Patent Application
20250181775
The present invention relates to a secure computation technique, and particularly to a distributed secure computation technique.
A distributed secure computation technique of using shares obtained by securely distributing information based on original information to obtain shares obtained by securely distributing operation results of specified computing without restoring the original information and the operation results is known (see, for example, NPL 1 or the like).
In the known distributed secure computation technique, data related to secure computation can be referred to through an interface of a computing device for performing the secure computation.
However, the known distributed secure computation technique has a problem that it is difficult to monitor and verify irregular processing of a computing device performing secure computation.
The present invention has been made in view of these points and an object thereof is to provide a technique that can monitor and verify irregular processing of secure computation.
A computing device serving as a node of a blockchain executes processing for obtaining consensus using a consensus algorithm of the blockchain, and stores, in a block of the blockchain, a one-way function value of at least one of secret information obtained by securely distributing information based on original information and a secure computation result obtained by performing secure computation on the secret information in a case in which the consensus is obtained using the consensus algorithm of the blockchain.
Thus, it is possible to monitor and verify irregularity of the secure computation.
Embodiments of the present invention will be described below with reference to the drawings.
First, a first embodiment of the present invention will be described.
As illustrated in
As illustrated in
As illustrated in
The acquisition unit 112-n of the client device 11-n receives information identifying the original information a-n and stores the original information a-n in the storage unit 111-n. The information identifying the original information a-n may be information representing the original information a-n itself or may be secret information (for example, ciphertext or a secure distributing value of the original information) of the original information a-n. Also, the original information a-n is, for example, plain text. Examples of the original information a-n include information that should be prevented from leaking to the outside, such as personal information, medical information, trade secret information, statistical information, technical information, or information (model parameters and the like) that identifies a learned model using these as learning data. The acquisition unit 112n stores the original information a-n in the storage unit 111-n in a case in which information representing the original information a-n itself is received and stores the original information a-n restored from the secret information in the storage unit 111-n (step S111-n) in a case in which the secret information of the original information a-n is received.
The processing unit 113-n reads the original information a-n from the storage unit 111-n and sends information based on the original information a-n to the concealment unit 114-n. Also, the “information based on the original information a-n” may be the original information a-n itself or may be information obtained by applying some processing to the original information a-n. In the latter case, the processing unit 113-n applies some processing to the original information a-n and sends the information obtained by the processing to the concealment unit 114-n (step S113-n).
The concealment unit 114-n securely distributes information based on the sent original information a-n to obtain and output R pieces of secret information [a-n]L(1), . . . , [a-n]L(R). These pieces of secret information [a-n]L(1), . . . , [a-n]L(R) are shares (sometimes referred to as “fragments”) in a secure distributing method. The secure distributing method may be any type. An example of the secure distributing method is a “threshold secret distributing method” that has a characteristic that “source information (for example, information based on original information) can be restored when a predetermined number of shares (for example, secret information) or more are collected, but no information (for example, the information based on the original information) can be obtained from below the predetermined number of shares (for example, the secret information).” The secret information [a-n]L(1), . . . , [a-n]L(R) is stored in the storage unit 111-n (step S114-n).
Based on this premise, secure computation processing is executed.
First, consensus processing units 128a-1, . . . , 128a-M (
When secure computation devices 12-L(1), . . . , 12-L(R) are selected as the leaders LEAD1, . . . , LEADR for the blockchains BC1, . . . , BCR, the smart contract function of the blockchain platform of the cloud 13 transmits a processing request to these secure computation devices 12-L(1), . . . , 12-L(R) to execute secure computation. In addition, {L(1), . . . , L(R)}⊆{1, . . . , M}. This processing request includes information on a transmission destination of the secure computation result. For example, the transmission destination of the secure computation result may be all the client devices 11-1, . . . , 11-N, some of the client devices 11-1, . . . , 11-N, or may include other devices (step S131).
