JP6904916B2 - Information processing method and information processing system - Google Patents

Description

The present invention relates to an information processing method and an information processing system, and more particularly to a technique for concealing a learning model generated by using machine learning and data to be processed by the learning model.

In recent years, the speed of CPU (Central Processing Unit) and GPU (Graphics Processing Unit) has been increased, the capacity of memory has been increased, and machine learning technology has been rapidly advanced. For this reason, machine learning using learning data on the order of hundreds of thousands to millions has become possible, and highly accurate identification technology and classification technology are being established (see Non-Patent Document 1).

Yangqing Jia, Evan Shelhamer, Jeff Donahue, Sergey Karayev, Jonathan Long, Ross Girshick, Sergio Guadarrama, and Trevor Darrell. Caffe: Convolutional architecture for fast feature embedding. In Proceedings of the 22nd ACM international conference on Multimedia (pp. 675-678) ). ACM.

A large amount of computational cost is required to perform machine learning based on a large amount of learning data. In addition, a huge amount of labor is required for preparing a large amount of learning data and preprocessing for processing the prepared learning data for use in machine learning. On the other hand, the learning model generated by machine learning is digital data, and its duplication is easy. Therefore, if the creator of the learning model provides the learning model to the user for the purpose of making the user use it, there is a risk that the provided learning model will be used illegally thereafter.

On the other hand, it is also conceivable that the processing target data is acquired from the user via the communication network and only the processing result of the learning model is provided to the user without providing the learning model itself to the user of the learning model. However, in this aspect, in the case of data in which leakage becomes a problem due to the inclusion of personal information in the data input to the learning model, the user may be reluctant to use the learning model.

The present invention has been made in view of these points, and an object of the present invention is to provide a technique capable of acquiring a processing result while keeping a learning model and processing target data concealed.

A first aspect of the present invention is an information processing method executed in an information processing system including a model providing server, a service providing server, and a user terminal that are connected to each other via a communication network in a manner that allows communication with each other. In this method, the model providing server encrypts a learning model created by using machine learning using a first public key, which is a public key of completely quasi-identical encryption, to generate an encryption learning model. The model providing server transmits the encryption learning model to the service providing server, the model providing server transmits the first public key to the user terminal, and the user terminal uses the model. A step of encrypting the processing target data of the learning model using the first public key received from the providing server to generate the encryption processing target data, and the user terminal using the encryption processing target data and the complete A step of transmitting a second public key, which is a public key of quasi-identical encryption and is different from the first public key, to the service providing server, and the user terminal transmits the second public key to the model providing server. The second public key encryption first private key in which the model providing server encrypts the first private key corresponding to the first public key using the second public key received from the user terminal. The step of generating the above, the step of the model providing server transmitting the second public key encryption first private key to the service providing server, and the encryption received by the service providing server from the model providing server. The first output of the learning model, which uses the learning model and the encryption processing target data received from the user terminal and inputs the processing target data encrypted with the first public key. The step of acquiring the encrypted output, the step of the service providing server generating the double encrypted output in which the first encrypted output is re-encrypted using the second public key, and the step of the service providing server , The second public key encryption The first private key is used to decrypt the encryption by the first public key in the double encryption output while being encrypted by the second public key. A step of acquiring the second encrypted output to be obtained, a step of the service providing server transmitting the second encrypted output to the user terminal, and a second secret corresponding to the second public key by the user terminal. It includes a step of decrypting the second encrypted output received from the service providing server using the key.

The information processing method includes a step in which the model providing server generates a third public key that is the public key of the completely quasi-isomorphic cryptography and is different from the first public key and the second public key, and the model providing. A step in which the server generates a third public key cryptography first private key in which the first private key is encrypted with the third public key, and a model providing server uses the third public key and the third public key. The step of transmitting the key encryption first private key to the service providing server and the service providing server re-encrypt the encryption learning model using the third public key received from the model providing server. The step of generating the dual encryption learning model and the service providing server are encrypted with the third public key using the third public key encryption first private key received from the model providing server. In this state, the dual encryption learning model may further include a step of decrypting the encryption by the first public key.

