Secure sum-of-product computation method, secure sum-of-product computation system, computation apparatus and programs therefor

TECHNICAL FIELD

The present invention relates to a secure sum-of-product computation method, a secure sum-of-product computation system, a computation apparatus and programs therefor for performing data processings, particularly, a multiplication computation and a sum-of-product computation, while concealing data by secret sharing.

BACKGROUND ART

In the field of management and operation of so-called sensitive information, such as customer information and management information, the information to be managed is increasing in variety, and the information processing technology such as cloud computing is changing, so that measures to ensure security and privacy are becoming more important. Recently, the secret sharing art has become popular to prevent leakage of information by distributing the information among plural sites. Besides, a secure functional computation (a multi-party protocol) for deriving a specified computation result without reconstructing the distributed information is also being developed for commercialization. The secret sharing art is effective as a measure to ensure security when storing information but has a risk of leakage of information when using the information, because the information generally needs to be reconstructed for use. In view of the presence of such a risk of leakage of information, the secure functional computation can uses distributed information as operands for computation instead of the original input values and does not need to reconstruct the original input values at all in the computation process. Therefore, the secure functional computation can be said to be an advanced security art that maintains the functionality of the secret sharing art even when the information is used.

A prior art for performing a multiplication while concealing information is a multiplication protocol described in Non-Patent literature 1. A prior art for performing a sum-of-product computation while concealing information is a combination of a multiplication protocol and an addition protocol. These protocols are 3-party secure functional computation protocols that derive a result of an arithmetic/logical operation by cooperative computation by three parties (three computing entities) without reconstructing a shared input value. In the 3-party secure functional computation protocol, data is treated as a natural number smaller than a predetermined prime number p. To conceal data, which will be denoted as “a”, the data a is divided into three fragments in such a manner that the fragments satisfy the following condition.

a=a₀+a₁+a₂mod p

In practice, random numbers a₀and a₁are generated, and a relation holds: a₂=a−a₀−a₁. Then, a random number sequence (a₀, a₁) is transmitted to a party X of the three parties, a random number sequence (a₁, a₂) is transmitted to a party Y of the three parties, and a random number sequence (a₂, a₀) is transmitted to a party Z of the three parties. Since a₁and a₂are random numbers, any of the parties X, Y and Z does not have information about the data a. However, any two of the parties can cooperate to reconstruct the data a.

Since the concealment is an additive distribution, the shared value can be equally reconstructed before or after addition of its fragments because of the interchangeability. That is, the addition and the constant multiplication of the distributed fragments can be achieved without communications. If a multiplication can additionally be performed, a logical circuit can be formed, and any computation can be performed. The multiplication needs communications and random number generation and therefore is a bottleneck of the 3-party secure functional computation.

PRIOR ART LITERATURE
Non-Patent Literature

Non-patent literature 1: Koji Chida, Koki Hamada, Dai Ikarashi, Katsumi Takahashi, “A Three-Party Secure Function Evaluation with Lightweight Verifiability Revisited”, CSS2010, 2010.

SUMMARY OF THE INVENTION
Problems to be Solved by the Invention

In the 3-party secure functional computation, the multiplication and the sum-of-product computation requires communications and random number generation and therefore are a bottleneck in the computation processing.

More specifically, the conventional multiplication protocol requires two rounds of communications. In addition, the computation amounts and the communication amounts of the three parties are not symmetrical to each other, so that a different program needs to be implemented in each party. As a result, the implementation cost increases. In addition, the part where the computation amount and the communication amount are at the maximum constitutes a bottleneck. In addition, the sum-of-product computation generally requires a large amount of communications.

An object of the present invention is to provide a secure sum-of-product computation method, a secure sum-of-product computation system, a computation apparatus and a program therefor that can quickly perform a multiplication and a sum-of-product computation and can be readily implemented.

Means to Solve the Problems

A secure sum-of-product computation method according to the present invention is a secure sum-of-product computation method used for performing a sum-of-product computation of data strings A₀=(a0₀, . . . , a0_na0-1), A₁=(a1₀, . . . , a1_na1-1) and A₂=(a2₀, . . . , a2_na2-1) and data strings B₀=(b0₀, . . . , b0_nb0-1), B₁=(b1₀, . . . , b1_nb1-1) and B₂=(b2₀, . . . , b2_nb2-1) by cooperative computation by three computation apparatuses, which are a party X, a party Y and a party Z, the sum-of-product computation being expressed as

$\begin{matrix} \sum_{i 0, j 0} (e 00_{i 0, j 0} \cdot a 0_{i 0} \cdot b 0_{j 0}) + \sum_{i 0, j 1} (e 01_{i 0, j 0} \cdot a 0_{i 0} \cdot b 1_{j 1}) + \sum_{i 1, j 0} (e 10_{i 1, j 0} \cdot a 1_{i 1} \cdot b 0_{j 0}) + \sum_{i 1, j 1} (e 11_{i 1, j 1} \cdot a 1_{i 1} \cdot b 1_{j 1}) + \sum_{i 1, j 2} (e 12_{i 1, j 2} \cdot a 1_{i 1} \cdot b 2_{j 2}) + \sum_{i 2, j 1} (e 21_{i 2, j 1} \cdot a 2_{i 2} \cdot b 1_{j 1}) + \sum_{i 2, j 2} (e 22_{i 2, j 2} \cdot a 2_{i 2} \cdot b 2_{j 2}) + \sum_{i 2, j 0} (e 20_{i 2, j 0} \cdot a 2_{i 2} \cdot b 0_{j 0}) + \sum_{i 0, j 2} (e 02_{i 0, j 2} \cdot a 0_{i 0} \cdot b 2_{j 2}) & [FORMULA 1] \end{matrix}$

(i0=0, . . . , na0-1, i1=0, . . . , na1-1, i2=0, . . . , na2-1, j0=0, . . . , nb0-1, j1=0, . . . , nb1-1, and j2=0, . . . , nb2-1, na0, na1, na2, nb0, nb1 and nb2 represent natural numbers), and comprises a party-X random number generation step, a party-X first computation step, a party-X second computation step, a party-Y random number generation step, a party-Y first computation step, a party-Y second computation step, a party-Z random number generation step, a party-Z first computation step and a party-Z second computation step.

In the processing, the data strings A₀, A₁, B₀and B₁are input to the party X, the data strings A₁, A₂, B₁and B₂are input to the party Y, and the data strings A₂, A₀, B₂and B₀are input to the party Z.

In the party-X random number generation step, the party X generates a number rx and transmits the number to the party Y.

In the party-X first computation step, the party X computes a value c_Xaccording to

$\begin{matrix} c_{X} = \sum_{i 0, j 1} (e 01_{i 0, j 1} \cdot a 0_{i 0} \cdot b 1_{j 1}) + \sum_{i 1, j 0} (e 10_{i 1, j 0} \cdot a 1_{i 1} \cdot b 0_{j 0}) + r_{X} & [FORMULA 2] \end{matrix}$

(e01_i0,j1and e10_i1,j0represent any numbers) and transmits the value to the party Z.

In the party-X second computation step, the party X receives a number r_Zfrom the party Z and a value c_Yfrom the party Y, computes values c₀and c₁according to

$\begin{matrix} c_{0} = \sum_{i 0, j 0} (e 00_{i 0, j 0} \cdot a 0_{i 0} \cdot b 0_{j 0}) + c_{X} - r_{Z} c_{1} = \sum_{i 1, j 1} (e 11_{i 1, j 1} \cdot a 1_{i 1} \cdot b 1_{j 1}) + c_{Y} - r_{X} & [FORMULA 3] \end{matrix}$

(e00_i0,j0and e11_i1,j1represent any numbers) and outputs the values.

In the party-Y random number generation step, the party Y generates a number r_Yand transmits the number to the party Z.

In the party-Y first computation step, the party Y computes the value c_Yaccording to

$\begin{matrix} c_{Y} = \sum_{i 1, j 2} (e 12_{i 1, j 2} \cdot a 1_{i 1} \cdot b 2_{j 2}) + \sum_{i 2, j 1} (e 21_{i 2, j 1} \cdot a 2_{i 2} \cdot b 1_{j 1}) + r_{Y} & [FORMULA 2] \end{matrix}$

(e12_i1,j2and e21_i2,j1represent any numbers) and transmits the value to the party X.

In the party-Y second computation step, the party Y receives the number rx from the party X and a value c_Zfrom the party Z, computes values c₁and c₂according to

$\begin{matrix} c_{1} = \sum_{i 1, j 1} (e 11_{i 1, j 1} \cdot a 1_{i 1} \cdot b 1_{j 1}) + c_{Y} - r_{X} c_{2} = \sum_{i 2, j 2} (e 22_{i 2, j 2} \cdot a 2_{i 2} \cdot b 2_{j 2}) + c_{Z} - r_{Y} & [FORMULA 5] \end{matrix}$

(e22_i2,j2represents any number) and outputs the values.

In the party-Z random number generation step, the party Z generates the number r_Zand transmits the number to the party X.

In the party-Z first computation step, the party Z computes the value c_Zaccording to

$\begin{matrix} c_{Z} = \sum_{i 2, j 0} (e 20_{i 2, j 0} \cdot a 2_{i 2} \cdot b 0_{j 0}) + \sum_{i 0, j 2} (e 02_{i 0, j 2} \cdot a 0_{i 0} \cdot b 2_{j 2}) + r_{Z} & [FORMULA 2] \end{matrix}$

(e20_i2,j0and e02_i0,j2represent any numbers) and transmits the value to the party Y.

In the party-Z second computation step, the party Z receives the number r_Yfrom the party Y and the value c_Xfrom the party X, computes the values c₀and c₂according to

Effects of the Invention

The secure sum-of-product computation methods, the secure sum-of-product computation systems, the computation apparatuses and the programs therefor according to the present invention can quickly perform a multiplication and a sum-of-product computation, and the programs can be readily implemented because the processings performed by the parties are symmetrical to each other.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagram showing an example of a configuration of a secure sum-of-product computation system 100;

FIG. 2 is a diagram showing an example of a flow of a processing performed by the secure sum-of-product computation system 100;

FIG. 3 is a diagram showing an example of an internal configuration of each party of the secure sum-of-product computation systems 100 and 200;

FIG. 4 is a diagram showing an example of a configuration of a secure sum-of-product computation system 200;

FIG. 5 is a diagram showing an example of a flow of a processing performed by the secure sum-of-product computation system 200;

FIG. 6 is a diagram showing an example of a configuration of a secure sum-of-product computation system 300;

FIG. 7 is a diagram showing an example of a flow of a processing performed by the secure sum-of-product computation system 300;

FIG. 8 is a diagram showing an example of an internal configuration of each party of the secure sum-of-product computation systems 300, 400 and 500;

FIG. 9 is a diagram showing an example of a configuration of secure sum-of-product computation systems 400 and 500;

FIG. 10 is a diagram showing an example of a flow of a processing performed by the secure sum-of-product computation systems 400 and 500;

FIG. 11 is a diagram showing an example of a configuration of a secure sum-of-product computation system 600;

FIG. 12 is a diagram showing an example of a flow of a processing performed by the secure sum-of-product computation system 600;

FIG. 13 is a diagram showing an example of an internal configuration of each party of the secure sum-of-product computation systems 600, 700 and 800;

FIG. 14 is a diagram showing an example of a configuration of secure sum-of-product computation systems 700 and 800;

FIG. 15 is a diagram showing an example of a flow of a processing performed by the secure sum-of-product computation systems 700 and 800;

FIG. 16 is a diagram showing an example of a configuration of secure sum-of-product computation system 900, 910 and 920; and

FIG. 17 is a diagram showing an example of a flow of a processing performed by the secure sum-of-product computation system 900, 910 and 920.

DETAILED DESCRIPTION OF THE EMBODIMENTS

In the following, embodiments of the present invention will be described in detail.

First Embodiment

FIG. 1 shows an example of a configuration of a secure sum-of-product computation system 100, and FIG. 2 shows an example of a flow of a processing performed by the secure sum-of-product computation system 100. The secure sum-of-product computation system 100 comprises a party X, a party Y and a party Z, which are computation apparatuses that perform symmetric computation processings.

A secure sum-of-product computation according to the present invention is achieved by the three computation apparatuses, the parties X, Y and Z, cooperating to perform sum-of-product computations of data strings A₀=(a0₀, . . . , a0_na0-1), A1=(a1₀, . . . , a1_na1-1) and A₂=(a2₀, . . . , a2_na2-1) and data strings B₀=(b0₀, . . . , b0_nb0-1), B₁=(b1₀, . . . , b1_nb1-1) and B₂=(b2₀, . . . , b2_nb2-1). Note that na0, na1, na2, nb0, nb1 and nb2 represent natural numbers.

As shown in FIG. 3, each party has random number generation means 101, first computation means 102 and second computation means 103. In FIG. 3, a subject party is denoted as P, and other parties are denoted as P₋ and P₊. Specifically, when the subject party is the party X, another party P₋ is the party Z, and the remaining party P₊ is the party Y. When the subject party is the party Y, another party P₋ is the party X, and the remaining party P₊ is the party Z. When the subject party is the party Z, another party P₋ is the party Y, and the remaining party P₊ is the party X. In this specification, the relationship between the subject party P and the other parties P₋ and P₊ that does not change depending on which of the parties serves as the subject party P is expressed as “symmetric (symmetrical)”. And a processing performed by the parties in such a relationship is referred to as a “symmetric processing” or expressed as “symmetric (symmetrical)”.

In the following, details of a cooperative computation processing performed by each party will be specifically described. First, data strings A₀, A₁, B₀and B₁are input to the party X, data strings A₁, A₂, B₁and B₂are input to the party Y, and data strings A₂, A₀, B₂and B₀are input to the party Z (S1).

Then, the party X performs the following processing. The random number generation means 101 first generates a random number r_Xand transmits the random number to the party Y (S2-1). Then, the first computation means 102 computes a value c_Xaccording to

$\begin{matrix} c_{X} = \sum_{i 0, j 1} (e 01_{i 0, j 1} \cdot a 0_{i 0} \cdot b 1_{j 1}) + \sum_{i 1, j 0} (e 10_{i 1, j 0} \cdot a 1_{i 1} \cdot b 0_{j 0}) + r_{X} & [FORMULA 8] \end{matrix}$

and transmits the value c_Xto the party Z (S2-2). Note that i0=0, . . . , na0-1, i1=0, . . . , na1-1, j0=0, . . . , nb0-1, j1=0, . . . , nb1-1, and e01_i0,j1and e10_i1,j0each represent any number. The second computation means 103 receives a random number r_Zfrom the party Z and a value c_Yfrom the party Y and computes values c₀and c₁according to

$\begin{matrix} c_{0} = \sum_{i 0, j 0} (e 00_{i 0, j 0} \cdot a 0_{i 0} \cdot b 0_{j 0}) + c_{X} - r_{Z} c_{1} = \sum_{i 1, j 1} (e 11_{i 1, j 1} \cdot a 1_{i 1} \cdot b 1_{j 1}) + c_{Y} - r_{X} & [FORMULA 9] \end{matrix}$

and outputs the values c₀and c₁(S3). Note that e00_i0,j0and e11_i1,j1each represent any number.

The party Y performs the following processing. The random number generation means 101 first generates a random number r_Yand transmits the random number to the party Z (S4-1). Then, the first computation means 102 computes the value c_Yaccording to

$\begin{matrix} c_{Y} = \sum_{i 1, j 2} (e 12_{i 1, j 2} \cdot a 1_{i 1} \cdot b 2_{j 2}) + \sum_{i 2, j 1} (e 21_{i 2, j 1} \cdot a 2_{i 2} \cdot b 1_{j 1}) + r_{Y} & [FORMULA 10] \end{matrix}$

and transmits the value c_Yto the party X (S4-2). Note that i2=0, . . . , na2-1, j2=0, . . . , nb2-1, and e12_i1,j2and e21_i2,j1each represent any number. The second computation means 103 receives the random number r_Xfrom the party X and a value c_Zfrom the party Z and computes values c₁and c₂according to

$\begin{matrix} c_{1} = \sum_{i 1, j 1} (e 11_{i 1, j 1} \cdot a 1_{i 1} \cdot b 1_{j 1}) + c_{Y} - r_{X} c_{2} = \sum_{i 2, j 2} (e 22_{i 2, j 2} \cdot a 2_{i 2} \cdot b 2_{j 2}) + c_{Z} - r_{Y} & [FORMULA 11] \end{matrix}$

and outputs the values c₁and c₂(S5). Note that e22_i2,j2represents any number.

