# US 12,192,339 B2 · Secure computation apparatus, secure computation method, and program

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,192,339 B2
- Document ID: US12192339B2
- Status: Granted
- Kind: B2
- Application number: 17/792,147
- Filed: 2020-01-20
- Published: 2023-03-30
- Granted: 2025-01-07
- Earliest claimed: 2020-01-20
- Assignees: Nippon Telegraph and Telephone Corporation
- Applicants: Nippon Telegraph and Telephone Corporation
- Inventors: Dai Ikarashi
- Web page: https://patentgrep.com/patent/US12192339B2

## CPC

- H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes}
- H04L 9/16: the keys or algorithms being changed during operation
- H04L 2209/46: Secure multiparty computation, e.g. millionaire problem
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A secret share value [ft(x)−f′t(x)] of ft(x)−f′t(x) is obtained through secure computation using a secret share value [x] of a real number x, and a secret share value [ft(x)−f′t(x)]r of (ft(x)−f′t(x))r obtained by right-shifting ft(x)−f′t(x) by the predetermined number of bits is obtained through secure computation using the secret share value [ft(x)−f′t(x)]. Here, [μ] is a secret share value of μ, n is an integer equal to or greater than 1, t=0, . . . , n−1, u=1, . . . , n−1, ft(x) is a function of the real number x, f′t(x) is an approximation function of the function ft(x), a secret share value [f′0(x)] of an approximation function f′0(x) is [f′0(x)]=c0,0+c0,1[x], a secret share value [f′u(x)] of an approximation function f′u(x) is [f′u(x)]=cu,0+cu,1[x]+cu,2[f0(x)]+ . . . +cu,u+1[fu−1(x)], ct,0 is a public value, and ct,1, . . . , ct,n+1 are coefficients.

## Claims

### Claim 1

A secure computation device that curbs overflow in secure computations, wherein x is a real number, [μ] is a secret share value of μ, n is an integer equal to or greater than 1, t=0, . . . , n−1, u=1, . . . , n−1, ft(x) is a function of the real number x, f′t(x) is an approximation function of the function ft(x), a secret share value [f′0(x)] of an approximation function f′0(x) is [f′0(x)]=c0,0+c0,1[x], a secret share value [f′u(x)] of an approximation function f′u(x) is [f′u(x)]=cu,0+cu,1[x]+cu,2[f0(x)]+ . . . +cu,u+1[fu−1(x)], ct,0 is a public value, and ct,1, . . . , ct,n+1 are coefficients, the secure computation device comprising:
first secure computation circuitry configured to obtain a secret share value [ft(x)−f′t(x)] of ft(x)−f′t(x) through secure computation using a secret share value [x] of the real number x; and
second secure computation circuitry configured to obtain a secret share value [ft(x)−f′t(x)]r of (ft(x)−f′t(x))r obtained by right-shifting ft(x)−f′t(x) by the number of bits predetermined through secure computation using the secret share value [ft(x)−f′t(x)],
wherein the secret share value [x], the secret share value [ft(x)−f′t(x)], and the secret share value [ft(x)−f′t(x)]r are fixed-point real numbers which are implemented in the first secure computation circuitry and the second secure computation circuitry, and the secure computation device curbs overflow in the first secure computation circuitry and the second secure computation circuitry.

### Claim 2 (depends on 1)

The secure computation device according to claim 1, further comprising third secure computation circuitry configured to obtain a secret share value [ft(x)] of the function ft(x) through secure computation using the secret share value [ft(x)−f′t(x)]r and the secret share value [f′t(x)].

### Claim 3 (depends on 1)

The secure computation device according to claim 1, wherein the first secure computation circuitry obtains the secret share value [ft(x)−f′t(x)] through secure computation of sum-of-product computation using the secret share value [x].

### Claim 4 (depends on 2)

The secure computation device according to claim 2,
wherein n is an integer equal to or greater than 2, and
every time processing operations of the first secure computation circuitry, the second secure computation circuitry, and the third secure computation circuitry are executed for t=0, . . . , n−2, the processing operations, with t+1 as a new t, of the first secure computation circuitry, the second secure computation circuitry, and the third secure computation circuitry are executed again to obtain a secret share value [fn-1(x)].

### Claim 5 (depends on 2)

The secure computation device according to claim 2,
wherein n=3,
a, b, c, d, f, g, h, i, j, k, s, m, n, o, p, q, α, β, γ, δ, and ζ are real numbers,
f0(x)=y=δx2+ax,
f1(x)=z=y(ζy+b)+cx,
f2(x)=w=γ(z(αz+d)+y(βx+f)+gx),
f′0(x)=ix+j,
f′1(x)=ky+sx+m, and
f′2(x)=nz+oy+px+q.

