Patent Application
20240121075
The present invention relates to a similarity calculation system, similarity calculation apparatus, similarity calculation method, and similarity calculation program.
Homomorphic encryption is a cryptographic technique. When ciphertexts Enc(m1), Enc(m2) of plaintexts m1, m2 are given, homomorphic encryption allows a ciphertext Enc(m1∘m2) of a binary operation m1∘m2 of the plaintexts m1, m2 to be computed without the ciphertext Enc(m1∘m2) being decrypted back into the plaintexts m1, m2. Here, “∘” is a binary operation, such as addition “+” or multiplication “x.” Further, homomorphic encryption related to addition “+” is called additive homomorphic encryption. Homomorphic encryption is used as an underlying technology for various cryptographic protocols.
Similarity calculation is such a cryptographic protocol using homomorphic encryption. The following describes similarity calculation using a film recommendation service as an application of similarity calculation. In a film recommendation service, when it is determined whether or not a certain film M* suits the taste of a certain user Y, computation is performed to find another user whose ratings for films other than the film M* are similar to the user Y's. More specifically, the similarity between the user Y and another user Ui of the rating values for films M1, M2, . . . , Mn is calculated, and if the similarity is high, the users Y and Ui are determined to also have similar ratings for the film M*. As the similarity, Euclidean distance or cosine similarity may be used, and an important requirement is to calculate the similarity while keeping the rating values of each user confidential. Homomorphic encryption is used in such a case where computation is performed while keeping the subject of the computation secret (for instance, refer to Patent Literature 1).
The disclosure of the literature in Citation List above is incorporated herein in its entirety by reference thereto. The following analysis is given by the present inventors.
When designing a similarity measure, weighting is sometimes performed. For instance, if the similarity of the rating values for the film M1 is more important than that of the rating values for the film M2, the similarity of the rating values for each film is weighted for evaluation. The so-called “weighted Euclidean distance” is an example of weighted similarity. In such a case, it is possible to calculate the similarity, using additive homomorphic encryption, while keeping the rating values of each user confidential. This is because, in additive homomorphic encryption, even computation with respect to a scalar multiple of a plaintext can be performed without decrypting the ciphertext.
Meanwhile, if weighting is performed more elaborately, computation using additive homomorphic encryption presents some problems. For instance, the rating values of a single film may be weighted differently, depending on whether the rating values are similar and favorable or they are similar and unfavorable. More specifically, let's say films are rated on a 0-5 scale with “5” being most favorable. The differences between “0” and “1” and between “4” and “5” are both 1, however, the difference between “4” and “5,” which are more favorable ratings, can be reflected more strongly in similarity.
In such a case, performing weighted similarity calculation with additive homomorphic encryption is problematic. In additive homomorphic encryption, it is possible to perform computation without decrypting the ciphertext when the weight is a scalar multiple of the plaintext, however, in a case of a nonlinear weight (not a scalar multiple), computation cannot be performed within the scope of operations defined in additive homomorphic encryption.
In view of the problem above, it is an object of the present invention to provide a similarity calculation system, similarity calculation apparatus, similarity calculation method, and similarity calculation program that contribute to calculating nonlinearly weighted similarity without decrypting the ciphertext.
According to a first aspect of the present invention, there is provided a similarity calculation system calculating a distance between a first vector encrypted and stored in a similarity calculation apparatus and a second vector entered from an input terminal, wherein the similarity calculation apparatus transmits to the input terminal a ciphertext of each element of the first vector and a weighted distance table with respect to combinations of possible values of the elements of the first vector and possible values of the elements of the second vector, the input terminal refers to the weighted distance table to calculate a ciphertext of element distances for all combinations of the value of a single element of the second vector and possible values of elements of the first vector corresponding to the single element, calculates the ciphertexts of the sum of the element distances for each element of the second vector using additive homomorphic encryption, and transmits a ciphertext of the sum to the similarity calculation apparatus, and the similarity calculation apparatus extracts the distance between the first and the second vectors from the ciphertext of the sum.
