Patent Application
20230112699
The present disclosure relates to a confidential-information processing system.
Homomorphic cipher is a cipher technique which can compute data while the data remains encrypted. Nowadays, a cloud service has started being in use widely. It is supposed that data is encrypted and stored on cloud because of concern about cracking or concern about reliability on the cloud. The homomorphic cipher can implement computation on encrypted data without decryption. Therefore, it is possible to utilize the cloud service without impairing security, by using the homomorphic cipher.
The homomorphic cipher which satisfies circuit confidentiality is an encryption technique achieving security which prevents information on a computation process from leaking from a computation result which remains encrypted, for enhancing the security of the homomorphic cipher.
Especially, strong circuit confidentiality is said to be satisfied by the homomorphic cipher achieving security which prevents information on homomorphic computation from leaking from a result of the homomorphic computation on a ciphertext which is not generated using encryption algorithm, among the homomorphic ciphers which satisfy the circuit confidentiality. At a time of performing computation while keeping a state being encrypted, the homomorphic cipher which satisfies the strong circuit confidentiality is realized by computation using homomorphic cipher which satisfies normal circuit confidentiality (that is, the circuit confidentiality is established only for a ciphertext generated by the encryption algorithm), while keeping the state being encrypted, after legitimacy of input (specifically, a fact that an encryption key and the ciphertext which serve as inputs to computation are generated by key generation algorithm and encryption algorithm, respectively) is confirmed.
An initial configuration example of the homomorphic cipher which satisfies the strong circuit confidentiality is described in Non-Patent Literature 1. A configuration described in Non-Patent Literature 1 has a problem that the homomorphic computation can be performed only on ciphertexts which have been encrypted using the same key. A configuration in Non-Patent Literature 2 has solved this problem. Non-Patent Literature 2 describes a configuration of strong-circuit-confidentiality homomorphic cipher which can perform the homomorphic computation also on ciphertexts which have been encrypted using different encryption keys.
In conventional circuit-confidentiality homomorphic cipher described in Non-Patent Literature 2, security is on a basis of a unique calculation problem called a Decisional Small Polynomial Ratio (DSPR) problem. It is known that this problem can be easily broken using a quantum computer. Especially, in a homomorphic cipher technique described in Non-Patent Literature 2, the security of the circuit-confidentiality homomorphic cipher used as a constituent depends on difficulty of the DSPR problem. Therefore, there is a problem that even the homomorphic cipher itself which satisfies the strong circuit confidentiality is not secure against the quantum computer.
The present disclosure mainly aims to solve such a problem. Specifically, the present disclosure mainly aims to realize a strong-circuit-confidentiality homomorphic cipher technique which can perform homomorphic computation on ciphertexts encrypted using different encryption keys and is secure against a quantum computer.
A confidential-information processing system according to the present disclosure includes:
an encryption apparatus to generate ciphertext data C of plaintext data x by an equation 1, using a matrix B included in an encryption key PK used for homomorphic computation, a random-number matrix R, a random-number matrix E, and a tensor product G of a predetermined vector and a predetermined identity matrix
C=B·R+E+x·G equation 1; and
According to the present disclosure, it is possible to realize a strong-circuit-confidentiality homomorphic cipher technique which can perform homomorphic computation on ciphertexts encrypted using different encryption keys and is secure against a quantum computer.
Hereinafter, an embodiment will be described with reference to the drawings. In the following description of the embodiment and the drawings, parts assigned by the same reference numerals indicate the same parts or corresponding parts.
The confidential-information processing system 100 includes a public-parameter generation apparatus 200, a key generation apparatus 300, an encryption apparatus 400, a circuit-confidentiality homomorphic computation apparatus 500, and a decryption apparatus 600.
The Internet 101 is a communication path connecting the public-parameter generation apparatus 200, the key generation apparatus 300, a plurality of encryption apparatuses 400, the circuit-confidentiality homomorphic computation apparatus 500, and the decryption apparatus 600 with each other.
The Internet 101 is an example of a network. Instead of the Internet 101, a different type of network may be used.
For example, the public-parameter generation apparatus 200 is a PC (Personal Computer). The public-parameter generation apparatus 200 generates a public parameter used for generating an encryption key, a decryption key, and a ciphertext. Then, the public-parameter generation apparatus 200 transmits the public parameter to the key generation apparatus 300, the encryption apparatus 400, and the circuit-confidentiality homomorphic computation apparatus 500 via the Internet 101. Note that, this public parameter may be directly sent by postal mail.
For example, the key generation apparatus 300 is a PC. The key generation apparatus 300 generates the encryption key used for encryption, and the decryption key. Then, the key generation apparatus 300 transmits the encryption key to the encryption apparatus 400 and the circuit-confidentiality homomorphic computation apparatus 500 and transmits the decryption key to the decryption apparatus 600, via the Internet 101. Note that, the encryption key and the decryption key may be directly sent by postal mail.
