if there are three server devices and the RSSS that can restore the secret information b when any two server devices cooperate, after generating b_1, b_2, and b_3 so that b = b_1 + b_2 + b_3, (b_1 , B_2), (b_2, b_3), (b_3, b_1), each two values are assigned to each server device.

  The distribution information of b generated when the secret information b is distributed to N server devices by RSSS using b_1, b_2, ..., b_N such that b = b_1 + b_2 + ... + b_N mod q <b> q = (V_1, v_2, ... v_n) will be written. At this time, it is assumed that v_i is held in the server device having the identifier i (1 ≦ i <N). In the example of RSSS that can be decrypted by two of the above three server devices, v_1 = (b_1, b_2), v_2 = (b_2, b_3), v_3 = (b_3, b_1).

  Non-Patent Document 3 discloses a method of sharing disperse information based on a random number RSSS between server devices, and using the disperse information about the random number to generate the disperse information based on the SSS of a pseudo-random number by calculation without communication. It has been described. When this method is used, the SSS random number distribution information can be generated at the time of calculation as needed, and therefore it is not necessary to be distributed in advance. Therefore, the size of the distributed random number information is small.

JP, 2007-114494, A JP 2012-024182A

Adi Shamir, "How to Share a Secret," Commun. ACM 22 (11), pp. 612-613, 1979. Michael Ben-Or, Shafi Goldwasser and Avi Wigderson, "Completeness Theorems for Non-Cryptographic Fault-Tolerant Distributed Computation (Extended Abstract)," Proceedings of the 20th Annual ACM Symposium on Theory of Computing, 1988. Ronald Cramer, Ivan Damgard, Yuval Ishai, "Share Conversion, Pseudorandom Secret-Sharing and Applications to Secure Computation," Theory of Cryptography, Second Theory of Cryptography Conference (TCC), pp. 342-362, 2005.

  The method using Non-Patent Document 1 has the following problems. It is assumed that n-symbol data T = (t_1, t_2 ..., T_n) is searched for search request data s = (s_1, ..., s_m) (where n> m). In this case, in order to execute the search as described above, each server device needs to hold the distributed information for every partial data of T by SSS. Specifically, in the method using Non-Patent Document 1, it is necessary to hold the shared information of (t_i, ..., T_j) for arbitrary 1 ≦ i <j ≦ n. Therefore, the method using Non-Patent Document 1 has a problem that the data size of the shared information to be held by each server device is very large with respect to the original data (t_1, t_2 ..., t_n).

  On the other hand, the method of Non-Patent Document 3 is not a data that can be arbitrarily selected, but is a method for reducing the size of random number distributed information. For the purpose of secret search, the distributed data is the secret information of the user of the secret search system and is not a random number. Therefore, the method of Non-Patent Document 3 cannot be directly applied to the secret search.

  An object of the present invention is to provide a server device, a search method, etc. in a secret search system using a secret sharing method, which reduces the size of data (distributed information) held by each server device without impairing its search function. To do.

  A server device of the present invention includes a data storage unit that stores distributed registration data for each symbol of secret information; and the distributed registration data stored in the data storage unit as search data for data in which a plurality of symbols are linked. A data conversion unit for converting; using the search data and the distributed search request data, performing a search for the distributed registration data in the data storage unit while communicating with a data search unit of another server device, And a data search unit for outputting the distributed search result.

  A search method of the present invention is a search method for executing a search in a server device, in which distributed registration data for each symbol of secret information is stored, and the stored distributed registration data is used for data obtained by concatenating a plurality of symbols. The data is converted into search data, the search data and the distributed search request data are used to communicate with another server device, the distributed registration data is searched, and the distributed search result is output.

A program of the present invention stores, in a computer, distributed registration data for each symbol of secret information, converts the saved distributed registration data into search data for data in which a plurality of symbols are linked, and searches the search data. and using the distributed search request data, communicate with other server devices, and perform a search for the distributed registration data, distributed search results outputs a search program for executing the.

  According to the present invention, the size of data (distributed information) stored in each server device can be reduced.

It is a block diagram which shows the structure of the confidential search system which concerns on 1st Embodiment. It is a block diagram which shows the structure of the server apparatus in the confidential search system of 1st Embodiment. It is a block diagram which shows the structure of the client apparatus in the confidential search system of 1st Embodiment. It is a flow chart which shows processing at the time of data registration in the secret search system of a 1st embodiment. It is a flow chart which shows processing at the time of data search in the secret search system of a 1st embodiment. It is a block diagram which shows the structure of the confidential search system which concerns on 2nd Embodiment. It is a block diagram which shows the structure of the server apparatus in the confidential search system of 2nd Embodiment. It is a block diagram which shows the structure of the client apparatus in the secret search system of 2nd Embodiment. It is a flowchart which shows the process at the time of data registration of the confidential search system of 2nd Embodiment. It is a flow chart which shows processing at the time of data search in the secret search system of a 1st embodiment.

First, the outline of the embodiment of the present invention will be described.
[Outline of Embodiment]

  In the method according to the related art, each server device needs to have all the distributed information of searchable partial character strings. On the other hand, in the present embodiment, when data of length m symbols is input as a search, a process of generating distributed information of secret information in which m symbols are concatenated from secret information distributed for each symbol. I do.

  As a method of having secret information for each symbol to generate shared information of secret information, a method using a duplicate secret sharing method (first method) and a method using Shamir's threshold secret sharing method ( The second method).

  In the first method, the shared information of the replicated secret sharing scheme (RSSS) is converted to the shared information of the m-symbols by converting the shared information of the replicated secret sharing scheme for each symbol into the Shamir threshold type. A method of converting to shared information of the secret sharing method (TSSS) is used. At this time, since the size of the shared information becomes large, the original secret information may not be restored properly. Therefore, in order to correct this, multi-party calculation (MPC) that compares the magnitudes without decoding the shared information is used.

  On the other hand, in the method of distributing the secret information to be searched by the threshold type secret sharing method (TSSS) (second method), the shared information generated by the small body threshold type secret sharing method (TSSS) The distributed information is connected by treating as the shared information of the threshold secret sharing method on the extension field.

