Patent Application
20220413802
The present invention relates to a computation apparatus for calculating an odds ratio by means of secure computation (hereinafter also referred to as “secure odds ratio computation”), a method of the same, and a program.
The odds ratio is one of the frequently used statistics in medical statistics. The odds ratio can be calculated based on a 2×2 summary table.
o=(a·d)/(b·c) (1)
Secure computation is one of the techniques for performing predetermined computation with input data encrypted. There are various encryption methods in secure computation, and an example is the method described in NPL 1. In the method in NPL 1, input data is subjected to encryption processing in which numerical values that express data are fragmented and distributed to three secure computation apparatuses. Each individual fragment is a seemingly random value, and the original value cannot be obtained unless the fragments are collected and restored. In the method in NPL 1, three secure computation apparatuses can perform addition, subtraction, multiplication, and logical operations with fixed-point numbers on the input data without restoring the input data by cooperating to perform computation. Division of fixed-point numbers can be realized using, for example, a method called secure batch mapping (see NPL 2).
In medical statistics, delicate data is dealt with and therefore security is very important. In previous studies on secure computation for medical statistics, a method of obtaining an odds ratio based on a weight learned by performing logistic regression analysis as in NPL 3 has been proposed.
However, a method for securely calculating the expression (1) has not been proposed. In a simple analysis without confounding factors, the computation of the expression (1) is sufficient, and thus the logistic regression calculation in NPL 3 is unnecessary in that case. That is to say, NPL 3 has a problem of performing logistic regression, which is very computationally expensive compared to arithmetic operations.
The present invention solves this problem by securely calculating the expression (1). Here, there are also two problems in the secure computation of the expression (1).
In the present invention, the secure computation of the expression (1) is performed using fixed-point arithmetic. The problem with computations using fixed-point numbers is that overflow tends to occur. To handle the case where the input value is large, it is necessary to devise computation to avoid overflow.
Next, division by zero may occur in a defining equation for the odds ratio, but the odds ratio cannot be defined if division by zero occurs. For this reason, the occurrence of division by zero needs be detected and distinguished from normal computation results. In the case of plain-text computations, it is easy to distinguish the normal computation results from invalid values, since errors can be checked by looking at intermediate results during the computation. However, if the secure computation of the expression (1) is performed as-is, the occurrence of division by zero cannot be detected and cannot be distinguished from the normal computation results.
An object of the present invention is to provide a computation apparatus, a method of the same, and a program with which secure computation is performed using fixed-point arithmetic, and overflow is unlikely to occur and the occurrence of division by zero can be detected when an odds ratio is calculated.
To solve the foregoing problems, according to an aspect of the present invention, a computation apparatus includes: an odds ratio computation unit for obtaining an odds ratio between a first group (a+b) and a second group (c+d) based on four plaintext values a, b, c, and d, by means of secure computation; a zero-division detection unit for determining, by means of secure computation, whether or not at least one of the plaintext values b and c is not zero, and detecting division by zero; and a selection unit for selecting the odds ratio if division by zero is not detected, by means of secure computation, wherein the odds ratio computation unit obtains ciphertexts [[o′1]] and [[o′2]] of results o′1 and o′2 of calculating a/b and d/c, respectively, by means of secure computation, and thereafter obtains a ciphertext [[o′]] of a result o′ of calculating o′1×o′2.