According to a second aspect of the present invention, there is provided a similarity calculation apparatus calculating a distance between a first vector stored while being encrypted and a second vector entered from an input terminal, the similarity calculation apparatus transmitting to the input terminal a ciphertext of each element of the first vector and a weighted distance table with respect to combinations of possible values of the elements of the first vector and possible values of the elements of the second vector; having the input terminal refer to the weighted distance table to calculate a ciphertext of element distances for all combinations of the value of a single element of the second vector and possible values of elements of the first vector corresponding to the single element and receiving from the input terminal the ciphertext of the sum of the element distances calculated for each element of the second vector using additive homomorphic encryption; and extracting the distance between the first and the second vectors from the ciphertext of the sum.
According to a third aspect of the present invention, there is provided a similarity calculation method calculating a distance between a first vector encrypted and stored in a similarity calculation apparatus and a second vector entered from an input terminal, wherein the similarity calculation apparatus transmits to the input terminal a ciphertext of each element of the first vector and a weighted distance table with respect to combinations of possible values of the elements of the first vector and possible values of the elements of the second vector, the input terminal refers to the weighted distance table to calculate a ciphertext of element distances for all combinations of the value of a single element of the second vector and possible values of elements of the first vector corresponding to the single element, calculates the ciphertexts of the sum of the element distances for each element of the second vector using additive homomorphic encryption, and transmits the ciphertext of the sum to the similarity calculation apparatus, and the similarity calculation apparatus extracts the distance between the first and the second vectors from the ciphertext of the sum.
According to a fourth aspect of the present invention, there is provided a similarity calculation program causing a computer to calculate a distance between a first vector stored while being encrypted and a second vector entered from an input terminal, the similarity calculation program transmitting to the input terminal a ciphertext of each element of the first vector and a weighted distance table with respect to combinations of possible values of the elements of the first vector and possible values of the elements of the second vector; having the input terminal refer to the weighted distance table to calculate a ciphertext of element distances for all combinations of the value of a single element of the second vector and possible values of elements of the first vector corresponding to the single element and receiving from the input terminal the ciphertext of the sum of the element distances calculated for each element of the second vector using additive homomorphic encryption; and extracting the distance between the first and the second vectors from the ciphertext of the sum. Further, this program can be stored in a computer-readable storage medium. The storage medium may be a non-transient one such as a semiconductor memory, a hard disk, a magnetic recording medium, an optical recording medium, and the like. The present invention can also be realized as a computer program product.
According to each aspect of the present invention, it becomes possible to provide a similarity calculation system, similarity calculation apparatus, similarity calculation method, and similarity calculation program that contribute to calculating nonlinearly weighted similarity without decrypting the ciphertext.
Example embodiments of the present invention will be described with reference to the drawings. The present invention, however, is not limited to the example embodiments described below. Further, in each drawing, the same or corresponding elements are appropriately designated by the same reference signs. It should also be noted that the drawings are schematic, and the dimensional relationships and the ratios between the elements may differ from the actual ones. The dimensional relationships and the ratios between drawings may also be different in some sections.
The following describes a similarity calculation system relating to a first example embodiment with reference to
The similarity calculation system 100 relating to the first example embodiment shown in
Next, with reference to
In step S1, the similarity calculation apparatus 110 transmits to the input terminal a ciphertext of each element xi (i=1, . . . , n) of the first vector and a weighted distance table with respect to combinations of possible values (x1∈{0, 1, 2, S}) of the elements of the first vector and possible values (yi E {0, 1, 2, . . . , S}) of the elements of the second vector. An example of the weighted distance table with respect to combinations of possible values (x1∈{0, 1, 2, . . . , S}) of the elements of the first vector and possible values (yi ∈{0, 1, 2, . . . , S}) of the elements of the second vector when S=5 is shown below:
In step S2, the input terminal 120 refers to the weighted distance table and calculates a ciphertext of element distances for all combinations of the value of a single element of the second vector and possible values of elements of the first vector corresponding to this single element. Then, the input terminal 120 calculates the ciphertexts of the sum of the element distances for each element of the second vector using additive homomorphic encryption, and transmits a ciphertext of the calculated sum to the similarity calculation apparatus 110.
