WO2022185391A1

WO2022185391A1 - Random number generation system, random number generation device, random number generation method, and program

Info

Publication number: WO2022185391A1
Application number: PCT/JP2021/007775
Authority: WO
Inventors: 真昇紀伊
Original assignee: 日本電信電話株式会社
Priority date: 2021-03-01
Filing date: 2021-03-01
Publication date: 2022-09-09

Abstract

A random number generation system according to an embodiment includes a first terminal for generating random number ciphertext following the Bernoulli distribution and a second terminal connected to the first terminal so as to be communicable therewith. The second terminal comprises a key generation unit that generates a bootstrap key to be used in TFHE bootstrap using a shared parameter with the first terminal, and a transmission unit that transmits the bootstrap key to the first terminal. The first terminal comprises a cipher generation unit that randomly generates ciphertext using the shared parameter, and a random number generation unit that, by executing an algorithm based on the TFHE bootstrap on the ciphertext using the bootstrap key and the shared parameter, generates the random number ciphertext. The algorithm changes the input of a BlindRotate algorithm included in the TFHE bootstrap into a predetermined polynomial, and makes the output of a SampleExtract algorithm the random number ciphertext.

Description

Random number generation system, random number generation device, random number generation method, and program

The present invention relates to a random number generation system, a random number generation device, a random number generation method, and a program.

　In recent years, there has been an increasing demand for the use of confidential information such as personal information and sales information. Therefore, attention is increasing to a secure computation technology that enables each participant to perform processing such as statistical processing on confidential information without leaking the confidential information to others. Secure computation technology is realized by techniques such as secret sharing and homomorphic encryption.

It is known that if the results processed by secure computation technology are disclosed to the participants as they are, there is a risk that some of the confidential information of each participant may be leaked from the output results. Therefore, a method of adding noise to the processing result of secure computation to achieve differential privacy is being researched. To implement such an approach, it is necessary to generate secure random numbers, i.e., random numbers that neither participant knows beyond a predetermined distribution. In particular, safely generating discrete numbers reduces to safely generating random numbers that follow a Bernoulli distribution Ber(p) for various p.

Techniques described in Non-Patent Documents 1 to 6 are known as techniques for generating encrypted random numbers that follow Bernoulli distribution.

However, the techniques described in Non-Patent Literatures 1 to 6 above include the following: Bernoulli distribution Ber (1/2 ) can be safely generated. In other words, there are only three conventional technologies: a technology that requires a large amount of communication, a technology that impairs security, and a technology that imposes large restrictions.

An embodiment of the present invention has been made in view of the above points, and aims to safely generate random numbers following the Bernoulli distribution Ber(p) with a small amount of communication for various p.

To achieve the above object, a random number generation system according to one embodiment includes a first terminal that generates a ciphertext of random numbers that follow Bernoulli distribution, and a second terminal that is communicably connected to the first terminal. wherein the second terminal uses a shared parameter with the first terminal to generate a bootstrap key used in bootstrapping of the TFHE method. and a transmitter that transmits the bootstrap key to the first terminal, the first terminal using the shared parameter to randomly generate a ciphertext; a random number generation unit that generates the ciphertext of the random number by executing an algorithm based on the TFHE bootstrap on the ciphertext using the bootstrap key and the shared parameter; The algorithm changes the input of the BlindRotate algorithm included in the bootstrap of the TFHE method into a predetermined polynomial, and the output of the SampleExtract algorithm is the ciphertext of the random number.

For various p, it is possible to safely generate random numbers following the Bernoulli distribution Ber(p) with a small amount of communication.

It is a figure which shows the whole structural example of the random-number generation system in one Example. FIG. 4 is a diagram showing a functional configuration example of a first participant terminal in one embodiment; FIG. 10 is a diagram showing an example of the functional configuration of a second participant terminal in one embodiment; FIG. 10 is a sequence diagram for explaining random number generation processing in one embodiment; It is a figure which shows the hardware configuration example of the computer in one Example.

An embodiment of the present invention will be described below. In this embodiment, based on the TFHE scheme, which is one of the fully homomorphic encryption schemes, a random number generator that can safely generate random numbers following the Bernoulli distribution Ber(p) for various p with a small amount of communication. System 1 will be described.

[Preparation]
The technology that is the premise of the present embodiment will be prepared below.

<Fully homomorphic encryption>
Homomorphic encryption is encryption that can perform calculation processing on encrypted data, and is described, for example, in Reference 1 below.