### Claim 6 (depends on 5)

The secure computation device according to claim 5,
wherein the first secure computation circuitry obtains a secret share value [f0(x)−f′0(x)]=[y′]=[x(δx+a−i)−j] through secure computation of sum-of-product computation using the secret share value [x],
the second secure computation circuitry obtains a secret share value [y′]r of y′r obtained by right-shifting y′ by the number of bits predetermined through secure computation using the secret share value [y′],
the third secure computation circuitry obtains a secret share value [y]=[y′+(ix+j)] through secure computation using the secret share value [y′], and the secret share value [f0(x)]=[ix+j],
the first secure computation circuitry obtains a secret share value [f1(x)−f′1(x)]=[z′]=[y(ζy+b−k)+(c−s)x−m] through secure computation of sum-of-product computation using the secret share value [x] and the secret share value [y],
the second secure computation circuitry obtains a secret share value [z′]r of z′r obtained by right-shifting z′ by the number of bits predetermined through secure computation using the secret share value [z′],
the third secure computation circuitry obtains a secret share value [y]=[z′+(ky+sx+m)] through secure computation using the secret share value [z′]r and the secret share value [f′1(x)]=[ky+sx+m],
the first secure computation circuitry obtains a secret share value [w′/y]=[z(αz+d−n/γ)+(βx+f−o/γ)y+(g−p)x+(h−q)/y] through secure computation of sum-of-product computation using the secret share value [x], the secret share value [y], and the secret share value [z],
the second secure computation circuitry obtains a secret share value [w′]r of w′r obtained by right-shifting w′ obtained by multiplying w′/γ by γ by the number of bits predetermined through secure computation using the secret share value [w′/γ], and
the third secure computation circuitry obtains a secret share value [w]=[w′+(nz+oy+px+q)] through secure computation using the secret share value [w′]r and the secret share value [f′2(x)]=[nz+oy+px+q].

### Claim 7 (depends on 6)

The secure computation device according to claim 6,
wherein σ is a positive integer, and
the second secure computation circuitry obtains a public value 2σ/γ, and obtains the secret share value [w′]r through secure computation of public value division [w′/γ]/(2σ/γ) using the public value 2σ/γ and the secret share value [w′/γ].

### Claim 8 (depends on 2)

The secure computation device according to claim 2,
wherein n=2,
a, b, c, γ, δ, i, j, k, s, and m are real numbers,
f0(x)=y=δx2+ax,
f1(x)=z=γ(y(δy+b)+cx),
f′0(x)=ix+j, and
f′1(x)=ky+sx+m.

### Claim 9 (depends on 8)

The secure computation device according to claim 8,
wherein the first secure computation circuitry obtains a secret share value [f0(x)−f′0(x)]=[y′]=[x(δx+a−i)−j] through secure computation of sum-of-product computation using the secret share value [x],
the second secure computation circuitry obtains a secret share value [y′]r of y′r obtained by right-shifting y′ by the number of bits predetermined through secure computation using the secret share value [y′],
the third secure computation circuitry obtains a secret share value [y]=[y′+(ix+j)] through secure computation using the secret share value [y′]r and the secret share value [f′0(x)]=[ix+j],
the first secure computation circuitry obtains a secret share value [z′/γ]=[y(ζy+b−k/γ)+(c−s/γ)x−m/γ] through secure computation of sum-of-product computation using the secret share value [x] and the secret share value [y],
the second secure computation circuitry obtains a secret share value [z′]r of z′r obtained by right-shifting z′ obtained by multiplying z′/γ by γ by the number of bits predetermined through secure computation using the secret share value [z′/γ], and
the third secure computation circuitry obtains a secret share value [z]=[z′+(ky+sx+m)] through secure computation using the secret share value [z′]r and the secret share value [f′1(x)]=[ky+sx+m].

### Claim 10 (depends on 9)

The secure computation device according to claim 9,
wherein σ is a positive integer, and
the second secure computation circuitry obtains a public value 2σ/γ, and obtains the secret share value [z′]r through secure computation of public value division [z′/γ]/(2σ/γ) using the public value 2σ/γ and the secret share value [z′/γ].

### Claim 11

A secure computation method to curb overflow in secure computations, wherein x is a real number, [a] is a secret share value of μ, n is an integer equal to or greater than 1, t=0, . . . , n−1, u=1, . . . , n−1, Ft(x) is a function of the real number x, f′t(x) is an approximation function of the function ft(x), a secret share value [f0(x)] of an approximation function f′0(x) is [f′0(x)]=c0,0+c0,1[x], a secret share value [f′u(x)] of an approximation function f′u(x) is [f′u(x)]=cu,0+cu,1[x]+cu,2[f0(x)]+ . . . +cu,u+1 [fu−1(x)], ct,0 is a public value, and ct,1, . . . , ct,n+1 are coefficients, the secure computation method, performed by processing circuitry, comprising:
obtaining a secret share value [ft(x)−f′t(x)] of ft(x)−f′t(x) through secure computation using a secret share value [x] of the real number x; and
obtaining a secret share value [ft(x)−f′t(x)]r of (ft(x)−f′t(x))r obtained by right-shifting ft(x)−f′t(x) by the number of bits predetermined through secure computation using the secret share value [ft(x)−f′t(x)],
wherein the secret share value [x], the secret share value [ft(x)−f′t(x)], and the secret share value [ft(x)−f′t(x)]r are fixed-point real numbers which are implemented in the processing circuitry, and the secure computation method curbs overflow in the processing circuitry.

### Claim 12 (depends on 11)

A non-transitory computer-readable recording medium storing a program for causing a computer to execute processing according to claim 11.