It should be noted that, since the input terminal 120 receives the ciphertext of each element xi (i=1, . . . , n) of the first vector as stated above, it cannot know the values of the elements of the first vector. Therefore, the input terminal 120 calculates a ciphertext of the element distances for all combinations of possible values of the elements of the first vector. More specifically, with each element in the weighted distance table being ai[xi][y1], the input terminal 120 calculates all of ai[0][yi], ai[1][yi], ai[2][yi], . . . , ai[S][yi] and encrypts the results.
Then, the input terminal 120 calculates the ciphertexts of the sum of the element distances using additive homomorphic encryption. The ciphertexts of the element distances calculated using the above method are for one element of the second vector, and the ciphertexts of the element distances obtained for all the elements of the second vector are summed. At this time, the input terminal 120 sums the ciphertexts without decrypting them using additive homomorphic encryption. In other words, the ciphertexts of all the element distances are summed with respect to the indices of the second vector (y1, y2, . . . , yn). Then, the input terminal 120 transmits the calculated sum to the similarity calculation apparatus 110.
In step S3, the similarity calculation apparatus 110 extracts the distance between the first and the second vectors from the ciphertext of the sum received from the input terminal 120. As can be seen from the calculation in the step S2, unnecessary information is included because the ciphertexts were calculated from the element distances with respect to all combinations with possible values of the elements of the first vector. The similarity calculation apparatus 110 extracts necessary information from the ciphertext of the sum received from the input terminal 120.
As described above, the similarity calculation system according to the first example embodiment is able to contribute to calculating nonlinearly weighted similarity without decrypting the ciphertext. Further, the similarity calculation system according to the first example embodiment can be implemented as a similarity calculation method, and the similarity calculation method according to the first example embodiment can be implemented as a program executed by an information processing apparatus (computer) with the hardware configuration described later.
The following describes a similarity calculation system relating to a second example embodiment with reference to
As shown in
In the similarity calculation system 200 relating to the second example embodiment shown in
Meanwhile, the elements of the second vector (y1, y2, yn) entered from the input terminal 220 are favorability rating values for each of the n films M1, M2, . . . , Mn, provided by a user of the film recommendation service. In other words, the distance between the first vector (x1, x2, . . . , xn) and the second vector (y1, y2, . . . , yn) indicates how close the taste of a rater who provided the first vector (x1, x2, . . . , xn) in film is to that of the user who provided the second vector (y1, y2, . . . , yn).
Therefore, the film recommendation service is implemented by selecting from the plurality of the first vectors (x1, x2, . . . , xn) stored in the similarity calculation apparatus 210 the one having the shortest distance to the second vector (y1, y2, . . . , yn) and transmitting the values linked to the selected first vector (x1, x2, . . . , xn) to the input terminal. Further, the values linked to the selected first vector (x1, x2, . . . , xn) may be rating values for films other than the n films M1, M2, . . . , Mn for which the rating values have been entered or the names of films other than the n films M1, M2, . . . , Mn for which the rating values have been entered.
The following describes the film recommendation service using nonlinearly weighted distances. As stated above, the non-linear weighting used here does not mean giving different constant weights to the elements of the first vector (x1, x2, . . . , xn) and the second vector (y1, y2, . . . , yn), but it means that the weight value varies according to the values of elements xi, yi (i=1, . . . , n). Therefore, the weight value varies according to the film rating values x1, y1 ∈{0, 1, 2, . . . , 5} in the film recommendation service. Film rating combinations (x1, y1)=(0, 1) and (x1, y1)=(4, 5) simply have the same difference “1” in rating value, but they are different in the sense that the ratings are close and favorable in one and close and unfavorable in the other. In the film recommendation service using nonlinearly weighted distances, it becomes possible to flexibly reflect such information in the film recommendation service.
