Proxy calculation system, method, request device and program thereof

A proxy calculation method, implemented by a proxy calculation system, where G and H are cyclic groups, M is an integer of two or more, i=1, . . . , M, f is a homomorphic function of mapping a member xi of group H to group G, Ri and R0 are random variables with a value in group G, ri is a realized value of the random variable Ri,, r0 is a realized value of the random variable R0, and ai is a random number of an integer of 0 or more, the method comprising:

• generating, by a request device having processing circuitry, random numbers a1, a2, . . . , aM;
• calculating, by a calculation device having processing circuitry, f(x1)r1, f(x2)r2, . . . , f(xM)rM to obtain a calculation result thereof as z1, z2, . . . , zM, respectively;
• calculating, by the request device, (z1)a1, (z2)a2, . . . , (zM)aM;
• calculating, by the calculation device, f(x1a1×x2a2× . . . ×xMaM)r0 to obtain a calculation result z0 thereof;
• determining, by the request device, whether or not (z1)a1×(z2)a2× . . . ×(zM)aM=z0,
• wherein when the request device determines that (z1)a1×(z2)a2× . . . ×(zM)aM does not equal z0, the proxy calculation system performs at least one more iteration of calculations that is less than or equal to a predetermined number of iterations to determine whether or not (z1)a1×(z2)a2× . . . ×(zM)aM=z0, and the method includes, by the request device, terminating the calculations and outputting a determination result that indicates that the calculation device does not operate within a predetermined standard of reliability when (z1)a1×(z2)a2× . . . ×(zM)aM is not determined to equal z0 after the predetermined number of iterations have been performed.

A request device comprising:

• processing circuitry configured to
• generate random numbers a1, a2, . . . , aM;
• calculate (z1)a1, (z2)a2, . . . , (zM)aM using a calculation result z1, z2, . . . , zM by a calculation device, that includes calculation processing circuitry, that calculates f(x1)r1, f(x2)r2, . . . , f(xM)rM;
• determine whether or not (z1)a1×(z2)a2× . . . ×(zM)aM=z0 using the calculation result of the processing circuitry and a calculation result z0 by the calculation device that further calculates f(x1a1×x2a2× . . . ×xMaM)r0,
• wherein when the processing circuitry determines that (z1)a1×(z2)a2× . . . ×(zM)aM does not equal z0, the request device and the calculation device are configured to perform at least one more iteration of calculations that is less than or equal to a predetermined number of iterations to determine whether or not (z1)a1×(z2)a2× . . . ×(zM)aM=z0, and the processing circuitry terminates the calculations and outputs a determination result that indicates that the calculation device does not operate within a predetermined standard of reliability when (z1)a1×(z2)a2× . . . ×(zM)aM is not determined to equal z0 after the predetermined number of iterations have been performed, and
• wherein G and H are cyclic groups, M is an integer of two or more, i=1, . . . , M, f is a homomorphic function of mapping a member xi of group H to group G, Ri and R0 are random variables with a value in group G, ri is a realized value of the random variable Ri, r0 is a realized value of the random variable R0, and ai is a random number of an integer of 0 or more.