Abstract: A secure deduplication system, including a plurality of secure computation apparatuses, wherein the plurality of secure computation apparatuses include a plurality of permutation calculation parts 11n for generating a share {{?}} of a permutation ? that stably sorts a vector v in ascending order, a plurality of permutation application parts 12n for generating a share [?(v)] of a vector ?(v) obtained by applying the permutation ? to the vector v, a plurality of vector generation parts 13n for generating a share [e] of a vector e that has 1 as an element corresponding to a certain element when the certain element of the vector ?(v) and an element before the certain element are different, and has 0 otherwise, and a plurality of inverse permutation application parts 14n for generating a share [??1(e)] of a vector ??1(e) obtained by applying an inverse permutation ??1 of the permutation ? to the vector e.

Abstract: A secret share value [ft(x)-ft(x)] of ft(x)-ft(x) is obtained through secure computation using a secret share value [x] of a real number x, and a secret share value [ft(x)-ft(x)]r of (ft(x)-ft(x))r obtained by right-shifting ft(x)-ft(x) by the predetermined number of bits is obtained through secure computation using the secret share value [ft(x)-ft(x)]. Here, [?] is a secret share value of ?, n is an integer equal to or greater than 1, t=0, . . . , n?1, u=1, . . . , n?1, ft(x) is a function of the real number x, ft(x) is an approximation function of the function ft(x), a secret share value [f0(x)] of an approximation function f0(x) is [f0(x)]=co,0+c0,1[x], a secret share value [fu(x)] of an approximation function fu(x) is [fu(x)]=cu,0+cu,1[x]+cu,2[f0(x)]+. . . +cu,u+1[fu?1(x)], ct,0 is a public value, and ct,1, . . . , ct,n+1 are coefficients.

Abstract: A public value 2?/m is obtained, and secure computation of public value division [x]/(2?/m) using a secret share value [x] and the obtained public value 2?/m is performed, so that a secret share value [mx]r of a value obtained by right-shifting mx by ? bits is obtained and output. Here, x is a real number, [•] is a secret share value of •, ? is a positive integer that is the number of bits indicating a right shifting amount, and m is a real number.

Abstract: In secure computation, an exponential function is calculated at high speed. A secure exponential function computation system (100) receives [a] as an input and calculates [exp (a)]. The minimum value subtraction unit (11) calculates [a?]:=[a]??. A bit decomposition unit (12) generates a bit representation [a?0], . . . , [a?u-1] of u upper bits of a? from [a?]. A selective product unit (13) calculates a total product [f?] of values that are [a?i?fi:1]. An upper bit calculation unit (14) calculates a total product [??] of [a?i?2?_i:1] for 0?i<u. A lower bit calculation unit (15) calculates [a??]:=[a?]??2i-t[a?i]. An exponential function calculation unit (16) calculates [w]:=[exp (a??)]. A result calculation unit (17) calculates [w][f?][??]exp (?).

Abstract: An aggregate sum is efficiently obtained while keeping confidentiality. A prefix-sum part computes a prefix-sum from a share of a sorted value attribute. A flag converting part converts a format of a share of a flag representing the last element of a group. A flag applying part generates a share of a vector in which a prefix-sum is set when a flag representing the last element of a group is true, and a sum of the whole is set when the flag is false. A sorting part generates a share of a sorted vector obtained by sorting a vector with a permutation which moves elements so that the last elements of each group are sequentially arranged from beginning. A sum computing part generates a share of a vector representing a sum for each group.

Abstract: To efficiently determine intermediate data for use with an aggregate function while keeping confidentiality, a bit decomposition unit generates a share of a bit string by bit decomposition and concatenation of key attributes. A group sort generation unit generates a share of a first permutation, which performs a stable sort of the bit string in ascending order. A bit string sorting unit generates a share of a sorted bit string obtained by sorting the bit string with the first permutation. A flag generation unit generates a share of a flag indicating a boundary between groups. A key aggregate sort generation unit generates a share of a second permutation, which performs a stable sort of the negation of the flag in ascending order. A de-duplication unit generates shares of de-duplicated key attributes. A key sorting unit generates shares of sorted key attributes by sorting the de-duplicated key attributes.

Abstract: The bit decomposition unit (11) generates a bit representation lap {a0}, . . . , {a??1} of a. A first bit sequence generator (12) calculates {a?i}={ai}?{ai+1} to generate {a?0}, . . . , {a????1}. A flag sequence generator (13) generates {x0}, . . . , {x???1} indicating a most significant bit of {a?0}, . . . , {a????1}. A normalization multiplier generator (14) generates [c?] by bit-connecting {x???1}, . . . , {x0}. A second bit sequence generator (15) sets {a?i}={a2i} to generate {a?0}, . . . . A flag calculator (16) sums {xj}{a?j} to calculate a share value {r}. A normalization unit (18) calculates [b]: =[c?][c?][2a] when r=1 and [b]: =[c?][c?][a] when r=0. A inverse square root calculator (19) calculates [w]: =[1/?b]*?2 when r=1, and [w]: =[1/?b] when r=0. An inverse normalization unit (20) multiplies [1/?a]: =[w][c?].