Since the decryption key is secret information, the decryption key is stored inside of the key generation apparatus 300 and the decryption apparatus 600 so that it does not leak.
For example, the encryption apparatus 400 is a PC. The encryption apparatus 400 generates ciphertext data by encrypting plaintext data obtained from a sensor or the like in a factory, with use of the public parameter and the encryption key which are stored. Then, the encryption apparatus 400 transmits the ciphertext data to the circuit-confidentiality homomorphic computation apparatus 500. Below, the ciphertext data may be simply referred to as a ciphertext.
Note that, an operation procedure of the encryption apparatus 400 is equivalent to an encryption method. Further, a program which realizes an operation of the encryption apparatus 400 is equivalent to an encryption program.
For example, the circuit-confidentiality homomorphic computation apparatus 500 is a computer including a large-volume storage medium. The circuit-confidentiality homomorphic computation apparatus 500 functions also as a data storage device. That is, the circuit-confidentiality homomorphic computation apparatus 500 stores the ciphertext data when it is requested to store the ciphertext data by the encryption apparatus 400.
The circuit-confidentiality homomorphic computation apparatus 500 performs homomorphic computation on the ciphertext data which has been stored (hereinafter, referred to as stored ciphertext data). That is, the circuit-confidentiality homomorphic computation apparatus 500 generates ciphertext data which is a result of computation on plaintext data of the stored ciphertext data, from the stored public parameter and the stored ciphertext data. Then, the circuit-confidentiality homomorphic computation apparatus 500 transmits the generated ciphertext data to the decryption apparatus 600.
For example, the decryption apparatus 600 is a PC. The decryption apparatus 600 functions also as a decryption-key storage apparatus which receives the decryption key transmitted from the key generation apparatus 300 and stores the decryption key.
The decryption apparatus 600 receives the ciphertext data transmitted from the circuit-confidentiality homomorphic computation apparatus 500. Further, the decryption apparatus 600 obtains the computation result by decrypting the ciphertext data with use of the stored decryption key.
Note that, two or more of the public-parameter generation apparatus 200, the key generation apparatus 300, the encryption apparatuses 400, the circuit-confidentiality homomorphic computation apparatus 500, and the decryption apparatus 600 may be included in the same PC simultaneously.
As illustrated in
Below, a functional configuration example of the public-parameter generation apparatus 200, a functional configuration example of the key generation apparatus 300, a functional configuration example of the encryption apparatuses 400, a functional configuration example of the circuit-confidentiality homomorphic computation apparatus 500, and a functional configuration example of the decryption apparatus 600 will be described in order.
As illustrated in
The public-parameter generation apparatus 200 includes a storage medium, not illustrated, which stores data used in each unit in the public-parameter generation apparatus 200.
The input unit 201 receives a security parameter λ and outputs the security parameter λ to the public-parameter generation unit 202.
The public-parameter generation unit 202 uses as input, the security parameter λ received from the input unit 201, and generates a public parameter PP for generating the encryption key and the decryption key. Further, the public-parameter generation unit 202 outputs the public parameter PP to the transmission unit 203.
To be accurate, the public-parameter generation unit 202 generates a public parameter PPi for each integer i being i=1, . . . , N (N is an integer being 1 or larger). That is, the public-parameter generation unit 202 generates N public-parameters PP. Below, for simplification of descriptions, the public parameter PPi is simply referred to as a public parameter PP unless it is necessary to mention the public parameter PPi for each integer i.
The transmission unit 203 transmits the public parameter PP generated by the public-parameter generation unit 202, to the key generation apparatus 300, the encryption apparatus 400, and the circuit-confidentiality homomorphic computation apparatus 500.
As illustrated in
The key generation apparatus 300 includes a storage medium, not illustrated, which stores data used in each unit in the key generation apparatus 300.
The input unit 301 receives the public parameter PP and outputs the public parameter PP to the public-parameter storage unit 302. Also, the input unit 301 receives the security parameter λ and outputs the security parameter λ to the decryption-key generation unit 303.
The public-parameter storage unit 302 stores the public parameter PP received from the input unit 301.
The decryption-key generation unit 303 generates a decryption key SK. Further, the decryption-key generation unit 303 outputs the decryption key SK to the encryption-key generation unit 304 and the transmission unit 305.
To be accurate, the decryption-key generation unit 303 generates a decryption key SKi for each integer i being i=1, . . . , N. That is, the decryption-key generation unit 303 generates N decryption keys SK. Below, for simplification of descriptions, the decryption key SKi is simply referred to as a decryption key SK unless it is necessary to mention the decryption key SKi for each integer i.