  The confidential search system according to the present embodiment includes N server devices and one client device. The server device of this embodiment is one computing device in the confidential search system.

  In other words, in the present embodiment, the data stored in each server device is stored as shared information for each symbol. Then, a method of performing a pre-process for generating shared information corresponding to the partial data required during the search process and then performing the search is adopted. This reduces the size of data (distributed information) stored in each server device.

  The confidential search system according to the present embodiment determines whether or not there is data including partial data designated by the user among a plurality of data distributed and held by N server devices without decrypting the data. Also, the data specified by the user can be searched without revealing it to the server.

  At this time, the amount of distributed data held by each server device is, for example, about 12 times the amount of data before distribution by the first method. Compared with the normal confidential search using Non-Patent Document 2, in the embodiment described later, the calculation cost is the same except for the data conversion process, and each server device may individually calculate the data conversion process. I can. Therefore, the confidential search system of this embodiment does not require communication for data conversion processing and can be executed at high speed.

  In the related art, when searching for data of any length, by trying to reduce the number of communications between server devices by secretly calculating multiple symbols collectively, distributed data for partial data of any length can be obtained. There was a problem that the size of the data that had to be held had to be held all the way up.

  On the other hand, in the present embodiment, each server device holds partial data for each symbol of secret information. Then, when the partial information of the m-symbol search request data is input, each server device generates distributed information corresponding to the partial data of m symbols of the secret information by a process that does not involve communication. Therefore, in the present embodiment, the number of times of communication can be reduced without increasing the data amount of the distributed data held in advance.

  By using this embodiment, it is possible to distribute data to a plurality of server devices and search for arbitrary data while hiding the data in each server device. This prevents an administrator of the server device from stealing the data when a certain server device provides some service for outsourcing confidential data to an external server device. That is, unless a plurality of managers collude, the manager cannot decrypt the secret information in the server device, which contributes to the protection of the secret information of the service user.

  This embodiment has an effect of reducing the data size from approximately 1/80 to 1/1000, as compared with the related art, for example.

Embodiments of the present invention will be described in detail with reference to the drawings. In the drawings showing the configuration of the embodiment, the direction of the arrow in the drawing is an example, and does not limit the direction of signals between blocks.
[First Embodiment]
A confidential search system according to a first embodiment of the present invention will be described with reference to FIGS. 1 to 3.

[Description of configuration]
FIG. 1 is a block diagram showing the configuration of a confidential search system according to the first embodiment of the present invention.

  Referring to FIG. 1, the confidential search system according to the first exemplary embodiment of the present invention includes N (N is an integer of 2 or more) server devices 100_1, 100_2, ..., 100_N and a client device 200. Here, the server devices 100_1 to 100_N are also referred to as first to Nth server devices, respectively. The client device 200 communicates with N server devices 100_1 to 100_N. Also, the N server devices 100_1 to 100_N communicate with each other.

  FIG. 2 is a block diagram showing the configuration of the nth server device 100_n (1 ≦ n ≦ N). The nth server device 100_n includes an nth data storage unit 101_n, an nth data conversion unit 102_n, and an nth data search unit 103_n.

  The nth data storage unit 101_n receives the nth distributed registration data 104_n from the client device 200 described later and stores it. Further, at the time of search, the nth data storage unit 101_n outputs the stored nth distributed registration data to the nth data conversion unit 102_n. The n-th data conversion unit 102_n converts the n-th distributed registration data stored in the n-th data storage unit 101_n into distributed information for n-th search (n-th search data) 105_n.

  The n-th data search unit 103_n uses the n-th search data 105_n received from the n-th data conversion unit 102_n and the n-th distributed search request data 106_n received from the client device 200, and other data. While communicating with the search units 103_1 to 103_N (excluding 103_n), a search is performed on the nth distributed registration data in the nth data storage unit 101_n, and the nth distributed search result 107_n is output.

  FIG. 3 is a block diagram showing the configuration of the client device 200. The client device 200 includes a registration data share generation unit 201, a query data share generation unit 202, and a secret sharing decryption unit 203.

  The registration data share generation unit 201 receives the registration data 204 from an input device (not shown). The registration data share generation unit 201 generates the first to N-th distributed registration data 104_1, ..., 104_N by using the secret sharing method for the registration data 204. The registration data share generation unit 201 transmits the nth distributed registration data 104_n (1 ≦ n ≦ N) to the nth server device 100_n.

  The query data share generation unit 202 receives the search request data 205 from an input device (not shown). The query data share generation unit 202 generates the first to Nth distributed search request data 106_1, ..., 106_N by using the secret sharing method for the search request data 205. The query data share generation unit 202 transmits the nth distributed search request data 106_n (1 ≦ n ≦ N) to the nth server device 100_n.

  The secret sharing decryption unit 203 receives the nth shared search result 107_n from the nth server device 100_n (1 ≦ n ≦ N). The secret sharing decryption unit 203 restores the search result 206 by using the secret sharing method for the first to Nth shared search results 107_1, ..., 107_N.

[Description of operation]
Next, the operation of the confidential search system according to the first embodiment of the present invention will be described in detail with reference to FIGS. 1 to 5.

  The confidential search system according to the first embodiment of the present invention performs two types of processing: (1) data registration processing and (2) data search processing. 4 and 5 are flowcharts showing the data registration process and the data search process, respectively.

(Data registration process)
FIG. 4 is a flowchart showing the operation of the data registration processing of the confidential search system according to the first embodiment of the present invention.

  When registering new data in the first to Nth server devices 100_1, ..., 100_N, the following is performed.

  The confidential search system inputs the registration data 204 (t_1, ..., T_n) to be newly distributed to the registration data share generation unit 201 of the client device 200. However, t_1, ..., T_n respectively correspond to one symbol of data, and each size is logq (q is a prime number, base is 2) (step S101). It should be noted that the log that follows has a base of 2, but is omitted and described as log.

  The registration data share generation unit 201 converts the registration data 204 into the nth distributed registration data 104_n (1 ≦ n ≦ N) by RSS (step S102).

