Abstract: The present invention provides techniques to calculate the number of surviving and the number of deaths while still concealing survival time data. The present invention includes: a group data position calculation means configured to calculate a share [[gA]] of a sequence gA and a share [[gB]] of a sequence gB represented by predetermined equations from a share [[g]] of a sequence g of values of group of survival time data included in a survival time data set D; a group data number calculation means configured to calculate a share [[sA]] and a share [[sB]] from a share [[t]] of a sequence t of values of time of survival time data included in the survival time data set D, the share [[gA]], and the share [[gB]], by [[sA]]=GroupSum ([[gA]], [[t]]), [[sB]]=GroupSum ([[gB]], [[t]]); and a survival number calculation means.

Abstract: When an inside iterative calculation does not end after a predetermined number of iterations, a midway value of a loop variable is retained and a calculation of an output value is not performed in an outside iterative calculation. In addition, subsequently, execution of the iterative calculation is continued using the value of the loop variable having been retained when the inside iterative calculation is executed once again. In other words, in each iterative calculation, an object iterative calculation is only performed when all iterative calculations immediately inside the object iterative calculation have ended. Recursively performing these processing steps enables wasteful calculation in inside iterative calculations to be reduced.

Abstract: A secure table reference system includes a first combining part 11n for generating [v?] of v? ? Fm+nt in which d and v are combined, a difference calculation part 12n for generating [r?] of r? that has a difference between a certain element of r and an element before the certain element as an element corresponding to the certain element, a second combining part 13n for generating [r?] of r? ? Fm+nt in which r? and an m-dimensional zero are combined, a permutation calculation part 14n for generating {{?}} of a permutation ? that stably sorts v? in ascending order, a permutation application part 15n for generating [s] of s: =?(r?) obtained by applying the permutation ? to r?, a vector generation part 16n for generating [s?] of a prefix-sum s? of s, an inverse permutation application part for generating [s?] of s? obtained by applying an inverse permutation ??1 of the permutation ? to s?, and an output part 17n for generating [x] of x ? Fm consisting of (nt+1)th and subsequent elements of s?.

Abstract: An approximate function calculation apparatus includes: a first error upper bound calculating unit which obtains an upper bound of a first error of an approximation of a function f(x) by the function gb(x) in a section [x0, b]; an expansion position calculating unit which obtains an expansion position b? that represents a maximum b at which the upper bound of the first error; a second error upper bound calculating unit which obtains an upper bound of a second error of an approximation of the function f(x) by a function gb?(x) in a section [b?, x2]; a right end position calculating unit which calculates a right end position x2? that represents a maximum x2 at which the upper bound of the second error; and a control unit which repeats processing of the respective units with a section [x2?, x1] as the section D.

Abstract: A search key is generated (S20). A key relationship array is transmitted (S11). If an element matching the key relationship array is present, the found search key is held (S21). A key relationship index is transmitted (S22). A record read out using the key relationship index is transmitted (S12). If the record matches the search key, the found search key is held (S23). The found search key is set for an empty element of the key relationship array and is transmitted (S24). A data array is transmitted (S13). If an element matching the data array is present, the found data is held (S25). A data index is transmitted (S26). A record read out using the data index is transmitted (S14). If the record matches the search key, the found data is held (S27). Desired data is set for an empty element of the data array and is transmitted (S28).

Abstract: A calculation of a gradient descent method in secure computing is performed at high speed while maintaining accuracy. A secure gradient descent computation method calculates a gradient descent method while keeping a gradient and a parameter concealed. An initialization unit initializes concealed values [M], [V] of matrices M, V (S11). A gradient calculation unit determines concealed value [G] of a matrix G of a gradient g (S12). A parameter update unit calculates [M] ?1 [M]+(1??1) [G] (S13-1), calculates [V]??2 [V]+(1??2) [G]?[G] (S13-2), calculates [M{circumflex over (?)}]??{circumflex over (?)}1, t [M] (S13-3), calculates [V{circumflex over (?)}]??{circumflex over (?)}2, t [V] (S13-4), calculates [G{circumflex over (?)}]?Adam ([V{circumflex over (?)}]) (S13-5), calculates [G{circumflex over (?)}]?[G{circumflex over (?)}]?[M{circumflex over (?)}] (S13-6), and calculates [W]?[W]?[G{circumflex over (?)}] (S13-7).

Abstract: An initialization unit generates secret values of vectors p{right arrow over (?)}0 and r{right arrow over (?)}0 and a value ?0. A first computation unit generates a secret value of a D-fold value of a vector a{right arrow over (?)}i?1. A second computation unit generates a secret value of a D-fold value of a value ?i?1. A third computation unit generates a secret value of a value ?i?1. A fourth computation unit generates a secret value of a D-fold value of a vector d{right arrow over (?)}i. A fifth computation unit generates a secret value of a vector x{right arrow over (?)}i. A sixth computation unit the generates a secret value of a vector r{right arrow over (?)}i. A seventh computation unit generates a secret value of a D-fold value of a value ?i. An eighth computation unit generates a secret value of a value ?i. A ninth computation unit generates a secret value of a vector p{right arrow over (?)}i.

