Patent Application
20220261507
The present invention relates to a secure computation server, a trail management method, and a program.
Data utilization businesses are active in information banks, data exchange markets, etc. In this kind of data utilization businesses, a blockchain (which will also be referred to as a “BC”) technology is an example of a mechanism of controlling data utilization of companies to which data is provided.
Since these data include personal information, privacy protection is also required. A multi-party computation (which will also be referred to as “MPC”) technology is known as a technique to obtain an output by processing data in secret. PTL 1 discloses a secret computation system that perform data processing while keeping personal information secret.
PTL2 discloses an electronic certification system that guarantee the reliability of data provided to a second terminal apparatus such as a client from a first terminal apparatus such as a server, which uses a trail registered in a blockchain. Specifically, the first terminal apparatus in PTL 2 includes trail registration means for registering data and information about the first terminal apparatus in a blockchain as a trail. In addition, this first terminal apparatus includes trail provision means for transmitting a trail to the second terminal apparatus. If the trail provided from the trail provision means is registered in the blockchain, the second terminal apparatus determines that the corresponding data is reliable.
NPL1 discloses a distributed computation platform on which various parties perform computation of data or the like in cooperation with each other while keeping the data secret by combining the MPC and BC.
NPL 2 discloses a configuration for ensuring fairness among parties regarding the MPC by combining the MPC and BC.
The following analysis will be hereinafter made based on the present invention. By using the configuration as disclosed in PTL 1, it is possible to have the secure computation system perform computation while keeping data secret and to transfer only the computation result to the corresponding user terminal that is to use the data. However, in this configuration as disclosed in PTL 1 in which various data processing is performed without restoring personal information included in data, that is, while keeping the personal secret, there is a possibility that a registerer terminal that provides data could register inappropriate data with some intention. For example, if a terminal has modified data such that a statistical result calculated by secure computation would be advantageous for the terminal, it is difficult to detect this modification in real time due to the nature of secure computation. Thus, a mechanism of retroactively verifying the correctness is needed.
In accordance with the method disclosed in PTL2, information about the first terminal apparatus and trail data are registered as a set in a blockchain. However, information handled by a secure computation system needs to be kept secret, and the method disclosed in PTL 2 cannot be adopted.
It is an object of the present invention to provide a secure computation server, a trail management method, and a program that contribute to facilitation of the verification of the correctness of secure computation target data.
According to a first aspect, there is provided a secure computation server, including: a computation processing part that performs secure computation by using data x received from a client and computes a computation result R; and a trail registration part that makes a predetermined trail storage system store first trail data and second trail data, wherein the first trail data is calculated from the data x for certifying identity of the data x and the second trail data certifies a relationship between the data x and the computation result R.
According to a second aspect, there is provided a trail storage system, including: a trail data creation part that creates first trail data for certifying identity of the data x and second trail data for certifying a relationship between data x and computation result R, based on data received from secure computation servers; and a trail data management part that manages the first and second trail data in a non-rewritable manner and provides the first and second trail data to a predetermined audit node, wherein each of the secure computation servers includes a computation processing part that performs secure computation by using the data x received from a client and computes the computation result R and a trail registration part that makes a predetermined trail storage system store first trail data and second trail data, wherein the first trail data is calculated from the data x for certifying identity of the data x and the second trail data certifies a relationship between the data x and the computation result R.
According to a third aspect, there is provided a secure computation trail management method, including: causing a secure computation server to transmit data for computing first trail data for certifying identity of data x and second trail data for certifying a relationship between the data x and computation result R to a predetermined trail storage system; and causing the predetermined trail storage system to store the first trail data and the second trail data, wherein the secure computation server includes a computation processing part that performs secure computation by using the data x received from a client and computes the computation result R. This method is associated with a certain machine, which is the secure computation server that makes the predetermined trail storage system store the first and second trail data.
According to a fourth aspect, there is provided a secure computation trail management method, including: receiving data for computing first trail data for certifying identity of data x and second trail data for certifying a relationship between the data x and computation result R from a secure computation server that includes the computation processing part that performs secure computation by using data x received from a client and computes the computation result R; creating the first trail data and the second trail data based on the received data; and managing the first trail data and the second trail data in a non-rewritable manner and providing the first trail data and the second trail data to a predetermined audit node. This method is associated with a certain machine, which is a trail storage system that creates the first and second trail data and provides the first and second trail data to a predetermined audit node.