  More specifically, first, the registration data share generation unit 201, for 1 ≦ i ≦ n, t_i = t {i, 1} + t_ {i, 2} + ... + t_ {i, N} mod q such that t_i. By generating {i, 1}, ..., T_ {i, N} and assigning them to each server device in an appropriate combination, <t_i> q = ((t_t for each symbol i (1 ≦ i ≦ n)). {1,1}, ..., t_ {N, 1}), (t_ {1,2}, ..., t_ {N, 2}), ..., (t_ {1, N}, ..., t_ {N, N})) is generated.

  Further, the registered data share generation unit 201 sets b_i = n if (n-1) q ≤ t_i <q, and the shared information [b_i] _p = (b_ {i, 1}, b_ {i by SSS of b_i. , 2}, ..., b_ {i, N}) are generated. At this time, note that t_ {i, 1} + t_ {i, 2} + ... + t_ {i, N} = t_i + b_i.q.

  The n-th distributed registration data 104_n is a set of distributed information (t_ {1, n}, ..., t {N, n}) of t_i and distributed information b_ {i, n} of b_i.

  The registration data share generation unit 201 transmits the nth distributed registration data 104_n to the nth server device 100_n (1 ≦ n ≦ N) (step S103).

  (Step S104) The nth server device 100_n (1 ≦ n ≦ N) stores the received nth distributed registration data 104_n in the nth data storage unit 101_n.

(Data search process)
FIG. 5 is a flowchart showing an operation at the time of data search of the confidential search system according to the first embodiment of the present invention.

  Does the data including certain partial data (s_1, ..., s_m) exist for the set of data T = (t_1, t_2, ..., t_n) distributed to the first to Nth server devices 100_1, ..., 100_N? If you want to search for something like this:

  The confidential search system inputs the search request data 205 (s_1, ..., s_m), which is the data to be searched, to the query data share generation unit 202 of the client device 200 (step S201). s_1, ..., s_m represent each character of the search request data, and the size of each is logq.

  The query data share generation unit 202 uses the TSSS method of Non-Patent Document 1 for the first to N-th distributed search request data (106_1, ..., 106_N) [s_1 s_2 ... s_m] _p in the form of the following Expression 1. Is generated (step S202).

Then, the query data share generation unit 202 transmits the nth distributed search request data 106_n to the nth data search unit 103_n of the nth server device 100_n. However, logp = logq × m (p and q are prime numbers, m is an arbitrary positive integer, and m> n).

  The nth server device 100_n (1 ≦ n ≦ N) reads the nth distributed registration data from the nth data storage unit 101_n and sends it to the nth data conversion unit 102_n (step S203). Note that the distributed registration data is distributed in the form of <t_1> q, ..., <t_n> q for each of the n character texts.

  First, the n-th data conversion unit 102_n receives the RSS distributed data <t_1> q, ..., <t_n> q received from the n-th data storage unit 101_n by the method described in Non-Patent Document 3. [T * _1] _p, ..., [t * _n] _p (step S204).

  At this time, since t * _i = t_i + b_i · q, it is corrected to b_i by the following calculation.

  The n-th data conversion unit 102_n calculates the distribution information [t′_1] _p, [t′_1] _p, [t′_i] _p = [t * _i] _p−q × [b_i] _p for each t_i. '_2] _p, ... [t'_n] _p are generated.

  The n-th data conversion unit 102_n uses the method described in Non-Patent Document 2 and utilizes that the calculation of the sum and the constant multiple can be executed without communication, so that the m symbol Convert to the distributed data of SSS regarding the combined data.

  The nth data conversion unit 102_n sends [s'] _ p as the nth search data 105_n to the nth data search unit 103_n.

  The nth data search unit 103_n uses the nth search data 105_n sent from the nth data conversion unit 102_n and the nth distributed search request data 106_n sent from the query data share generation unit 202. , [S′_0] _p, ..., [s ′ _ {n−m}] _ p are generated by the calculation of the following Expression 3 (step S205).

If any of the partial data t'_1, ..., T '_ (n-m) to be searched matches the search request data, any of s'_0, ..., s' _ (n-m). Note that the value becomes 0.

  After that, the first to N-th data search units 103_1 to 103_N communicate with each other and perform calculations such as the following formula 4, and the n-th data search unit 103_n searches the obtained results for the n-th distributed search. The result 107_n is transmitted to the client device 200.

  The client device 200 inputs all the first to Nth shared search results 107_1, ..., 107_N received from the first to Nth server devices 100_1, ..., 100_N to the secret sharing decryption unit 203, and outputs the search result 206. Decrypt (step S206). When the decrypted result is 0, it means that the data including the search request data exists in the registered data, and when it is not 0, it indicates that such data does not exist. ..

(Effects of the first embodiment)
According to the first embodiment, the size of data (distributed information) stored in each server device can be reduced. The reason is that the data stored in each server device is stored as distributed information for each symbol. This is because the search is performed after the preprocessing for generating the shared information corresponding to the partial data required in the search processing is performed.

  In the first embodiment, the secret information is stored in RSSS for each symbol, and the data conversion unit converts this into TSSS distributed information by the method of Non-Patent Document 3. At this time, the shared information converted by the method of Non-Patent Document 3 may not be the shared information of t_i but the shared information of t * _i = t_i + b_i · q. Therefore, by distributing b_i together with t_i and calculating [t_i] _p = [t * _i] _p−q × [b_i] _p, the same secret information can be restored even after the conversion of the shared information. Is being corrected. The value calculated by the equation (2) is t'_i variance information, and t'_i is each symbol of (t_1, ..., t_n) for every q bits, so the variance information for partial data of m symbols. It has become. The operation of masking with random numbers after the difference between t'_i and the search request data s' is obtained has the same effect as the operation of masking the difference with respect to each of the m symbols.

[Second Embodiment]
Next, a confidential search system according to the second embodiment of the present invention will be described with reference to FIGS. 6 to 8.

[Description of configuration]
FIG. 6 is a block diagram showing the configuration of the confidential search system according to the second embodiment of the present invention.

