Patent Application
20240176908
The present invention relates to a secure computation system, a secure computation apparatus, a method, and a program.
Secure computation is a useful technology that is known to perform various computations at high speed while concealing data. In many analyses, an operation of searching for and extracting data that matches specific conditions from a data set (vector) is important processing that is frequently used. In secure computation, an operation of searching becomes an operation of finding a location matching the conditions by simply searching for an entire vector in each reference since data reference while concealing search conditions (for example, a search keyword) is necessary, and there is a problem that a large amount of calculation and communication are required.
To address this problem, a technology capable of greatly reducing a reference cost by constructing a special data structure in advance using a permutation or sorting is known (for example, Non Patent Literature 1 and Non Patent Literature 2). How to construct and refer to such a data structure at high speed is important for data reference in secure computation.
In construction of the data structure as described above, concealment permutation capable of rearranging a vector while concealing a permutation method for participants (parties) of secure computation plays an important role. Various methods are known as a method of realizing a concealment permutation, but a method of permutating a vector while concealing both the vector and the permutation, for example, under the premise that parties share a pre-concealed permutation and a random number sequence, is known. Further, for example, a method of concealing a vector for all parties under the premise that one party has a permutation as plaintext, and permutating the vector while concealing the permutation for parties other than the party having the permutation is known.
However, in the related arts (for example, Non Patent Literature 1 and Non Patent Literature 2), since random permutation (shuffle) or partial sorting of a vector is executed multiple times, there is a problem that actual efficiency is poor, or although actual efficiency is good, there is a vulnerability to unauthorized reference.
An embodiment of the present invention has been made in view of the above points, and an object of the embodiment of the present invention is to perform efficient and safe concealed vector permutation in secure computation by three parties.
To achieve the above object, a secure computation system according to an embodiment is a secure computation system including a first secure computation apparatus, a second secure computation apparatus, and a third secure computation apparatus each having a tripartite share of a concealed input vector, wherein the first secure computation apparatus includes a first conversion unit configured to convert its own tripartite share into a bipartite share with the third secure computation apparatus; a first calculation unit configured to calculate a third vector obtained by subtracting, from a result of applying its own permutation to its own bipartite share, a result of applying a second permutation determined according to the permutation to a first vector determined by a predetermined method and a second vector determined by a predetermined method; and a first transmission unit configured to transmit the third vector and the second permutation to the second secure computation apparatus, the third secure computation apparatus includes a second conversion unit configured to convert its own tripartite share into a bipartite share with the first secure computation apparatus; a second calculation unit configured to calculate a fourth vector obtained by adding the first vector to a result of applying a first permutation determined according to the permutation to its own bipartite share; a second transmission unit configured to transmit the fourth vector to the third secure computation apparatus; a first output unit configured to set the second vector as a bipartite share, with the second secure computation apparatus, of a result of applying the permutation to the input vector, and the second secure computation apparatus includes a second output unit configured to set a vector obtained by adding a result of applying the second permutation to the fourth vector to the third vector, as a bipartite share, with the third secure computation apparatus, of the result of applying the permutation to the input vector.
It is possible to perform efficient and secure concealed vector permutation in secure computation by three parties.
Hereinafter, an embodiment of the present invention will be described. In the present embodiment, a secure computation system 1 capable of performing efficient and secure concealed vector permutation by making information obtained by each party asymmetrical in secure computation by three parties will be described. Further, a case in which a construction of any data structure using a concealed vector permutation (a data structure in a vector format in which data and a reference position at the time of accessing the data are concealed (hereinafter also referred to as a reference position concealment vector)), and referring to data structure are performed by the secure computation system 1 according to the present embodiment will be described.
Hereinafter, it is assumed that the three parties are denoted as P1, P2, and P3, and P1 is a party having a permutation.
First, some symbols, terms, concepts, and the like are prepared.