According to a fifth aspect, there is provided a program for realizing a function of the above secure computation server or trail storage system. The program is inputted to a computer apparatus from an input device or an external node via a communication interface, is stored in a storage device, and causes a processor to drive in accordance with predetermined steps or processing. In addition, as needed, this program can display a processing result including an intermediate state per state on a display device or can communicate with an external node via a communication interface. For this purpose, the computer apparatus typically includes, for example, a processor, a storage device, an input device, a communication interface, and as needed, a display device, which can be connected to each other via a bus.
The present invention contributes to facilitation of the verification of the correctness of secure computation target data.
First, an outline of an example embodiment of the present invention will be described with reference to drawings. In the following outline, various components are denoted by reference characters for the sake of convenience. That is, the following reference characters are merely used as examples to facilitate understanding of the present invention. Thus, the description of the outline is not meant to limit the present invention to the illustrated modes. An individual connection line between blocks in the drawings, etc. referred to in the following description signifies both one-way and two-way directions. An arrow schematically illustrates a principal signal (data) flow and does not exclude bidirectionality. A program is executed via a computer apparatus, and the computer apparatus includes, for example, a processor, a storage device, an input device, a communication interface, and as needed, a display device. In addition, this computer apparatus is configured to communicate with a device therein or an external node (including a computer) via the communication interface in a wired or wireless manner. In addition, while a port or an interface is present at an input/output connection point of an individual block in the drawings, illustration of the port or the interface is omitted. In addition, in the following description, “A and/or B” signifies at least one of A and B.
As illustrated in
The trail storage system 20 includes a trail data creation part 21 and a trail data management part 22. The trail data creation part 21 creates first trail data for certifying identity of the data x and second trail data for certifying a relationship between the data x and the computation result R, based on the data received from the secure computation servers 10. For example, the secure computation servers 10 transmit a set of shares of hash values of the data x and a set of shares of hash values of values, in each of which the corresponding data x and the corresponding computation result R are concatenated. In this case, based on these received data, the trail data creation part 21 creates first trail data for certifying identity of the data x and second trail data for certifying a relationship between the data x and the computation result R. Next, the trail data management part 22 manages the first and second trail data in a non-rewritable manner and provides the first and second trail data to a predetermined audit node.
For example, when three parties perform secure computation, the first and second trail data will be created as follows. As illustrated in
The individual secure computation servers 10 according to the present example embodiment calculate hash values of the data x, in addition to the above operation. As illustrated in
Next, when the trail storage system 20 receives an audit request about the data x and the computation result R from the predetermined audit node, the trail storage system 20 transmits the hash value h(x) and the hash value h(x∥R) to the audit node as illustrated in
As described above, according to the present example embodiment, a mechanism of detecting the correctness of secure computation target data is established, and the reliability of the secure computation system that obtains a desired computation result while protecting privacy can be improved. In the above example, the present invention has been applied to secure computation performed by three parties, the method for creating the first and second trail data may be changed depending on the secure computation method to be adopted. For example, when n parties perform secure computation, n secure computation servers transmit n shares a1 to an, and the trail storage system creates the first and second trail data from these shares. Likewise, when a homomorphic encryption method is used as the secure computation method, Enc(h(x)) and Enc(h(x∥R)) can be created from the data x and the computation result R and can be used as the first and second trail data. Enc(x) indicates encrypted text based on the homomorphic encryption method.
Next, a first example embodiment will be described in detail with reference to drawings. In the first example embodiment, the present invention is applied to a mode in which secure computation is performed by receiving data from a plurality of clients.
The following description assumes that the client 300a is an apparatus of an information bank A (a client A) that manages secret target data x and that the client 300b is an apparatus of an information bank B (a client B) that manages secret target data y. The three MPC servers 100 receive shares of data x and shares of data y from the clients 300a and 300b and calculate computation results R in coordination with each other. The three MPC servers 100 transmit shares of the computation results R to the client 300a or the client 300b. The client 300a or the client 300b can restore a computation result R from the shares of the computation results R and can use the restored computation result R. In the following example embodiment, the trail storage system 200 is used to detect data replacement or the like conducted by the client 300a or the client 300b.
