Patent Application
20220413807
The present invention relates to a secure computation technique and a privacy protection technique.
Recently, demands for utilizing privacy data represented by private information have been increasing, and a secure computation technique for enabling various calculations while information is kept secret attracts attention. The secure computation is a useful technique that can be applied to various applications (e.g., refer to NPL 1). However, because the accuracy (correctness) of calculation results is ensured in the secure computation, the privacy of calculation results, which is called as “output privacy”, is not protected. Mixing of a calculation result using random noise, for example, is needed in order to protect the output privacy, and in the secure computation as well, such mixing, that is, generation of random noise is one technical issue.
For such an issue, a method of generating secret random noise following a discrete Laplace distribution using the secure computation is disclosed in NPL 2. Noise that follows the discrete Laplace distribution is used for satisfying an output privacy protection standard called differential privacy, and therefore the technique disclosed in NPL 2 can be said as a useful technique for achieving the output privacy protection in the secure computation.
[NPL 1] Naoto Kiribuchi, Dai Ikarashi, Koki Hamada, Ryo Kikuchi, “MEVAL3: A Library for Programmable Secure Computation”, Symposium on Cryptography and Information Security (SCIS), 2018.
[NPL 2] C. Dwork, K, Kenthapadi, F. McSherry, I. Mironov, M. Naor, “Our data, ourselves: privacy via distributed noise generation,” Advances in Cryptology, EUROCRYPT, LNCS 4004, pp. 486-503, 2006.
However, in the technique disclosed in NPL 2, noise is generated by approximating the discrete Laplace distribution with a geometric distribution, and therefore there is a problem in that the privacy protection strength decreases relative to a known technique.
The present invention has been made in view of the technical problem described above, and an object of the present invention is to generate a secure random number following a discrete Laplace distribution without performing approximation.
In order to achieve the above-described object, a secure random number generation system according to one aspect of the invention includes a plurality of secure computation apparatuses and generates a concealed value [r] of a random number r that follows a discrete Laplace distribution with parameter a, wherein, a being a number that is larger than 0 and smaller than 1, and N being an integer of 2 or more, the secure computation apparatus includes: a bit stream generating unit configured to generate a concealed value stream [b0], [b1], . . . , [bN] that is constituted by a concealed value [b0] of a random number bit b0 that follows a Bernoulli distribution with probability (1−α)/(1+α) and concealed values [b1], . . . , [bN] of random number bits b1, . . . , bN that each follow a Bernoulli distribution with probability (1−α); an absolute value determining unit configured to obtain a concealed value [L] of a position L at which 1 is first set from the head of the random number bits b0, b1, . . . , bN; and a sign determining unit configured to obtain a result [L·s] obtained by multiplying the concealed value [L] by a concealed value [s] of a random sign s, as a concealed value [r] of the random number r.
According to the invention, a secure random number following a discrete Laplace distribution can be generated without performing approximation. By performing mixing of a computation result using this secure random number, the protection strength of output privacy in secure computation can be improved.
First, the existing technologies on which the present invention is premised will be described.
Secure Computation
The secure computation is a technique for performing computation in a state in which numerical values are encrypted or concealed (see NPL 1, for example). In the following, a value obtained by concealing a certain value · is called as a “concealed value”, and is represented by [·]. In the secure computation, an addition [a+b], a subtraction [a−b], and a multiplication [a·b] of concealed values [a] and [b] can be computed. Also, when a and b are truth values (1-bit value), in particular, an exclusive OR [a XOR b], a logical product [a AND b] and a logical sum [a OR b] can be computed.
A method is known for realizing more complex processing by the secure computation utilizing the above properties. Processing, among such processing, that will be used in the present invention will be shown as following.
Prefix logical sum (Prefix-OR)
By using logical sum computation, concealed values ([b1]=[a1], [b2]=[a1 OR a2], . . . , [bn]=[a1 OR a2 OR . . . OR an]) of a bit stream (b1, . . . , bn) can be obtained with respect to concealed values ([a1], . . . , [an]) of a bit stream (a1, . . . , an). Here, with respect to any bit stream (a1, . . . , an) in which ai=1 is first achieved at certain i and a1, . . . , ai−1 before ai are all 0, the bit stream (b1, . . . , bn) satisfies a condition that b1, . . . , bi−1=0 and b1, . . . , bn=1.
Uniform Random Number Generation
According to Reference Literatures 1 and 2, a concealed value [r] of a uniform random number r can be generated without knowing an original random number value r.
Interval Test
According to Reference Literature 3, with respect to a concealed value [a] of a certain value a, a concealed value [b] of a concealed bit obtained by judging whether or not the value a is contained in a certain range I can be obtained. Here, if a∈I, then b=1, and if not, then b=0.
