WO2023058186A1

WO2023058186A1 - Information processing program, information processing method, and information processing apparatus

Info

Publication number: WO2023058186A1
Application number: PCT/JP2021/037125
Authority: WO
Inventors: 中村允一; 森永正信
Original assignee: 富士通株式会社
Priority date: 2021-10-07
Filing date: 2021-10-07
Publication date: 2023-04-13

Abstract

Provided is an information processing program that causes a computer to execute a process, the process being characterized by comprising: encrypting a secret input that is kept secret by a prover in zero-knowledge proof and input to a numerical calculation program and a secret output from the numerical calculation program by a first encryption process and a second encryption process, respectively; modifying the numerical calculation program into another numerical calculation program including a decryption process associated with the first encryption process, the numerical calculation program, and the second encryption process; transmitting first information including the other numerical calculation program, a public input that is made public by the prover and input to the numerical calculation program, and a public output from the numerical calculation program to a verifier in the zero-knowledge proof; and transmitting second information including the encrypted secret input and secret output, the other numerical calculation program, the public input, and the public output to a third party different from the prover and the verifier, wherein the third party generates a proof for a proposition in the zero-knowledge proof on the basis of the second information and transmits the generated proof to the verifier.　

Description

Information processing program, information processing method, and information processing apparatus

This case relates to an information processing program, an information processing method, and an information processing device.

A cryptographic technique called Zero Knowledge Proof (ZKP) is known that allows a prover to convince a verifier that a certain proposition is true while keeping part of the information about the proposition secret. In zero-knowledge proof, a prover generates data called proof (hereinafter simply referred to as proof) from information about a proposition and sends it to a verifier. The verifier verifies the validity of the transmitted proof. It is designed to be probabilistically difficult to generate a valid proof if the proposition is false. Therefore, if the proof is valid, the verifier can be convinced that the proposition is true (see Non-Patent Document 1, for example). Zero-knowledge proofs have been put into practical use in the blockchain field, such as the crypto asset Zcash and the layer 2 technology zkSync (see Patent Documents 1 and 2, for example).

By the way, generating the above-mentioned proof has a high computational load, and generates a huge amount of calculations. For this reason, there is a problem that it takes time to generate a proof when using a device such as a smart phone, which has a relatively small memory capacity and computing power compared to a high-spec computer.

In order to deal with this problem, a technology has been proposed that reduces the amount of calculation of the prover by entrusting the generation of the proof to a third party called a worker who is different from both the prover and the verifier (for example, non-patented Reference 2). On the other hand, generating a proof also requires confidential information such as inputs and outputs kept secret by the prover, which may lead to disclosure of confidential information to a third party. That is, there is a potential issue of the prover's privacy. As a technology that considers this privacy problem, a technology using a secret sharing method has been proposed (see, for example, Non-Patent Document 3).

JP 2021-064891 A U.S. Patent Application Publication No. 2020/0250320

However, in the case of technology using the secret sharing method, it is possible that the above-mentioned privacy problem can be solved to some extent, but the following problems may occur separately. For example, in the case of the secret sharing method, in order to distribute secret information, it is required to entrust generation of certificates to a plurality of third parties. In this case, if a certain percentage of a plurality of third parties collude, there is a risk that confidential information will leak out. In addition, according to Non-Patent Document 3, the amount of calculation for each of multiple third parties is about the same as the amount of calculation when entrusting the generation of proof to a single third party. The total amount of computation can also grow in proportion to the number of third parties.

Therefore, in one aspect, it is an object to provide an information processing program, an information processing method, and an information processing apparatus that suppress leakage of confidential information even if generation of a certificate is entrusted to a third party.

In one embodiment, the information processing program performs a first encryption process and a second encryption process on a secret input to a numerical calculation program and a secret output from the numerical calculation program, which are kept secret by a prover in a zero-knowledge proof, respectively. and modifying the numerical calculation program into another numerical calculation program including decryption processing paired with the first encryption processing, the numerical calculation program, and the second encryption processing, and modifying the numerical calculation program transmitting first information including a calculation program and public input to and public output from said numerical calculation program published by said prover to a verifier in said zero-knowledge proof, and encrypting said secret; causing a computer to execute a process of transmitting second information including the input and the secret output, the separate numerical calculation program, the public input and the public output to a third party different from the prover and the verifier; , the third party generates a proof of the proposition in the zero-knowledge proof based on the second information, and transmits the generated proof to the verifier.

Leakage of confidential information can be suppressed even if the generation of certificates is outsourced to a third party.

FIG. 1 is an example of an information processing system. FIG. 2 shows an example of the hardware configuration of the prover terminal. FIG. 3 shows an example of the hardware configuration of the verifier server. FIG. 4 is an example of the functional configuration of the prover terminal. FIG. 5 is an example of the functional configuration of the verifier server. FIG. 6 is an example of the functional configuration of the third party server. FIG. 7 is an example of a processing sequence diagram of the information processing system. FIG. 8 is a flow chart showing an example of the operation of the prover terminal. FIG. 9(a) is a diagram for explaining an example of a numerical calculation program. FIG. 9B is a diagram explaining an example of another numerical calculation program. FIG. 10 is a flow chart showing an example of the operation of the third party server. FIG. 11 is a flow chart showing an example of the operation of the verifier server. FIG. 12 is another example of the functional configuration of the prover terminal. FIG. 13 is a flow chart showing another example of the operation of the prover terminal.

