Abstract: A share generating device obtains N seeds s0, . . . , sN?1, obtains a function value y=g(x, e) ? Fm of plaintext x ? Fm and a function value e, and obtains information containing a member yi and N?1 seeds sd, where d ? {0, . . . , N?1} and d?i, as a share SSi of the plaintext x in secret sharing and outputs the share SSi. It is to be noted that the function value y is expressed by members y0 ? Fm(0), . . . , yN?1 ? Fm(N?1) which satisfy m=m(0)+ . . . +m(N?1).

Abstract: A share generating device obtains N seeds s0, . . . , sN?1, obtains a function value y=g(x, e)?Fm of plaintext x?Fm and a function value e, and obtains information containing a member yi and N?1 seeds sd, where d?{0, . . . , N?1} and d?i, as a share SSi of the plaintext x in secret sharing and outputs the share SSi. It is to be noted that the function value y is expressed by members y0?Fm(0), . . . , yN?1?Fm(N?1), which satisfy m=m(0)+ . . . +m(N?1).

Abstract: A secure computation device obtains a first concealed verification value [z]i=[w??]i with secure computation by using concealed authentication information [w]i which is preliminarily stored and concealed authentication information [?]i which is inputted, obtains a concealed extension field random number [rm]i?[F?] which is a secret sharing value of an extension field random number rm, obtains a second concealed verification value [ym]i in which ym is concealed with secure computation by using the first concealed verification value [z]i, and obtains a third concealed verification value [rmym]i with secure computation by using the concealed extension field random number [rm]i and the second concealed verification value [ym]i and outputs the third concealed verification value [rmym]i.

Abstract: An aggregate median is efficiently obtained while confidentiality is kept. An order computing part generates ascending order a and descending order d within a group when a table which has been stably sorted based on a desired value attribute and a key attribute is grouped based on the key attribute. A subtracting part generates shares {a-d}, {d-a} of a-d, d-a. A bit deleting part generates shares {a?}, {d?} of a?, d? obtained by excluding least significant bits from {a-d}, {d-a}. An equality determining part generates shares {a?}, {d?} of {a?}:={|a?=0|}, {d?}:={|d?=0|}. A format converting part (15) converts {a?}, {d?} into [a?], [d?]. A flag applying part generates shares [va], [vd] of [va]:=[v1a?], [vd]:=[v1d?]. A permutation generating part generates shares {{?a}}, {{?d}} of permutations ?a, ?d which sort ¬a?, ¬d?. A median computing part generates a share [x] of a vector x.

Abstract: An agreement apparatus P(i) (where i=0, . . . , n?1) which executes a consensus protocol generates an opinion value with a signature Xij=(xi, sig_i(xi)) including an opinion value xi indicating an opinion and a signature sig_i(xi) on the opinion value xi or information different from the opinion value with the signature Xij as an opinion value with a signature X?ij=(x?ij, e?ij) and outputs the opinion value with the signature X?ij to an agreement apparatus P(j) (where j=0, . . . , n?1, i?j). The agreement apparatus P(j) accepts the opinion value with the signature X?ij and outputs the opinion value with the signature X?ij or information different from the opinion value with the signature X?ij to an agreement apparatus P(m) (where m=0, . . . , n?1, m?i, m?j) as an opinion value with a signature X?ij.

Abstract: The present invention implements high-speed right shift computation and division in secure computation. According to the present invention, a public value multiplication part calculates [a?]=[2ua] from a distributed value [a] of a value “a.” A first conversion part converts [a?] into additive secret sharing. A right shift computation part calculates <s>i=<a?>i>>b+u. A second conversion part converts <s> into linear secret sharing. A first bit conversion part converts lower u bits of <a?>i into {a?i mod 2u}. A quotient transfer part 16 obtains lower u bits of ??i<m{a?i mod 2u} as {q}. A second bit conversion part converts lower b+u bits of <a?>i into {a?iR}={a?i mod 2b+u}. An addition part calculates {z}=?i<m{a?iR}+{q}, and obtains a bit sequence {zQ} of a (b+u)-th bit and after of {z}. A third conversion part converts {q} and {zQ} into linear secret sharing. An output computation part outputs [s]?[2l?(b+u)q]+[zQ] as [a>>b].

Abstract: An aggregate maximum is efficiently obtained while keeping confidentiality. A flag converting part (12) converts a form of a share of a flag representing a last element of a group. A flag applying part (13) generates a share of a vector in which a value of a value attribute is set if a flag representing the last element of the group is true, and a predetermined value is set if the flag is false. A sorting part (14) generates a share of a sorted vector obtained by sorting the vector with a permutation which moves elements so that the last elements of each group are sequentially arranged from beginning. An output part (15) generates and outputs a share of a vector representing a maximum of each group from the sorted vector.