Reference 1: "Takuya Hayashi. "Secret computation using homomorphic cryptography and its applications". In: System/Control/Information 63.2 (2019), pp. 64-70.doi: 10.11509/isciesci.63.2_64."
In homomorphic encryption, an operation called "function evaluation" can be performed on the ciphertext. For example, Enc _k (a ₁ ) and Enc _k (a ₂ ) are obtained by encrypting data a ₁ and a ₂ with a key k. Furthermore, choose a two-variable function f(x ₁ , x ₂ ). Then, when the ciphertexts _Enck (a ₁ ) and _Enck (a ₂ ) are subjected to “evaluation of the function f”, the ciphertext _Enck ( f(a ₁ , a ₂ )) is obtained.

In general, the function f that can be evaluated in homomorphic encryption has restrictions for each specific scheme. For example, there is also a homomorphic encryption scheme in which only sums can be used as the function f. A homomorphic encryption scheme that does not have such restrictions and can perform “evaluation of function f” for any computable function f(x ₁ , x ₂ ) is called a fully homomorphic encryption scheme.

<TFHE method>
In this embodiment, the TFHE scheme, which is one of the fully homomorphic encryption schemes described in References 2 to 4 below, is used.

Reference 2: Ilaria Chillotti et al. "Faster Fully Homomorphic Encryption: Bootstrapping in Less Than 0.1 Seconds". In: Advances in Cryptology - ASIACRYPT 2016. Ed. by Jung Hee Cheon and Tsuyoshi Takagi. Lecture Notes in Computer Science. Berlin, Heidelberg: Springer, 2016, pp. 3-33. isbn: 978-3-662-53887-6. doi: 10.1007/978-3-662-53887-6_1.
Reference 3: Ilaria Chillotti et al. "Faster Packed Homomorphic Operations and Efficient Circuit Bootstrapping for TFHE". In: Advances in Cryptology - ASIACRYPT 2017. Ed. by Tsuyoshi Takagi and Thomas Peyrin. Lecture Notes in Computer Science. Cham: Springer International Publishing, 2017, pp. 377-408. isbn: 978-3-319-70694-8. doi: 10.1007/978-3-319-70694-8_14.
Reference 4: Ilaria Chillotti et al. TFHE: Fast Fully Homomorphic Encryption over the Torus. 421. Apr. 2, 2019. url: http://eprint.iacr.org/2018/421 (visited on 11/26/2020 ).
In the TFHE method, there are three types of ``using a torus'', ``three types of ciphertext formats (TLWE ciphertext, TRLWE ciphertext, and TGSW ciphertext)'', and ``bootstrap processing''. Characteristic. These three features are described below. In the following description, n and N are parameters of the TFHE method, and N is a sufficiently large power of 2.

・Taurus T
The TFHE method uses an algebraic structure called a torus for plaintext and ciphertext. A torus is a module of Z coefficients obtained as a remainder by an integer ring Z of the real number field R, and is represented by T. A real number in the interval (-1/2, 1/2) is taken as a representative element of the torus T.

• TLWE type ciphertext Of the three types of ciphertext formats used in the TFHE scheme, the TLWE type is the main one. A TLWE-type ciphertext key is a sequence of n 0s or 1s (s ₁ , . . . , s _n ). A method of creating a TLWE-type ciphertext corresponding to the plaintext m is as follows. First, randomly select n elements a ₁ , . . . , a _n of the torus. Also, a torus element e (this e is called noise) whose representative element is a very small real number is selected. At this time,

Then, a _TLWE type ciphertext (a ₁ , . . . , an , b) corresponding to the plaintext m is obtained.

- TRLWE-type ciphertext TRLWE-type ciphertext is used as an intermediate representation when performing various processes. The set of plaintexts of TRLWE-type ciphertexts is the remainder module T _N [X]=T[X]/(X ^N +1) of the polynomial module T [X] by the polynomial X ^N +1. T _N [X] is the module of Z[X]/(X ^N +1) coefficients.

TGSW-type ciphertext TGSW-type ciphertext is a plaintext that is an element of Z[X]/(X ^N +1). In particular, the TGSW type ciphertext of 0 or 1 is often used. The TFHE method can calculate the product of a TLWE-type ciphertext and a TGSW-type ciphertext. For example, the product of a TLWE type 1/2 ciphertext and a TGSW type 0 ciphertext results in a TLWE type 0 ciphertext.

- Bootstrapping In some fully homomorphic encryption including the TFHE scheme, it is necessary to perform a process called bootstrapping for each calculation (evaluation). A bootstrap key is used for this process. This bootstrap key is a TGSW type ciphertext of a TLWE type ciphertext key. Note that even if the bootstrap key is known, the TLWE-type ciphertext key cannot be known.