The party Z performs the following processing. The random number generation means 101 first generates the random number r_Zand transmits the random number to the party X (S6-1). Then, the first computation means 102 computes the value c_Zaccording to

$\begin{matrix} c_{Z} = \sum_{i 2, j 0} (e 20_{i 2, j 0} \cdot a 2_{i 2} \cdot b 0_{j 0}) + \sum_{i 0, j 2} (e 02_{i 0, j 2} \cdot a 0_{i 0} \cdot b 2_{j 2}) + r_{Z} & [FORMULA 12] \end{matrix}$

and transmits the value c_Zto the party Y (S6-2). Note that e20_i2,j0and e02_i0,j2represent any numbers. The second computation means 103 receives the random number r_Yfrom the party Y and the value c_Xfrom the party X and computes values c₀and c₂according to

$\begin{matrix} c_{0} = \sum_{i 0, j 0} (e 00_{i 0, j 0} \cdot a 0_{i 0} \cdot b 0_{j 0}) + c_{X} - r_{Z} c_{2} = \sum_{i 2, j 2} (e 22_{i 2, j 2} \cdot a 2_{i 2} \cdot b 2_{j 2}) + c_{Z} - r_{Y} & [FORMULA 13] \end{matrix}$

and outputs the values c₀and c₂(S7). Note that the series of steps S2-1 and S2-2, the series of steps S4-1 and S4-2 and the series of steps S6-1 and S6-2 can be performed in parallel, and the steps S3, S5 and S7 can also be performed in parallel.

Then, the total sum of the values c₀, c₁, and c₂output from the parties X, Y and Z can be computed to obtain a sum-of-product computation result as expressed by the following formula.

$\begin{matrix} c_{0} + c_{1} + c_{2} = \sum_{i 0, j 0} (e 00_{i 0, j 0} \cdot a 0_{i 0} \cdot b 0_{j 0}) + \sum_{i 0, j 1} (e 01_{i 0, j 0} \cdot a 0_{i 0} \cdot b 1_{j 1}) + \sum_{i 1, j 0} (e 10_{i 1, j 0} \cdot a 1_{i 1} \cdot b 0_{j 0}) + \sum_{i 1, j 1} (e 11_{i 1, j 1} \cdot a 1_{i 1} \cdot b 1_{j 1}) + \sum_{i 1, j 2} (e 12_{i 1, j 2} \cdot a 1_{i 1} \cdot b 2_{j 2}) + \sum_{i 2, j 1} (e 21_{i 2, j 1} \cdot a 2_{i 2} \cdot b 1_{j 1}) + \sum_{i 2, j 2} (e 22_{i 2, j 2} \cdot a 2_{i 2} \cdot b 2_{j 2}) + \sum_{i 2, j 0} (e 20_{i 2, j 0} \cdot a 2_{i 2} \cdot b 0_{j 0}) + \sum_{i 0, j 2} (e 02_{i 0, j 2} \cdot a 0_{i 0} \cdot b 2_{j 2}) & [FORMULA 14] \end{matrix}$

In the processing described above, hash values or other values can be substituted for the random numbers.

The effect of the method according to the present invention will be compared with that of the method described in Non-Patent literature 1. Most of the computations in Non-Patent literature 1 are involved with random number generation and encryption and decryption for communications in the case where no physical secure channels are available. The amount of computations for encryption and decryption agrees with the amount of communications, so that the efficiency can be evaluated by observing the number of random numbers generated and the amount of communications.

In the case where an addition is performed after repeatedly performing multiplications as described in Non-Patent literature 1, the number of random numbers generated and the amount of communications are proportional to the number of elements of the input data strings. In the method according to the present invention, the parties X, Y and Z each generate only one random number and transmit only two pieces of data to the other parties. In addition, the processings performed by the parties X, Y and Z are symmetrical to each other, so that common programs can be implemented in all the parties, and the implementation cost can be reduced.

Second Embodiment

A second embodiment is a specific example of the first embodiment, in which na0=na1=na2=nb0=nb1=nb2=n (n represents an integer equal to or greater than 1), and e00=e01=e10=e11=e12=e21=e22=e20=e02=1. FIG. 4 shows an example of a configuration of a secure sum-of-product computation system 200 according to this embodiment, and FIG. 5 shows an example of a flow of a processing performed by the secure sum-of-product computation system 200. The secure sum-of-product computation system 200 comprises a party X, a party Y, a party Z, a data string decomposition and supply part 210 and an output part 220. Each party has random number generation means 101, first computation means 102 and second computation means 103 as in the first embodiment as shown in FIG. 3.

The secure sum-of-product computation system 200 performs a sum-of-product computation

$\begin{matrix} \overset{n - 1}{\sum_{i}} a_{i} \cdot b_{i} & [FORMULA 15] \end{matrix}$

for two data strings A=(a₀, . . . , a_n-1) and B=(b₀, . . . , b_n-1) comprising elements a_iand b_i(i=0, . . . , n−1), which are natural numbers smaller than a prime number p while concealing the contents of the data strings through cooperative computation by the three computation apparatuses, the parties X, Y and Z (the sum-of-product computation is a multiplication of a and b in the case where n=1).

Specifically, the data string decomposition and supply part 210 decomposes the input data strings A and B in such a manner that each element a_iand b_isatisfy conditional formulas a_i=a0_i+a1_i+a2_imod p and b_i=b0_i+b1_i+b2_imod p (a0_i, a1_i, b0_iand b1_irepresent random numbers, and p represents a prime number) and supplies data strings A₀=(a0₀, . . . , a0_n-1), A₁=(a1₀, . . . , a1_n-1), B₀=(b0₀, . . . , b0_n-1) and B₁=(b1₀, . . . , b1_n-1) to the party X, the data strings A₁, A₂=(a2₀, . . . , a2_n-1), B₁and B₂=(b2₀, . . . , b2_n-1) to the party Y, and data strings A₂, A₀, B₂and B₀to the party Z (S11).

Then, the party X performs the following processing. The random number generation means 101 first generates a random number r_Xand transmits the random number to the party Y (S12-1). Then, the first computation means 102 computes a value c_Xaccording to

$\begin{matrix} c_{X} = \sum_{i} (a 0_{i} \cdot b 1_{i} + a 1_{i} \cdot b 0_{i}) + r_{X} & [FORMULA 16] \end{matrix}$

and transmits the value c_Xto the party Z (S12-2). Then, the second computation means 103 receives a random number r_Zfrom the party Z and a value c_Yfrom the party Y and computes values c₀and c₁according to

$\begin{matrix} c_{0} = \sum_{i} (a 0_{i} \cdot b 0_{i}) + c_{X} - r_{Z} c_{1} = \sum_{i} (a 1_{i} \cdot b 1_{i}) + c_{Y} - r_{X} & [FORMULA 17] \end{matrix}$

and outputs the values c₀and c₁(S13).

The party Y performs the following processing. The random number generation means 101 first generates a random number r_Yand transmits the random number to the party Z (S14-1). Then, the first computation means 102 computes the value c_Yaccording to

$\begin{matrix} c_{Y} = \sum_{i} (a 1_{i} \cdot b 2_{i} + a 2_{i} \cdot b 1_{i}) + r_{Y} & [FORMULA 18] \end{matrix}$

and transmits the value c_Yto the party X (S14-2). Then, the second computation means 103 receives the random number r_Xfrom the party X and a value c_Zfrom the party Z and computes values c₁and c₂according to

$\begin{matrix} c_{1} = \sum_{i} (a 1_{i} \cdot b 1_{i}) + c_{Y} - r_{X} c_{2} = \sum_{i} (a 2_{i} \cdot b 2_{i}) + c_{Z} - r_{Y} & [FORMULA 19] \end{matrix}$

and outputs the values c₁and c₂(S15).

The party Z performs the following processing. The random number generation means 101 first generates the random number r_Zand transmits the random number to the party X (S16-1). Then, the first computation means 102 computes the value c_Zaccording to

$\begin{matrix} c_{Z} = \sum_{i} (a 2_{i} \cdot b 0_{i} + a 0_{i} \cdot b 2_{i}) + r_{Z} & [FORMULA 20] \end{matrix}$

and transmits the value c_Zto the party Y (S16-2). Then, the second computation means 103 receives the random number r_Yfrom the party Y and the value c_Xfrom the party X and computes values c₀and c₂according to

$\begin{matrix} c_{0} = \sum_{i} (a 0_{i} \cdot b 0_{i}) + c_{X} - r_{Z} c_{2} = \sum_{i} (a 2_{i} \cdot b 2_{i}) + c_{Z} - r_{Y} & [FORMULA 21] \end{matrix}$

and outputs the values c₀and c₂(S17). Note that the series of steps S12-1 and S12-2, the series of steps S14-1 and S14-2 and the series of steps S16-1 and S16-2 can be performed in parallel, and the steps S13, S15 and S17 can also be performed in parallel.

Then, the output part 220 computes the total sum (c₀+c₁+c₂) of the values c₀, c₁and c₂output from the parties X, Y and Z and outputs the total sum.

The following relation holds.

$\begin{matrix} \begin{matrix} c_{0} + c_{1} + c_{2} = \sum_{i} (\begin{matrix} a 0_{i} + b 0_{i} + a 0_{i} \cdot b 1_{i} + \\ a 1_{i} \cdot b 0_{i} \end{matrix}) + \\ \sum_{i} (\begin{matrix} a 1_{i} \cdot b 1_{i} + a 1_{i} \cdot b 2_{i} + \\ a 2_{i} \cdot b 1_{i} \end{matrix}) + \\ \sum_{i} (\begin{matrix} a 2_{i} \cdot b 2_{i} + a 2_{i} \cdot b 0_{i} + \\ a 0_{i} \cdot b 2_{i} \end{matrix}) \\ = \sum_{i} (a 0_{i} + a 1_{i} + a 2_{i}) (\begin{matrix} b 0_{i} + b 1_{i} + \\ b 2_{i} \end{matrix}) \\ = \sum_{i} a_{i} \cdot b_{i} \end{matrix} & [FORMULA 22] \end{matrix}$

From the relation above, it can be seen that the sum-of-product computation (a multiplication of a and b in the case where i=1) has been correctly done.

In the processing described above, hash values or other values can be substituted for the random numbers. The data string decomposition and supply part 210 and the output part 220 can be provided in an apparatus other than the parties or provided in any one or more of the apparatuses serving as the parties.

The effect of the method according to the present invention will be compared with that of the method described in Non-Patent literature 1. Concerning the multiplications, in the method described in Non-Patent literature 1, two rounds of communications are required (the term “round” means the number of times that each of the parties X, Y and Z performing parallel processing needs to wait for the other parties to complete their respective processings), and the party X generates one random number and transmits four pieces of data, and the parties Y and Z generate no random number and transmit one piece of data. On the other hand, according to the present invention, one round of communications is required, and all the parties X, Y and Z generate one random number and transmit two pieces of data. That is, the number of rounds is reduced to a half. In addition, the number of random numbers generated and the number of pieces of data transmitted are the same as those in the method described in Non-Patent literature 1, it can be said that the bottleneck is reduced because the processings performed by the parties X, Y and Z are symmetrical to each other.

Concerning the sum-of-product computation, in the case of the method of performing an addition after repeatedly performing multiplications described in Non-Patent literature 1, the number of random numbers generated and the amount of communications are proportional to the number of elements of the input data strings. However, in the case of the method according to the present invention, the parties X, Y and Z each generate only one random number and transmit only two pieces of data to the other parties. Since the processings for any computations performed by the parties X, Y and Z are symmetrical to each other, the implementation cost can be reduced.

Third Embodiment

According to a third embodiment, a misuse detection function is added to the configurations for performing a sum-of-product computation according to the first and second embodiments. FIG. 6 shows an example of a configuration of a secure sum-of-product computation system 300, and FIG. 7 shows an example of a flow of a processing performed by the secure sum-of-product computation system 300. The secure sum-of-product computation system 300 comprises a party X, a party Y and a party Z, which are computation apparatuses that perform symmetric computation processings.

A secure sum-of-product computation according to the present invention is achieved by the three computation apparatuses, the parties X, Y and Z, cooperating to perform a total of m sets of sum-of-product computations of data strings A_q_—₀=(a0_q_—₀, . . . , a0_q_—_na0-1), A_q_—₁=(a1_q_—₀, . . . , a1_q_—_na1-1) and A_q_—₂=(a2_q_—₀, . . . , a2_q_—_na2-1) and B_q_—₀=(b0_q_—₀, . . . , b0_q_—_nb0-1), B_q_—₁=(b1_q_—₀, . . . , b1_q_—_nb1-1) and B_q_—₂=(b2_q_—₀, . . . , b2_q_—_nb2-1) (q=0, . . . , m−1, and m represents an integer equal to or greater than 1) (the sum-of-product computations are performed in parallel in the case where m is equal to or greater than 2). Note that na0, na1, na2, nb0, nb1 and nb2 represent natural numbers.

As shown in FIG. 8, each party has first random number generation means 301, first computation means 302, second computation means 303, second random number generation means 304, third computation means 305, fourth computation means 306 and misuse detection means 307. In FIG. 8, provided that any of the apparatuses described above is a party P, when the party P is the party X, a party P₋ is the party Z, and a party P₊ is the party Y, and subscripts 0p, 1p and 2p correspond to numerals 0, 1 and 2, respectively. When the party P is the party Y, the party P₋ is the party X, and the party P₊ is the party Z, and the subscripts 0p, 1p and 2p correspond to numerals 1, 2 and 0, respectively. When the party P is the party Z, the party P₋ is the party Y, and the party P₊ is the party X, and the subscripts 0p, 1p and 2p correspond to numerals 2, 0 and 1, respectively.

In the following, details of a cooperative computation processing performed by each party will be specifically described. Steps S21 to S27 correspond to the sum-of-product computation processing according to the first embodiment, and steps S28 to S39 are involved in a misuse detection processing. It is assumed that the parties X and Y previously share a random number s_q_—_Z, the parties Y and Z previously share a random number s_q_—_X, and the parties Z and X previously share a random number s_q_—_Y. First, data strings A_q_—₀, A_q_—₁, B_q_—₀and B_q_—₁are input to the party X, data strings A_q_—₁, A_q_—₂, B_q_—₁and B_q_—₂are input to the party Y, and data strings A_q_—₂, A_q_—₀, B_q_—₂and B_q_—₀are input to the party Z (S21).

Then, the party X performs the following processing. The first random number generation means 301 first generates a random number r_q_—_Xand transmits the random number to the party Y (S22-1). Then, the first computation means 302 computes a value c_q_—_Xaccording to

$\begin{matrix} c_{q_X} = \sum_{q_i 0, q_j 1} (e 01_{q_i 0, q_j 1} \cdot a 0_{q_i 0} \cdot b 1_{q_j 1}) + \sum_{q_i 1, q_j 0} (e 10_{q_i 1, q_j 0} \cdot a 1_{q_i 1} \cdot b 0_{q_j 0}) + r_{q_X} & [FORMULA 23] \end{matrix}$

and transmits the value c_q_—_Xto the party Z (S22-2). Note that i0=0, . . . , na0-1, i1=0, . . . , na1-1, j0=0, . . . , nb0-1, and j1=0, . . . , nb1-1, and e01_q_—_i0,q_—_j1and e10_q_—_i1,q_—_j0each represent any number. The second computation means 303 receives a random number r_q_—_Zfrom the party Z and a value c_q_—_Yfrom the party Y and computes values c_q_—₀and c_q_—1according to

$\begin{matrix} c_{q_0} = \sum_{q_i 0, q_j 0} (e 00_{q_i 0, q_j 0} \cdot a 0_{q_i 0} \cdot b 0_{q_j 0}) + c_{q_X} - r_{q_Z} c_{q_1} = \sum_{q_i 1, q_j 1} (e 11_{q_i 1, q_j 1} \cdot a 1_{q_i 1} \cdot b 1_{q_j 1}) + c_{q_Y} - r_{q_X} & [FORMULA 24] \end{matrix}$

and outputs the values c_q_—₀and c_q_—₁(S23). Note that e00_q_—_i0,q_—_j0and e11_q_—_i1,q_—_j1represent any numbers.