The encryption-key generation unit 304 uses as input, the decryption key SK received from the decryption-key generation unit 303 and generates an encryption key PK. Further, the encryption-key generation unit 304 outputs the encryption key PK to the transmission unit 305.
To be accurate, the encryption-key generation unit 304 generates an encryption key PKi for each integer i being i=1, . . . , N. That is, the encryption-key generation unit 304 generates N encryption keys PK. Below, for simplification of descriptions, the encryption key PKi is simply referred to as an encryption key PK unless it is necessary to mention the encryption key PKi for each integer i.
The transmission unit 305 transmits the decryption key SK generated by the decryption-key generation unit 303, to the decryption apparatus 600.
Also, the transmission unit 305 transmits the encryption key PK generated by the encryption-key generation unit 304, to the encryption apparatus 400 and the circuit-confidentiality homomorphic computation apparatus 500.
As illustrated in
The encryption apparatus 400 includes a storage medium, not illustrated, which stores data used in each unit in the encryption apparatus 400.
The input unit 401 receives the encryption key PK transmitted from the key generation apparatus 300 and outputs the encryption key PK to the encryption-key storage unit 402. Further, the input unit 401 receives plaintext data x and outputs the plaintext data x to the encryption unit 403.
Note that, a process performed by the input unit 401 is equivalent to an input process.
The encryption-key storage unit 402 stores the encryption key PK received from the input unit 401.
The encryption unit 403 receives the encryption key PK output from the encryption-key storage unit 402, and the plaintext data x and the public parameter PP which are output from the input unit 401. Then, the encryption unit 403 generates ciphertext data C of the plaintext data x and outputs the ciphertext data C to the transmission unit 404.
To be accurate, the encryption unit 403 generates ciphertext data Ci of plaintext data xi for each integer i being i=1, . . . , N. That is, the encryption unit 403 generates N pieces of encryption data C of N pieces of plaintext data x. Below, for simplification of descriptions, the plaintext data xi and the ciphertext data Ci for each integer i are simply referred to as plaintext data x and encryption data C unless it is necessary to mention the plaintext data xi and the ciphertext data Ci for each integer i.
A process performed by the encryption unit 403 is equivalent to an encryption process.
The transmission unit 404 receives the ciphertext data C from the encryption unit 403 and transmits the ciphertext data C to the circuit-confidentiality homomorphic computation apparatus 500.
As illustrated in
The circuit-confidentiality homomorphic computation apparatus 500 includes a storage medium, not illustrated, which stores data used in each unit in the circuit-confidentiality homomorphic computation apparatus 500.
The input unit 501 receives the public parameter PP transmitted from the public-parameter generation apparatus 200 and outputs the received public parameter PP to the public-parameter storage unit 502. Further, the input unit 501 receives the encryption key PK transmitted from the key generation apparatus 300 and outputs the received encryption key PK to the encryption-key storage unit 503. Further, the input unit 501 receives the ciphertext data C transmitted from the encryption apparatus 400 and outputs the received ciphertext data C to the ciphertext storage unit 504. Further, the input unit 501 receives a function f and outputs the received function f to the homomorphic computation unit 505.
The public-parameter storage unit 502 stores the public parameter PP received from the input unit 501.
The encryption-key storage unit 503 stores the encryption key PK received from the input unit 501.
The ciphertext storage unit 504 stores the ciphertext data C received from the input unit 501.
The homomorphic computation unit 505 receives: the function f output from the input unit 501; the public parameter PPi for each integer i being i=1, . . . , N, output from the public-parameter storage unit 502; the encryption key PKi for each integer being i=1, . . . , N, output from the encryption-key storage unit 503; and the ciphertext data Ci of the plaintext data xi for each integer i being i=1, . . . , N, output from the ciphertext storage unit 504.
Then, the homomorphic computation unit 505 calculates ciphertext data CX regarding computation result data X=f (x1, . . . , xN) obtained by applying the function f to all pieces of plaintext data xi for each integer i being i=1, . . . , N.
Further, the homomorphic computation unit 505 outputs the ciphertext data CX to the transmission unit 508.
Here, f (x1, . . . , xN) represents a result of computation which applies the function f to the N pieces of plaintext data x1, . . . , xN. Further, hereinafter, the ciphertext data CX represents ciphertext data after homomorphic computation, of the computation result data X regarding an encryption-key set PK1, . . . , PKN. That is, the ciphertext data CX is a computation result of the homomorphic computation on the N pieces of plaintext data x1, . . . , xN.
The computation result data X can be decrypted from the ciphertext data CX by using all of the decryption keys SK1, . . . , SKN.
The transmission unit 508 transmits to the decryption apparatus 600, the ciphertext data CX after the homomorphic computation, received from the homomorphic computation unit 505.
As illustrated in
The decryption apparatus 600 includes a storage medium, not illustrated, which stores data used in each unit in the decryption apparatus 600.
