Homomorphic inference device, homomorphic inference method, computer readable medium, and privacy-preserving information processing system

Abstract

A range determination unit (412) takes as input an input ciphertext C.sub.i resulting from encrypting input data, determines whether a value obtained from the input data is within a reference range, and generates a range ciphertext a.sub.j depending on a determined result. A result generation unit (413) performs a homomorphic operation on the range ciphertext a.sub.j generated by the range determination unit (412), so as to generate a result ciphertext D of a result of performing inference including a non-polynomial operation on the input data. An output unit (414) outputs the result ciphertext D.

Claims

1. A homomorphic inference device comprising: processing circuitry executing an intermediate layer of a neural network performing recognition on an encrypted message, wherein in performing the recognition, the processing circuitry is configured to: take as input an input ciphertext resulting from encrypting input data, determine whether a value obtained from the input data is greater than 0, generate a ciphertext resulting from encrypting 1 as a range ciphertext when the value obtained from the input data is greater than 0, and generate a ciphertext resulting from encrypting 0 as the range ciphertext when the value obtained from the input data is equal to or less than 0; and perform a homomorphic operation of computing a product of the generated range ciphertext and a ciphertext of the value obtained from the input data, so as to generate a result ciphertext of a result of computing a rectified linear unit (ReLU) function, wherein the processing circuitry generates a.sub.j, which is the range ciphertext, as indicated in Formula 1, and generates D, which is the result ciphertext, as indicated in Formula 2 $\begin{matrix} for i = 1, .Math., n A_{i} := {\begin{matrix} C_{i} G^{- 1} (A_{i - 1}) & if w_{i} = 1 \\ {SwitchKey}_{{KS}^{s (1 / X) .fwdarw. s (x)}} (C_{i} (1 / X)) G^{- 1} (A_{i - 1}) & otherwise \end{matrix}, for j = 0, .Math., L - 1 a_{i} := SampleExtract (A_{n} G^{- 1} (t_{j} (X), 0) & [Formula 1] \end{matrix}$ where n is an integer of 1 or more, C.sub.i is an input ciphertext resulting from encrypting input data x.sub.i, X is a variable constituting a polynomial of a polynomial ring in the ring variant of Gentry-Sahai-Waters (RGSW) encryption, G is a tensor product of g and I.sub.2 G.sup.−1 is a process to convert each integer element of a matrix into a binary representation, g:=(1, 2, 2.sup.2, . . . , 2.sup.L−1), L is a minimum integer equal to or more than log q, q is a positive integer, I.sub.2 is a 2×2 identity matrix, and w.sub.i is weight data in a neural network
[Formula 2]
for j=0, . . . ,L−1),
a′.sub.j,k:=SwitchKey.sub.KS.sub.s.fwdarw.s(a.sub.j),
A′:=(a′.sub.j,k).sub.j=0, . . . ,L−1;k=0,1,
D:=A′G.sup.−1(A.sub.n) where A′ is the range ciphertext, and D is the result ciphertext.

2. A homomorphic inference device comprising: processing circuitry executing an intermediate layer of a neural network performing recognition on an encrypted message, wherein in performing the recognition, the processing circuitry is configured to: take as input an input ciphertext resulting from encrypting input data, determine whether a value obtained from the input data is greater than 0, generate a ciphertext resulting from encrypting 1 as a range ciphertext when the value obtained from the input data is greater than 0, and generate a ciphertext resulting from encrypting 0 as the range ciphertext when the value obtained from the input data is equal to or less than 0; and perform a homomorphic operation of computing a sum of a product of a ciphertext resulting from encrypting 1 and the range ciphertext and a product of a ciphertext resulting from encrypting −1 and a value obtained by subtracting the range ciphertext from the ciphertext resulting from encrypting 1, so as to generate a result ciphertext of a result of computing a Sign function that takes as input an integer and outputs a sign of the integer, wherein the processing circuitry generates ai, which is the range ciphertext, as indicated in Formula 3, and generates D, which is the result ciphertext, as indicated in Formula 4 $\begin{matrix} for i = 1, .Math., n & [Formula 3] \end{matrix}$ $A_{i} := {\begin{matrix} C_{i} G^{- 1} (A_{i - 1}) & if w_{i} = 1 \\ {SwitchKey}_{K S^{s (1 / X) .fwdarw. s (x)}} (C_{i} (1 / X)) G^{- 1} (A_{i - 1}) & otherwise \end{matrix},$ $for j = 0, .Math., L - 1$ $a_{i} := SampleExtract (A_{n} G^{- 1} (t_{j} (X), 0)$ where n is an integer of 1 or more, Ci is an input ciphertext resulting from encrypting input data xi, X is a variable constituting a polynomial of a polynomial ring in the ring variant of Gentry-Sahai-Waters (RGSW) encryption, G is a tensor product of g and I.sub.2, G.sup.−1 is a process to convert each integer element of a matrix into a binary representation,
g:=(1,2,2.sup.2, . . . ,2.sup.L−1), L is a minimum integer equal to or more than log q, g is a positive integer, I.sub.2 is a 2×2 identity matrix, and w.sub.i is weight data in a neural network
[Formula 4]
for j=0, . . . ,L−1),
a′.sub.j,k:=SwitchKey.sub.KS.sub.s.fwdarw.s(a.sub.j),
A′:=(a′.sub.j,k).sub.j=0, . . . ,L−1;k=0,1,
D:=X.Math.GG.sup.−1(A′)+X.sup.−1G.sup.−1GG.sup.−1(A′) where A′ is the range ciphertext, and D is the result ciphertext.