  Referring to FIG. 6, the confidential search system according to the second embodiment includes a client device 200A and first to Nth server devices 100A_1, 100A_2, ..., 100A_N. The server devices 100A_1 to 100A_N are also referred to as first to Nth server devices, respectively. The client device 200A communicates with N server devices 100A_1 to 100A_N. Further, the N server devices 100A_1, ..., 100A_N communicate with each other.

FIG. 7 is a block diagram showing the configuration of the nth server device 100A_n (1 ≦ n ≦ N).
The nth server device 100A_n (1 ≦ n ≦ N) includes an nth data storage unit 101A_n, an nth data conversion unit 102A_n, and an nth data search unit 103A_n.

  The nth data storage unit 101A_n receives the nth distributed registration data 104A_n from the client device 200A and stores it. Further, the nth data storage unit 101A_n outputs the nth distributed registration data 104A_n stored at the time of search to the nth data conversion unit 102A_n. The n-th data conversion unit 102A_n converts the n-th distributed registration data stored in the n-th data storage unit 101A_n into distributed information for search (search data) 105A_n.

  The n-th data search unit 103A_n uses the n-th search data 105A_n received from the n-th data conversion unit 102A_n and the n-th distributed search request data 106A_n received from the client device 200A, and uses the other data. While communicating with the search units 103A_1 to 103A_N (excluding 103A_n), a search is performed on the nth distributed registration data in the nth data storage unit 101A_n, and the nth distributed search result 107A_n is output.

  FIG. 8 is a block diagram showing the configuration of the client device 200A. The client device 200A includes a registration data share generation unit 201A, a query data share generation unit 202A, and a secret sharing decryption unit 203A.

  The registration data share generation unit 201A receives the registration data 204A from an input device (not shown). The registration data share generation unit 201A executes the shared data generation procedure of the secret sharing method to generate the first to Nth distributed registration data 104A_1, ..., Distributed registration data 104A_N. The registration data share generation unit 201A transmits the nth distributed registration data 104A_n (1 ≦ n ≦ N) to the nth server device 100A_n.

  The query data share generation unit 202A receives the search request data 205A from an input device (not shown). The query data share generation unit 202A executes the shared data generation procedure of the secret sharing method to generate the first to Nth distributed search request data 106A_1, ..., 106A_N. The query data share generation unit 202A transmits the nth distributed search request data 106A_n (1 ≦ n ≦ N) to the nth server device 100A_n.

  The secret sharing decryption unit 203A receives the nth shared search result 107A_n from the nth server apparatus 100A_n (1 ≦ n ≦ N). The secret sharing decryption unit 203A executes the secret sharing decryption procedure on the first to Nth shared search results 107A_1, ..., 107A_N to restore the search result 206A.

[Description of operation]
Next, the operation of the confidential search system according to the second embodiment of the present invention will be described in detail with reference to FIGS. 6 to 10.

  The confidential search system according to the second embodiment of the present invention performs two types of processing: (1) data registration processing and (2) data search processing. 9 and 10 are flowcharts showing the flow of the data registration process and the data search process, respectively.

(Data registration process)
FIG. 9 is a flowchart showing an operation at the time of data registration of the confidential search system according to the second exemplary embodiment of the present invention.

  The following is performed when registering new data in the first to Nth server devices 100A_1, ..., 100A_N.

  The confidential search system inputs the new registration data 204A (t_1, ..., t_n) to be distributed to the registration data share generation unit 201A of the client device 200A (step S101A). However, t_1, ..., T_n respectively correspond to one symbol of data, and each t_i is an element of the finite field GF (q).

  The registration data share generation unit 201A generates a share [t_i] q of t_i by SSS for 1 ≦ i ≦ n, and assigns [t_1] q, ... [t_n] q to the first to Nth distributed registration data 104A_1. , ..., 104A_N (step S102A).

  The registration data share generation unit 201A transmits the nth distributed registration data 104A_n to the nth server device 100A_n (1 ≦ n ≦ N) (step S103A).

  The nth server device 100A_n (1 ≦ n ≦ N) stores the received nth distributed registration data 104A_n in the nth data storage unit 101A_n (step S104A).

(Data search process)
FIG. 10 is a flowchart showing an operation at the time of data search of the confidential search system according to the second embodiment of the present invention.

  Does the data including certain partial data (s_1, ..., s_m) exist for the set of data T = (t_1, t_2, ..., t_n) distributed to the first to Nth server devices 100A_1, ..., 100A_N? If you want to search for something like this:

  The confidential search system inputs the search request data 205A (s_1, ..., s_m), which is the data desired to be searched, to the query data share generation unit 202A of the client device 200A (step S201A). s_1, ..., s_m represent each character of the search request data, and the size of each is logq.

  The query data share generation unit 202A generates SSS distribution information [s] _p = [s_1 || s_2 || ... || s_m] _p from the search request data 205A (s_1, ..., s_m) (step S202A). .. However, p = q ^ m, and s is an element of the finite field GF (q ^ m). The query data share generation unit 202A transmits the nth distributed search request data 106A_n (1 ≦ n ≦ N) to the nth server device 100A_n.

  The nth server device 100A_n (1 ≦ n ≦ N) reads the nth distributed registration data from the nth data storage unit 101A_n and sends it to the nth data conversion unit 102A_n (step S203A).

  The nth data conversion unit 102A_n first converts the SSS distribution information [t_1] q, ..., [t_n] q received from the nth data storage unit 101A_n into search data by the following method (step S204A). ).

  The n-th data conversion unit 102A_n holds by itself among [t_i] q = (t_ {i, 1}, t_ {i, 2}, ..., T_ {i, N}) for each t_i. Distributed information t_ {1, j}, t_ {2, j} ,. ． ． , T_ {n, j}, t ′ _ {i, j} = t_ {i, j} || t_ {i + 1, j} || ... || t_ {i + m-1, j} is 0 ≦ Compute for i ≦ n−m, t ′ _ {0} ,. ． ． , T '_ {n-m}. t '_ {i, 1} ,. ． ． , T '_ {i, N} is the disperse information of t' _ {i} = t_ {i} || ... || t_ {i + m-1}. That is, [t'_i] _p = [t_ {i} || ... || t_ {i + m-1}] _ p. However, p = q ^ m, and each t'_i is an element of the finite field GF (2 ^ q).