The input unit 601 receives the decryption key SK transmitted from the key generation apparatus 300. Further, the input unit 601 receives the ciphertext data CX after the homomorphic computation, of the computation result data X regarding the encryption-key set PK1, . . . , PKN transmitted from the circuit-confidentiality homomorphic computation apparatus 500.
The decryption-key storage unit 602 stores the decryption key SK received from the input unit 601.
The decryption processing unit 603 receives the ciphertext data CX after the homomorphic computation, output from the input unit 601, and the decryption key SKi for each integer i being i=1, . . . , N, output from the decryption-key storage unit 602. Then, the decryption processing unit 603 decrypts the ciphertext data CX after the homomorphic computation, into the computation result data X which has been encrypted, using the decryption keys SK1, . . . , SKN, and outputs the computation result data X to the decryption-result storage unit 604.
The decryption-result storage unit 604 receives the computation result data X from the decryption processing unit 603 and stores it.
*** Description of Operation ***
Below, an operation of the confidential-information processing system 100 which is equivalent to a confidential-information processing method, according to the present embodiment will be described.
Steps S701 to S709 in
In step S701, the input unit 201 of the public-parameter generation apparatus 200 receives the security parameter λ.
In step S702, the public-parameter generation unit 202 of the public-parameter generation apparatus 200 uses as input, the security parameter λ received by the input unit 201 of the public-parameter generation apparatus 200 in step S701, calculates an equation 1, and generates a public parameter PP represented by a matrix A.
[formula 1]
A←
q
m×n equation 1
Here, n and q are integers being 1 or larger. m is an integer obtained from k×(λ2+1). k is an integer being 1 or larger, and λ is a security parameter. Zqm×n represents a set of matrixes of m×n having integers from 0 to (q−1) as elements.
That is, the public-parameter generation unit 202 randomly selects as the matrix A, a matrix from a plurality of Zqm×n and generates the public parameter PP.
In step S703, the transmission unit 203 of the public-parameter generation apparatus 200 receives the public parameter PP generated by the public-parameter generation unit 202 of the public-parameter generation apparatus 200.
Then, the transmission unit 203 transmits the public parameter PP to the key generation apparatus 300, the encryption apparatus 400, and the circuit-confidentiality homomorphic computation apparatus 500.
In step S704, the input unit 301 of the key generation apparatus 300 receives the public parameter PP transmitted by the transmission unit 203 of the public-parameter generation apparatus 200 in step S703.
In step S705, the public-parameter storage unit 302 of the key generation apparatus 300 stores the public parameter PP received by the input unit 301 of the key generation apparatus 300.
In step S706, the input unit 401 of the encryption apparatus 400 receives the public parameter PP transmitted by the transmission unit 203 of the public-parameter generation apparatus 200 in step S703.
In step S707, the encryption unit 403 of the encryption apparatus 400 stores the public parameter PP received by the input unit 401 of the encryption apparatus 400. The encryption unit 403 may extract a value q from the public parameter PP and store the value q only.
In step S708, the input unit 501 of the circuit-confidentiality homomorphic computation apparatus 500 receives the public parameter PP transmitted by the transmission unit 203 of the public-parameter generation apparatus 200.
In step S709, the public-parameter storage unit 502 of the circuit-confidentiality homomorphic computation apparatus 500 stores the public parameter PP received by the input unit 501 of the circuit-confidentiality homomorphic computation apparatus 500.
Steps S801 to S810 in
In step S801, the input unit 301 of the key generation apparatus 300 receives the security parameter λ.
In step S802, the decryption-key generation unit 303 of the key generation apparatus 300 uses as input, the security parameter λ received by the input unit 301 of the key generation apparatus 300 in step S801, calculates an equation 2, and generates the decryption key SK.
[formula 2]
SK=(1,−s) where s←{0,1}m-1 equation 2
Here, s←{0, 1}m-1 indicates that a vector s is randomly selected from a set of vectors each having (m−1) elements each of which is 0 or 1. (1, −s) represents a vector having m elements, which is obtained by concatenating an integer 1 and a vector −s.
That is, the decryption-key generation unit 303 randomly selects as the vector s, a vector from the set of vectors each having (m−1) elements each of which is 0 or 1, and generates as the decryption key SK, the vector having m elements, by concatenating the vector −s and the integer 1.
In step S803, the encryption-key generation unit 304 of the key generation apparatus 300 uses as input, the decryption key SK generated by the decryption-key generation unit 303 of the key generation apparatus 300 in step S802 and the public parameter PP stored in the public-parameter storage unit 302 of the key generation apparatus 300, and generates the encryption key PK. A matrix B included in the encryption key PK is calculated using an equation 3.
Here, 0(m-1)×n represents a matrix of (m−1)×n, whose elements are all 0. SK·A represents a vector obtained from multiplying the decryption key SK by the matrix A of the public parameter PP.