A result of concealing plaintext x and sharing the plaintext x between three parties is expressed by
x
1,
x
2,
x
3 [Math. 1]
. In the text of the specification, these are represented as [x]i, [x]2, and [x]3, respectively.
In this case, [x]i is assumed to be owned by party Pi, but hereinafter, “x in a state shared by each party” is abstracted and simply expressed as [x]. Each [x]i is called a fragment or share. Further, it is assumed that the plaintext x can be restored using any two of the three shares [x]1, [x]2, and [x]3, and cannot be restored using one of the shares.
Examples of a technology satisfying the above include secret sharing methods (for example, reference 1 and reference 2), but the present invention is not limited thereto, and any method can be used as long as the method satisfies the same function and security as the secret sharing method.
A result of concealing the plaintext x and sharing the plaintext x between two parties is represented by <x>1 and <x>2, and particularly, two values thereof are random values satisfying <x>1+<x>2=x. Each of <x>1 and <x>2 is assumed to be owned by two parties among P1, P2, and P3, but such a state is abstracted and simply indicated as <x>. It is also assumed that conversion from [x] to <x> is possible without intervening communication between the parties.
Examples of a technology satisfying the above include secret sharing methods (for example, reference 1 and reference 2), but the present invention is not limited thereto, and any method can be used as long as the method satisfies the same function and security as the secret sharing method.
Processing for generating a share [r] of a random number r without any party knowing the plaintext r is called random share generation. This processing can be realized, for example, with the technology described in Reference 3, and the like on the secret sharing method, but the present invention is not limited thereto, and any technology can be used as long as the technology satisfies the same function and security as such a technology.
Hereinafter, it is assumed that a pseudo-random function capable of secure computation is denoted by F, and secure computation of the pseudo-random function is denoted by F([a], [s]) for a value [a] of a secret and a key [s]. This secure computation processing can be realized, for example, by the technology described in Reference 4, and the like, but the present invention is not limited thereto, and any technology can be used as long as the technology satisfies the same function and security as such a technology.
Hereinafter, it is assumed that permutation (rearrangement) for any vector having a length m (not based on secure computation) is represented by a bijection Π: {1, . . . , m}→{1, . . . , m}, and a vector obtained by applying the permutation n to a vector A is represented by ΠA. Here, for A=(A1, . . . , Am),
πA=(Aπ−1(1), . . . , Aπ−1(m) [Math. 2]
. Further, it is assumed that synthesis between two permutations is represented by a symbol ○. For example, when
π=π1○π2 [Math. 3]
, ΠA=Π2(Π1A) is satisfied.
Next, an overall configuration of the secure computation system 1 according to the present embodiment will be described with reference to
As illustrated in
The secure computation apparatus 10 is a computer or computer system that functions as a party P1 and includes a secure computation processing unit 101 and a storage unit 102. The secure computation processing unit 101 executes various processing for performing concealed vector permutation or construction of a reference position concealment vector. Further, the storage unit 102 stores various types of information (for example, permutation or sharing of vectors) required for execution of various types of processing.
The secure computation apparatus 20 is a computer or computer system that functions as the party P2 and includes a secure computation processing unit 201 and a storage unit 202. The secure computation processing unit 101 executes various processing for performing concealed vector permutation, construction of a reference position concealment vector, and referencing thereof. Further, the storage unit 202 stores various types of information (for example, shares of the vector) required for execution of the various types of processing.
The secure computation apparatus 30 is a computer or computer system that functions as a party P3 and includes a secure computation processing unit 301 and a storage unit 302. The secure computation processing unit 301 executes various processing for performing concealed vector permutation, construction of a reference position concealment vector, and referencing thereof. Further, the storage unit 302 stores various types of information (for example, shares of the vector) required for execution of the various types of processing.