Hereinafter, the form for carrying out this matter will be described with reference to the drawings.

(First embodiment)
As shown in FIG. 1 , the information processing system ST includes a prover terminal 100 , a verifier server 200 and a third party server 300 . The prover terminal 100 is an example of an information processing device, and is a terminal device that realizes a prover in zero-knowledge proof. The verifier server 200 is a server device that implements a verifier in zero-knowledge proof. The third party server 300 is a server device that implements a third party that is different from both the prover and the verifier. Third parties are sometimes called workers. The information processing system ST does not include a plurality of third party servers 300, but includes one third party server 300. FIG. That is, the information processing system ST includes a single third party server 300 .

Although a smartphone is shown as an example of the prover terminal 100 in FIG. 1, it may be a tablet terminal or a PC (Personal Computer). The first performance representing the performance of the third party server 300 is higher than the second performance representing the performance of the prover terminal 100 . For example, the memory capacity of the third party server 300 is higher than the memory capacity of the prover terminal 100 . Further, the number of cores and the clock frequency of the processor provided in the third party server 300 are higher than the number of cores and the clock frequency of the processor provided in the prover terminal 100 . Thus, the third party server 300 has higher performance than the prover terminal 100. FIG. The third performance representing the performance of the verifier server 200 may be approximately the same as the second performance, or may be higher than the second performance and lower than the first performance.

The prover terminal 100, the verifier server 200, and the third party server 300 are connected to each other. More specifically, the prover terminal 100, the verifier server 200, and the third party server 300 are connected via a wireless communication network NW1, a mobile base station BS, and a wired communication network NW2. For example, if the certifier terminal 100 is included in the communicable area AR of the mobile base station BS, the certifier terminal 100 is connected to the verifier server via the wireless communication network NW1, the mobile base station BS, and the wired communication network NW2. 200 and third party servers 300 . As the wireless communication network NW1, for example, there is a communication network using LTE (Long Term Evolution). The wired communication network NW2 includes communication networks such as LAN (Local Area Network) and the Internet.

The prover terminal 100 transmits the first information 10 to the verifier server 200 when, for example, the verifier server 200 requests proof in the zero-knowledge proof. Although the details will be described later, the first information 10 includes public information in which a part of the information regarding the proposition in the zero-knowledge proof is made public. In this embodiment, as an example, the proposition is that the prover terminal 100 knows the correct input and output (specifically, the input/output relationship between input and output) of the numerical calculation program. Public information includes public inputs and public outputs. A public input is an input to a numerical calculation program that the prover terminal 100 makes public. A public output is an output from a numerical calculation program that the prover terminal 100 makes public. Both the public input and the public output are part of the information about the proposition in the zero-knowledge proof. The first information 10 includes, in addition to public information, another numerical calculation program modified from the numerical calculation program.

Also, the prover terminal 100 transmits the second information 20 to the third party server 300 when the proof is requested. Although the details will be described later, the second information 20 includes the above-described public information and another numerical calculation program, as well as encrypted secret information in which the rest of the information related to the proposition in the zero-knowledge proof is kept secret and encrypted. I'm in. The encrypted secret information includes an encrypted secret input and an encrypted secret output. The encrypted secret input is the secret input encrypted in the first encryption process. The encrypted secret output is the secret output encrypted in the second encryption process. The first encryption process and the second encryption process are different. A secret input is an input to a numerical calculation program that is kept secret by the prover terminal 100 . The secret output is the output from the numerical calculation program that the prover terminal 100 keeps secret. Both secret input and secret output keep the rest of the information about the proposition in the zero-knowledge proof secret.

When the third party server 300 receives the second information 20 transmitted from the prover terminal 100, the third party server 300 generates a proof 30 related to the proposition in the zero-knowledge proof based on the received second information 20, and sends the generated proof 30 to the verifier. Send to server 200 . The verifier server 200 verifies the validity of the proof 30 based on the first information 10 sent from the prover terminal 100 and the proof 30 sent from the third party server 300 .

After verifying the correctness of the proof 30, the verifier server 200 sends the verification result regarding the correctness of the proposition to the prover terminal 100. Accordingly, the prover terminal 100 receives the verification result. For example, when the verifier server 200 determines that the proposition is true as a result of verifying the validity of the proof 30, the verifier server 200 transmits a verification result including true as a result of the validity of the proposition. Conversely, when the verifier server 200 determines that the proposition is false as a result of verifying the validity of the proof 30, the verifier server 200 transmits a verification result including false as a result of the validity of the proposition.

In this way, the prover terminal 100 can entrust the third-party server 300 with the process of generating the proof. The calculations executed by the prover terminal 100 are mainly encryption of secret information (specifically, secret input and secret output). Since encryption is much smaller than the amount of calculation that occurs when generating a proof, the calculation load (for example, the amount of calculation) on the prover terminal 100 can be reduced.

