Abstract: An efficient share recovery technique for Shamir's secret sharing is provided. n share recovery apparatuses p0, . . . , pn?1 generate a share [r]i of a secretly shared value shared through Shamir's secret sharing, which becomes a random number r when restored. k share recovery apparatuses ?0, . . . , ?k?1 calculate a share [b]i by subtracting the share [r]i from a share [a]i. The share recovery apparatus ?k receives the shares [b]0, . . . , [b]k?1 from the share recovery apparatuses ?0, . . . , ?k?1. The share recovery apparatus ?k recovers shares [b]k, . . . , [b]k+m?1 using the shares [b]0, . . . , [b]k?1. m?1 share recovery apparatuses ?k+1, . . . , ?k+m?1 receive a share [b]j from the share recovery apparatus ?k. m share recovery apparatuses ?k, . . . , ?k+m?1 calculate the share [a]j by adding the share [r]j to the share [b]j.

Abstract: A secret share value of object data on which secure computation is to be performed is stored in a secure computation device, and a query which requests secure computation or secret share value of the query is input to the secure computation device. The secure computation device performs consistency verification of the secret share value of the object data and consistency verification of the query or the secret share value of the query, obtains a secret share value of a calculation result by performing secure computation in accordance with the query or the secret share value of the query which passed the consistency verification by using the secret share value of the object data which passed the consistency verification, and outputs the secret share value of the calculation result.

Abstract: A secret computation system is a secret computation system for performing computation while keeping data concealed, and comprises a cyphertext generation device that generates cyphertext by encrypting the data, a secret computation device that generates encrypted basic statistics by performing secret computation of predetermined basic statistics using the cyphertext while keeping the cyphertext concealed, and a computation device that generates decrypted basic statistics by decrypting the encrypted basic statistics and performs predetermined computation using the decrypted basic statistics.

Abstract: A share [x]i of plaintext x in accordance with Shamir's secret sharing scheme is expressed by N shares [x0]i, . . . , [xN?1]i, and each share generating device Ai obtains a function value ri=Pm(i(?))(si) of a seed si, obtains a first calculated value ?i=?(i, i(?))[xi(?)]i+ri using a Lagrange coefficient ?(i, i(?)), a share [xi(?)]i, and the function value ri, and outputs the first calculated value ?i to a share generating device Ai(?). Each share generating device Ai accepts a second calculated value ?i(+), obtains a third calculated value zi=?(i, i(+))[xi]i+?i(+) using a Lagrange coefficient ?(i, i(+)), a share [xi]i, and the second calculated value ?i(+), and obtains information containing the seed si and the third calculated value zi as a share SSi of the plaintext x in secret sharing and outputs the share SSi.

Abstract: The present invention provides a technique for performing confidential sort at a faster speed than in the prior art. A confidential sort system comprises first to Mth apparatuses. The first to Mth apparatuses obtain inverse substitution [[?0?1]] of L-bit stable sort of {?k0}. The first to Mth apparatuses perform, on i=1, . . . , N?1, a process of converting [[?i?1?1]] to hybrid substitution to obtain {?i?1?1}, a process of inversely substituting {?ki} with {?i?1?1} to obtain {?i?1?ki}, a process of obtaining inverse substitution [[??i?1]] of L-bit stable sort of [[?i?1?ki]], a process of synthesizing {?i?1?1} with [[??i?1]] to obtain [[?i?1]]:=[[?i?1?1??i?1]], and a process of converting [[?N?1?1]] to hybrid substitution to obtain {?N?1?1}. The first to Mth apparatuses inversely substitute [[?v]] with {?N?1?1} and output [[?N?1?v]].

Abstract: Pi and P+ have stored a+?{a0, a1, a2} and b+?{b0, b1, b2} therein, and Pi and P? have stored a??A? and b??B? therein. Here, P+?P(i+1)mod3, P?=P(i?1)mod3, and a and b are arbitrary values and satisfy a=a0+a1+a2 and b=b0+b1+b2, where A? is a complement of a+ in {a0, a1, a2} and B? is a complement of b+ in {b0, b1, b2}. Pi and P+ share r+, Pi and P? share r?, and Pi calculates c+=(a++a?)(b++b?)?a?b?+r+?r?. Pi sends c+ to P+.

