Patent Application
20250068394
The present invention relates to a secure computation technology, and more particularly to a technology for secure computation of a random number that can be used in the k-means++ method.
As a technology for classifying a plurality of pieces of data, there is a technology (hereinafter, referred to as a clustering technology) for classifying similar pieces of data into one cluster. Examples of the clustering technology include the k-means method described in Non Patent Literature 1 and the k-means++ method described in Non Patent Literature 2.
The secure computation is a method of obtaining an operation result of a designated operation without restoring an encrypted numerical value (for example, see Reference Non Patent Literature 1). In the method of Reference Non Patent Literature 1, encryption of distributing a plurality of pieces of information capable of restoring numerical values to three secure computation devices is performed, and thus the results of addition/subtraction, constant addition, multiplication, constant multiplication, logical operation (NOT, logical product, logical sum, exclusive logical sum), data format conversion (integer and binary number), and the like can be held in a state of being distributed to the three secure computation devices without restoring the numerical values, that is, in an encrypted state. In general, the distribution number is not limited to three and may be W (W is a predetermined constant of three or more), and a protocol that achieves secure computation by cooperative calculation by W secure computation devices is called a multi-party protocol.
The k-means method is said to be a method in which generation of clusters greatly depends on how to provide an initial value. Therefore, when a completely random initial value is given to generate a cluster, a preferable result may not be obtained. Therefore, in the plaintext k-means method, the initial value is generated using the k-means++ method that can easily obtain a better result than giving a completely random initial value.
However, no secure computation method for the k-means++ method has been proposed so far. This is because a random number generation method using weighted probability distribution that can be used in the k-means++ method has not been proposed so far.
Therefore, an object of the present invention is to provide a technology for performing secure computation of a random number generation method using weighted probability distribution with high accuracy while keeping data secure.
An aspect of the present invention is a secure random number computation system having L and S being integers of 1 or more, including three or more secure random number computation devices, configured to compute a share ([[r1]], . . . , [[rS]]) of a vector (r1, . . . , rS) (where ri (i=1, . . . , S) is equal to one of output possibility values x1, . . . , xL) having an output value as an element, from a share ([[x1]], . . . , [[xL]]) of a vector (x1, . . . , xL) having an output possibility value as an element and a share ([[p1]], . . . , [[pL]]) of a vector (p1, . . . , pL) (where pi (i=1, . . . , L) is a probability that the output possibility value xi is output, and satisfies Σpi=1) having an output probability as an element, the secure random number computation system including: first vector computation means that computes a share ([[p′1]], . . . , [[p′L]]) of a vector (p′1, . . . , p′L) from the share ([[p1]], . . . , [[pL]]) of the vector (p1, . . . , pL) by ([[p′1]], . . . [[p′L]])=prefix_sum (([[p1]], . . . , [[pL]])); uniform random number generation means that generates a share ([[q1]], . . . , [[qS]]) of a vector (q1, . . . , qS) (where qi (i=1, . . . , S) is a uniform random number, and satisfies 0≤qi≤1) having a uniform random number as an element; and random number computation means that computes a share ([[r1]], . . . , [[rS]]) of a vector (r1, . . . , rS) having an output value as an element from the share ([[p′1]], . . . , [[p′L]]) of the vector (p′1, . . . , p′L), the share ([[x1]], . . . , [[xL]]) of the vector (x1, . . . , xL), and the share ([[q1]], . . . , [[qS]]) of the vector (q1, . . . , qS) by ([[r1]], . . . , [[rS]])=map (([[p′1]], . . . , [[p′L]]), ([[x1]], . . . , [[xL]]), ([[q1]], . . . , [[qS]])).
According to the present invention, it is possible to perform secure computation of a random number generation method using weighted probability distribution with high accuracy while keeping data secure.
Hereinafter, an embodiment of the present invention will be described in detail. Note that components having the same functions are denoted by the same reference numerals, and redundant description will be omitted.
Prior to the description of each embodiment, a notation method in the present specification will be described.
{circumflex over ( )} (caret) represents a superscript. For example, xy{circumflex over ( )}z represents that yz is a superscript for x, and xy{circumflex over ( )}z represents that yz is a subscript for x. Furthermore, _ (underscore) represents a subscript. For example, xy_z represents that yz is a superscript for x, and xy_z represents that yz is a subscript for x.
A superscript “{circumflex over ( )}” or “˜” such as {circumflex over ( )}x or ˜x for a certain letter x would normally be placed directly above “x”, but is written as {circumflex over ( )}x or ˜x due to restrictions on notation in the specification.