Abstract: The present invention provides a technique for performing confidential sort at a faster speed than in the prior art. A confidential sort system comprises first to Mth apparatuses. The first to Mth apparatuses obtain inverse substitution [[?0?1]] of L-bit stable sort of {?k0}. The first to Mth apparatuses perform, on i=1, . . . , N?1, a process of converting [[?i-1?1]] to hybrid substitution to obtain {?i-1?1}, a process of inversely substituting {?ki} with {?i-1?1} to obtain {?i-1?ki}, a process of obtaining inverse substitution [[??i?1]] of L-bit stable sort of [[?i-1?ki]], a process of synthesizing {?i-1?1} with [[??i?1]] to obtain [[?i?1]]:=[[?i-1?1??i?1]], and a process of converting [[?N-1?1]] to hybrid substitution to obtain {?N-1?1}. The first to Mth apparatuses inversely substitute [[?v]] with {?N-1?1} and output [[?N-1?v]].

Abstract: Techniques for performing secure computing of softmax functions at high speed and with high accuracy are provided. A secure softmax function calculation system that calculates a share ([[softmax (u1)]], . . . , [[softmax (uJ)]]) from a share ([[u1]], . . . , [[uJ]]) includes a subtraction means for calculating a share ([[u1?u1]], [[u2?u1]], . . . , [[uJ?uJ]]), a first secure batch mapping calculation means for calculating, [[exp (u1?u1)]], [[exp (u2?u1)]], . . . , [[exp (uJ?uJ)]], an addition means for calculating a share ([[?j=1J exp (uj?u1)]], . . . , [[?j=1J exp (uj?uJ)]], and a second secure batch mapping calculation means for calculating a share ([[softmax (u1)], . . . , [[softmax (uJ)]]).

Abstract: Division is realized with a small number of processing stages. A secure computation apparatus (1) obtains a secret value representing a result of divided N by D using a secret value [N] of a real number N and a secret value [D] of a natural number D. An initialization unit (12) sets a secret value [PL1] of a partial remainder PL1 to 0. A parallel comparison unit (13) computes secret values [E1], . . . , [ER?1] of comparison results E1, . . . , ER?1 of comparing a secret value [n] of a partial divisor n=Pj+1R+Nj with [D]×g for each integer g not less than 1 and less than R in parallel. An update unit (14) computes a secret value [Qj] of a quotient Qj and a secret value [Pj] of a partial remainder Pj that satisfy n=DQj+Pj using the secret values [E1], . . . , [ER?1] of the comparison results E1, . . . , ER?1. An iterative control unit (15) executes the parallel comparison unit (13) and the update unit (14) for each integer j from L1?1 to ?L0.

Abstract: An aggregate median is efficiently obtained while confidentiality is kept. An order computing part generates ascending order a and descending order d within a group when a table which has been stably sorted based on a desired value attribute and a key attribute is grouped based on the key attribute. A subtracting part generates shares {a-d}, {d-a} of a-d, d-a. A bit deleting part generates shares {a?}, {d?} of a?, d? obtained by excluding least significant bits from {a-d}, {d-a}. An equality determining part generates shares {a?}, {d?} of {a?}:={|a?=0|}, {d?}:={|d?=0|}. A format converting part (15) converts {a?}, {d?} into [a?], [d?]. A flag applying part generates shares [va], [vd] of [va]:=[v1a?], [vd]:=[v1d?]. A permutation generating part generates shares {{?a}}, {{?d}} of permutations ?a, ?d which sort ¬a?, ¬d?. A median computing part generates a share [x] of a vector x.

Abstract: Access to an array is efficiently performed without reveling an accessed position. A storage 10 stores an array of concealed values [x??] of an array x?? and an array of addresses a?? corresponding to respective elements of the array of concealed values [x??]. A refresh unit 11 determines a concealed value [F] of a random parameter F, an array of concealed values [x?] of an array x? generated by permutating the array x?? with random permutation ?, and an array of public tags b? calculated from respective elements of the array of addresses a? with the function TagF. An access unit 12 performs a desired access to an element of the array of concealed values [x?] corresponding to a tag that is calculated from a concealed value [j] of an access position j with the function Tag and the concealed value [F] of the parameter.

Abstract: A secure computation system calculates concealed text of a difference x?r from concealed text by using concealed text and generates concealed text and of an integer portion e and a decimal fraction portion f (0?f<1) of the difference x?r from the concealed text; reconstructs the decimal fraction portion f from the concealed text; generates, from the decimal fraction portion f and the concealed text, concealed text of a left shift value y obtained by shifting 2f, which is 2 raised to the power f which is the decimal fraction portion f, to the left by e bit; and calculates, as concealed text, concealed text of a value 2r×y obtained by multiplying 2r, which is a power of 2, by the left shift value y from the concealed text by using the concealed text.