  The n-th data conversion unit 102A_n has [t'_0] _p ,. ． ． , [T '_ {n-m}] _ p are sent to the nth data search unit 103A_n as the nth search data 105A_n.

  The nth data search unit 103A_n uses the nth search data 105A_n sent from the nth data conversion unit 102A_n and the nth distributed search request data 106A_n sent from the query data share generation unit 202A. , [S′_0] _p, ..., [s ′ _ {n−m}] _ p are generated by the calculation of Equation 3 (step S205A). If any of the search target partial data t'_0, ..., T '_ (n-m) matches the search request data, any of s'_0, ..., s' _ {n-m}. Note that the value becomes 0.

  After that, the nth data search unit 103A_n performs the calculation as shown in the above mathematical expression 4, and transmits the obtained result to the client apparatus 200A as the nth distributed search result 107A_n.

  The client apparatus 200A inputs all the first to Nth shared search results 106A_1, ..., 106A_N received from the first to Nth server apparatuses 100A_1, ..., 100A_N to the secret sharing decryption unit 203A, and outputs the search result 206A. Decrypt (step S206A). When the decrypted result is 0, it means that the data including the search request data exists in the registered data, and when it is not 0, it indicates that such data does not exist. ..

(Effects of the second embodiment)
According to the second embodiment, the size of data (distributed information) stored in each server device can be reduced. The reason is that the data stored in each server device is stored as distributed information for each symbol. This is because the search is performed after the preprocessing for generating the shared information corresponding to the partial data required in the search processing is performed.

  In the second embodiment, the secret information is distributed by TSSS for each symbol, and the data conversion unit performs t '_ {i, j} = t_ {i, j} || t_ {i + 1 in step S204A. , J} || ... || t_ {i + m-1, j} are connected. Each symbol t_ {1, j}, t_ {2, j} ,. ． ． , T_ {n, j} is an element of a finite field GF (q), the concatenation of m pieces is an element of the finite field GF (q ^ m), and the original secret information t = (t1 , ..., T_n), the distribution information is for the partial data of m symbols. As a result, as in the first embodiment, the operations for m symbols can be collectively executed.

[Specific Example of Embodiment]
As a specific example of the first embodiment, a configuration of a character string search system including three server devices 100_1, 100_2, 100_3 and a client device 200 will be shown.

  In the specific example of the first embodiment, the original data of the text has a maximum of 200 characters each and is expressed in the form of T = (t_1, ..., t_200), and t_i (1 ≦ i ≦ n) is each character of the text. Represents. In the three server devices 100_1, 100_2, 100_3, a set of character strings is distributed and stored for each character using RSSS as <t_1> q, ..., <t_200> q. Each character is encoded with 8 bits, and q = 2 ^ 8. In the specific example of the first embodiment, the length of the keyword requested to be searched by the client device 200 is 10 characters. That is, the search request data is a character string of maximum 80 bits, and p = 2 ^ 80.

  The client device 200 uses the text of 10 characters s = (s_1, s_2, ..., s_10) = “calculator” as the search request data in SSS to [(“calculator”)] _ p = [2 ^ (72) · ”c "+ 2 ^ (64)," a "+ 2 ^ (56)," l "+ 2 ^ (48)," c "+ 2 ^ (40)," u "+ 2 ^ (32)," l "+ 2 ^ (24 ) · “A” + 2 ^ (16) · “t” + 2 ^ (8) · “o” + “r”] _ p, which are distributed to the three server devices 100_1, 100_2, 100_3.

  The nth server device 100_n (1 ≦ n ≦ 3) receives the RSSth nth distributed registration data 104_n for the search request data of 10 characters and then stores the text of the text stored in the nth data storage unit 101_n. Of the RSSS distributed information <t_1> q, ..., <t_200> q for each character, the information held by itself is input to the nth data conversion unit 102_n, and the TSSS distributed information [[ t * _1] _p, ..., [t * _n] _p. At this time, note that t * _i (= t_i mod q) may take three kinds of values of t_i, t_i + q, and t_i + 2q.

  Next, the nth server device 100_n calculates [t_i] _p = [t * _i] _p−q × [b_i] _p for each t_i.

  After that, the server device 100_n calculates [t_1] _p ,. ． ． , [T_ {n−m}] _ p, SSS distribution information [t′_i] _p = [2̂ (72) · t_ {i} + 2̂ (64) · t_ {for 10 character substrings. i + 1} + 2 ^ (56) .t_ {i + 2} + 2 ^ (48) .t_ {i + 3} + 2 ^ (40) .t_ {i + 4} + 2 ^ (32) .t_ {i + 5} + 2 ^ (24) .t_ { i + 6} + 2 ^ (16) · t_ {i + 7} + 2 ^ (8) · t_ {i + 8} + t_ {i + 9}] _ p (1 ≦ i <191) 105_n.

  The nth server device 100_n receives the nth distributed search request data 106_n received from the client device 200 and the nth search data 105_n converted from the data of the nth data storage unit 101_n as the nth data. Input to the search unit 103_n.

From the input distributed search request data [(calculator)] _ p and search data [t'_1] _p, ..., [t'_191] _p, the nth data search unit 103_n
[S'_1] _p = [t'_1] _p-[(calculator)] _ p,
…
[S'_191] _p = [t'_191] _p-[(calculator)] _ p
The search request data and the partial character string are matched by the calculation of.

  Here, it is assumed that t′_k = (“calculator”) for a certain partial character string t′_k. At this time, [s'_k] = [t'_k] _p-[("calculator")] _ p = [0] _p.

  After that, the nth data search unit 103_n distributes the distribution information [r] _p of the random number r, performs the calculation using the formula shown in the above number, and the search result S = s′_1 × ... × s ′ _ ( 191) × r distributed information is generated. Since a certain s'_k = 0, the value of S becomes 0.