The following describes the film recommendation service using nonlinearly weighted distances using a concrete example. The table below shows a second vector (y1, y2, y3, y4)=(2, 3, 4, 5) entered into the input terminal 220 by a user U0 of the film recommendation service, and a plurality of the first vectors stored in the similarity calculation apparatus 210: a first vector (x1, x2, x3, x4)=(5, 3, 5, 4) provided by a rater V1, a first vector (x1, x2, x3, x4)=(5, 4, 3, 0) provided by a rater V2, and a first vector (x1, x2, x3, x4)=(3, 3, 1, 2) provided by a rater V3.
In this example, distances are calculated using a weighted distance table (below) with respect to combinations of possible values (x1 ∈{0, 1, 2, . . . , 5}) of the elements of the first vector and possible values (yi ∈{0, 1, 2, . . . , 5}) of the elements of the second vector.
Then, the table below is obtained. Note that the entry notated as (5, 2) in the table below denotes Element (5, 2) in the weighted distance table.
In order to incorporate such nonlinearly weighted distances into a cryptographic protocol, the following computations are performed. Note that information encrypted here is the first vector (x1, x2, . . . , xn). In the film recommendation service, the first vector (x1, x2, . . . , xn) represents a rater's film preferences and should not be leaked to the outside.
The following first describes a process of registering the first vector (x1, x2, . . . , xn) in the similarity calculation apparatus 210.
With the inputs being the number n of films and the number Vmax of raters to be compared, a public parameter p is created, and a public key pk and a secret key sk are generated using a homomorphic encryption key generation algorithm. The public parameter p and the public key pk for homomorphic encryption are used in the registration process.
Here, (x1, x2, . . . , xn) are the rating values provided by a rater Vj (1≤j≤Vmax) for the films M1, M2, . . . , Mn. Each rater Vj enters xj∈{0, 1, 2, . . . , 5} (1≤j≤n) and then calculates a ciphertext ci,j=Enc(pk, 2xiN) of a rating value for each film M1. The ciphertext ci,j=Enc(pk, 2xiN) is transmitted to the similarity calculation apparatus 210 and the ciphertext ci,j is stored for each rater.
Further, each rater Vj may use the input terminal 220 as means for entering x1 ∈{0, 1, 2, . . . , 5} (1≤i≤n). Each rater V may be a past user of the film recommendation service, and his or her rating values after the film recommendation service has ended may be registered in the similarity calculation apparatus 210.
When a user U of the film recommendation service wants to estimate how likely he or she will like a film M*, the user U transmits information of the film M* to the similarity calculation apparatus 210.
In response to this, the similarity calculation apparatus 210 transmits to the input terminal 220 the ciphertext of each element of the first vector of each rater Vj and the weighted distance table with respect to combinations of possible values of the elements of the first vector and possible values of the elements of the second vector.
Meanwhile, the user U of the film recommendation service enters ratings for the films M1, M2, . . . , M˜ required to estimate how likely he or she will like the film M*. More specifically, the user U enters the second vector (y1, y2, . . . , yn). Note that, instead of having the user U enter the second vector (y1, y2, . . . , yn) when he or she uses the film recommendation service, the second vector (y1, y2, . . . , yn) may be entered into the input terminal 220 in advance.
The input terminal 220 calculates a ciphertext of the element distance using the ciphertext of each element of the first vector of each rater Vj received from the similarity calculation apparatus 210, the weighted distance table with respect to combinations of possible values of the elements of the first vector and possible values of the elements of the second vector, and the second vector (y1, y2, . . . , yn) entered by the user U.