In the information processing method, the learning model obtains the processing target data by executing a combination of at least one of addition and multiplication of the processing target data of the learning model and the model parameters of the learning model. It may be configured to calculate the output of the learning model as an input.

A second aspect of the present invention is an information processing system including a model providing server and a service providing server that are connected to each other via a communication network in a manner capable of communicating with each other. In this system, the model providing server encrypts and encrypts the learning model using a model generator that generates a learning model using machine learning and a first public key that is a public key of fully homomorphic encryption. The encryption unit that generates the learning model, the transmission unit that transmits the encryption learning model to the service providing server and the first public key to the user terminal, and the public key of the fully homomorphic encryption. It includes a receiving unit that receives a second public key different from the first public key from the user terminal. The encryption unit uses the second public key to generate a second public key encryption first private key in which the first private key corresponding to the first public key is encrypted, and the transmission unit generates a first private key. The second public key encryption first private key is transmitted to the service providing server. Further, the service providing server receives the encryption learning model from the model providing server and encrypts the processing target data of the learning model from the user terminal using the first public key. Output of the learning model in which the processing target data encrypted with the first public key is input using the receiving unit that receives the data, the encryption learning model, and the encryption processing target data. A model execution unit that generates the first encrypted output, an encryption unit that generates a double encrypted output in which the first encrypted output is re-encrypted using the second public key, and the second. Public key encryption A second encryption obtained by decrypting the encryption by the first public key of the double encryption output while being encrypted by the second public key using the first private key. It includes a decryption unit that acquires the encrypted output and a transmission unit that transmits the second encrypted output to the user terminal.

According to the present invention, it is possible to provide a technique capable of acquiring a processing result while keeping the learning model and the data to be processed concealed.

It is a figure which shows typically the outline of the structure of the information processing system which concerns on embodiment. It is a figure which shows typically the functional structure of the model providing server, the service providing server, and the user terminal which concerns on embodiment. It is a figure which shows the first half part of the sequence diagram for demonstrating the flow of the process executed by the information processing system which concerns on embodiment. It is a figure which shows the latter half of the sequence diagram for demonstrating the flow of the process executed by the information processing system which concerns on embodiment. It is a figure which summarized the list of the data generated or acquired by the model providing server, the service providing server, and the user terminal which concerns on embodiment in a table format. It is a sequence diagram for demonstrating the update process of the encryption key executed in the information processing system which concerns on embodiment.

<Outline of the embodiment>
FIG. 1 is a diagram schematically showing an outline of the configuration of the information processing system S according to the embodiment. Hereinafter, an outline of the embodiment will be described with reference to FIG.

As shown in FIG. 1, the information processing system S according to the embodiment includes a model providing server 1, a service providing server 2, and a user terminal 3. The model providing server 1, the service providing server 2, and the user terminal 3 are connected to each other via the communication network N in such a manner that they can communicate with each other.

The model providing server 1 is a device that generates a learning model by machine learning. The learning model generated by the model providing server 1 is digital data configured to input data to be processed and output some processing result. As an example, the learning model generated by the model providing server 1 recognizes the subject included in the image data and outputs the type, number, location in the image, etc. of the subject when the image data is input as the processing target. It is an image recognition engine.

The service providing server 2 is a device that receives the learning model generated by the model providing server 1 and provides the service to the user. The service providing server 2 receives data to be processed from the user terminal 3 used by the user via the communication network N. Subsequently, the service providing server 2 applies the received data to the learning model and acquires the output. Finally, the service providing server 2 transmits the acquired output of the learning model to the user terminal 3 via the communication network N.

Here, the model providing server 1 transmits the learning model in which the learning model is encrypted with the public key of full homomorphic encryption (Fully Homomorphic. Encryption) to the service providing server 2. Further, the user terminal 3 receives the public key used for encrypting the learning model from the model providing server 1, encrypts the data to be processed by using the public key, and then sends the service providing server 2 to the service providing server 2. Send. That is, the service providing server 2 acquires the learning model encrypted with the same public key and the data to be processed.