That is, the encryption-key generation unit 304 generates the matrix B, using an equation 3, and generates the encryption key PK including the matrix B.
In step S804, the transmission unit 305 of the key generation apparatus 300 receives the decryption key SK generated by the decryption-key generation unit 303 of the key generation apparatus 300 in step S802 and the encryption key PK generated by the encryption-key generation unit 304 of the key generation apparatus 300 in step S803.
Then, the transmission unit 305 transmits the encryption key PK to the encryption apparatus 400 and the circuit-confidentiality homomorphic computation apparatus 500 and transmits the decryption key SK to the decryption apparatus 600.
In step S805, the input unit 401 of the encryption apparatus 400 receives the encryption key PK transmitted by the transmission unit 305 of the key generation apparatus 300 in step S804.
In step S806, the encryption-key storage unit 402 of the encryption apparatus 400 stores the encryption key PK received by the input unit 401 of the encryption apparatus 400 in step S805.
In step S807, the input unit 501 of the circuit-confidentiality homomorphic computation apparatus 500 receives the encryption key PK transmitted by the transmission unit 305 of the key generation apparatus 300 in step S804.
In step S808, the encryption-key storage unit 503 of the circuit-confidentiality homomorphic computation apparatus 500 stores the encryption key PK received by the input unit 501 of the circuit-confidentiality homomorphic computation apparatus 500 in step S807.
In step S809, the input unit 601 of the decryption apparatus 600 receives the decryption key SK transmitted by the transmission unit 305 of the key generation apparatus 300 in step S804.
In step S810, the decryption-key storage unit 602 of the decryption apparatus 600 stores the decryption key SK received by the input unit 601 of the decryption apparatus 600 in step S809.
Note that, since the decryption key SK is secret information, the decryption-key storage unit 602 of the decryption apparatus 600 needs to stringently store the decryption key SK so that it does not leak to the outside.
Steps S901 to S905 in
In step S901, the input unit 401 of the encryption apparatus 400 obtains the plaintext x collected, for example, by the sensor or the like, and outputs the obtained plaintext data x to the encryption unit 403.
In step S902, the encryption unit 403 of the encryption apparatus 400 calculates an equation 4, using the plaintext data x provided by the input unit 401 in step S901 and the encryption key PK stored in the encryption-key storage unit 402, and generates the ciphertext data C. Calculation of the equation 4 is a process of adding to the plaintext data x, a matrix obtained by adding a random matrix having a small integer as elements, to a result of multiplying a uniformly random matrix by a random matrix having a small integer as elements.
[formula 4]
C=B·R+E+x·G equation 4
Here, B is the matrix B included in the encryption key PK. R and E are random-number matrixes generated by the encryption unit 403. G is a tensor product of (1, 2, . . . , 2L-1) and an identity matrix of m×m. L is a minimum integer equal to or larger than log q. x is the plaintext data x.
That is, the encryption unit 403 generates the random-number matrix R and the random-number matrix E, and calculates the tensor product G of a vector (1, 2, . . . , 2L-1) and the identity matrix of m×m. Then, the encryption unit 403 uses the matrix B, the random-number matrix R, the random-number matrix E, and the tensor product G, and generates the cipher data C of the plaintext data x, using the equation 1.
Note that, the encryption unit 403 generates the ciphertext data C which enables the circuit-confidentiality homomorphic computation apparatus 500 to verify that the matrix B has been generated by a legitimate generator (the key generation apparatus 300) and that the ciphertext data C has been generated by the encryption apparatus 400.
The encryption unit 403 outputs the generated ciphertext data C to the transmission unit 404 of the encryption apparatus 400.
In step S903, the transmission unit 404 of the encryption apparatus 400 receives the ciphertext data C output by the encryption unit 403 in step S902 and transmits the ciphertext data C to the circuit-confidentiality homomorphic computation apparatus 500.
In step S904, the input unit 501 of the circuit-confidentiality homomorphic computation apparatus 500 receives the ciphertext data C transmitted from the transmission unit 404 of the encryption apparatus 400 and outputs the ciphertext data C to the ciphertext storage unit 504.
In step S905, the ciphertext storage unit 504 of the circuit-confidentiality homomorphic computation apparatus 500 receives the ciphertext data C transmitted from the input unit 501 of the circuit-confidentiality homomorphic computation apparatus 500 in step S904 and stores the ciphertext data C.
Steps S1001 to S1008 in
In step S1001, the input unit 501 of the circuit-confidentiality homomorphic computation apparatus 500 receives the function f input from a keyboard, a mouse, a storage device, or the like, and transmits the function f to the homomorphic computation unit 505.