  The nth data search unit 103_n outputs the S shared information as the nth distributed search result 107_n. The nth server device 100_n transmits the nth distributed search result 107_n to the client device 200.

  The client device 200 receives the partial information 107_1, 107_2, 107_3 of the search result S from the three server devices 100_1, 100_2, 100_3, and restores the search result S by the restore algorithm of TSSS. The client device 200 confirms that S = 0 has been decrypted, and outputs the result that “a character string including“ calculator ”exists in the server”.

  In the specific example of the first embodiment, the size of the distributed information of text stored in the server device is n · logp + 2n · logq = 200 × 80 + 2 × 200 × 8 = 19200 bits per text. As in the related art, when the partial character strings are all held by the TSSS distributed information of 80 bits, the size of the distributed information is (1/2) .n. (N + 1) .logp = (1/2) × 200 × 201 × 80 = 1608000 bits (≈200 KB). As described above, in the specific example of the first embodiment, the size of shared information can be reduced to 1/83 as compared with the related art.

  As a specific example of the second embodiment, a configuration of a character string search system including three server devices 100A_1, 100A_2, 100A_3 and a client device 200A will be shown.

  In the specific example of the second embodiment, the original data of the text has a maximum of 200 characters each and is expressed in the form of T = (t_1, ..., t_200), and t_i (1 ≦ i <n) is each character of the text. Represents. In the three server devices 100A_1, 100A_2, 100A_3, a set of character strings is distributed and stored for each character in TSSS such as [t_1] q, ..., [t_200] q. Each character is encoded with 8 bits, and q = 2 ^ 8. In this specific example, the length of the keyword requested by the client device 200A to search is 10 characters. That is, the search request data is a character string of maximum 80 bits, and p = 2 ^ 80.

  The client device 200A uses, as search request data, a 10-character text s = (s_1, s_2, ..., s_10) = “calculator” in SSS [(“calculator”)] _ p = [2 ^ (72) · ”c "+ 2 ^ (64)," a "+ 2 ^ (56)," l "+ 2 ^ (48)," c "+ 2 ^ (40)," u "+ 2 ^ (32)," l "+ 2 ^ (24 ) · “A” + 2 ^ (16) · “t” + 2 ^ (8) · “o” + “r”] _ p, which are distributed to the three server devices 100A_1, 100A_2, 100A_3.

The nth server device 100A_n (1 ≦ n ≦ 3) receives the TSSS distributed registration data 104A_n for the search request data of 10 characters, and then, for each character of the text stored in the nth data storage unit 101A_n. Of the distributed information [t_1] q, ..., [t_200] q of SSS, information t_ {1, j}, t_ {2, j} ,. ． ． , T_ {n, j} are input to the n-th data conversion unit 102A_n.
The nth data conversion unit 102A_n
t '_ {i, j} = t_ {i, j} || t_ {i + 1, j} || ... || t_ {i + m-1, j}
For 0 ≦ i ≦ n−m, and [t ′ _ {0}] _ p ,. ． ． , [T ′ _ {n−m}] _ p is transmitted to the nth data search unit 103A_n as the nth search data 105A_n.

After that, similarly to the specific example of the first embodiment, the nth data search unit 103A_n inputs the nth distributed search request data [(calculator)] _ p and the nth search data [t. From "_1" _p, ..., [t'_191] _p,
[S'_1] _p = [(calculator)] _ p- [t'_1] _p,
…
[S'_191] _p = [(calculator)] _ p- [t'_191] _p,
In this calculation, the search request data and the partial character string are matched, and the search result is output by the same method as in the specific example of the first embodiment.

  In the specific example of the second embodiment, the size of the distributed information of the text stored in the server device is n · logq = 200 × 8 = 1600 bits per text. As in the related art, when the partial character strings are all held in the TSSS distributed information of 80 bits, the size of the distributed information is (1/2) n (n + 1) .logp = (1/2) × 200. × 201 × 80 = 1608000 bits (≈200 KB). As described above, in the specific example of the second embodiment, the size of the shared information can be reduced to 1/1000 as compared with the related art.

  The present invention is not limited to the above embodiment, and the constituent elements can be modified without departing from the scope of the invention. Further, various inventions can be formed by appropriately combining a plurality of constituent elements. For example, in the specific example of the above-described embodiment, the case where there are three server devices has been described, but the same can be applied to the case where there are N server devices (N is an integer of 2 or more).

  According to the first and second embodiments, in the secret search system using the secret sharing method, it is possible to reduce the size of data (distributed information) held by each server device without impairing its search function. Becomes

  The first and second embodiments can also contribute to more sophisticated secret data analysis that combines secret search. For example, by combining the embodiment with other techniques for calculating a function while keeping data secret, it is possible to realize a secret data analysis system that performs some processing on data including certain partial data.

  Further, in a cloud service in which data is outsourced to a server device, the price of the service is usually determined by the data size and the communication charge. With the confidential search system to which the present embodiment is applied, the data size held by the server device can be reduced, and it is possible to reduce the price of services and promote the use of the services using the confidential search system.

  The methods described in the first and second embodiments can be executed by a computer. A program for executing this method is a floppy (registered trademark) disk, a magnetic disk such as a hard disk, an optical disk such as a CD-ROM (Compact Disc-Read Only Memory), a DVD (digital versatile disc), a magneto-optical disk (MO), and the like. It can be stored in a recording medium such as a semiconductor memory and distributed.

  Further, as this recording medium, as long as it is a recording medium that can store a program and is readable by a computer, the storage format may be any form.

  Further, an operating system running on the computer, middleware such as database management software, network software, or the like may execute a part of each processing based on an instruction of a program installed in the computer from the recording medium.

  Further, the recording medium is not limited to a medium independent of a computer, and includes a recording medium in which a program transmitted via a LAN (Local Area Network), the Internet, etc. is downloaded and stored or temporarily stored.

  Further, the number of recording media is not limited to one, and a case where the processing in the above-described embodiment is executed from a plurality of recording media is also included, and the medium configuration may be any configuration.

  The computer executes each process based on the program stored in the recording medium, and may have any configuration such as a device including a personal computer and a system in which a plurality of devices are network-connected.