Homomorphic encryption is a cipher that allows additive operations and multiplication operations while the data is encrypted. Specifically, the plaintexts of the two numerical values are designated as a and b, and the encrypted versions of a and b are designated as Enc (a) and Enc (b), respectively. Further, the encrypted addition a + b of a and b is referred to as Enc (a + b), and the encrypted multiplication a × b of a and b is referred to as Enc (a × b). At this time, the following equations (1) and (2) hold in the fully homomorphic encryption.
Enc (a) + Enc (b) = Enc (a + b) (1)
Enc (a) x Enc (b) = Enc (a x b) (2)

The learning model generated by the model providing server 1 according to the embodiment is a processing target by executing a combination of at least one of addition and multiplication of the processing target data of the learning model and the model parameters of the learning model. It is configured to calculate the output of a learning model that takes data as input. In other words, the learning model generated by the model providing server 1 according to the embodiment does not include a non-linear function such as a sigmoid function in the middle of processing, and includes only an addition operation or a multiplication operation. As a result, the service providing server 2 according to the embodiment acquires the learning model encrypted with the public key of the fully homomorphic encryption and the data to be processed, and the data to be processed in the encrypted state. Can be applied to the learning model.

The output obtained by applying the data to be processed by the service providing server 2 to the learning model is also in a state of being encrypted by the public key generated by the model providing server 1. Therefore, even if the service providing server 2 transmits the encrypted output to the user terminal 3, the user terminal 3 cannot confirm the output content.

Therefore, the service providing server 2 rewrites the output of the state encrypted with the public key generated by the model providing server 1 into the state encrypted with another public key generated by the user terminal 3 and then transmits the output to the user terminal 3. do. As a result, the user terminal 3 can confirm the output contents by decrypting the output with the private key owned by the user terminal 3.

As described above, according to the information processing system S according to the embodiment, the service providing server 2 and the user terminal 3 cannot acquire the learning model of the plaintext state. Further, the model providing server 1 and the service providing server 2 cannot acquire the processing target data in the plaintext state. Nevertheless, the user terminal 3 can acquire the result of applying the processing target data to the learning model. Therefore, the information processing system S according to the embodiment can acquire the processing result while keeping the learning model and the processing target data concealed, and can suppress leakage between the learning model and the processing target data.

<Functional configuration of model providing server 1, service providing server 2, and user terminal 3 according to the embodiment>
FIG. 2 is a diagram schematically showing the functional configurations of the model providing server 1, the service providing server 2, and the user terminal 3 according to the embodiment. The model providing server 1 includes a storage unit 10, a control unit 11, a transmission unit 12, and a reception unit 13. The service providing server 2 includes a storage unit 20, a control unit 21, a transmission unit 22, and a reception unit 23. The user terminal 3 includes a storage unit 30, a control unit 31, a transmission unit 32, and a reception unit 33.

The storage unit 10 includes a ROM (Read Only Memory) for storing the BIOS (Basic Input Output System) of the computer that realizes the model providing server 1, a RAM (Random Access Memory) that serves as a work area for the model providing server 1, and an OS (OS). It is a large-capacity storage device such as an HDD (Hard Disk Drive) or SSD (Solid State Drive) that stores an Operating System), an application program, and various information referred to when the application program is executed.

Similarly, the storage unit 20 includes a ROM that stores the BIOS and the like of the computer that realizes the service providing server 2, a RAM that is a work area of the service providing server 2, an OS and an application program, and various references that are referred to when the application program is executed. It is a large-capacity storage device such as an HDD or SSD that stores the information of the above. Further, the storage unit 30 stores a ROM that stores the BIOS and the like of the computer that realizes the user terminal 3, a RAM that is a work area of the user terminal 3, an OS and an application program, and various information that is referred to when the application program is executed. It is a large-capacity storage device such as an HDD or SSD for storing.

