JP6916596B2 - Arithmetic system, arithmetic method and arithmetic program - Google Patents

Description

The present invention relates to an arithmetic system, an arithmetic method, and an arithmetic program for calculating a secret binary value.

Conventionally, as a means for calculating confidential information, a cryptographic method called homomorphic encryption such as Paillier encryption (see, for example, Non-Patent Document 1) or modified-Elgamal encryption, which enables addition or multiplication operations while the value is encrypted. Is used.

Pascal Paillier, Public-Key Cryptosystems Based on Composite Degree Resin Classes, EUROCRYPT 1999, pp223-238.

The above-mentioned homomorphic encryption can be used to obtain the distance between two points while concealing the position information. However, since the processing load of the operation by homomorphic encryption is large, the processing time is enormous when targeting a large-scale data set.

An object of the present invention is to provide an arithmetic system, an arithmetic method, and an arithmetic program capable of performing concealed binary addition / subtraction at high speed.

The arithmetic system according to the present invention includes a first node that holds a first value, a second node that holds a second value, and a third node that calculates the first value and the second value. The first node generates at least one matrix having an calculated value using a parameter group as an element with respect to the first value, and the second node with respect to the second value. Therefore, at least one matrix whose elements are the calculated values using the parameter group whose product with the parameter group is constant is generated, and the third node is generated by each of the first node and the second node. Based on some elements of the result obtained by multiplying the obtained matrices, the value of the arithmetic expression including the sum or difference of the first value and the second value is output.

The third node may output the product of the sum or difference squared of the first value and the second value and the constant.

The first node generates a first matrix and a second matrix whose elements are calculated values using the first parameter group and the second parameter group, and the second node generates the first parameter. A third element having a calculated value using a third parameter group in which the product with the group is the first constant and a fourth parameter group in which the product with the second parameter group is the second constant. And the fourth matrix are generated, and the third node is based on some elements of the matrix obtained by multiplying the first matrix and the third matrix. And one of the matrices obtained by multiplying the second matrix and the fourth matrix after outputting the sum of a part of each of the two arithmetic expressions including the sum or difference of the second values. A value obtained by summing up the remaining parts of the two arithmetic expressions may be output based on the elements of the parts.

The first node generates a first matrix and a second matrix whose elements are calculated values using the first parameter group and the second parameter group, and the second node generates the first parameter. A third element having a calculated value using a third parameter group in which the product with the group is the first constant and a fourth parameter group in which the product with the second parameter group is the second constant. And the fourth matrix are generated, and the third node is based on some elements of the matrix obtained by multiplying the first matrix and the third matrix. And a matrix obtained by multiplying the second matrix and the fourth matrix with a node that outputs a value obtained by summing a part of each of the two arithmetic expressions including the sum or difference of the second value. Based on some elements, it may be separated into a node that outputs a value obtained by summing the remaining parts of the two arithmetic expressions.

The first node multiplies the generated matrix and the random matrix and provides them to the third node, and the second node multiplies the inverse matrix of the random matrix and the generated matrix and provides them to the third node. You may.

The calculation method according to the present invention includes a first node that holds a first value, a second node that holds a second value, and a third node that calculates the first value and the second value. In an arithmetic system including, the first node generates at least one matrix having an arithmetic value using a parameter group as an element for the first value, and the second node is the second. For the value of, at least one matrix whose elements are the calculated values using the parameter group whose product with the parameter group is constant is generated, and the third node is the first node and the second node. Based on some elements of the result obtained by multiplying the matrices generated by each of the above, the value of the arithmetic expression including the sum or difference of the first value and the second value is output.

The arithmetic program according to the present invention causes a computer to function as the first node, the second node, or the third node.

According to the present invention, concealed binary addition / subtraction can be performed at high speed.

It is a figure which shows the structure of the arithmetic system which concerns on 1st Embodiment. It is a flowchart which shows the calculation method which concerns on 1st Embodiment. It is a flowchart which shows the calculation method which concerns on 2nd Embodiment. It is a flowchart which shows the calculation method which concerns on 3rd Embodiment.