Next, hardware configurations of the secure computation apparatus 10, the secure computation apparatus 20, and the secure computation apparatus 30 included in the secure computation system 1 according to the present embodiment will be described. The secure computation apparatus 10, the secure computation apparatus 20, and the secure computation apparatus 30 can be realized by, for example, a hardware configuration of a computer 500 illustrated in
The computer 500 illustrated in
The input device 501 is, for example, a keyboard and a mouse, a touch panel, or the like. The display device 502 is, for example, a display. The computer 500 may not include at least one of the input device 501 and the display device 502.
The external I/F 503 is an interface with an external device such as a recording medium 503a. Examples of the recording medium 503a include a compact disc (CD), a digital versatile disk (DVD), a secure digital memory card (SD memory card), and a universal serial bus (USB) memory card.
The communication I/F 504 is an interface for connection to the communication network 40. The processor 505 is, for example, any of various arithmetic devices such as a central processing unit (CPU) and a graphics processing unit (GPU). The memory device 506 is, for example, any of various storage devices such as a hard disk drive (HDD), a solid state drive (SSD), a random access memory (RAM), a read only memory (ROM), and a flash memory.
The secure computation apparatus 10, the secure computation apparatus 20, and the secure computation apparatus 30 according to the present embodiment can realize various processing to be described below by the hardware configuration of the computer 500 illustrated in
The secure computation processing unit 101 is realized by, for example, processing that one or more programs installed in the secure computation apparatus 10 cause the processor 505 of the computer 500 realizing the secure computation apparatus 10 to execute. Further, the storage unit 102 is realized by the memory device 506 of the computer 500 realizing the secure computation apparatus 10, for example.
Similarly, the secure computation processing unit 201 is realized by, for example, processing that one or more programs installed in the secure computation apparatus 20 cause the processor 505 of the computer 500 realizing the secure computation apparatus 20 to execute. Further, the storage unit 202 is realized by the memory device 506 of the computer 500 realizing the secure computation apparatus 20, for example.
Further, similarly, the secure computation processing unit 301 is realized by, for example, processing that one or more programs installed in the secure computation apparatus 30 cause the processor 505 of the computer 500 realizing the secure computation apparatus 30 to execute. Further, the storage unit 302 is realized by the memory device 506 of the computer 500 realizing the secure computation apparatus 30, for example.
In the present example, a case in which, when P1 has a permutation Π of any plaintext and all parties have (or receive) a concealed vector
{right arrow over (D)}
:=(
D1
, . . . ,
Dn
) [Math. 4]
, the permutation Π is applied to a share thereof, and only P2 and P3 obtains an additive bipartite share of the permuted vector
{right arrow over (T)}
; {right arrow over (T)}=π{right arrow over (D)} [Math. 5]
will be described with reference to
The secure computation processing unit 101 of the secure computation apparatus 10 converts the share [→D] into <→D>1 (S101). Similarly, the secure computation processing unit 301 of the secure computation apparatus 30 converts the share [→D] into <→D>2 (S102). Here, it is assumed that P1 has <→D>1 and P2 has <→D>2, but P1 may have <→D>2 and P2 may have <→D>1. Hereinafter, it is assumed that P1 has <→D>1 and P2 has <→D>2.
Next, the secure computation processing unit 101 of the secure computation apparatus 10 selects random permutations Π1 and Π2 that satisfy:
π1○π2=π [Math. 6]
(S103). Further, the secure computation processing unit 101 of the secure computation apparatus 10 selects a random vector →U, →V having the same size as <→D>1 (S104).
Next, the secure computation processing unit 101 of the secure computation apparatus 10 calculates →A:=Π<→D>1−Π2→U−→V (S105).
The secure computation processing unit 101 of the secure computation apparatus 10 transmits Π2 and →A to the secure computation apparatus 20 (S106), and also transmits Π1, →U and →V to the secure computation apparatus 30 (S107).