The control unit 11 is a processor such as a CPU or GPU of the model providing server 1, and functions as a model generation unit 110, a key generation unit 111, and an encryption unit 112 by executing a program stored in the storage unit 10. .. Similarly, the control unit 21 is a processor such as a CPU or GPU of the service providing server 2, and serves as a model execution unit 210, an encryption unit 211, and a decryption unit 212 by executing a program stored in the storage unit 20. Function. Further, the control unit 31 is a processor such as a CPU or GPU of the user terminal 3, and functions as an encryption unit 310, a key generation unit 311 and a decryption unit 312 by executing a program stored in the storage unit 30. ..

Note that FIG. 2 shows an example in which the model providing server 1 and the service providing server 2 are configured by a single device. However, the model providing server 1 and the service providing server 2 may be realized by computing resources such as a plurality of processors and memories, such as a cloud computing system. In this case, each unit constituting the control unit 11 and the control unit 21 is realized by executing a program by at least one of a plurality of different processors.

<Sequence diagram of processing executed by information processing system S>
FIG. 3 is a diagram showing a first half of a sequence diagram for explaining a flow of processing executed by the information processing system S according to the embodiment. Further, FIG. 4 is a diagram showing a latter half of a sequence diagram for explaining a flow of processing executed by the information processing system S according to the embodiment. Hereinafter, the processes executed by the model providing server 1, the service providing server 2, and the user terminal 3 in cooperation with each other will be described with reference to FIGS. 2, 3, and 4.

The model generation unit 110 generates a learning model using machine learning (S2). Specifically, the model generation unit 110 generates a learning model by processing the learning data collected in advance by known machine learning such as a neural network, SVM (Support Vector Machine), and boosting. Here, when a non-linear function is used in a known learning model, the model generation unit 110 executes learning after replacing it with a learning model having only multiplication operations and addition operations by approximating it with a linear function in advance. do.

The key generation unit 111 generates an encryption key of a public key system of fully homomorphic encryption (S4). Since it is a public key cryptographic key, the key generation unit 111 generates a public key and a private key corresponding to the public key. As will be described later, the encryption key of the public key system of fully homomorphic encryption is also generated by the service providing server 2. Therefore, the public key generated by the key generation unit 111 is described as "first public key pk1" or simply "pk1". Similarly, the first private key is described as "first secret key sk1" or simply "sk1". The key generation unit 111 and the service providing server 2 may use, for example, a BVG system (Brakerski-Gentry-Vaikuntanathan cryptosystem) encryption as the fully homomorphic encryption.

The encryption unit 112 encrypts the learning model using the first public key pk1 to generate an encryption learning model (S6). Hereinafter, the learning model will be referred to as "learning model w" or simply "w". Further, the learning model w encrypted with the first secret key sk1 is described as "encryption learning model Enc (pk1, w)" or simply "Enc (pk1, w)". Hereinafter, the data obtained by encrypting the data d using the public key pk will be described as Enc (pk, d).

The transmission unit 12 transmits the encryption learning model Enc (pk1, w) to the service providing server 2 (S8). Further, the transmission unit 12 transmits the first public key pk1 to the user terminal 3 (S10).

The receiving unit 33 of the user terminal 3 receives the first public key pk1 transmitted from the model providing server 1 (S12). The encryption unit 310 encrypts the processing target data x of the learning model w using the first public key pk1 to generate the encryption processing target data Enc (pk1, x) (S14).

The key generation unit 311 is a second cipher including a second public key pk2 which is a public key of fully homomorphic encryption and is different from the first public key pk1 and a second private key sk2 corresponding to the second public key pk2. Generate a key (S16). The transmission unit 32 transmits the second public key pk2 to the model providing server 1 and the service providing server 2 (S18).

The receiving unit 13 of the model providing server 1 receives the second public key pk2 from the user terminal 3 (S20). Further, the receiving unit 23 of the service providing server 2 receives the encryption learning model Enc (pk1, w) from the model providing server 1 (S22). The receiving unit 23 receives the second public key pk2 from the user terminal 3 (S24).

The transmission unit 32 of the user terminal 3 transmits the encryption processing target data Enc (pk1, x) to the service providing server 2 (S26). The receiving unit 23 of the service providing server 2 receives the encryption processing target data Enc (pk1, x) from the user terminal 3 (S28).