・Blind Rotate
References 3 and 4 above define an algorithm called BlindRotate. TRLWE-type ciphertext c _v of element v of T _N [X] and elements of n+1 Z/2NZ

and the bootstrap key to BlindRotate, the element of T _N [X]

of TRLWE type ciphertext is obtained. here,

is an integer.

・Sample Extract
References 2-4 above define an algorithm called SampleExtract. Let the plaintext corresponding to the TRLWE-type ciphertext c be an element m ₀ +m ₁ X+ . . . +m _N−1 X ^N−1 of T _N [X]. Each coefficient m ₀ , m ₁ , . . . , m _N−1 is an element of the torus T. At this time, the _TLWE type ciphertext corresponding to the constant term m0 can be obtained by using SampleExtract for the TRLWE type ciphertext c.

Bootstrap Algorithm An algorithm for bootstrapping the TLWE-type ciphertext c ₌ (a ₁ , . . . , an , b) will be described. First, all representative elements of elements a ₁ , . . . , an , b of _torus T are multiplied by 2N and rounded to the nearest integer. The integer thus obtained is

and Then these n+1 integers

and the polynomial

and the bootstrap key to run the BlindRotate algorithm. Then,

of _TRLWE -type ciphertext cR is obtained. where, as mentioned above,

is an integer.

Finally, the SampleExtract algorithm is executed for the _TRLWE type ciphertext cR, and the TLWE type ciphertext (0, . . . , 0, 1/4) is added to the TLWE type ciphertext thus obtained. If the initial TLWE-type ciphertext c corresponds to an element in the interval (-1/4, 1/4], then the final result is 1/2 ciphertext, otherwise 0 ciphertext sentence is obtained.

<Bernoulli distribution>
For real numbers p, where 0≤p≤1, the Bernoulli distribution Ber(p) is a distribution that yields 1 with probability p and 0 with probability 1-p.

[Example]
Examples of the present embodiment will be described below. The random number generation system 1 according to the present embodiment executes random number generation processing between two participant groups, one participant group is a random number encrypted with the other participant group's key, And we get random numbers following Bernoulli distribution. Therefore, in this embodiment, these two participant groups are A and B, and the participant group A is a random number encrypted with the key of the participant group B and is a random number that follows the Bernoulli distribution. will be explained. Although the term "participant group" is used, the number of participants belonging to each participant group may be one or more, and may not necessarily be plural.

<Overall composition>
First, an example of the overall configuration of the random number generation system 1 according to this embodiment will be described with reference to FIG. FIG. 1 is a diagram showing an example of the overall configuration of a random number generation system 1 in one embodiment.

As shown in FIG. 1, the random number generation system 1 in this embodiment includes one or more first participant terminals 10 used by each participant belonging to the participant group A, and each participant belonging to the participant group B. and one or more second participant terminals 20 used by each participant. The first participant terminal 10 and the second participant terminal 20 are communicably connected via a communication network such as the Internet.

<Functional configuration>
Next, functional configuration examples of the first participant terminal 10 and the second participant terminal 20 in this embodiment will be described with reference to FIGS. 2 and 3, respectively. 2 and 3 are diagrams showing functional configuration examples of the first participant terminal 10 and the second participant terminal 20, respectively, in one embodiment.

As shown in FIG. 2, the first participant terminal 10 in this embodiment has a preparation unit 101, a random number generation unit 102, and a storage unit 103.

The preparation unit 101 executes various preparation-related processes such as sharing parameters with the second participant terminal 20 and generating polynomials to be given to the BlindRotate algorithm.

The random number generation unit 102 generates encrypted random numbers that follow the Bernoulli distribution using an algorithm partially modified from the bootstrap algorithm.

The storage unit 103 stores parameters shared with the second participant terminal 20, random numbers generated by the random number generation unit 102, and the like.

As shown in FIG. 3, the second participant terminal 20 in this embodiment has a preparation section 201 and a storage section 202 .

The advance preparation unit 201 executes various preparation-related processes such as sharing parameters with the first participant terminal 10 and generating a bootstrap key.

The storage unit 202 stores parameters shared with the first participant terminal 10, bootstrap keys generated by the preparation unit 201, and the like.

<Random number generation processing>
Next, random number generation processing in this embodiment will be described with reference to FIG. FIG. 4 is a sequence diagram for explaining random number generation processing in one embodiment. Below, the probability p is assumed to be one of 0=0/N, 1/N, 2/N, . . . , N/N=1. where N is a parameter of the TFHE scheme mentioned in the above preparation. It is assumed that the participants belonging to the participant group A know this probability p.