Abstract: A secure equijoin technique of generating one table from two tables while curbing the volume of communications traffic is provided. The technique includes: a first permutation generating means 110 that generates a permutation <?> from an element sequence which is generated from the first column of a table L and the first column of a table R; a first column generating means 120 that generates, for j=2, . . . , a, by using the permutation <?>, a prefix sum, and an inverse permutation <??1>, the j-th column of a table J from an element sequence which is generated from the to j-th column of the table L; a join-result element sequence generating means 130 that generates a join-result element sequence from an element sequence ([[1]], . . . , [[1]], [[0]], . . . , [[0]], [[?1]], . . . , [[?1]]) by using the permutation <?>, the prefix sum, and the inverse permutation <??1>; a second column generating means 140 that generates, for j=a+1, . . .

Abstract: An aggregate order is efficiently obtained while keeping confidentiality. An inverse permutating part (12) generates a share of a vector representing an inversely permutated cross tabulation by applying inverse permutation to a cross tabulation of a table, the inverse permutation being a permutation which moves elements so that, when the table is grouped based on a key attribute, last elements of each group are sequentially arranged from beginning. A partial summing part (13) computes a prefix sum from the inversely permutated cross tabulation. The order computing part (14) generates a share of a vector representing ascending order within a group from a result of the prefix sum.

Abstract: A technique for performing secure computation of a sigmoid function with high speed and precision is provided. A secret sigmoid function calculation system is a system, in which g(x) is assumed to be a secure computable function, which calculates, from a share [[x]] of an input value x, a share [[??(x)]] of a value of a sigmoid function for the input value x, and includes: a first comparing means that generates a first comparison result [[c]]=less_than([[x]], t1); a second comparing means that generates a second comparison result [[d]]=greater_than([[x]], t0); a first logical computation means that generates a first logical computation result [[e]]=not([[c]]); a second logical computation means that generates a second logical computation result [[k]]=and([[c]], [[d]]) or [[k]]=mul([[c]], [[d]]); and a function value calculating means that calculates the share [[??(x)]]=mul([[k]], [[g(x)]])+[[e]].

Abstract: An aggregate median is efficiently obtained while confidentiality is kept. An order computing part generates ascending order a and descending order d within a group when a table which has been stably sorted based on a desired value attribute and a key attribute is grouped based on the key attribute. A subtracting part generates shares {a?d}, {d?a} of a?d, d?a. A bit deleting part generates shares {a?}, {d?} of a?, d? obtained by excluding least significant bits from {a?d}, {d?a}. An equality determining part generates shares {a?}, {d?} of {a?}:={|a?=0|}, {d?}:={|d?=0|}. A format converting part (15) converts {a?}, {d?} into [a?], [d?]. A flag applying part generates shares [va], [vd] of [va]:=[v1a?], [vd]:=[v1d?]. A permutation generating part generates shares {{?a}}, {{?d}} of permutations ?a, ?d which sort ¬a?, ¬d?. A median computing part generates a share [x] of a vector x.

Abstract: A secure sigmoid function calculation system is a system in which map? is assumed to be secure batch mapping defined by parameters (a0, . . . , ak-1) representing the domain of definition of a sigmoid function ?(x) and parameters (?(a0), . . . , ?(ak-1)) representing the range of the sigmoid function ?(x) (a0, . . . , ak-1 are real numbers that satisfy a0< . . . <ak-1) and which is configured with three or more secure sigmoid function calculation apparatuses and calculates, from a share [[x?]] of an input vector x?, a share [[y?]] of a value y? of a sigmoid function for the input vector x?, the system including a secure batch mapping calculating means that calculates the share [[y?]] by [[y?]]=map?([[x?]])=([[?(af(0))]], . . . , [[?(af(m-1)]]) (where f(i) (0?i?m?1) is j that makes aj?xi<aj+1 hold).

Abstract: Provided is a technique for performing statistical processing such as processing for obtaining parameters of logistic regression analysis faster than before. A secure statistical processing system includes a cross tabulation table computing device 2 that performs secure computation on a cross tabulation table in which frequencies are in plain texts while keeping each record concealed; and a statistical processing device 3 that performs predetermined statistical processing using the cross tabulation table in which frequencies are in plain texts. The cross tabulation table computing device 2 may include a plurality of secure computation devices 221, . . . , 22N that perform secure computation on a cross tabulation table in which frequencies are fragments subjected to secret sharing while keeping each record concealed, and a management device 21 that restores the fragments to compute the cross tabulation table in which frequencies are in plain texts.

