Patent Description:
In December <NUM>, the Basic Act on the Advancement of Public and Private Sector Data Utilization, which promotes appropriate utilization of public and private sector data related to individuals by a wide variety of actors, was promulgated and came into effect. In December <NUM>, the acceptance of certification applications at information banks was started, and personal data utilization schemes in cooperation with the public and private sectors have been developed. The Ministry of Internal Affairs and Communications has made clear that the first information bank will be certified in March <NUM>.

On the other hand, as a regulation for protecting personal privacy information, Japan fully implemented the revised Act on the Protection of Personal Information in May <NUM>, and in overseas, Europe started implementation of the EU General Data Protection Regulation (GDPR) was in May <NUM>, so that the regulation is being strengthened worldwide.

Under such circumstances, creation of new values is promoted, where various types of information are cooperated, such as cooperation of public services in which public and private sectors such as an emergency and a security company cooperate in terms of information, and cooperation of private services such as pharmaceutical, insurance, transportation, and information bank that produce a synergistic effect with the public services. In order to analyze various data and create a new value, statistical analysis such as regression analysis and analysis processing such as machine learning are effective. Furthermore, in order to achieve these services, there is a demand for a concealment information processing technology that enables providers of public services or private services to analyze and utilize, while protecting personal privacy, confidential information such as personal information owned by data holders such as hospitals and banks.

The conventional concealment information processing technology enables certain processing while keeping data encrypted, thereby achieving concealment of confidential information such as personal information. However, processing that can be executed by the conventional concealment information processing technology is limited to basic computation such as search and order comparison, and there is a limit in the degree of freedom of processing. The encryption technology such as homomorphic encryption having no limit in the degree of freedom of processing cannot be achieved at a practical processing speed. For this reason, there is a demand for concealment information processing compatible to advanced statistical processing and machine learning requiring a high degree of freedom of processing.

In recent years, a main central processing unit (CPU) has been mounted with a trusted execution environment (TEE) function as a standard. It is considered that the TEE function is effective for processing of concealment information. The TEE function is a function of providing a computer with a trust region in which information cannot be read even if the administrator authority of the OS is deprived, and by decrypting and processing encrypted data only in the trust region, advanced processing is safely enabled.

Technologies for using the trust region of the TEE function includes <CIT>. <CIT> discloses a privacy-enhanced deep learning system that reduces information leakage of confidential input data in an inference pipeline.

The technology described in <CIT> uses a hierarchical structure of a neural network to divide each deep learning model into FrontNet to be processed in a trust region and BackNet to be processed in a normal region.

In the technology described in <CIT>, a terminal used by an end user transmits an encrypted input and encrypted FrontNet to the system. The technology described in <CIT> uses the TEE function on the cloud infrastructure to perform deep learning processing in the enclave (isolated execution process in the TEE function) of FrontNet, and cryptographically protects the confidentiality and integrity of user input.

On the other hand, the technology described in <CIT> gains benefits due to improvement in performance in a case where a safe enclave is insufficient in inference calculation of BackNet and the cloud machine is mounted with a deep learning acceleration chip.

In order to determine a model-specific optimal division point that balances privacy protection and performance requirements, the technology described in <CIT> uses the hierarchical structure of the neural network and partitions each deep learning model into FrontNet and BackNet. In the technology described in <CIT>, a deep learning inference system measures similarity for each set of intermediate data of each layer, and uses a selected subset of the intermediate data that is most similar to the input information to determine a division point used for division into two partitions.

However, there is a case where the system described in <CIT> cannot prevent leakage of confidential information at the time of deep learning processing of input information in a case where the input information includes confidential information such as personal privacy information or trade secrets that have not been learned in the learning stage. For example, in a case where the input information used for learning for determining the division point includes an image of an individual, an image of a component, or character information corresponding to personal information and a trade secret, there is a case where intermediate data including these pieces of information is processed by BackNet that is not protected by the enclave.

Therefore, an object of one aspect of the present invention is to protect confidential information such as information regarding personal privacy and a trade secret included in input information at the time of processing such as machine learning by a plurality of processing layers.

In order to solve the above problems, one aspect of the present invention employs the following configuration. An information processing apparatus that executes machine learning by a plurality of processing layers includes a processor and a memory, in which the memory includes a normal region and an isolation region isolated from the normal region, the normal region holds a parameter of the machine learning, the isolation region holds input data to an i-th layer included in the plurality of processing layers and a parameter of the machine learning, the processor executes semantic determination processing of determining whether there is a risk in executing processing of the i-th layer for the input data in the normal region on the basis of a content of secret information of the input data in the isolation region, when determining that there is the risk, executes the processing of the i-th layer for the input data on the basis of the parameter held by the isolation region in the isolation region, and when determining that there is no risk, outputs the input data to the normal region, and executes the processing of the i-th layer for the input data on the basis of the parameter held by the normal region in the normal region.