The secure computation processing unit 301 of the secure computation apparatus 30 calculates →B:=Π1<→D>2+→U (S108), and then transmits →B to the secure computation apparatus 20 (S109). Further, the secure computation processing unit 301 of the secure computation apparatus 30 determines its own output to be <→T>2:=→V (S110).
The secure computation processing unit 201 of the secure computation apparatus 20 determines its own output to be <→T>1:=→A+Π2→B (S111).
Since in the above protocol →A+Π2→B=Π→D−→V, <→T>1 and <→T>2 are additive bipartite shares of →T=Π→D. Further, in the above protocol, the amount of communication is 4×(size of vector <→D>)+2×(size of permutation Π) bits, and the number of rounds is 2. From this, it can be seen that efficient concealed vector permutation can be realized in the present embodiment. Further, since P1, who is an owner of the permutation, does not have <→T>, it can be seen that, for example, a secure concealed vector permutation in which P1 cannot perform (unauthorized) manipulation or information acquisition can be realized.
Therefore, according to the present embodiment, any permutation can be applied to the concealed vector, and a secure reference position concealment vector can be obtained efficiently.
The present embodiment is an extension of Example 1, and a case in which an amount of communication and the number of rounds are reduced using any cryptographic pseudo-random number generator (not based on secure computation) will be described with reference to
Since S201 to S202 in
The secure computation processing unit 101 of the secure computation apparatus 10 executes ψ(p) to obtain random number sequences Π1, →U, and →V (S203). Similarly, the secure computation processing unit 301 of the secure computation apparatus 30 executes ψ(p) to obtain random number sequences Π1, →U, and →V (S204). That is, P1 and P3 independently execute ψ(p) to obtain common random number sequences Π1, →U, and →V.
Next, the secure computation processing unit 101 of the secure computation apparatus 10 calculates a permutation:
π2:=π1−1○π [Math. 7]
Next, the secure computation processing unit 101 of the secure computation apparatus 10 calculates →A:=Π<→D>1−Π2→U−→V (S206).
The secure computation processing unit 101 of the secure computation apparatus 10 transmits Π2 and →A to the secure computation apparatus 20 (S207).
Since subsequent S208 to S211 are substantially the same as S108 to S111 of Example 1, respectively, description thereof is omitted.
In the present example, any update rule regarding p (for example, update p←p+1 is performed each time ψ(p) is executed) is shared between P1 and P3, so that p or ψ can be executed repeatedly without re-sharing. This can reduce the amount of communication to 2×(size of vector <→D>)+2>(size of permutation Π) bits and the number of rounds to 1.
This example is an extension of the concealed vector permutation described in Examples 1 and 2, and a method in which P1 generates the permutation Π will be described with reference to
In the present embodiment, it is assumed that any pseudo-random function F capable of secure computation is shared among all parties in advance, and at least P1 has any mechanism M that uniquely computes the permutation from a plaintext value of an output of F. Here, the mechanism M is a device or algorithm that outputs bijection Π: {1, . . . , m}→{1, . . . , m} (here, n≤m) when a vector (f1, . . . , fn) is input, and outputs Π(i) when a value fi is input. As the mechanism M, it is possible to use, for example, cuckoo hashing described in Reference 5, but the present invention is not limited thereto, and it is possible to use any device or algorithm as long as the device or algorithm has properties similar to cuckoo hashing. In some mechanisms including cuckoo hashing, a case in which an output of the pseudo-random function is multiple values fi(1), . . . , fi(l) (here, l is a lowercase letter of L), and an output when this is input to M is multiple values Π(1)(i), . . . , Π(l) (i) (here, l is a lowercase of L) is conceivable, but such a case can be used for the present example.
In the present example, [Di]=([ki], *), and a share of any concealed vector held (or input) by all parties is [→D]:=([D1], . . . , [Dn]). However, it is assumed that ki functions as a search key for data reference described in Example 4, and that each Di has a different ki. Further, * is any type, size, and number of data, but in principle, it is assumed to be a share.