The ciphertext of each element xi ∈{0, 1, 2, . . . , 5} (1≤i≤n) of the first vector (x1, x2, . . . , xn) of each rater Vj is encrypted by an encryption scheme that satisfies additive homomorphism and can be expressed by the following equation, for instance. Note that index i therein is an index assigned to each film M1 (1≤i≤n), and index j is an index assigned to each rater Vj (1≤j≤Vmax).
c
i,j
=Enc(pk,2x
Further, the table below shows an example of the weighted distance table with respect to combinations of possible values of the elements of the first vector and possible values of the elements of the second vector, and each element can be mathematically expressed as ai[xi][yi].
Therefore, using the second vector (y1, y2, . . . , yn) entered by the user U, a linear combination obtained by multiplying all combinations of the value yi of a single element of the second vector and possible values xi ∈{0, 1, 2, . . . , 5} (1≤i≤n) of the elements of the first vector corresponding to this single element by the weights can be stored by applying the linear combination to the ciphertext of each element of the first vector. More specifically, for instance, this ciphertext can be expressed as follows:
d
i,j=(ci,j)α
After the distance between the first and the second vectors is calculated, a random vector is created to mask the result other than the portion of the resultant score. By doing so, it is possible to prevent the information from leaking from parts other than the resultant score.
Then, the input terminal 220 calculates the sum of the ciphertexts di,j of the element distances with respect to the elements yi∈{0, 1, 2, . . . , 5} (1≤i≤n) of the second vector using additive homomorphic encryption. In other words, the input terminal 220 calculates the sum with respect to the index i using the rules of additive homomorphic encryption as in the following equation:
d
j=HomAdd(d1,j,d2,j, . . . ,di,j, . . . ,dn,j) [Math. 3]
Then, the input terminal 220 transmits the ciphertext dj to the similarity calculation apparatus 210.
The similarity calculation apparatus 210 extracts the distance between the first and the second vectors from the ciphertext dj received from the input terminal 220. As stated above, unnecessary information is included since the ciphertexts were calculated from the element distances with respect to all combinations with possible values of the elements of the first vector. The similarity calculation apparatus 210 extracts necessary information from the ciphertext of the sum received from the input terminal 120. The following describes the principle of this extraction method.
As can be seen from the description above, the ciphertexts ci,j and di,j store information in base-2 exponents. Therefore, according to the law of exponents, what we need to do is consider the calculation of exponents. Further, in terms of computer processing, the fact that information is stored in base-2 exponents corresponds to the problem of digits that store information when bit decomposition is performed. Then, the method for extracting necessary information from the ciphertext of the sum received comes down to a bit shift problem as follows:
αi[0][yi]·2(x
More specifically, one can see that the similarity calculation apparatus 210 needs to extract the 5N- to 6N-bit portion from the ciphertext of the sum received. In other words, the similarity calculation apparatus 210 decrypts the ciphertext of the sum received, extracts the 5N- to 6N-bit portion of the plaintext, and deems this portion to be the distance between the first and the second vectors.
The similarity calculation apparatus 210 performs the process described above for all the raters Vj (1≤j≤Vmax) and searches for the rater Vj with the shortest distance between the first and the second vectors. Then, the similarity calculation apparatus 210 transmits to the input terminal 220 the rating value given to the film M* by the rater Vj with the shortest distance between the first and the second vectors.
The user U of the film recommendation service is thus able to know how likely he or she will like the film M*.
As described above, since the similarity calculation system according to the second example embodiment can calculate nonlinearly weighted similarity without decrypting the ciphertext, it can be suitably applied to a film recommendation service. It goes without saying that the similarity calculation system according to the second example embodiment is not limited to a film recommendation service and can be applied to various recommendation services. Further, the applications of the similarity calculation system according to the second example embodiment are not limited to recommendation services and include various examples that involve calculating vector similarity.