According to one aspect of the present invention, it is possible to protect confidential information such as information regarding personal privacy and a trade secret included in input information at the time of processing such as machine learning by a plurality of processing layers.

Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments.

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. In the present embodiment, the same components are in principle given the same reference signs, and a repeated description thereof will be omitted. Note that the present embodiment is merely an example for achieving the present invention and does not limit the technical scope of the present invention.

<FIG> is a block diagram illustrating a system configuration example of the concealment information processing system. A concealment information processing system <NUM> deposits encrypted data from a data holder holding confidential information such as personal information, processes the deposited data in response to a processing request of a processing result user while keeping the confidential information concealed, and provides the processing result to the processing result user.

The concealment information processing system <NUM> includes, for example, a data holder terminal <NUM> used by a data holder to encrypt and deposit data, a processing result user terminal <NUM> with which a processing result user generates and transmits a processing request and refers to a processing result, and a concealment information processing server <NUM> that executes processing of the processing request received from the processing result user for the data deposited from the data holder while keeping the processing concealed and transmits the processing result. The data holder terminal <NUM>, the processing result user terminal <NUM>, and the concealment information processing server <NUM> are connected to one another via a network <NUM> such as the Internet.

The concealment information processing system <NUM> may include a plurality of the data holder terminals <NUM> or a plurality of the processing result user terminals <NUM>. The data holder terminal <NUM> and the processing result user terminal <NUM> may be the same terminal.

<FIG> is a block diagram illustrating a hardware configuration example of the concealment information processing system <NUM>. The data holder terminal <NUM> is, for example, a computer such as a personal computer, a smartphone, or a server device, or a virtual computer. The data holder terminal <NUM> includes, for example, a computer including a control processing unit (CPU) <NUM>, a memory <NUM>, an auxiliary storage device <NUM>, a network interface <NUM>, a display device <NUM>, and an input device <NUM>, which are connected to one another via an internal communication line.

The CPU <NUM> includes a processor and executes a program stored in the memory <NUM>. The memory <NUM> includes a read only memory (ROM), which is a nonvolatile storage element, and a random access memory (RAM), which is a volatile storage element. The ROM stores an immutable program (e.g., basic input/output system (BIOS)) and the like. The RAM is a high-speed and volatile storage element such as a dynamic random access memory (DRAM), and temporarily stores a program executed by the CPU <NUM> and data used when the program is executed.

The CPU <NUM> is a TEE-compatible CPU having a trusted execution environment (TEE) function, and the memory <NUM> has a TEE trust region <NUM> that is a hardware trust region secured on the memory by the TEE-compatible CPU <NUM> and is isolated from other regions on the memory. In the first embodiment, the CPU <NUM> needs not have the TEE function, and the memory <NUM> needs not have a TEE trust region <NUM>. The memory amount that can be handled in the TEE trust region <NUM> may be limited to be smaller than the memory amount in the normal region (for example, about <NUM> MB), and in this case, when executing processing on the TEE trust region <NUM>, the CPU <NUM> has the processing speed lowered as compared with that in a case of executing the processing on the normal region.

The auxiliary storage device <NUM> is, for example, a large-capacity and nonvolatile storage device such as a magnetic storage device (hard disk drive (HDD)) or a flash memory (solid state drive (SSD)), and stores a program executed by the CPU <NUM> and data used when the program is executed. That is, the program is read from the auxiliary storage device <NUM>, loaded into the memory <NUM>, and executed by the CPU <NUM>.

The display device <NUM> is a device that outputs the execution result of the program in a format that can be visually recognized by an operator, such as a display or a printer. The input device <NUM> is a device that receives input from the operator, such as a keyboard or a mouse. The network interface <NUM> controls communication with other devices according to a predetermined protocol. The network interface <NUM> may include a serial interface such as a USB, for example.

The program executed by the CPU <NUM> may be stored in advance in the nonvolatile auxiliary storage device <NUM>, which is a computer-readable non-transitory storage medium, or may be provided from a removable medium (CD-ROM, flash memory, or the like) that is a non-transitory storage medium or a non-transitory storage device of another device to the data holder terminal <NUM> via a network and stored in the auxiliary storage device <NUM>. Therefore, the data holder terminal <NUM> preferably has an interface for reading data from a removable medium. The same applies to the processing result user terminal <NUM> and the concealment information processing server <NUM>.