To solve the foregoing problem, according to another aspect of the present invention, a computation apparatus includes: a division unit for taking ciphertexts [[a]], [[b]], [[c]], and [[d]] of plaintext values a, b, c, and d as input, and obtaining ciphertexts [[o′1]] and [[o′2]] of results o′1 and o′2 of calculating a/b and d/c, respectively, by [[o′1]]←[[a]]/[[b]] and [[o′2]]←[[d]]/[[c]], by means of secure computation; a multiplication unit for taking the ciphertexts [[o′i]] and [[o′2]] as input and obtaining a ciphertext [[o′]] of a result o′ of computation of plaintext values o′1×o′2 by [[o′]]77 [[o′1]]×[[o′2]], by means of secure computation; an equality judgment unit for taking the ciphertexts [[b]] and [[c]] as input and obtaining ciphertexts [[f1]] and [[f2]] of truth values f1 and f2 with predicates b=?0 and c=?0, respectively, by [[f1]]←[[b]]=?[[0]] and [[f2]]←[[c]]=?[[0]], by means of secure computation; a logical operation unit for taking the ciphertexts [[f1]] and [[f2]] as input and obtaining a ciphertext [[f]] of a result f of calculating f1 Or f2 by [[f]]←Or([[f1]], [[f2]]), by means of secure computation; and a selection unit for taking the ciphertexts [[f]] and [[o′]] as input and obtaining a ciphertext [[o]] of o that satisfies
by [[o]]←If Else([[f]], [[⊥]], [[o′]]), by means of secure computation, wherein ⊥ indicates an invalid value.
The present invention has an effect that overflow is unlikely to occur and the occurrence of division by zero can be detected.
Hereinafter, the embodiment of the present invention will be described. Note that in the diagrams used in the following description, constituent units with the same functions and steps in which the same processing is performed are assigned the same signs, and redundant description is omitted. In the following description, processing performed for each element unit of a vector or a matrix is assumed to be applied to all elements of that vector or matrix, unless otherwise noted.
First, the points of the present embodiment will be described, and then the notation used in the present embodiment will be described.
In the present embodiment, the maximum value of an intermediate computation result is reduced from n2 to n by devising the computation method, thereby avoiding overflow. In addition, division by zero in the secure odds ratio computation is detected by effectively combining comparison, logic, and selection operations, and ⊥ is returned if division by zero occurs. Here, ⊥ indicates an invalid value.
<Encryption>
A value obtained by encrypting a in some way is called a ciphertext of a, and is denoted as [[a]]. Also, a is called a plaintext value of the ciphertext [[a]].
The following arithmetic operations, logical operations, equality judgments, and selections are performed by means of secure computation. Note that the method for encryption in secure computation may be any method. For example, any of the methods described in NPL 1 and 2, or the like, is used.
<Arithmetic Operations>
Each operation of addition, subtraction, multiplication, and division by means of secure computation takes ciphertexts [[a]] and [[b]] of a and b as input, and outputs ciphertexts [[c1]], [[c2]], [[c3]], and [[c4]] of the results c1, c2, c3, and c4 of calculating a+b, a−b, ab, and a/b, respectively. The execution of these operations is described as follows.
[[c1]]←Add([[a]],[[b]])
[[c2]]←Sub([[a]],[[b]])
[[c3]]←Mul([[a]],[[b]])
[[c4]]←Div([[a]],[[b]])
Note that, in the following, Add([[a]], [[b]]), Sub([[a]], [[b]]), Mul([[a]], [[b]]), and Div([[a]], [[b]]) are also denoted as [[a]]+[[b]], [[a]]-[[b]], [[a]]×[[b]], [[a]]/[[b]], respectively.
<Logical Operations>
The Or operation by means of secure computation takes the ciphertexts [[a]] and [[b]] of 1-bit values a and b as input, and outputs a ciphertext [[c]] of a result c of calculating a Or b. The execution of this operation is described as follows. [[c]]←Or([[a]], [[b]])
<Equality Judgment>
The operation of equality judgment takes the ciphertexts [[a]] and [[b]] of a and b as input, and outputs the ciphertext [[c]] of a truth value c of a predicate a=?b. The execution of this operation is described as follows. [[c]]←[[a]]=?[[b]]
<Selection>
The selection takes the ciphertexts [[c]], [[a]], and [[b]] of a truth value c∈{0,1} and a and b, and outputs a ciphertext [[d]] of d that satisfies
The execution of this operation is described as follows.