Abstract: A secret sharing value of a value represented by a “first target bit string” is used to obtain a secret sharing value of a value represented by a “first check bit string” obtained by setting a value of the most significant bit of the “first target bit string” to a value of a “first check bit” that is lower than the most significant bit. Here, the “first target bit string” corresponds to a null value when the most significant bit is 1 and corresponds to a real number when the most significant bit is 0. Next, the secret sharing value of the value represented by the “first check bit string” is used to obtain secret sharing values of bit values of the least significant bit to “first check bit” of the “first check bit string”.

Abstract: An inconsistency in shares is detected with a small volume of communications traffic. n inconsistency detecting devices generate random numbers si and make the random numbers si public. The n inconsistency detecting devices generate a common random number s which is the sum total of the random numbers s0, . . . , sn?1. The n inconsistency detecting devices calculate shares [c]i. The n inconsistency detecting devices generate shares [r]i, each of which would become a random number r by reconstruction. The n inconsistency detecting devices calculate shares [d]i, each of which would become a judgment value d by reconstruction. One inconsistency detecting device receives shares [d]1, . . . , [d]n?1 from n?1 inconsistency detecting devices. The one inconsistency detecting device restores n?k shares [d]?k, . . . , [d]?n?1 from k shares [d]0, . . . , [d]k?1. The one inconsistency detecting device judges, for j=k, . . . , n?1, whether or not a share [d]j and a share [d]?j coincide with each other.

Abstract: The present invention can be efficiently applied to secure computation and can achieve a low probability of successful tampering. A tampering detection device includes a parameter storage storing parameters ?ijk for uniformly mapping from two elements of a ring Rq to one element of the ring Rq, a division part 12 dividing N values a0, . . . , aN?1 into sets of q values to generate value vectors A0, . . . , A??1, a generation part 14 generating a checksum c, and a verification part 15 comparing a verification value generated by using the value vectors A0, . . . , A??1 with the checksum c to determine whether or not any of the values a0, . . . , aN?1 has been tampered with. Here, N and q are integers greater than or equal to 2 and ? is a minimum integer greater than or equal to N/q.

Abstract: A Fisher's exact test calculation apparatus includes: a condition storage 1 that has stored therein a condition for determining whether a result of Fisher's exact test corresponding to input is significant or not, the input being frequencies in a summary table; and a calculation unit 2 that obtains the result of Fisher's exact test corresponding to the frequencies in the summary table by inputting the frequencies in the summary table to the condition read from the condition storage 1.

Abstract: A Fisher's exact test calculation apparatus includes a selection unit that selects summary tables for which a result of Fisher's exact test indicative of being significant will be possibly obtained from among a plurality of summary tables based on a parameter obtained in calculation in course of determining the result of Fisher's exact test, and a calculation unit that performs calculations for Fisher's exact test for each of the selected summary tables.

Abstract: Fisher's exact test is efficiently computed through secure computation. It is assumed that a, b, c and d are frequencies of a 2×2 contingency table, [a], [b], [c] and [d] are secure texts of the respective frequencies a, b, c and d, and N is an upper bound satisfying a+b+c+d?N. A reference frequency computation part 12 computes a secure text ([a0], [b0], [c0], [d0]) of a combination of reference frequencies (a0, b0, c0, d0) which are integers satisfying a0+b0=a+b, c0+d0=c+d, a0+c0=a+c, and b0+d0=b+d. A number-of-patterns determination part 13 determines integers h0 and h1 satisfying h0?h1. A pattern computation part 14 computes [ai]=[a0]+i, [bi]=[b0]?i, [ci]=[c0]?i and [di]=[d0]+i for i=h0, . . . , h1, and obtains a set S={([ai], [bi], [ci], [di])}i of secure texts of combinations of frequencies (ai, bi, ci, di).

Abstract: Data processing is performed while personal information is kept concealed. A registrant terminal splits a registration input password and allocates the split pieces to secure computation servers. The secure computation servers verify whether the password matches. The registrant terminal splits target data and allocates the data shared values to the secure computation servers. The secure computation servers store the data shared values. A user terminal splits a utilization input password and allocates the split pieces to the secure computation servers. The secure computation servers verify whether the password matches. The user terminal sends a data processing request to the secure computation servers. The secure computation servers execute secure computation of the data shared values to generate processing result shared values. The user terminal recovers the processing result from the processing result shared values.