Some or all of the functions of the functional units executed by the CPU and a GPU in the present embodiment may be achieved by hardware such as an application specific integrated circuit (ASIC) or a field-programmable gate array (FPGA), for example.

In the present embodiment, the information used by the concealment information processing system <NUM> may be expressed in any data structure no depending on the data structure, and for example, a data structure appropriately selected from a list, a table, a database, or a queue can store the information.

The processing result user terminal <NUM> is, for example, a computer such as a personal computer, a smartphone, or a server device, or a virtual computer. The processing result user terminal <NUM> includes, for example, a computer including a CPU <NUM>, a memory <NUM>, an auxiliary storage device <NUM>, a network interface <NUM>, a display device <NUM>, and an input device <NUM>, which are connected to one another via an internal communication line.

The description of the CPU <NUM>, the memory <NUM>, the auxiliary storage device <NUM>, the network interface <NUM>, the display device <NUM>, and the input device <NUM> as hardware is similar to the description of the CPU <NUM>, the memory <NUM>, the auxiliary storage device <NUM>, the network interface <NUM>, the display device <NUM>, and the input device <NUM>, respectively, as hardware. However, the CPU <NUM> does not need to have the TEE function, and it is not necessary to construct a trust region in the memory <NUM>.

The concealment information processing server <NUM> is, for example, a computer such as a personal computer, a smartphone, or a server device, or a virtual computer. The concealment information processing server <NUM> includes, for example, a computer including a CPU <NUM>, a memory <NUM>, an auxiliary storage device <NUM>, a network interface <NUM>, a display device <NUM>, an input device <NUM>, and a graphics processing unit (GPU) <NUM>, which are connected to one another via an internal communication line such as a bus.

The description of the CPU <NUM>, the memory <NUM>, the auxiliary storage device <NUM>, the network interface <NUM>, the display device <NUM>, and the input device <NUM> as hardware is similar to the description of the CPU <NUM>, the memory <NUM>, the auxiliary storage device <NUM>, the network interface <NUM>, the display device <NUM>, and the input device <NUM>, respectively, as hardware. However, the CPU <NUM> of the concealment information processing server <NUM> is a TEE-compatible CPU having a TEE function, and the memory <NUM> of the concealment information processing server <NUM> is a hardware trust region secured on the memory by the TEE-compatible CPU <NUM> and includes a TEE trust region <NUM>, which is an execution region isolated from other regions on the memory. The GPU <NUM> includes a processor and executes, at high speed, the program stored in the memory <NUM>, using a region (normal region) out of the TEE trust region <NUM> of the memory <NUM>. The concealment information processing server <NUM> needs not include the GPU <NUM>.

Although the data holder terminal <NUM> and the concealment information processing server <NUM> have the TEE function in the present embodiment, a method different from the TEE function may be adopted, in which computation can be performed in a safe execution region isolated from the normal region on the memory.

Part or entire processing executed by the CPU <NUM>, the CPU <NUM>, the CPU <NUM>, and the GPU <NUM> may be executed by hardware such as the application specific integrated circuit (ASIC) or the field-programmable gate array (FPGA), for example.

Each of the data holder terminal <NUM>, the processing result user terminal <NUM>, and the concealment information processing server <NUM> is a computer system configured physically on one computer or on a plurality of computers configured logically or physically, and may operate on separate threads on the same computer or may operate on a virtual computer constructed on a plurality of physical computer resources.

The network <NUM> is a communication network such as the Internet by wired communication or wireless communication, an intranet such as an in-house network, or a satellite line.

<FIG> is an explanatory diagram illustrating a functional configuration example and an example of a data processing flow for concealment inference processing.

First, the entire concealment inference processing executed by the concealment information processing system <NUM> according to the present embodiment will be described. In the concealment information processing system <NUM>, the data holder terminal <NUM> encrypts and transmits, to the concealment information processing server <NUM>, input data including confidential information such as personal information.

Next, the concealment information processing server <NUM> decrypts the input data in the TEE trust region <NUM>, executes, in the TEE trust region <NUM> or the normal region according to the results of the quantitative determination processing and the semantic determination processing, processing of each layer of the deep learning inference processing including a plurality of processing layers, encrypts the inference result, and transmits the encrypted inference result to the processing result user terminal <NUM>. Then, the processing result user terminal <NUM> decrypts the received encrypted inference result and acquires the inference result.

