# US 2025/0167979 A1 · Secret calculation device, secret calculation system, secret calculation method, and computer program product

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2025/0167979 A1
- Document ID: US20250167979A1
- Status: Published application
- Kind: A1
- Application number: 18/777,222
- Filed: 2024-07-18
- Published: 2025-05-22
- Earliest claimed: 2023-11-21
- Assignees: Kabushiki Kaisha Toshiba
- Applicants: Kabushiki Kaisha Toshiba
- Inventors: Yuki NANJO; Tomoko YONEMURA; Yoshikazu HANATANI
- Web page: https://patentgrep.com/patent/US20250167979A1

## CPC

- H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation}
- H04L 9/008: {involving homomorphic encryption}
- H04L 2209/46: Secure multiparty computation, e.g. millionaire problem
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A secret calculation device includes a memory and one or more processors coupled to the memory. The one or more processors are configured to: perform a first secret calculation operation on a first ciphertext obtained by encrypting input data according to a first homomorphic encryption method by using first homomorphic computation based on the first homomorphic encryption method to calculate a second ciphertext; convert, by using a ciphertext conversion method defined between the first homomorphic encryption method and a second homomorphic encryption method, the second ciphertext into a third ciphertext encrypted by the second homomorphic encryption method without decrypting the second ciphertext; and perform a second secret calculation operation on the third ciphertext by using second homomorphic computation based on the second homomorphic encryption method to calculate a fourth ciphertext.

## Claims

### Claim 1

A secret calculation device comprising:
a memory; and
one or more processors coupled to the memory and configured to:
perform a first secret calculation operation on a first ciphertext obtained by encrypting input data according to a first homomorphic encryption method by using first homomorphic computation based on the first homomorphic encryption method to calculate a second ciphertext;
convert, by using a ciphertext conversion method defined between the first homomorphic encryption method and a second homomorphic encryption method, the second ciphertext into a third ciphertext encrypted by the second homomorphic encryption method without decrypting the second ciphertext; and
perform a second secret calculation operation on the third ciphertext by using second homomorphic computation based on the second homomorphic encryption method to calculate a fourth ciphertext.

### Claim 2 (depends on 1)

The device according to claim 1, wherein the first homomorphic computation and the second homomorphic computation include multiplication and addition.

### Claim 3 (depends on 1)

The device according to claim 1, wherein
the first secret calculation operation includes calculating inner product or calculating summation, and
the second secret calculation operation includes addition, multiplication, or identity operation.

### Claim 4 (depends on 1)

The device according to claim 1, wherein
the one or more processors are configured to:
perform the first secret calculation operation on the first ciphertext in which a plaintext including a vector is encrypted to calculate the second ciphertext in which a plaintext including a scalar value is encrypted;
convert, by the second homomorphic encryption method, the second ciphertext into the third ciphertext in which a plaintext including a scalar value is encrypted; and
perform the second secret calculation operation on the third ciphertext to calculate the fourth ciphertext in which a plaintext including a scalar value is encrypted.

### Claim 5 (depends on 4)

The device according to claim 4, wherein
the one or more processors are configured to:
calculate the second ciphertext in which a plaintext of a scalar value representing an element of a cross-tabulation table is encrypted, the cross-tabulation table aggregated by performing the first secret calculation operation on the first ciphertext in which a plaintext including a vector is encrypted;
convert the second ciphertext into the third ciphertext in which a plaintext of a scalar value, which represents an element of the cross-tabulation table encrypted by the second homomorphic encryption method, is encrypted; and
calculate, by the second secret calculation operation on the third ciphertext, the fourth ciphertext in which a plaintext of a scalar value representing a valuation result of the cross-tabulation table is encrypted.