[First Embodiment]
Hereinafter, the first embodiment of the present invention will be described.
FIG. 1 is a diagram showing a configuration of an arithmetic system 1 according to the present embodiment.

The calculation system 1 has a node X (first node) and a node Y (second node) that hold one of the first value p and the second value q, which are the calculation targets, and a node that performs binary calculation. It has a Z (third node).
Node X and node Y provide node Z with a matrix in which the values p and q are concealed by parameters based on the constant r.
Node Z provides the calculation result to node X, node Y, or another node, and the node that receives the calculation result calculates the sum or difference of the two values based on the given information (constant r). ..

Here, each node X, Y, and Z is composed of an information processing device (computer) such as a server or a PC, and the control unit of each node executes a predetermined program (calculation program) stored in the storage unit of each node. By executing it, the function of this embodiment is realized.

FIG. 2 is a flowchart showing a calculation method according to the present embodiment.
Here, the node X acquires the sum or difference between the numerical value p held by the node X and the numerical value q held by the node Y by using the calculation result of the node Z.

In step S1, between node X and node Y, a random constant r and a parameter group a ₁ , a ₂ , b ₁ , b ₂ , c ₁ , c ₂ , d ₁ , d ₂ , and a random constant r satisfying the following equation, and Arrange a random 2x2 matrix R.
a ₁ a ₂ = b ₁ c ₂ = c ₁ b ₂ = d ₁ d ₂ = r

In step S2, the node X generates a matrix A whose elements are calculated values using the parameter group for the numerical value p, and holds the product AR with the random matrix R. The matrix A is generated, for example, as in the following equation.

In step S3, the node Y generates a matrix B whose elements are calculated values using the parameter group for the numerical value q, and holds a product R ^{-1 B with the inverse matrix R -1 of the random matrix R.} The matrix B is generated, for example, as in the following equation.

続いて、ノードＺは、行列ＡＢの要素のうち、１行１列及び２行２列の値を足す。
ａ_１ａ_２ｐ^２＋ｂ_１ｃ_２ｑ^２±２ｃ_１ｂ_２ｐｑ＝ｒ（ｐ±ｑ）^２
ステップＳ７において、ノードＺは、計算結果ｒ（ｐ±ｑ）^２を、ノードＸへ送信する。 In step S4, node X transmits the matrix AR to node Z.
In step S5, node Y ^{transmits the matrix R -1} B to node Z.
In step S6, node Z multiplies the matrices received from node X and node Y to ^{generate matrix ARR -1} B = AB.

Subsequently, the node Z adds the values of 1 row 1 column and 2 rows 2 columns among the elements of the matrix AB.
a ₁ a ₂ p ² + b ₁ c ₂ q ² ± 2c ₁ b ₂ pq = r (p ± q) ²
In step S7, the node Z transmits the calculation result r (p ± q) ² to the node X.

In step S8, the node X divides the received calculation result r (p ± q) ² by the constant r to calculate the sum or difference of the two values, or further obtains the square root and calculates the sum or difference of the two values. do.
When the calculation result is provided to a node different from the node X or the node Y, the constant r is also provided to this node.

とし、積ＡＢの１行１列及び２行２列の値を足すと、前述と同様にｒ（ｐ±ｑ）^２が得られる。
また、例えば、

とし、積ＡＢの１行２列及び２行１列の値を足すと、前述と同様にｒ（ｐ±ｑ）^２が得られる。
このように、積ＡＢの要素のいずれかを組み合わせることにより、例えば（ｐ±ｑ）^２の展開式と定数ｒとの積が構成されるように、行列Ａ及びＢが設定されればよい。 Moreover, each element of the matrix A and B is not limited to the above-mentioned example. for example,

Then, by adding the values of the product AB in 1 row and 1 column and 2 rows and 2 columns, r (p ± q) ² is obtained in the same manner as described above.
Also, for example

Then, by adding the values of the product AB in 1 row and 2 columns and 2 rows and 1 column, r (p ± q) ² is obtained in the same manner as described above.
In this way, the matrices A and B may be set so that, for example, the product of the expansion equation of ^{(p ± q) 2} and the constant r is constructed by combining any of the elements of the product AB.