3. A homomorphic inference method, wherein the method executes an intermediate layer of a neural network performing recognition on an encrypted image, and wherein, in performing the recognition, the method comprises: taking as input an input ciphertext resulting from encrypting input data, determining whether a value obtained from the input data is greater than 0, generating a ciphertext resulting from encrypting 1 as a range ciphertext when the value obtained from the input data is greater than 0, and generating a ciphertext resulting from encrypting 0 as the range ciphertext when the value obtained from the input data is equal to or less than 0; and performing a homomorphic operation of computing a product of the range ciphertext and a ciphertext of the value obtained from the input data, so as to generate a result ciphertext of a result of computing a rectified linear unit (ReLU) function, wherein the processing circuitry generates a.sub.j, which is the range ciphertext, as indicated in Formula 1, and generates D, which is the result ciphertext, as indicated in Formula 2 $\begin{matrix} for i = 1, .Math., n & [Formula 1] \end{matrix}$ $A_{i} := {\begin{matrix} C_{i} G^{- 1} (A_{i - 1}) & if w_{i} = 1 \\ {SwitchKey}_{K S^{s (1 / X) .fwdarw. s (x)}} (C_{i} (1 / X)) G^{- 1} (A_{i - 1}) & otherwise \end{matrix},$ $for j = 0, .Math., L - 1$ $a_{i} := SampleExtract (A_{n} G^{- 1} (t_{j} (X), 0)$ where n is an integer of 1 or more, C.sub.i is an input ciphertext resulting from encrypting input data x.sub.i, X is a variable constituting a polynomial of a polynomial ring in the ring variant of Gentry-Sahai-Waters (RGSW) encryption, G is a tensor product of g and I.sub.2, G.sup.−1 is a process to convert each integer element of a matrix into a binary representation, g:=(1, 2, 2.sup.2, . . . , 2.sup.L−1), L is a minimum integer equal to or more than log q, q is a positive integer, I.sub.2 is a 2×2 identity matrix, and w.sub.i is weight data in a neural network
[Formula 2]
for j=0, . . . ,L−1),
a′.sub.j,k:=SwitchKey.sub.KS.sub.s.fwdarw.s(a.sub.j),
A′:=(a′.sub.j,k).sub.j=0, . . . ,L−1;k=0,1,
D:=A′G.sup.−1(A.sub.n) where A′ is the range ciphertext, and D is the result ciphertext.

4. A homomorphic inference method, wherein the method executes an intermediate layer of a neural network performing recognition on an encrypted image, and wherein, in performing the recognition, the method comprises: comprising: taking as input an input ciphertext resulting from encrypting input data, determining whether a value obtained from the input data is greater than 0, generating a ciphertext resulting from encrypting 1 as a range ciphertext when the value obtained from the input data is greater than 0, and generating a ciphertext resulting from encrypting 0 as the range ciphertext when the value obtained from the input data is equal to or less than 0; and performing a homomorphic operation of computing a sum of a product of a ciphertext resulting from encrypting 1 and the range ciphertext and a product of a ciphertext resulting from encrypting −1 and a value obtained by subtracting the range ciphertext from the ciphertext resulting from encrypting 1, so as to generate a result ciphertext of a result of computing a Sign function that takes as input an integer and outputs a sign of the integer wherein the processing circuitry generates a.sub.j, which is the range ciphertext, as indicated in Formula 3, and generates D, which is the result ciphertext, as indicated in Formula 4 $\begin{matrix} for i = 1, .Math., n & [Formula 3] \end{matrix}$ $A_{i} := {\begin{matrix} C_{i} G^{- 1} (A_{i - 1}) & if w_{i} = 1 \\ {SwitchKey}_{K S^{s (1 / X) .fwdarw. s (x)}} (C_{i} (1 / X)) G^{- 1} (A_{i - 1}) & otherwise \end{matrix},$ $for j = 0, .Math., L - 1$ $a_{i} := SampleExtract (A_{n} G^{- 1} (t_{j} (X), 0)$ where n is an integer of 1 or more, C.sub.i is an input ciphertext resulting from encrypting input data x.sub.i, X is a variable constituting a polynomial of a polynomial ring in the ring variant of Gentry-Sahai-Waters (RGSW) encryption, G is a tensor product of g and I.sub.2, G.sup.−1 is a process to convert each integer element of a matrix into a binary representation, g:=(1, 2, 2.sup.2, . . . , 2.sup.L−1), L is a minimum integer equal to or more than log q, q is a positive integer, I.sub.2 is a 2×2 identity matrix, and w.sub.i is weight data in a neural network
[Formula 4]
for j=0, . . . ,L−1),
a′.sub.j,k:=SwitchKey.sub.KS.sub.s.fwdarw.s(a.sub.j),
A′:=(a′.sub.j,k).sub.j=0, . . . ,L−1;k=0,1,
D:=X.Math.GG.sup.−1(A′)+X.sup.−1G.sup.−1GG.sup.−1(A′) where A′ is the range ciphertext, and D is the result ciphertext.

5. A non-transitory computer readable medium storing a homomorphic inference program for causing a computer to execute an intermediate layer of a neural network performing recognition on an encrypted message, wherein in performing the recognition, the program causes the computer to execute: a range determination process to take as input an input ciphertext resulting from encrypting input data, determine whether a value obtained from the input data is greater than 0, generate a ciphertext resulting from encrypting 1 as a range ciphertext when the value obtained from the input data is greater than 0, and generate a ciphertext resulting from encrypting 0 as the range ciphertext when the value obtained from the input data is equal to or less than 0; and a result generation process to perform a homomorphic operation of computing a product of the range ciphertext generated by the range determination process and a ciphertext of the value obtained from the input data, so as to generate a result ciphertext of a result of computing a rectified linear unit (ReLU) function, wherein the processing circuitry generates a.sub.j, which is the range ciphertext, as indicated in Formula 1, and generates D, which is the result ciphertext, as indicated in Formula 2 $\begin{matrix} for i = 1, .Math., n & [Formula 1] \end{matrix}$ $A_{i} := {\begin{matrix} C_{i} G^{- 1} (A_{i - 1}) & if w_{i} = 1 \\ {SwitchKey}_{K S^{s (1 / X) .fwdarw. s (x)}} (C_{i} (1 / X)) G^{- 1} (A_{i - 1}) & otherwise \end{matrix},$ $for j = 0, .Math., L - 1$ $a_{i} := SampleExtract (A_{n} G^{- 1} (t_{j} (X), 0)$ where n is an integer of 1 or more, C.sub.i is an input ciphertext resulting from encrypting input data x.sub.i, X is a variable constituting a polynomial of a polynomial ring in the ring variant of Gentry-Sahai-Waters (RGSW) encryption, G is a tensor product of g and I.sub.2, G.sup.−1 is a process to convert each integer element of a matrix into a binary representation, g:=(1, 2, 2.sup.2, . . . , 2.sup.L−1), L is a minimum integer equal to or more than log q, q is a positive integer, I.sub.2 is a 2×2 identity matrix, and w.sub.i is weight data in a neural network
[Formula 2]
for j=0, . . . ,L−1),
a′.sub.j,k:=SwitchKey.sub.KS.sub.s.fwdarw.s(a.sub.j),
A′:=(a′.sub.j,k).sub.j=0, . . . ,L−1;k=0,1,
D:=A′G.sup.−1(A.sub.n) where A′ is the range ciphertext, and D is the result ciphertext.