  Further, the computer is not limited to a personal computer, but includes an arithmetic processing unit included in an information processing device, and is a device or device capable of realizing the functions of the present embodiment by a program.

  The whole or part of the exemplary embodiments disclosed above can be described as, but not limited to, the following supplementary notes.

(Supplementary Note 1) A data storage unit that stores distributed registration data for each symbol of confidential information,
A data conversion unit that converts the distributed registration data stored in the data storage unit into search data for data in which a plurality of symbols are linked,
Data for performing a search on the distributed registration data in the data storage unit while communicating with a data search unit of another server device using the search data and the distributed search request data, and outputting a distributed search result. Search section,
A server device having.

(Supplementary Note 2) The data storage unit holds the distributed registration data as shared information of a duplicate secret sharing method for each symbol,
The data conversion unit executes a process of generating, for each symbol, shared information of the duplicate secret sharing method stored in the data storage unit into shared information of one Shamir threshold secret sharing method for a plurality of symbols. And obtain the search data,
The server device according to attachment 1.

(Supplementary Note 3) The data storage unit holds, as the distributed registration data, distributed data of secret information generated by Shamir's threshold secret sharing method,
The data conversion unit executes a process of connecting the distributed data of the secret information stored in the data storage unit to obtain the search data,
The data search unit uses the data connected by the data conversion unit to execute a process of performing a search on an extension field to obtain the distributed search result,
The server device according to attachment 1.

(Supplementary Note 4) First to Nth (N is an integer of 2 or more) server devices, each of which is the server device according to any one of Supplementary Notes 1 to 3, and the first to Nth server devices. A confidential search system comprising a client device connected via a network, wherein the client device comprises:
A registration data share generation unit that generates first to Nth distributed registration data to be registered in the first to Nth server devices, respectively, from the registration data;
A query data share generation unit that generates first to Nth distributed search request data to be transmitted from the search request data to the first to Nth server devices, respectively.
A secret sharing decryption unit that decrypts the shared information of the search results from the first to Nth shared search results received from the first to Nth server devices, respectively.
Concealment search system with.

(Supplementary Note 5) A secret search method in a search system, comprising: a client device; and first to Nth (N is an integer of 2 or more) server devices connected to the client device via a network. A secret search method capable of secretly sharing data according to a secret sharing method, storing the data in the first to Nth server devices, and searching the data stored in the first to Nth server devices while keeping the data secret
The client device performs a distributed data generation procedure of the secret sharing method on registration data to generate first to Nth distributed registration data, and the first to Nth distributed registration data are respectively generated in the first to Nth distributed registration data. A registration data generation step of transmitting to the first to Nth server devices;
A registration data storage step in which the nth (1 ≦ n ≦ N) server device stores the nth distributed registration data in the nth data storage unit;
The client device executes the distributed data generation procedure of the secret sharing method on the search request data to generate the first to Nth distributed search data, and the first to Nth distributed search data are respectively generated as described above. A search request data generation step of transmitting to the first to Nth server devices;
A search data conversion step in which the nth server device converts the nth distributed registration data stored in the nth data storage unit into nth search data for data obtained by connecting a plurality of symbols;
The n-th server device uses the n-th search data and the n-th distributed search data to communicate with another server device while the n-th data storage unit stores the n-th data. A search step of searching the distributed registration data and transmitting an n-th distributed search result to the client device;
A restoration step in which the client device executes a decryption procedure of the secret sharing method on the first to Nth distributed search results received from the first to Nth server devices and restores the search results; ,
Concealment search method including.

(Supplementary Note 6) In the registration data generation step, the client device converts the registration data into the first to Nth distributed search data by a duplicate secret sharing method,
In the search request data generation step, the client device converts the search request data into the first to N-th distributed search data by Shamir's threshold secret sharing method,
In the search data conversion step, the nth server device converts the nth distributed registration data into the nth search data that is distributed data of the Shamir threshold secret sharing method.
The secret search method according to attachment 5.

(Supplementary Note 7) In the registration data generating step, the client device converts the registration data into the first to Nth distributed search data by Shamir's threshold secret sharing method, and in the search request data generating step, , The client device converts the search request data into the first to Nth distributed search data by the Shamir threshold secret sharing method,
In the search data conversion step, the nth server device concatenates the nth distributed registration data and converts it as one data into the nth search data.
The secret search method according to attachment 5.

(Supplementary Note 8) A search method for executing a search on a server device,
A saving step of saving the distributed registration data for each symbol of the confidential information in the data storage unit;
A conversion step in which the data conversion unit converts the distributed registration data stored in the data storage unit into search data for data in which a plurality of symbols are connected,
A data search unit uses the search data and the distributed search request data to perform a search for the distributed registration data in the data storage unit while communicating with the data search unit of another server device to perform a distributed search. A search step that outputs results,
Search method including.

(Supplementary Note 9) In the storage step, the distributed registration data is held in the data storage unit as shared information of a duplicate secret sharing method for each symbol,
In the conversion step, the data conversion unit converts the shared information of the duplicate secret sharing method for each symbol stored in the data storage unit into one Shamir's threshold secret sharing sharing information for a plurality of symbols. Performing a process of generating to obtain the search data,
The search method described in appendix 8.

(Supplementary Note 10) In the storing step, as the distributed registration data, shared data of secret information generated by a Shamir threshold secret sharing method is held in the data storage unit,
In the converting step, the data converting unit obtains the search data by executing a process of connecting the distributed data of the secret information stored in the data storage unit,
In the search step, the data search unit uses the data linked by the conversion procedure to perform a process of performing a search on an extension field to obtain the distributed search result.
The search method described in appendix 8.

(Supplementary Note 11) A search program for causing a server device, which is a computer, to execute a search, the computer including:
A saving procedure for saving the distributed registration data for each symbol of confidential information in the data storage unit,
A conversion procedure for converting the distributed registration data stored in the data storage unit into search data for data in which a plurality of symbols are connected,
A search procedure for performing a search on the distributed registration data in the data storage unit and outputting a distributed search result while communicating with another server device using the search data and the distributed search request data,
A search program for executing.