The share generation part 301 generates shares (secret data) by applying a secret sharing method to the data (data x or data y) received from a data holder and transmits the shares to the MPC servers 100 via the communication IF 303. As this secret sharing method, it is possible to use a (k,n) threshold method. In this method, first, an inputted plain text is divided into n partition values, and next these n partition values are distributed to n computation nodes (MPC servers 100). The plain text can be restored if an arbitrary number k of partition values are obtained. Of course, any of the methods disclosed in the above PTLs and NPLs may alternatively be used.
The restoration part 302 restores the computation result R from the shares of the computation results R received from the MPC servers 100 via the communication IF 303.
Each of the MPC servers 100 includes a trail registration part 101, a computation processing part 102, and a communication IF 103. The individual computation processing part 102 computes a share of a computation result R by using a share (secret data) received from the client 300a or 300b via the communication IF 103 and transmits the computed share to the client 300a or the client 300b.
The individual trail registration parts 101 transmit, to the trail storage system 200, shares (ha1, ha2, and ha3) of the hash values of their respective data x, shares (hb1, hb2, and hb3) of the hash values of their respective data y, and shares of their respective hash values h(x∥R) and h(y∥R). The shares of the hash values h(x∥R) will be referred to as (hc1, hc2, and hc3), and the shares of the hash values h(y∥R) will be referred to as (hd1, hd2, and hd3).
The trail storage system 200 includes a trail data management part 201, a trail data creation part 202, and a communication IF 203 and can store data in a blockchain 204.
The trail data creation part 202 creates trail data from the shares received from the MPC servers 100 via the communication IF 203. Specifically, the trail data creation part 202 computes a hash value h(x) of the data x from the shares of the hash values of the data x and uses the hash value h(x) as the trail data of the data x. The following description assumes that h(x) is a value obtained by inputting the data x to a hash function and satisfies a feature that it is difficult to compute x from h(x). The following description assumes that h(x) can be computed from an operation on the shares ha1, ha2, and ha3, for example, from ha1+ha2+ha3.
Likewise, the trail data creation part 202 computes a hash value h(y) of the data y from the shares hb1, hb2, and hb3 of the hash values of the data y and uses the hash value h(y) as the trail data of the data y. In addition, the trail data creation part 202 computes a hash value h(x∥R) from the shares (hc1, hc2, and hc3) of the hash value h(x∥R). Likewise, the trail data creation part 202 computes a hash value h(y∥R) from the shares (hd1, hd2, and hd3) of the hash values h(y∥R). The following description also assumes that a symbol ab indicates concatenation of data a and data b.
The trail data management part 201 stores the hash values h(x), h(y), h(x∥R), and h(y∥R) in the blockchain 204.
The blockchain 204 is a distributed ledger technology for storing data by concatenating blocks in which data is stored in the form of a chain or the like. In the present example embodiment, the above hash values h(x), h(y), h(x∥R), and h(y∥R) are stored in a block, and an arbitrary set of h(x), h(y), h(x∥R), and h(y∥R) can be extracted.
Next, an operation according to the present example embodiment will be described in detail with reference to drawings.
As illustrated in
The client 300b generates shares y1, y2, and y3 from the data y and transmits the shares y1, y2, and y3 to the MPC servers 100 (step S002).
One of the MPC servers 100 computes a computation result R1 from the share x1 and the share y1. Likewise, the other two MPC servers 100 calculate computation results R2 and R3 from the share x2, the share y2, the share x3, and the share y3 (step S003). In addition, the three MPC servers 100 transmit the computation results R1, R2, and R3 to the client A (step S004).
The client A restores a computation result R from the computation results R1, R2, and R3 and provides the restored computation result R to a data holder 500a (step S005). The processing performed so far is the same as the secure computation using the MPC servers.