First, the secure computation processing unit 101 of the secure computation apparatus 10, the secure computation processing unit 201 of the secure computation apparatus 20, and the secure computation processing unit 301 of the secure computation apparatus 30 execute random share generation to obtain a random number share [s] (S301). That is, all parties execute the random share generation and P1, P2, and P3 obtain shares [s]1, [s]2, and [s]3 respectively.
Next, the secure computation processing unit 101 of the secure computation apparatus 10, the secure computation processing unit 201 of the secure computation apparatus 20, and the secure computation processing unit 301 of the secure computation apparatus 30 calculate [fi]←F([ki], [s]) for i=1, . . . , n to obtain [→f]:=([f1], . . . , [fn]) (S302). That is, all parties calculate [fi]←F([ki], [s]) for i=1, . . . , n to obtain [→f]:=([f1], . . . , [fn]). Accordingly, P1, P2, and P3 obtain shares [→f]1, [→f]2, and [→f]3, respectively.
Next, the secure computation processing unit 201 of the secure computation apparatus 20 transmits its own share [→f]2 to the secure computation apparatus 10 (S303). However, the secure computation processing unit 301 of the secure computation apparatus 30 may transmit its own share [→f]3 to the secure computation apparatus 10. That is, either P2 or P3 may transmit its own share [→f] to P1.
The secure computation processing unit 101 of the secure computation apparatus 10 restores →f using its own share [→f]1 and the share [→f] transmitted from the secure computation apparatus 20 (or the secure computation apparatus 30) (S304).
Next, the secure computation processing unit 101 of the secure computation apparatus 10 inputs the plaintext →f to the mechanism M to obtain the permutation Π (S305).
Thereafter, the secure computation processing unit 101 of the secure computation apparatus 10, the secure computation processing unit 201 of the secure computation apparatus 20, and the secure computation processing unit 301 of the secure computation apparatus 30 execute the concealed vector permutation described in Example 1 or 2 (S306). Accordingly, P2 obtains <→T>1, and P3 obtains <→T>2. Here, when a value range m of the bijection Π is n<m, a share of dummy data is added so that a length of [→D] becomes m in all parties before the concealed vector permutation described in Example 1 or 2 is executed. The dummy data used here may have any value as long as the dummy data satisfies that “the search key is different from any ki included in +D”.
The secure computation processing unit 101 of the secure computation apparatus 10 stores [s]1 in the storage unit 102 (S307). Further, the secure computation processing unit 201 of the secure computation apparatus 20 stores [s]2 and →T>1 in the storage unit 202 (S308). Similarly, the secure computation processing unit 301 of the secure computation apparatus 30 stores [s]3 and <→T>2 in the storage unit 302 (S309).
According to the above protocol, construction of any data structure (reference position concealment vector) including the cuckoo hash table described in Reference 5 and the like can be realized mainly by one-time permutation. In addition, since P1, which knows the permutation Π, does not have the vector <→T>, P1 cannot observe the data reference (vector reference) described in Example 4, making it impossible to identify the reference. Therefore, as described in Example 1, according to the present embodiment, it is possible to efficiently obtain a secure reference position concealment vector.
In the present embodiment, a method of referring to the vector <→T>obtained in Example 3 will be described with reference to
Hereinafter, a case in which a tripartite share [k] of a certain search key is input and a bipartite share <D>=(<k>, *) of data matching the search key is output will be described.
First, the secure computation processing unit 101 of the secure computation apparatus 10, the secure computation processing unit 201 of the secure computation apparatus 20, and the secure computation processing unit 301 of the secure computation apparatus 30 calculate [f]←F([k], [s]) (S401). That is, all parties calculate [f]←F ([k], [s]). Accordingly, each Pi (i=1, 2, 3) has [f]i.