Hereinafter, a functional configuration example and an example of a data processing flow will be described in detail with reference to <FIG> for each processing described above.

The concealment information processing server <NUM> includes, for example, a normal region <NUM> on the memory <NUM> for performing high-speed processing by a normal CPU, a memory, and an acceleration chip such as a GPU, and the TEE trust region <NUM> on the memory <NUM>, which is a highly safely isolated processing execution region provided by the TEE function or the like of the CPU.

The normal region <NUM> includes, for example, an i-th layer processing unit <NUM>, a quantitative determination processing unit <NUM>, and a semantic determination processing unit <NUM>. The i-th layer processing unit <NUM> executes processing of a layer in machine learning (convolutional neural network (CNN) will be described below as an example) of a multilayer structure such as a CNN. The quantitative determination processing unit <NUM> executes quantitative determination processing based on the calculation amount, the data input/output time, and the like of data processing to be executed next in the TEE trust region <NUM>. The semantic determination processing unit <NUM> executes semantic determination processing such as determination of privacy risk in data processing to be executed next in the TEE trust region <NUM>.

The TEE trust region <NUM> includes, for example, an i-th layer processing unit <NUM>, a decryption processing unit <NUM>, a determination notification processing unit <NUM>, and an encryption processing unit <NUM>. The i-th layer processing unit <NUM> executes processing of the CNN layer. The decryption processing unit <NUM> decrypts the encrypted data using an encryption key <NUM> stored in the TEE trust region <NUM>.

The determination notification processing unit <NUM> notifies the processing result user terminal <NUM> or the data holder terminal <NUM> of the determination content of the quantitative determination processing unit <NUM> or the semantic determination processing unit <NUM>. The determination notification processing unit <NUM> notifies the quantitative determination processing unit <NUM> or the semantic determination processing unit <NUM> of the determination of the processing result user terminal <NUM> or the data holder terminal <NUM> in response to designation. The encryption processing unit <NUM> encrypts the inference result that is the final result of the CNN processing with an encryption key <NUM>.

The data holder terminal <NUM> includes an encryption processing unit <NUM> that encrypts data using an encryption key <NUM> stored in the memory <NUM>, the auxiliary storage device <NUM>, or the TEE trust region <NUM>. The processing result user terminal <NUM> includes a decryption processing unit <NUM> that decrypts data using an encryption key <NUM> stored in the memory <NUM> or the auxiliary storage device <NUM>. The data holder terminal <NUM> and the processing result user terminal may be the same terminal, and in that case, the encryption processing unit <NUM> and the decryption processing unit <NUM> are included in the same terminal.

For example, the TEE-compatible CPU <NUM> executes processing as the decryption processing unit <NUM> by operating in accordance with the decryption processing program loaded in the TEE trust region <NUM> of the memory <NUM>, executes processing as the quantitative determination processing unit <NUM> by operating in accordance with the quantitative determination processing program loaded in the TEE trust region <NUM> of the memory <NUM>, executes processing as the semantic determination processing unit <NUM> by operating in accordance with the semantic determination processing program loaded in the TEE trust region <NUM> of the memory <NUM>, executes processing as the i-th layer processing unit <NUM> by operating in accordance with the i-th layer processing program loaded in the TEE trust region <NUM> of the memory <NUM>, and executes processing as the determination notification processing unit <NUM> by operating in accordance with the determination notification processing program loaded in the TEE trust region <NUM> of the memory <NUM>.

The GPU <NUM> executes processing as the i-th layer processing unit <NUM> by operating in accordance with the i-th layer processing program loaded in the normal region of the memory <NUM>. The TEE-compatible CPU <NUM> executes processing as the encryption processing unit <NUM> by operating in accordance with the encryption processing program loaded in the TEE trust region <NUM> of the memory <NUM>. The CPU <NUM> executes processing as an inference result display unit <NUM> by operating in accordance with the inference result display program loaded in the memory <NUM>, and executes processing as the decryption processing unit <NUM> by operating in accordance with the decryption processing program loaded in the memory <NUM>.