6. A non-transitory computer readable medium storing a homomorphic inference program for causing a computer to execute an intermediate layer of a neural network performing recognition on an encrypted message, wherein in performing the recognition, the program causes the computer to execute: a range determination process to take as input an input ciphertext resulting from encrypting input data, determine whether a value obtained from the input data is greater than 0, generate a ciphertext resulting from encrypting 1 as a range ciphertext when the value obtained from the input data is greater than 0, and generate a ciphertext resulting from encrypting 0 as the range ciphertext when the value obtained from the input data is equal to or less than 0; and a result generation process to perform a homomorphic operation of computing a sum of a product of a ciphertext resulting from encrypting 1 and the range ciphertext and a product of a ciphertext resulting from encrypting −1 and a value obtained by subtracting the range ciphertext from the ciphertext resulting from encrypting 1, so as to generate a result ciphertext of a result of computing a Sign function that takes as input an integer and outputs a sign of the integer, wherein the processing circuitry generates a.sub.j, which is the range ciphertext, as indicated in Formula 3, and generates D, which is the result ciphertext, as indicated in Formula 4 $\begin{matrix} for i = 1, .Math., n & [Formula 3] \end{matrix}$ $A_{i} := {\begin{matrix} C_{i} G^{- 1} (A_{i - 1}) & if w_{i} = 1 \\ {SwitchKey}_{K S^{s (1 / X) .fwdarw. s (x)}} (C_{i} (1 / X)) G^{- 1} (A_{i - 1}) & otherwise \end{matrix},$ $for j = 0, .Math., L - 1$ $a_{i} := SampleExtract (A_{n} G^{- 1} (t_{j} (X), 0)$ where n is an integer of 1 or more, C.sub.i is an input ciphertext resulting from encrypting input data x.sub.i, X is a variable constituting a polynomial of a polynomial ring in the ring variant of Gentry-Sahai-Waters (RGSW) encryption, G is a tensor product of g and I.sub.2, G.sup.−1 is a process to convert each integer element of a matrix into a binary representation, g:=(1, 2, 2.sup.2, . . . , 2.sup.L−1), L is a minimum integer equal to or more than log q, q is a positive integer, I.sub.2 is a 2×2 identity matrix, and w.sub.i is weight data in a neural network
[Formula 4]
for j=0, . . . ,L−1),
a′.sub.j,k:=SwitchKey.sub.KS.sub.s.fwdarw.s(a.sub.j),
A′:=(a′.sub.j,k).sub.j=0, . . . ,L−1;k=0,1,
D:=X.Math.GG.sup.−1(A′)+X.sup.−1G.sup.−1GG.sup.−1(A′) where A′ is the range ciphertext, and D is the result ciphertext.

7. A privacy-preserving information processing system comprising: an encryption device to encrypt input data to generate an input ciphertext; a homomorphic inference device to take as input the input ciphertext generated by the encryption device, and generate a result ciphertext of a result of computing a rectified linear unit (ReLU) function; and a decryption device to decrypt the result ciphertext generated by the homomorphic inference device, so as to generate result data indicating the result, wherein the homomorphic inference device includes processing circuitry to: take as input the input ciphertext, determine whether a value obtained from the input data is greater than 0, generate a ciphertext resulting from encrypting 1 as a range ciphertext when the value obtained from the input data is greater than 0, and generate a ciphertext resulting from encrypting 0 as the range ciphertext when the value obtained from the input data is equal to or less than 0; and perform a homomorphic operation of computing a product of the generated range ciphertext and a ciphertext of the value obtained from the input data, so as to generate the result ciphertext, and wherein the homomorphic operation is utilized as a function of an intermediate layer of a neural network performing recognition on an encrypted image, and wherein the processing circuitry generates a.sub.j, which is the range ciphertext, as indicated in Formula 1, and generates D, which is the result ciphertext, as indicated in Formula 2 $\begin{matrix} for i = 1, .Math., n & [Formula 1] \end{matrix}$ $A_{i} := {\begin{matrix} C_{i} G^{- 1} (A_{i - 1}) & if w_{i} = 1 \\ {SwitchKey}_{K S^{s (1 / X) .fwdarw. s (x)}} (C_{i} (1 / X)) G^{- 1} (A_{i - 1}) & otherwise \end{matrix},$ $for j = 0, .Math., L - 1$ $a_{i} := SampleExtract (A_{n} G^{- 1} (t_{j} (X), 0)$ where n is an integer of 1 or more, C.sub.i is an input ciphertext resulting from encrypting input data x.sub.i, X is a variable constituting a polynomial of a polynomial ring in the ring variant of Gentry-Sahai-Waters (RGSW) encryption, G is a tensor product of g and I.sub.2, G.sup.−1 is a process to convert each integer element of a matrix into a binary representation, g:=(1, 2, 2.sup.2, . . . , 2.sup.L−1), L is a minimum integer equal to or more than log q, q is a positive integer, I.sub.2 is a 2×2 identity matrix, and w.sub.i is weight data in a neural network
[Formula 2]
for j=0, . . . ,L−1),
a′.sub.j,k:=SwitchKey.sub.KS.sub.s.fwdarw.s(a.sub.j),
A′:=(a′.sub.j,k).sub.j=0, . . . ,L−1;k=0,1,
D:=A′G.sup.−1(A.sub.n) where A′ is the range ciphertext, and D is the result ciphertext.