The secure computation in the invention of the present application is constructed by a combination of existing secure computation operations. The operations necessary for the secure computation are concealment, addition, subtraction, multiplication, division, logical operation (NOT, logical product, logical sum, exclusive logical sum), comparison operation (=, <, >, ≤, ≥), secure sorting, secure unique check, Group-by operation, prefix_sum (prefix sum), and secure collective mapping. Hereinafter, some operations including the notation will be described.
It is assumed that [[x]] is a value (hereinafter, referred to as a share of x) obtained by concealing x by secure distribution. Any known method can be used as the secure distribution method. For example, the Shamir's secure distribution on GF (261−1) and the duplication secure distribution on Z2 can be used.
A plurality of secure distribution methods may be used in combination in one algorithm. In this case, mutual conversion is appropriately performed.
For the N-dimensional vector {right arrow over ( )}x=(x1, . . . , xN), [[{right arrow over ( )}x]]=([[x1]], . . . , [[xN]]) is set. That is, [[{right arrow over ( )}x]] is a vector having the share [[xn]] of the n-th element xn of {right arrow over ( )}x as the n-th element. As similar to this, also for the M×N matrix A=(am,n) (1≤m≤M, 1≤n≤N), [[A]] is set as a matrix having the share [[am,n]] of the (m, n)th element am,n Of A as the (m, n)-th element.
x is referred to as a plaintext of [[x]].
As a method of obtaining [[x]] from x (concealment) and a method of obtaining x from [[x]] (restoration), specifically, there are methods described in Reference Non Patent Literature 1 and Reference Non Patent Literature 2.
The addition [[x]]+[[y]] by secure computation uses [[x]], [[y]] as inputs and outputs [[x+y]]. The subtraction [[x]]−[[y]] by secure computation uses [[x]], [[y]] as inputs, and outputs [[x−y]]. The multiplication [[x]]> [[y]] (sometimes represented as mul ([[x]], [[y]])) by secure computation uses [[x]], [[y]] as inputs, and outputs [[x×y]]. The division [[x]]/[[y]] (sometimes represented as div ([[x]], [[y]])) by the secure computation uses [[x]], [[y]] as inputs, and outputs [[x/y]].
As specific methods of addition, subtraction, multiplication, and division, there are methods described in Reference Non Patent Literature 3 and Reference Non Patent Literature 4.
For the share [[{right arrow over ( )}x]]=([[x1]], . . . , [[xN]]) of the N-dimensional vector {right arrow over ( )}x=(x1, . . . , xN) and the share [[{right arrow over ( )}y]]=([[y1]], . . . , [[yN]]) of the N-dimensional vector {right arrow over ( )}y=(y1, . . . , yN), the division [[{right arrow over ( )}x]]/[[{right arrow over ( )}y]] by the secure computation is set as [[{right arrow over ( )}x/{right arrow over ( )}y]]=([[x1/y1]], . . . , [[xN/yN]]). [[{right arrow over ( )}x]]/[[{right arrow over ( )}y]] is also referred to as a value obtained by dividing [[{right arrow over ( )}x]] by [[{right arrow over ( )}y]].
Not [[x]] based on secure computation uses [[x]] as inputs, and outputs [not (x)]. The logical product and ([[x]], [[y]]) by the secure computation uses [[x]], [[y]] as inputs, and outputs [[and (x, y)]]. The logical sum or ([[x]], [[y]]) by secure computation uses [[x]], [[y]] as inputs and outputs [[or (x, y)]]. An exclusive OR xor ([[x]], [[y]]) by secure computation uses [[x]], [[y]] as inputs and outputs [[xor (x, y)]].
The logical operation can be easily configured by combining addition, subtraction, multiplication, and division.
The equal sign determination=([[x]], [[y]]) (sometimes represented as equal ([[x]], [[y]]) by secure computation uses [[x]], [[y]] as inputs, and outputs [[1]] when x=y, and outputs [[0]] otherwise. The comparison < ([[x]], [[y]]) by secure computation uses [[x]], [[y]] as inputs, and outputs [[1]] when x<y, and [[0]] otherwise. The comparison by secure computation > ([[x]], [[y]]) uses [[x]], [[y]] as inputs, and outputs [[1]] when x>y, and [[0]] otherwise. The comparison ≤([[x]], [[y]]) by secure computation uses [[x]], [[y]] as inputs, and outputs [[1]] when x≤y, and outputs [[0]] otherwise. The comparison ≥([[x]], [[y]]) by secure computation uses [[x]], [[y]] as inputs, and outputs [[1]] when x≥y, and outputs [[0]] otherwise.
The comparison operation can be easily configured by combining logical operations.