First, the pre-preparation unit 101 of each first participant terminal 10 and the pre-preparation unit 201 of each second participant terminal 20 share the parameters of the TFHE method (for example, n, N, etc.) (step S101). . This parameter sharing may be done in any way.

The preparation unit 101 of each first participant terminal 10 uses a polynomial

is generated (step S102). where Np is an integer from 0 to N; Note that the above polynomial expresses 0 when Np=0.

Also, the advance preparation unit 201 of each second participant terminal 20 generates a secret key (TLWE-type ciphertext key) and a bootstrap key (step S103). As described above, the bootstrap key is a private key (TLWE ciphertext key) converted to TGSW ciphertext.

Then, the preparation unit 201 of each second participant terminal 20 transmits the bootstrap key generated in step S103 above to the first participant terminal 10 (step S104). At this time, if there are a plurality of participants belonging to the participant group A, the preparation unit 201 of each second participant terminal 20 sends the bootstrap key to the first participant terminals 10 of one or more participants. Send. As long as each first participant terminal 10 can receive one or more bootstrap keys, each second participant terminal 20 may transmit the bootstrap key in any way. For example, if each first participant terminal 10 can receive one or more bootstrap keys, there are second participant terminals 20 that do not transmit the bootstrap key among the plurality of second participant terminals 20. You may

On the other hand, the preparation unit 101 of each first participant terminal 10 that has received the bootstrap key selects one bootstrap key (step S105). That is, the preparation unit 101 of each first participant terminal 10 selects one bootstrap key from one or more bootstrap keys received from the second participant terminals 20 .

The above steps S101 to S105 are preparatory processes, which need to be executed before the following steps S106 to S107. It should be noted that the amount of communication required for this preparatory processing is independent of how many random numbers are generated.

The random number generator 102 of each first participant terminal 10 independently selects _n +1 real numbers a ₁ , . S106) These n+1 real numbers a ₁ , . . . a _n , b are private keys (second participant It can be regarded as TLWE type ciphertext c ₌ (a ₁ , .

Next, the random number generation unit 102 of each first participant terminal 10 generates the real _numbers a ₁ , . , a partially modified TFHE bootstrap algorithm is executed (step S107). That is, the random number generator 102 of each first participant terminal 10, in the TFHE bootstrap algorithm, gives the polynomial v to the BlindRotate algorithm as follows:

instead of the polynomial generated in the preparatory process

At the same time, the TLWE type ciphertext obtained by executing the SampleExtract algorithm is output as it is (that is, it is output without adding the TLWE type ciphertext (0, . . . , 0, 1/4)).

The TLWE type ciphertext obtained in this way is a ciphertext with probability p of 1/2 (=-1/2) and a ciphertext with probability 1-p of 0. That is, it is a ciphertext of random numbers following Bernoulli distribution Ber(p).

<Hardware configuration>
Next, the hardware configuration of the first participant terminal 10 and the second participant terminal 20 in this embodiment will be described. The first participant terminal 10 and the second participant terminal 20 in this embodiment are implemented by, for example, the hardware configuration of the computer 300 shown in FIG. FIG. 5 is a diagram showing a hardware configuration example of the computer 300 in one embodiment.

A computer 300 shown in FIG. Each of these pieces of hardware is communicably connected via a bus 307 .

The input device 301 is, for example, a keyboard, mouse, touch panel, or the like. The display device 302 is, for example, a display. Note that the computer 300 may not have at least one of the input device 301 and the display device 302 .

The external I/F 303 is an interface with an external device such as a recording medium 303a. The computer 300 can perform reading, writing, etc. of the recording medium 303 a via the external I/F 303 . Examples of the recording medium 303a include CD (Compact Disc), DVD (Digital Versatile Disk), SD memory card (Secure Digital memory card), USB (Universal Serial Bus) memory card, and the like.

A communication I/F 304 is an interface for connecting the computer 300 to a communication network. The processor 305 is, for example, various arithmetic devices such as a CPU (Central Processing Unit). The preparation unit 101 and the random number generation unit 102 included in the first participant terminal 10 are realized, for example, by processing that one or more programs installed in the first participant terminal 10 cause the processor 305 to execute. be. Similarly, the preparatory unit 201 of the second participant terminal 20 is implemented by, for example, processing that one or more programs installed in the second participant terminal 20 cause the processor 305 to execute.

The memory device 306 is, for example, various storage devices such as HDD (Hard Disk Drive), SSD (Solid State Drive), RAM (Random Access Memory), ROM (Read Only Memory), and flash memory. Note that the storage unit 103 of the first participant terminal 10 and the storage unit 202 of the second participant terminal 20 are realized by the memory device 306, for example.