8. A privacy-preserving information processing system comprising: an encryption device to encrypt input data to generate an input ciphertext; a homomorphic inference device to take as input the input ciphertext generated by the encryption device, and generate a result ciphertext of a result of computing a Sign function that takes as input an integer and outputs a sign of the integer; and a decryption device to decrypt the result ciphertext generated by the homomorphic inference device, so as to generate result data indicating the result, wherein the homomorphic inference device includes processing circuitry to: take as input the input ciphertext, determine whether a value obtained from the input data is greater than 0, generate a ciphertext resulting from encrypting 1 as a range ciphertext when the value obtained from the input data is greater than 0, and generate a ciphertext resulting from encrypting 0 as the range ciphertext when the value obtained from the input data is equal to or less than 0; and perform a homomorphic operation of computing a sum of a product of a ciphertext resulting from encrypting 1 and the range ciphertext and a product of a ciphertext resulting from encrypting −1 and a value obtained by subtracting the range ciphertext from the ciphertext resulting from encrypting 1, so as to generate the result ciphertext, and wherein the homomorphic operation is utilized as a function of an intermediate layer of a neural network performing recognition on an encrypted image, and wherein the processing circuitry generates a.sub.j, which is the range ciphertext, as indicated in Formula 3, and generates D, which is the result ciphertext, as indicated in Formula 4 $\begin{matrix} for i = 1, .Math., n & [Formula 3] \end{matrix}$ $A_{i} := {\begin{matrix} C_{i} G^{- 1} (A_{i - 1}) & if w_{i} = 1 \\ {SwitchKey}_{K S^{s (1 / X) .fwdarw. s (x)}} (C_{i} (1 / X)) G^{- 1} (A_{i - 1}) & otherwise \end{matrix},$ $for j = 0, .Math., L - 1$ $a_{i} := SampleExtract (A_{n} G^{- 1} (t_{j} (X), 0)$ where n is an integer of 1 or more, C.sub.i is an input ciphertext resulting from encrypting input data x.sub.i, X is a variable constituting a polynomial of a polynomial ring in the ring variant of Gentry-Sahai-Waters (RGSW) encryption, G is a tensor product of g and I.sub.2, G.sup.−1 is a process to convert each integer element of a matrix into a binary representation, g:=(1, 2, 2.sup.2, . . . , 2.sup.L−1), L is a minimum integer equal to or more than log q, q is a positive integer, I.sub.2 is a 2×2 identity matrix, and w.sub.i is weight data in a neural network
[Formula 4]
for j=0, . . . ,L−1),
a′.sub.j,k:=SwitchKey.sub.KS.sub.s.fwdarw.s(a.sub.j),
A′:=(a′.sub.j,k).sub.j=0, . . . ,L−1;k=0,1,
D:=X.Math.GG.sup.−1(A′)+X.sup.−1G.sup.−1GG.sup.−1(A′) where A′ is the range ciphertext, and D is the result ciphertext.

Description

BRIEF DESCRIPTION OF DRAWINGS

(1) FIG. 1 is a configuration diagram of a privacy-preserving information processing system 10 according to a first embodiment;

(2) FIG. 2 is a configuration diagram of a key generation device 20 according to the first embodiment;

(3) FIG. 3 is a configuration diagram of an encryption device 30 according to the first embodiment;

(4) FIG. 4 is a configuration diagram of a homomorphic inference device 40 according to the first embodiment;

(5) FIG. 5 is a configuration diagram of a decryption device 50 according to the first embodiment;

(6) FIG. 6 is a flowchart of operation of the key generation device 20 according to the first embodiment;

(7) FIG. 7 is a flowchart of operation of the encryption device 30 according to the first embodiment;

(8) FIG. 8 is a flowchart of operation of the homomorphic inference device 40 according to the first embodiment;

(9) FIG. 9 is a diagram describing a ReLU function;

(10) FIG. 10 is a flowchart of a range determination process according to the first embodiment;

(11) FIG. 11 is a flowchart of a result generation process according to the first embodiment;

(12) FIG. 12 is a flowchart of operation of the decryption device 50 according to the first embodiment;

(13) FIG. 13 is a configuration diagram of the key generation device 20 according to a second variation;

(14) FIG. 14 is a configuration diagram of the encryption device 30 according to the second variation;

(15) FIG. 15 is a configuration diagram of the homomorphic inference device 40 according to the second variation; and

(16) FIG. 16 is a configuration diagram of the decryption device 50 according to the second variation.

DESCRIPTION OF EMBODIMENTS

First Embodiment

(17) ***Description of Configuration***

(18) A configuration of a privacy-preserving information processing system 10 according to a first embodiment will be described with reference to FIG. 1.

(19) The privacy-preserving information processing system 10 includes a key generation device 20, an encryption device 30, a homomorphic inference device 40, and a decryption device 50.

(20) The key generation device 20, the encryption device 30, the homomorphic inference device 40, and the decryption device 50 are connected via a network 60. A specific example of the network 60 is the Internet. The network 60 may be a different type of network such as a local area network (LAN).

(21) A configuration of the key generation device 20 according to the first embodiment will be described with reference to FIG. 2.

(22) The key generation device 20 is a computer such as a personal computer (PC).

(23) The key generation device 20 includes hardware of a processor 21, a memory 22, a storage 23, and a communication interface 24. The processor 21 is connected with the other hardware components and controls these other hardware components.

(24) The key generation device 20 includes, as functional components, an acquisition unit 211, a key generation unit 212, and an output unit 213. The functions of the functional components of the key generation device 20 are realized by software.

(25) The storage 23 stores programs for realizing the functions of the functional components of the key generation device 20. These programs are loaded into the memory 22 by the processor 21 and executed by the processor 21. This realizes the functions of the functional components of the key generation device 20.

(26) The storage 23 realizes the function of a key storage unit 231.

(27) A configuration of the encryption device 30 according to the first embodiment will be described with reference to FIG. 3.

(28) The encryption device 30 is a computer such as a PC.

(29) The encryption device 30 includes hardware of a processor 31, a memory 32, a storage 33, and a communication interface 34. The processor 31 is connected with the other hardware components via signal lines and controls these other hardware components.

(30) The encryption device 30 includes, as functional components, an acquisition unit 311, an encryption unit 312, and an output unit 313. The functions of the functional components of the encryption device 30 are realized by software.

(31) The storage 33 stores programs for realizing the functions of the functional components of the encryption device 30. These programs are loaded into the memory 32 by the processor 31 and executed by the processor 31. This realizes the functions of the functional components of the encryption device 30.

(32) The storage 33 realizes the function of a public key storage unit 331.

(33) A configuration of the homomorphic inference device 40 according to the first embodiment will be described with reference to FIG. 4.

(34) The homomorphic inference device 40 is a computer, such as a server, that has a large-capacity storage device.

(35) The homomorphic inference device 40 includes hardware of a processor 41, a memory 42, a storage 43, and a communication interface 44. The processor 41 is connected with the other hardware components via signal lines and controls these other hardware components.

(36) The homomorphic inference device 40 includes, as functional components, an acquisition unit 411, a range determination unit 412, a result generation unit 413, and an output unit 414. The functions of the functional components of the homomorphic inference device 40 are realized by software.

(37) The storage 43 stores programs for realizing the functions of the functional components of the homomorphic inference device 40. These programs are loaded into the memory 42 by the processor 41 and executed by the processor 41. This realizes the functions of the functional components of the homomorphic inference device 40.

(38) The storage 43 realizes the functions of a public key storage unit 431 and a ciphertext storage unit 432.

(39) A configuration of the decryption device 50 according to the first embodiment will be described with reference to FIG. 5.

(40) The decryption device 50 is a computer such as a PC.