Next, the secure computation processing unit 201 of the secure computation apparatus 20 and the secure computation processing unit 301 of the secure computation apparatus 30 mutually restore [f] to obtain a plaintext f (S402). That is, P2 transmits [f]2 of P2 to P3. Similarly, P3 transmits [f]3 of P3 to P2. P2 restores f using [f]2 of P2 and [f]3 transmitted from P3. Similarly, P3 restores f using [f]3 of P3 and [f]2 transmitted from P2.
Next, the secure computation processing unit 201 of the secure computation apparatus 20 inputs the plaintext f to the mechanism M to obtain a value q (S403). Similarly, the secure computation processing unit 301 of the secure computation apparatus 30 inputs the plaintext f to the mechanism M to obtain the value q (S404). That is, P2 and P3 independently input the plaintext f to the mechanism M to obtain the value q.
The secure computation processing unit 201 of the secure computation apparatus 20 outputs a q-th element <Tq>1 of <←T>1 (S405). Similarly, the secure computation processing unit 301 of the secure computation apparatus 30 outputs a q-th element <Tq>1 of <→T>2 (S406). That is, P2 and P3 independently output the q-th element <Tq> of <→T>.
In this case, when data [Di]=([ki], *) such that ki=k is included in [→D], <Tq>=<Di>in which q=Π(i) can be correctly referred to by using the fact that a calculation result of the pseudo-random function is also fi=f. Further, in this case, since P2 and P3 do not know the entire permutation Π or vector (f1, . . . , fn), it is difficult to identify a reference point (that is, an index i) in an original vector even when only f and q are observed. Further, when the mechanism M always maps any output f of the pseudo-random function F to a value range {1, . . . , m}, any element Tq; q∈{1, . . . , m} of →T is also referred to for unauthorized reference such that k of the input is not included in an original data vector →D, and there is resistance to an attack attempting to identify an index by intentionally making unauthorized reference.
When the pseudo-random function and the mechanism output multiple values as described in Example 3, P2 and P3 obtain multiple values q(1), . . . , q(l) (here, l is a lowercase letter of case L). In this case, in S405 and S406, all elements
Tq
, . . . ,
[Math. 8]
are output. In this case, desired data <D>=(<k>, *) is equivalent to any one element.
Tq
[Math. 9]
Therefore, each party can also select and output a specific element from all the elements by using any operations such as an equality determination or secure computation, for example.
As described above, with the secure computation system 1 according to the present embodiment, it is possible to efficiently apply any permutation Π of P1 to the vector while concealing the permutation Π for P2 and P3 by using asymmetry of information for each party in secure computation of three parties, and to achieve higher security than that in the related art because P1 does not have the vector after permutation. Further, it is possible to construct any data in which the reference position of the vector can be concealed by using such a permutation. Here, asymmetry of information for each party indicates that the information is asymmetric between the party P1 having the permutation for the vector and the parties P2 and P3 having the vector itself after the permutation. This also indicates that information is asymmetric between the parties P2 and P3.
For example, a vector permutation method described in Reference 6 assumes that the permutation is concealed for all parties, whereas in the present embodiment, P1 has any plaintext permutation Π. Therefore, in Reference 6, it is necessary to allow an extra communication traffic cost or add a new process in order to perform any permutation not limited to random permutation, whereas in the present embodiment, it is possible to perform any permutation without any restrictions.
Further, for example, a vector permutation method described in Reference 7 has a wide range of applicable permutation as in the present embodiment because one party has any plaintext permutation, whereas the party having permutation also obtains the vector after permutation. Therefore, in Reference 7, the reference position can be concealed for the parties having the permutation. With respect to the above, in the present embodiment, since only P2 and P3 have the vector after the permutation, and P1 having the permutation does not have the vector after the permutation as described above, it is possible to conceal the reference position for P1 having the permutation.
The present invention is not limited to the specifically disclosed embodiments, and various modifications, changes, combinations with known techniques, and the like can be made without departing from the definition of the claims.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2021/015927 | 4/19/2021 | WO |