The party Y performs the following processing. The random number generation means 301 first generates a random number r_q_—_Yand transmits the random number to the party Z (S24-1). Then, the first computation means 302 computes the value c_q_—_Yaccording to

$\begin{matrix} c_{q_Y} = \sum_{q_i 1, q_j 2} (e 12_{q_i 1, q_j 2} \cdot a 1_{q_i 1} \cdot b 2_{q_j 2}) + \sum_{q_i 2, q_j 1} (e 21_{q_i 2, q_j 1} \cdot a 2_{q_i 2} \cdot b 1_{q_j 1}) + r_{q_Y} & [FORMULA 25] \end{matrix}$

and transmits the value c_q_—_Yto the party X (S24-2). Note that i2=0, . . . , na2-1 and j2=0, . . . , nb2-1, and e12_q_—_i1,q_—_j2and e21_q_—_i2,q_—_j1represent any numbers. The second computation means 303 receives the random number r_q_—_Xfrom the party X and a value c_q_—_Zfrom the party Z and computes values c_q_—₁and c_q_—₂according to the following formula (S25).

$\begin{matrix} c_{q_1} = \sum_{q_i 1, q_j 1} (e 11_{q_i 1, q_j 1} \cdot a 1_{q_i 1} \cdot b 1_{q_j 1}) + c_{q_Y} - r_{q_X} c_{q_2} = \sum_{q_i 2, q_j 2} (e 22_{q_i 2, q_j 2} \cdot a 2_{q_i 2} \cdot b 2_{q_j 2}) + c_{q_Z} - r_{q_Y} & [FORMULA 26] \end{matrix}$

Note that e22_q_—_i2,q_—_j2represents any number.

The party Z performs the following processing. The random number generation means 301 first generates the random number r_q_—_Zand transmits the random number to the party X (S26-1). Then, the first computation means 302 computes the value c_q_—_Zaccording to

$\begin{matrix} c_{q_Z} = \sum_{q_i 2, q_j 0} (e 20_{q_i 2, q_j 0} \cdot a 2_{q_i 2} \cdot b 0_{q_j 0}) + \sum_{q_i 0, q_j 2} (e 02_{q_i 0, q_j 2} \cdot a 2_{q_i 2} \cdot b 0_{q_i 0}) + r_{q_Z} & [FORMULA 27] \end{matrix}$

and transmits the value c_q_—_Zto the party Y (S26-2). Note that e20_q_—_i2,q_—_j0and e02_q_—_i0,q_—_j2represent any multipliers. The second computation means 303 receives the random number r_q_—_Yfrom the party Y and the value c_q_—_Xfrom the party X and computes values c_q_—₀and c_q_—₂according to the following formula (S27).

$\begin{matrix} c_{q_0} = \sum_{q_i 0, q_j 0} (e 00_{q_i 0, q_j 0} \cdot a 0_{q_i 0} \cdot b 0_{q_j 0}) + c_{q_X} - r_{q_Z} c_{q_2} = \sum_{q_i 2, q_j 2} (e 22_{q_i 2, q_j 2} \cdot a 2_{q_i 2} \cdot b 2_{q_j 2}) + c_{q_Z} - r_{q_Y} & [FORMULA 28] \end{matrix}$

Note that the series of steps S22-1 and S22-2, the series of steps S24-1 and S24-2 and the series of steps S26-1 and S26-2 can be performed in parallel, and the steps S23, S25 and S27 can also be performed in parallel.

Following the steps S21 to S27, each party performs a misuse detection processing as described below.

A processing performed by the party X will be described. First, the second random number generation means 304 generates a random number sequence (αY1_q_—₀, . . . , αY1_q_—_na1-1) and a random number ρ_Xand transmits the random number sequence and the random number to the party Y, and generates a random number sequence (αZ0_q_—₀, . . . , αZ0_q_—_na0-1) and transmits the random number sequence to the party Z (S28). Then, the third computation means 305 computes a random number sequence (αZ0_q_—₀−s_q_—_Z·a0_q_—₀, . . . , αZ0_q_—_na0-1−s_q_—_Z·a0_q_—_na0-1), transmits the random number sequence to the party Y, receives a random number sequence (αX1_q_—₀, . . . , αX1_q_—_na1-1) from the party Y and a random number sequence (αX0_q_—₀, . . . , αX0_q_—_na0-1) from the party Z, computes a random number sequence (αY1_q_—₀−s_q_—_Y·a1_q_—₀, . . . , αY1_q_—_na1-1−s_q_—_Y·a1_q_—_na1-1) and a value γ_Xaccording to

$\begin{matrix} γ_{X} = \sum_{i 0, j 1, q} (e 01_{q_i 0, q_j 1} \cdot α X 0_{q_i 0} \cdot b 1_{q_j 1}) + \sum_{i 1, j 0, q} (e 10_{q_i 1, q_j 0} \cdot α X 1_{q_j 1} \cdot b 0_{q_j 0}) + ρ_{X} & [FORMULA 29] \end{matrix}$

and transmits the random number sequence and the value to the party Z (S29). Then, the fourth computation means 306 receives a random number sequence (αZ2_q_—₀−s_q_—_Z·a2_q_—₀, . . . , αZ2_q_—_na2-1−s_q_—_Z·a2_q_—_na2-1) from the party Y and a value ρ_Zfrom the party Z, computes a value

$\begin{matrix} γ_{Z}^{'} = \sum_{i 2, j 0, q} {e 20_{q_i 2, q_j 0} \cdot (α Z 2_{q_i 2} - s_{q_Z} \cdot a 2_{q_i 2}) \cdot b 0_{q_j 0} - s_{q_Z} \cdot r_{q_Z}} + ρ_{Z} & [FORMULA 30] \end{matrix}$

and transmits the value to the party Y (S30). Then, the misuse detection means 307 receives a value γ_Yfrom the party Y, a value γ′_Yand a random number sequence (αY2_q_—₀−s_q_—_Y·a2_q_—₀, . . . , αY2_q_—_na2-1−s_q_—_Y·a2_q_—_na2-1) from the party Z, computes

$\begin{matrix} \sum_{i 2, j 1, q} {e 21_{q_i 2, q_j 1} \cdot (α Y 2_{q_i 2} - s_{q_Y} \cdot a 2_{q_i 2}) \cdot b 1_{q_j 1} + s_{q_Y} \cdot c_{q_Y}} - γ_{Y} + γ_{Y}^{'}, & [FORMULA 31] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₀and c_q_—₁if the computation result is 0 (S31).

Next, a processing performed by the party Y will be described. First, the second random number generation means 304 generates a random number sequence (αZ2_q_—₀, . . . , αZ2_q_—_na2-1) and a random number ρ_Yand transmits the random number sequence and the random number to the party Z, and generates a random number sequence (αX1_q_—₀, . . . , αX1_q_—_na1-1) and transmits the random number sequence to the party X (S32). Then, the third computation means 305 computes a random number sequence (αX1_q_—₀−s_q_—_X·a1_q_—₀, . . . , αX1_q_—_na1-1−s_q_—_X·a1_q_—_na1-1), transmits the random number sequence to the party Z, receives a random number sequence (αY1_q_—₀, . . . , αY1_q_—_na1-1) from the party X and a random number sequence (αY2_q_—₀, . . . , αY2_q_—_na2-1) from the party Z, computes a random number sequence (αZ2_q_—₀−s_q_—_Z·a2_q_—₀, . . . , αZ2_q_—_na2-1−s_q_—_Z·a2_q_—_na2-1) and a value

$\begin{matrix} γ_{Y} = \sum_{i 1, j 2, q} (e 12_{q_i 1, q_j 2} \cdot α Y 1_{q_i 1} \cdot b 2_{q_j 2}) + \sum_{i 2, j 1, q} (e 21_{q_i 2, q_j 1} \cdot α Y 2_{q_i 2} \cdot b 1_{q_j 1}) + ρ_{Y} & [FORMULA 32] \end{matrix}$

and transmits the random number sequence and the value to the party X (S33). Then, the fourth computation means 306 receives the random number ρ_Xfrom the party X and a random number sequence (αX0_q_—₀−s_q_—_X·a0_q_—₀, . . . , αX0_q_—_na0-1−s_q_—_X·a0_q_—_na0-1) from the party Z, computes a value

$\begin{matrix} γ_{X}^{'} = \sum_{i 0, j 1, q} {e 01_{q_i 0, q_j 1} \cdot (α X 0_{q_i 0} - s_{q_X} \cdot a 0_{q_i 0}) \cdot b 1_{q_j 1} - s_{q_X} \cdot r_{q_X}} + ρ_{X} & [FORMULA 33] \end{matrix}$

and transmits the value to the party Z (S34). Then, the misuse detection means 307 receives a value γ′_Zand a random number sequence (αZ0_q_—₀−s_q_—_Z·a0_q_—₀, . . . , αZ0_q_—_na0-1−s_q_—_Z·a0_q_—_na0-1) from the party X and a value γ_Zfrom the party Z, computes

$\begin{matrix} \sum_{i 0, j 2, q} {e 02_{q_i 0, q_j 2} \cdot (α Z 0_{q_i 0} - s_{q_Z} \cdot a 0_{q_i 0}) \cdot b 2_{q_j 2} + s_{q_Z} \cdot c_{q_Z}} - γ_{Z} + γ_{Z}^{'}, & [FORMULA 34] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₁and c_q_—₂if the computation result is 0 (S35).

Next, a processing performed by the party Z will be described. First, the second random number generation means 304 generates a random number sequence (αX0_q_—₀, . . . , αX0_q_—_na0-1) and a random number ρ_Zand transmits the random number sequence and the random number to the party X, and generates a random number sequence (αY2_q_—₀, . . . , αY2_q_—_na2-1) and transmits the random number sequence to the party Y (S36). Then, the third computation means 305 computes a random number sequence (αY2_q_—₀−s_q_—_Y·a2_q_—₀, . . . , αY2_q_—_na2-1−s_q_—_Y·a2_q_—_na2-1), transmits the random number sequence to the party X, receives a random number sequence (αZ0_q_—₀, . . . , αZ0_q_—_na0-1) from the party X and a random number sequence (αZ2_q_—₀, . . . , αZ2_q_—_na2-1) from the party Y, computes a random number sequence (αX0_q_—₀−s_q_—_X·a0_q_—₀, . . . , αX0_q_—_na0-1−s_q_—_X·a0_q_—_na0-1) and a value γ_Zaccording to

$\begin{matrix} γ_{Z} = \sum_{i 2, j 0, q} (e 20_{q_i 2, q_j 0} \cdot α Z 2_{q_i 2} \cdot b 0_{q_j 0}) + \sum_{i 0, j 2, q} (e 02_{q_i 0, q_j 2} \cdot α Z 0_{q_i 0} \cdot b 2_{q_j 2}) + ρ_{Z} & [FORMULA 35] \end{matrix}$

and transmits the random number sequence and the value to the party Y (S37). Then, the fourth computation means 306 receives a random number sequence (αY1_q_—₀−s_q_—_Y·a1_q_—₀, . . . , αY1_q_—_na1-1−s_q_—_Y·a1_q_—_na1-1) from the party X and a value ρ_Yfrom the party Y, computes a value γ′_Yaccording to

$\begin{matrix} γ_{Y}^{'} = \sum_{i 1, j 2, q} {e 12_{q_i 1, q_j 2} \cdot (α Y 1_{q_i 1} - s_{q_Y} \cdot a 1_{q_i 1}) \cdot b 2_{q_j 2} - s_{q_Y} \cdot r_{q_Y}} + ρ_{Y} & [FORMULA 36] \end{matrix}$

and transmits the value to the party X (S38). Then, the misuse detection means 307 receives the value γ_Xfrom the party X and the value γ′_Xand a random number sequence (αX1_q_—₀−s_q_—_X·a1_q_—₀, . . . , αX1_q_—_na1-1−s_q_—_X·a1_q_—_na1-1) from the party Y, computes

$\begin{matrix} \sum_{i 1, j 0, q} {e 10_{q_i 1, q_j 0} \cdot (α X 1_{q_i 1} - s_{q_X} \cdot a 1_{q_i 1}) \cdot b 0_{q_j 0} + s_{q_X} \cdot c_{q_X}} - γ_{X} + γ_{X}^{'}, & [FORMULA 37] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₂and c_q_—₀if the computation result is 0 (S39).

If no misuse detection occurs, the total sum of the values c_q_—₀, c_q_—₁and c_q_—₂output from the parties X, Y and Z can be computed to obtain a sum-of-product computation result as expressed by the following formula.

$\begin{matrix} c_{q_0} + c_{q_1} + c_{q_2} = \sum_{q_i 0, q_j 0} (e 00_{q_i 0, q_j 0} \cdot a 0_{q_i 0} \cdot b 0_{q_j 0}) + \sum_{q_i 0, q_j 1} (e 01_{q_i 0, q_j 1} \cdot a 0_{q_i 0} \cdot b 1_{q_j 1}) + \sum_{q_i 1, q_j 0} (e 10_{q_i 1, q_j 0} \cdot a 1_{q_i 1} \cdot b 0_{q_j 0}) + \sum_{q_i 1, q_j 1} (e 11_{q_i 1, q_j 1} \cdot a 1_{q_i 1} \cdot b 1_{q_j 1}) + \sum_{q_i 1, q_j 2} (e 12_{q_i 1, q_j 2} \cdot a 1_{q_i 1} \cdot b 2_{q_j 2}) + \sum_{q_i 2, q_j 1} (e 21_{q_i 2, q_j 1} \cdot a 2_{q_i 2} \cdot b 1_{q_j 1}) + \sum_{q_i 2, q_j 2} (e 22_{q_i 2, q_j 2} \cdot a 2_{q_i 2} \cdot b 2_{q_j 2}) + \sum_{q_i 2, q_j 0} (e 20_{q_i 2, q_j 0} \cdot a 2_{q_i 2} \cdot b 0_{q_j 0}) + \sum_{q_i 0, q_j 2} (e 02_{q_i 0, q_j 2} \cdot a 2_{q_i 2} \cdot b 0_{q_i 0}) & [FORMULA 38] \end{matrix}$

In the processing described above, hash values or other values can be substituted for the random numbers.

The misuse detection according to the present invention is performed once for one multiplication, one sum-of-product computation or a set of multiplications or sum-of-product computations performed in parallel. The values αP₊0_q_—_i0, αP₊1_q_—_i1and αP₊2_q_—_i2(q=0, . . . , m−1) included in the value γ_P+ transmitted by the party P₊ involved with the misuse detection function are fragments of the respective values a_q_—_imultiplied by different random numbers. Thus, if any of the values is not correct, the party P₊ cannot predict the random numbers. Therefore, if the modulo is a prime number p, the probability that any misuse can be made agree with the misuse in the sum-of-product computation processing is only 1/(p−1).

Fourth Embodiment

A fourth embodiment is a specific example of the third embodiment, in which na0=na1=na2=nb0=nb1=nb2=n (n represents an integer equal to or greater than 1), and e00=e01=e10=e11=e12=e21=e22=e20=e02=1. FIG. 9 shows an example of a configuration of a secure sum-of-product computation system 400 according to this embodiment, and FIG. 10 shows an example of a flow of a processing performed by the secure sum-of-product computation system 400. The secure sum-of-product computation system 400 comprises a party X, a party Y, a party Z, a data string decomposition and supply part 410 and an output part 420. As in the third embodiment, each party has first random number generation means 301, first computation means 302, second computation means 303, second random number generation means 304, third computation means 305, fourth computation means 306 and misuse detection means 307.