On the other hand, only the encrypted secret information (specifically, encrypted secret input and encrypted secret output) is disclosed to the third party server 300, and an attack on the third party server 300 occurs. However, there is little risk of confidential information being leaked. Also, even if unauthorized processing occurs in the third party server 300, there is little risk of leakage of confidential information. Furthermore, when the secret sharing method is used, the amount of calculation related to the process of generating the proof is proportional to the number of servers (see, for example, Non-Patent Document 3) by adopting a plurality of third-party servers 300. Since the third-party server 300 may be used, this is almost the same as when the prover terminal 100 generates the proof by itself.

The hardware configuration of the prover terminal 100 will be described with reference to FIG.

The prover terminal 100 includes a CPU (Central Processing Unit) 100A as a processor, RAM (Random Access Memory) 100B, ROM (Read Only Memory) 100C, and NVM (Non-Volatile Memory) 100D as memories. there is The prover terminal 100 also includes an RF (Radio Frequency) circuit 100E, an acceleration sensor 100F, and a camera 100G. An antenna 100N is connected to the RF circuit 100E. A CPU (not shown) that implements a communication function may be used instead of the RF circuit 100E. The camera 100G includes an image sensor such as CMOS (Complementary Metal Oxide Semiconductor) or CCD (Charge Coupled Device).

Furthermore, the prover terminal 100 includes a touch panel 100H as an input unit, a display 100I as a display unit, and a speaker 100J. The CPU 100A to the speaker 100J are interconnected by an internal bus 100K. That is, the prover terminal 100 can be realized by a smart device such as a smart phone or a tablet terminal, or a computer including a PC.

The information processing programs stored in the ROM 100C and NVM 100D are stored in the RAM 100B by the CPU 100A. As the CPU 100A executes the stored information processing program, the CPU 100A realizes various functions described later and executes various processes described later. In this way, a computer can be realized by cooperation of the CPU 100A and the RAM 100B. Moreover, an information processing method can be realized by the CPU 100A executing various kinds of processing. The information processing program may correspond to a flow chart described later.

The hardware configuration of the verifier server 200 will be described with reference to FIG. Note that the hardware configuration of the third party server 300 is basically the same as the hardware configuration of the verifier server 200, so detailed description thereof will be omitted.

The verifier server 200 includes a CPU 200A, a RAM 200B, a ROM 200C, and a network I/F (interface) 200D. Verifier server 200 may include at least one of HDD (Hard Disk Drive) 200E, input I/F 200F, output I/F 200G, input/output I/F 200H, and drive device 200I, if necessary. The CPU 200A to the drive device 200I are interconnected by an internal bus 200J.

An input device 710 is connected to the input I/F 200F. The input device 710 includes, for example, a keyboard and a mouse. A display device 720 is connected to the output I/F 200G. The display device 720 is, for example, a liquid crystal display. A semiconductor memory 730 is connected to the input/output I/F 200H. Examples of the semiconductor memory 730 include USB (Universal Serial Bus) memory and flash memory. The input/output I/F 200H reads programs stored in the semiconductor memory 730 . The input I/F 200F and the input/output I/F 200H are provided with USB ports, for example. The output I/F 200G has, for example, a display port.

A portable recording medium 740 is inserted into the drive device 200I. Portable recording media 740 include removable discs such as CD (Compact Disc)-ROM and DVD (Digital Versatile Disc). Drive device 200I reads a program recorded on portable recording medium 740 . The network I/F 200D has, for example, a LAN port. A network I/F 200D is connected to the above-described wired communication network NW2.

The programs stored in the ROM 200C and HDD 200E are stored in the RAM 200B described above by the CPU 200A. The program recorded on the portable recording medium 740 is stored in the RAM 200B by the CPU 200A. When the CPU 200A executes the stored programs, various functions described later are realized, and various processes described later are executed. Note that the program may correspond to a flow chart described later.

The functional configuration of the prover terminal 100 will be described with reference to FIG. Note that FIG. 4 shows the essential functions of the prover terminal 100 .

As shown in FIG. 4, the prover terminal 100 includes a storage unit 110, a processing unit 120, and a communication unit . The storage unit 110 can be implemented by one or both of the RAM 100B and NVM 100D described above. The processing unit 120 can be realized by the CPU 100A described above. The communication unit 130 can be realized by the RF circuit 100E and the antenna 100N described above. Therefore, the storage unit 110, the processing unit 120, and the communication unit 130 are connected to each other. Storage unit 110 includes information storage unit 111 and program storage unit 112 . The processing unit 120 includes an encryption unit 121 , a correction unit 122 , a transmission unit 123 and a reception unit 124 .

The information storage unit 111 stores public information and confidential information. Public information is information in which a part of the information about the proposition in the zero-knowledge proof is made public. The public information in this embodiment includes public input that is input to the numerical calculation program that the prover terminal 100 makes public. Also, the public information in this embodiment includes public output, which is the output from the numerical calculation program in response to the public input. Confidential information, on the other hand, is information in which the rest of the information about the proposition in the zero-knowledge proof is kept secret. Confidential information in this embodiment includes a secret input which is an input to a numerical calculation program kept secret by the prover terminal 100 . Also, the secret information in this embodiment includes a secret output which is an output from the numerical calculation program in response to the secret input.