In step S1002, the homomorphic computation unit 505 of the circuit-confidentiality homomorphic computation apparatus 500 uses as input, the function f received from the input unit 501, the public parameters PP1, . . . , PPN stored in the public-parameter storage unit 502, the encryption keys PK1, . . . , PKN stored in the encryption-key storage unit 503, and the ciphertext data Ci of the plaintext data xi stored in the ciphertext storage unit 504 for all integers i being i=1, . . . , N, and generates ciphertext data CX after homomorphic computation (hereinafter, simply referred to as ciphertext data CX), of the computation result data X=f(x1, . . . , xN) regarding all of the encryption keys PK1, . . . , PKN. This calculation is realized by algorithm described in Non-Patent Literature 3.
Then, the homomorphic computation unit 505 outputs the ciphertext data CX after the homomorphic computation to the encryption-key legitimacy confirmation unit 506.
In step S1003, the encryption-key legitimacy confirmation unit 506 of the circuit-confidentiality homomorphic computation apparatus 500 uses as input, the ciphertext data CX after the homomorphic computation, received from the homomorphic computation unit 505, and the encryption keys PK1, . . . , PKN stored in the encryption-key storage unit 503, and verifies that a matrix Bi included in the encryption key PKi for all integers i being i=1, . . . , N has been generated by the key generation apparatus 300.
When it is verified that all of the matrixes Bi have been generated by the key generation apparatus 300, the encryption-key legitimacy confirmation unit 506 outputs the ciphertext data CX after the homomorphic computation to the ciphertext legitimacy confirmation unit 507.
When it is not verified that all of the matrixes Bi have been generated by the key generation apparatus 300, the encryption-key legitimacy confirmation unit 506 outputs to the ciphertext legitimacy confirmation unit 507, ciphertext data CY of random plaintext data Y.
In step S1004, the ciphertext legitimacy confirmation unit 507 of the circuit-confidentiality homomorphic computation apparatus 500 uses as input, the ciphertext data CX after the homomorphic computation, received from the encryption-key legitimacy confirmation unit 506, the encryption keys PK1, . . . , PKN stored in the encryption-key storage unit 503, and pieces of ciphertext data C1, . . . , CN stored in the ciphertext storage unit 504. Then, the ciphertext legitimacy confirmation unit 507 verifies that the ciphertext data Ci for each integer i being i=1, . . . , N has been generated by the matrix Bi included in the encryption key PKi, that is, the ciphertext legitimacy confirmation unit 507 verifies that the ciphertext data Ci has been generated by the encryption apparatus 400.
When it is verified that all of the pieces of ciphertext data Ci have been generated by the matrix Bi included in the encryption key PKi, the ciphertext legitimacy confirmation unit 507 outputs the ciphertext data CX after the homomorphic computation.
When it is not verified that all of the pieces of ciphertext data Ci have been generated by the matrix Bi included in the encryption key PKi, the ciphertext legitimacy confirmation unit 507 outputs to the transmission unit 508, the ciphertext data CY of the random plaintext data Y.
Note that, when the ciphertext data CY of the random plaintext data Y is received from the encryption-key legitimacy confirmation unit 506, the ciphertext legitimacy confirmation unit 507 omits the process of step S1004 and outputs the ciphertext data CY to the transmission unit 508.
In step S1005, the transmission unit 508 of the circuit-confidentiality homomorphic computation apparatus 500 transmits to the decryption apparatus 600, the ciphertext data CX after the homomorphic computation or the ciphertext data CY of the random plaintext data Y each of which has been output from the ciphertext legitimacy confirmation unit 507 in step S1004.
Here, details of the verification in step S1003 will be described.
The encryption key PKi includes the ciphertext of the decryption key SKi by the homomorphic cipher in addition to the matrix Bi. The encryption-key legitimacy confirmation unit 506 uses the ciphertext while the ciphertext remains encrypted, and verifies that the matrix Bi has been correctly generated.
Specifically, the encryption-key legitimacy confirmation unit 506 uses a ciphertext Csi of SKi=si while the ciphertext Csi remains encrypted, and calculates a following function KValidate in a method described in Non-Patent Literature 3.
Here, Ai is the matrix A of the public parameter PPi, and Bi is a matrix B included in the encryption key PKi.
Next, details of the verification in step S1004 will be described.
The ciphertext data CX includes, in addition to the ciphertext data Ci of the plaintext data xi, ciphertext CR and ciphertext CE which are ciphertexts in the homomorphic cipher of the random-number matrix R and the random-number matrix E used for generating the ciphertext data Ci. The ciphertext legitimacy confirmation unit 507 uses the ciphertext CR and the ciphertext CE while the ciphertext CR and the ciphertext CE remain encrypted, and confirms that the ciphertext data Ci has been correctly generated.