According to the present embodiment, the calculation system 1 calculates the values p and q using random parameters and keeps them in a state concealed by a matrix. Then, the calculation system 1 outputs a calculation result in which the sum or difference between the values p and q is concealed by the parameter from a part of the result of the matrix operation. Therefore, since the arithmetic system 1 can perform addition / subtraction only by simple matrix multiplication and numerical calculation, it is possible to perform concealed binary addition / subtraction at high speed even if there is a large amount of data.

Further, the arithmetic system 1 extracts the product of the sum or difference square of the values p and q and the constant r from some elements of the matrix. As a result, the arithmetic system 1 can efficiently perform calculations using the square of the difference, such as the Euclidean distance between two points.

Further, since the arithmetic system 1 holds the matrix generated from the values p and q by multiplying it by a random matrix, the safety is improved against leakage of the matrix and parameters.

[Second Embodiment]
Hereinafter, the second embodiment of the present invention will be described.
In this embodiment, node X and node Y conceal two matrices whose values p and q are concealed by two sets of parameter groups based on the first constant r and the second constant r'to node Z, respectively. offer.
Node Z provides the calculation result to node X, node Y, or another node, and the node that receives the calculation result calculates the sum or difference of the two values based on the given information (r + r'). ..

FIG. 3 is a flowchart showing a calculation method according to the present embodiment.
Here, the node X acquires the sum or difference between the numerical value p held by the node X and the numerical value q held by the node Y by using the calculation result of the node Z.

_{In step S11, the first parameter group a 1} , b ₁ , c ₁ , d ₁ and the third parameter group a ₂ , b ₂ correspond to a random constant r between the node X and the node Y. , and _c 2, _{d 2,} also 'in response to the second parameter group a' random constant _{r 1, b '1, c} ' 1, d '1 and the fourth set of parameters a' _{2 , b '2, c' 2} , d ' and a _2, arrange so as to satisfy the following equation. Also, random 2x2 matrices R and R'are negotiated between node X and node Y.
a ₁ a ₂ = b ₁ c ₂ = c ₁ b ₂ = d ₁ d ₂ = r
_{a '1 a' 2 = b} '1 c' 2 = c '1 b' 2 = d '1 d' 2 = r '

In step S12, the node X generates a first matrix A and a second matrix A'having the calculated values using the first parameter group and the second parameter group as elements for the numerical value p, respectively. Multiply the random matrices R and R'and hold AR and A'R'. The matrices A and A'are generated, for example, as in the following equation.

In step S13, the node Y generates a third matrix B and a fourth matrix B'having the calculated values using the third parameter group and the fourth parameter group as elements with respect to the numerical value q, respectively. Multiply the inverse matrix R -1 of the random matrix R and the inverse matrix ^{R'- 1} of R'to ^{hold R -1} B and R'- ¹ B'. The matrices B and B'are generated, for example, as in the following equation.

続いて、ノードＺは、行列ＡＢの要素のうち、１行１列及び２行２列の値を足す。
ａ_１ａ_２ｐ^２＋ｂ_１ｃ_２ｑ^２±２ｃ’_１ｂ’_２ｐｑ＝ｒ（ｐ^２＋ｑ^２）±２ｒ’ｐｑ
ステップＳ１７において、ノードＺは、計算結果を、ノードＸへ送信する。
ステップＳ１８において、ノードＺは、受信データ及び計算結果を削除する。 In step S14, node X transmits the matrix AR to node Z.
In step S15, node Y ^{transmits the matrix R -1} B to node Z.
In step S16, node Z multiplies the matrices received from node X and node Y to ^{generate matrix ARR -1} B = AB.

