Nippon Telegraph and Telephone Corporation

Tohoku University

Koji Chida

Dai Ikarashi

Koki Hamada

Ryo Kikuchi

Satoshi Hasegawa

Tetsuya Okuda

Hikaru Morita

Kunio Kobayashi

Gembu Morohashi

Masao Nagasaki

Kazuharu Misawa

Hitoshi Fuji

Katsumi Takahashi

Ryohei Suzuki

Naoto Kiribuchi

Hiroyoshi Takiguchi

Satoshi Tanaka

Yuichiro Dan

Teruko Miyata

Shigeru Kayaguchi

A program execution system includes a data holding apparatus, a program providing apparatus, and a data processing apparatus that performs computing in a secure region. The data holding apparatus transmits encrypted data, encrypted with a first common key, to the data processing apparatus, and the program providing apparatus transmits an encrypted program, encrypted with a second common key, to the data processing apparatus. In the secure region, the data processing apparatus acquires data by decrypting the encrypted data with the first common key, acquires a program by decrypting the encrypted program with the second common key, executes the program for the data, and encrypts a result of the execution with a public key of the data holding apparatus or the first common key. The data holding apparatus acquires the result of the execution by decrypting the encrypted result of the execution with a secret key or the first common key.

Program execution system, data processing apparatus, program execution method and program

An information processing apparatus includes a secure area configured to execute a program in secret, and a security chip. The secure area conceals information related to the program, and requests the security chip to provide a blind signature with respect to the concealed information obtained by the concealing. The security chip calculates the blind signature and returns the blind signature to the secure area. The secure area acquires a signature with respect to the information related to the program from the blind signature.

Information processing apparatus, program execution system, information processing method and program

A share generating device obtains N seeds s, . . . , s, obtains a function value y=g(x, e)∈Fof plaintext x∈Fand a function value e, and obtains information containing a member yand N−1 seeds s, where d∈{0, . . . , N−1} and d≠i, as a share SSof the plaintext x in secret sharing and outputs the share SS. It is to be noted that the function value y is expressed by members y∈F, . . . , y∈Fwhich satisfy m=m(0)+ . . . +m(N−1).

Share generating device, share converting device, secure computation system, share generation method, share conversion method, program, and recording medium

A share [x]of plaintext x in accordance with Shamir's secret sharing scheme is expressed by N shares [x], . . . , [x], and each share generating device Aobtains a function value r=P(s) of a seed s, obtains a first calculated value &#x3b6;=&#x3bb;(i, i(&#x2212;))[x]+rusing a Lagrange coefficient &#x3bb;(i, i(&#x2212;)), a share [x], and the function value r, and outputs the first calculated value &#x3b6;to a share generating device A. Each share generating device Aaccepts a second calculated value &#x3b6;, obtains a third calculated value z=&#x3bb;(i, i(+))[x]+&#x3b6;using a Lagrange coefficient &#x3bb;(i, i(+)), a share [x], and the second calculated value &#x3b6;, and obtains information containing the seed sand the third calculated value zas a share SSof the plaintext x in secret sharing and outputs the share SS.

Share generating device, reconstructing device, secure computation system, share generation method, reconstruction method, program, and recording medium

A Fisher's exact test calculation apparatus includes: a condition storagethat has stored therein a condition for determining whether a result of Fisher's exact test corresponding to input is significant or not, the input being frequencies in a summary table; and a calculation unitthat obtains the result of Fisher's exact test corresponding to the frequencies in the summary table by inputting the frequencies in the summary table to the condition read from the condition storage

Fisher's exact test calculation apparatus, method, and program

A secret computation system is a secret computation system for performing computation while keeping data concealed, and comprises a cyphertext generation device that generates cyphertext by encrypting the data, a secret computation device that generates encrypted basic statistics by performing secret computation of predetermined basic statistics using the cyphertext while keeping the cyphertext concealed, and a computation device that generates decrypted basic statistics by decrypting the encrypted basic statistics and performs predetermined computation using the decrypted basic statistics.

Secret computation system and method

The present invention provides a technique for performing confidential sort at a faster speed than in the prior art. A confidential sort system comprises first to Mth apparatuses. The first to Mth apparatuses obtain inverse substitution [[&#x3c3;]] of L-bit stable sort of {k}. The first to Mth apparatuses perform, on i=1, . . . , N&#x2212;1, a process of converting [[&#x3c3;]] to hybrid substitution to obtain {&#x3c3;}, a process of inversely substituting {k} with {&#x3c3;} to obtain {&#x3c3;k}, a process of obtaining inverse substitution [[&#x3c3;']] of L-bit stable sort of [[&#x3c3;k]], a process of synthesizing {&#x3c3;} with [[&#x3c3;&#x2032;]] to obtain [[&#x3c3;]]:=[[&#x3c3;&#x3c3;&#x2032;]], and a process of converting [[&#x3c3;]] to hybrid substitution to obtain {&#x3c3;}. The first to Mth apparatuses inversely substitute [[v]] with {&#x3c3;} and output [[&#x3c3;v]].

Confidential sort system and method

Pand Phave stored a&#x2208;{a, a, a} and b&#x2208;{b, b, b} therein, and Pand Phave stored a&#x2208;Aand b&#x2208;Btherein. Here, P&#x2212;P, P=P, and a and b are arbitrary values and satisfy a=a+a+aand b=b+b+b, where Ais a complement of ain {a, a, a} and Bis a complement of bin {b, b, b}. Pand Pshare r, Pand Pshare r, and Pcalculates c=(a+a)(b+b)&#x2212;ab+r&#x2212;r. Psends cto P.