The encryption unit 112 of the model providing server 1 encrypts the first private key sk1 using the second public key pk2 received from the user terminal 3. Second public key encryption First private key Enc (pk2, sk1) Is generated (S30). The transmission unit 12 transmits the second public key encryption first private key Enc (pk2, sk1) to the service providing server 2 (S32).

The receiving unit 23 of the service providing server 2 receives the second public key encryption first private key Enc (pk2, sk1) from the model providing server 1 (S34). The model execution unit 210 uses the encryption learning model Enc (pk1, w) and the encryption processing target data Enc (pk1, x) to obtain the processing target data x encrypted with the first public key pk1. first encryption output Enc is the output of the learning model w to input to generate a _{(pk1, f w (x)} ) (S36).

Encryption unit 211 first encrypts the output _{Enc (pk1, f w (x} )) , and the second two were re-encrypted using the public key pk2 double encrypted output Enc received from the user terminal 3 (pk2, Enc (pk1, f _w (x))) is generated (S38).

The decryption unit 212 uses the second public key encryption first private key Enc (pk2, sk1) received from the model providing server 1 to perform double encryption output while being encrypted with the second public key pk2. _{Enc (pk2, Enc (pk1,} f w (x))) first second encryption output Enc obtained by decrypting the encrypted public key _{pk1 (pk2, f w (x} )) to get out of ( S40). Transmission unit 22 transmits the second encrypted output _{Enc (pk2, f w (x} )) to the user terminal 3 (S42).

Receiver 33 of the user terminal 3 receives from the service providing server 2 second encrypted output _{Enc (pk2, f w (x} )) (S44). Decoding unit 312, using the second secret key sk2, second encrypted output second encrypted output Enc received from the service providing server _{2 (pk2, f w (x} )) for decoding the (S46). _{As a result, the user terminal 3 can obtain the output fw} (x) of the learning model w that inputs the unencrypted processing target data x.

5 (a)-(c) is a diagram in which a list of data generated or acquired by the model providing server 1, the service providing server 2, and the user terminal 3 according to the embodiment is summarized in a table format. As shown in FIG. 5A, the model providing server 1 generates the learning model w, the first public key pk1, and the first private key sk1, and acquires the second public key pk2 from the user terminal 3. The model providing server 1 also generates a second public key encryption first private key Enc (pk2, sk1) in which the first private key sk1 is encrypted using the second public key pk2.

As shown in FIG. 5B, the service providing server 2 receives the encryption learning model Enc (pk1, w) and the second public key encryption first private key Enc (pk2, sk1) from the model providing server 1. get. Further, the service providing server 2 acquires the second public key pk2 and the encryption processing target data Enc (pk1, x) from the user terminal 3.

_{The service providing server 2 generates the first encryption output Enc (pk1, f w} (x)) based on the encryption learning model Enc (pk1, w) and the encryption processing target data Enc (pk1, x). do. The service providing server 2 uses the second public key pk2 to encrypt the first encrypted output Enc (pk1, f _w (x)), and the double encrypted output Enc (pk2, Enc (pk1, f _w (x)). ))) Is generated. Further, the service providing server 2 decrypts the double encryption output Enc (pk2, Enc (pk1, f _w (x))) by using the second public key encryption first private key Enc (pk2, sk1). The second encrypted output Enc (pk2, f _w (x)) is also generated.

As shown in FIG. 5C, the user terminal 3 generates the processing target data x, the second public key pk2, and the second private key sk2. The user terminal 3 acquires the first public key pk1 from the model providing server 1. The user terminal 3 generates the encryption processing target data Enc (pk1, x) in which the processing target data x is encrypted using the first public key pk1. Furthermore, the user terminal 3 acquires from the service providing server 2 second encrypted output _{Enc (pk2, f w (x} )). The user terminal 3, by decoding the second encrypted output _{Enc (pk2, f w (x} )) using the second secret key sk2, the output _f w of the learning model w to enter processing target data x ( x) is generated.

As described above, the learning model w generated by the model providing server 1 according to the embodiment is not transmitted to the service providing server 2 or the user terminal 3 as it is in plain text. Further, neither the service providing server 2 nor the user terminal 3 acquires the private key for decrypting the encrypted learning model w. Therefore, the information processing system S according to the embodiment can conceal the learning model w and suppress the leakage of the learning model w.