The secure sorting uses the share [[{right arrow over ( )}x]] of the N-dimensional vector {right arrow over ( )}x=(x1, . . . , xN) as inputs, and outputs a vector sort ([[{right arrow over ( )}x]]): =([[xi__1]], . . . , [[xi__N]]) (where xi_1, . . . , and xi_N satisfy xi_1≤xi_2≤ . . . ≤xi_N) obtained by sorting the elements [[x1]], . . . , [[xN]] of [[{right arrow over ( )}x]] in ascending order. For a table T in which each element of any attribute is concealed, a table in which the table T is subjected to secure sorting with the attribute α of the table T as a key is a table exchanged record by record so that the values of the elements of the attribute α are in ascending order from the first record.
As a specific method of secure sorting, there is a method described in Reference Non Patent Literature 5.
The secure unique check uses the share [[{right arrow over ( )}x]] of the N-dimensional vector {right arrow over ( )}x=(x1, . . . , xN) as an input, and outputs a vector unique_check ([[{right arrow over ( )}x]]): =([[xi_1]], . . . [[xi_N]]) (where xi_1, xi_N are either 1 or 0) substituted with [[1]] for the element that appears in the first time and [[0]] for the elements that appear in the second and subsequent times when the same value appears twice or more in the elements [[x1]], . . . , [[xN]] of [[{right arrow over ( )}x]]. For example, executing the secure unique check on the vector ([[1]], [[2]], [[2]], [[3]], [[3]], [3]]) results in ([[1]], [[1]], [[0]], [[1]], [[0]], [0]]).
The secure unique check can be easily configured by combining secure sorting and comparison operation.
The Group-by operation is an operation for obtaining a statistical value (for example, average height for each gender) grouped for each value of an element of a key attribute in a case where a table has a key attribute (for example, gender) and a value attribute (for example, height) and each element of any attribute of the table is concealed. A case in which the computed statistical value is a sum is a groupBySum operation, and a case in which the computed statistical value is a frequency is a groupByCount operation.
As a specific method of Group-by operation, there is a method described in Reference Non Patent Literature 6.
In the Group-by operation disclosed in Reference Non Patent Literature 6, various Group-by operations are efficiently performed by using a groupByCommon operation.
[prefix_sum (Prefix Sum)]
prefix_sum uses the share [[{right arrow over ( )}x]] of the N-dimensional vector {right arrow over ( )}x=(x1, . . . , xN) as an input, and outputs the share [[{right arrow over ( )}y]]=([[y1]], . . . , [yN]) (where yi=Σj=1ixj) of the N-dimensional vector y.
The secure collective mapping is a function of calculating a lookup table, and can arbitrarily determine two vectors used to define the lookup table. Since secure collective mapping performs processing in units of vectors, there is a property that efficiency is high when the same processing is performed on a plurality of inputs. The secure collective mapping is a function map defined as follows.
The secure collective mapping uses the share [[{right arrow over ( )}a]]=([[a1]], . . . , [[aK]]) of the vector {right arrow over ( )}a=(a1, . . . , aK), the share [[{right arrow over ( )}b]]=([[b1]], . . . , [[bK]]) of the vector {right arrow over ( )}b=(b1, . . . , bK) (where a1, . . . , aK, b1, . . . , bK are real numbers, and satisfy a1< . . . <aK), and the share [{right arrow over ( )}x]=([[x1]], . . . , [[xN]]) of the vector {right arrow over ( )}x=(x1, . . . , xN) as inputs, and outputs [[{right arrow over ( )}y]]: =([[y1]], . . . , [yN]) such that ap<xn≤ap+1 and yn=bp are satisfied for 1≤n≤N, that is, the share obtained by mapping the share of each element of the vector {right arrow over ( )}x. At this time, [[{right arrow over ( )}y]]=map ([[{right arrow over ( )}a]], [[{right arrow over ( )}b]], [[{right arrow over ( )}x]]) is expressed. The vector {right arrow over ( )}a and the vector {right arrow over ( )}b are two vectors used to define the lookup table. For example, when the shares of the two vectors {right arrow over ( )}a and {right arrow over ( )}b used for defining the lookup table are ([[50]], [[80]], [[100]]), ([[1]], [[2]], [3]), respectively, map (([[50]], [80], [[100]]), ([[1]], [[2]], [[3]]), ([[5]], [[68]], [[91]]))=([[1]], [[2]], [[3]]) is obtained.
As the secure collective mapping, for example, the algorithm described in Reference Non Patent Literature 7 can be used.
The k-means method is one of machine learning methods classified as unsupervised learning. In supervised learning such as regression analysis and class classification, desired output (called training data) is prepared, and its object is to construct a model that reproduces the output with high accuracy, whereas in unsupervised learning such as clustering, desired output is not determined in advance.
In clustering, distances between a plurality of pieces of given data are computed, and pieces of data having close distances are put together into clusters as similar data. The clustering includes a non-hierarchical method in which the number of clusters to be generated is determined in advance such as the k-means method, and a hierarchical method in which the number of clusters to be generated is not determined in advance, and clusters are sequentially formed from the most similar pieces of data (that is, pieces of data having a minimum distance). The k-means method has a feature that the amount of calculation is less likely to increase even when large-scale data is clustered as compared with the hierarchical method, and thus, is often used for data of a scale that cannot be handled by the hierarchical method.