Bernoulli Distribution
The Bernoulli distribution Ber(β) is a distribution for generating 1 with probability β, and 0 with probability 1−β.
Discrete Laplace Distribution
Assume that probability variables B0, B1, . . . that are independently tried satisfy B0˜Ber((1−α)/(1+α)) and Bj≥1˜Ber(1−α). Here, ˜ indicates to follow the distribution. That is, assume that the probability variable Bo follows the Bernoulli distribution with probability (1−α)/(1+α), and the probability variables B1, B2, . . . follow the Bernoulli distribution with probability (1−α). Here, with respect to a position L at which BL=1 is first achieved from the head (that is, L that satisfies B0, . . . , BL−1=0 and BL=1), a value ˜L=L or −L obtained by inverting the sign with probability ½ follows a discrete Laplace distribution DL(α) with parameter α.
Here, an embodiment of the present invention will be described in detail. Note that the same reference numerals are added to constituent units that have the same function, in the drawings, and redundant description will be omitted.
In a secure random number generation system of the embodiment, n (≥2) secure computation apparatuses compute a concealed value of a random value that follows the discrete Laplace distribution in a cooperated manner. In the present embodiment, a secure computation on a finite field Zp with order p is envisioned, but there is no limitation thereto, and the present invention can be similarly applied to a secure computation on another finite field.
A secure random number generation system 100 of the embodiment includes n (≥2) secure computation apparatuses 11, . . . , 1n, as shown in
The secure computation apparatus 1i (i=1, . . . , n) included in the secure random number generation system 100 of the embodiment includes a parameter storage unit 10, a bit stream generating unit 11, an absolute value determining unit 12, a sign determining unit 13, and an output unit 14, as shown in
The secure computation apparatus 1i is a special apparatus that is configured by a special program being read in a known or dedicated computer including a central processing unit (CPU), a main storage device (RAM: Random Access Memory), and the like, for example. The secure computation apparatus 1i executes the processing under the control of the central processing unit, for example. The data input to the secure computation apparatus 1i and the data obtained by the processing are stored in the main storage device, for example, and the data stored in the main storage device is read out to the central processing unit as necessary and is used for another processing. At least some of the processing units of the secure computation apparatus 1i may be configured by hardware such as an integrated circuit. The storage units included in the secure computation apparatus 1i can be configured by a main storage device such as RAM (Random Access Memory), an auxiliary storage device such as a hard disk, an optical disk, or a semiconductor memory device such as a flash memory, or middleware such as a relational database or key-value store, for example.
In the following, the processing procedure of the secure random number generation method to be executed by the secure random number generation system 100 of the embodiment will be described with reference to
The parameter storage unit 10 stores a parameter a of a predetermined discrete Laplace distribution DL(α) and a sufficiently large natural number N. Note that α is a number that is larger than 0 and smaller than 1.
In step S11, the bit stream generating unit 11 generates a stream [b0], [b1], . . . , [bN] of concealed values of random number bits b0, b1, . . . , bN that follow a Bernoulli distribution. Here, assume that the conditions of b0·Ber((1−α)/(1+α)) and b1, . . . , bN˜Ber (1−α) are satisfied. That is, the random number bit bo follows a Bernoulli distribution with probability (1−α)/(1+α), and the random number bits b1, . . . , bN follow a Bernoulli distribution with probability (1−α). The concealed value [bi] (i=0, . . . , N) of a random number bit bi (i=0,0 . . . , N) is generated by executing the following steps S111 to S113 for each integer i.
In step S111, the section setting unit 111 selects a section I=[γ1, γ2] on the finite field Zp such that β≈|I|/p. Here, β is probability of the Bernoulli distribution. That is, if i=0, then β=(1−α)/(1+α), and if i≥1, then β=(1−α). The section setting unit 111 outputs the selected section I to the interval test unit 113.
In step S112, the random number generating unit 112 generates a concealed value [ri] of a random number ri on the finite field Zp. The random number generating unit 112 outputs the generated concealed value [ri] of the random number ri to the interval test unit 113.
In step S113, the interval test unit 113 judges ri∈I by an interval test. That is, a concealed value [b] of a result b that is obtained by judging whether or not the random number ri is included in the section I is generated, using the concealed value [ri] of the random number ri. This judgment result b follows a Bernoulli distribution Ber(β) with probability β. That is, b˜Ber(β) is satisfied. The interval test unit 113 outputs the concealed value [b] of the judgment result b as the concealed value [bi] of the random number bit bi.
In step S12, the absolute value determining unit 12 obtains a concealed value [L] of a position L at which 1 is first set from the head out of the random number bits b0, b1, . . . , bN. The concealed value [L] of the position L can be obtained by executing the following steps 5121 to 5122.