Subsequently, the node Z adds the values of 1 row 1 column and 2 rows 2 columns among the elements of the matrix AB.
^{_{a 1 a 2 p 2 + b}} 1 c 2 q 2 ± 2c '1 b' 2 pq = r (p 2 + q 2) ± 2r'pq
In step S17, the node Z transmits the calculation result to the node X.
In step S18, the node Z deletes the received data and the calculation result.

続いて、ノードＺは、行列ＡＢの要素のうち、１行１列及び２行２列の値を足す。
ａ’_１ａ’_２ｐ^２＋ｂ’_１ｃ’_２ｑ^２±２ｃ_１ｂ_２ｐｑ
＝ｒ’（ｐ^２＋ｑ^２）±２ｒｐｑ
ステップＳ２２において、ノードＺは、計算結果を、ノードＸへ送信する。
ステップＳ２３において、ノードＺは、受信データ及び計算結果を削除する。 In step S19, node X transmits the matrix A'R'to node Z.
In step S20, node Y transmits the ^{matrix R'-1 B'to node Z.}
In step S21, node Z multiplies the matrices received from node X and node Y to ^{generate the matrix A'R'R'-1} B'= A'B'.

Subsequently, the node Z adds the values of 1 row 1 column and 2 rows 2 columns among the elements of the matrix AB.
^{_{a '1 a' 2 p 2}} + b '1 c' 2 q 2 ± 2c 1 b 2 pq
= R'(p ² + q ² ) ± 2 rpq
In step S22, the node Z transmits the calculation result to the node X.
In step S23, the node Z deletes the received data and the calculation result.

In step S24, the node X ^{adds the received calculation result r (p 2} + q ² ) ± 2 r'pq and r'(p ² + q ² ) ± 2 rpq, divides by the constant (r + r'), and is the sum of the two values. Alternatively, the square of the difference, or the square root, is calculated to calculate the sum or difference of the two values.
When the calculation result is provided to a node different from the node X or the node Y, a constant (r + r') is also provided to this node.

According to the present embodiment, the arithmetic system 1 performs addition and subtraction of the values p and q using both the calculation result by the set of the matrices A and B and the calculation result by the set of the matrices A'and B'. Therefore, the arithmetic system 1 can further improve the confidentiality and improve the safety against leakage of the elements or parameters of each matrix.
Further, in the node Z, by deleting the data after transmitting the calculation result, the risk that the value p or q is obtained by combining the plurality of data is reduced.

The elements of the above-mentioned matrices A, A', B, B'in the present embodiment are examples, and by combining any element of the product AB and any element of the product A'B', for example. (P ± q) It may be set so that the product of the expansion formula of ^{2 and the constant (r + r') is constructed.}

[Third Embodiment]
Hereinafter, a third embodiment of the present invention will be described.
In the present embodiment, node X and node Y, the value p and q, the two matrices were concealed parameter group 2 set based on the first constant r and the second constant r ', the node Z ₁ and Provided to node Z _2.
Node Z ₁ and Node Z ₂ provide the operation result to node X or node Y, or another node, and the node receiving the operation result is the sum of the two values based on the given information (r + r'). Or calculate the difference.

FIG. 4 is a flowchart showing a calculation method according to the present embodiment.
Here, the node X acquires the sum or difference between the numerical value p held by the node X and the numerical value q held by the node Y by using the calculation results of the _{node Z 1} and the node Z _2.

Steps S31 to S33 are common to steps S11 to S13 of the second embodiment (FIG. 3).
In steps S34 to S41, steps S14 to S18 and steps S19 to S23 of the second embodiment (FIG. 3) are processed in parallel by the _{node Z 1} and the node Z _{2, respectively.}
Step S42 is common to step S24 of the second embodiment (FIG. 3).

According to the present embodiment, the arithmetic system 1 performs addition and subtraction of the values p and q using both the calculation result by the set of the matrices A and B and the calculation result by the set of the matrices A'and B'. Further, since the node Z is separated into two and each of them shares the matrix calculation, the _{data that can be acquired by each of the node Z 1} and the node Z ₂ is limited, and the safety is improved.
Further, the processing is speeded up by performing parallel processing on the node Z ₁ and the node Z _2.