Abstract: A secret parallel processing device reducing communication amount includes: a randomization unit that obtains a non-randomized input sequence and outputs a randomized sequence obtained by joining the non-randomized sequence and a dummy record sequence formed of a disclosed value and subjecting the joined sequences to random replacement processing and concealed random replacement data obtained by concealing used random replacement data; a calculation unit that obtains the non-randomized sequence, the randomized sequence, and the dummy record sequence, applies a predetermined function to the sequences, and generates an output checksum for each sequence by using calculation procedure data used in the processing of applying the function; and a correctness verification unit that obtains the output checksum for each sequence and the concealed random replacement data, assesses the output checksum for each sequence, and outputs a final test result determining whether the predetermined function has been correctly appl

Abstract: Secret calculation including secret sorting is performed at high speed. Permutation data generation step S10 generates permutation data <?i> and <??i> so as to generate permutation data <?L>. Random ID column generation step S12 generates a random ID column [r?i] so as to generate a random ID column [r?L]. Secret random permutation step S14 performs secret random permutation of a set composed of a random ID column [r?i?1], a key column [k?i], and the random ID column [r?i] with the permutation data <?i>. Flag creation step S16 sets a flag [fj,h] by using a key [kj]=([kj,0], . . . , [kj,L?1]). Order table creation step S18 creates an order table [s?] by using the flag [fj,h]. Sort permutation generation step S20 generates sort permutation ???1L by using the random ID column [r?i], the order table [s?], a post-permutation key column [?ik?i], and a post-permutation random ID column [?ir?i].

Abstract: A second set including a plurality of elements a5(1), . . . , a5(N) or a concealed text of the second set is obtained, where the second set is obtained by setting a replication source element a(f(h)) included in a first set to an element a(f(h))?a(f(h?1)) and setting elements other than the replication source in the first set to zero with respect to h=2, . . . , M. An additive inverse of a replication source element a(f(h?1)) of which the order is before the replication source element a(f(h)) and is the closest to the replication source element a(f(h)) is ?a(f(h?1)). The second set or the concealed text of the second set is used to obtain a third set or a concealed text of the third set. The third set is a set including a first element b(1)=a5(1) and i=2, . . . , Nth element b(i)=b(i?1)+a5(i).

Abstract: A secret share value of object data on which secure computation is to be performed is stored in a secure computation device, and a query which requests secure computation or secret share value of the query is input to the secure computation device. The secure computation device performs consistency verification of the secret share value of the object data and consistency verification of the query or the secret share value of the query, obtains a secret share value of a calculation result by performing secure computation in accordance with the query or the secret share value of the query which passed the consistency verification by using the secret share value of the object data which passed the consistency verification, and outputs the secret share value of the calculation result.

Abstract: A secret quotient transfer device that can reduce the communication cost. On the assumption that u denotes a natural number and represents a boundary value, m denotes an integer that satisfies a relation m?2u, i denotes an integer from 0 to m?1, a plain text a is an integer that is equal to or greater than 0 and smaller than an arbitrary modulo p, the integers a and 0 are congruent modulo 2u, and the plain text a is expressed as a sum of m sub-shares x0, . . . , xm-1, the secret quotient transfer device computes a quotient q of the division of a total sum aZ of the sub-shares by p according to q=?(i<m)xi mod 2u.

Abstract: Secret calculation including secret random permutation is performed at high speed. In unit permutation, random permutation devices p0, . . . , pk-1 perform permutation of additive secret sharing values «a»?i of a plain text a with sub shares ??i of permutation data ?. In resharing, the random permutation device p0 generates additive secret sharing values «a»?i+1pk by using random numbers r1, . . . , rk-1 which are respectively shared with random permutation devices pj (j=1, . . . , k?1) so as to transmit the additive secret sharing values «a»?i+1pk to the random permutation device pk and each of the random permutation devices pj generates additive secret sharing values «a»?i+1pj by using random numbers rj.

Abstract: A secret sharing value of a value represented by a “first target bit string” is used to obtain a secret sharing value of a value represented by a “first check bit string” obtained by setting a value of the most significant bit of the “first target bit string” to a value of a “first check bit” that is lower than the most significant bit. Here, the “first target bit string” corresponds to a null value when the most significant bit is 1 and corresponds to a real number when the most significant bit is 0. Next, the secret sharing value of the value represented by the “first check bit string” is used to obtain secret sharing values of bit values of the least significant bit to “first check bit” of the “first check bit string”.