### Claim 6 (depends on 5)

The device according to claim 5, wherein
the one or more processors are configured to:
calculate the second ciphertext in which a plaintext of a scalar value representing an element of the cross-tabulation table as a 2×2 table is encrypted, the cross-tabulation table aggregated by the first secret calculation operation on the first ciphertext in which a plaintext including a vector is encrypted;
convert the second ciphertext into the third ciphertext in which a plaintext of a scalar value, which represents an element of the 2×2 cross-tabulation table encrypted by the second homomorphic encryption method, is encrypted; and
calculate, by the second secret calculation operation on the third ciphertext, the fourth ciphertext in which a plaintext of a scalar value, which represents a result of chi-square testing of the 2×2 cross-tabulation table, is encrypted, and
the chi-square testing is expressed by Equation (A) or Equation (B):
Xsq
=
(
a
+
b
+
c
+
d
)
×
(
a
×
d
-
b
×
c
)
2
/
(
(
a
+
b
)
×
(
a
+
c
)
×
(
b
+
d
)
×
(
c
+
d
)
)
;
and
(
A
)
Xsq
=
(
a
+
b
+
c
+
d
)
×
(
(
a
+
b
+
c
+
d
)
×
a
-
(
a
+
b
)
×
(
a
+
c
)
)
2
/
(
(
a
+
b
)
×
(
a
+
c
)
×
(
b
+
d
)
×
(
c
+
d
)
)
,
(
B
)
wherein “a”, “b”, “c”, and “d” in Equation (A) and Equation (B) are scalar values representing elements of the cross-tabulation table.

### Claim 7 (depends on 6)

The device according to claim 6, wherein
the first secret calculation operation represents calculation of inner product or summation performed at least once with respect to a vector, and
the second secret calculation operation represents addition or multiplication performed at least once with respect to a scalar value.

### Claim 8 (depends on 1)

The device according to claim 1, wherein
the input data contains two polynomials in which coefficients represent vector elements,
the one or more processors are configured to:
perform the first secret calculation operation, in which homomorphic inner product computation is used as the first homomorphic computation based on the first homomorphic encryption method, on two first ciphertexts obtained by encrypting the two polynomials included in the input data to calculate the second ciphertext of a polynomial plaintext in which a scalar value of inner product result is stored in a constant term;
convert, without decrypting the second ciphertext, the second ciphertext into the third ciphertext in which a plaintext of a scalar value of a constant term of a polynomial encrypted by the second homomorphic encryption method is encrypted; and
perform the second secret calculation operation, in which the second homomorphic computation including at least one homomorphic multiplication and at least one homomorphic addition is performed, on the third ciphertext to calculate the fourth ciphertext.

### Claim 9 (depends on 8)

The device according to claim 8, wherein
the first homomorphic encryption method includes a homomorphic encryption method in which Ring-LWE is adapted or a homomorphic encryption method in which Module-LWE is adapted,
the second homomorphic encryption method includes a homomorphic encryption method in which either LWE is adapted or LWE not dependent on ring dimensionality of the first homomorphic encryption method is adapted,
the ciphertext conversion method includes a ciphertext conversion method defined between: the second ciphertext encrypted by the first homomorphic encryption method in which Ring-LWE or Module-LWE is adapted; and the third ciphertext encrypted by the second homomorphic encryption method in which either LWE is adapted or LWE not dependent on ring dimensionality of the first homomorphic encryption method is adapted, and
the one or more processors are configured to perform an extraction operation of extracting some of numerical values constituting the second ciphertext representing a polynomial, or, in addition to performing the extraction operation, perform a calculation operation using an encryption key or a conversion key, and convert, without decrypting the second ciphertext, the second ciphertext into the third ciphertext in which the plaintext of the scalar value of the constant term of the polynomial is encrypted.

### Claim 10 (depends on 9)

The device according to claim 9, wherein
the first homomorphic encryption method includes a homomorphic encryption method in which Ring-LWE is adapted,
the second homomorphic encryption method includes a homomorphic encryption method in which LWE is adapted, and
the ciphertext conversion method includes a ciphertext conversion method defined between: the second ciphertext encrypted by the first homomorphic encryption method in which Ring-LWE is adapted; and the third ciphertext encrypted by the second homomorphic encryption method in which LWE is adapted.

### Claim 11 (depends on 9)

The device according to claim 9, wherein
the first homomorphic encryption method includes a homomorphic encryption method in which Module-LWE is adapted,
the second homomorphic encryption method includes a homomorphic encryption method in which LWE is adapted, and
the ciphertext conversion method includes a ciphertext conversion method defined between: the second ciphertext encrypted by the first homomorphic encryption method in which Module-LWE is adapted; and the third ciphertext encrypted by the second homomorphic encryption method in which LWE is adapted.