(Supplementary Note 12) The storage procedure causes the computer to hold the distributed registration data in the data storage unit as shared information of a duplicate secret sharing method for each symbol,
In the conversion procedure, the shared information of the duplicate secret sharing method for each symbol stored in the data storage unit is generated in the computer as the shared information of one Shamir threshold secret sharing method for a plurality of symbols. Execute a process to obtain the search data,
The search program according to attachment 11.

(Supplementary Note 13) The storage procedure causes the computer to hold, as the distributed registration data, shared data of secret information generated by Shamir's threshold secret sharing method in the data storage unit,
In the conversion procedure, the computer is caused to perform a process of connecting the distributed data of the secret information stored in the data storage unit to obtain the search data,
In the search procedure, the computer is caused to perform a process of performing a search by an operation on an extension field using the data linked by the conversion procedure to obtain the distributed search result.
The search program according to attachment 11.

  The present invention also contributes to more sophisticated secret data analysis that combines secret search. For example, a secret data analysis system that performs some processing on data including certain partial data can be realized by combining the present invention and a technique for calculating a function while keeping other data secret.

  Further, in a cloud service that entrusts data to a server device, the price of the service is usually determined by the data size and the communication charge. Therefore, it is considered that reducing the data size held by the server device in the secret search system leads to lower prices of services using the secret search system and promotes the use of the service.

  This application claims the priority on the basis of Japanese application Japanese Patent Application No. 2005-032573 for which it applied on February 23, 2015, and takes in those the indications of all here.

100_1 to 100_N, 100_n server device 100A_1 to 100A_N, 100A_n server device 101_1 to 101_N, 101_n data storage unit 101A_1 to 101A_N, 101A_n data storage unit 102_1 to 102_N, 102_n data conversion unit 102A_1 to 102A_N, 102A_n data conversion unit 103_1 to 103_1 to 103_1 103_n data search unit 103A_1 to 103A_N, 103A_n data search unit 104_n, 104A_n distributed registration data 105_n, 105A_n search data 106_n, 106A_n distributed search request data 107_n, 107A_n distributed search result 200, 200A client device 201, 201A registered data share generation unit 202, 202A query data share generation unit 203, 203A secret sharing decryption unit 204, 204A Registration data 205, 205A Search request data 206, 206A Search results

Claims (9)

Data storage means for storing distributed registration data for each symbol of confidential information;
Data conversion means for converting the distributed registration data stored in the data storage means into search data in which a plurality of symbols are connected , during search processing ;
A data search unit that communicates with a data search unit of another server device using the search data and the distributed search request data, searches the distributed registration data in the data storage unit, and outputs a distributed search result. When,
A server device having. The distributed registration data is held as shared information of the duplicate secret sharing method for each symbol,
The data conversion means converts the shared information of the replicated secret sharing method for each symbol stored in the data storage means into the shared information of one threshold secret sharing method for a plurality of symbols to convert the search data. Get
The server device according to claim 1. It said data storage means, as the dispersion registration data, to maintain the dispersion information of the secret information converted by the threshold secret sharing scheme,
Said data conversion means, wherein acquires search data by connecting the variance information of the secret information stored in the data storage means,
The data search means obtains the distributed search result by performing a search on an extension field using the shared information connected by the data conversion means.
The server device according to claim 1. First to N-th (N is an integer of 2 or more) server devices each comprising the server device according to any one of claims 1 to 3, and the first to N-th server devices via a network. A secret search system consisting of a client device connected by
The client device is
Registration data share generation means for converting the registration data into first to Nth distributed registration data to be registered in the first to Nth server devices, respectively.
Query data share generating means for converting the search request data into the first to Nth distributed search request data to be transmitted to the first to Nth server devices, respectively.
Secret shared decryption means for decrypting the shared information of the search results from the first to Nth distributed search results received from the first to Nth server devices, respectively.
Concealment search system with. A confidential search method in a search system comprising a client device and first to Nth (N is an integer of 2 or more) server devices connected to the client device via a network,
Distributed registered data of the first through the N-th converted using the secret sharing scheme to the registered data by the client device, wherein the data storage means of the first n of the server apparatus of the first n (1 ≦ n ≦ N) Each symbol of registration data is saved as the nth distributed registration data,
The client device converts the search request data into first to Nth distributed search data using the secret sharing method, and the first to Nth distributed search data are respectively the first to Nth server devices. Send to
The nth server device converts the nth distributed registration data stored in the nth data storage means into nth search data in which a plurality of symbols are connected ,
The n-th server device uses the n-th search data and the n-th distributed search data to communicate with another server device while the n-th data storage means stores the n-th data. A search for the distributed registration data is performed, the n-th distributed search result is transmitted to the client device,
The client device executes a decryption procedure of the secret sharing method on the first to Nth distributed search results received from the first to Nth server devices to restore the search results.
Secret search method. The client device converts the registration data into the first to Nth distributed search data by a duplicate secret sharing method,
The client device converts the search request data into the first to Nth distributed search data by Shamir's threshold secret sharing method;
The nth server device converts the nth distributed registration data into the nth search data which is distributed data of the Shamir threshold secret sharing method;
The confidential search method according to claim 5. The client device converts the registration data into the first to Nth distributed search data by Shamir's threshold secret sharing method;
The client device converts the search request data into the first to Nth distributed search data by the Shamir threshold secret sharing method;
The n-th server device concatenates the n-th distributed registration data and converts the data into one piece of data into the n-th search data.
The confidential search method according to claim 5. A search method for executing a search on a server device,
At the time of search processing , the distributed registration data for each symbol of confidential information is converted to search data in which multiple symbols are linked ,
Using the search data and the distributed search request data, communicating with another server device, performing a search for the distributed registration data, and outputting a distributed search result,
retrieval method. On the computer,
At the time of search processing , the distributed registration data for each symbol of confidential information is converted to search data in which multiple symbols are linked ,
A search program that uses the search data and the distributed search request data to communicate with another server device, perform a search on the distributed registration data, and output a distributed search result.

Images