(41) The decryption device 50 includes hardware of a processor 51, a memory 52, a storage 53, and a communication interface 54. The processor 51 is connected with the other hardware components via signal lines and controls these other hardware components.

(42) The decryption device 50 includes, as functional components, an acquisition unit 511, a decryption unit 512, and an output unit 513. The functions of the functional components of the decryption device 50 are realized by software.

(43) The storage 53 stores programs for realizing the functions of the functional components of the decryption device 50. These programs are loaded into the memory 52 by the processor 51 and executed by the processor 51. This realizes the functions of the functional components of the decryption device 50.

(44) The storage 53 realizes the function of a key storage unit 531.

(45) Each of the processors 21, 31, 41, and 51 is an integrated circuit (IC) that performs arithmetic processing. As a specific example, each of the processors 21, 31, 41, and 51 is a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU).

(46) Each of the memories 22, 32, 42, and 52 is a storage device to temporarily store data. As a specific example, each of the memories 22, 32, 42, and 52 is a static random access memory (SRAM) or a dynamic random access memory (DRAM).

(47) Each of the storages 23, 33, 43, and 53 is a storage device to store data. As a specific example, each of the storages 23, 33, 43, and 53 is a hard disk drive (HDD). Each of the storages 23, 33, 43, and 53 may be a portable storage medium such as a Secure Digital (SD, registered trademark) memory card, CompactFlash (CF), a NAND flash, a flexible disk, an optical disc, a compact disc, a Blu-ray (registered trademark) disc, or a digital versatile disc (DVD).

(48) Each of the communication interfaces 24, 34, 44, and 54 is an interface for communicating with external devices. As a specific example, each of the communication interfaces 24, 34, 44, and 54 is an Ethernet (registered trademark) port, a Universal Serial Bus (USB) port, or a High-Definition Multimedia Interface (HDMI, registered trademark) port.

(49) FIG. 2 illustrates only one processor 21. However, the key generation device 20 may include a plurality of processors as an alternative to the processor 21. Similarly, the encryption device 30 may include a plurality of processors as an alternative to the processor 31, the homomorphic inference device 40 may include a plurality of processors as an alternative to the processor 41, and the decryption device 50 may include a plurality of processors as an alternative to the processor 51. The plurality of processors share the execution of the programs for realizing the functions of the functional components. Each of the plurality of processors is, like the processors 21, 31, 41, and 51, an IC that performs arithmetic processing.

(50) ***Description of Operation***

(51) Operation of the privacy-preserving information processing system 10 according to the first embodiment will be described with reference to FIGS. 6 to 12.

(52) The operation of the privacy-preserving information processing system 10 according to the first embodiment corresponds to a privacy-preserving information processing method according to the first embodiment. The operation of the privacy-preserving information processing system 10 according to the first embodiment also corresponds to processes of a privacy-preserving information processing program according to the first embodiment.

(53) Operation of the key generation device 20 according to the first embodiment will be described with reference to FIG. 6.

(54) The operation of the key generation device 20 according to the first embodiment corresponds to a key generation method according to the first embodiment. The operation of the key generation device 20 according to the first embodiment also corresponds to processes of a key generation program according to the first embodiment.

(55) (Step S11: Acquisition Process)

(56) The acquisition unit 211 acquires a parameter λ via the communication interface 24. The acquisition unit 211 writes the acquired parameter λ in the memory 22.

(57) (Step S12: Key Generation Process)

(58) The key generation unit 212 reads the parameter λ written in step S11 from the memory 22. The key generation unit 212 generates a public key PK and a secret key SK, taking as input the parameter λ. The key generation unit 212 writes the generated public key PK and secret key SK in the key storage unit 231.

(59) It is assumed here that the key generation unit 212 generates the public key PK and the secret key SK of an RGSW encryption scheme. The RGSW encryption scheme is described in Non-Patent Literature 3.

(60) (Step S13: Output Process)

(61) The output unit 213 reads the public key PK and the secret key SK written in step S12 from the key storage unit 231. The output unit 213 transmits the public key PK to the encryption device 30, the homomorphic inference device 40, and the decryption device 50 via the communication interface 24. The output unit 213 transmits the secret key SK to the decryption device 50 in secrecy via the communication interface 24. To transmit in secrecy means to transmit after encryption by an existing encryption scheme. Note that the public key PK and the secret key SK may be transmitted by a different method such as by postal mail.

(62) In the encryption device 30, the acquisition unit 311 acquires the public key PK and writes the public key PK in the public key storage unit 331. In the homomorphic inference device 40, the acquisition unit 411 acquires the public key PK and writes the public key PK in the public key storage unit 431. In the decryption device 50, the acquisition unit 511 acquires the public key PK and the secret key SK and writes the public key PK and the secret key SK in the key storage unit 531. In the decryption device 50, the secret key SK is stored strictly so as not to be leaked to the outside. The decryption device 50 functions as a storage device to store the secret key SK.

(63) Operation of the encryption device 30 according to the first embodiment will be described with reference to FIG. 7.

(64) The operation of the encryption device 30 according to the first embodiment corresponds to an encryption method according to the first embodiment. The operation of the encryption device 30 according to the first embodiment also corresponds to processes of an encryption program according to the first embodiment.

(65) (Step S21: Acquisition Process)

(66) The acquisition unit 311 acquires via the communication interface 34 input data x.sub.i for i=1, . . . , n, which is data to be encrypted, where n is an integer of 1 or more. A specific example of the input data x.sub.i is data detected by a sensor installed at a factory or the like. The acquisition unit 311 writes the acquired input data in the memory 32.

(67) (Step S22: Encryption Process)

(68) The encryption unit 312 reads the input data x.sub.i written in step S21 from the memory 32. The encryption unit 312 also reads the public key PK from the public key storage unit 331.

(69) The encryption unit 312 encrypts the input data x.sub.i to generate an input ciphertext C.sub.i for each integer i of i=1, . . . , n, based on the public key PK. The encryption unit 312 encrypts the input data x.sub.i by the RGSW encryption scheme here. The encryption unit 312 writes the generated input ciphertext C.sub.i in the memory 32.

(70) (Step S23: Output Process)

(71) The output unit 313 reads the input ciphertext C.sub.i written in step S22 from the memory 32. The output unit 313 transmits the input ciphertext C.sub.i to the homomorphic inference device 40 via the communication interface 34.

(72) In the homomorphic inference device 40, the acquisition unit 411 acquires the input ciphertext C.sub.i and writes the input ciphertext C.sub.i in the ciphertext storage unit 432. The homomorphic inference device 40 functions as a storage device to store the input ciphertext C.sub.i.