Next, the MPC servers 100 compute shares (ha1, ha2, and ha3) of the hash values h(x) of their respective data x and shares (hb1, hb2, and hb3) of the hash values h(y) of their respective data y. In addition, the MPC server 100 computes shares (hc1, hc2, and hc3) and (hd1, hd2, and hd3) of the hash values h(x∥R) and h(y∥R) and transmits these shares to the trail storage system 200 (step S006).
The trail storage system 200 computes hash values h(x) and h(y) from the received shares ha1, ha2, and ha3 and the received shares hb1, hb2, and hb3. In addition, the trail storage system 200 computes a hash value h(x∥R) from the received shares (hc1, hc2, and hc3) of the hash values h(x∥R). In addition, the trail storage system 200 computes a hash value h(y∥R) from the received shares (hd1, hd2, and hd3) of the hash value h(y∥R) (step S007). Finally, the trail storage system 200 stores the computed hash values h(x), h(y), h(x∥R), and h(y∥R) in the blockchain 204 (step S008).
Next, an audit process using data registered in the above trail storage system 200 will be described. The following description assumes that the data holder 500a, the data holder 500b, or a third party has transmitted, to an auditor (an audit node), an audit request about the correctness of a computation result R.
As illustrated in
When receiving the trail data transmission request, the trail storage system 200 extracts the corresponding hash values h(x), h(y), h(x∥R), and h(y∥R) from the blockchain 204 and transmits these hash values to the audit node (step S102).
Next, the audit node requests the data holder 500a to transmit the hash value h(x) of the data x and the hash value h(x∥R) of a value x∥R in which the data x and the computation result R are concatenated (step S103).
When receiving the request, the data holder 500a computes the hash value h(x) of the data x and the hash value h(x∥R) and transmits these hash values to the audit node (step S104). The hash values h(x) and h(x∥R) created by the data holder 500a will be referred to as h0(x) and h0(x∥R), respectively. In addition, as described above, since h(x) satisfies a feature that it is difficult to compute x from h(x), x is not leaked to the audit node.
Next, the audit node requests the data holder 500b to transmit the hash value h(y) of the data y and the hash value h(y∥R) of the value y∥R in which the data y and the computation result R are concatenated (step S105).
When receiving the request, the data holder 500b computes the hash value h(y) of the data y and the hash value h(y∥R) and transmits these hash values to the audit node (step S106). The hash values h(y) and h(y∥R) created by the data holder 500b will be referred to as h0(y) and h0(y∥R), respectively. In addition, as described above, since h(y) satisfies a feature that it is difficult to compute y from h(y), y is not leaked to the audit node.
Finally, the audit node determines the correctness of the computation result R by determining whether the following values (1) to (4) match (step S107).
h(x)=h0(x) (1)
h(y)=h0(y) (2)
h(x∥R)=h0(x∥R) (3)
h(y∥R)=h0(y∥R) (4)
If the above (1) h(x)=h0(x) is not met, the audit node determines that the client 300a has replaced the data x. This is because h(x) is computed from the shares (for example, ha1, ha2, and ha3) that the trail storage system 200 has received from the MPC servers 100, h(x) is stored in the blockchain 204, and the identity is guaranteed. In addition, in this case, (3) h(x∥R)=h0(x∥R) is not met, either.
If the above (2) h(y)=h0(y) is not met, the audit node determines that the client 300b has replaced the data y. This is because h(y) is computed from the shares (for example, hb1, hb2, and hb3) that the trail storage system 200 received from the MPC servers 100, h(y) is stored in the blockchain 204, and the identity is guaranteed. In addition, in this case, (4) h(y∥R)=h0(y∥R) is not met, either.
If (1) h(x)=h0(x) is met and (3) h(x∥R)=h0(x∥R) is not met, the audit node determines that the client 300a has replaced the computation result R.
Likewise, if (2) h(y)=h0(y) is met and (4) h(y∥R)=h0(y∥R) is not met, the audit node determines that the client 300b has replaced the computation result R.
As described above, according to the present example embodiment, even when secure computation target data is provided by a plurality of holders, the correctness of the data can be determined. The order of steps S101 and S102, the order of steps S103 and S104, and the order of steps S105 and S106 in
Next, a second example embodiment will be described in detail with reference to drawings. Unlike the first example embodiment, the second example embodiment can certify that trail data exists and that the trail data has not been falsified.
