US 12,386,948 B2
Secure computation apparatus, secure computation system, secure computation method, and program
Hiroki Sudo, Musashino (JP); and Dai Ikarashi, Musashino (JP)
Assigned to NIPPON TELEGRAPH AND TELEPHONE CORPORATION, Tokyo (JP)
Appl. No. 18/565,091
Filed by NIPPON TELEGRAPH AND TELEPHONE CORPORATION, Tokyo (JP)
PCT Filed Jun. 4, 2021, PCT No. PCT/JP2021/021366
§ 371(c)(1), (2) Date Nov. 29, 2023,
PCT Pub. No. WO2022/254691, PCT Pub. Date Dec. 8, 2022.
Prior Publication US 2024/0273180 A1, Aug. 15, 2024
Int. Cl. G06F 21/52 (2013.01); G06F 21/71 (2013.01)
CPC G06F 21/52 (2013.01) [G06F 21/71 (2013.01); G06F 2221/034 (2013.01)] 5 Claims
OG exemplary drawing
 
1. A secure computation device that obtains a concealed operation result representing concealed information of an Intersect operation result between a first multiset X={{x0, . . . , xn−1}} and a second multiset Y={{y0, . . . , ym−1}} while concealing the first multiset X and the second multiset Y, the device comprising processing circuitry configured to:
(A) receive n first elements [x0], . . . , [xn−1] and m second elements [y0], . . . , [ym−1] as inputs, and obtain an input flagged sequence ([s], [M]) including a sequence [s]=([s0], . . . , [sn−1], [sn], . . . , [sn+m−1])=([B0], . . . , [B0], [B1], . . . , [B1]) including n first values [B0] and m second values [B1] and a sequence [M]=([M0], . . . , [Mn−1], [Mn], . . . , [Mn+m−1])=([x0], . . . , [xn−1], [y0], . . . , [ym−1]) including first elements [x0], . . . , [xn−1] and second elements [y0], . . . , [ym−1] in which Bo and Bi are different from each other, each first value [si]=[B0] is associated with each first element [Mi]=[xi], and each second value [sj+n]=[B1] is associated with each second element [Mj+n]=[yj], where n and m are positive integers, i=0, . . . , n−1, j=0, . . . , m−1, q=0, . . . , n+m−1, and [α] is concealed information of α;
(B) perform, by secure computation, stable sorting according to an order relation of content represented by each of elements M0, . . . , Mn+m−1 corresponding to the sequence [M] for the input flagged sequence ([s], [M]) while maintaining a correspondence between [sq] and [Mq], to obtain a sorted sequence ([s′], [M′]) including a sequence [s′]=([s′0], . . . , [s′n+m−1]) of sorted values [s′0], . . . , [s′n+m−1] and a sequence [M′]=([M′=0], . . . , [M′n+m−1]) of sorted elements [M′0], . . . , [M′n+m−1];
(C) obtains obtain a first equality check result [eqq] and a second equality check result [seqq] by secure computation using the sorted sequence ([s′], [M′]), where eqq=T when M′q=M′q+1 holds, eqq=F when M′q=M′q+1 does not hold, eqn+m−1=F, seqq=T when s′q=s′q+1 holds, seqq=F when s′q=s′q+1 does not hold, seqn+m−1=F, and T and F are different from each other;
(D) obtain an output flag [fq] by secure computation using the first equality check result [eqq] and the second equality check result [seqq], where, fq=D1 when “eqq=T and seqq=F” holds, fq=Do when “eqq=T and seqq=F” does not hold, and Di and Do are different from each other; and
(E) output the concealed operation result including the output flag and the sorted element [M′q] of the sequence [M′] associated with each other.