The program storage unit 112 stores various programs. For example, the program storage unit 112 stores the numerical calculation program described above. Numerical programs include polynomials combining additions and multiplications, for example f(x,y)=x ² +y ³ +xy. The numerical calculation program may be, for example, a hash function calculation program. In addition, the program storage unit 112 includes a first encryption program that implements the first encryption process, and a first decryption program that implements the first decryption process paired with the first encryption process. The program storage unit 112 also contains a second encryption program that implements the second encryption process, and a second decryption program that implements the second decryption process paired with the second encryption process.

The encryption unit 121 encrypts the secret input with the first encryption process and encrypts the secret output with the second encryption process. The modifying unit 122 modifies the numerical calculation program into another numerical calculation program including a combination of the first decryption process, the numerical calculation program and the second encryption process. The transmitting unit 123 transmits the first information 10 to the verifier server 200 and the second information to the third party server 300 . The receiving unit 124 receives from the verifier server 200 a verification result regarding the correctness of the proposition verified by the verifier server 200 based on the first information 10 and the proof 30 .

The functional configuration of the verifier server 200 will be described with reference to FIG. Note that FIG. 5 shows the essential functions of the verifier server 200 .

As shown in FIG. 5, the verifier server 200 includes a storage unit 210, a processing unit 220, and a communication unit 230. The storage unit 210 can be realized by one or both of the RAM 200B and HDD 200E described above. The processing unit 220 can be realized by the CPU 200A described above. The communication unit 230 can be implemented by the network I/F 200D described above. Therefore, the storage unit 210, the processing unit 220, and the communication unit 230 are connected to each other. Storage unit 210 includes information storage unit 211 . The processing unit 220 includes a receiving unit 221 , a verification unit 222 and a transmitting unit 223 .

The receiving unit 221 independently receives the first information 10 and the proof 30 and stores them in the information storage unit 211 . Thereby, the information storage unit 211 stores the first information 10 and the proof 30 . The verification unit 222 acquires the first information 10 and the proof 30 from the information storage unit 211, and based on the acquired first information 10 and the proof 30 and a known predetermined verification method (for example, see Patent Document 1) , to verify the correctness of the proposition. The transmitting unit 223 transmits the verification result regarding the correctness of the proposition to the prover terminal 100 . For example, when the verification unit 222 verifies the validity of the proof 30 and determines that the proposition is true, it transmits a verification result including true as a result of the validity of the proposition. Conversely, when the verifier 222 verifies the validity of the proof 30 and determines that the proposition is false, it transmits a verification result including false as a result of the validity of the proposition.

The functional configuration of the third party server 300 will be described with reference to FIG. Note that FIG. 6 shows the essential functions of the third party server 300 .

As shown in FIG. 6, the third party server 300 includes a storage unit 310, a processing unit 320, and a communication unit 330. The storage unit 310 can be implemented by one or both of the RAM 200B and HDD 200E described above. The processing unit 320 can be implemented by the CPU 200A described above. The communication unit 330 can be implemented by the network I/F 200D described above. Therefore, the storage unit 310, the processing unit 320, and the communication unit 330 are connected to each other. Storage unit 310 includes information storage unit 311 . The processing unit 320 includes a receiving unit 321 , an auxiliary data recording unit 322 , a proof generating unit 323 and a transmitting unit 324 .

The receiving unit 321 receives the second information 20 and stores it in the information storage unit 311. Thereby, the information storage unit 311 stores the second information 20 . The auxiliary data recording section 322 acquires the second information 20 from the information storage section 311 . When the auxiliary data recording unit 322 acquires the second information 20, it extracts the encrypted secret input, the public input, and another numerical calculation program from the acquired second information 20. FIG. After extracting them, the auxiliary data recording unit 322 puts the encrypted secret input and public input into another numerical calculation program, and records and outputs the auxiliary data obtained during the execution of another numerical calculation program.

Here, since the separate numerical calculation program includes the first decryption processing paired with the first encryption processing, the encrypted secret input is decrypted into the unencrypted secret input inside the separate numerical calculation program. be able to. Also, another numerical calculation program includes the numerical calculation program before modification. Therefore, inside another numerical calculation program, a combination of a secret input and a public input is input to the numerical calculation program, and data obtained during execution of the numerical calculation program is recorded as auxiliary data. The auxiliary data recording unit 322 outputs this auxiliary data.

The proof generation unit 323 acquires the second information 20 from the information storage unit 311. After obtaining the second information 20 , the proof generation unit 323 extracts the encrypted secret input, the encrypted secret output, the public input, and the public output from the obtained second information 20 . When the proof generation unit 323 extracts these, the encrypted secret input, the encrypted secret output, the public input, the public output, the auxiliary data output from the auxiliary data recording unit 322, and a known predetermined proof generation method (for example, A proof 30 is generated based on (see Patent Document 1). The transmission unit 324 transmits the proof 30 generated by the proof generation unit 323 to the verifier server 200 .