The first participant terminal 10 and the second participant terminal 20 in this embodiment have the hardware configuration of the computer 300 shown in FIG. 5, thereby realizing the random number generation process described above. Note that the hardware configuration of the computer 300 shown in FIG. 5 is an example, and other hardware configurations may be used. For example, computer 300 may have multiple processors 305 and may have multiple memory devices 306 .

<Summary>
As described above, the random number generation system 1 according to the present embodiment applies the TFHE method to randomly generated ciphertext (that is, a set of n+1 random numbers is regarded as a ciphertext of random numbers). By applying an algorithm obtained by partially modifying the bootstrap used in , it is possible to generate ciphertexts of random numbers following Bernoulli distribution Ber(p). At this time, by taking advantage of the characteristics of the TFHE method, which is one of the fully homomorphic encryption methods, it became possible to overcome the problems of the conventional technology such as security, communication volume, and the inability to change the parameter p. .

Therefore, by using the random number generation system 1 according to the present embodiment, random numbers according to the Bernoulli distribution Ber(p) for various p, not limited to p = 1/2, can be generated in a form that can be used for secure calculation technology. It becomes possible to Also, in this case, it is possible to generate an encrypted random number with the same level of security as the conventional technology and with a smaller amount of communication.

The present invention is not limited to the specifically disclosed embodiments described above, and various modifications, alterations, combinations with known techniques, etc. are possible without departing from the scope of the claims. .

1 random number generation system 10 first participant terminal 20 second participant terminal 101 preparation unit 102 random number generation unit 103 storage unit 201 preparation unit 202 storage unit 301 input device 302 display device 303 external I/F
303a recording medium 304 communication I/F
305 processor 306 memory device 307 bus

Claims

A random number generation system including a first terminal for generating a ciphertext of random numbers following Bernoulli distribution and a second terminal communicably connected to the first terminal,
The second terminal is
a key generation unit that generates a bootstrap key that is used in bootstrapping of the TFHE method using a shared parameter with the first terminal;
a transmitting unit configured to transmit the bootstrap key to the first terminal;
The first terminal is
a cipher generator that randomly generates ciphertext using the shared parameter;
a random number generation unit that generates the ciphertext of the random number by executing an algorithm based on the TFHE bootstrap on the ciphertext using the bootstrap key and the shared parameter; ,
The algorithm is a random number generation system in which the input of the BlindRotate algorithm included in the bootstrap of the TFHE method is changed to a predetermined polynomial, and the output of the SampleExtract algorithm is the ciphertext of the random number.
The shared parameters include at least parameters n and N of the TFHE scheme;
2. The random number generating system according to claim 1, wherein the parameter p of said Bernoulli distribution is any one of 0/N, 1/N, . . . , N/N.
The predetermined polynomial is expressed as (1/2)(1+X+...+X Np-1 ) where Np is an integer from 0 to N (however, 0 when Np=0). 2. The random number generation system according to 2.
The cipher generator,
Randomly selecting n +1 real numbers a 1 , . . . , an , b to generate ciphertext c =(a 1 , . A random number generation system as described.
A random number generator for generating a ciphertext of random numbers following Bernoulli distribution,
a receiving unit that receives a bootstrap key used in bootstrapping of the TFHE method from another device that shares a shared parameter with the random number generation device;
a cipher generator that randomly generates ciphertext using the shared parameter;
a random number generator that generates the ciphertext of the random number by executing an algorithm based on the TFHE bootstrap on the ciphertext using the bootstrap key and the shared parameter; ,
The algorithm is a random number generator, wherein the input of the BlindRotate algorithm included in the bootstrap of the TFHE method is changed to a predetermined polynomial, and the output of the SampleExtract algorithm is the ciphertext of the random number.
A random number generation method used in a random number generation system including a first terminal for generating a ciphertext of random numbers following Bernoulli distribution and a second terminal communicably connected to the first terminal,
the second terminal
a key generation procedure for generating a bootstrap key used in bootstrapping of the TFHE method using the shared parameters with the first terminal;
a sending step of sending the bootstrap key to the first terminal;
the first terminal
A cipher generation procedure for randomly generating a ciphertext using the shared parameter;
and a random number generation procedure for generating the random number ciphertext by executing the TFHE bootstrap-based algorithm on the ciphertext using the bootstrap key and the shared parameter. ,
The algorithm is a method of generating random numbers, wherein the input of the BlindRotate algorithm included in the bootstrap of the TFHE method is changed to a predetermined polynomial, and the output of the SampleExtract algorithm is the ciphertext of the random number.
A program that causes a computer to function as a first terminal or a second terminal included in the random number generation system according to any one of claims 1 to 4.