An acquisition unit 121-L(r) (
The acquisition unit 121-L(r) of the secure computation device 12-L(r) (
The providing unit 123-L(r) transmits the secure computation result [b]L(r) to the transmission destination included in the processing request. For example, the secure computation result [b]L(r) is transmitted to the client devices 11-1, . . . , 11-N. The acquisition unit 112-n of the client device 11-n (
Also, the one-way function operation unit 128b-L(r) of the secure computation device 12-L(r) (
For example, the one-way function operation unit 128b-L(r) obtains and outputs one-way function values H1([a-1]L(r)), . . . , HN([a-N]L(r)), and HN+1([b]L(r)) of each of the secret information [a-1]L(r), . . . , [a-N]L(r) and the secure computation result [b]L(r). However, Hβ(α) represents a one-way function value obtained by applying a one-way function Hβ to α. The one-way function Hβ may be any function as long as it is cryptographically unlikely to collide with an input value. For example, the one-way function Hβ may be a cryptographic hash function or may be a cryptographic function of a deterministic cryptosystem into which an encryption key is input. In the former case, the one-way function value is a hash value, and in the latter case, the one-way function value is ciphertext. One-way functions H1, . . . , HN, and HN+1 may be the same (H=H1= . . . =HN=HN+1), or at least some of them may be different from each other.
Alternatively, for example, the one-way function operation unit 128b-L(r) may obtain and output one-way function values H1([a-1]L(r), . . . , [a-N]L(r), and [b]L(r)) of function values (for example, bit coupling values) of the secret information [a-1]L(r), . . . , [a-N]L(r) and the secure computation result [b]L(r).
Alternatively, for example, the one-way function operation unit 128b-L(r) may obtain and output one-way function values H1([a-1]L(r), . . . , [a-N]L(r) of function values of the secret information [a-1]L(r), . . . , [a-N]L(r) and a one-way function value H2([b]L(r)) of the secure computation result [b]L(r).
Alternatively, for example, the one-way function operation unit 128b-L(r) may obtain and output only the one-way function values H1([a-1]L(r), . . . , [a-N]L(r), or only the one-way function value H2([b]L(r)). In addition, for example, the one-way function operation unit 128b-L(r) may obtain and output one-way function values of function values (for example, bit coupling values) of at least one of the secret information [a-1]L(r), . . . , [a-N]L(r) and the secure computation result [b]L(r) and other information.
However, these are merely examples and do not limit the present invention. The single or plurality of one-way function values output from the one-way function operation unit 128b-L(r) are sent to a block processing unit 128c-L(r) (step S128b-L(r)).
Each block processing unit 128c-L(r) (where r=1, . . . , R) stores the received one-way function value in the latest block Br(ir) of each blockchain BCr. Here, the block Br(ir) is a block in which the secure computation device 12-L(r) has obtained the consensus, and ir is an index of a positive integer representing a block of the blockchain BCr.
In the present embodiment, for r=1, . . . , R, the secure computation device 12-L(r) (computing device) serving as a node of the blockchain BCr executes processing for obtaining the consensus using the consensus algorithm of the blockchain BCr and in a case in which the consensus is obtained using the consensus algorithm of the blockchain BCr, stores the one-way function value of at least one of the secret information obtained by securely distributing the information based on the original information and the secure computation result obtained by performing secure computation on the secret information in the block Br(ir) of the blockchain BCr. As long as safety of the blockchain BCr is maintained, the information stored in the block Br(ir) cannot be altered. Thus, it is possible to monitor and verify the processing performed by the secure computation device 12-L(r).
Also, the secure computation unit 122-L(r) of the secure computation device 12-L(r) of the present embodiment performs secure computation on the secret information [a-1]L(r), . . . , [a-N]L(r) in accordance with the processing request from the smart contract function using the blockchain BCr to obtain the secure computation result [b]L(r). Thus, it is possible to control the secure computation processing of the secure computation device 12-L(r) to inhibit irregularity of the secure computation device 12-L(r).