Further, the processing target data x generated by the user terminal 3 according to the embodiment is not transmitted to the model providing server 1 or the service providing server 2 in plain text. Further, neither the model providing server 1 nor the service providing server 2 acquires the private key for decrypting the encrypted processing target data x. Therefore, the information processing system S according to the embodiment can conceal the processing target data x and suppress the leakage of the processing target data x.

(Update of encryption key of learning model w)
As described above, the model providing server 1 according to the embodiment transmits the learning model w in an encrypted state to the service providing server 2. Here, if the public key that encrypts the learning model w can be updated periodically, the learning model can be protected from leakage even if the private key corresponding to the public key is leaked. Therefore, the update process of the public key that encrypts the learning model w will be described below.

FIG. 6 is a sequence diagram for explaining the encryption key update process executed by the information processing system S according to the embodiment. The key generation unit 111 of the model providing server 1 corresponds to a third public key pk3, which is a public key of fully homomorphic encryption and is different from the first public key pk1 and the second public key pk2, and a third public key pk3. A third encryption key including the third private key sk3 is generated (S48).

The encryption unit 112 generates a third public key encryption first private key Enc (pk3, sk1) in which the first private key sk1 is encrypted with the third public key pk3 (S50). The transmission unit 12 transmits the third public key pk3 and the third public key encryption first private key Enc (pk3, sk1) to the service providing server 2 (S52).

The receiving unit 23 of the service providing server 2 receives the third public key pk3 and the third public key encrypted first private key Enc (pk3, sk1) from the model providing server 1 (S54). The encryption unit 211 re-encrypts the encryption learning model Enc (pk1, w) using the third public key pk3, and double-encryption learning model encryption learning model Enc (pk3, Enc (pk1, w)). ) Is generated (S56).

The decryption unit 212 uses the third public key encryption first private key Enc (pk3, sk1) to perform the double encryption learning model encryption learning model Enc (in the state of being encrypted with the third public key pk3). Of the pk3, Enc (pk1, w)), the encryption by the first public key pk1 is decrypted (S58). As a result, the decryption unit 212 can generate Enc (pk3, w), which is a learning model w encrypted with the third public key pk3.

From the above, the information processing system S can update the encryption key of the learning model w held by the service providing server 2. For example, the learning model w generated by machine learning using a large amount of learning data on the order of hundreds of thousands to one million has a large data size, and the data size after encryption is also the same. Therefore, as compared with the case where the model providing server 1 encrypts the learning model w with the third public key pk3 and then transmits the learning model w to the service providing server 2, the above-mentioned encryption key update process is the data via the communication network N. It is advantageous in that the amount can be significantly reduced.

<Effects of the model providing server 1 according to the embodiment>
As described above, according to the model providing server 1 according to the embodiment, it is possible to acquire the processing result while keeping the learning model and the processing target data concealed.

Although the present invention has been described above using the embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments, and various modifications and changes can be made within the scope of the gist thereof. be. For example, the specific embodiment of the distribution / integration of the device is not limited to the above embodiment, and all or a part thereof may be functionally or physically distributed / integrated in any unit. Can be done. Also included in the embodiments of the present invention are new embodiments resulting from any combination of the plurality of embodiments. The effect of the new embodiment produced by the combination has the effect of the original embodiment together.

1 ... Model providing server 10 ... Storage unit 11 ... Control unit 110 ... Model generation unit 111 ... Key generation unit 112 ... Encryption unit 12 ... Transmission unit 13 ... Reception unit 2 ... Service providing server 20 ... Storage unit 21 ... Control unit 210 ... Model execution unit 211 ... Encryption unit 212 ... Decryption unit 22 ... Transmission unit 23 ...・ Reception unit 3 ・ ・ ・ User terminal 30 ・ ・ ・ Storage unit 31 ・ ・ ・ Control unit 310 ・ ・ ・ Encryption unit 311 ・ ・ ・ Key generation unit 312 ・ ・ ・ Decryption unit 32 ・ ・ ・ Transmission unit 33 ・ ・・ Receiver N ・ ・ ・ Communication network S ・ ・ ・ Information processing system