[[d]]←If Else([[c]],[[a]],[[b]])
<Secure Summary Table Computation>
An encrypted summary table itself used as input for the secure odds ratio computation can also be calculated by means of secure computation. In the following, processing for reading an encrypted database [[D]] and returning the ciphertexts ([[a]], [[b]], [[c]], [[d]]) of a contingency table is denoted as ([[a]], [[b]], [[c]], [[d]])←Count([[D]]). There are several possible ways to realize Count ([[D]]), but for example, if n is known and it is assumed the format of the database takes two values of [[0]], [[1]] and has two attributes, subtotal portions (n1., n2., n.1, n.2) and a can be calculated by addition and constant multiplication. Then, all elements of the summary table can be calculated based on the relationship between the subtotals and each element.
The computation apparatus includes a division unit 110, a multiplication unit 120, an equality judgment unit 130, a logical operation unit 140, and a selection unit 150.
The computation apparatus receives input of the ciphertexts [[a]], [[b]], [[c]], and [[d]], obtains an odds ratio o by means of secure computation, and outputs the obtained odds ratio o or ⊥ indicating an invalid value. Note that the computation apparatus may calculate the ciphertexts [[a]], [[b]], [[c]], and [[d]] by calculating a pre-calculated summary table, or by performing secure summary table computation with the encrypted database [[D]] as input.
The computation apparatus is, for example, a special device configured by loading a special program into a known or dedicated computer that has a central processing unit (CPU), a main storage device (RAM: Random Access Memory), and so on. The computation apparatus executes each processing under the control of the central processing unit, for example. Data input to the computation apparatus and data obtained by each processing is, for example, stored in the main storage device, and the data stored in the main storage device is loaded to the central processing unit and used in other processing as necessary. Each processing unit of the computation apparatus may be constituted at least partially by hardware such as an integrated circuit. Each storage unit included in the computation apparatus may be constituted by, for example, a main storage device such as a RAM (Random Access Memory) or middleware such as a relational database or a key-value store. However, each storage unit does not necessarily need to be installed in the computer, but may alternatively be constituted by an auxiliary storage device constituted by an auxiliary storage device consisting of a hard disk, an optical disk, or a semiconductor memory device such as a flash memory (Flash Memory), and installed outside the computation apparatus.
Each unit will be described below.
<Division Unit 110>
The division unit 110 takes the ciphertexts [[a]], [[b]], [[c]], and [[d]] as input, obtains ciphertexts [[o′1]] and [[o′2]] of results o′1 and o′2 of calculating a/b and d/c using the following expressions (2) and (3) (S110), and outputs ciphertexts [[o′1]], [[o′2]].
[[o′1]]←[[a]]/[[b]] (2)
[[o′2]]←[[d]]/[[c]] (3)
<Multiplication Unit 120>
The multiplication unit 120 takes the ciphertext [[o′1]], [[o′2]] as input, obtains, using the following expression (4), a ciphertext [[o′]] of a result o′ of the computation of plaintext values o′1×o′2 (S120), and outputs the ciphertext [[o′]].
[[o′]]←[[o′1]]×[[o′2]] (4)
In other words, the odds ratio o′ that is calculated based on a, b, c, and d in the 2×2 summary table is obtained by the expressions (2)-(4). In other words, the odds ratio between the first group (a+b) and the second group (c+d) are obtained based on the four plaintext values a, b, c, and d. Accordingly, the division unit 110 and the multiplication unit 120 are also collectively called an odds ratio computation unit 160, and processing performed thereby is S160.
<Equality Judgment Unit 130>
The equality judgment unit 130 takes the ciphertext [[b]] and [[c]] as input, obtains ciphertexts [[f1]] and [[f2]] of truth values f1 and f2 with predicates b=?0 and c=?0 by the following expression (S130), and outputs the ciphertexts [[f1]] and [[f2]].