The secure sum-of-product computation system 400 performs a sum-of-product computation

$\begin{matrix} \sum_{i = 0}^{n - 1} a_{q_i} \cdot b_{q_i} & [FORMULA 39] \end{matrix}$

for m sets of data strings A_q=(a_q_—₀, . . . , a_q_—_n-1) and B_q=(b_q_—₀, . . . , b_q_—_n-1) (m represents an integer equal to or greater than 1, and q=0, . . . , m−1) comprising elements a_q_—_iand b_q_—_i(i=0, . . . , n−1 (n represents an integer equal to or greater than 1)), which are natural numbers smaller than a prime number p, through cooperative computation by the three computation apparatuses, the parties X, Y and Z (the sum-of-product computation is a multiplication of a and b in the case where n=1). As in the third embodiment, it is assumed that the parties X and Y previously share a random number s_q_—_Z, the parties Y and Z previously share a random number s_q_—_X, and the parties Z and X previously share a random number s_q_—_Y.

Specifically, the data string decomposition and supply part 410 first decomposes the m sets of input data strings A_qand B_qin such a manner that each element a_q_—_iand b_q_—_isatisfy conditional formulas a_q_—_i=a0_q_—_i+a1_q_—_i+a2_q_—_imod p and b_q_—_i=b0_q_—_i+b1_q_—_i+b2_q_—_imod p (a0_q_—_i, a1_q_—_i, b0_q_—_iand b1_q_—_irepresent random numbers, and p represents a prime number) and supplies data strings A_q_—₀=(a0_q_—₀, . . . , a0_q_—_n-1), A_q_—₁=(a1_q_—₀, . . . , a1_q_—_n-1), B_q_—₀=(b0_q_—₀, . . . , b0_q_—_n-1) and B_q_—₁=(b1_q_—₀, . . . , b1_q_—_n-1) to the party X, the data strings A_q_—₁, A_q_—₂=(a2_q_—₀, . . . , a2_q_—_n-1), B_q_—₁and B_q_—₂=(b2_q_—₀, . . . , b2_q_—_n-1) to the party Y, and data strings A_q_—₂, A_q_—₀, B_q_—₂and B_q_—₀to the party Z (S41).

Then, the party X performs the following processing. The first random number generation means 301 first generates a random number r_q_—_Xand transmits the random number to the party Y (S42-1). Then, the first computation means 302 computes a value c_q_—_Xaccording to

$\begin{matrix} c_{q_X} = \sum_{i} (a 0_{q_i} \cdot b 1_{q_i} + a 1_{q_i} \cdot b 0_{q_i}) + r_{q_X} & [FORMULA 40] \end{matrix}$

and transmits the value c_q_—_Xto the party Z (S42-2). Then, the second computation means 303 receives a random number r_q_—_Zfrom the party Z and a value c_q_—_Yfrom the party Y and computes values c_q_—₀and c_q_—₁according to the following formula (S43).

$\begin{matrix} c_{q_0} = \sum_{i} (a 0_{q_i} \cdot b 0_{q_i}) + c_{q_X} - r_{q_Z} c_{q_1} = \sum_{i} (a 1_{q_i} \cdot b 1_{q_i}) + c_{q_Y} - r_{q_X} & [FORMULA 41] \end{matrix}$

The party Y performs the following processing. The first random number generation means 301 first generates a random number r_q_—_Yand transmits the random number to the party Z (S44-1). Then, the first computation means 302 computes the value c_q_—_Yaccording to

$\begin{matrix} c_{q_Y} = \sum_{i} (a 1_{q_i} \cdot b 2_{q_i} + a 2_{q_i} \cdot b 1_{q_i}) + r_{q_Y} & [FORMULA 42] \end{matrix}$

and transmits the value c_q_—_Yto the party X (S44-2). Then, the second computation means 306 receives the random number r_q_—_Xfrom the party X and a value c_q_—_Zfrom the party Z and computes values c_q_—₁and c_q_—₂according to the following formula (S45).

$\begin{matrix} c_{q_1} = \sum_{i} (a 1_{q_i} \cdot b 1_{q_i}) + c_{q_Y} - r_{q_X} c_{q_2} = \sum_{i} (a 2_{q_i} \cdot b 2_{q_i}) + c_{Z} - r_{Y} & [FORMULA 43] \end{matrix}$

The party Z performs the following processing. The first random number generation means 301 first generates the random number r_q_—_Zand transmits the random number to the party X (S46-1). Then, the first computation means 302 computes the value c_q_—_Zaccording to

$\begin{matrix} c_{q_Z} = \sum_{i} (a 2_{q_i} \cdot b 0_{q_i} + a 0_{q_i} \cdot b 2_{q_i}) + r_{q_Z} & [FORMULA 44] \end{matrix}$

and transmits the value c_q_—_Zto the party Y (S46-2). Then, the second computation means 303 receives the random number r_q_—_Yfrom the party Y and the value c_q_—_Xfrom the party X and computes values c_q_—₀and c_q_—₂according to the following formula (S47).

$\begin{matrix} c_{0} = \sum_{i} (a 0_{i} \cdot b 0_{i}) + c_{X} - r_{Z} c_{2} = \sum_{i} (a 2_{i} \cdot b 2_{i}) + c_{Z} - r_{Y} & [FORMULA 45] \end{matrix}$

Note that the series of steps S42-1 and S4-2, the series of steps S44-1 S44-2 and the series of steps S46-1 and S46-2 can be performed in parallel, and the steps S43, S45 and S47 can also be performed in parallel.

Following the steps S41 to S47, each party performs a misuse detection processing as described below. A processing performed by the party X will be described. First, the second random number generation means 304 generates a random number sequence (αY1_q_—₀, . . . , αY1_q_—_n-1) and a random number ρ_Xand transmits the random number sequence and the random number to the party Y, and generates a random number sequence (αZ0_q_—₀, . . . , αZ0_q_—_n-1) and transmits the random number sequence to the party Z (S48). Then, the third computation means 305 computes a random number sequence (αZ0_q_—₀−s_q_—_Z·a0_q_—₀, . . . , αZ0_q_—_n-1−s_q_—_Z·a0_q_—_n-1), transmits the random number sequence to the party Y, receives a random number sequence (αX1_q_—₀, . . . , αX1_q_—_n-1) from the party Y and a random number sequence (αX0_q_—₀, . . . , αX0_q_—_n-1) from the party Z, computes a random number sequence (αY1_q_—₀−s_q_—_Y·a1_q_—₀, . . . , αY1_q_—_n-1−s_q_—_Y·a1_q_—_n-1) and a value γ_Xaccording to

$\begin{matrix} γ_{X} = \sum_{i, q} (α X 0_{q_i} \cdot b 1_{q_i} + α X 1_{q_i} \cdot b 0_{q_i}) + ρ_{X} & [FORMULA 46] \end{matrix}$

and transmits the random number sequence and the value to the party Z (S49). Then, the fourth computation means 306 receives a random number sequence (αZ2_q_—₀−s_q_—_Z·a2_q_—₀, . . . , αZ2_q_—_n-1−s_q_—_Z·a2_q_—_n-1) from the party Y and a value ρ_Zfrom the party Z, computes a value γ′_Zaccording to

$\begin{matrix} γ_{Z}^{'} = \sum_{i, q} {(α Z 2_{q_i} - s_{q_Z} \cdot a 2_{q_i}) \cdot b 0_{q_i} - s_{q_Z} \cdot r_{q_Z}} + ρ_{Z} & [FORMULA 47] \end{matrix}$

and transmits the value to the party Y (S50). Then, the misuse detection means 307 receives a value γ_Yfrom the party Y, a value γ′_Yand a random number sequence (αY2_q_—₀−s_q_—_Y·a2_q_—₀, . . . , αY2_q_—_n-1−s_q_—_Y·a2_q_—_n-1) from the party Z, computes

$\begin{matrix} \sum_{i, q} {(α Y 2_{q_i} - s_{q_Y} \cdot a 2_{q_i}) \cdot b 1_{q_i} + s_{q_Y} \cdot c_{q_Y}} - γ_{Y} + γ_{Y}^{'}, & [FORMULA 48] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₀and c_q_—₁if the computation result is 0 (S51).

Next, a processing performed by the party Y will be described.

First, the second random number generation means 304 generates a random number sequence (αZ2_q_—₀, . . . , αZ2_q_—_n-1) and a random number ρ_Yand transmits the random number sequence and the random number to the party Z, and generates a random number sequence (αX1_q_—₀, . . . , αX1_q_—_n-1) and transmits the random number sequence to the party X (S52). Then, the third computation means 305 computes a random number sequence (αX1_q_—₀−s_q_—_X·a1_q_—₀, . . . , αX1_q_—_n-1−s_q_—_X·a1_q_—_n-1), transmits the random number sequence to the party Z, receives a random number sequence (αY1_q_—₀, . . . , αY1_q_—_n-1) from the party X and a random number sequence (αY2_q_—₀, . . . , αY2_q_—_n-1) from the party Z, computes a random number sequence (αZ2_q_—₀−s_q_—_Z·a2_q_—₀, . . . , αZ2_q_—_n-1−s_q_—_Z·a2_q_—_n-1) and a value γ_Yaccording to

$\begin{matrix} γ_{Y} = \sum_{i, q} (α Y 1_{q_i} \cdot b 2_{q_i} + α Y 2_{q_i} \cdot b 1_{q_i}) + ρ_{Y} & [FORMULA 49] \end{matrix}$

and transmits the random number sequence and the value to the party X (S53). Then, the fourth computation means 306 receives the random number ρ_Xfrom the party X and a random number sequence (αX0_q_—₀−s_q_—_X·a0_q_—₀, . . . , αX0_q_—_n-1−s_q_—_X·a0_q_—_n-1) from the party Z, computes a value γ′_Xaccording to

$\begin{matrix} γ_{X}^{'} = \sum_{i, q} {(α X 0_{q_i} - s_{q_X} \cdot a 0_{q_i}) \cdot b 1_{q_i} - s_{q_X} \cdot r_{q_X}} + ρ_{X} & [FORMULA 50] \end{matrix}$

and transmits the value to the party Z (S54). Then, the misuse detection means 307 receives a value γ′_Zand a random number sequence (αZ0_q_—₀−s_q_—_Z·a0_q_—₀, . . . , αZ0_q_—_n-1−s_q_—_Z·a0_q_—_n-1) from the party X and a value γ_Zfrom the party Z, computes

$\begin{matrix} \sum_{i, q} {(α Z 0_{q_i} - s_{q_Z} \cdot a 0_{q_i}) \cdot b 2_{q_i} + s_{q_Z} \cdot c_{q_Z}} - γ_{Z} + γ_{Z}^{'}, & [FORMULA 51] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₁and c_q_—₂if the computation result is 0 (S55).

Next, a processing performed by the party Z will be described. First, the second random number generation means 304 generates a random number sequence (αX0_q_—₀, . . . , αX0_q_—_n-1) and a random number ρ_Zand transmits the random number sequence and the random number to the party X, and generates a random number sequence (αY2_q_—₀, . . . , αY2_q_—_n-1) and transmits the random number sequence to the party Y (S56). Then, the third computation means 305 computes a random number sequence (αY2_q_—₀−s_q_—_Y·a2_q_—₀, . . . , αY2_q_—_n-1−s_q_—_Y·a2_q_—_n-1), transmits the random number sequence to the party X, receives a random number sequence (αZ0_q_—₀, . . . , αZ0_q_—_n-1) from the party X and a random number sequence (αZ2_q_—₀, . . . , αZ2_q_—_n-1) from the party Y, computes a random number sequence (αX0_q_—₀−s_q_—_X·a0_q_—₀, . . . , αX0_q_—_n-1−s_q_—_X·a0_q_—_n-1) and a value γ_Zaccording to

$\begin{matrix} γ_{Z} = \sum_{i, q} (α Z 2_{q_i} \cdot b 0_{q_i} + α Z 0_{q_i} \cdot b 2_{q_i}) + ρ_{Z} & [FORMULA 52] \end{matrix}$

and transmits the random number sequence and the value to the party Y (S57). Then, the fourth computation means 306 receives a random number sequence (αY1_q_—₀−s_q_—_Y·a1_q_—₀, . . . , αY1_q_—_n-1−s_q_—_Y·a1_q_—_n-1) from the party X and a value ρ_Yfrom the party Y, computes a value γ′_Yaccording to

$\begin{matrix} γ_{Y}^{'} = \sum_{i, q} {(α Y 1_{q_i} - s_{q_Y} \cdot a 1_{q_i}) \cdot b 2_{q_i} - s_{q_Y} \cdot r_{q_Y}} + ρ_{Y} & [FORMULA 53] \end{matrix}$

and transmits the value to the party X (S58). Then, the misuse detection means 307 receives the value γ_Xfrom the party X and the value γ′_Xand a random number sequence (αX1_q_—₀−s_q_—_X·a1_q_—₀, . . . , αX1_q_—_n-1−s_q_—_X·a1_q_—_n-1) from the party Y, computes

$\begin{matrix} \sum_{i, q} {(α X 1_{q_i} - s_{q_X} \cdot a 1_{q_i}) \cdot b 0_{q_i} + s_{q_X} \cdot c_{q_X}} - γ_{X} + γ_{X}^{'}, & [FORMULA 54] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₂and c_q_—₀if the computation result is 0 (S59).

Then, the output part 420 computes the total sum (c_q_—₀+c_q_—₁+c_q_—₂) of the values c_q_—₀, c_q_—₁and c_q_—₂output from the parties X, Y and Z and outputs the total sum (S60).

The following relation holds.

$[FORMULA 55]$

$\begin{matrix} c_{q_0} + c_{q_1} + c_{q_2} = \sum_{i} (a 0_{q_i} \cdot b 0_{q_i} + a 0_{q_i} \cdot b 1_{q_i} + a 1_{q_i} \cdot b 0_{q_i}) + \\ \sum_{i} (a 1_{q_i} \cdot b 1_{q_i} + a 1_{q_i} \cdot b 2 q_{q_i} + a 2_{q_i} \cdot b 1_{q_i}) + \\ \sum_{i} (a 2_{q_i} \cdot b 2_{q_i} + a 2_{q_i} \cdot b 0_{q_i} + a 0_{q_i} \cdot b 2_{q_i}) \\ = \sum_{i} (a 0_{q_i} + a 1_{q_i} + a 2_{q_i}) (b 0_{q_i} + b 1_{q_i} + b 2_{q_i}) \\ = \sum_{i} a_{q_i} \cdot b_{q_i} \end{matrix}$

From the relation above, it can be seen that the sum-of-product computation (a multiplication of a_qand b_qin the case where i=1 (in the case where n=1)) has been correctly done. In the processing described above, hash values or other values can be substituted for the random numbers.

The data string decomposition and supply part 410 and the output part 420 can be provided in an apparatus other than the parties or provided in any one or more of the apparatuses serving as the parties.

The effect of the method according to the present invention will be compared with that of the method described in Non-Patent literature 1. Provided that m=1, according to the present invention, the number of rounds is 2, the number of pieces of data transmitted by each party is 10, and the number of random numbers generated by each party is 5. In addition, since the value s_Pcan be repeatedly used once it is shared among the parties, the actual number of rounds is 2, the actual number of pieces of data transmitted is 9, and the number of random numbers generated is 4. On the other hand, according to the method described in Non-Patent literature 1, the number of rounds is 4, the number of pieces of data transmitted by the party X is 20, the number of random numbers generated by the party X is 12, the number of pieces of data transmitted by the parties Y and Z is 17, and the number of random numbers generated by the parties Y and Z is 9. Therefore, the method according to the present invention is about twice as efficient as the method described in Non-Patent literature 1.