Secure computation system, secure computation apparatus, secure computation method, and recording medium

A share generating device obtains N seeds s, . . . , s, obtains a function value y=g(x, e)&#x2208;Fof plaintext x&#x2208;Fand a function value e, and obtains information containing a member yand N&#x2212;1 seeds s, where d&#x2208;{0, . . . , N&#x2212;1} and d&#x2260;i, as a share SSof the plaintext x in secret sharing and outputs the share SS. It is to be noted that the function value y is expressed by members y&#x2208;F, . . . , y&#x2208;F, which satisfy m=m(0)+ . . . +m(N&#x2212;1).

A secure computation device obtains a first concealed verification value [z]=[w&#x2212;&#x3c9;]with secure computation by using concealed authentication information [w]which is preliminarily stored and concealed authentication information [&#x3c9;]which is inputted, obtains a concealed extension field random number [r]&#x2208;[F] which is a secret sharing value of an extension field random number r, obtains a second concealed verification value [y]in which yis concealed with secure computation by using the first concealed verification value [z], and obtains a third concealed verification value [ry]with secure computation by using the concealed extension field random number [r]and the second concealed verification value [y]and outputs the third concealed verification value [ry].

Secure computation device, secure computation authentication system, secure computation method, and program

Fisher's exact test is efficiently computed through secure computation. It is assumed that a, b, c and d are frequencies of a 2&#xd7;2 contingency table, [a], [b], [c] and [d] are secure texts of the respective frequencies a, b, c and d, and N is an upper bound satisfying a+b+c+dN. A reference frequency computation part computes a secure text ([a], [b], [c], [d]) of a combination of reference frequencies (a, b, c, d) which are integers satisfying a+b=a+b, c+d=c+d, a+c=a+c, and b+d=b+d. A number-of-patterns determination part determines integers hand hsatisfying h&#x2264;h. A pattern computation part computes [ai]=[a]+i, [b]=[b]&#x2212;i, [c]=[c]&#x2212;i and [d]=[d]+i for i=h, . . . , h, and obtains a set S={([a], [b], [c], [d])}of secure texts of combinations of frequencies (a, b, c, d).

Secure computation system, secure computation device, secure computation method, and program

An efficient share recovery technique for Shamir's secret sharing is provided. n share recovery apparatuses p, . . . , pgenerate a share [r]of a secretly shared value shared through Shamir's secret sharing, which becomes a random number r when restored. k share recovery apparatuses &#x3c3;, . . . , &#x3c3;calculate a share [b]by subtracting the share [r]from a share [a]. The share recovery apparatus &#x3c4;receives the shares [b], . . . , [b]from the share recovery apparatuses &#x3c3;, . . . , &#x3c3;. The share recovery apparatus &#x3c4;recovers shares [b], . . . , [b]using the shares [b], . . . , [b]. m&#x2212;1 share recovery apparatuses &#x3c4;, . . . , &#x3c4;receive a share [b]from the share recovery apparatus &#x3c4;. m share recovery apparatuses &#x3c4;, . . . , &#x3c4;calculate the share [a]by adding the share [r]to the share [b].

Share recovery system, share recovery apparatus, share recovery method, and program

A secret share value of object data on which secure computation is to be performed is stored in a secure computation device, and a query which requests secure computation or secret share value of the query is input to the secure computation device. The secure computation device performs consistency verification of the secret share value of the object data and consistency verification of the query or the secret share value of the query, obtains a secret share value of a calculation result by performing secure computation in accordance with the query or the secret share value of the query which passed the consistency verification by using the secret share value of the object data which passed the consistency verification, and outputs the secret share value of the calculation result.

A secret sharing value of a value represented by a 'first target bit string' is used to obtain a secret sharing value of a value represented by a 'first check bit string' obtained by setting a value of the most significant bit of the &#x201c;first target bit string&#x201d; to a value of a &#x201c;first check bit&#x201d; that is lower than the most significant bit. Here, the &#x201c;first target bit string&#x201d; corresponds to a null value when the most significant bit is 1 and corresponds to a real number when the most significant bit is 0. Next, the secret sharing value of the value represented by the &#x201c;first check bit string&#x201d; is used to obtain secret sharing values of bit values of the least significant bit to &#x201c;first check bit&#x201d; of the &#x201c;first check bit string&#x201d;.

Secure computation apparatus, secure computation method and program

An inconsistency in shares is detected with a small volume of communications traffic. n inconsistency detecting devices generate random numbers sand make the random numbers spublic. The n inconsistency detecting devices generate a common random number s which is the sum total of the random numbers s, . . . , s. The n inconsistency detecting devices calculate shares [c]. The n inconsistency detecting devices generate shares [r], each of which would become a random number r by reconstruction. The n inconsistency detecting devices calculate shares [d], each of which would become a judgment value d by reconstruction. One inconsistency detecting device receives shares [d], . . . , [d]from n&#x2212;1 inconsistency detecting devices. The one inconsistency detecting device restores n&#x2212;k shares [d]', . . . , [d]&#x2032;from k shares [d], . . . , [d]. The one inconsistency detecting device judges, for j=k, . . . , n&#x2212;1, whether or not a share [d]and a share [d]&#x2032;coincide with each other.

Growing community of inventors

Musashino, Japan

Koji Chida