(73) Operation of the homomorphic inference device 40 according to the first embodiment will be described with reference to FIG. 8.

(74) The operation of the homomorphic inference device 40 according to the first embodiment corresponds to a homomorphic inference method according to the first embodiment. The operation of the homomorphic inference device 40 according to the first embodiment also corresponds to processes of a homomorphic inference program according to the first embodiment.

(75) The homomorphic inference device 40 performs inference including a non-polynomial operation, taking as input the input ciphertext C.sub.i. A case in which a rectified linear unit (ReLU) function, which is one type of the activation function in neural networks, is used as the inference including a non-polynomial operation will be described here. In particular, a case in which a weight w.sub.i in a neural network is +1 or −1 will be described here. A bias in the neural network will be denoted as b.

(76) As illustrated in FIG. 9, the ReLU function is a function that returns an input value if the input value is greater than 0, and returns 0 if the input value is equal to or less than 0. Therefore, the ReLU function is the inference including a non-polynomial operation.

(77) (Step S31: Acquisition Process)

(78) The acquisition unit 411 reads the public key PK from the public key storage unit 431.

(79) The acquisition unit 411 accepts designation of the input ciphertext C.sub.i to be processed. The acquisition unit 411 reads the input ciphertext C.sub.i to be processed from the ciphertext storage unit 432.

(80) (Step S32: Range Determination Process)

(81) The range determination unit 412 determines whether a value V obtained from the input data x.sub.i is within a reference range, taking as input the input ciphertext C.sub.i resulting from encrypting the input data x.sub.i for i=1, . . . , n. Then, the range determination unit 412 generates a range ciphertext a.sub.j depending on the determined result.

(82) The value V is the value defined depending on the inference including a non-polynomial operation, and the reference range is the range depending on the inference including a non-polynomial operation. The value V and the reference range are pre-set depending on the inference to be performed. The ReLU function, which is one type of the activation function in neural networks, is used as the inference including a non-polynomial operation here. Accordingly, the value V is defined as the sum of values obtained by multiplying the input data x.sub.i by the weight w.sub.i (Σ.sub.ix.sub.iw.sub.i) for each integer i of i=1, . . . , n, and the reference range is defined as the range greater than 0.

(83) The range determination unit 412 treats the sum of values obtained by multiplying the input data x.sub.i by the weight w.sub.i (Σ.sub.ix.sub.iw.sub.i) for each integer i of i=1, . . . , n as the value V, and determines whether the value V is greater than 0. Then, the range determination unit 412 generates, as the range ciphertext a.sub.j, a ciphertext resulting from encrypting 1 if the value V is greater than 0, and generates, as the range ciphertext a.sub.j, a ciphertext resulting from encrypting 0 if the value V is equal to or less than 0.

(84) The range determination process according to the first embodiment will be described with reference to FIG. 10.

(85) (Step S321: RGSW Encoding Process)

(86) The range determination unit 412 generates an RGSW encoding of ReLU(b+Σ.sub.ix.sub.iw.sub.i), taking as input the bias b, the weight w.sub.i∈{+1, −1}, and the input ciphertext C.sub.i for i=1, . . . , n.

(87) Specifically, the range determination unit 412 first computes A.sub.0:=X.sup.b.Math.G, where X is a variable constituting a polynomial of a polynomial ring in RGSW and G is a tensor product of g and I.sub.2. Note that g:=(1, 2, 2.sup.2, . . . , 2.sup.L−1), L is a minimum integer equal to or greater than log q, q is a positive integer, and I.sub.2 is a 2×2 identity matrix.

(88) Next, the range determination unit 412 generates a ciphertext A.sub.n by computing Formula 11 for each integer i of i:=1, . . . , n in ascending order. The range determination unit 412 writes the ciphertext A.sub.n in the memory 42.

(89) $\begin{matrix} A_{i} := {\begin{matrix} C_{i} G^{- 1} (A_{i - 1}) & if w_{i} = 1 \\ {SwitchKey}_{{KS}^{s (1 / X) .fwdarw. s (x)}} (C_{i} (1 / X)) G^{- 1} (A_{i - 1}) & otherwise \end{matrix} & [Formula 11] \end{matrix}$

(90) The SwitchKey algorithm is described in Non-Patent Literature 3. Because of s(1/x).fwdarw.s(x) here, the SwitchKey algorithm is a process to convert a ciphertext that can be decrypted with s(1/x) into a ciphertext that can be decrypted with s(x). Note that s is a secret key in the RGSW encryption scheme, and G.sup.−1 is a process to convert each integer element of a matrix into a binary representation.

(91) The ciphertext A.sub.n generated by Formula 11 is a ciphertext resulting from encrypting Σ.sub.ix.sub.iw.sub.i, which is the value V, by the RGSW encryption scheme.

(92) (Step S322: Range Ciphertext Generation Process)

(93) The range determination unit 412 generates the range ciphertext a.sub.j by computing Formula 12 for each integer j of j=0, . . . , L−1, taking as input the ciphertext A.sub.n computed in step S311. The range determination unit 412 writes the range ciphertext a.sub.j in the memory 42.
[Formula 12]
a.sub.i:=SampleExtract(A.sub.nG.sup.−1(t.sub.j(X),0)

(94) The SampleExtract algorithm is described in Non-Patent Literature 3. The SampleExtract algorithm is a process to output a ciphertext resulting from encrypting constant terms of an input plaintext polynomial. Note that t.sub.j(X):=2.sup.j(1−X−X.sup.2− . . . ).

(95) The range ciphertext a.sub.j generated by Formula 12 is a ciphertext resulting from encrypting 1 if the value V is greater than 0, and is a ciphertext resulting from encrypting 0 if the value V is equal to or less than 0. Note that the range ciphertext a.sub.j computed by Formula 12 is not a ciphertext of the RGSW encryption scheme, but a ciphertext of a learning with errors (LWE) encryption scheme.

(96) (Step S33: Result Generation Process)

(97) The result generation unit 413 performs a homomorphic operation on the range ciphertext a.sub.j generated in step S32, so as to generate a result ciphertext D, which is a ciphertext of a result of performing the inference including a non-polynomial operation on the input data x.sub.i.

(98) That is, the result generation unit 413 generates, as the result ciphertext D, a ciphertext resulting from encrypting the value V if the value V is greater than 0, and generates, as the result ciphertext D, a ciphertext resulting from encrypting 0 if the value V is equal to or less than 0.