Further, the secure computation device 12-L(r) of the present embodiment blocks requests other than the processing request from the smart contract function. Thus, it is possible to inhibit irregularity of the secure computation device 12-L(r).
Also, the R secure computation devices 12-L(1), . . . , 12-L(R) of the present embodiment store the above-described one-way function values respectively to the blocks of the R blockchains BC1, . . . , BCR. That is, a secure computation device 12-L(r1) (computing device) executes processing for obtaining consensus using a consensus algorithm of the blockchain BCr1, and in a case in which the consensus is obtained using the consensus algorithm of the blockchain BCr1, stores a one-way function value of at least one of the secret information obtained by securely distributing the information based on the original information and the secure computation result obtained by performing secure computation on the secure information in a block Br1 (ir1) of the blockchain BCr1. Further, another secure computation device 12-L(r2) (computing device) executes processing for obtaining consensus using a consensus algorithm of another blockchain BCr2 other than the blockchain BCr1, and in a case in which the consensus is obtained using the consensus algorithm of the blockchain BCr2, stores a one-way function value of at least one of other secret information obtained by securely distributing the information based on the original information and another secret information secure computation result obtained by performing secure computation on the other secret information in a block Br2 (ir2) of the other blockchain BCr2. However, r1≠r2, and r1 and r2∈{1, . . . , R}. Thus, even when safety of any blockchain is impaired, it is possible to monitor and verify the processing performed by the secure computation device as long as security of the other blockchain is maintained.
Differences from the first embodiment will be mainly described below, and the matters that have already been described will be simplified. In the first embodiment, for the R blockchains BC1, . . . , BCR, the secure computation devices 12-L(1), . . . , 12-L(R) are selected as the leaders LEAD1, . . . , LEADR, and the secure computation devices 12-L(1), . . . , 12-L(R) store the above-described one-way function values respectively in the blocks B1(i1), . . . , BR(iR) of the blockchains BC1, . . . , BCR. However, the R secure computation devices 12-L(1), . . . , 12-L(R) may be selected as the leaders LEAD1, . . . , LEADR in parallel to one blockchain BC1 of the blockchain platform of the cloud 13, and the secure computation devices 12-L(1), . . . , 12-L(R) may store the above-described one-way function values in the block B1(i1) of the blockchain BC1. This will be described in detail below.
In the present modified example, as illustrated in
This is the same as the first embodiment.
First, instead of the processing of step S128a-m of the first embodiment, the consensus processing unit 128a-m of each secure computation device 12-m (where m=1, . . . , M) is connected to the blockchain platform of the cloud 13 and executes processing for obtaining consensus using the consensus algorithm of the blockchain BC1. In the present modified example, any R secure computation devices 12-L(1), . . . , 12-L(R) are selected as the leaders LEAD1, . . . , LEADR for the blockchain BC1 using the consensus algorithm ({L(1), . . . , L(R)}⊆{1, . . . , M}) (step S128a(1)-m).
After that, the processing described in steps S131, S115-n, S122-L(r), S112-n, and S128b-L(r) described in the first embodiment are executed.
After that, the block processing unit 128c-L(r) of each secure computation device 12-L(r) (where r=1, . . . , R) stores the received one-way function value in the latest block B1(i1) of the blockchain BC1 (the block for which the secure computation device 12-L(r) has obtained the consensus using the consensus algorithm of the blockchain BC1).