Specifically, the ciphertext legitimacy confirmation unit 507 uses a ciphertext CRi and a ciphertext CEi of a random-number matrix Ri and a random-number matrix Ei while the ciphertext CRi and the ciphertext CEi remain encrypted, and calculates a following function CValidate in a method described in Non-Patent Literature 3.
Here, Ri is the random-number matrix R used for generating the matrix Bi, and Ei is the random-number matrix E used for generating the matrix Bi.
In step S1006, the input unit 601 of the decryption apparatus 600 receives the ciphertext data CX after the homomorphic computation or the ciphertext data CY of the random plaintext data Y, each of which has been transmitted from the transmission unit 508 of the circuit-confidentiality homomorphic computation apparatus 500 in step S1005. Then, the input unit 601 outputs the ciphertext data CX after the homomorphic computation or the ciphertext data CY to the decryption processing unit 603.
In step S1007, the decryption processing unit 603 of the decryption apparatus 600 uses as input, the decryption keys SK1, . . . , SKN stored in the decryption-key storage unit 602 of the decryption apparatus 600, performs a decryption process by algorithm described in Non-Patent Literature 3, on the ciphertext data CX after the homomorphic computation or the ciphertext data CY of the random plaintext data Y, each of which has been transmitted from the input unit 601 of the decryption apparatus 600 in step S1006, and obtains a decryption result X or the random plaintext data Y.
Here, the decryption result X=f(x1, . . . , xN) or the random plaintext data Y can be obtained from the ciphertext data CX after the homomorphic computation or the encryption keys PK1, . . . , PKN of the ciphertext data CY, only in a case where the encryption-key generation unit 304 of the key generation apparatus 300 has generated the encryption key PKi, using the decryption key SKi, for each integer i being i=1, . . . , N.
The decryption processing unit 603 outputs the decryption result X or the random plaintext data Y to the decryption-result storage unit 604.
In step S1008, the decryption-result storage unit 604 of the decryption apparatus 600 stores the decryption result X or the random plaintext data Y each of which has been output from the decryption processing unit 603 of the decryption apparatus 600 in step S910.
The decryption apparatus 600 accepts only the ciphertext after the homomorphic computation as input. However, when the ciphertext before the homomorphic computation is required to be decrypted, the decryption apparatus 600 requests the circuit-confidentiality homomorphic computation apparatus 500 to perform the homomorphic computation as to computation which outputs the same value as input without any change. Then, the decryption apparatus 600 decrypts the obtained ciphertext after the homomorphic computation in the same way as the process in step S910. Consequently, it is possible to decrypt the plaintext data of the ciphertext before the homomorphic computation.
In step S1008, the homomorphic computation process and the decryption process in the confidential-information processing system 100 end.
In
The drive 1114 is a device which reads and writes on a storage medium such as an FD (Flexible Disk Drive), a CD (Compact Disc), or a DVD (Digital Versatile Disc).
The ROM 1103, the RAM 1104, the magnetic disk device 1120, and the drive 1114 are examples of the storage device.
The keyboard 1112, the mouse 1113, and the communication board 1105 are examples of the input device. The display 1111 and the communication board 1105 are examples of the output device.
The communication board 1105 is connected to communication networks such as a LAN (Local Area Network), the Internet, and a telephone line, in a wired or wireless way.
The magnetic disk device 1120 stores an OS (Operating System) 1121, a program 1122, and a file 1123.
The program 1122 includes a program which executes a function described as “ . . . unit” in the present embodiment. The program is read and executed by the processor 1101. That is, the program causes a computer to function as “ . . . unit” and to execute a procedure or a method of “ . . . unit”. The program may be stored in a portable storage medium such as a magnetic disk, a flexible disk, an optical disc, a compact disc, a blue-ray (registered trademark) disc, or the DVD. Then the portable storage medium storing the program may be distributed.
The file 1123 includes various types of data (input, output, a determination result, a calculation result, a processing result, and the like) used by “ . . . unit” described in the present embodiment.
Arrows included in a configuration diagram and a flowchart in the present embodiment mainly indicate input/output of pieces of data or signals.
Processes in the present embodiment, described based on the flowcharts are executed using pieces of hardware such as the processor 1101, the storage device, the input device, and the output device.
A part described as “ . . . unit” in the present embodiment may be “ . . . circuit”, “ . . . device”, and “ . . . equipment”, and may also be “ . . . step”, “ . . . procedure”, and “ . . . process”. That is, the part described as “ . . . unit” may be implemented as any of firmware, software, hardware, and a combination of these.
Each of the public-parameter generation apparatus 200, the key generation apparatus 300, the encryption apparatus 400, the circuit-confidentiality homomorphic computation apparatus 500, and the decryption apparatus 600 may be realized by a processing circuit. For example, the processing circuit is a logic IC (Integrated Circuit), a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), or an FPGA (Field-Programmable Gate Array).