An information processing apparatus (computer) employing the hardware configuration shown in
As shown in
The CPU 11 executes each instruction included in the similarity calculation program executed by the similarity calculation apparatuses 110 and 210. The primary storage device 12 is, for instance, a RAM (Random Access Memory) and temporarily stores various programs such as the similarity calculation program executed by the similarity calculation apparatuses 110 and 210 so that the CPU 11 can process the programs.
The auxiliary storage device 13 is, for instance, an HDD (Hard Disk Drive) and is capable of storing the various programs, such as the similarity calculation program executed by the similarity calculation apparatuses 110 and 210, in the medium to long term. The various programs such as the similarity calculation program may be provided as a program product stored in a non-transitory computer-readable storage medium. The auxiliary storage device 13 can be used to store the various programs such as the similarity calculation program stored in the non-transitory computer-readable storage medium in the medium to long term. The IF part 14 provides an interface to the input and output between the similarity calculation apparatuses 110 and 210 and the input terminals 120 and 220.
The information processing apparatus employing the hardware configuration 10 described above achieves the functions of the similarity calculation apparatuses 110 and 210 by executing the similarity calculation method described above as a program.
Some or all of the example embodiments above can be described as (but not limited to) the following Supplementary Notes.
A similarity calculation system calculating a distance between a first vector encrypted and stored in a similarity calculation apparatus and a second vector entered from an input terminal, wherein
The similarity calculation system according to Supplementary Note 1, wherein
The similarity calculation system according to Supplementary Note 2, wherein
c
i
=Enc(pk,2x
d
i=(ci)α
The similarity calculation system according to any one of Supplementary Notes 1 to 3, wherein a plurality of the first vectors are stored in the similarity calculation apparatus and the distances between the first and the second vectors are calculated for all the first vectors.
The similarity calculation system according to Supplementary Note 4, selecting from the plurality of the first vectors stored in the similarity calculation apparatus the one having the shortest distance to the second vector and transmitting the values linked to the selected first vector to the input terminal.
The similarity calculation system according to Supplementary Note 5, wherein the second vector entered from the input terminal is included as one of the plurality of the first vectors stored in the similarity calculation apparatus after the values linked to the selected first vector are transmitted to the input terminal.
The similarity calculation system according to Supplementary Note 6, wherein the input terminal transmits the second vector to the similarity calculation apparatus after encrypting the second vector using a public key published by the similarity calculation apparatus.
A similarity calculation apparatus calculating a distance between a first vector stored while being encrypted and a second vector entered from an input terminal, the similarity calculation apparatus:
A similarity calculation method calculating a distance between a first vector encrypted and stored in a similarity calculation apparatus and a second vector entered from an input terminal, wherein
A similarity calculation program causing a computer to calculate a distance between a first vector stored while being encrypted and a second vector entered from an input terminal, the similarity calculation program:
Further, the disclosure of Patent Literature cited above is incorporated herein in its entirety by reference thereto. It is to be noted that it is possible to modify or adjust the example embodiments or examples within the scope of the whole disclosure of the present invention (including the Claims) and based on the basic technical concept thereof. Further, it is possible to variously combine or select (or partially omit) a wide variety of the disclosed elements (including the individual elements of the individual claims, the individual elements of the individual example embodiments or examples, and the individual elements of the individual figures) within the scope of the whole disclosure of the present invention. That is, it is self-explanatory that the present invention includes any types of variations and modifications to be done by a skilled person according to the whole disclosure including the Claims and the technical concept of the present invention. Particularly, any numerical ranges disclosed herein should be interpreted that any intermediate values or subranges falling within the disclosed ranges are also concretely disclosed even without specific recital thereof. In addition, using some or all of the disclosed matters in the literature cited above as necessary, in combination with the matters described herein, as part of the disclosure of the present invention in accordance with the object of the present invention shall be considered to be included in the disclosed matters of the present application.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2021/004898 | 2/10/2021 | WO |