Abstract: To detect tampering in secure computation while maintaining confidentiality with a little communication traffic. A random number generation part (11) generates [{right arrow over (?)}ri], [{right arrow over (?)}si]. A random number multiplication part (12) computes [{right arrow over (?)}ti]:=[{right arrow over (?)}ri{right arrow over (?)}si]. A secret multiplication part (13) computes [{right arrow over (?)}z]:=[{right arrow over (?)}x{right arrow over (?)}y]. A random number verification part (14) discloses a pi,jth element of each of [{right arrow over (?)}ri], [{right arrow over (?)}si], [{right arrow over (?)}ti] and confirms whether the element has integrity as multiplication. A random number substitution part (15) randomly substitutes elements in each of [{right arrow over (?)}ri], [{right arrow over (?)}si], [{right arrow over (?)}ti] except for the pi,j-th element to generate [{right arrow over (?)}r?i], [{right arrow over (?)}s?i], [{right arrow over (?)}t?i].

Abstract: A secure joining system is a secure joining system including a plurality of secure computing apparatuses. The plurality of secure computing apparatuses include a first vector joining unit, a first permutation calculation unit, a first vector generation unit, a second vector joining unit, a first permutation application unit, a second vector generation unit, a first inverse permutation application unit, a first vector extraction unit, a second permutation application unit, a third vector generation unit, a second inverse permutation application unit, a second vector extraction unit, a modified second table generation unit, a third permutation application unit, a fourth vector generation unit, a shifting unit, a third inverse permutation application unit, a bit inversion unit, a third vector extraction unit, a modified first table generation unit, a first table joining unit, and a first table formatting unit.

Abstract: A secure joining system is a secure joining system comprising a plurality of secure computation apparatuses; and the plurality of secure computation apparatuses are provided with vector joining parts 11n, first permutation calculating parts 12n, first permutation applying parts 13n, first vector generating parts 14n, second vector generating parts 15n, bit-flipping parts 16n, second permutation calculating parts 17n, second permutation applying parts 18n, third vector generating parts 19n, inverse permutation applying parts 110n, vector separating parts 111n, third permutation applying parts 112n, attribute value permutating parts 113n and fourth vector generating parts 114n.

Abstract: To perform permutation processing at high speed. A number-of-elements determination unit (22) calculates the number of elements to be contained in each allocation destination. A start position determination unit (23) calculates a start position corresponding to each allocation destination. An allocation destination determination unit (24) calculates a sequence of values representing allocation destinations in a buffer. A permutation generating unit (25) calculates a sequence of values representing permutation destinations within the respective allocation destination. An initial position setting unit (31) sets the start position into a value indicating a position within processing corresponding to each allocation destination. A rearrangement unit (32) sets the elements of a vector into the respective allocation destinations in the buffer. A permutation execution unit (33) generates an output vector by executing an arbitrary inverse permutation algorithm on the respective allocation destinations.

Abstract: An aggregate maximum is efficiently obtained while keeping confidentiality. A flag converting part (12) converts a form of a share of a flag representing a last element of a group. A flag applying part (13) generates a share of a vector in which a value of a value attribute is set if a flag representing the last element of the group is true, and a predetermined value is set if the flag is false. A sorting part (14) generates a share of a sorted vector obtained by sorting the vector with a permutation which moves elements so that the last elements of each group are sequentially arranged from beginning. An output part (15) generates and outputs a share of a vector representing a maximum of each group from the sorted vector.

Abstract: To efficiently determine intermediate data for use with an aggregate function while keeping confidentiality, a bit decomposition unit generates a share of a bit string by bit decomposition and concatenation of key attributes. A group sort generation unit generates a share of a first permutation, which performs a stable sort of the bit string in ascending order. A bit string sorting unit generates a share of a sorted bit string obtained by sorting the bit string with the first permutation. A flag generation unit generates a share of a flag indicating a boundary between groups. A key aggregate sort generation unit generates a share of a second permutation, which performs a stable sort of the negation of the flag in ascending order. A de-duplication unit generates shares of de-duplicated key attributes. A key sorting unit generates shares of sorted key attributes by sorting the de-duplicated key attributes.

Abstract: A secure joining system is a secure joining system including a plurality of secure computing apparatuses. The plurality of secure computing apparatuses include a vector joining unit 11n, a first vector generation unit 12n, a first permutation calculation unit 13n, a first permutation application unit 14n, a second vector generation unit 15n, a third vector generation unit 16n, a second permutation calculation unit 17n, a second permutation application unit 18n, a fourth vector generation unit 19n, a fifth vector generation unit 110n, a first inverse permutation application unit 111n, a first vector separation unit 112n, a second inverse permutation application unit 113n and a second vector separation unit 114n, a third permutation application unit 115n, a fourth permutation application unit 116n, and a first joined table generation unit 117n.