[Application Example 1]
An application example 1 for calculating an n-dimensional Euclidean distance will be described according to any of the above embodiments.

と行列に変換する。 In the calculation of the n-dimensional Euclidean distance, for the points P (p ₁ , p ₂ , ..., P _n ) and the point Q (q ₁ , q ₂ , ..., q _n ) in the Cartesian coordinate system, Each ingredient,

And convert to a matrix.

となるので、１行１列及び２行２列の値を足すと、（ｐ_ｋ−ｑ_ｋ）^２が求まる。
したがって、各次元（ｋ）の成分を加算して、平方根を求めることにより、ｎ次元のユークリッド距離ｄ（Ｐ，Ｑ）が算出される。

The product of these matrices is

_{Therefore, (p k} − q _k ) ² can be obtained by adding the values of 1 row and 1 column and 2 rows and 2 columns.
Therefore, the n-dimensional Euclidean distance d (P, Q) is calculated by adding the components of each dimension (k) to obtain the square root.

[Application example 2]
An application example 2 for calculating a distance from latitude / longitude information will be described according to any of the above embodiments.

で与えられる。ただし、ａ及びｂは、それぞれ赤道半径及び極半径である。
したがって、前述の実施形態により（ｐ_１−ｑ_１）^２、（ｐ_２−ｑ_２）^２、ｐ_１＋ｑ_１を求め、この式に代入することで、地点間の距離が算出される。 According to official Hyubeni, and the point of longitude _{p 2} latitude _{p 1,} the distance d between point longitude _{q 2} latitude _{q 1} is

Given in. However, a and b are the equatorial radius and the polar radius, respectively.
Therefore, the distance between the points is calculated by _{obtaining (p 1} − q ₁ ) ² , (p ₂ −q ₂ ) ² , and p ₁ + q ₁ according to the above-described embodiment and substituting them into this equation.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. In addition, the effects described in the present embodiment merely list the most preferable effects arising from the present invention, and the effects according to the present invention are not limited to those described in the present embodiment.

The calculation method by the calculation system 1 is realized by software. When realized by software, the programs that make up this software are installed in the information processing device (computer). Further, these programs may be recorded on a removable medium such as a CD-ROM and distributed to the user, or may be distributed by being downloaded to the user's computer via a network. Further, these programs may be provided to the user's computer as a Web service via a network without being downloaded.

1 computing system X first node Y second node Z third node r first constant r 'second constant _{a 1, b 1, c 1} , d 1 first parameter group a' _1, b _'1, c _'1, d' ₁ second parameter group _{a 2, b 2, c 2} , d 2 third parameter group _{a '2, b' 2,} c '2, d' 2 fourth parameter group p first Value of 1 q Second value A First matrix A'Second matrix B Third matrix B'Fourth matrix R, R'Random matrix

Claims (6)