The flow of processing in the k-means method is as follows.
In the k-means++ method, the initial value of the centroid is set on the basis of the idea that the centroids selected from the data as the initial value are preferably separated from each other as much as possible.
The flow of processing in the k-means++ method is as follows.
In the random number generation method using the weighted probability distribution, a vector (x1, . . . , xL) having an output possibility value as an element and a vector (p1, . . . , pL) (where pi (i=1, . . . , L) is a probability that the output possibility value xi is output, and Σpi=1 is satisfied) having an output probability as an element are input, and a vector (r1, . . . , rS) (where ri (i=1, . . . , S) is equal to one of the output possibility values x1, . . . , xL) having an output value as an element is output. Here, ri (i=1, . . . , S) is selected according to the distribution of the output probability. For example, when a random number is generated using a vector (1, 2, 3) having an output possibility value as an element and a vector (0.5, 0.3, 0.2) having an output probability as an element, l is output with a probability of 0.5, 2 is output with a probability of 0.3, and 3 is output with a probability of 0.2.
<<Secure k-Means Method>>
The secure k-means method is a method of performing secure computation of the k-means method, and the method is secure except for the number M of data and the number K of clusters. In a case where the convergence determination condition as described above is used as the end condition, it is necessary to decode one-bit information indicating “whether each of the K centroids has converged to a certain position” for each convergence determination, but all the other information is processed while being concealed. For example, the M pieces of data, the K pieces of centroids, the distance between the data and the centroid, the information indicating the cluster to which the data belongs, and the number of pieces of data included in the cluster are processed while being concealed.
Next, a table handled by the secure k-means method will be described. In the k-means method, it is necessary to handle information indicating a cluster to which data belongs. Here, as illustrated in
The processing flow in the secure k-means method is the same as the processing flow in the k-means method, and is different only in whether secure computation is performed. The way of performing the processing of (3) to (5) using the above three tables will be described below.
Here, processing of (3) will be described. In the processing, the distance between the data of the data ID and the centroid of the cluster of the cluster ID is computed for all combinations of the data ID and the cluster ID using the data table and the centroid table. However, in order to facilitate the subsequent processing, the calculation results are summarized in a distance table as illustrated in
Here, the processing of (4) will be described. In the processing, the cluster ID table is updated using the distance table obtained in the processing of (3) such that a cluster having the minimum distance to the centroid is paired with each data. That is, in the cluster ID table, the cluster ID paired with the data ID is the cluster ID of the cluster including the centroid having the minimum distance from the data of the data ID. For this purpose, a cluster ID of a cluster having the minimum distance to the data of the data ID for each data ID is extracted from the distance table. Specifically, the following processing is performed.
A table obtained by extracting the element column of the data ID attribute and the element column of the cluster ID attribute from the table generated in (4-4) is a cluster ID table in which a cluster having the minimum distance to the centroid for each data is paired.
Here, the processing of (5) will be described. In this process, the centroid table is updated using the cluster ID table obtained in the processing of (4). The centroid is an average of data included in each cluster. Therefore, if the sum of data included in the cluster and the number of data included in the cluster can be obtained for each cluster, the centroid can be obtained. Since each data is expressed as a vector, the centroid can be efficiently obtained by using the groupBySum operation and the groupByCount operation. Specifically, the following processing is performed.
The value obtained in (5-4) is the centroid of each cluster.
As can be seen from the above description, by performing cluster assignment using secure sorting and secure unique check and performing centroid calculation using groupBySum operation and groupByCount operation, it is possible to safely and efficiently perform secure computation of the k-means method.
The input and output in the secure computation of the random number generation method using the weighted probability distribution are as follows.
Here, the number S of output values may be the plaintext.
This secure computation is very similar in terms of the processing structure of secure collective mapping that is computed using two vectors for defining the lookup table. Therefore, the secure computation is achieved using the secure collective mapping. A flow of the processing will be described below.
The output values r1, . . . , Is are random numbers generated using the weighted probability distribution.
When ([[x1]], [[x2]], [[x3]])=([[1]], [[2]], [[3]]), ([[p1]], [[p2]], [[p3]])=([[0.5]], [[0.3]], [[0.2]]), ([[p′1]], [[p′2]], [[p′3]])=([[0.5]], [[0.8]], [[1.0]]) is obtained. Since qi is a uniform random number satisfying 0≤qi≤1, the probability that the uniform random number qi is included in the section [0, 0.5] is 0.5, the probability that the uniform random number qi is included in the section [0.5, 0.8] is 0.3, and the probability that the uniform random number q is included in the section [0.8, 1.0] is 0.2, and the share ([[r1]], . . . , [[rS]]) of the random numbers according to the weighted probability distribution is obtained by map (([[p′1]], [[p′2]], [[p′3]]), ([[x1]], [[x2]], [[x3]]), ([[q1]], . . . , [[qS]]))=map (([[0.5]], [[0.8]], [[1.0]]), ([[1]], [[2]], [[3]]), ([[q1]], . . . , [[qS]])).