Abstract: A flag sequence generator (12) generates {x0}, . . . , {x??11} indicating a msb of a. A bit sequence generator (13) calculates {yi}:={x2i} XOR {x2i+1} to generate {y0}, . . . , {y???1}. A flag calculator (14) calculates an exclusive logical sum of all {xj} to calculate [r] for each odd j. A public value multiplier setting-unit (16) sets r? that becomes ?2 when ? is an odd and 1 when ? is an even. A normalization multiplier generator (17) bit-connects {y0}, . . . to generate [c?]. A normalization multiplier generator (18) bit-connects {x??1}, . . . to generate [c]. A normalizer (19) calculates [b]:=[a][c]. A square root calculator (20) calculates [w]:=[?b]*(r?/?2) when r=1, and [w?]:=[?b]*r? when r=0. An inverse normalizer (21) calculates [w][c?] and performs ?? bits right-shift.

Abstract: A secure selective product computation system (100) has conditions [c0], . . . , [cn?1] and a binary table including m0,0, m0,1, . . . , mn?1,0, and mn?1, 1 as inputs, and outputs a total product [A] of multipliers selected according to the conditions. A condition integrator (11) calculates share values [cici+1]. A table convertor (12) generates a 4-value table including m?00, m?01, m?10, and m?11 A public value multiplier (13) calculates [ai]:=[cici+1](m00+m11?m01?m10)+[ci](mi+1,0?mi,0)+[ci+1](mi,1?mi,0)+mi,0. A real number multiplier (14) calculates a value [A] obtained by multiplying all [ai]. A selective multiplier (15) multiplies [A] by a multiplier selected from multipliers mn?1, 0 and mn?1,1 according to cn?1 when n is an odd number.

Abstract: A secret share value [q] of a quotient q of a/p is obtained through secure computation using a secret share value [a] and a modulus p and [a/d0]=[(a+qp)/d0]?[q]p/d0, . . . , [a/dn?1 ]=[(a+qp)/dn?1]?[q]p/dn?1 are obtained and output through secure computation using secret share values [a] and [q], divisors d0, . . . , dn?1, and a modulus p. Here, [?] is a secret share value of ?, a is a real number, n is an integer equal to or greater than 2, d0, . . . , dn?1 are divisors of real numbers, p is a modulus of a positive integer, and q is a quotient of a positive integer.

Abstract: A computation apparatus, a method of the same, and a program which perform a secure computation using fixed-point arithmetic, and overflow is unlikely to occur and the occurrence of division by zero can be detected when an odds ratio is calculated. The computation apparatus includes an odds ratio computation unit for obtaining an odds ratio between a first group (a+b) and a second group (c+d) based on four plaintext values a, b, c, and d, by means of secure computation; a zero-division detection unit for determining, by means of secure computation, whether or not at least one of the plaintext values b and c is not zero, and detecting division by zero; and a selection unit for selecting the odds ratio if division by zero is not detected, by means of secure computation.

Abstract: A secret share value [y]=[?x2+ax] is obtained through secure computation using a secret share value [x] of a real number x, and a secret share value [func(x)]=[y(?y+b)+cx] of an elementary function approximation value z=func(x) of the real number x is obtained and output through secure computation using secret share values [x] and [y]. Here, x, y, and z are real numbers, a, b, c, ?, and ? are real number coefficients, and a secret share value of · is [·].

Abstract: A secure computation device obtains concealed information {M(i0, . . . , iS?1)} of a table M(i0, . . . , iS?1) having one-variable function values as its members. It is to be noted that M(ib, 0, . . . , ib, S?1) generated by substituting counter values ib, 0, . . . , ib, S?1 into the table M(i0, . . . , iS?1) represents a matrix Mb, ?, ?, which is any one of Mb, 2, 1, . . . , Mb, 3, 2. The secure computation device obtains concealed information {Mb, ?, ?} by secure computation using concealed information {ib, 0}, . . . , {ib, S?1} and the concealed information {M(i0, . . . , iS?1)}, and obtains concealed information {Mb, ?, MU} of a matrix Mb, ?, MU, which is obtained by execution of a remaining process including those processes among a process Pj, 1, a process Pj, 2, a process Pj, 3, and a process Pj, 4, that are performed subsequent to a process P?, ?.

Abstract: The present invention provides techniques to calculate the number of surviving and the number of deaths while still concealing survival time data. The present invention includes: a group data position calculation means configured to calculate a share [[gA]] of a sequence gA and a share [[gB]] of a sequence gB represented by predetermined equations from a share [[g]] of a sequence g of values of group of survival time data included in a survival time data set D; a group data number calculation means configured to calculate a share [[sA]] and a share [[sB]] from a share [[t]] of a sequence t of values of time of survival time data included in the survival time data set D, the share [[gA]], and the share [[gB]], by [[sA]]=GroupSum ([[gA]], [[t]]), [[sB]]=GroupSum ([[gB]], [[t]]); and a survival number calculation means.