A processing sequence of the information processing system ST will be described with reference to FIG.

As shown in FIG. 7, the transmission unit 223 of the verifier server 200 transmits a certification request (step S1). A certification request is information for which certification is requested. The transmission unit 223 transmits a certification request via the communication unit 330, for example, upon detecting access from the prover terminal 100. FIG. Accordingly, the receiving unit 124 of the prover terminal 100 receives the certification request via the communication unit 130 (step S2). Note that the prover terminal 100 can transmit the access to the verifier server 200 when detecting an operation on the input unit (not shown).

Upon receiving the certification request, the encryption unit 121 encrypts the secret information (step S3). That is, the encryption unit 121 encrypts the secret input and secret output. After the encryption unit 121 finishes encrypting the secret information, the modification unit 122 modifies the numerical calculation program to another numerical calculation program (step S4). After correcting the numerical calculation program, the transmission unit 123 transmits the first information 10 to the verifier server 200 via the communication unit 130 (step S5). The first information 10 includes public information and another numerical calculation program. As noted above, public information includes public inputs and public outputs. After completing the transmission of the first information 10, the transmission unit 123 transmits the second information 20 to the third party server 300 via the communication unit 130 (step S6). The second information 20 includes public information, another numerical calculation program, and encrypted secret information. As noted above, the encrypted secret information includes an encrypted secret input and an encrypted secret output. The processing order of the processing in step S5 and the processing in step S6 may be reversed, or may be the same timing.

When the first information 10 is transmitted, the receiving unit 221 of the verifier server 200 receives the first information 10 via the communication unit 230 (step S7). After receiving the first information 10 , the receiver 221 waits until the proof 30 is received. When the second information 20 is transmitted, the receiving section 321 of the third party server 300 receives the second information 20 via the communication section 330 (step S8). When the receiving unit 321 receives the second information 20, the proof generating unit 323 generates the proof 30 (step S9). More specifically, when the receiving unit 321 receives the second information 20, the auxiliary data recording unit 322 records and outputs the auxiliary data, and the proof generating unit 323 stores the auxiliary data, public information, encrypted secret information, and known public information. A proof 30 is generated based on a proof generation technique. When the proof generation unit 323 generates the proof 30, the transmission unit 324 transmits the proof 30 to the verifier server 200 via the communication unit 330 (step S10).

When the proof 30 is transmitted, the receiving unit 221 of the verifier server 200 receives the proof 30 via the communication unit 230 (step S11). When the receiving unit 221 receives the proof 30, the verification unit 222 verifies the validity of the proof 30 (step S12). After the verification unit 222 has verified the validity of the proof 30, the transmission unit 223 transmits the verification result via the communication unit 230 (step S13). When the verification result is transmitted, the receiving unit 124 of the prover terminal 100 receives the verification result via the communication unit 130 (step S14). A display unit (not shown) of the prover terminal 100 may display the verification result.

Details of the processing executed by the prover terminal 100 will be described with reference to FIGS.

As described above, when a certification request is transmitted from the verifier server 200, the receiving unit 124 receives the certification request as shown in FIG. 8 (step S21). When the receiving unit 124 receives the certification request, the encryption unit 121 encrypts the secret input and secret output (step S22). More specifically, the encryption unit 121 acquires the secret input from the information storage unit 111 and acquires the numerical calculation program from the program storage unit 112 . When the encryption unit 121 acquires the secret input and the numerical calculation program, as shown in FIG. 9A, the encryption unit 121 puts the secret input into the numerical calculation program and acquires the secret output. When the encryption unit 121 obtains the secret output, it encrypts the secret input with the first encryption process and encrypts the secret output with the second encryption process. As a result, encrypted secret input and encrypted secret output are obtained.

Before, during, or after encryption of the secret input and secret output, the encryption unit 121 acquires the public input from the information storage unit 111, and as shown in FIG. Inject public and secret inputs to obtain public outputs. The encryption unit 121 stores the acquired secret output and public output in the information storage unit 111 . Thereby, the information storage unit 111 stores confidential information including confidential input and confidential output, and stores public information including public input and public output.

After encrypting the secret input and secret output, the modification unit 122 modifies the numerical calculation program into another numerical calculation program (step S23). Specifically, as shown in FIG. 9B, the modifying unit 122 modifies the numerical calculation program into another numerical calculation program including a numerical calculation program, a first decryption program, and a second encryption program. . Note that the first decryption program and the second encryption program may be acquired from the program storage unit 112 by the correction unit 122 .

Since the first decryption program corresponds to the first encryption program, when the encrypted secret input is input to the first decryption program, the secret input before encryption can be restored from the encrypted secret input. can. Therefore, if a secret input is input to a numerical calculation program inside another numerical calculation program, a secret output corresponding to the secret input can be obtained. Further, within another numerical computation program, when the secret output is fed into a second encryption program, an encrypted secret output can be generated from the secret output. Since the encrypted secret output is generated based on the encrypted secret input, the encrypted secret output and the encrypted secret input maintain the correct input/output relationship. That is, the correct input/output relation between secret input and secret output and the correct input/output relation between encrypted secret output and encrypted secret input are synonymous.