Abstract: An agreement apparatus P(i) (where i=0, . . . , n?1) which executes a consensus protocol generates an opinion value with a signature Xij=(xi, sig_i(xi)) including an opinion value xi indicating an opinion and a signature sig_i(xi) on the opinion value xi or information different from the opinion value with the signature Xij as an opinion value with a signature X?ij=(x?ij, e?ij) and outputs the opinion value with the signature X?ij to an agreement apparatus P(j) (where j=0, . . . , n?1, i?j). The agreement apparatus P(j) accepts the opinion value with the signature X?ij and outputs the opinion value with the signature X?ij or information different from the opinion value with the signature X?ij to an agreement apparatus P(m) (where m=0, . . . , n?1, m?i, m?j) as an opinion value with a signature X?ij.

Abstract: An analysis query response system comprises a user terminal 1 that generates and transmits an analysis query, and a database apparatus 2 including an analysis query verification apparatus 22 that includes a verification execution part 222 that performs a first verification of whether the analysis query satisfies a predetermined privacy preservation indicator, and an analysis query execution apparatus 21 that includes a personal data storage part 211 that stores personal data and an analysis query execution and preservation part 214 that, in a case where the first verification is successful, performs an analysis corresponding to the analysis query on the personal data read from the personal data storage part to acquire an analysis result, and applies a predetermined privacy-preserving mechanism to the acquired analysis result.

Abstract: A secure equijoin technique of generating one table from two tables while curbing the volume of communications traffic is provided. The technique includes: a first permutation generating means 110 that generates a permutation <?> from an element sequence which is generated from the first column of a table L and the first column of a table R; a first column generating means 120 that generates, for j=2, . . . , a, by using the permutation <?>, a prefix sum, and an inverse permutation <??1>, the j-th column of a table J from an element sequence which is generated from the to j-th column of the table L; a join-result element sequence generating means 130 that generates a join-result element sequence from an element sequence ([[1]], . . . , [[1]], [[0]], . . . , [[0]], [[?1]], . . . , [[?1]]) by using the permutation <?>, the prefix sum, and the inverse permutation <??1>; a second column generating means 140 that generates, for j=a+1, . . .

Abstract: A technique for performing secure computation of a sigmoid function with high speed and precision is provided. A secret sigmoid function calculation system is a system, in which g(x) is assumed to be a secure computable function, which calculates, from a share [[x]] of an input value x, a share [[??(x)]] of a value of a sigmoid function for the input value x, and includes: a first comparing means that generates a first comparison result [[c]]=less_than([[x]], t1); a second comparing means that generates a second comparison result [[d]]=greater_than([[x]], t0); a first logical computation means that generates a first logical computation result [[e]]=not([[c]]); a second logical computation means that generates a second logical computation result [[k]]=and([[c]], [[d]]) or [[k]]=mul([[c]], [[d]]); and a function value calculating means that calculates the share [[??(x)]]=mul([[k]], [[g(x)]])+[[e]].

Abstract: Multiple elements are efficiently read from a secured array. A secure text array <a>=(<a[0]>, . . . , <a[n?1]>) where an array a=(a[0], . . . , a[n?1]) having a size of n is secured, secure text <x> of an integer x that is equal to or higher than 0 and less than n, and in integers i0, . . . , im-1 that are equal to or higher than 0 and less than n are input into an input part 11. A secure shift part 12 secure-shifts the secure text array <a> by <x> to obtain a secure text array <a?>=(<a?[0]>, . . . , <a?[n?1]>) where an array a?=(a?[0], . . . , a?[n?1]) obtained by shifting leftward the array a by x is secured. An array generation part 13 generates a secure text array <b>=(<a?[i0]>, . . . , <a?[im-1]>) from the secure text array <a?>.

Abstract: An aggregate median is efficiently obtained while confidentiality is kept. An order computing part generates ascending order a and descending order d within a group when a table which has been stably sorted based on a desired value attribute and a key attribute is grouped based on the key attribute. A subtracting part generates shares {a?d}, {d?a} of a?d, d?a. A bit deleting part generates shares {a?}, {d?} of a?, d? obtained by excluding least significant bits from {a?d}, {d?a}. An equality determining part generates shares {a?}, {d?} of {a?}:={|a?=0|}, {d?}:={|d?=0|}. A format converting part (15) converts {a?}, {d?} into [a?], [d?]. A flag applying part generates shares [va], [vd] of [va]:=[v1a?], [vd]:=[v1d?]. A permutation generating part generates shares {{?a}}, {{?d}} of permutations ?a, ?d which sort ¬a?, ¬d?. A median computing part generates a share [x] of a vector x.

Abstract: A secure sigmoid function calculation system is a system in which map? is assumed to be secure batch mapping defined by parameters (a0, . . . , ak-1) representing the domain of definition of a sigmoid function ?(x) and parameters (?(a0), . . . , ?(ak-1)) representing the range of the sigmoid function ?(x) (a0, . . . , ak-1 are real numbers that satisfy a0< . . . <ak-1) and which is configured with three or more secure sigmoid function calculation apparatuses and calculates, from a share [[x?]] of an input vector x?, a share [[y?]] of a value y? of a sigmoid function for the input vector x?, the system including a secure batch mapping calculating means that calculates the share [[y?]] by [[y?]]=map?([[x?]])=([[?(af(0))]], . . . , [[?(af(m-1)]]) (where f(i) (0?i?m?1) is j that makes aj?xi<aj+1 hold).