[[f1]]←[[b]]=?[[0]] (5)
[[f2]]←[[c]]=?[[0]] (6)
<Logical Operation Unit 140>
The logical operation unit 140 takes the ciphertexts [[f1]] and [[f2]] as input, obtains a ciphertext [[f]] of a result f of calculating f1 Or f2 by the following expression (S140), and outputs the ciphertext [[f]].
[[f]]←Or([[f1]],[[f2]]) (7)
<Selection Unit 150>
The selection unit 150 takes the ciphertexts [[f]] and [[o′]] as input, obtains a ciphertext [[o]] of o that satisfies
by the following equation (S150), and outputs the ciphertext [[o]].
[[o]]←If Else([[f]],[[⊥]],[[o′]]) (8)
That is to say, division by zero is detected by the expressions (5) to (7). Accordingly, the equality judgment unit 130 and the logical operation unit 140 are also collectively called a zero-division detection unit 170, and processing performed thereby is S170. By the expression (8), the selection unit 150 selects a ciphertext [[⊥]] of ⊥ indicating an invalid value if division by zero is detected, or selects a ratio ciphertext [[o′]] of the odds ratio o′ if division by zero is not detected, and outputs the selection result [[o]].
In the present embodiment, division by zero is detected by effectively combining comparison, logic, and selection operations as represented by the expressions (5) to (8), and replaces the computation result of (4) with ⊥ if division by zero is detected.
When the expression (1) is simply calculated, division and comparison operations can be done at a time by calculating ad and bc and thereafter performing division. In this method, however, overflow occurs when values to be handled are large, and a correct computation result cannot be obtained. In the present embodiment, the number of times of costly division increases compared with multiplication, but instead, the largest value during computation decreases from n2 to n as a result of calculating [[o′1]]←[[a]]/[[b]] and [[o′2]]←[[d]]/[[c]] and thereafter calculating the product [[o′]]←[[o′1]]×[[o′2]], and thus, large values can be handled while avoiding overflow.
In other words, when secure computation of the odds ratio using the expression (1) is performed by means of fixed-point arithmetic, it is possible to detect division by zero and distinguish it from the correct computation result even in secure computation in which the intermediate computation result is invisible. In addition, large input can also be dealt with by avoiding overflow.
<Other Modifications>
The present invention is not limited to the above embodiments and modifications. For example, various types of processing described above may be not only performed in time-series in accordance the description, but also performed in parallel or separately in accordance with the performance of the device that performs processing, or as required. In addition, the present invention may be modified, as appropriate, within the scope of the gist thereof.
<Program and Recording Medium>
The above-described processing can be implemented by causing a recording unit 2020 of a computer shown in
The program that describes this processing content can be recorded in a computer-readable recording medium. The computer-readable recording medium may be of any kind, e.g., a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or the like.
This program is distributed by, for example, selling, transferring, or lending a portable recording medium, such as a DVD or a CD-ROM, in which the program is recorded. Furthermore, a configuration is also possible in which this program is stored in a storage device in a server computer, and is distributed by transferring the program from the server computer to other computers via a network.
For example, first, a computer that executes such a program temporarily stores the program recorded in the portable recording medium or the program transferred from the server computer in a storage device of this computer. When executing the processing, the computer loads the program stored in its own storage medium, and executes processing in accordance with the loaded program. As another mode of executing this program, the computer may directly load the program from the portable recording medium and execute processing in accordance with the program, or may sequentially execute processing in accordance with a received program every time the program is transferred from the server computer to this computer. A configuration is also possible in which the above-described processing is executed through a so-called ASP (Application Service Provider)-type service that realizes processing functions only by giving instructions to execute the program and acquiring the results, without transferring the program to the computer. Note that the program in this mode may include information for use in processing performed by an electronic computer that is equivalent to a program (e.g., data that is not a direct command to the computer but has properties that define computer processing).
In this mode, the present device is configured by executing a predetermined program on a computer, but the content of this processing may be at least partially realized in a hardware manner.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2019/039504 | 10/7/2019 | WO |