After correcting the numerical calculation program, the transmission unit 123 transmits the first information 10 to the verifier server 200 (step S24). The first information 10 includes public information (specifically public input and public output) and another numerical calculation program. After transmitting the first information 10, the transmitter 123 transmits the second information 20 to the third party server 300 (step S25). The second information 20 includes public information, separate numerical calculation programs, and encrypted secret information (encrypted secret input and encrypted secret output). When the transmitter 123 transmits the second information 20, the receiver 124 waits until it receives the verification result. When the verification result is transmitted from the verifier server 200, the receiving unit 124 receives the verification result (step S26) and ends the process.

Details of the processing executed by the third party server 300 will be described with reference to FIG.

When the second information 20 is transmitted from the prover terminal 100, the receiving section 321 receives the second information 20 (step S31). When the receiving unit 321 receives the second information 20, the auxiliary data recording unit 322 records and outputs auxiliary data based on the second information 20 (step S32). More specifically, the auxiliary data recording unit 322 inputs the public input and encrypted secret input included in the second information 20 to another numerical calculation program included in the second information 20 . Another numerical calculation program includes a first decoding program. Therefore, of the public input and the encrypted secret input input to another numerical calculation program, the encrypted secret input is independently decrypted into the secret input inside another numerical calculation program. That is, public inputs are immutable inside another numerical computation program. The auxiliary data recording unit 322 inputs the combination of the public input and the decrypted secret input into a numerical calculation program included in another numerical calculation program, and records and outputs auxiliary data obtained during execution of the numerical calculation program.

It should be noted that the auxiliary data recording unit 322 may separately input the public input and the decrypted secret input into a numerical calculation program included in another numerical calculation program. In this case, the auxiliary data may be recorded and output based on the first data obtained during the execution of the public input of the numerical calculation program and the second data obtained during the execution of the secret input of the numerical calculation program. good.

When the auxiliary data recording unit 322 outputs the auxiliary data, the proof generating unit 323 generates the proof 30 (step S33). More specifically, the proof generation unit 323 generates the proof 30 based on the auxiliary data, the public input, the public output, the encrypted secret input, the encrypted secret output, and a known proof generation method. When the proof generating unit 323 generates the proof 30, the sending unit 324 sends the proof 30 to the verifier server 200 (step S34), and ends the process.

Details of the processing executed by the verifier server 200 will be described with reference to FIG.

First, the transmission unit 223 transmits a certification request (step S41). When the transmitter 223 transmits the certification request, the receiver 221 waits until the first information 10 is received. When the first information 10 is transmitted from the prover terminal 100, the receiving section 221 receives the first information 10 (step S42). After receiving the first information 10 , the receiver 221 waits until the proof 30 is received. When the certification 30 is transmitted from the third party server 300, the receiving unit 221 receives the certification 30 (step S43).

When the receiving unit 221 receives the proof 30, the verification unit 222 verifies the validity of the proof 30 (step S44). More specifically, the verification unit 222 generates the proof 30 based on the public input, the public output, and another numerical calculation program included in the first information 10, the proof 30, and a predetermined verification technique provided in the verification unit 222. verify the legitimacy of As a result of verifying the correctness of the proof 30, when the verification unit 222 determines that the proposition is true (step S45: YES), the verification result including true is transmitted to the prover terminal 100 (step S46), and the process is started. finish. Here, proof 30 has been generated based on public input, public output, another numerical computation program, encrypted secret input, and encrypted secret output. Therefore, based on the public input and public output included in the first information 10, another numerical calculation program, and a predetermined verification method provided in the verification unit 222, the encrypted secret input and the encrypted secret of the proof 30 If the correct input/output relationship of output can be determined, the correct input/output relationship of secret input and secret output can also be determined. In this case, the verification unit 222 determines that the proposition is true. As a result of verifying the validity of the proof 30, when the verification unit 222 determines that the proposition is false (step S45: NO), the verification result including false is transmitted to the prover terminal 100 (step S47), and the process is started. finish.

(Second embodiment)
A second embodiment of the present case will be described with reference to FIGS. 12 and 13. FIG. 12, the same components as those of the prover terminal 100 shown in FIG. 4 are denoted by the same reference numerals, and description thereof will be omitted. Further, in FIG. 13, the same reference numerals are given to the same processes as the processes of the prover terminal 100 shown in FIG. 8, and the description thereof will be omitted.

First, as shown in FIG. 12, the processing unit 120 according to the second embodiment is different from the processing unit 120 according to the first embodiment in that a random value generation unit 125 is further provided. A random value generator 125 generates a first random value and a second random value. Both the first random value and the second random value are values (specifically, numerical values) randomly specified by the random value generator 125 . That is, both the first random value and the second random value are values randomly specified by the prover terminal 100 .

As shown in FIG. 13, when the receiving unit 124 receives the certification request in the process of step S21, the random value generating unit 125 generates a first random value and a second random value (step S51). After the random value generator 125 generates the first random value and the second random value, the encryption unit 121 encrypts the secret input based on the first random value (step S52).