It includes a first node that holds a first value, a second node that holds a second value, and a third node that performs operations on the first value and the second value.
The first node generates at least one matrix whose elements are values concealed by a predetermined arithmetic expression using a random parameter group with respect to the first value.
The second node is a predetermined arithmetic expression using a parameter group in which the product of the second value and the parameter group is a random constant agreed between the first node and the second node. Generate at least one matrix whose elements are the values concealed by
Each of the predetermined arithmetic expressions used by the first node and the second node is based on a part of the matrix elements obtained by multiplying the matrices generated by the first node and the second node. And the arithmetic expression including the sum or difference of the second value is set to be configurable.
The third node multiplies the matrices generated by each of the first node and the second node, and based on some of the elements, adds or differs the first value and the second value. An arithmetic system that outputs the value of an arithmetic expression that includes it. The arithmetic system according to claim 1, wherein the third node outputs a product of the sum or difference square of the first value and the second value and the constant. The first node generates a first matrix and a second matrix whose elements are values concealed by a predetermined arithmetic expression using a random first parameter group and a second parameter group.
The second node is a third parameter group in which the product with the first parameter group is a random first constant negotiated between the first node and the second node, and the second parameter. A third element whose element is a value concealed by a predetermined arithmetic expression using a fourth parameter group in which the product with the group becomes a random second constant agreed between the first node and the second node. And a fourth matrix,
Each of the predetermined arithmetic expressions for generating the first matrix and the third matrix in the first node and the second node is obtained by multiplying the first matrix and the third matrix. Based on a part of the elements of the obtained matrix, an expression obtained by summing a part of each of two arithmetic expressions including the sum or difference of the first value and the second value is set to be configurable.
Each of the predetermined arithmetic expressions for generating the second matrix and the fourth matrix in the first node and the second node is obtained by multiplying the second matrix and the fourth matrix. Based on a part of the elements of the obtained matrix, an expression obtained by summing the remaining parts of the two arithmetic expressions including the sum or difference of the first value and the second value is set to be configurable. ,
The third node is
After outputting the said first matrix based on some elements of the third matrix and the multiplying was obtained matrix, the value which is the sum of some respective front SL two arithmetic expressions,
Claim 1 or claim 1 or which outputs a value obtained by summing up the remaining parts of the two arithmetic expressions based on a part of the elements of the matrix obtained by multiplying the second matrix and the fourth matrix. The arithmetic system according to claim 2. The first node generates a first matrix and a second matrix whose elements are values concealed by a predetermined arithmetic expression using a random first parameter group and a second parameter group.
The second node is a third parameter group in which the product with the first parameter group is a random first constant negotiated between the first node and the second node, and the second parameter. A third element whose element is a value concealed by a predetermined arithmetic expression using a fourth parameter group in which the product with the group becomes a random second constant agreed between the first node and the second node. And a fourth matrix,
Each of the predetermined arithmetic expressions for generating the first matrix and the third matrix in the first node and the second node is obtained by multiplying the first matrix and the third matrix. Based on a part of the elements of the obtained matrix, an expression obtained by summing a part of each of two arithmetic expressions including the sum or difference of the first value and the second value is set to be configurable.
Each of the predetermined arithmetic expressions for generating the second matrix and the fourth matrix in the first node and the second node is obtained by multiplying the second matrix and the fourth matrix. Based on a part of the elements of the obtained matrix, an expression obtained by summing the remaining parts of the two arithmetic expressions including the sum or difference of the first value and the second value is set to be configurable. ,
The third node is
A node for outputting said first matrix based on some elements of the third matrix and the multiplying was obtained matrix, the value which is the sum of some respective front SL two arithmetic expressions,
Based on a part of the elements of the matrix obtained by multiplying the second matrix and the fourth matrix, the node that outputs the sum of the remaining parts of the two arithmetic expressions is added to the node. The arithmetic system according to claim 1 or 2, which is separated. The first node multiplies the generated matrix and the random matrix and provides them to the third node.
The arithmetic system according to any one of claims 1 to 4, wherein the second node is provided to the third node by multiplying the inverse matrix of the random matrix and the generated matrix. In an arithmetic system including a first node holding a first value, a second node holding a second value, and a third node performing operations on the first value and the second value.
The first node generates at least one matrix whose elements are values concealed by a predetermined arithmetic expression using a random parameter group with respect to the first value.
A predetermined arithmetic expression using a parameter group in which the product of the parameter group with respect to the second value is a random constant agreed between the first node and the second node. Generate at least one matrix whose elements are the values concealed by
Each of the predetermined arithmetic expressions used by the first node and the second node is based on a part of the matrix elements obtained by multiplying the matrices generated by the first node and the second node. And the arithmetic expression including the sum or difference of the second value is set to be configurable.
The third node multiplies the matrices generated by each of the first node and the second node, and based on some of the elements, adds or differs the first value and the second value. An arithmetic method that outputs the value of an arithmetic expression that includes it.

Images