The time stamp server (TS server) 400 is a server that adds time stamps to hash values in response to requests from clients based on a method as typified by RFC 3161.
When a trail data creation part 202a of a trail storage system 200a according to the second example embodiment creates trail data from shares received from MPC servers 100 via a communication IF 203, the trail data creation part 202a uses a time stamp T received from the TS server 400. Specifically, the trail data creation part 202a acquires a time stamp T for a hash value h(x) from the TS server 400, computes a hash value h′(h(x)∥T) by using a second hash function h′(x), and uses this hash value h′(h(x)∥T) as the trail data of data x.
Likewise, the trail data creation part 202a acquires a time stamp T for a hash value h(y), computes a hash value h′(h(y)∥T) by using the second hash function h′(y), and uses this hash value h′(h(y)∥T) as the trail data of data y.
Next, the trail data creation part 202a enters a value in which the hash value h′(h(x)∥T) and a corresponding computation result R are concatenated to a third hash function h″(x) and computes a hash value h″(h′(h(x)∥T)∥R) as the trail data indicating a correlation between the data x and the computation result R. Likewise, the trail data creation part 202a enters a value in which the hash value h′(h(y)∥T) and a corresponding computation result R are concatenated to the third hash function h″(x) and computes a hash value h″(h′(h(y)∥T)∥R) as the trail data indicating a correlation between the data y and the computation result R.
A trail data management part 201a stores these hash values h′(h(x)∥T), h′(h(y)∥T), h″(h′(h(x)∥T)∥R), and h″(h′(h(y)∥T)∥R) in a blockchain 204.
Next, an operation according to the present example embodiment will be described in detail with reference to drawing.
After the trail storage system 200a restores a hash value h(x), a hash value h(y), and a computation result R from shares ha1, ha2, and ha3, shares hb1, hb2, and hb3, and shares R1, R2, and R3, the trail storage system 200a acquires a time stamp T from the TS server 400 (step S207).
Next, the trail storage system 200a computes hash values h′(h(x)∥T), h′(h(y)∥T), h″(h′(h(x)∥T)∥R), and h″(h′(h(y)∥T)∥R) (step S208).
Finally, the trail storage system 200a stores these hash values h′(h(x)∥T), h′(h(y)∥T), h″(h′(h(x)∥T)∥R), and h″(h′(h(y)∥T)∥R) in the blockchain 204 (step S209).
Next, an audit process using data registered in the above trail storage system 200a will be described. The following description assumes that a data holder 500a, a data holder 500b, or a third party has transmitted an audit request about the correctness of a computation result R to an auditor (an audit node).
As illustrated in
When receiving the trail data transmission request, the trail storage system 200a extracts the corresponding time stamp T and hash values h′(h(x)∥T), h′(h(y)∥T), h″(h′(h(x)∥T)∥R), and h″(h′(h(y)∥T)∥R) from the blockchain 204 and transmits the extracted time stamp T and hash values to the audit node (step S302).
Next, the audit node transmits the time stamp T to the data holder 500a and requests the data holder 500a to transmit corresponding hash values h′(h(x)∥T) and h″(h′(h(x)∥T)∥R) (step S303).
When receiving the request, the data holder 500a computes hash values h0′(h0(x)∥T) and h0″(h0′(h0(x)∥T)∥R) by using the time stamp T and hash functions h(x), h′(x), and h″(x) and transmits the calculated hash values to the audit node (step S304). Hereinafter, the hash value h(x) calculated by the data holder 500a and the data holder 500b will be denoted as h0(x) by adding an index 0 is added to h(x). In addition, h0′(h0(x)∥T) is a hash value of a value in which the hash value h0(x) of the data x and T are concatenated, based on h0′(x). In addition, h0″(h0′(h0(x)∥T)∥R) is a hash value of a value in which the hash value h0′(h0(x)∥T) and the computation result R are concatenated, based on h0″(x).
Next, the audit node transmits the time stamp T to the data holder 500b and requests the data holder 500b to transmit corresponding hash values h′(h(y)∥T) and h″(h′(h(y)∥T)∥R) (step S305).