For example, the encryption unit 121 adds a first random value to the secret input, and encrypts the secret input after the addition by the first encryption process. This generates an encrypted secret input corresponding to the first random value. When the encrypted secret input corresponding to the first random value is decrypted by the first decryption process, the secret input to which the first random value is added is restored. Therefore, when returning to the original secret input, the first random value is subtracted from the secret input to which the first random value is added. That is, when encryption is performed by the first encryption process based on the first random value and the secret input, the process of subtracting the first random value must be included in the first decryption process paired with the first encryption process. Just do it.

After encrypting the secret input based on the first random value, the encryption unit 121 encrypts the secret output based on the second random value (step S53). As described above, when the secret input after addition of the first random value is encrypted by the first encryption process, the encryption unit 121 adds the second random value to the secret output, and converts the secret output after addition to the second random value. Encrypt by the second encryption process. This generates an encrypted secret output corresponding to the second random value. When the encrypted secret output corresponding to the second random value is decrypted by the second decryption process, the secret output to which the second random value is added is restored. Therefore, when returning to the original secret output, the second random value should be subtracted from the secret output to which the second random value is added. That is, when encryption is performed by the second encryption process based on the second random value and the secret output, the process of subtracting the second random value must be included in the second decryption process paired with the second encryption process. Just do it.

After encrypting the secret output based on the second random value, the modification unit 122 modifies the numerical calculation program to another numerical calculation program (step S54). Specifically, the modifying unit 122 modifies the numerical calculation program into another numerical calculation program including a numerical calculation program, a first decryption program, and a second encryption program. However, in the second embodiment, the first decoding program includes a process of subtracting the first random value. Also, a process of adding a second random value to the second encryption program is included. That is, another numerical calculation program according to the second embodiment is different from another numerical calculation program according to the first embodiment. As a result, the encrypted secret input corresponding to the first random value and the encrypted secret output corresponding to the second random value maintain a correct input/output relationship. When the correcting unit 122 corrects the numerical calculation program to another numerical calculation program, the transmission unit 123 transmits the first information 10 to the verifier server 200 by the process of step S24.

As an example, addition of the first random value to the secret input and subtraction of the first random value from the secret input, and addition of the second random value to the secret output and subtraction of the second random value from the secret output are performed. Although described, it is not specifically limited to this example.

For example, in the first encryption process, the secret input is multiplied by the first random value, and in the first decryption process, the secret input multiplied by the first random value is divided by the first random value. good too. Similarly, the secret output is multiplied by the second random value in the second encryption process, and the secret output multiplied by the second random value is divided by the second random value in the second decryption process. may Such a method can also provide the same effect as addition and subtraction. As described above, according to the second embodiment, by adopting the first random value and the second random value for the encryption of the secret information and the correction of the numerical calculation program, the secret information is more secure than in the first embodiment. You can reduce the risk of leakage.

(Third embodiment)
A third embodiment of this case will be described. When correcting the numerical calculation program, the correction unit 122 according to the third embodiment rearranges the order of addition and multiplication across the first decryption program, the numerical calculation program, and the second encryption program, so that the numerical calculation program to another numerical calculation program. That is, the correction unit 122 shuffles by changing the order of calculation described in the first decryption program, the numerical calculation program, and the second encryption program. The first decryption program, the numerical calculation program, and the second encryption program are all programs for calculating polynomials (on a finite field) that are combinations of addition and multiplication. As a result, it is possible to conceal what kind of calculation the first decryption program and the second encryption program perform, and it is possible to improve security against leakage of the secret input and the secret output.

Here, as described in the first embodiment, the encrypted secret input can be decrypted by the first decryption program, and the encrypted secret output can be decrypted by the second decryption program. Therefore, if the first decryption program leaks to the third party server 300 alone, the third party server 300 can use the first decryption program to decrypt the secret input. Similarly, if the second decryption program is leaked to the third party server 300 alone, the third party server 300 can decrypt the secret output using the second decryption program.

Further, as described in the first embodiment, the transmission unit 123 simply combines the first decryption program, the numerical calculation program, and the second encryption program in this order to create another numerical calculation program (Fig. 9(b)). )) as part of the second information 20 to the third party server 300 . In this case, if the third party server 300 can confirm the inside of another numerical calculation program by a technique such as reverse engineering, it may identify the first decryption program and the second encryption program. As a result, highly confidential encrypted secret input and encrypted secret output may be decrypted. However, according to the third embodiment, the order of the calculations described in the first decryption program, the numerical calculation program, and the second encryption program is changed and shuffled to prevent leakage of secret input and secret output. Safety can be improved.

Although the preferred embodiments of the present invention have been described in detail above, the present invention is not limited to specific embodiments, and various modifications and variations can be made within the scope of the gist of the present invention described in the claims. Change is possible. For example, although the embodiment described above describes generating the proof 30 based on the auxiliary data, the proof 30 can also be generated without employing the auxiliary data. Specifically, the proof generation unit 323 generates the proof 30 based on the encrypted secret input, the encrypted secret output, the public input, the public output, another numerical calculation program, and a known proof generation technique. good too.