In the present modified example, the secure computation device 12-L(r1) (computing device) serving as a node of the blockchain BC1 executes processing for obtaining consensus using the consensus algorithm of the blockchain BC1, and when the consensus is obtained using the consensus algorithm of the blockchain BC1, stores the one-way function value of at least one of the secret information obtained by securely distributing the information based on the original information and the secure computation result obtained by performing secure computation on the secret information in the block B1(i1) of the blockchain BC1. Further, another secure computation device 12-L(r2) (another computing device) serving as another node of the blockchain BC1 also executes processing for obtaining consensus using the consensus algorithm of the same blockchain BC1, and in a case in which the consensus is obtained using the consensus algorithm of the blockchain BC1, stores the one-way function value of at least one of other secret information obtained by securely distributing the information based on the original information and another secret information secure computation result obtained by performing secure computation on the other secret information in the block B1(i1) of the blockchain BC1. The block B1(i1) corresponds to a block of a blockchain in which a one-way function value of at least one of other secret information and another secure computation result is stored by another computing device. However, r1≠r2, and r1 and r2∈{1, . . . , R}. Even in this case, as in the first embodiment, it is possible to monitor and verify the processing performed by the secure computation device 12-L(r).
In the first embodiment, for the R blockchains BC1, . . . , BCR, the secure computation devices 12-L(1), . . . , 12-L(R) are selected as the leaders LEAD1, . . . , LEADR, and the secure computation devices 12-L(1), . . . , 12-L(R) store the above-described one-way function values respectively in the blocks B1(i1), . . . , BR(iR), of the blockchains BC1, . . . , BCR. However, the R secure computation devices 12-L(1), . . . , 12-L(R) may be selected as the leaders LEAD1, . . . , LEADR in order (in series) for a plurality of blocks B1(i1), . . . , B1 (iR) of one blockchain BC1 in the blockchain platform of the cloud 13, and each secure computation device 12-L(r) may store the above-described one-way function value in order in the block B1 (ir) for which it is selected as the leader LEADr. However, since the secure computation is performed after the R secure computation devices 12-L(1), . . . , 12-L(R) are selected as the leaders LEAD1, . . . . LEADR, the one-way function value of the information including the secure computation result [b]L(r) is stored in the block B1(iR) by the secure computation device 12-L(R) finally selected as the leader LEADR. Also, by performing secure computation after the R secure computation devices 12-L(1), . . . , 12-L(R) are selected as the leaders LEAD1, . . . , LEADR, it is also possible to perform secure computation (for example, multiplication in secure computation) accompanied by communication among the secure computation devices 12-L(1), . . . , 12-L(R). This will be described in detail below.
In the present modified example, as illustrated in
This is the same as the first embodiment.
First, instead of the processing of step S128a-m of the first embodiment, the consensus processing unit 128a-m of each secure computation device 12-m (where m=1, . . . , M) is connected to the blockchain platform of the cloud 13 and executes processing for obtaining consensus using the consensus algorithm of the blockchain BC1. In the present modified example, any one secure computation device 12-L(r) is selected as the leaders LEAD1, . . . , LEADR for the blockchain BC1 using the consensus algorithm (where r∈{1, . . . , M}) (step S128a(2)-m).
When any secure computation device 12-L(r) is selected as the leader LEADr, the smart contract function of the blockchain platform of the cloud 13 transmits a processing request for obtaining the secret information for secure computation to the secure computation device 12-L(r) instead of the processing of step S131 of the first embodiment (step S131(2)).
Next, instead of the processing of step S115-n of the first embodiment, the acquisition unit 121-L(r) (
Instead of step S122-L(r) of the first embodiment, the acquisition unit 121-L(r) of the secure computation device 12-L(r) (
For example, the one-way function operation unit 128b-L(r) obtains and outputs the one-way function values H1([a-1]L(r)), . . . , HN([a-N]L(r)) of the secret information [a-1]L(r), . . . , [a-N]L(r).
Alternatively, for example, the one-way function operation unit 128b-L(r) may obtain and output the one-way function values H1([a-1]L(r), . . . , [a-N]L(r)) of the function values (for example, bit coupling values) of the secret information [a-1]L(r), . . . , [a-N]L(r).