In the case where m≧2, the efficiency is further improved. According to the present invention, the number of rounds is 2, the number of pieces of data transmitted by each party is 6 m+3, and the number of random numbers generated by each party is 3 m+1. On the other hand, according to the method described in Non-Patent literature 1, the number of rounds is 4, the number of pieces of data transmitted by the party X is 20m, the number of random numbers generated by the party X is 12m, the number of pieces of data transmitted by the parties Y and Z is 17m, and the number of random numbers generated by the parties Y and Z is 9m. Therefore, the method according to the present invention is about three times as efficient as the method described in Non-Patent literature 1.

Fifth Embodiment

While the secure sum-of-product computation system 400 according to the fourth embodiment is configured to perform a sum-of-product computation expressed as

$\begin{matrix} \sum_{i = 0}^{n - 1} a_{q_i} \cdot b_{q_i}, & [FORMULA 56] \end{matrix}$

a secure sum-of-product computation system 500 according to a fifth embodiment has a configuration in which one of the values involved in the multiplication is fixed, for example. More specifically, the secure sum-of-product computation system 500 performs the following m sum-of-product computations of a data string A_q=(a_q_—₀, . . . , a_q_—_n-1) (m represents an integer equal to or greater than 1, and q=0, . . . , m−1) comprising elements a_q_—_i(q=0, . . . , m−1 (m represents an integer equal to or greater than 1), and i=0, . . . , n−1 (n represents an integer equal to or greater than 1)), which are natural numbers smaller than a prime number p, and a value b, which is a natural number smaller than the prime number p, through cooperative computation by three computation apparatuses, the parties X, Y and Z.

$\begin{matrix} \sum_{i = 0}^{n - 1} a_{q_i} \cdot b & [FORMULA 57] \end{matrix}$

The functional configuration and the process flow are the same as those in the fourth embodiment and therefore will be described below with reference to them (that is, FIG. 9 (and FIG. 8) showing the configuration and FIG. 10 showing the process flow). As in the fourth embodiment, it is assumed that the parties X and Y previously share a random number s_q_—_Z, the parties Y and Z previously share a random number s_q_—_X, and the parties Z and X previously share a random number s_q_—_Y.

Specifically, the data string decomposition and supply part 410 first decomposes the input data string A_qand the value b in such a manner that each element a_q_—_iof the data string satisfies a conditional formula a_q_—_i=a0_q_—_i+a1_q_—_i+a2_q_—_imod p and the value satisfies a conditional formula b=b0+b1+b2 mod p (a0_q_—_i, a1_q_—_{, b}0 and b1 represent random numbers, and p represents a prime number) and supplies data strings A_q_—₀=(a0_q_—₀, . . . , a0_q_—_n-1) and A_q_—₁=(a1_q_—₀, . . . , a1_q_—_n-1) and values b0 and b1 to the party X, data strings A_q_—₁and A_q_—₂=(a2_q_—₀, . . . , a2_q_—₁) and values b1 and b2 to the party Y, and data strings A_q_—₂and A_q_—₀and values b2 and b0 to the party Z (S41).

Then, the party X performs the following processing. The first random number generation means 301 first generates a random number r_q_—_Xand transmits the random number to the party Y (S42-1). Then, the first computation means 302 computes a value c_q_—_Xaccording to

$\begin{matrix} c_{q_X} = \sum_{i} (a 0_{q_i} \cdot b 1 + a 1_{q_i} \cdot b 0) + r_{q_X} & [FORMULA 58] \end{matrix}$

and transmits the value c_q_—_Xto the party Z (S42-2). Then, the second computation means 303 receives a random number r_q_—_Zfrom the party Z and a value c_q_—_Yfrom the party Y and computes values c_q_—₀and c_q_—₁according to the following formula (S43).

$\begin{matrix} c_{q_0} = \sum_{i} (a 0_{q_i} \cdot b 0) + c_{q_X} - r_{q_Z} c_{q_1} = \sum_{i} (a 1_{q_i} \cdot b 1) + c_{q_Y} - r_{q_X} & [FORMULA 59] \end{matrix}$

The party Y performs the following processing. The random number generation means 304 first generates a random number r_q_—_Yand transmits the random number to the party Z (S44-1). Then, the first computation means 305 computes the value c_q_—_Yaccording to

$\begin{matrix} c_{q_Y} = \sum_{i} (a 1_{q_i} \cdot b 2 + a 2_{q_i} \cdot b 1) + r_{q_Y} & [FORMULA 60] \end{matrix}$

and transmits the value c_q_—_Yto the party X (S44-2). Then, the second computation means 306 receives the random number r_q_—_Xfrom the party X and a value c_q_—_Zfrom the party Z and computes values c_q_—₁and c_q_—₂according to the following formula (S45).

$\begin{matrix} c_{q_1} = \sum_{i} (a 1_{q_i} \cdot b 1) + c_{q_Y} - r_{q_X} c_{q_2} = \sum_{i} (a 2_{q_i} \cdot b 2) + c_{q_Z} - r_{q_Y} & [FORMULA 61] \end{matrix}$

$\begin{matrix} c_{q_Z} = \sum_{i} (a 2_{q_i} \cdot b 0 + a 0_{q_i} \cdot b 2) + r_{q_Z} & [FORMULA 62] \end{matrix}$

and transmits the value c_q_—_Zto the party Y (S46-2). Then, the second computation means 303 receives the random number r_q_—_Yfrom the party Y and the value c_q_—_Xfrom the party X and computes values c_q_—₀and c_q_—₂according to the following formula (S47).

$\begin{matrix} c_{q_0} = \sum_{i} (a 0_{q_i} \cdot b 0) + c_{q_X} - r_{q_Z} c_{q_2} = \sum_{i} (a 2_{q_i} \cdot b 2) + c_{q_Z} - r_{q_Y} & [FORMULA 63] \end{matrix}$

Note that the series of steps S42-1 and S42-2, the series of steps S44-1 and S44-2 and the series of steps S46-1 and S46-2 can be performed in parallel, and the steps S43, S45 and S47 can also be performed in parallel.

$\begin{matrix} α Z 0 - \sum_{i, q} (s_{q_Z} \cdot a 0_{q_i}), & [FORMULA 64] \end{matrix}$

transmits the value to the party Y, receives a random number αX1 from the party Y and a random number α0 from the party Z, computes values

$\begin{matrix} α Y 1 - \sum_{i, q} (s_{q_Y} \cdot a 1_{q_i}) and & [FORMULA 65] \\ γ_{X} = α X 0 \cdot b 1 + α X 1 \cdot b 0 + ρ_{X} & [FORMULA 66] \end{matrix}$

and transmits the values to the party Z (S49). Then, the fourth computation means 306 receives a value

$\begin{matrix} α Z 2 - \sum_{i, q} (s_{q_Z} \cdot a 2_{q_i}) & [FORMULA 67] \end{matrix}$

from the party Y and a value ρ_Zfrom the party Z, computes a value

$\begin{matrix} γ_{Z}^{'} = (α Z 2 - \sum_{i, q} (s_{q_Z} \cdot a 2_{q_i})) \cdot b 0 - \sum_{q} s_{q_Z} \cdot r_{q_Z} \cdot ρ_{Z} & [FORMULA 68] \end{matrix}$

and outputs the value to the party Y (S50).

Then, the misuse detection means 307 receives a value γ_Yfrom the party Y, a value γ′_Yand a value

$α Y 2 - \sum_{i, q} (s_{q_Y} \cdot a 2_{q_i})$

from the party Z, computes

$\begin{matrix} (α Y 2 - \sum_{i, q} (s_{q_Y} \cdot a 2_{q_i})) \cdot b 1 + \sum_{q} s_{q_Y} \cdot c_{q_Y} - γ_{Y} + γ_{Y}^{'}, & [FORMULA 70] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₀and c_q_—₁if the computation result is 0 (S51).

Next, a processing performed by the party Y will be described. First, the second random number generation means 304 generates random numbers αZ2 and ρ_Yand transmits the random numbers to the party Z, and generates a random number αX1 and transmits the random number to the party X (S52). Then, the third computation means 305 computes a value

$\begin{matrix} α X 1 - \sum_{i, q} (s_{q_X} \cdot a 1_{q_i}) & [FORMULA 71] \end{matrix}$

transmits the value to the party Z, receives a random number αY1 from the party X and a random number αY2 from the party Z, computes

$\begin{matrix} α Z 2 - \sum_{i, q} (s_{q_Z} \cdot a 2_{q_i}) and & [FORMULA 72] \\ γ_{Y} = α Y 1 \cdot b 2 + α Y 2 \cdot b 1 + ρ_{Y} & [FORMULA 73] \end{matrix}$

and transmits the values to the party X (S53). Then, the fourth computation means 306 receives the random number ρ_Xfrom the party X and a value

$\begin{matrix} α X 0 - \sum_{i, q} (s_{q_X} \cdot a 0_{q_i}) & [FORMULA 74] \end{matrix}$

from the party Z, computes a value γ′_Xaccording to

$\begin{matrix} γ_{X}^{'} = (α X 0 - \sum_{i, q} (s_{q_X} \cdot a 0_{q_i})) \cdot b 1 - \sum_{q} s_{q_X} \cdot r_{q_X} + ρ_{X} & [FORMULA 75] \end{matrix}$

and transmits the value to the party Z (S54). Then, the misuse detection means 307 receives a value γ′_Zand a value

$\begin{matrix} α Z 0 - \sum_{i, q} (s_{q_Z} \cdot a 0_{q_i}) & [FORMULA 76] \end{matrix}$

from the party X and a value γ_Zfrom the party Z, computes

$\begin{matrix} (α Z 0 - \sum_{i, q} (s_{q_Z} \cdot a 0_{q_i})) \cdot b 2 + \sum_{q} s_{q_Z} \cdot c_{q_Z} - γ_{Z} + γ_{Z}^{'}, & [FORMULA 77] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₁and c_q_—₂if the computation result is 0 (S55).

Next, a processing performed by the party Z will be described. First, the second random number generation means 304 generates random numbers αX0 and ρ_Zand transmits the random numbers to the party X, and generates a random number αY2 and transmits the random number to the party Y (S56). Then, the third computation means 305 computes a value

$\begin{matrix} α Y 2 - \sum_{i, q} (s_{q_Y} \cdot a 2_{q_i}), & [FORMULA 78] \end{matrix}$

transmits the value to the party X, receives a random number αZ0 from the party X and a random number αZ2 from the party Y, computes values

$\begin{matrix} α X 0 - \sum_{i, q} (s_{q_X} \cdot a 0_{q_i}) and & [FORMULA 79] \\ γ_{Z} = α Z 2 \cdot b 0 + α Z 0 \cdot b 2 + ρ_{Z} & [FORMULA 80] \end{matrix}$

and transmits the values to the party Y (S57). Then, the fourth computation means 306 receives a value

$\begin{matrix} α Y 1 - \sum_{i, q} (s_{q_Y} \cdot a 1_{q_i}) & [FORMULA 81] \end{matrix}$

from the party X and a value ρ_Yfrom the party Y, computes a value γ′_Yaccording to

$\begin{matrix} γ_{Y}^{'} = (α Y 1 - \sum_{i, q} (s_{q_Y} \cdot a 1_{q_i})) \cdot b 2 - \sum_{q} s_{q_Y} \cdot r_{q_Y} + ρ_{Y} & [FORMULA 82] \end{matrix}$

and transmits the value to the party X (S58). Then, the misuse detection means 307 receives the value γ_Xfrom the party X and the value γ′_Xand a value

$\begin{matrix} α X 1 - \sum_{i, q} (s_{q_X} \cdot a 1_{q_i}) & [FORMULA 83] \end{matrix}$

from the party Y, computes

$\begin{matrix} (α X 1 - \sum_{i, q} (s_{q_X} \cdot a 1_{q_i})) \cdot b 0 + \sum_{q} s_{q_X} \cdot c_{q_X} - γ_{X} + γ_{X}^{'}, & [FORMULA 84] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₂and c_q_—₀if the computation result is 0 (S59).

$\begin{matrix} \begin{matrix} c_{q_0} + c_{q_1} + c_{q_2} = \sum_{i} (\begin{matrix} a 0_{q_i} \cdot b 0 + a 0_{q_i} \cdot \\ b 1 + a 1_{q_i} \cdot b 0 \end{matrix}) + \\ \sum_{i} (\begin{matrix} a 1_{q_i} \cdot b 1 + a 1_{q_i} \cdot \\ b 2 + a 2_{q_i} \cdot b 1 \end{matrix}) + \\ \sum_{i} (\begin{matrix} a 2_{q_i} \cdot b 2 + a 2_{q_i} \cdot \\ b 0 + a 0_{q_i} \cdot b 2 \end{matrix}) \\ = \sum_{i} (a 0_{q_i} + a 1_{q_i} + a 2_{q_i}) \\ (b 0 + b 1 + b 2) \\ = \sum_{i} a_{q_i} \cdot b \end{matrix} & [FORMULA 85] \end{matrix}$

From the relation above, it can be seen that the sum-of-product computation has been correctly done. In the processing described above, hash values or other values can be substituted for the random numbers. The data string decomposition and supply part 410 and the output part 420 can be provided in an apparatus other than the parties or provided in any one or more of the apparatuses serving as the parties.

The effect of the method according to the present invention will be compared with that of the method described in Non-Patent literature 1. According to the present invention, the number of rounds is 2, the number of pieces of data transmitted by each party is 2m, and the number of random numbers generated by each party is 3. Therefore, the method according to the present invention is about nine times as efficient as the method described in Non-Patent literature 1. An improvement is that the number of random numbers generated is constant and therefore does not depend on the value m, rather than increasing with the value m.

Sixth Embodiment

In the multiplication protocol for a and b, the secure sum-of-product computation system 300 with a misuse detection function shown in the third embodiment uses values α_P0pand α_PP− indicating fragment values of a value s_P·a_0pto compare (α_P0p−α_PP−)·b_1pand s_P·a_0p·b_1pand uses values α_P1pand α_PP+ indicating fragment values of a value s_P·a_1pto compare (α_P1p−α_PP+)·b_0pand s_P·a_1p·b_0pin order to check the validity of a_0p·b_1p+a_1p·b_0p. However, in the former comparison, the multiplication protocol of the secure sum-of-product computation system 300 involves a procedure of round-trip transmission of computed values between the parties. Specifically, the value αZ2_q_—_i2−s_q_—_Z·a2_q_—_i2needs to be transmitted from the party Y to the party X and then transmitted from the party X back to the party Y, the value αX0_q_—_i0−s_q_—_X·a0_q_—_i0needs to be transmitted from the party Z to the party Y and then transmitted from the party Y back to the party Z, and the value αY1_q_—_i1−s_q_—_Y·a1_q_—_i1needs to be transmitted from the party X to the party Z and then transmitted from the party Z back to the party X. Therefore, a computed value may leak during the transmission, and a server may perform a misuse (acquisition of information concerning data to be concealed) without causing a change of the computation result. That is, the third embodiment can be said to provide a configuration capable of perfect concealment as far as the server perform no misuse.

A sixth embodiment provides a configuration capable of perfect concealment even if the server performs a misuse. More specifically, the sixth embodiment provides a configuration whose protocol does not involve a round-trip transmission of a computed value that can lead to a misuse. FIG. 11 shows an example of a configuration of a secure sum-of-product computation system 600, and FIG. 12 shows an example of a flow of a processing performed by the secure sum-of-product computation system 600. The secure sum-of-product computation system 600 comprises a party X, a party Y and a party Z. As shown in FIG. 13, each party has first random number generation means 301, first computation means 302 and second computation means 303, which are the same as those of the secure sum-of-product computation system 300, as well as second random number generation means 604, third computation means 605, fourth computation means 606 and misuse detection means 607.

In the following specific description, the functions of the first random number generation means 301, the first computation means 302 and the second computation means 303 and the secure sum-of-product computation processing (steps S21 to S27) implemented by these functions are the same as those of the secure sum-of-product computation system 300 and therefore will not be further described, and the misuse detection processing, which differs from that of the secure sum-of-product computation system 300, will be particularly described.