Claims (4)

An information processing method executed in an information processing system including a model providing server, a service providing server, and a user terminal that are connected to each other via a communication network.
A step of generating an encryption learning model by encrypting a learning model created by the model providing server using machine learning using a first public key which is a public key of fully homomorphic encryption.
A step in which the model providing server transmits the encryption learning model to the service providing server,
A step in which the model providing server transmits the first public key to the user terminal,
A step in which the user terminal encrypts the processing target data of the learning model using the first public key received from the model providing server to generate the encryption processing target data.
A step in which the user terminal transmits the data to be encrypted and a second public key which is the public key of the fully homomorphic encryption and is different from the first public key to the service providing server.
A step in which the user terminal transmits the second public key to the model providing server, and
A step in which the model providing server generates a second public key encryption first private key in which the first private key corresponding to the first public key is encrypted using the second public key received from the user terminal. When,
A step in which the model providing server transmits the second public key encryption first private key to the service providing server.
The state in which the service providing server is encrypted with the first public key using the encryption learning model received from the model providing server and the encryption processing target data received from the user terminal. The step of acquiring the first encrypted output, which is the output of the learning model that inputs the data to be processed, and
A step in which the service providing server generates a double encrypted output in which the first encrypted output is re-encrypted using the second public key.
The service providing server uses the second public key encryption first private key to encrypt the double encryption output with the first public key while being encrypted with the second public key. And the step to obtain the second encrypted output obtained by decrypting
A step in which the service providing server transmits the second encrypted output to the user terminal, and
A step in which the user terminal decrypts the second encrypted output received from the service providing server by using the second private key corresponding to the second public key.
Information processing methods including. A step in which the model providing server generates a third public key that is the public key of the fully homomorphic encryption and is different from the first public key and the second public key.
A step in which the model providing server generates a third public key encryption first private key in which the first private key is encrypted with the third public key.
A step in which the model providing server transmits the third public key and the third public key encryption first private key to the service providing server.
A step in which the service providing server re-encrypts the encryption learning model using the third public key received from the model providing server to generate a double encryption learning model.
Of the double encryption learning model, the service providing server uses the third public key encryption first private key received from the model providing server and remains encrypted with the third public key. The step of decrypting the encryption by the first public key and
The information processing method according to claim 1, further comprising. The learning model receives the processing target data as input by executing a combination of at least one of addition and multiplication of the processing target data of the learning model and the model parameters of the learning model. Is configured to calculate the output of,
The information processing method according to claim 1 or 2. An information processing system that includes a model-providing server and a service-providing server that connect to each other via a communication network.
The model providing server is
A model generator that generates a learning model using machine learning,
An encryption unit that encrypts the learning model using the first public key, which is the public key of fully homomorphic encryption, and generates an encryption learning model.
A transmission unit that transmits the encryption learning model to the service providing server and also transmits the first public key to the user terminal.
It includes a receiving unit that receives a second public key, which is the public key of the fully homomorphic encryption and is different from the first public key, from the user terminal.
The encryption unit uses the second public key to generate a second public key encryption first private key in which the first private key corresponding to the first public key is encrypted.
The transmitting unit transmits the second public key encryption first private key to the service providing server.
The service providing server is
A receiving unit that receives the encryption learning model from the model providing server and also receives the encryption processing target data obtained by encrypting the processing target data of the learning model from the user terminal using the first public key.
Using the encryption learning model and the encryption processing target data, a first encryption output, which is an output of the learning model in which the processing target data encrypted with the first public key is input, is output. The model execution part to be generated and
An encryption unit that generates a double encrypted output in which the first encrypted output is re-encrypted using the second public key, and
The second public key encryption The first private key is used to decrypt the encryption by the first public key in the double encryption output while being encrypted by the second public key. A decryption unit that acquires the second encrypted output,
A transmission unit that transmits the second encrypted output to the user terminal is provided.
Information processing system.

Images