Note that, in the present specification, a superordinate concept of the processor and the processing circuit is referred to as “processing circuitry”.
That is, each of the processor and the processing circuit is a specific example of the “processing circuitry”.
According to the present embodiment, it is possible to realize a strong-circuit-confidentiality homomorphic cipher technique which can perform the homomorphic computation on the ciphertexts encrypted using the different encryption keys and is secure against a quantum computer.
The confidential-information processing system 100 according to the present embodiment internally uses circuit-confidentiality homomorphic cipher in which the ciphertext is represented by a matrix, which is secure against the quantum computer.
Therefore, according to the present embodiment, a homomorphic cipher method which has strong circuit confidentiality also has security against the quantum computer. A conventional technique internally uses the circuit-confidentiality homomorphic cipher which is not secure against the quantum computer, therefore, it does not have such security.
More specifically, security against the quantum computer can be obtained from the above equation 4. Generally, security of the cipher is secured by difficulty to solve a calculation problem. Existence of quantum algorithm which solves a problem (specifically, a problem called a learning-with-errors problem) defined using a matrix is not recognized. Thus, the plaintext data x cannot be obtained from the ciphertext data C calculated according to the equation 4.
Further, the strong circuit confidentiality is a characteristic of preventing leakage of information on a function to be calculated with (the function fin the present specification), when encrypted input into the computation is not correctly generated. The encryption-key legitimacy confirmation unit 506 and the ciphertext legitimacy confirmation unit 507 verify that the input (the encryption key and the ciphertext data) into the computation has been correctly generated. In the present embodiment, when the encryption key or the ciphertext data is not correctly generated, the ciphertext data CY of the random plaintext data Y is output. Therefore, even when the encryption key or the ciphertext data is not correctly generated, the information on the function f does not leak.
Further, in the confidential-information processing system 100 according to the present embodiment, the circuit-confidentiality homomorphic computation apparatus 500 generates the ciphertext data CX of a correct calculation result of the function f which is given as input, only for the encryption key generated by the key generation apparatus 300 and the ciphertext data generated by the encryption apparatus 400.
Therefore, according to the present embodiment, when a malicious data provider inputs illegitimate data into the circuit-confidentiality homomorphic computation apparatus 500, the ciphertext data CY of the random plaintext data Y is generated. Thus, the malicious data provider cannot extract the plaintext data x before computation circuit calculation, and the security is enhanced according to the present embodiment.
In the present embodiment, it is possible to perform a computation process on ciphertexts which have been encrypted using different encryption keys, while the ciphertexts remain encrypted. Conventionally, the computation process can be performed only on ciphertexts which have been encrypted using the same encryption keys.
In the present embodiment, the homomorphic computation unit 505 of the circuit-confidentiality homomorphic computation apparatus 500 performs the homomorphic computation, using the method described in Non-Patent Literature 3. Therefore, it is possible to perform the computation process on the ciphertexts which have been encrypted using the different encryption keys, while the ciphertexts remain encrypted. Note that, Non-Patent Literature 3 describes an encryption method of enabling the homomorphic computation on the ciphertexts which have been encrypted using the different encryption keys.
Therefore, according to the present embodiment, when computation is made on pieces of confidential information from a plurality of data providers while the pieces of confidential information remain encrypted, the decryption keys do not need to be shared between the data providers. Thus, the security is enhanced according to the present embodiment.
100: confidential-information processing system, 101: Internet, 200: public-parameter generation apparatus, 201: input unit, 202: public-parameter generation unit, 203: transmission unit, 300: key generation apparatus, 301: input unit, 302: public-parameter storage unit, 303: decryption-key generation unit, 304: encryption-key generation unit, 305: transmission unit, 400: encryption apparatus, 401: input unit, 402: encryption-key storage unit, 403: encryption unit, 404: transmission unit, 500: circuit-confidentiality homomorphic computation apparatus, 501: input unit, 502: public-parameter storage unit, 503: encryption-key storage unit, 504: ciphertext storage unit, 505: homomorphic computation unit, 506: encryption-key legitimacy confirmation unit, 507: ciphertext legitimacy confirmation unit, 508: transmission unit, 600: decryption apparatus, 601: input unit, 602: decryption-key storage unit, 603: decryption processing unit, 604: decryption-result storage unit, 1101: processor, 1102: bus, 1103: ROM, 1104: RAM, 1105: communication board, 1111: display, 1112: keyboard, 1113: mouse, 1114: drive, 1120: magnetic disk device, 1121: OS, 1122: program, 1123: file.
This application is a Continuation of PCT International Application No. PCT/JP2020/022376 filed on Jun. 5, 2020, which is hereby expressly incorporated by reference into the present application.
| Number | Date | Country | |
|---|---|---|---|
| Parent | PCT/JP2020/022376 | Jun 2020 | US |
| Child | 17964310 | US |