In general, each element of the vector (p1, . . . , pL) is a decimal, and thus the calculation cost of the secure computation is very large. Therefore, for example, if secure computation is performed after each element of the vector (p1, . . . , pL) and the vectors (q1, . . . , qS) is converted into an integer by multiplying each element by 100, the calculation cost of the secure computation can be suppressed.
As can be seen from the above description, it is possible to safely and efficiently perform secure computation of the random number generation method using the weighted probability distribution by using the secure collective mapping.
<<Secure k-means++ Method>>
In the k-means++ method, the weighted probability distribution is used in the processing of (4), and the other processing can be achieved by basic operations such as addition, subtraction, multiplication, and division. Therefore, here, the processing of (4) will be briefly described.
A share ([[k1]], . . . , [kM−j]) of a vector (k1, . . . , kM−j) having a data ID of data not selected as a centroid as an element is set as a vector having an output possibility value as an element. A share ([dk_12/Σdk_m2], . . . , [dk_(M−j)2/Σdk_n2]]) of a vector (dk_12/Σdk_m2, . . . dk_(M−j)2/Σdk_m2). (where dk_m is the smallest distance from a distance between the centroid specified by the first record of the centroid table and the data of the data ID kn to a distance between the centroid specified by the j-th record of the centroid table and the data of the data ID kn) is a vector with the output probability as an element. Furthermore, the number of output values is one.
By performing secure computation of the random number generation method using the weighted probability distribution using these values as inputs, a share [[ij+1]] of the output value ij+1 equal to any of the data IDs of the data not selected as the centroid is obtained. That is, the share ([[xi_(j+1)1]], . . . [xi_(j+1)N]]) of the data (xi_(j+1)1, . . . , xi_(j+1)N) having the data ID ij+1 is the share of the newly obtained centroid.
As can be seen from the above description, it is possible to safely and efficiently perform secure computation of the k-means++ method by using the random number generation method using the weighted probability distribution.
The secure random number computation system 10 will be described below with reference to
As illustrated in
Through cooperative calculation by the W secure random number computation devices 100i, the secure random number computation system 10 achieves secure computation of a random number generation method using weighted probability distribution that is a multi-party protocol. Therefore, the first vector computation means 110 (not illustrated) of the secure random number computation system 10 includes the first vector computation units 1101, 110W, the uniform random number generation means 120 (not illustrated) includes the uniform random number generation units 1201, . . . , 120W, and the random number computation means 130 (not illustrated) includes the random number computation units 1301, . . . , 130W.
The secure random number computation system 10 sets L and S to integers of 1 or more, and calculates a share ([[r1]], . . . , [[rS]]) of a vector (r1, . . . , rS) (where ri (i=1, . . . , S) is equal to one of output possibility values x1, . . . , xL) having an output value as an element from a share ([[x1]], . . . , [[xL]]) of a vector (x1, . . . , xL) having an output possibility value as an element and a share ([[p1]], . . . , [[pL]]) of a vector (p1, . . . , pL) (where pi (i=1, . . . , L) is a probability that the output possibility value xi is output, and Σpi=1 is satisfied) having an output probability as an element.
The operation of the secure random number computation system 10 will be described with reference to
In S110, the first vector computation means 110 computes a share ([[p′1]], . . . , [[p′L]]) of a vector (p′1, . . . , p′L) from the share ([[p1]], . . . , [[pL]]) of the vector (p1, . . . , pL) by ([[p′1]], . . . , [[p′L]])=prefix_sum (([[p1]], . . . , [[pL]])).
In S120, the uniform random number generation means 120 generates a share ([[q1]], . . . , [[qS]]) of a vector (q1, . . . , qS) (where qi (i=1, . . . , S) is a uniform random number, and satisfies 0≤qi≤1) having a uniform random number as an element.
In S130, the random number computation means 130 computes a share ([[r1]], . . . , [[rS]]) of a vector (r1, . . . rS) having an output value as an element from the share ([[p′1]], . . . , [[p′L]]) of the vector (p′1, . . . , p′L) computed in S110, the share ([[x1]], . . . , [[xL]]) of the vector (x1, . . . , xL), and the share ([[q1]], . . . , [[qS]]) of the vector (q1, . . . , qS) generated in S120 by ([[r1]], . . . , [[rS]])=map (([[p′1]], . . . , [[p′L]]), ([[x1]], . . . , [[xL]]), ([[q1]], . . . , [[qS]])).