Alternatively, for example, the one-way function operation unit 128b-L(r) may obtain and output the one-way function values of the function values (for example, bit coupling values) of the secret information [a-1]L(r), . . . , [a-N]L(r) and other information.
However, these are merely examples and do not limit the present invention. The single or plurality of one-way function values output from the one-way function operation unit 128b-L(r) are sent to the block processing unit 128c-L(r) (step S128b(2)-L(r)).
Next, as illustrated in
The processing of these steps S128a(2)-m, S131(2), and SS115(2)-n, and steps S128b(2)-L(r) and S128c(2)-L(r) are executed in order in series for r=1, . . . , R (
The providing unit 123-L(r) transmits the secure computation result [b]L(r) to the transmission destination included in the above-described processing request. The acquisition unit 112-n of the client device 11-n (
Also, the one-way function operation unit 128b-L(r) of the secure computation device 12-L(r) (
In the present modified example, after the consensus for the secure computation devices 12-L(1), . . . , 12-L(R-1) (other computing devices) is obtained using the consensus algorithm of the blockchain BC1, the consensus for the secure computation device 12-L(R) (computing device) is obtained using the consensus algorithm of the blockchain BC1. After the consensus for the secure computation device 12-L(R) is obtained using the consensus algorithm of the blockchain BC1, the secure computation device 12-L(R) performs secure computation on the secret information to obtain a secure computation result, and the secure computation devices 12-L(1), . . . , 12-L(R-1) (other computing devices) perform secure computation on other secret information to obtain other secure computation results. The secure computation device 12-L(R) stores a one-way function value of the secure computation result obtained by the secure computation device 12-L(R) and one-way function values of the secure computation results obtained by the secure computation devices 12-L(1), . . . , 12-L(R-1) (other computing devices) in the latest block B1(iR) of the blockchain BC1 (
Also, in the present modified example, after consensus for each secure computation device 12-L(r′) (other computing devices) (r′∈{1, . . . , R−1}) is obtained using the consensus algorithm of the blockchain BC1, one-way function values of secret information (other secret information) obtained by each secure computation device 12-L(r′) (other computing devices) are stored one by one in blocks B1(ir′) of the blockchain BC1 by each secure computation device 12-L(r′) (other computing devices) (
Also, as a further modified example, after the consensus for each secure computation device 12-L(r′) (r′∈{1, . . . , R−1}) is obtained, the one-way function values of the secret information obtained by each secure computation device 12-L(r′) may not be stored one by one in the blocks B1(ir′) of the blockchain BC1 by each secure computation device 12-L(r′), but these one-way function values may also be stored in the block B1(iR) by the secure computation device 12-L(R) (
In the first embodiment and the modified examples, the processing content of the secure computation executed by each secure computation device 12-m (where m=1, . . . , M) are incorporated in the blockchain platform of the cloud 13. However, the processing content of the secure computation executed by each secure computation device 12-m may be incorporated in the secure computation unit 122-m of each secure computation device 12-m. In this case, each secure computation device 12-m executes secure computation on the basis of the processing content incorporated in itself, rather than the processing request from the smart contract function. Also, the processing content of the secure computation executed by each secure computation device 12-m may be distributed and incorporated in the blockchain platform and the secure computation unit 122-m.
In the first embodiment or the modified examples, the providing unit 123-L(r) of the secure computation device 12-L(r) may determine whether or not transmission of the secure computation result [b]L(r) to a specific client device 11-n (n∈{1, . . . , N}) is allowable by consensus confirmation processing (voting processing) included in the smart contract function of the blockchain platform of the cloud 13. In this case, each secure computation device 12-L(r) executes the consensus confirmation processing, and in accordance with the result, determines whether or the transmission of the secure computation result [b]L(r) to the specific client device 11-n is allowable. Here, only in a case in which the result indicating that the transmission to the specific client device 11-n is allowable is obtained, each secure computation device 12-L(r) transmits the secure computation result [b]L(r) to the specific client device 11-n. Thus, the safety is further improved.