ST information processing system 100 prover terminal 120 processing unit 121 encryption unit 122 correction unit 123 transmission unit 124 reception unit 125 random value generation unit 200 verifier server 300 third party server

Claims

encrypting a secret input to a numerical calculation program and a secret output from the numerical calculation program, which are kept secret by a prover in zero-knowledge proof, by a first encryption process and a second encryption process, respectively;
modifying the numerical calculation program into another numerical calculation program including decryption processing paired with the first encryption processing, the numerical calculation program, and the second encryption processing;
transmitting to a verifier in the zero-knowledge proof first information including the another numerical calculation program, a public input to the numerical calculation program published by the prover, and a public output from the numerical calculation program;
a process of transmitting second information including the encrypted secret input and secret output, the separate numerical calculation program, and the public input and public output to a third party different from the prover and the verifier; on the computer, and
the third party generates a proof of the proposition in the zero-knowledge proof based on the second information, and transmits the generated proof to the verifier;
An information processing program characterized by:
The encryption process includes adding a first random value randomly specified by the prover to the secret input, encrypting the secret input by the first encryption process, and adding a second random value randomly specified by the prover to the secret input. adding a value to the secret output and encrypting it with the second encryption process;
The information processing program according to claim 1, characterized by:
The encryption process includes multiplying the secret input by a first random value randomly specified by the prover, encrypting the secret input by the first encryption process, and encrypting the secret input with a second random value randomly specified by the prover. multiplying the secret output by a value and encrypting it with the second encryption process;
The information processing program according to claim 1, characterized by:
The decryption process, the numerical calculation program, and the second encryption process are all combinations of addition and multiplication,
The modifying process changes the order of the addition and the multiplication across the decryption process, the numerical calculation program, and the second encryption process, and modifies the numerical calculation program into the different numerical calculation program. do,
4. The information processing program according to any one of claims 1 to 3, characterized by:
receiving a verification result regarding the correctness of the proposition verified by the verifier based on the first information and the proof;
5. The information processing program according to any one of claims 1 to 4, characterized by:
the process of transmitting the second information transmits the second information to the single third party;
6. The information processing program according to any one of claims 1 to 5, characterized by:
a first performance of the server device realizing the third party is higher than a second performance of the computer;
7. The information processing program according to any one of claims 1 to 6, characterized by:
encrypting a secret input to a numerical calculation program and a secret output from the numerical calculation program, which are kept secret by a prover in zero-knowledge proof, by a first encryption process and a second encryption process, respectively;
modifying the numerical calculation program into another numerical calculation program including decryption processing paired with the first encryption processing, the numerical calculation program, and the second encryption processing;
transmitting to a verifier in the zero-knowledge proof first information including the another numerical calculation program, a public input to the numerical calculation program published by the prover, and a public output from the numerical calculation program;
a process of transmitting second information including the encrypted secret input and secret output, the separate numerical calculation program, and the public input and public output to a third party different from the prover and the verifier; is executed by the computer and
the third party generates a proof of the proposition in the zero-knowledge proof based on the second information, and transmits the generated proof to the verifier;
An information processing method characterized by:
a secret input to a numerical calculation program and a secret output from the numerical calculation program which are kept secret by a prover in zero-knowledge proof by a first encryption process and a second encryption process, respectively;
a modification unit that converts the numerical calculation program into another numerical calculation program that includes decryption processing paired with a first encryption processing, the numerical calculation program, and the second encryption processing;
transmitting to a verifier in said zero-knowledge proof first information including said another numerical calculation program, a public input to said numerical calculation program published by said prover, and a public output from said numerical calculation program; a transmission unit configured to transmit second information including the secret input and the secret output, the different numerical calculation program, the public input and the public output to a third party different from the prover and the verifier; , and
the third party generates a proof of the proposition in the zero-knowledge proof based on the second information, and transmits the generated proof to the verifier;
An information processing device characterized by:
The encryption unit adds a first random value randomly specified by the prover to the secret input, encrypts the secret input by the first encryption process, and adds a second random value randomly specified by the prover to the secret input. is added to the secret output and encrypted with the second encryption process,
10. The information processing apparatus according to claim 9, characterized by:
The encryption unit multiplies the secret input by a first random value randomly specified by the prover, encrypts the secret input in the first encryption process, and encrypts the secret input with a second random value randomly specified by the prover. multiplied by the secret output and encrypted with the second encryption process;
10. The information processing apparatus according to claim 9, characterized by:
The decryption process, the numerical calculation program, and the second encryption process are all combinations of addition and multiplication,
The modifying unit rearranges the order of the addition and the multiplication across the decryption process, the numerical calculation program, and the second encryption process, and modifies the numerical calculation program into the different numerical calculation program. ,
12. The information processing apparatus according to any one of claims 9 to 11, characterized by:
13. The method according to any one of claims 9 to 12, further comprising a receiving unit that receives a verification result regarding the correctness of the proposition verified by the verifier based on the first information and the proof. The information processing device described.
the transmission unit transmits the second information to the single third party;
14. The information processing apparatus according to any one of claims 9 to 13, characterized by:
the first performance of the server device realizing the third party is higher than the second performance of the information processing device;
15. The information processing apparatus according to any one of claims 9 to 14, characterized by: