Patent Application
20230370251
The present invention relates to a secure computation technique.
In secure computation (for example, refer to NPL 1, 2, and the like), it may be necessary to share a numerical value representing a position of an element having a specific value in a sequence of a plurality of elements. For example, in secure computation, in order to shift the most significant bit (most significant bit: MSB) of a bit string to a specific position, it is necessary to share a numerical value representing a position of the most significant bit.
However, there is no known technique for obtaining a numerical share representing a position of an element having a specific value while the position of the element having the specific value in a sequence of a plurality elements is kept secret from the share of the sequence of the plurality of elements.
The present invention was made in view of these points, and an object of the present invention is to obtain a numerical share representing a position of an element having a specific value while keeping the position of the element having the specific value hidden from the share of a sequence of a plurality of elements.
The secure computation apparatus obtains the sequence ρ∘f obtained by rotating the elements fp-1, . . . , f0 of the sequence f by ρ elements by secure computation using the share of the random number ρ and the share of the sequence f without obtaining the random number ρ and the sequence f, obtains the value b′ϵ{0, . . . , p−1} representing the position of the element cfb′ whose value is α among the elements cfp-1, . . . , cf0 in the sequence ρ∘f, and obtains the share of the value b by secure computation using the share of the random number ρ and the value b′. Here, p is an integer of 2 or more, f is a sequence of p elements fp-1, . . . , f0, a value of one element fb among the elements fp-1, . . . , f0 is α, a value of an element other than the element fb is other than α, a value representing a position of the element fb is bϵ{0, . . . , p−1}, and ρ is a random number represented by an integer. Here, since ρ is a random number, ρ∘f is a randomized position of the element fb and information b of the position of the element fb cannot be obtained from ρ∘f.
Thus, in a secure computation apparatus of the present invention, from the share of a sequence of a plurality of elements, it is possible to obtain the share of a numerical value representing a position of an element having a specific value while keeping the position of the element having the specific value concealed in the sequence of the plurality of elements.
An embodiment of the present invention will be described below with reference to the drawings.
First, a principle of an embodiment will be described. In the embodiment, n secure computation apparatuses PA(0), . . . , PA(n−1) perform secure computation and each obtains a share of a numerical value representing a position of an element fb having a specific value a from a share (secret sharing value) of a sequence f of a plurality of (p) elements fp-1, . . . , f0 while keeping the position of the element fb having the specific value a concealed among the sequences f of the plurality of elements fp-1, . . . , f0. Here, n is an integer of 2 or more, j=0, . . . , n−1, and p is an integer of 2 or more. For example, p is a prime number (for example, p is a Mersenne prime number such as 61). Furthermore, f is a sequence of p elements fp-1, . . . , f0, a value of one element fb among the elements fp-1, . . . , f0 is α, a value of an element other than the element fb is other than α, and a value representing the position of the element fb is bϵ{0, . . . , P−1}. Preferably, all the values of the elements other than the element fb among the elements fp-1, . . . , f0 are β, and β≠α. That is to say, preferably, each element fi (where iϵ{0, . . . , p−1}) is binary (fiϵ{α, β}). For example, the sequence f is a bit string, each element fi of the elements fp-1, . . . , f0 is a bit, and the value of each element fi of the elements fp-1, . . . , f0 is 0 or 1. It may be (α, β))=(1,0) or (α, β)=(0,1). For example, the sequence f=(fp-1, . . . , f0) represents a position b of a specific bit (for example, most significant bit) when an element AϵZP (that is, if A is regarded as an integer, A mod P) of a quotient ring Zp modulo P represented by p bits is expressed in binary and the value of the element fb corresponding to the position b of the specific bit of the element A is α=1, and the value of the other elements is β=0. For example, p represents the number of bits of P. P is an integer of 1 or more, for example, P is a Mersenne number. An example of P is the Mersenne prime P=2p−1 (for example, 261-1). However, these do not limit the invention.
Each secure computation apparatus PA(j) holds p as a parameter. The share sha(f)j of the sequence f=(fp-1, . . . , f0) of the p elements fp-1, . . . , f0 is input to each secure computation apparatus PA(j). For example, the share sha(f)j of f=(fp-1, . . . , f0) is a sequence of shares sha(fp-1)j, . . . , sha(f0)j of each element fp-1, . . . , f0. However, this does not limit the invention. The share sha(χ)j of χ represents the share assigned to the secure computation apparatus PA(j) among the shares (secret sharing value) obtained by secret sharing X according to a predetermined secret sharing method. There is no limit to the secret sharing method. Examples of the secret sharing method include (k, n)-secret sharing methods such as (k, n)-replica secret sharing methods (for example, refer to Reference Literature 1) and (k, n)-Shamir secret sharing methods (for example, refer to Reference Literature 2) and (k, k)-additive secret sharing methods. Here, k is an integer of 2 or more and n or less. A (k, n)-duplicate secret sharing method in the case of n=k is called a (k, k)-additive secret sharing method. Furthermore, the share of χ is expressed as sha(χ)j regardless of the type of secret sharing method. For example, the share sha(χ1)j of χ1 and the share (χ2)j of χ2 may be based on the same secret sharing method or may be based on different secret sharing methods.
Each secret calculator PA(j) generates a share sha(ρ)j of a random number ρ represented by an integer. Preferably, the random number ρ is a uniform random number, but the random number ρ does not have to be a uniform random number. For example, a pseudo-random number which can be approximated to a uniform random number may be a random number p. Furthermore, the random number ρ may or may not be limited to an integer of 0 or more. Each secure computation apparatus PA(j) generates the share sha(ρ)j without obtaining the value of the random number ρ itself. For example, at least a part of n secure computation apparatuses PA(0), . . . PA(n−1) cooperate to generate the share sha(ρ)0, . . . , sha(ρ)n-1 of the random number ρ. The share of the random number ρ sha(ρ)0, . . . , sha(ρ)n-1 is, for example, a share obtained by secretly sharing the element ρϵZp (that is, if ρ is regarded as an integer, ρ mod p) of the quotient ring Zp modulo p. There is no limitation on the method of generating the shares sha(ρ)0, . . . , Sha(ρ)n-1. For example, each secure computation apparatus PA(j) of the k secure computation apparatuses PA(0), . . . , PA(k−1) may generate a random number ρj and each random number ρj may be sha(ρ)j when the share sha(ρ)j is based on the (k, k)-additive secret sharing method. In this case, ρ=ρ0+ . . . +ρk-1ϵZp (that is, if ρ, ρ0, . . . , ρn-1 are regarded as integers, ρ=ρ0+ . . . +ρk-1 mod p) is satisfied. For example, each secure computation apparatus PA(j) of n secure computation apparatuses PA(0), . . . , PA(n−1) may generate random numbers ρj and a true subset (set of sub-shares) of random numbers ρ0, . . . , ρn-1 may be each share sha(ρ)j when the share sha(ρ)j conforms to the (k, n)-replica type secret sharing method. In the case of (K, n)-duplicate secret sharing method, ρ=ρ0+ . . . +ρn-1ϵZp is satisfied and all of random numbers μ0, . . . , ρn-1 can be obtained using any k shares of the shares sha(ρ)0, . . . , sha(ρ)n-1. but no information on p can be obtained from shares less than k.
Each secure computation apparatus PA(j) obtains a sequence ρ∘f=(cfp-1, . . . , cf0) in which the elements fp-1, . . . , f0 of the sequence f are rotated (circularly shifted) by ρ elements by secure computation using the share sha(ρ)j of the random number ρ and the share sha(f)j of the sequence without obtaining the random number ρ and the sequence f. For example, each secure computation apparatus PA(j) obtains a sequence ρ∘f which is a bit string obtained by bit-rotating the elements fp-1, . . . , f0 of the sequence f which is a bit string by p bits. Since rotation is a sub-group of permutations, this process can be achieved, for example, by limiting the permutations to rotations by random permutations by secure computation (for example, Reference Literature 3). In addition, since rotation is equivalent to multiplication or division on the quotient ring, it can also be realized by exponentiation, multiplication, division, or the like by secure computation. In this case, the quotient ring method is a Mersenne prime.
The rotation of χ by ρ elements may cyclically shift χ to the left by ρ elements when p is positive, and cyclically shift χ to the right by ρ elements when ρ is negative. On the other hand, when ρ is positive, χ may be cyclically shifted to the right by ρ elements, and when ρ is negative, χ may be cyclically shifted to the left by ρ elements. Here, the sequence ρ∘f is a restored value (public value), but each secure computation apparatus PA(j) does not know the random number ρ itself. Therefore, although it is possible to ascertain the position of the element cfb, (where b′ϵ{0, . . . , p−1}) whose value is α from the sequence ρ∘f=(cfp-1, . . . , cf0), each secure computation apparatus PA(j) cannot ascertain which of the elements fp-1, . . . , f0 in the original sequence f has the value of a (it is not possible to ascertain what number the element with the value of a was). Particularly, when the value of one element fb among the elements fp-1, . . . , f0 is α, and the values of all the elements other than the element fb are β (β≠α), the information obtained from the sequence ρ∘f is indistinguishable from the information obtained from any random number. Therefore, higher safety can be ensured.
Each secure computation apparatus PA (j) obtains a value b′ϵ{0, . . . , p−1} representing the position of the element cfb′ in which the value is α among the elements cfp-1, . . . , cf0 in sequence ρ∘f. That is to say, each secure computation apparatus PA(j) obtains a value b′ which satisfies cfb′=α among the elements cfp-1, . . . , cf0. b′, b, and ρ satisfy the relationship of b′=b+ρϵZp.
Each secret calculator PA(j) obtains the share sha(b)j of the value b using the share sha(ρ)j of the random number ρ and the value b′ on the basis of the relationship of b′=b+ρϵZp by secure computation. For example, when the share sha(ρ)j and the share sha(b)j are based on the (k, k)-additive secret sharing method or the (k, n)-replica secret sharing method, each secure computation apparatus PA(j) obtains sha(b)j=b′−sha(ρ)jϵZp as the share sha(b)j of the value b.
Next, a first embodiment of the present invention will be described below with reference to the drawings. The following example will be described in the first embodiment.
For example, the sequence f=(fp-1, . . . , f0) represents the position of the most significant bit of AϵZP represented by the p bit and the value of the element fb corresponding to the position b of the most significant bit is α=1 and the value of the other elements is β=0. Furthermore, in the embodiment, the share obtained by secret-sharing xϵZy (x mod y when x is regarded as an integer) according to the (k, n)-secret sharing method is expressed as [x]y, the share obtained by secret-sharing xϵZy according to the (k, k)-additive secret-sharing method is expressed as <x>y, and the share obtained by secret-sharing xϵZy according to the (k, n)-duplicate secret-sharing method is expressed as <<x>>y. Furthermore, [x]y assigned to the secure computation apparatus PA(j) is expressed as [x]jy, <x>y assigned to the secure computation apparatus PA(j) is expressed as <x>jy, and <<x>>y assigned to the secure computation apparatus PA(j) is expressed as <<x>>jy.
As illustrated in
A process of each secure computation apparatus PA(j) will be described below with reference to
The random number share generation unit 12-j uses p read from the storage unit 17-j and generates and outputs a share <<ρ>>jp of a random number (for example, a uniform random number) p in cooperation with at least a part of the random number share generator 12-m of another secure computation apparatus PAm(where mϵ{0, . . . , n−1} and m≠j) (step S12-j).
The rotation unit 13-j obtains and outputs the sequence ρ∘f=(cfp-1, . . . , cf0) obtained by rotating the elements fp-1, . . . , f0 of the sequence f by ρ elements (bit rotation by p bits) by secure computation using the bit share vector [f]j2 input in Step S11-j and the share <<ρ>>jp of the random number ρ obtained in Step S12-j without obtaining the random number ρ and the sequence f. For example, the sequence ρ∘f when ρ is positive is the sequence f cyclically shifted to the left by the ρ element, and when ρ is negative, the sequence ρ∘f is the sequence f cyclically shifted to the right by the ρ element. A specific example of this process will be described later (Step S13-j).
The position extraction unit 14-j uses the sequence ρ∘f=(cfp-1, . . . , cf0) obtained in Step S13-j and obtains and outputs a value b′ϵ{0, . . . , P−1} representing the position of the element cfb, whose value is α=1 (Step S14-j) among the elements cfp-1, . . . , cf0 in sequence ρ∘f.
The numerical share conversion unit 15-j calculates <<p>>jP=b′−<<ρ>>jpϵZp by secure computation using the p read from the storage unit 17-j, the share of random number ρ obtained in Step S12-j<<ρ>>jp, and the value b′ obtained in Step S14-j and outputs the obtained share <<p>>jp (Step S15-j).
The process of Step S13-j can be realized by using random permutation by secure computation (for example, refer to Reference Literature 3). A specific example of this process is shown below.
Specific example 1 is an example in the case of n=3 and k=2.
1: The rotation unit 13-0 of the secure computation apparatus PA(0) and the rotation unit 13-1 of the secure computation apparatus PA(1) cooperate with each other and the bit share vector [f]02 and the bit share vector [f]12 are converted into the share <f>02 and the share <f>12 according to the (2,2)-additive secret sharing method (for example, refer to Reference Literature 4 and the like). That is to say, f=<f>02+<f>12 is satisfied. The share <f>02 is assigned to the secure computation apparatus PA(0), and the share <f>12 is assigned to the secure computation apparatus PA(1).
2: The rotation unit 13-0 of the secure computation apparatus PA(0) and the rotation unit 13-1 of the secure computation apparatus PA(1) shares the sequence r01=(r01, p-1, . . . , r01, 0) of the random number elements r01, p-1, . . . , r01, 0. For example, the rotation unit 13-0 may randomly generate the sequence r01 and send it to the rotation unit 13-1, the rotation units 13-0 and 13-1 may share the seed value in advance, and may share the same sequence r01 by a predetermined process using the seed value.
3: The rotation unit 13-0 of the secure computation apparatus PA(0) calculates B0=(ρ01)∘<f>02−r01 using the share <<ρ>>0P, the share <f>02, and the sequence r01 and transmit it to the rotation unit 13-2 of the secure computation apparatus PA2.
Here, the following relationship is satisfied.
<<ρ>>0p=(ρ01,ρ20)
<<ρ>>1p=(ρ01,ρ12)
<<ρ>>2p=(ρ12,ρ20)
ρ=ρ01+ρ12+ρ20ϵZp
ρ, ρ01, ρ20, and ρ12 are the elements of the quotient ring modulo p and the operation of ρ, β01, ρ20, and ρ12, and the operation of the share of ρ, ρ01, ρ20, and ρ12 are operations on the quotient ring Zp modulo p (operation on mod p).
4: The rotation unit 13-1 of the secure computation apparatus PA (1) calculates B1=(ρ01)∘<f>12+r01 using the share <<ρ>>1p, the share <f>12, and the sequence r01 and transmits it to the rotation unit 13-2 of the secure computation apparatus PA2.
5: The rotation unit 13-2 of the secure computation apparatus PA2 calculates C=(ρ20)∘((ρ12)∘(B0+B1)) using the share <<ρ>>2p, the share <f>22, B0, and B1. Here, the following holds.
C=(ρ20)∘((ρ12)∘(B0+B1))
=(ρ20)ρ((ρ12)∘((ρ01)∘<f>02−r01+(ρ01)∘<f>12+r01))
=(ρ20)∘((ρ12)∘((ρ01)∘(<f>02+<f>12))
=(ρ20)∘((ρ12)∘((ρ01)∘f)
=(ρ20+ρ12+ρ01)∘f
=P∘f
Specific Example 2 is an example in which n and k are generalized. In Specific Example 2, the set of n secure computation apparatuses PA(0), . . . , PA(n−1) is expressed as PA and the set of k secure computation apparatuses PA(φ(i, 0)), . . . , PA(φ(i, k−1)) selected from PA is referred to as SP(i). Here, n and k are integers of 2 or more, n>k, N=nCk, and i=0, . . . , N−1. nCk represents the total number of combinations when selecting k different from each other from n different from each other. Furthermore, φ (α, β) is a function value of α and β, and satisfies {φ (i, 0), . . . , φ (i, k−1)}∪{0, . . . , n−1}. SP(0), . . . , SP(N−1) are different from each other, and SP(0), . . . , SP(N−1) is configured as |SP(i′)∩SP(I′+1)c|=1 about i′=0, . . . , N−2. Here, αc represents the complement of α, and |α| represents the number of elements of a. That is to say, the set SP(i′) is a set in which only one secure computation apparatus is different from the set SP(i′+1).