Following the steps S21 to S27, each party performs a misuse detection processing as described below. As in the third embodiment, it is assumed that the parties X and Y previously share a random number s_q_—_Z, the parties Y and Z previously share a random number s_q_—_X, and the parties Z and X previously share a random number s_q_—_Y.

A processing performed by the party X will be described. First, the second random number generation means 604 generates a random number ρ_Xand transmits the random number to the party Y, and generates random number sequences (αZ0_q_—₀, . . . , αZ0_q_—_na0-1) and (βZ0_q_—₀, . . . , βZ0_q_—_nb0-1) and transmits the random number sequences to the party Z (S68). Then, the third computation means 605 computes random number sequences (αZ0_q_—₀−s_q_—_Z·a0_q_—₀, . . . , αZ0_q_—_na0-1−s_q_—_Z·a0_q_—_na0-1) and (βZ0_q_—₀−s_q_—_Z·b0_q_—₀, . . . , βZ0_q_—_nb0-1−s_q_—_Z·b0_q_—_nb0-1), transmits the random number sequences to the party Y, receives random number sequences (αX1_q_—₀, . . . , αX1_q_—_na1-1) and (βX1_q_—₀, . . . , βX1_q_—_nb1-1) from the party Y, computes a value γ_Xaccording to

$\begin{matrix} γ_{X} = \sum_{i 1, j 0, q} (e 10_{q_i 1, q_j 0} \cdot α X 1_{q_i 1} \cdot b 0_{q_j 0}) + \sum_{i 0, j 1, q} (e 01_{q_i 0, q_j 1} \cdot a 0_{q_i 0} \cdot β X 1_{q_j 1}) + ρ_{X} & [FORMULA 86] \end{matrix}$

and transmits the value to the party Z (S69). Then, the fourth computation means 606 receives a random number ρ_Zfrom the party Z, computes a value γ′_Zaccording to

$\begin{matrix} γ_{Z}^{'} = \sum_{q} (- s_{q_Z} \cdot r_{q_Z}) + ρ_{Z} & [FORMULA 87] \end{matrix}$

and transmits the value to the party Y (S70). Then, the misuse detection means 607 receives a value γ_Yfrom the party Y, a value γ′_Yand random number sequences (αY2_q_—₀−s_q_—_Y·a2_q_—₀, . . . , αY2_q_—_na2-1−s_q_—_Y·a2_q_—_na2-1) and (βY2_q_—₀−s_q_—_Y·b2_q_—₀, . . . , βY2_q_—_nb2-1−s_q_—_Y·b2_q_—_nb2-1) from the party Z, computes

$\begin{matrix} \sum_{i 1, i 2, j 1, j 2, q} {\begin{matrix} \begin{matrix} e 21_{q_i 2, q_j 1} \cdot (α Y 2_{q_i 2} - s_{q_Y} \cdot a 2_{q_i 2}) \cdot \\ b 1_{q_j 1} + e 12_{q_i 1, q_j 2} \cdot (\begin{matrix} β Y 2_{q_j 2} - s_{q_Y} \cdot \\ b 2_{q_j 2} \end{matrix}) \cdot \end{matrix} \\ a 1_{q_i 1} + s_{q_Y} \cdot c_{q_Y} \end{matrix}} - γ_{Y} + γ_{Y}^{'}, & [FORMULA 88] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₀and c_q_—₁if the computation result is 0 (S71).

Next, a processing performed by the party Y will be described. First, the second random number generation means 604 generates a random number ρ_Yand transmits the random number to the party Z, and generates random number sequences (αX1_q_—₀, . . . , αX1_q_—_na1-1) and (βX1_q_—₀, . . . , βX1_q_—_nb1-1) and transmits the random number sequences to the party X (S72). Then, the third computation means 605 computes random number sequences (αX1_q_—₀−s_q_—_X·a1_q_—₀, . . . , αX1_q_—_na1-1−s_q_—_X·a1_q_—_na1-1) and (βX1_q_—₀−s_q_—_X·b1_q_—₀, . . . , βX1_q_—_nb1-1−s_q_—_X·b1_q_—_nb1-1), transmits the random number sequences to the party Z, receives random number sequences (αY2_q_—₀, . . . , αY2_q_—_na2-1) and (βY2_q_—₀, . . . , βY2_q_—_nb2-1) from the party Z, computes a value γ_Yaccording to

$\begin{matrix} γ_{Y} = \sum_{i 2, j 1, q} (e 21_{q_i 2, q_j 1} \cdot α Y 2_{q_i 2} \cdot b 1_{q_j 1}) + \sum_{i 1, j 2, q} (e 12_{q_i 1, q_j 2} \cdot a 1_{q_i 1} \cdot β Y 2_{q_j 2}) + ρ_{Y} & [FORMULA 89] \end{matrix}$

and transmits the value to the party X (S73). Then, the fourth computation means 606 receives the random number ρ_Xfrom the party X, computes a value γ′_Xaccording to

$\begin{matrix} γ_{X}^{'} = \sum_{q} (- s_{q_X} \cdot r_{q_X}) + ρ_{X} & [FORMULA 90] \end{matrix}$

and transmits the value to the party Z (S74). Then, the misuse detection means 607 receives a value γ′_Zand random number sequences (αZ0_q_—₀−s_q_—_Z·a0_q_—₀, . . . , αZ0_q_—_na0-1−s_q_—_Z·a0_q_—_na0-1) and (βZ0−s_q_—_Z·b0_q_—₀, . . . , βZ0_q_—_nb0-1−s_q_—_Z·b0_q_—_nb0-1) from the party X and a value γ_Zfrom the party Z, computes

$\begin{matrix} \sum_{i 0, i 2, j 0, j 2, q} {\begin{matrix} \begin{matrix} e 02_{q_i 0, q_j 2} \cdot (α Z 0_{q_i 0} - s_{q_Z} \cdot a 0_{q_i 0}) \cdot \\ \begin{matrix} b 2_{q_j 2} + e 20_{q_i 2, q_j 0} \cdot \\ (β Z 0_{q_j 0} - s_{q_Z} \cdot b 0_{q_j 0}) \cdot \end{matrix} \end{matrix} \\ a 2_{q_i 2} + s_{q_Z} \cdot c_{q_Z} \end{matrix}} - γ_{Z} + γ_{Z}^{'}, & [FORMULA 91] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₁and c_q_—₂if the computation result is 0 (S75).

Next, a processing performed by the party Z will be described. First, the second random number generation means 604 generates a random number ρ_Zand transmits the random number to the party X, and generates random number sequences (αY2_q_—₀, . . . , αY2_q_—_na2-1) and (βY2_q_—₀, . . . , βY2_q_—_nb2-1) and transmits the random number sequences to the party Y (S76). Then, the third computation means 605 computes random number sequences (αY2_q_—₀−s_q_—_Y·a2_q_—₀, . . . , αY2_q_—_na2-1−s_q_—_Y·a2_q_—_na2-1) and (βY2_q_—₀−s_q_—_Y·b2_q_—₀, . . . , βY2_q_—_nb2-1−s_q_—_Y·b2_q_—_nb2-1), transmits the random number sequences to the party X, receives random number sequences (αZ0_q_—₀, . . . , αZ0_q_—_na0-1) and (βZ0_q_—₀, . . . , βZ0_q_—_nb0-1) from the party X, computes a value γ_Zaccording to

$\begin{matrix} γ_{Z} = \sum_{i 0, j 2, q} (e 02_{q_i 0, q_j 2} \cdot α Z 0_{q_i 0} \cdot b 2_{q_j 0}) + \sum_{i 2, j 0, q} (e 20_{q_i 2, q_j 0} \cdot a 2_{q_i 2} \cdot β Z 0_{q_j 0}) + ρ_{Z} & [FORMULA 92] \end{matrix}$

and transmits the value to the party Y (S77). Then, the fourth computation means 606 receives a random number ρ_Yfrom the party Y, computes a value γ′_Yaccording to

$\begin{matrix} γ_{Y}^{'} = \sum_{q} (- s_{q_Y} \cdot r_{q_Y}) + ρ_{Y} & [FORMULA 93] \end{matrix}$

and transmits the value to the party X (S78). Then, the misuse detection means 607 receives the value γ_Xfrom the party X and the value γ′_Xand random number sequences (αX1_q_—₀−s_q_—_X·a1_q_—₀, . . . , αX1_q_—_na1-1−s_q_—_X·a1_q_—_na1-1) and (βX1_q_—₀−s_q_—_X·b1_q_—₀, . . . , βX1_q_—_nb1−s_q_—_X·b1_q_—_nb1-1) from the party Y, computes

$\begin{matrix} \sum_{i 0, i 1, j 0, j 1, q} {\begin{matrix} e 10_{q_i 1, q_j 0} \cdot (α X 1_{q_i 1} - s_{q_X} \cdot a 1_{q_i 1}) \cdot \\ \begin{matrix} b 0_{q_j 0} + e 01_{q_i 0, q_j 1} \cdot \\ (β X 1_{q_j 1} - s_{q_X} \cdot b 1_{q_j 1}) \cdot \end{matrix} \\ a 0_{q_i 0} + s_{q_X} \cdot c_{q_X} \end{matrix}} - γ_{X} + γ_{X}^{'}, & [FORMULA 94] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₂and c_q_—₀if the computation result is 0 (S79). In the processing described above, hash values or other values can be substituted for the random numbers.

In the multiplication protocol for a and b, the secure sum-of-product computation system 600 described above uses values β_P1pand β_PP+ indicating fragment values of a value s_P·b_1pto compare (β_P1p+a_0p·β_PP+) and s_P·a_1p·b_0pand uses values α_P1pand α_PP+ indicating fragment values of a value s_P·a_1pto compare (α_P1p−a_PP+)·b_0pand s_P·a_1p·b_0pin order to check the validity of a_0p·b_1p+a_1p·b_0p. With such a configuration, the protocol involves no round-trip transmission of computed values among the parties. Therefore, leakage of a computed value can be prevented, and therefore, the server cannot perform a misuse. In addition, the number of processing steps is the same as that of the secure sum-of-product computation system 300, the secure sum-of-product computation system 600 can maintain approximately the same level of efficiency.

Seventh Embodiment

A seventh embodiment is a specific example of the sixth embodiment, in which na0=na1=na2=nb0=nb1=nb2=n, and e00=e01=e10=e11=e12=e21=e22=e20=e02=1. FIG. 14 shows an example of a configuration of a secure sum-of-product computation system 700 according to this embodiment, and FIG. 15 shows an example of a flow of a processing performed by the secure sum-of-product computation system 700. The secure sum-of-product computation system 700 comprises a party X, a party Y, a party Z, a data string decomposition and supply part 410 and an output part 420. The data string decomposition and supply part 410 and the output part 420 are the same as those of the secure sum-of-product computation system 400 according to the fourth embodiment. As shown in FIG. 13, each party has first random number generation means 301, first computation means 302 and second computation means 303, which are the same as those of the secure sum-of-product computation system 400, as well as second random number generation means 604, third computation means 605, fourth computation means 606 and misuse detection means 607.

As with the secure sum-of-product computation system 400 according to the fourth embodiment, the secure sum-of-product computation system 700 performs each set of sum-of-product computations

$\begin{matrix} \sum_{i = 0}^{n - 1} a_{q_i} \cdot b_{q_i} & [FORMULA 95] \end{matrix}$

for m sets of data strings A_q=(a_q_—₀, . . . , a_q_—_n-1) and B_q=(b_q_—₀, . . . , b_q_—_n-1) comprising elements a_q_—_iand b_q_—_i, which are natural numbers smaller than a prime number p, through cooperative computation by the three computation apparatuses, the parties X, Y and Z (the sum-of-product computation is a multiplication of a_qand b_qin the case where n=1).

In the following specific description, the functions of the data string decomposition and supply part 410, the first random number generation means 301, the first computation means 302, the second computation means 303 and the output part 420 and the secure sum-of-product computation processing (steps S41 to S47 and S60) implemented by these functions are the same as those of the secure sum-of-product computation system 400 according to the fourth embodiment and therefore will not be further described, and the misuse detection processing, which differs from that of the secure sum-of-product computation system 400, will be particularly described.

Following the steps S41 to S47, each party performs a misuse detection processing as described below. As in the sixth embodiment, it is assumed that the parties X and Y previously share a random number s_q_—_Z, the parties Y and Z previously share a random number s_q_—_X, and the parties Z and X previously share a random number s_q_—_Y.

A processing performed by the party X will be described. First, the second random number generation means 604 generates a random number ρ_X, and transmits the random number to the party Y, and generates random number sequences (αZ0_q_—₀, . . . , αZ0_q_—_n-1) and (βZ0_q_—₀, . . . , βZ0_q_—_n-1) and transmits the random number sequences to the party Z (S88). Then, the third computation means 605 computes random number sequences (αZ0_q_—₀−s_q_—_Z·a0_q_—₀, . . . , αZ0_q_—_n-1−s_q_—_Z·a0_q_—_n-1) and (βZ0_q_—₀−s_q_—_Z·b0_q_—₀, . . . , βZ0_q_—_n-1−s_q_—_Z·b0_q_—_n-1), transmits the random number sequences to the party Y, receives random number sequences (αX1_q_—₀, . . . , αX1_q_—_n-1) and (βX1_q_—₀, . . . , βX1_q_—_n-1) from the party Y, computes a value γ_Xaccording to

$\begin{matrix} γ_{X} = \sum_{i, q} (α X 1_{q_i} \cdot b 0_{q_i} + a 0_{q_i} \cdot β X 1_{q_i}) + ρ_{X} & [FORMULA 96] \end{matrix}$

and transmits the value to the party Z (S89). Then, the fourth computation means 606 receives a random number ρ_Zfrom the party Z, computes a value γ′_Zaccording to

$\begin{matrix} γ_{Z}^{'} = \sum_{q} (- s_{q_Z} \cdot r_{q_Z}) + ρ_{Z} & [FORMULA 97] \end{matrix}$

and transmits the value to the party Y (S90). Then, the misuse detection means 607 receives a value γ_Yfrom the party Y, a value γ′_Yand random number sequences (αY2_q_—₀−s_q_—_Y·a2_q_—₀, . . . , αY2_q_—_n-1−s_q_—_Y·a2_q_—_n-1) and (βY2_q_—₀−s_q_—_Y·b2_q_—₀, . . . , βY2_q_—_n-1−s_q_—_Y·b2_q_—_n-1) from the party Z, computes

$\begin{matrix} \sum_{i, q} {\begin{matrix} \begin{matrix} (α Y 2_{q_i} - s_{q_Y} \cdot a 2_{q_i}) \cdot b 1_{q_i} + \\ (β Y 2_{q_i} - s_{q_Y} \cdot b 2_{q_i}) \cdot a 1_{q_i} + \end{matrix} \\ s_{q_Y} \cdot c_{q_Y} \end{matrix}} - γ_{Y} + γ_{Y}^{'}, & [FORMULA 98] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₀and c_q_—₁if the computation result is 0 (S91).