### Claim 12 (depends on 9)

The device according to claim 9, wherein
the first homomorphic encryption method includes a homomorphic encryption method in which Ring-LWE is adapted,
the second homomorphic encryption method includes a homomorphic encryption method in which LWE not dependent on ring dimensionality of the first homomorphic encryption method is adapted, and
the ciphertext conversion method includes a ciphertext conversion method defined between: the second ciphertext encrypted by the first homomorphic encryption method in which Ring-LWE is adapted; and the third ciphertext encrypted by the second homomorphic encryption method in which LWE not dependent on ring dimensionality of the first homomorphic encryption method is adapted.

### Claim 13 (depends on 9)

The device according to claim 9, wherein
the first homomorphic encryption method includes a homomorphic encryption method in which Module-LWE is adapted,
the second homomorphic encryption method includes a homomorphic encryption method in which LWE not dependent on ring dimensionality of the first homomorphic encryption method is adapted, and
the ciphertext conversion method includes a ciphertext conversion method defined between: the second ciphertext encrypted by the first homomorphic encryption method in which Module-LWE is adapted; and the third ciphertext encrypted by the second homomorphic encryption method in which LWE not dependent on ring dimensionality of the first homomorphic encryption method is adapted.

### Claim 14 (depends on 9)

The device according to claim 9, wherein
the ciphertext conversion method includes a ciphertext conversion method defined between: the second ciphertext encrypted by the first homomorphic encryption method in which Ring-LWE or Module-LWE is adapted; and the third ciphertext encrypted by the second homomorphic encryption method in which LWE not dependent on ring dimensionality of the first homomorphic encryption method is adapted, and
the one or more processors are configured to convert, without decrypting the second ciphertext, the second ciphertext into the third ciphertext by using an encryption key generated for use in the second homomorphic encryption method and a conversion key generated for use in ciphertext conversion.

### Claim 15 (depends on 1)

A secret calculation system comprising:
the secret calculation device according to claim 1; and
a first terminal device that communicates with the secret calculation device,
the first terminal device comprising one or processors configured to execute at least one of:
key generation processing of generating an encryption key for use in the first homomorphic encryption method and a decryption key for use in the second homomorphic encryption method;
encryption processing of calculating the first ciphertext in which the input data is encrypted using the encryption key; and
decryption processing of calculating output data in which the fourth ciphertext received from the secret calculation device is decrypted using the decryption key.

### Claim 16 (depends on 15)

The system according to claim 15, wherein the key generation processing includes further generating a conversion key for use in ciphertext conversion.

### Claim 17 (depends on 1)

A secret calculation system comprising:
the secret calculation device according to claim 1;
a first terminal device that communicates with the secret calculation device; and
a second terminal device that communicates with the secret calculation device and the first terminal device,
the first terminal device comprising one or processors configured to:
generate an encryption key for use in the first homomorphic encryption method and a decryption key for use in the second homomorphic encryption method;
obtain input data;
calculate the first ciphertext in which the input data is encrypted using the encryption key;
send the first ciphertext to the secret calculation device;
calculate output data in which the fourth ciphertext received from the secret calculation device is decrypted using the decryption key; and
output the output data, and
the second terminal device comprising one or processors configured to send the first ciphertext, in which the input data is encrypted using the encryption key, to the secret calculation device.

### Claim 18

A secret calculation method implemented in a secret calculation device, the method comprising:
performing a first secret calculation operation on a first ciphertext obtained by encrypting input data according to a first homomorphic encryption method by using first homomorphic computation based on a first homomorphic encryption method to calculate a second ciphertext;
converting, by using a ciphertext conversion method defined between the first homomorphic encryption method and a second homomorphic encryption method, the second ciphertext into a third ciphertext encrypted by the second homomorphic encryption method without decrypting the second ciphertext; and
performing a second secret calculation operation on the third ciphertext by using second homomorphic computation based on the second homomorphic encryption method to calculate a fourth ciphertext.

### Claim 19

A computer program product comprising a computer-readable medium including programmed instructions, the instructions causing a computer to execute:
performing a first secret calculation operation on a first ciphertext obtained by encrypting input data according to a first homomorphic encryption method by using first homomorphic computation based on a first homomorphic encryption method to calculate a second ciphertext;
converting, by using a ciphertext conversion method defined between the first homomorphic encryption method and a second homomorphic encryption method, the second ciphertext into a third ciphertext encrypted by the second homomorphic encryption method without decrypting the second ciphertext; and
performing a second secret calculation operation on the third ciphertext by using second homomorphic computation based on the second homomorphic encryption method to calculate a fourth ciphertext.