When receiving the request, the data holder 500b computes hash values h0′(h0(y)∥T) and h0″(h0′(h0(y)∥T)∥R) by using the time stamp T and hash functions h(x), h′(x), and h″(x) and transmits the calculated hash values to the audit node (step S306).
Finally, the audit node determines the correctness of the computation result R by determining whether the following values (1) to (4) match (step S307).
h′(h(x)∥T)=h0′(h0(x)∥T) (1)
h′(h(y)∥T)=h0′(h0(y)∥T) (2)
h″(h′(h(x)∥T)∥R)=h0″(h0′(h0(x)∥T)∥R) (3)
h″(h′(h(y)∥T)∥R)=h0″(h0′(h0(y)∥T)∥R) (4)
If the above (1) h′(h(x)∥T)=h0′(h0(x)∥T) is not met, the audit node determines that the client 300a has replaced the data x. This is because the individual hash values are computed from the shares (for example, a1, a2, and a3) that the trail storage system 200a has received from the MPC servers 100, these hash values are stored in the blockchain 204, and the identity is guaranteed. In addition, in this case, (3) h″(h′(h(x)∥T)∥R)=h0″(h0′(h0(x)∥T)∥R) is not met, either.
If the above (2) h′(h(y)∥T)=h0′(h0(y)∥T) is not met, the audit node determines that the client 300b has replaced the data y. This is because the individual hash values are computed from the shares (for example, b1, b2, and b3) that the trail storage system 200a has received from the MPC servers 100, these hash values are stored in the blockchain 204, and the identity is guaranteed. In addition, in this case, (4) h″(h′(h(y)∥T)∥R)=h0″(h0′(h0(y)∥T)∥R) is not met, either.
If (1) h′(h(x)∥T)=h0′(h0(x)∥T) is met and (3) h″(h′(h(x)∥T)∥R)=h0″(h0′(h0(x)∥T)∥R) is not met, the audit node determines that the client 300a has replaced the computation result R.
Likewise, if (2) h′(h(y)∥T)=h0′(h0(y)∥T) is met and (4) h″(h′(h(y)∥T)∥R)=h0″(h0′(h0(y)∥T)∥R) is not met, the audit node determines that the client 300b has replaced the computation result R.
As described above, according to the present example embodiment, in addition to the advantageous effects of the first example embodiment, whether the same data has been used for computation at a certain time point T and for computation at a different time point T′ can be kept secret. This is because, by including a time point T in a hash value, even when the same data is used at different time points, different hash values are generated at these different time points.
While example embodiments of the present invention have thus been described, the present invention is not limited thereto. Further variations, substitutions, or adjustments can be made without departing from the basic technical concept of the present invention. For example, the configurations of the networks, the configurations of the elements, and the representation modes of the messages illustrated in the drawings have been used only as examples to facilitate understanding of the present invention. That is, the present invention is not limited to the configurations illustrated in the drawings.
For example, while the above example embodiments assume that trail data is created by using a hash function, a different one-way function may alternatively be used, as long as a feature that trail data can be computed from data x and it is difficult to compute the data x from the trail data is satisfied. In addition, the hash functions h(x), h′(x), and h″(x) may be the same hash function or different hash functions.
For example, while the above example embodiments have been described based on an example in which the data holder 500a provides the data x and the data holder 500b provides the data y, the application field of the present invention is not limited to this example. For example, the present invention is applicable without problem to a case in which a third data holder registers a learning model M or the like in an information bank and the MPC servers 100 are requested to perform secure computation on data by using the learning model M. In this case, too, whether all the data holders have provided correct data and whether the learning model M has been provided can be verified.
In addition, the individual example embodiment described above assumes that the trail storage system 200 or 200a restores the hash values of the data x and the data y and the computation result R and generates the trail data. However, it is possible to adopt a configuration including an intermediate node that restores the hash values of the data x and the data y and the computation result R and creates the trail data.
In addition, while the example embodiments assume that the blockchain 204 is used as a trail data storage destination, a different storage apparatus in which data can be stored in a non-rewritable manner may alternatively be used.