In the first embodiment or the modified examples, the secure computation unit 122-L(r) of the secure computation device 12-L(r) obtains all the secret information [a-1]L(r), . . . , [a-N]L(r), and then executes the secure computation. However, depending on the content of the secure computation, the secure computation unit 122-L(r) may execute the secure computation using only some of the acquired secret information before obtaining all the secret information [a-1]L(r), . . . , [a-N]L(r) (for example, in the case of time-out) and obtain the secure computation result [b]L(r).
Further, using an algorithm (for example, POS) that provides consensus without mining Nonce as a consensus algorithm, the client devices 11-1, . . . , 11-N that have obtained consensus using the consensus algorithm may store the one-way function value of the secret information [a-N]L(r) of the original information a-n in a block (for example, a first block) of the above-described blockchain. Thus, the safety is further improved.
A second embodiment is a form in which the first embodiment and the modified examples are applied to federated learning using secure computation. Federated learning is a technique of performing machine learning while learning data are distributed without being aggregated. In federated learning, a plurality of model learning devices perform machine learning using learning data (local learning data) held by themselves to generate worker models (local models) and transmit the generated worker models to a federated learning device. The federated learning device generates an aggregated model (a global model) obtained by aggregating the worker models sent from the plurality of model learning devices and transmits the generated aggregated model to the plurality of model learning devices. The plurality of model learning devices receiving the aggregated model further update the aggregated model through machine learning using learning data held by themselves to generate new worker models and transmit the generated worker models to the federated learning device. By repeating such processing, each model learning device can obtain an aggregated model in which the learning data held in the plurality of model learning devices are reflected in machine learning without passing the learning data held by itself to the outside.
However, in normal federated learning, the federated learning device receives plaintext worker models from each model learning device. For that reason, the federated learning device can know the tendency of the learning data held by each model learning device on the basis of differences between the transmitted aggregated model and the received worker models.
For that reason, in the present embodiment, instead of the model learning devices transmitting the worker models to the federated learning device, the model learning devices transmit secret information of information identifying the worker models to a secure federated learning device. The secure federated learning device obtains secret information of information identifying a plurality of worker models from a plurality of model learning devices, obtains secret information of information identifying an aggregated model obtained by aggregating the plurality of worker models by secure computation using the secret information of the information identifying the plurality of worker models without obtaining the plurality of worker models, and transmits information identifying the aggregated model or secret information of the information identifying the aggregated model to the plurality of model learning devices. Each model learning device restores the information identifying the aggregated model from the secret information, updates the aggregated model by machine learning using learning data (local learning data) held by itself, to obtain a new worker model. Further, each model learning device similarly transmits secret information of information identifying the worker model to the secure federated learning device. By repeating such processing, each model learning device can obtain an aggregated model in which the learning data held in the plurality of model learning devices is reflected in machine learning while protecting information of the learning data held by itself.
In the present embodiment, the first embodiment and the modified examples are applied to such a method. In this case, the client device 11-n described in the first embodiment and the modified examples corresponds to a model learning device, and the secure computation device 12-m corresponds to a secure federated learning device. The original information a-n stored in the storage unit 111-n of the client device 11-n of the present embodiment is information identifying an aggregated model in federated learning. The information identifying the aggregated model is, for example, a group of model parameters of the aggregated model. Further, learning data D-n (local learning data) is also stored in the storage unit 111-n of the client device 11-n.
The processing unit 113-n of the client device 11-n performs machine learning using the learning data D-n read from the storage unit 111-n, updates an aggregated model identified by the original information a-n (information identifying the aggregated model) read from the storage unit 111-n to obtain a worker model, to output information identifying the worker model as information based on the original information a-n. The information identifying the worker model is, for example, a group of model parameters of the worker model. The aggregated model and the worker model are known machine learning models. There are no limitations to the aggregated model and worker model, and for example, they may be models based on a deep learning method, models based on a hidden Markov model method, models based on a support vector machine method, or models based on linear prediction. However, all the aggregated model and the worker models handled in the present embodiment are models based on the same method. The concealment unit 114-n securely distributes information identifying the worker model (information based on the original information a-n) to obtain and output R pieces of secret information [a-n]L(1), . . . , [a-n]L(R) (secret information of the information identifying the worker model).