(99) The result generation process according to the first embodiment will be described with reference to FIG. 11.

(100) (Step S331: Scheme Conversion Process)

(101) The result generation unit 413 reads the range ciphertext a.sub.j written in step S322 from the memory 42. Then, the result generation unit 413 converts the range ciphertext a.sub.j, which is a ciphertext of the LWE encryption scheme, into a range ciphertext A′, which is a ciphertext of the RGSW encryption scheme.

(102) Specifically, the result generation unit 413 generates the range ciphertext A′ by computing Formula 13 for each integer j of j=0, . . . , L−1 and each integer k of k=0, 1.
[Formula 13]
a′.sub.j,k:=SwitchKey.sub.KS.sub.s.fwdarw.s(a.sub.j),
A′:=(a′.sub.j,k).sub.j=0, . . . ,L−1;k=0,1∈R.sub.q.sup.2×2L

(103) The SwitchKey algorithm is described in Non-Patent Literature 3. Because of s.fwdarw.s (italic) here, the SwitchKey algorithm is a process to convert a ciphertext that can be decrypted with s into a ciphertext that can be decrypted with s (italic).

(104) (Step S332: Result Computation Process)

(105) The result generation unit 413 reads the ciphertext A.sub.n of the value V written in step S321 from the memory 42. Then, the result generation unit 413 performs a homomorphic operation of computing the product of the range ciphertext A′ generated in step S331 and the ciphertext A.sub.n of the value V obtained from the input data x.sub.i, so as to generate the result ciphertext D.

(106) The range ciphertext A′ is the ciphertext resulting from encrypting 1 if the value V is greater than 0, and is the ciphertext resulting from encrypting 0 if the value V is equal to or less than 0. Therefore, when the product of the range ciphertext A′ and the ciphertext A.sub.n is computed, the ciphertext of the value V is generated as the result ciphertext D if the value V is greater than 0, and the ciphertext resulting from encrypting 0 is generated as the result ciphertext D if the value V is equal to or less than 0.

(107) Specifically, the result generation unit 413 generates the result ciphertext D by computing Formula 14. The result generation unit 413 writes the result ciphertext D in the memory 42.
[Formula 14]
D:=A′G.sup.−1(A.sub.n)∈R.sub.q.sup.2×2L

(108) (Step S34: Output process)

(109) The output unit 414 reads the result ciphertext D written in step S33 from the memory 42. The output unit 414 writes the result ciphertext D in the ciphertext storage unit 432.

(110) Operation of the decryption device 50 according to the first embodiment will be described with reference to FIG. 12.

(111) The operation of the decryption device 50 according to the first embodiment corresponds to a decryption method according to the first embodiment. The operation of the decryption device 50 according to the first embodiment also corresponds to processes of a decryption program according to the first embodiment.

(112) (Step S41: Acquisition Process)

(113) The acquisition unit 511 transmits an acquisition request for the result ciphertext D to be processed to the homomorphic inference device 40 via the communication interface 54. Then, the acquisition unit 511 acquires via the communication interface 54 the result ciphertext D requested by the acquisition request. The acquisition unit 511 writes the acquired result ciphertext D in the memory 52.

(114) (Step S42: Decryption Process)

(115) The decryption unit 512 decrypts the result ciphertext D acquired in step S41 to generate result data d indicating the result of performing the inference including a non-polynomial operation on the input data x.sub.i. The decryption unit 512 decrypts the result ciphertext D by the RGSW encryption scheme here. The decryption unit 512 generates the result data d that is obtained when the value V obtained from the input data x.sub.i is used as the input to the ReLU function. The decryption unit 512 writes the generated result data d in the memory 52.

(116) (Step S43: Output Process)

(117) The output unit 513 reads the result data d written in step S42 from the memory 52. Then, the output unit 513 outputs the result data d to a display device or the like via the communication interface 54.

(118) ***Effects of First Embodiment***

(119) As described above, in the privacy-preserving information processing system 10 according to the first embodiment, the homomorphic inference device 40 determines whether the value obtained from the input data x.sub.i is within the reference range, taking as input the input ciphertext C.sub.i, and generates the range ciphertext a.sub.j depending on the determined result. Then, the homomorphic inference device 40 performs a homomorphic operation on the range ciphertext a.sub.j, so as to generate the result ciphertext D of the result of performing the inference.

(120) This allows the privacy-preserving information processing system 10 to compute the inference including a non-polynomial operation, such as a function at an intermediate layer in a neural network, with a small number of homomorphic multiplications, without performing replacement with an approximate function. Specifically, the privacy-preserving information processing system 10 can compute the inference with two homomorphic multiplications, whereas the method described in Non-Patent Literature 2 requires six homomorphic multiplications.

(121) The privacy-preserving information processing system 10 can perform the inference in a neural network without performing replacement with an approximate function, and can thus achieve high inference accuracy. In addition, it is not necessary to configure a neural network separately for encrypted data, which leads to a reduction in cost.

(122) In particular, the homomorphic inference device 40 generates the ciphertext resulting from encrypting 1 as the range ciphertext a.sub.j or generates the ciphertext resulting from encrypting 0 as the range ciphertext a.sub.j, depending on whether the value obtained from the input data x, is within the reference range. This allows the inference including a non-polynomial operation to be computed with a small number of operations.

(123) ***Other Configurations***

(124) <First Variation>

(125) In the first embodiment, the ReLU function, which is one type of the activation function in neural networks, is used as the inference including a non-polynomial operation. However, the inference including a non-polynomial operation is not limited to the ReLU function.

(126) In a first variation, a case in which a Sign function, which is one type of the activation function in neural networks, is used as the inference including a non-polynomial operation will be described. The Sign function is a function that returns the sign (+1 or −1) of an input. In the first variation, differences from the first embodiment will be described, and description of the same portions will be omitted.

(127) The result generation process according to the first variation will be described with reference to FIG. 11.

(128) The process of step S331 is the same as in the first embodiment.

(129) (Step S332: Result Computation Process)

(130) The result generation unit 413 reads the ciphertext A.sub.n of the value V written in step S321 from the memory 42. Then, the result generation unit 413 performs a homomorphic operation of computing the sum of the product of a ciphertext resulting from encrypting 1 and the range ciphertext A′ and the product of a ciphertext resulting from encrypting −1 and a value obtained by subtracting the range ciphertext A′ from the ciphertext resulting from encrypting 1, so as to generate a result ciphertext D.