According to the embodiment of the present invention, it is possible to perform secure computation of a random number generation method using weighted probability distribution with high accuracy while keeping data secure.
The secure cluster computation system 20 will be described below with reference to
As illustrated in
Through cooperative calculation by the W secure cluster computation devices 200i, the secure cluster computation system 20 achieves secure computation of the k-means method and the k-means++ method that is a multi-party protocol. Therefore, the centroid table initialization means 210 (not illustrated) of the secure cluster computation system 20 is configured by the centroid table initialization units 2101, . . . , 210W, the distance table computation means 220 (not illustrated) is configured by the distance table computation units 2201, . . . , 220W, the cluster ID table computation means 230 (not illustrated) is configured by the cluster ID table computation units 2301, . . . , 230W, the centroid table computation means 240 (not illustrated) is configured by the centroid table computation units 2401, . . . , 240W, and the end condition determination means 250 (not illustrated) is configured by the end condition determination units 2501, . . . , 250W.
The secure cluster computation system 20 sets M (M is an integer of 1 or more) as the number of data, K (K is an integer of 1 or more) as the number of clusters, N (N is an integer of 1 or more) as a dimension of data, (xi1, . . . , xiN) (i=1, . . . , M) as data of the data ID i, and calculates a share [[k(i)]] of a cluster ID k(i) (where k(i) satisfies 1≤k(i)≤K) of a cluster to which the data of the data ID i belongs from shares ([[xi1]], . . . , [xiN]) (i=1, . . . , M) of M pieces of data (xi1, . . . , xiN). Here, it is assumed that a cluster ID table includes a data ID and a cluster ID of a cluster to which data of the data ID belongs as attributes (hereinafter, referred to as a data ID attribute and a cluster ID attribute), a data table includes a data ID and data of the data ID as attributes (hereinafter, referred to as a data ID attribute and a data attribute), a centroid table includes a cluster ID and a centroid of a cluster of the cluster ID as attributes (hereinafter, referred to as a cluster ID attribute and a centroid attribute), a distance table includes a data ID, a cluster ID, and a distance between data of the data ID and a centroid of a cluster of the cluster ID as attributes (hereinafter, referred to as a data ID attribute, a cluster ID attribute, and a distance attribute), and the data table includes a set of a share [[i]] of the data ID i and the share ([[xi1]], . . . , [[xiN]]) of the data (xi1, . . . , xiN) of the data ID i as the i-th record (i=1, . . . , M).
The operation of the secure cluster computation system 20 will be described with reference to
In S210, the centroid table initialization means 210 sets a table including a set of a share [[j]] of a cluster ID j and a share ([[cj1]], . . . [cjN]]) of a centroid (cj1, . . . , cjN) of the cluster ID j (where the shares are computed by a predetermined method) as the j-th record (j=1, . . . , K) as an initial value of the centroid table. For example, the centroid table initialization means 210 randomly selects shares [[i1]], . . . , [[iK]] of the data IDs from among the shares [[1]], . . . , [[M]], and sets a set of the share [[j]] of the cluster ID j and the share ([xi_j1]], . . . , [xi_jN]]) of the data (xi_j1, . . . , xi_jN) of the data ID ij as an initial value of the j-th record (j=1, . . . , K) of the centroid table.
In S220, using the data table and the centroid table, the distance table computation means 220 computes a distance table including a set of the share [[i]] of the data ID i, the share [[j]] of the cluster ID j, a share [[dij]] of a distance dij between the data (xi1, . . . , xiN) of the data ID i and the centroid (cj1, . . . , cjN) of the cluster ID j as an M(j−1)+i-th record (i=1, . . . , M, j=1, . . . , K). The centroid table computed in S210 is used at the time of the first execution of S220, and the centroid table computed in S240 is used at the time of the second and subsequent executions.
In S230, the cluster ID table computation means 230 computes a cluster ID table including a set of the share [[i]] of the data ID i and the share [[k(i)]] of the cluster ID k(i) of the cluster to which the data of the data ID i belongs as the i-th record (i=1, . . . , M) using the distance table. For example, the cluster ID table computation means 230 computes a first intermediate table by performing secure sorting on the distance table by using the distance attribute of the distance table as a key, using the distance table, computes a second intermediate table by adding a column obtained by performing secure unique check on an element column of the data ID attribute of the first intermediate table to the first intermediate table as a checked data ID attribute, using the first intermediate table, computes a third intermediate table including a record in which a value of an element of the checked data ID attribute of the second intermediate table is [[1]], using the second intermediate table, and computes a cluster ID table by respectively using, as an element column of the data ID attribute and an element column of the cluster ID attribute of the cluster ID table, an element column of the data ID attribute and an element column of the cluster ID attribute of a table obtained by performing secure sorting on the third intermediate table by using the data ID attribute of the third intermediate table as a key, using the third intermediate table. Here, the first intermediate table is a table including the data ID attribute, the cluster ID attribute, and the distance attribute, the second intermediate table is a table including the checked data ID attribute, the data ID attribute, the cluster ID attribute, and the distance attribute, and the third intermediate table is a table including the checked data ID attribute, the data ID attribute, the cluster ID attribute, and the distance attribute. The first intermediate table includes MK records, the second intermediate table includes MK records, and the third intermediate table includes M records.