The share <f>(SP(i)) is k shares held by the set SP(i) according to the (k, k)-additive secret sharing method. In addition, particularly, the share <f>(SP(i)) is k shares <f>0p, . . . , <f>k-1p obtained by secret sharing f according to the (k, k)-additive secret sharing method. <f>(PA(θ)ϵSP(i)) is a share among the share <f>(SP(i)) held by the secure computation apparatus PA(θ)ϵSP(i).
The sub-share of n shares <<ρ>>0p, . . . , <<ρ>>n-1p obtained by secretly sharing ρ according to the (k, n)-duplicate secret sharing method is expressed as ρ0, . . . , ρn-1ϵZp. That is to say, ρ=ρ0+ . . . +ρn-1ϵZp (that is, ρ=ρ0+ . . . +ρn-1 mod p) is satisfied. The sub-share of the sub-shares ρ0, . . . , ρn-1 corresponding to the set SP(i) is expressed as ρ(SP(i)). That is to say, ρ(SP(i)) represents a sub-share included in the share <<ρ>>(φ (i, 0))p, . . . , <<ρ>>(φ(i, k-1))p corresponding to k secure computation apparatuses PA(φ (i, 0)), . . . , PA(φ (i, k−1)) belonging to the set SP(i).
As described above, for i′=0, . . . , N−2, SP(0), . . . , SP(N−1) is configured so that |SP(i′)∩SP(i′+1)c|=1 is satisfied. Here, PA(φ(i′, 0)) represents a secure computation apparatus included in the set SP (i′) and not included in the set SP(i′+1). Furthermore, PA(φ(i′+1, k)) represents a secure computation apparatus not included in the set SP(i′) but included in the set SP(i′+1). Furthermore, the PA(φ(i′, j)) for j=1, . . . , K−1 represents a secure computation apparatus included in both the set SP(i′) and the set SP(i′+1).
Specific Example 2 of Step S13-j will be described with reference to
The control units 16-j of all the secure computation apparatuses PA(j) are set to i=0 (Step S132).
Rotational units 13-φ(i, 0), . . . , PA(φ(i, k−1)) of k secure computation apparatuses PA(φ(i, 0)), . . . , PA(φ(i, k−1)) belonging to the set SP(i) calculates (performs unit rotation on) ρ(SP(i))∘<f>(SP(i))ϵZp and stores a value obtained thereby as a new share <f>(SP(i)) in the storage unit 17-φ(i, 0), . . . , φ(i, k−1) (Step S133).
The control unit 16-j determines whether i≥N−1 is satisfied (Step S134). When i≥N−1 is satisfied, the process proceeds to Step S137, and when i≥N−1 is satisfied, the process proceeds to Step S135.
In Step S135, first, the rotation unit 13-φ(i, 0) of the secure computation apparatus PA(φ (i, 0)) and the rotation unit 13-φ(i, 1), . . . , 13-φ(i, k−1) of the secure computation apparatus PA(φ (i, 1)), . . . , PA(φ (i, k−1)) share random numbers r(i, 1), . . . , r(i, k−1))ϵZp. Furthermore, the rotation unit 13-φ(i, 0) of the secure computation unit PA(φ (i, 0)) uses a share <f>(PA(0)ϵSP(i)) and random numbers r(i, 1), . . . , r(i, k−1)) to obtain the share <f>(PA(k)ϵSP(i+1)). That is to say, the secure computation apparatus PA(φ(i, 0)) obtains the share <f>(PA(k)ϵSP(i+1)) using the following Equation.
The secure computation apparatus PA(φ(i, 0)) transmits the share <f>(PA(k)ϵSP(i+1)) obtained as described above to the secure computation apparatus PA(φ(i+1, k)). Furthermore, the rotation unit 13-φ(i, j′) of the secure computation apparatus PA(φ(i, j′)) obtains the share <f>(PA(j′)ϵSP(i+1)) using the share <f>(PA(j′)ϵSP(i)) and the random number r(i, j′) for j′=1, . . . , k−1. That is to say, each of the rotation units 13-φ(i, j′) of the secure computation apparatus PA(φ(i, j′)) has a share <f>(PA(j′)ϵSP(i+1)) using the following Equation (Step S135).
The control unit 16-j of all the secure computation apparatuses PA(j) sets i+1 to a new i (Step S136) and the process proceeds to Step S133.
In Step S137 (when i≥N−1 is satisfied in Step S134), the rotation units 13-φ(N−1, 0), . . . , 13-φ(N−1, k−1) of the secure computation apparatus PA(φ(N−1, 0)), . . . , PA(φ(N−1, k−1)) belonging to the set SP(N−1) uses the share <f>(SP(N-1) stored in the storage units 17-φ(N−1, 0), . . . , φ(N−1, k−1) in Step S133 and obtains the restored value ρ∘f in cooperation thereof.
The secure computation apparatus PA(j) in the embodiment is, for example, a device composed of a general-purpose or dedicated computer including a processor (hardware processor) such as a central processing unit (CPU) and a memory such as a random access memory (RAN) and a read only memory (ROM) and configured to execute a predetermined program. This computer may have one processor and one memory or may have a plurality of processors and a plurality of memories. This program may be installed in a computer or may be recorded in a ROM or the like in advance. Furthermore, a part or all of the processing units may be configured by using an electronic circuit which realizes a processing function independently, instead of an electronic circuit (circuitry) which realizes a function configuration by reading a program like a CPU. Furthermore, an electronic circuit constituting one device may include a plurality of CPUs.
Similarly, the CPU 10a writes various data stored in the data region 10fb of the auxiliary storage device 10f to the data region 10db of the RAM 10d. Also, the address on the RAM 10d in which this program or data is written is stored in the register 10ac of the CPU 10a. The control unit 10aa of the CPU 10a sequentially reads out these addresses stored in the register 10ac, reads a program or data from the region on the RAM 10d indicated by the read address, and reads the program or data, causes the calculation unit 10ab to sequentially execute the operations indicated by the program, and stores the calculation result in the register 10ac. With such a configuration, the functional configuration of the secure computation apparatus PA(j) is realized.
The above program can be recorded on a computer-readable recording medium. An example of a computer-readable recording medium is a non-transitory recording medium. Examples of such recording media are magnetic recording devices, optical discs, optomagnetic recording media, semiconductor memories, and the like.
The distribution of this program is performed, for example, by selling, transferring, renting, or the like a portable recording medium such as a DVD or a CD-ROM in which the program is recorded. Furthermore, the program may be stored in the storage device of the server computer and the program may be distributed by transferring the program from the server computer to another computer over a network. As described above, the computer which executes such a program first temporarily stores, for example, the program recorded on the portable recording medium or the program transferred from the server computer in its own storage device. Furthermore, when the process is performed, the computer reads the program stored in its own storage device and performs the process according to the read program. Furthermore, as another execution form of this program, a computer may read the program directly from a portable recording medium and execute processing according to the program and the processing according to the received program may be executed sequentially every time the program is transferred from the server computer to this computer. In addition, the above-mentioned process may be performed by a so-called application service provider (ASP) type service which realizes the processing function only by the execution instruction and result acquisition without transferring the program from the server computer to this computer. Note that the program in this embodiment includes information to be used for processing by a computer and equivalent to the program (data which is not a direct command to the computer but has a property that regulates the processing of the computer and the like).
Although the device is configured by executing a predetermined program on a computer in each embodiment, at least a part of these processing contents may be realized using hardware.
Note that the present invention is not limited to the above-described embodiment. For example, the various processes described above may not only be executed in chronological order according to the description, but may also be executed in parallel or individually as required by the processing capacity of the device that executes the processes. In addition, it goes without saying that changes can be made as appropriate without departing from the spirit of the present invention.
The present invention can be used, for example, for secret calculations using shares. For example, in a secret calculation, in order to shift the most significant bit of a bit string to a specific position, it may be necessary to share a numerical value representing the position of the most significant bit. It is possible to obtain a numerical share which represents the position of the element with that particular value while keeping the position of the element having the specific value secret from the share of the column of the plurality of elements having the specific value in the element at the most significant bit position by using the present invention.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2020/039082 | 10/16/2020 | WO |