The secure computation of the present embodiment is computing for obtaining the secure computation result [b]L(r), which is secret information of information identifying an aggregated model, using the secret information [a-n]L(1), . . . , [a-N]L(R), without obtaining worker models. The secure computation device 12-L(r) (where r=1, . . . , R) obtains and outputs the secure computation result [b]L(r), which is the secret information of the information identifying the aggregated model, by the secure computation, using the secret information [a-n]L(1), . . . , [a-N]L(R). For example, when the information a-n identifying a worker model is a group of model parameters {p1(n), . . . , pK(n)} of the worker model, a group of model parameters {P1, . . . , pK} obtained by aggregating groups of model parameters {p1(n1), . . . , pK(n1)}, . . . , {p1(nmax), . . . , pK(nmax)} where {n1, . . . , nmax}⊆{1, . . . , N} becomes information identifying an aggregated model. For example, pk is a function value of a weighted linear combination value, an average value, or the like of pk(n1), . . . , pk(nmax). Here, k is indexes k=1, . . . , K for identifying model parameters, and K is a positive integer. The obtained secure computation result [b]L(r) (where, r=1, . . . , R) is transmitted to the client device 11-n (where n=1, . . . , N). The acquisition unit 112-n of the client device 11-n receives the secure computation result [b]L(r) and stores the operation result b (information identifying the aggregated model) restored from the secure computation result [b]L(r) in the storage unit 111-n as new original information a-n.
After that, the above-described processing is repeated until a predetermined condition is satisfied. Thus, the federated learning that is highly safe and in which irregular processing of secure computation can be monitored and verified can be performed.
Forms in which in which the first embodiment is applied to federated learning using secure computation will be exemplified below. However, the present invention is not limited thereto.
As illustrated in
As illustrated in
As illustrated in
Learning data D-n is stored in the storage unit 111-n of each client device 21-n. The acquisition unit 112-n of the client device 21-n receives information (original information a-n) identifying an aggregated model in federated learning and stores the original information a-n in the storage unit 111-n. When the federated learning is not yet performed, the acquisition unit 112-n receives initial information of information identifying the aggregated model as information identifying the original information a-n. The acquisition unit 112n stores the original information a-n in the storage unit 111-n when receiving information representing the original information a-n (aggregated model) itself, and stores the original information a-n (aggregated model) restored from secret information in the storage unit 111-n when receiving the secret information of the original information a-n (step S111-n).
The processing unit 213-n reads the original information a-n (aggregated model) and the learning data D-n from the storage unit 111-n, updates the aggregated model identified by the original information a-n by machine learning using the learning data D-n to obtain a worker model, and sends information identifying the worker model (for example, a group of model parameters) to the concealment unit 114-n as information based on the original information a-n (step S213-n).
The concealment unit 114-n obtains and outputs R pieces of secret information [a-n]L(1), . . . , [a-N]L(R) by securely distributing the information (information identifying the worker model) based on the sent original information a-n. The secret information [a-n]L(1), . . . , [a-N]L(R) is stored in the storage unit 111-n (step S114-n).
Based on this premise, secure computation processing is executed.
First, consensus processing units 128a-1, . . . , 128a-M (
For the blockchains BC1, . . . , BCR, when secure computation devices 22-L(1), . . . , 12-L(R) are selected as leaders LEAD1, . . . , LEADR, a smart contract function of the blockchain platform of the cloud 13 transmits processing requests to these secure computation devices 22-L(1), . . . , 22-L(R) to execute secure computation. In addition, {L(1), . . . , L(R)}⊆{1, . . . , M}. The processing request includes information about a transmission destination of a secure computation result (step S131).