Abstract: A secure table reference system includes a first combining part 11n for generating [v?] of v? ? Fm+nt in which d and v are combined, a difference calculation part 12n for generating [r?] of r? that has a difference between a certain element of r and an element before the certain element as an element corresponding to the certain element, a second combining part 13n for generating [r?] of r? ? Fm+nt in which r? and an m-dimensional zero are combined, a permutation calculation part 14n for generating {{?}} of a permutation ? that stably sorts v? in ascending order, a permutation application part 15n for generating [s] of s: =?(r?) obtained by applying the permutation ? to r?, a vector generation part 16n for generating [s?] of a prefix-sum s? of s, an inverse permutation application part for generating [s?] of s? obtained by applying an inverse permutation ??1 of the permutation ? to s?, and an output part 17n for generating [x] of x ? Fm consisting of (nt+1)th and subsequent elements of s?.

Abstract: A calculation of a gradient descent method in secure computing is performed at high speed while maintaining accuracy. A secure gradient descent computation method calculates a gradient descent method while keeping a gradient and a parameter concealed. An initialization unit initializes concealed values [M], [V] of matrices M, V (S11). A gradient calculation unit determines concealed value [G] of a matrix G of a gradient g (S12). A parameter update unit calculates [M] ?1 [M]+(1??1) [G] (S13-1), calculates [V]??2 [V]+(1??2) [G]?[G] (S13-2), calculates [M{circumflex over (?)}]??{circumflex over (?)}1, t [M] (S13-3), calculates [V{circumflex over (?)}]??{circumflex over (?)}2, t [V] (S13-4), calculates [G{circumflex over (?)}]?Adam ([V{circumflex over (?)}]) (S13-5), calculates [G{circumflex over (?)}]?[G{circumflex over (?)}]?[M{circumflex over (?)}] (S13-6), and calculates [W]?[W]?[G{circumflex over (?)}] (S13-7).

Abstract: The present invention provides a technique for performing confidential sort at a faster speed than in the prior art. A confidential sort system comprises first to Mth apparatuses. The first to Mth apparatuses obtain inverse substitution [[?0?1]] of L-bit stable sort of {?k0}. The first to Mth apparatuses perform, on i=1, . . . , N?1, a process of converting [[?i-1?1]] to hybrid substitution to obtain {?i-1?1}, a process of inversely substituting {?ki} with {?i-1?1} to obtain {?i-1?ki}, a process of obtaining inverse substitution [[??i?1]] of L-bit stable sort of [[?i-1?ki]], a process of synthesizing {?i-1?1} with [[??i?1]] to obtain [[?i?1]]:=[[?i-1?1??i?1]], and a process of converting [[?N-1?1]] to hybrid substitution to obtain {?N-1?1}. The first to Mth apparatuses inversely substitute [[?v]] with {?N-1?1} and output [[?N-1?v]].

Abstract: Pi and P+ have stored a+?{a0, a1, a2} and b+?{b0, b1, b2} therein, and Pi and P? have stored a??A? and b??B? therein. Here, P+?P(i+1)mod 3, P?=P(i?1)mod 3, and a and b are arbitrary values and satisfy a=a0+a1+a2 and b=b0+b1+b2, where A? is a complement of a+ in {a0, a1, a2} and B? is a complement of b+ in {b0, b1, b2}. Pi and P+ share r+, Pi and P? share r?, and Pi calculates c+=(a++a?)(b++b?)?a?b?+r+?r?. Pi sends c+ to P+.

Abstract: Techniques for performing secure computing of softmax functions at high speed and with high accuracy are provided. A secure softmax function calculation system that calculates a share ([[softmax (u1)]], . . . , [[softmax (uJ)]]) from a share ([[u1]], . . . , [[uJ]]) includes a subtraction means for calculating a share ([[u1?u1]], [[u2?u1]], . . . , [[uJ?uJ]]), a first secure batch mapping calculation means for calculating, [[exp (u1?u1)]], [[exp (u2?u1)]], . . . , [[exp (uJ?uJ)]], an addition means for calculating a share ([[?j=1J exp (uj?u1)]], . . . , [[?j=1J exp (uj?uJ)]], and a second secure batch mapping calculation means for calculating a share ([[softmax (u1)], . . . , [[softmax (uJ)]]).

Abstract: To efficiently determine cross tabulation while keeping confidentiality. A flag conversion unit (11) converts a format of a share of a flag that represents a boundary between groups. A boundary number setting unit (12) generates a share of a vector in which the next element number is set when the flag representing a group boundary is true and the number of records is set when the flag is false. A sorting unit (13) generates a share of a sorted vector which has been sorted by a permutation that moves vectors such that the last elements of each group are sequentially arranged from beginning A count calculation unit (14) sets a difference between the value of one element and the value of the preceding element in the sorted vector and generates a share of a vector representing the number of records in each group.