In step 5121, the prefix logical sum unit 121 obtains the result of executing Prefix-OR on a concealed value stream [b0], [b1], . . . , [bN] as a concealed value stream [c0], [c1], . . . , [cN]Specifically, the prefix logical sum unit 121 obtains [c0]=[b0], [c1]=[b0] OR [b1], . . . , [cN]=[b0] OR . . . OR [bN], in which the result of computing [b0] OR . . . OR [bi] for each integer i is the concealed value [ci]. The prefix logical sum unit 121 outputs the concealed value stream [c0], [c1], . . . , [cN] to the bit inversion total sum unit 122.
In step S122, the bit inversion total sum unit 122 computes [L]=Σi(1−[ci]). L indicates the position L at which bL=1 is first achieved from the head, out of the random number bits b0, b1, . . . , bN. The bit inversion total sum unit 122 outputs the computed concealed value [L] of the position L.
In step S13, the sign determining unit 13 obtains a result [L·s] that is a result of multiplying the concealed value [L] of the position L by a concealed value [s] of a random sign s. The multiplication result [L·s] can be obtained by executing the following steps S131 and S132.
In step S131, the sign generating unit 131 generates the concealed value [s] of the random sign s by computing [s]←R{−1, 1}. Here, ←R represents an operation for randomly selecting an element of a set. The sign generating unit 131 outputs the generated concealed value [s] of the sign s to the sign multiplying unit 132.
In step S132, the sign multiplying unit 132 multiplies the concealed value [L] of the position L by the concealed value [s] of the sign s. The concealed value [L·s] of this multiplication result is a concealed value of a random number that follows a discrete Laplace distribution DL(α). The sign multiplying unit 132 outputs the concealed value [L·s] of the multiplication result.
In step S14, the output unit 14 outputs the concealed value [L·s] of the multiplication result as the concealed value [r] of a random number r that follows a discrete Laplace distribution DL(α) with parameter α.
In the present invention, the secure computation of a random number that follows a discrete Laplace distribution is realized by performing secure computation on a random number bit that follows the Bernoulli distribution. Here, in the present invention, as a result of directly generating a random number that follows a discrete Laplace distribution without performing approximation by a geometric distribution, the reduction in privacy protection strength that occurs due to approximation is avoided. In this way, according to the present invention, secure random numbers, which follow the discrete Laplace distribution, that can be used for output privacy protection of secure computation results and the like can be generated without performing approximation. In the known methods, approximation by a geometric distribution was needed.
Although an embodiment of the present invention have been described above, a specific configuration is not limited to the embodiment, and even if a design change or the like is made without departing from the spirit of the present invention, when necessary, such a change is included in the scope of the present invention as a matter of course. The various kinds of processing described in the embodiment are not necessarily executed in chronological order according to the order of descriptions, and may be parallelly or individually executed depending on the processing capabilities of the device that executes the processing or according to the need.
Program and Recording Medium
When the various processing functions of the devices described in the above embodiment are realized using a computer, the functions that the devices need to have are to be described in the form of a program. Then, this program is read in a storage unit 1020 of a computer shown in
The program that describes the contents of such processing can be recorded in a computer-readable recording medium. Any kind of computer-readable recording medium may be employed, such as a magnetic recording device, an optical disc, a magneto-optical recording medium, or a semiconductor memory.
The program is distributed by, for example, selling, transferring, or lending a portable recording medium such as a DVD or a CD-ROM on which the program is recorded. Furthermore, it is possible to employ a configuration in which the program is stored in a storage device of a server computer, and the program is distributed by the server computer transferring the program to other computers via a network.
A computer that executes such a program first stores, in a storage device thereof, the program that is recorded on a portable recording medium or that has been transferred from a server computer. Thereafter, when executing processing, the computer reads the program stored in the storage device thereof, and executes processing according to the program thus read. In another mode of execution of the program, the computer may read the program directly from a portable recording medium and execute processing according to the program. In addition, the computer may sequentially execute processing according to the received program every time the computer receives the program transferred from a server computer. Also, it is possible to employ a configuration for executing the above-described processing by using a so-called ASP (Application Service Provider) type service, which does not transfer a program from the server computer to the computer, but realizes processing functions by only making instructions to execute the program and acquiring the results. The program according to the embodiments may be information that is used by an electronic computer to perform processing, and that is similar to a program (e.g. data that is not a direct command to the computer, but has the property of defining computer processing).
Also, although the device is formed by running a predetermined program on a computer in the embodiment, at least part of the content of the above processing may be realized using hardware.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2019/049882 | 12/19/2019 | WO |