In S240, the centroid table computation means 240 computes the centroid table using the data table and the cluster ID table. For example, the centroid table computation means 240 computes a fifth intermediate table by replacing the element column of the data ID attribute of the data table with the element of the cluster ID attribute of the cluster ID table, using the data table and the cluster ID table, computes a sixth intermediate table by a groupBySum operation using the data ID attribute of the fifth intermediate table as a key, using the fifth intermediate table, computes a seventh intermediate table by a groupByCount operation using the data ID attribute of the fifth intermediate table as a key, using the fifth intermediate table, and computes a centroid table by setting a value obtained by dividing the value of the element of the data attribute of the j-th record of the sixth intermediate table by the value of the element of the data attribute of the j-th record of the seventh intermediate table as a value of an element of the centroid attribute of the j-th record of the centroid table, using the sixth intermediate table and the seventh intermediate table. Here, the fifth intermediate table is a table including the data ID attribute and the data attribute, the sixth intermediate table is a table including the data ID attribute and the data attribute, and the seventh intermediate table is a table including the data ID attribute and the data attribute. The fifth intermediate table includes M records, the sixth intermediate table includes K records, and the seventh intermediate table includes K records.
In S250, the end condition determination means 250 ends the process in a case where a predetermined end condition is satisfied, and returns to the processing of S220 in other cases. That is, the secure cluster computation system 20 repeats the processing of S220 to S240. When the predetermined end condition is the number of executions of the processing of S220 to S240, it is assumed that the share [[T]] of the number of executions T is given in advance, and the centroid table initialization means 210 initializes the value of the counter t with the share [[0]]. Then, the end condition determination means 250 may update the value of the counter t with t+[1], and in a case where the value of =([[t>T]], [[1]]) is [[1]], the process may be ended, and in other cases, the process may return to the processing of S220.
<<Setting of Initial Value Using Secure k-Means++ Method>>
Hereinafter, the centroid table initialization means 210 will be described with reference to
The first initial value setting means 211 (not illustrated) of the centroid table initialization means 210 is configured by the first initial value setting units 2111, . . . , and 211W, the first vector computation means 212 (not illustrated) is configured by the first vector computation units 2121, . . . , 212W, the second initial value setting means 213 (not illustrated) is configured by the second initial value setting units 2131, . . . , 213W, and the end condition determination means 214 (not illustrated) is configured by the end condition determination units 2141, . . . , 214W.
Hereinafter, the operation of the centroid table initialization means 210 will be described with reference to
In S211, the first initial value setting means 211 randomly selects a share [[i]] of a data ID from among shares [[1]], . . . , [[M]], and sets a set of the share [[1]] of the cluster ID 1 and the share ([[xi_11]], . . . , [[xi_1N]]) of the data (xi_11, . . . , xi_1N) of the data ID i1 as an initial value of the first record of the centroid table. The first initial value setting means 211 initializes the value of the counter t with the share [[0]].
In S212, the first vector computation means 212 computes a share ([dk_12/Σdk_m2], . . . , [dk_(M−j)2/Σdk_m2]) of a vector (dk_12/Σdk_m2, . . . , dk_(M−j)2/Σdk_m2) (where dk_n is the smallest distance from a distance between the centroid specified by the first record of the centroid table and the data of the data ID km to a distance between the centroid specified by the j-th record of the centroid table and the data of the data ID km), using a share ([xk_11]], . . . [xk_(M−j)N]) of data (xk_11, . . . , xk_(M−j)N) (where km (m=1, . . . , M−j, j satisfies 1≤j<K) is a data ID of data that is not selected as the centroid) of the data ID km. For example, the first vector computation means 212 may perform processing similar to the processing of S220 and S230 to compute the share ([[dk_12/Σdk_m2]], . . . , [[dk_(M−j)2/Σdk_m2]]).