An acquisition unit 121-L(r) (
The acquisition unit 121-L(r) of the secure computation device 22-L(r) (
The providing unit 123-L(r) transmits the secure computation result [b]L(r) to the transmission destination included in the processing request. For example, the secure computation result [b]L(r) is transmitted to the client devices 21-1, . . . , 21-N. The acquisition unit 112-n of the client device 21-n (
Further, the one-way function operation unit 128b-L(r) of the secure computation device 12-L(r) (
Each block processing unit 128c-L(r) (where r=1, . . . , R) stores the received one-way function value in the latest block Br(ir) of each blockchain BCr (
After that, the above-described secure distributing processing and secure computation processing of the present embodiment are repeated until a predetermined end condition is satisfied. This repetition is performed while updating the operation result b (information identifying the aggregated model) as new original information a-n (information identifying the aggregated model) in step S112-n. Also, any end conditions may be used. For example, the end condition may be satisfied when the number of updates, amounts of updates, times of updates, or the like of the aggregated model reach a specified value.
The client devices 11-n and 21-n and the secure computation devices 12-m and 22-m according to each embodiment are devices configured by general-purpose or dedicated computers executing predetermined programs, which include, for example, processors (hardware processors) such as central processing units (CPUs), and memories such as random-access memories (RAMs) and read-only memories (ROMs). That is, the client devices 11-n and 21-n and the secure computation devices 12-m and 22-m according to each embodiment have, for example, processing circuitry configured to incorporate their respective units. This computer may include one processor and a memory, or may include a plurality of processors and memories. This program may be installed in the computer or may be recorded in a ROM or the like in advance. In addition, some or all processing units may be configured using electronic circuitry which realizes a processing function independently, instead of electronic circuitry which realizes a functional configuration by reading a program like a CPU. Further, electronic circuitry constituting one device may include a plurality of CPUS.
The above-described program can be recorded on a computer-readable recording medium. An example of the computer-readable recording medium is a non-transitory recording medium. Examples of such a recording medium include a magnetic recording device, an optical disc, a magneto-optical recording medium, a semiconductor memory, and the like.
The program is distributed, for example, by selling, transferring, lending, or the like of portable recording media such as DVDs and CD-ROMs on which the program is recorded. Further, a configuration may be adopted in which the program is stored in a storage device of a server computer and distributed by transferring the program from the server computer to another computer via a network. As described above, the computer executing such a program, for example, first, temporally stores the program stored in the portable recording medium or the program transferred from the server computer in its own storage device. Then, at the time of executing the processing, the computer reads the program stored in its own storage device and executes the processing may be executed in accordance with the read program. Also, as another execution form of the program, the computer may directly read the program from the portable recording medium and execute the processing in accordance with the program, or each time the program is transferred from the server computer to the computer, processing may be executed sequentially in accordance with the received program. In addition, a configuration may be adopted in which the above-described processing is executed by a so-called application service provider (ASP) type service which does not transfer the program from the server computer to the computer and realizes processing functions only by issuing execution instructions and acquiring the results. Further, each processing may be executed in accordance with a smart contract function on a blockchain platform. Also, the program in the present form is assumed to include information that is used for processing by an electronic computer and is equivalent to a program (such as data that is not a direct command to the computer but has a property for defining processing of the computer).
Although the present device is configured by executing a predetermined program on a computer in each embodiment, at least a part of the processing content may be implemented by hardware.
Also, the present invention is not limited to the above-described embodiments. For example, the above-described various processing may not only be executed in chronological order as described, but may also be executed in parallel or individually depending on the processing capacity of the device that executes the processing or as needed. In addition, it is needless to say that changes can be made as appropriate without departing from the gist of the present invention.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2022/016502 | 3/31/2022 | WO |