(131) The range ciphertext A′ is the ciphertext resulting from encrypting 1 if the value V is greater than 0, and is the ciphertext resulting from encrypting 0 if the value V is equal to or less than 0. Accordingly, if the value V is greater than 0, the value obtained by subtracting the range ciphertext A′ from the ciphertext resulting from encrypting 1 is 0, so that the product of the ciphertext resulting from encrypting −1 and the value obtained by subtracting the range ciphertext A′ from the ciphertext resulting from encrypting 1 is 0. Therefore, the ciphertext resulting from encrypting 1, which is the product of the ciphertext resulting from encrypting 1 and the range ciphertext A′, is generated as the result ciphertext D. On the other hand, if the value V is equal to or less than 0, the product of the ciphertext resulting from encrypting 1 and the range ciphertext A′ is 0. The value obtained by subtracting the range ciphertext A′ from the ciphertext resulting from encrypting 1 is 1. Therefore, the ciphertext resulting from encrypting −1, which is the product of the ciphertext resulting from encrypting −1 and the value obtained by subtracting the range ciphertext A′ from the ciphertext resulting from encrypting 1, is generated as the result ciphertext D.

(132) Specifically, the result generation unit 413 generates the result ciphertext D by computing Formula 15. The result generation unit 413 writes the result ciphertext D in the memory 42.
[Formula 15]
D:=X.Math.GG.sup.−1(A′)+X.sup.−1GG.sup.−1(G−A′)∈R.sub.q.sup.2×2L

(133) In Formula 15, XG is the ciphertext resulting from encrypting 1, and X.sup.−1G is the ciphertext resulting from encrypting −1.

(134) Note that the case in which the inference including a non-polynomial operation is the Sign function is described in the first variation. However, the privacy-preserving information processing system 10 may be applicable to other types of the activation function. The privacy-preserving information processing system 10 may also be applicable to other types of the inference including a non-polynomial operation, not limited to the activation function.

(135) <Second Variation>

(136) In the first embodiment, the functional components are realized by software. However, as a second variation, the functional components may be realized by hardware. With respect to the second variation, differences from the first embodiment will be described.

(137) A configuration of the key generation device 20 according to the second variation will be described with reference to FIG. 13.

(138) When the functions are realized by hardware, the key generation device 20 includes an electronic circuit 25, in place of the processor 21, the memory 22, and the storage 23. The electronic circuit 25 is a dedicated circuit that realizes the functional components of the key generation device 20 and the functions of the memory 22 and the storage 23.

(139) A configuration of the encryption device 30 according to the second variation will be described with reference to FIG. 14.

(140) When the functions are realized by hardware, the encryption device 30 includes an electronic circuit 35, in place of the processor 31, the memory 32, and the storage 33. The electronic circuit 35 is a dedicated circuit that realizes the functional components of the encryption device 30 and the functions of the memory 32 and the storage 33.

(141) A configuration of the homomorphic inference device 40 according to the second variation will be described with reference to FIG. 15.

(142) When the functions are realized by hardware, the homomorphic inference device 40 includes an electronic circuit 45, in place of the processor 41, the memory 42, and the storage 43. The electronic circuit 45 is a dedicated circuit that realizes the functional components of the homomorphic inference device 40 and the functions of the memory 42 and the storage 43.

(143) A configuration of the decryption device 50 according to the second variation will be described with reference to FIG. 16.

(144) When the functions are realized by hardware, the decryption device 50 includes an electronic circuit 55, in place of the processor 51, the memory 52, and the storage 53. The electronic circuit 55 is a dedicated circuit that realizes the functional components of the decryption device 50 and the functions of the memory 52 and the storage 53.

(145) Each of the electronic circuits 25, 35, 45, and 55 is assumed to be a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, a logic IC, a gate array (GA), an application specific integrated circuit (ASIC), or a field-programmable gate array (FPGA).

(146) The functions of the functional components of the key generation device 20 may be realized by one electronic circuit 25, or the functions of the functional components may be distributed among and realized by a plurality of electronic circuits 25. Similarly, the functions of the functional components of the encryption device 30, the homomorphic inference device 40, or the decryption device 50 may be realized by one electronic circuit 35, 45, or 55, or may be realized by a plurality of electronic circuits 35, 45, or 55, respectively.

(147) <Third Variation>

(148) As a third variation, some of the functions may be realized by hardware, and the rest of the functions may be realized by software. That is, some of the functions of the functional components may be realized by hardware, and the rest of the functions may be realized by software.

(149) Each of the processors 21, 31, 41, and 51, the memories 22, 32, 42, and 52, the storages 23, 33, 43, and 53, and the electronic circuits 25, 35, 45, and 55 is referred to as processing circuitry. That is, the functions of the functional components are realized by the processing circuitry.

REFERENCE SIGNS LIST

(150) 10: privacy-preserving information processing system, 20: key generation device, 21: processor, 22: memory, 23: storage, 24: communication interface, 25: electronic circuit, 211: acquisition unit, 212: key generation unit, 213: output unit, 231: key storage unit, 30: encryption device, 31: processor, 32: memory, 33: storage, 34: communication interface, 35: electronic circuit, 311: acquisition unit, 312: encryption unit, 313: output unit, 331: public key storage unit, 40: homomorphic inference device, 41: processor, 42: memory, 43: storage, 44: communication interface, 45: electronic circuit, 411: acquisition unit, 412: range determination unit, 413: result generation unit, 414: output unit, 431: public key storage unit, 432: ciphertext storage unit, 50: decryption device, 51: processor, 52: memory, 53: storage, 54: communication interface, 55: electronic circuit, 511: acquisition unit, 512: decryption unit, 513: output unit, 531: key storage unit, 60: network

Homomorphic inference device, homomorphic inference method, computer readable medium, and privacy-preserving information processing system

Assignee

Inventors

Cpc classification

Classification Explorer

G06F21/71

PHYSICS

Classification Explorer

H04L9/3093

ELECTRICITY

Classification Explorer

G06N5/04

PHYSICS

Classification Explorer

H04L9/0618

ELECTRICITY

Classification Explorer

G06F21/60

PHYSICS

Classification Explorer

H04L9/008

ELECTRICITY

Classification Explorer

G06N3/048

PHYSICS

International classification

Classification Explorer

H04L9/00

ELECTRICITY

Classification Explorer

G06N5/04

PHYSICS

Classification Explorer

G06N3/04

PHYSICS

Classification Explorer

G06F21/71

PHYSICS

Classification Explorer

G06F21/60

PHYSICS

Classification Explorer

H04L9/30

ELECTRICITY

Classification Explorer

H04L9/06

ELECTRICITY

Abstract

Claims

Description