In S213, using the secure random number computation system of the first embodiment, the second initial value setting means 213 computes a share [[ij+1]] of one output value ij+1 (ij+1 is equal to one of the data IDs k1, . . . , kM−j of the data not selected as the centroid) from the share ([[k1]], . . . [[kM−j]]) of the vector (k1, . . . , kM−j) having a data ID of data not selected as the centroid as an element and the share ([[dk_12/Σdk_m2]], . . . , [[dk_(M−j)2/Σdk_n2]]) of the vector (dk_12/Σdk_n2, . . . , dk_(M−j)2/Σdk_m2) computed in S212, and sets a set of the share [[j+1]] of the cluster ID j+1 and the share ([[xi_(j+1)1]], . . . , [xi_(j+1)N]]) of the data (xi_(j+1)1, . . . , xi_(j+1)N) of the data ID ij+1 as an initial value of the j+1-th record of the centroid table.
In S214, the end condition determination means 214 may update the value of the counter t with t+[[1]], and in a case where the value of =([[t>K]], [[1]]) is [[1]], the process ends, and in other cases, the process returns to the processing of S212. That is, the centroid table initialization means 210 repeats the processing of S212 to S213.
According to the embodiment of the present invention, it is possible to perform secure computation of the k-means method and the k-means++ method with high accuracy while keeping data secure.
The device according to the present invention includes, as a single hardware entity for example, an input unit that can be connected to a keyboard or the like, an output unit that can be connected to a liquid crystal display or the like, a communication unit that can be connected to a communication device (e.g., a communication cable) capable of communicating with the outside of the hardware entity, a CPU (Central Processing Unit, which may include a cache memory or a register), a RAM or a ROM which is a memory, an external storage device as a hard disk, and a bus that connects the input unit, the output unit, the communication unit, the CPU, the RAM, the ROM, and the external storage device so that data can be exchanged therebetween. A device (drive) or the like that can write and read data in and from a recording medium such as a CD-ROM may be provided in the hardware entity as necessary. Examples of a physical entity including such a hardware resource include a general-purpose computer.
The external storage device of the hardware entity stores a program required to implement the above-described functions, data required to process the program, and the like (the present invention is not limited to the external storage device and the program may be stored, for example, in a ROM which is a read-only storage device). Data or the like obtained by processing the program is appropriately stored in a RAM, an external storage device, or the like.
In the hardware entity, each program stored in the external storage device (or ROM or the like) and data required to process each program are read to a memory as necessary and are appropriately interpreted and processed by the CPU. As a result, the CPU implements a predetermined function (each component represented as unit, . . . means, or the like).
The present invention is not limited to the above-described embodiment and can be appropriately modified without departing from the gist of the present invention. The processes described in the foregoing embodiment may be executed not only chronologically in accordance with the described order, but also in parallel or individually in accordance with the processing capability of a device that executes the processes or as necessary.
As described above, when the processing function of the hardware entity (the device according to the present invention) described in the foregoing embodiment is implemented by a computer, processing content of the function of the hardware entity is described by a program. In addition, as the computer executes the program, the processing function of the hardware entity is implemented on the computer.
The program in which the processing content is written may be recorded on a computer-readable recording medium. The computer-readable recording medium may be, for example, any recording medium such as a magnetic recording device, an optical disc, a magneto-optical recording medium, or a semiconductor memory. Specifically, for example, a hard disk device, a flexible disk, a magnetic tape, or the like, can be used as a magnetic recording device, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only Memory), a CD-R (Recordable)/RW (ReWritable), or the like, can be used as an optical disk, an MO (Magneto-Optical disc), or the like, can be used as a magneto-optical recording medium, an EEP-ROM (Electronically Erasable and Programmable-Read Only Memory), or the like, can be used as a semiconductor memory.
In addition, the program is distributed by, for example, selling, transferring, or renting a portable recording medium such as a DVD or a CD-ROM on which the program is recorded. Further, a configuration may also be employed in which the program is stored in a storage device of a server computer and the program is distributed by transferring the program from the server computer to other computers via a network.
For example, a computer that executes such a program first temporarily stores a program recorded on a portable recording medium or a program transferred from the server computer in a storage device of the computer. In addition, to perform the processing, the computer reads the program stored in the storage device of the computer, and executes the processing in accordance with the read program. Also, in other modes of execution of the program, the computer may read the program directly from a portable recording medium and performs processing in accordance with the program, or alternatively, the computer may sequentially perform processing in accordance with a received program every time a program is transferred from the server computer to the computer. In addition, the above-described processing may be executed by a so-called ASP (Application Service Provider) type service that implements a processing function only by an execution instruction and result acquisition without transferring the program from the server computer to the computer. Note that the program in the present embodiment includes information that is used for processing by an electronic computer and is equivalent to the program (data or the like that is not a direct command to the computer but has property that defines processing performed by the computer).
Although the hardware entity is configured by causing a computer to execute a predetermined program in the present embodiment, at least some of the processing content may be implemented by hardware.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2022/000519 | 1/11/2022 | WO |