In addition, the above example embodiments use an example in which the present invention is applied to a configuration in which three MPC servers perform multi-party computation, the secure computation method to which the present invention is applicable is not limited to this example. For example, the present invention is also applicable to a configuration in which n MPC servers perform multi-party computation. In this case, n secure computation servers transmit n shares a1 to an, and the trail storage system creates first and second trail data from these shares. Likewise, when a homomorphic encryption method is used as the secure computation method, encrypted text Enc(h(x)), Enc(h(y)), Enc(h(x∥R)), and Enc(h(y∥R)) can be created from data x, data y, and the corresponding computation results R as the first and second trail data.
In addition, the method for computing the first and second trail data in the individual example embodiment described above is only an example. Any of various methods may be used as the creation method. For example, in place of h(x) and h(x∥R), h(x∥S) and h(x∥R∥S) obtained by concatenating an arbitrary string S to x and x∥R may be used. Likewise, in place of h(x) and h(x∥R), h(p(x)) and h(p(x∥R)) may be used by using an arbitrary replacement function p(x). Likewise, replacement data of the encrypted text Enc(h(x)), Enc(h(y)), Enc(h(x∥R)), and Enc(h(y∥R)) may be used as the first and second trail data.
The procedure according to the first or second example embodiment can be realized by a program that causes a computer (9000 in
That is, an individual unit (processing means, function) of the MPC server 100, the trail storage system 200, or the trail storage system 200a according to the above first or second example embodiment can be realized by a computer program that causes a processor mounted on this corresponding apparatus to execute the corresponding processing described above by using its hardware.
Finally, suitable modes of the present invention will be summarized.
(See the secure computation server according to the above first aspect)
The trail storage system store the first and second trail data by using a blockchain.
The trail storage system store, as the first trail data, a hash value of the data x and store, as the second trail data, a hash value of a value in which the data x and the computation result R are concatenated.
The trail storage system store, as the first trail data, a hash value of a value created by using the data x and a time stamp value and store, as the second trail data, a hash value of a value created by using the data x, the computation result R, and a time stamp value.
The computation processing part of the secure computation server perform multi-party computation in which secure computation is performed in coordination with other secure computation servers, and the trail registration part of the secure computation server transmit, to the trail storage system, data for restoring the first trail data and the second trail data in a form of shares calculated by the computation processing part.
(See the trail storage system according to the above second aspect)
It is preferable that the trail data management part of the trail storage system be constituted by a blockchain.
The trail data creation part of the trail storage system compute, as the first trail data, a hash value of the data x and compute, as the second trail data, a hash value of a value in which the data x and the computation result R are concatenated.
The trail data creation part of the trail storage system compute, as the first trail data, a hash value of a value created by using the data x and a time stamp value and compute, as the second trail data, a hash value of a value created by using the data x, the computation result R, and a time stamp value.
The individual secure computation server perform multi-party computation in which secure computation is performed in coordination with other secure computation servers. In addition, the trail data creation part of the trail storage system receive, from the individual secure computation servers, data for restoring the first trail data and the second trail data in a form of shares calculated by the multi-party computation and restore the first trail data and the second trail data.
(See the secure computation trail management method according to the above third and fourth aspects)
(See the program according to the above fifth aspect)
The above modes 11 and 12 can be expanded in the same way as mode 1 can be expanded to modes 2 to 5 and mode 6 can be expanded to modes 7 to 10.
The disclosure of each of the above PTLs and NPLs is incorporated herein by reference thereto and may be used as the basis or a part of the present invention as needed. Modifications and adjustments of the example embodiments and examples are possible within the scope of the overall disclosure (including the claims) of the present invention and based on the basic technical concept of the present invention. Various combinations and selections (including partial deletion) of various disclosed elements (including the elements in each of the claims, example embodiments, examples, drawings, etc.) are possible within the scope of the disclosure of the present invention. That is, the present invention of course includes various variations and modifications that could be made by those skilled in the art according to the overall disclosure including the claims and the technical concept. The description discloses numerical value ranges. However, even if the description does not particularly disclose arbitrary numerical values or small ranges included in the ranges, these values and ranges should be deemed to have been specifically disclosed.
This application is a National Stage Entry of PCT/JP2019/029029 filed on Jul. 24, 2019, the contents of all of which are incorporated herein by reference, in their entirety.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2019/029029 | 7/24/2019 | WO |