Next, a processing performed by the party Y will be described. First, the second random number generation means 604 generates a random number ρ_Yand transmits the random number to the party Z, and generates random number sequences (αX1_q_—₀, . . . , αX1_q_—_n-1) and (βX1_q_—₀, . . . , βX1_q_—_n-1) and transmits the random number sequences to the party X (S92). Then, the third computation means 605 computes random number sequences (αX1_q_—₀−s_q_—_X·a1_q_—₀, . . . , αX1_q_—_n-1−s_q_—_X·a1_q_—_n-1) and (βX1_q_—₀−s_q_—_X·b1_q_—₀, . . . , βX1_q_—_n-1−s_q_—_X·b1_q_—_n-1), transmits the random number sequences to the party Z, receives random number sequences (αY2_q_—₀, . . . , αY2_q_—_n-1) and (βY2_q_—₀, . . . , βY2_q_—_n-1) from the party Z, computes a value γ_Yaccording to

$\begin{matrix} γ_{Y} = \sum_{i, q} (α Y 2_{q_i} \cdot b 1_{q_i} + a 1_{q_i} \cdot β Y 2_{q_i}) + ρ_{Y} & [FORMULA 99] \end{matrix}$

and transmits the value to the party X (S93). Then, the fourth computation means 606 receives the random number ρ_Xfrom the party X, computes a value γ′_Xaccording to

$\begin{matrix} γ_{X}^{'} = \sum_{q} (- s_{q_X} \cdot r_{q_X}) + ρ_{X} & [FORMULA 100] \end{matrix}$

and transmits the value to the party Z (S94). Then, the misuse detection means 607 receives a value γ′_Zand random number sequences (αZ0_q_—₀−s_q_—_Z·a0_q_—₀, . . . , αZ0_q_—_n-1−s_q_—_Z·a0_q_—_n-1) and (βZ0_q_—₀−s_q_—_Z·b0_q_—₀, . . . , βZ0_q_—_n-1−s_q_—_Z·b0_q_—_n-1) from the party X and a value γ_Zfrom the party Z, computes

$\begin{matrix} \sum_{i, q} {\begin{matrix} \begin{matrix} (α Z 0_{q_i} - s_{q_Z} \cdot a 0_{q_i}) \cdot b 2_{q_i} + \\ (β Z 0_{q_i} - s_{q_Z} \cdot b 0_{q_i}) \cdot a 2_{q_i} + \end{matrix} \\ s_{q_Z} \cdot c_{q_Z} \end{matrix}} - γ_{Z} + γ_{Z}^{'}, & [FORMULA 101] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₁and c_q_—₂if the computation result is 0 (S95).

Next, a processing performed by the party Z will be described.

First, the second random number generation means 604 generates a random number ρ_Zand transmits the random number to the party X, and generates random number sequences (αY2_q_—₀, . . . , αY2_q_—_n-1) and (βY2_q_—₀, . . . , βY2_q_—_n-1) and transmits the random number sequences to the party Y (S96). Then, the third computation means 605 computes random number sequences (αY2_q_—₀−s_q_—_Y·a2_q_—₀, . . . , αY2_q_—_n-1−s_q_—_Y·a2_q_—_n-1) and (βY2_q_—₀−s_q_—_Y·b2_q_—₀, . . . , βY2_q_—_n-1−s_q_—_Y·b2_q_—_n-1), transmits the random number sequences to the party X, receives random number sequences (αZ0_q_—₀, . . . , αZ0_q_—_n-1) and (βZ0_q_—₀, . . . , βZ0_q_—_n-1) from the party X, computes a value γ_Zaccording to

$\begin{matrix} γ_{Z} = \sum_{i, q} (α Z 0_{q_i} \cdot b 2_{q_i} + a 2_{q_i} \cdot β Z 0_{q_i}) + ρ_{Z} & [FORMULA 102] \end{matrix}$

and transmits the value to the party Y (S97). Then, the fourth computation means 606 receives a random number ρ_Yfrom the party Y, computes a value γ′_Yaccording to

$\begin{matrix} γ_{Y}^{'} = \sum_{q} (- s_{q_Y} \cdot r_{q_Y}) + ρ_{Y} & [FORMULA 103] \end{matrix}$

and transmits the value to the party X (S98). Then, the misuse detection means 607 receives the value γ_Xfrom the party X and the value γ′_Xand random number sequences (αX1_q_—₀−s_q_—_X·a1_q_—₀, . . . , αX1_q_—_n-1−s_q_—_X·a1_q_—_n-1) and (βX1_q_—₀−s_q_—_X·b1_q_—₀, . . . , βX1_q_—_n-1−s_q_—_X·b1_q_—_n-1) from the party Y, computes

$\begin{matrix} \sum_{i, q} {\begin{matrix} \begin{matrix} (α X 1_{q_i} - s_{q_X} \cdot a 1_{q_i}) \cdot b 0_{q_i} + \\ (β X 1_{q_i} - s_{q_X} \cdot b 1_{q_i}) \cdot a 0_{q_i} + \end{matrix} \\ s_{q_X} \cdot c_{q_X} \end{matrix}} - γ_{X} + γ_{X}^{'}, & [FORMULA 104] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₂and c_q_—₀if the computation result is 0 (S99). In the processing described above, hash values or other values can be substituted for the random numbers.

Eighth Embodiment

While the secure sum-of-product computation system 700 according to the seventh embodiment is configured to perform a sum-of-product computation expressed as

$\begin{matrix} \sum_{i = 0}^{n - 1} a_{q_i} \cdot b_{q_i} & [FORMULA 105] \end{matrix}$

as with the secure sum-of-product computation system 400 according to the fourth embodiment and apply the method according to the embodiment 6 to the misuse detection processing for the sum-of-product computation, a secure sum-of-product computation system 800 according to an eighth embodiment has a configuration in which one of the values involved in the multiplication in the sum-of-product computation is fixed. More specifically, the secure sum-of-product computation system 800 is configured to perform the following m sum-of-product computations of a data string A_q=(a_q_—₀, . . . , a_q_—_n-1) comprising elements a_q_—_i, which are natural numbers smaller than a prime number p, and a value b, which is a natural number smaller than the prime number p, through cooperative computation by three computation apparatuses, the parties X, Y and Z, as with the secure sum-of-product computation system 500 according to the fifth embodiment and apply the misuse detection method according to the sixth embodiment to the misuse detection processing for the sum-of-product computation.

$\begin{matrix} \sum_{i = 0}^{n - 1} a_{q_i} \cdot b & [FORMULA 106] \end{matrix}$

In the following specific description, the functions of the data string decomposition and supply part 410, the first random number generation means 301, the first computation means 302, the second computation means 303 and the output part 420 and the secure sum-of-product computation processing (steps S41 to S47 and S60) implemented by these functions are the same as those of the secure sum-of-product computation system 500 according to the fifth embodiment and therefore will not be further described, and the misuse detection processing, which differs from that of the secure sum-of-product computation system 500, will be particularly described. The functional configuration and the process flow are the same as those in the seventh embodiment and therefore will be described below with reference to them (that is, FIG. 14 (and FIG. 13) showing the configuration and FIG. 15 showing the process flow).

Following the steps S41 to S47, each party performs a misuse detection processing as described below. As in the seventh embodiment, it is assumed that the parties X and Y previously share a random number s_q_—_Z, the parties Y and Z previously share a random number s_q_—_X, and the parties Z and X previously share a random number s_q_—_Y.

A processing performed by the party X will be described. First, the second random number generation means 604 generates a random number ρ_Xand transmits the random number to the party Y, and generates random numbers αZ0 and βZ0_qand transmits the random numbers to the party Z (S88). Then, the third computation means 605 computes random numbers

$\begin{matrix} α Z 0 - \sum_{i, q} (s_{q_Z} \cdot a 0_{q_i}), β Z 0_{q} - s_{q_Z} \cdot b 0 & [FORMULA 107] \end{matrix}$

transmits the random numbers to the party Y, receives random numbers αX1 and βX1_qfrom the party Y, computes a value γ_Xaccording to

$\begin{matrix} γ_{X} = α X 1 \cdot b 0 + \sum_{i, q} (a 0_{q_i} \cdot β X 1_{q}) + ρ_{X} & [FORMULA 108] \end{matrix}$

and transmits the value to the party Z (S89). Then, the fourth computation means 606 receives a random number ρ_Zfrom the party Z, computes a value γ′_Zaccording to

$\begin{matrix} γ_{Z}^{'} = - \sum_{q} (s_{q_Z} \cdot r_{q_Z}) + ρ_{Z} & [FORMULA 109] \end{matrix}$

and transmits the value to the party Y (S90). Then, the misuse detection means 607 receives a value γ_Yfrom the party Y, a value γ′_Yand values

$\begin{matrix} α Y 2 - \sum_{i, q} (s_{q_Y} \cdot a 2_{q_i}) and & [FORMULA 110] \\ β Y 2_{q} - s_{q_Y} \cdot b 2 & [FORMULA 111] \end{matrix}$

from the party Z, computes

$\begin{matrix} (α Y 2 - \sum_{i, q} (s_{q_Y} \cdot a 2_{q_i})) \cdot b 1 + \sum_{q} {\begin{matrix} \sum_{i} (a 1_{q_i} (β Y 2_{q} - s_{q_Y} \cdot b 2)) + \\ s_{q_Y} \cdot c_{q_Y} \end{matrix}} - γ_{Y} + γ_{Y}^{'}, & [FORMULA 112] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₀and c_q_—₁if the computation result is 0 (S91).

Next, a processing performed by the party Y will be described. First, the second random number generation means 604 generates a random number ρ_Yand transmits the random number to the party Z, and generates random numbers αX1 and βX1_qand transmits the random numbers to the party X (S92). Then, the third computation means 605 computes random numbers

$\begin{matrix} α X 1 - \sum_{i, q} (s_{q_X} \cdot a 1_{q_i}), β X 1_{q} - s_{q_X} \cdot b 1 & [FORMULA 113] \end{matrix}$

transmits the random numbers to the party Z, receives random numbers αY2 and βY2_qfrom the party Z, computes a value γ_Yaccording to

$\begin{matrix} γ_{Y} = α Y 2 \cdot b 1 + \sum_{i, q} (a 1_{q_i} \cdot β Y 2_{q}) + ρ_{Y} & [FORMULA 114] \end{matrix}$

and transmits the value to the party X (S93). Then, the fourth computation means 606 receives the random number ρ_Xfrom the party X, computes a value γ′_Xaccording to

$\begin{matrix} γ_{X}^{'} = - \sum_{q} (s_{q_X} \cdot r_{q_X}) + ρ_{X} & [FORMULA 115] \end{matrix}$

and transmits the value to the party Z (S94). Then, the misuse detection means 607 receives a random number γ_Zfrom the party Z and random numbers γ′_Z,

$\begin{matrix} α Z 0 - \sum_{i, q} (s_{q_Z} \cdot a 0_{q_i}) and & [FORMULA 116] \\ β Z 0_{q} - s_{q_Z} \cdot b 0 & [FORMULA 117] \end{matrix}$

from the party X, computes

$\begin{matrix} (α Z 0 - \sum_{i, q} (s_{q_Z} \cdot a 0_{q_i})) \cdot b 2 + \sum_{q} {\begin{matrix} \sum_{i} (a 2_{q_i} (β Z 0_{q} - s_{q_Z} \cdot b 0)) + \\ s_{q_Z} \cdot c_{q_Z} \end{matrix}} - γ_{Z} + γ_{Z}^{'}, & [FORMULA 118] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₁and c_q_—₂if the computation result is 0 (S95).

Next, a processing performed by the party Z will be described. First, the second random number generation means 604 generates a random number ρ_Zand transmits the random number to the party X, and generates random numbers αY2 and βY2_qand transmits the random numbers to the party Y (S96). Then, the third computation means 605 computes random numbers

$\begin{matrix} α Y 2 - \sum_{i, q} (s_{q_Y} \cdot a 2_{q_i}), β Y 2_{q} - S_{q_Y} \cdot b 2 & [FORMULA 119] \end{matrix}$

transmits the random numbers to the party X, receives random numbers αZ0 and βZ0_qfrom the party X, computes a value γ_Zaccording to

$\begin{matrix} γ_{Z} = α Z 0 \cdot b 2 + \sum_{i, q} (a 2_{q_i} \cdot β Z 0_{q}) + ρ_{Z} & [FORMULA 136] \end{matrix}$

and transmits the value to the party Y (S97). Then, the fourth computation means 606 receives a random number ρ_Yfrom the party Y, computes a value γ′_Yaccording to

$\begin{matrix} γ_{Y}^{'} = - \sum_{q} (s_{q_Y} \cdot r_{q_Y}) + ρ_{Y} & [FORMULA 121] \end{matrix}$

and transmits the value to the party X (S98). Then, the misuse detection means 607 receives the value γ_Xfrom the party X and random numbers γ′_X,

$\begin{matrix} α X 1 - \sum_{i, q} (s_{q_X} \cdot a 1_{q_i}) and & [FORMULA 122] \\ β X 1_{q} - s_{q_X} \cdot b 1 & [FORMULA 123] \end{matrix}$

from the party Y, computes

$\begin{matrix} (α X 1 - \sum_{i, q} (s_{q_X} \cdot a 1_{q_i})) \cdot b 0 + \sum_{q} {\sum_{i} (a 0_{q_i} (β X 1_{q} - s_{q_X} \cdot b 1)) + s_{q_X} \cdot c_{q_X}} - γ_{X} + γ_{X}^{'}, & [FORMULA 124] \end{matrix}$

ends the processing by outputting data indicating a misuse detection if the computation result is not 0, and outputs values c_q_—₂and c_q_—₀if the computation result is 0 (S99). In the processing described above, hash values or other values can be substituted for the random numbers.

Ninth Embodiment

According to the sixth and seventh embodiments, two data strings A=(a_q_—₀, . . . , a_q_—_n-1) and B=(b_q_—₀, . . . , b_q_—_n-1) are divided into three fragment data strings A₀, A₁and A₂and B₀, B₁and B₂, respectively, in such a manner that the fragments satisfy conditions that A=A₀+A₁+A₂mod p and B=B₀+B₁+B₂mod p, the data strings A₀=(a0_q_—₀, . . . , a0_q_—_na0-1), A₁=(a1_q_—₀, . . . , a1_q_—_na1-1), B₀=(b0_q_—₀, . . . , b0_q_—_nb0-1) and B₁=(b1_q_—₀, . . . , b1_q_—_nb1-1) are supplied to the party X as values to be concealed, the data strings A₁, A₂=(a2_q_—₀, . . . , a2_q_—_na2-1), B₁and B₂=(b2_q_—₀, . . . , b2_q_—_nb2-1) are supplied to the party Y as values to be concealed, the data strings A₂, A₀, B₂and B₀are supplied to the party Z as valued to be concealed, and thus, the secure sum-of-product of these values expressed by the following formula can be securely computed by determining the value c_q_—₀+c_q_—₁+c_q_—₂from the values c_q_—₀and c_q_—₁, which are the results of the computation performed by the party X, the values c_q_—₁and c_q_—₂, which are the results of the computation performed by the party Y, and the values c_q_—₂and c_q_—₀, which are the results of the computation performed by the party Z.

$\begin{matrix} \sum_{q_i 0, q_j 0} (e 00_{q_i 0, q_j 0} \cdot a 0_{q_i 0} \cdot b 0_{q_j 0}) + \sum_{q_i 0, q_j 1} (e 01_{q_i 0, q_j 1} \cdot a 0_{q_i 0} \cdot b 1_{q_j 1}) + \sum_{q_i 1, q_j 0} (e 10_{q_i 1, q_j 0} \cdot a 1_{q_i 1} \cdot b 0_{q_j 0}) + \sum_{q_i 1, q_j 1} (e 11_{q_i 1, q_j 1} \cdot a 1_{q_i 1} \cdot b 1_{q_j 1}) + \sum_{q_i 1, q_j 2} (e 12_{q_i 1, q_j 2} \cdot a 1_{q_i 1} \cdot b 2_{q_j 2}) + \sum_{q_i 2, q_j 1} (e 21_{q_i 2, q_j 1} \cdot a 2_{q_i 2} \cdot b 1_{q_j 1}) + \sum_{q_i 2, q_j 2} (e 22_{q_i 2, q_j 2} \cdot a 2_{q_i 2} \cdot b 2_{q_j 2}) + \sum_{q_i 2, q_j 0} (e 20_{q_i 2, q_j 0} \cdot a 2_{q_i 2} \cdot b 0_{q_j 0}) + \sum_{q_i 0, q_j 2} (e 02_{q_i 0, q_j 2} \cdot a 2_{q_i 2} \cdot b 0_{q_i 0}) & [FORMULA 125] \end{matrix}$

Focusing on the six terms Σa0_q_—_i0·b1_q_—_j1, Σa1_q_—_i1·b0_q_—_j0, Σa1_q_—_i1·b2_q_—_j2, Σa2_q_—_i2·b1_q_—_j1, Σa2_q_—_i2·b0_q_—_j0and Σa0_q_—_i0·b2_q_—_j2in the above formula of the secure sum-of-product computation, one party has both the two fragment values of each term, another party has one of the two fragment values, and the remaining party has the other of the two fragment values. For example, concerning the fragment values a0_q_—_i0and b1_q_—_j1of the term Σa0_q_—_i0·b1_q_—_j1, the party X has both the fragment values a0_q_—_i0and b1_q_—_j1, the party Y has only the fragment value b1_q_—_j1, and the party Z has only the fragment value a0_q_—_i0. The same holds true for the term Σa1_q_—_i1·b0_q_—_j0. A secure sum-of-product computation system 900 according to a ninth embodiment implements a method of determining a sum-of-product of two fragment values in the case where any one of three parties has both the two fragment values, another of the three parties has one of the two fragment values, and the remaining one of the three parties has the other of the two fragment values, that is, a sum-of-product computation method on which the secure sum-of-product computation according to the sixth and seventh embodiments is based.

In the following, an example in which the party X has both the fragment values, the party Y has one of the two fragment values, and the party Z has the other of the two fragment values will be described. However, the computation can also be achieved in the same manner in the cases where the party Y has both the fragment values, the party X has one of the two fragment values, and the party Z has the other of the two fragment values and where the party Z has both the fragment values, the party X has one of the two fragment values, and the party Y has the other of the two fragment values.

FIG. 16 shows an example of a configuration of the secure sum-of-product computation system 900, and FIG. 17 shows an example of a flow of a processing performed by the secure sum-of-product computation system 900. The secure sum-of-product computation system 900 comprises a party X, a party Y and a party Z, which are computation apparatuses. The party X has party-X random number generation means 901 and party-X computation means 903, the party Y has party-Y random number generation means 902 and party-Y computation means 904, and the party Z has misuse detection means 905.

The secure sum-of-product computation system 900 performs a total of m sets of sum-of-product computations of data strings A_q_—₀=(a0_q_—₀, . . . , a0_q_—_na0-1) and A_q_—₁=(a1_q_—₀, . . . , a1_q_—_na1-1) and data strings B_q_—₀=(b0_q_—₀, . . . , b0_q_—_nb0-1) and B_q_—₁=(b1_q_—₀, . . . , b1_q_—_nb1-1) expressed as the following formula by cooperative computation by the three computation apparatuses, the parties X, Y and Z (i0=0, . . . , na0-1, i1=0, . . . , na1-1, j0=0, . . . , nb0-1, j1=0, . . . , nb1-1, na0, na1, nb0 and nb1 represent natural numbers, e01_q_—_i0,q_—_j1and e10_q_—_i1,q_—_j0represent any numbers, q=0, . . . , m−1, and m represents an integer equal to or greater than 1) (the computations are performed in parallel in the case where m is equal to or greater than 2).

$\begin{matrix} \sum_{q_i 0, q_j 1} (e 01_{q_i 0, q_j 1} \cdot a 0_{q_i 0} \cdot b 1_{q_j 1}) + \sum_{q_i 1, q_j 0} (e 10_{q_i 1, q_j 0} \cdot a 1_{q_i 1} \cdot b 0_{q_j 0}) & [FORMULA 126] \end{matrix}$

Data strings A_q_—₀, A_q_—₁, B_q_—₀and B_q_—₁are input to the party X, data strings A_q_—₁and B_q_—₁are input to the party Y, and data strings A_q_—₀and B_q_—₀are input to the party Z (S101).

First, the party-X random number generation means 901 in the party X generates random numbers c_q_—₁and γ₁and random number sequences (α1_q_—₀, . . . , α1_q_—_nb0-1) and (β1_q_—₀, . . . , β1_q_—_na0-1) and transmits the random numbers and the random number sequences to the party Y (S102). In addition, the party-Y random number generation means 902 in the party Y generates a random number s_qand transmits the random number to the party Z (S103).

Then, the party-X computation means 903 in the party X computes random numbers c_q_—₀and γ₀according to

$\begin{matrix} c_{q_0} = \sum_{q_i 0, q_j 1} (e 01_{q_i 0, q_j 1} \cdot a 0_{q_i 0} \cdot b 1_{q_j 1}) + \sum_{q_i 1, q_j 0} (e 10_{q_i 1, q_j 0} \cdot a 1_{q_i 1} \cdot b 0_{q_j 0}) - c_{q_1} γ_{0} = \sum_{i 0, j 0, q} (a 0_{q_i 0} \cdot b 1_{q_i 0} + b 0_{q_j 0} \cdot α 1_{q_j 0}) - γ_{1} & [FORMULA 127] \end{matrix}$

and transmits the random numbers to the party Z (S104).

In addition, the party-Y computation means 904 in the party Y receives the random numbers c_q_—₁and γ₁and the random number sequences (α1_q_—₀, . . . , α1_q_—_nb0-1) and (β1_q_—₀, . . . , β1_q_—_na0-1) from the party X, computes number sequences (α0_q_—₀, . . . , α0_q_—_nb0-1) and (β0_q_—₀, . . . , β0_q_—_na0-1) and a value γ′ according to

$\begin{matrix} α 0_{q_j 0} = \sum_{q, q_i 1} s_{q} \cdot e 10_{q_i 1, q_j 0} \cdot a 1_{q_i 1} - α 1_{q_j 0} β 0_{q_i 0} = \sum_{q, q_j 1} s_{q} \cdot e 01_{q_i 0, q_j 1} \cdot b 1_{q_j 1} - β 1_{q_i 0} γ^{'} = \sum_{q} s_{q} \cdot c_{q_1} - γ_{1}, & [FORMULA 128] \end{matrix}$

and transmits the number sequences and the value to the party Z (S105).

Then, the misuse detection means 905 in the party Z receives the random numbers c_q_—₀and γ₀from the party X and the random number s_q, the number sequences (α0_q_—₀, . . . , α0_q_—_nb0-1) and (β0_q_—₀, . . . , β0_q_—_na0-1) and the value γ′ from the party Y, computes

$\begin{matrix} \sum_{q} s_{q} \cdot c_{q_0} - γ_{0} - \sum_{i 0, j 0, q} (a 0_{q_i 0} \cdot β 0_{q_i 0} + b 0_{q_j 0} \cdot α 0_{q_j 0}) + γ^{'}, & [FORMULA 129] \end{matrix}$

and ends the processing by outputting data indicating a misuse detection if the computation result is not 0 (S106).

If the result of the computation by the misuse detection means 905 is 0, the party X outputs the random numbers c_q_—₀and c_q_—₁, the party Y outputs the random number c_q_—₁and 0, and the party Z outputs 0 and the random number c_q_—₀(S107). In the processing described above, hash values or other values can be substituted for the random numbers.

Tenth Embodiment

A tenth embodiment is a specific example of the ninth embodiment, in which na0=na1=na2=nb0=nb1=nb2=n, and e00=e01=e10=e11=e12=e21=e22=e20=e02=1. The configuration and the process flow are the same as those according to the ninth embodiment (an example of the configuration is shown in FIG. 16, and an example of the process flow is shown in FIG. 17). A secure sum-of-product computation system 910 according to the tenth embodiment performs a total of m sets of sum-of-product computations of data strings A_q_—₀=(α0_q_—₀, . . . , a0_q_—_n-1) and A_q_—₁=(a1_q_—₀, . . . , a1_q_—_n-1) and data strings B_q_—₀=(b0_q_—₀, . . . , b0_q_—_n-1) and B_q_—₁=(b1_q_—₀, . . . , b1_q_—_n-1) expressed as the following formula by cooperative computation by the three computation apparatuses, the parties X, Y and Z (i=0, . . . , n−1, n represents a natural number, q=0, . . . , m−1, and m represents an integer equal to or greater than 1) (the computations are performed in parallel in the case where m is equal to or greater than 2).

$\begin{matrix} \sum_{q_i} a 0_{q_i} \cdot b 1_{q_i} + \sum_{q_i} a 1_{q_i} \cdot b 0_{q_i} & [FORMULA 130] \end{matrix}$

First, the party-X random number generation means 901 in the party X generates random numbers c_q_—₁and γ₁and random number sequences (α1_q_—₀, . . . , α1_q_—_n-1) and (β1_q_—₀, . . . , β1_q_—_n-1) and transmits the random numbers and the random number sequences to the party Y (S102). In addition, the party-Y random number generation means 902 in the party Y generates a random number s_qand transmits the random number to the party Z (S103).

Then, the party-X computation means 903 in the party X computes random numbers c_q_—₀and γ₀according to

$\begin{matrix} c_{q_0} = \sum_{q_i} a 0_{q_i} \cdot b 1_{q_i} + \sum_{q_i} a 1_{q_i} \cdot b 0_{q_i} - c_{q_1} γ_{0} = \sum_{i, q} (a 0_{q_i} \cdot β 1_{q_i} + b 0_{q_i} \cdot α 1_{q_i}) - γ_{1} & [FORMULA 131] \end{matrix}$

and transmits the random numbers to the party Z (S104).

In addition, the party-Y computation means 904 in the party Y receives the random numbers c_q_—₁and γ₁and the random number sequences (α1_q_—₀, . . . , α1_q_—_n-1) and (β1_q_—₀, . . . , β1_q_—_n-1) from the party X, computes number sequences (α0_q_—₀, . . . , α0_q_—_n-1) and (β0_q_—₀, . . . , β0_q_—_n-1) and a value γ′ according to

$\begin{matrix} α 0_{q_i} = s_{q} \cdot a 1_{q_i} - α 1_{q_i} β 0_{q_i} = s_{q} \cdot b 1_{q_i} - β 1_{q_i} γ^{'} = \sum_{q} s_{q} \cdot c_{q_1} - γ_{1}, & [FORMULA 132] \end{matrix}$

and transmits the number sequences and the value to the party Z (S105).

Then, the misuse detection means 905 in the party Z receives the random numbers c_q_—₀and γ₀from the party X and the random number s_q, the number sequences (α0_q_—₀, . . . , α0_q_—_n-1) and (β0_q_—₀, . . . , β0_q_—_n-1) and the value γ′ from the party Y, computes

$\begin{matrix} \sum_{q} s_{q} \cdot c_{q_0} - γ_{0} - \sum_{i, q} (a 0_{q_i} \cdot β 0_{q_i} + b 0_{q_i} \cdot α 0_{q_i}) + γ^{'}, & [FORMULA 133] \end{matrix}$

and ends the processing by outputting data indicating a misuse detection if the computation result is not 0 (S106).

Eleventh Embodiment

A secure sum-of-product computation system 920 according to an eleventh embodiment is the secure sum-of-product computation system 910 according to the tenth embodiment that is improved so as to be able to more efficiently and securely perform the sum-of-product computation

$\begin{matrix} \sum_{q_i} a 0_{q_i} \cdot b 1_{q_i} + \sum_{q_i} a 1_{q_i} \cdot b 0_{q_i} & [FORMULA 134] \end{matrix}$

with one of the multipliers in each term being fixed regardless of the values i and q, that is,

$\begin{matrix} \sum_{q_i} a 0 \cdot b 1_{q_i} + \sum_{q_i} a 1 \cdot b 0_{q_i} . & [FORMULA 135] \end{matrix}$

The configuration and the process flow of the secure sum-of-product computation system 920 are the same as those according to the ninth and tenth embodiment (an example of the configuration is shown in FIG. 16, and an example of the process flow is shown in FIG. 17). However, data a0 and a1 and data strings B_q_—₀=(b0_q_—₀, . . . , b0_q_—_n-1) and B_q_—₁=(b1_q_—₀, . . . , b1_q_—_n-1) are input to the party X, the data a1 and the data string B_q_—₁are input to the party Y, and the data a0 and the data string B_q_—₀are input to the party Z (S101).

First, the party-X random number generation means 901 in the party X generates random numbers c_q_—₁and γ₁, a random number sequence (α1_q_—₀, . . . , a1_q_—_n-1) and a random number β1 and transmits the random numbers and the random number sequence to the party Y (S102).

In addition, the party-Y random number generation means 902 in the party Y generates a random number s_qand transmits the random number to the party Z (S103).

Then, the party-X computation means 903 in the party X computes random numbers c_q_—₀and γ₀according to

$\begin{matrix} c_{q_0} = \sum_{q_i} a 0 \cdot b 1_{q_i} + \sum_{q_i} a 1 \cdot b 0_{q_i} - c_{q_1} γ_{0} = a 0 \cdot β 1 + \sum_{i, q} b 0_{q_i} \cdot α 1_{q_i} - γ_{1} & [FORMULA 136] \end{matrix}$

and transmits the random numbers to the party Z (S104).

In addition, the party-Y computation means 904 in the party Y receives the random numbers c_q_—₁and γ₁, the random number sequence (α1_q_—₀, . . . , α1_q_—_n-1) and the random number β1 from the party X, computes a number sequence (α0_q_—₀, . . . , α0_q_—_n-1) and value β0 and γ′ according to

$\begin{matrix} α 0_{q_i} = \sum_{q} s_{q} \cdot a 1 - α 1_{q_i} β 0 = \sum_{i, q} s_{q} \cdot b 1_{q_i} - β 1 γ^{'} = \sum_{q} s_{q} \cdot c_{q_1} - γ_{1}, & [FORMULA 137] \end{matrix}$

and transmits the number sequence and the values to the party Z (S105).

Then, the misuse detection means 905 in the party Z receives the random numbers c_q_—₀and γ₀from the party X and the random number s_q, the number sequence (α0_q_—₀, . . . , α0_q_—_n-1) and the values β0 and γ′ from the party Y, computes

$\begin{matrix} \sum_{q} s_{q} \cdot c_{q_0} - γ_{0} - a 0 \cdot β 0 - \sum_{i, q} b 0_{q_i} \cdot α 0_{q_i} + γ^{'}, & [FORMULA 138] \end{matrix}$

and ends the processing by outputting data indicating a misuse detection if the computation result is not 0 (S106).

The processings in the secure sum-of-product computation methods according to the present invention performed by the secure sum-of-product computation systems according to the present invention described above can be performed not only sequentially in the order described above but also in parallel with each other or individually as required or depending on the processing power of the apparatus that performs the processings. The functions of components of the secure sum-of-product computation systems according to the present invention can be combined or divided as required. Furthermore, other various modifications can be appropriately made without departing form the spirit of the present invention. In the case where the secure sum-of-product computation systems according to the embodiments of the present invention are implemented by computers, the specific processings of the functions of the apparatuses and the components thereof are described in programs. The programs are stored in a hard disk drive, for example, and a required program or data is loaded into a random access memory (RAM) for execution. The computer implements the specific processing by the CPU executing the loaded program.

Number	Date	Country	Kind
2011-012126	Jan 2011	JP	national
2011-054965	Mar 2011	JP	national
2011-110635	May 2011	JP	national

Number	Name	Date	Kind
20090235085	Mathur	Sep 2009	A1
20100054458	Schneider	Mar 2010	A1
20100325443	Mattsson	Dec 2010	A1
20120166582	Binder	Jun 2012	A1

Secure sum-of-product computation method, secure sum-of-product computation system, computation apparatus and programs therefor

Information

Patent Number

Date Filed

Date Issued

Inventors

Original Assignees

Examiners

Agents

CPC

Field of Search

CPC

International Classifications

Term Extension

Abstract

Description

Claims

Priority Claims (3)

PCT Information

US Referenced Citations (4)

Non-Patent Literature Citations (2)

Related Publications (1)

Entry
Chida, K. et al., “A Three-Party Secure Function Evaluation with Lightweight verifiability Revisited”, Computer Security Symposium 2010, vol. 2010, No. 9, pp. 555-560, Oct. 12, 2010 ( with English abstract ).
International Search Report Issued Feb. 21, 2012 in PCT/JP12/051199 filed Jan. 20, 2012.