The data processing flow of the concealment inference processing according to the first embodiment will be described below with reference to <FIG> and <FIG> is a sequence diagram illustrating an example of the data processing flow of concealment inference processing. First, the encryption processing unit <NUM> of the data holder terminal <NUM> generates encrypted data <NUM> (S301) by encrypting data <NUM> including confidential information, and registers the data (S302) by transmitting the encrypted data <NUM> to the concealment information processing server <NUM>. Upon receiving the encrypted data <NUM>, the concealment information processing server <NUM> inputs it to the TEE trust region <NUM>. The decryption processing unit <NUM> in the TEE trust region <NUM> decrypts the encrypted data <NUM>, thereby generating data <NUM> (S303).

The quantitative determination processing unit <NUM> acquires parameter information <NUM> or parameter information <NUM> including the network configuration in an AI model of deep learning to be used for a next i-th layer (first layer in the first time) processing of the CNN, as well as filter information and weight information (S304). The quantitative determination processing unit <NUM> executes quantitative determination processing on the basis of the data <NUM> and the acquired parameter information (S305). Details of the quantitative determination processing will be described later.

In the quantitative determination processing, the quantitative determination processing unit <NUM> determines whether or not the i-th layer is the final layer of the multilayer processing and whether there is a quantitative effect by executing the processing in the normal region (S306). If the quantitative determination processing unit <NUM> determines that the i-th layer is not the final layer of the multilayer processing and has a quantitative effect (S306: YES), the semantic determination processing unit <NUM> executes the semantic determination processing (S307). Details of the semantic determination processing will be described later.

If the quantitative determination processing unit <NUM> determines that the i-th layer is the final layer of the multilayer processing or there is no quantitative effect (S306: YES), the i-th layer processing unit <NUM> of the TEE trust region <NUM> generates intermediate data <NUM> (S309) by executing the data processing of the i-th layer of the CNN on the basis of the data <NUM> and the parameter information <NUM> used for the i-th layer processing, and proceeds to step S311.

In the semantic determination processing, the semantic determination processing unit <NUM> determines whether there is a risk (or whether there is a large risk) of leakage of secret information if the data processing of the i-th layer of the CNN is processed in the normal region <NUM> (S308). If the semantic determination processing unit <NUM> determines that there is a risk (or there is a large risk) of leakage of the secret information if the data processing of the i-th layer of CNN is processed in the normal region <NUM> (S308: YES), the processing proceeds to step S309.

If the semantic determination processing unit <NUM> determines that there is no risk (or there is a small risk) in processing the data processing of the i-th layer of the CNN in the normal region <NUM> (S308: NO), the i-th layer processing unit <NUM> of the normal region <NUM> generates intermediate data <NUM> (S310) by executing the data processing of the i-th layer of the CNN on the basis of the data <NUM> and the parameter information <NUM> used for the i-th layer processing, and increments i, and the processing proceeds to step S304.

The i-th layer processing unit <NUM> of the TEE trust region <NUM> determines whether the i-th layer of the immediately preceding i-th layer processing is the final processing layer (S311). If determining that the i-th layer of the immediately preceding i-th layer processing is not the final processing layer (S311: NO), the i-th layer processing unit <NUM> of the TEE trust region <NUM> increments i, and transmits the intermediate data <NUM>, which is the processing result, to the quantitative determination processing unit <NUM> together with i, and the processing returns to step S304.

If determining that the i-th layer of the immediately preceding i-th layer processing is the final processing layer (S311: YES), the i-th layer processing unit <NUM> of the TEE trust region <NUM> generates an encryption inference result <NUM> (S312) by the encryption processing unit <NUM> of the TEE trust region <NUM> encrypting, with the encryption key <NUM>, an inference result <NUM>, which is the processing result of the final layer output by the i-th layer processing unit <NUM> of the TEE trust region <NUM>.

The encryption processing unit <NUM> of the TEE trust region <NUM> outputs the encryption inference result <NUM> to the normal region <NUM>, and the i-th layer processing unit <NUM> of the normal region <NUM> transmits the encryption inference result <NUM> to the processing result user terminal <NUM>. The decryption processing unit <NUM> of the processing result user terminal <NUM> generates an inference result by decrypting the received encryption inference result <NUM> with the encryption key <NUM>, and the inference result display unit <NUM> displays the inference result on the display device <NUM>.

<FIG> is a flowchart illustrating an example of the quantitative determination processing. The quantitative determination processing unit <NUM> reads the parameter information of the i-th layer in the parameter information <NUM>, and further specifies an input/output data size (input data size from the normal region <NUM> to the TEE trust region <NUM> and output data size from the TEE trust region <NUM> to the normal region <NUM>) of the i-th layer and the type of computation performed in the i-th layer (S441).

TEE trust region basic processing time (processing time per unit data size in a case where the i-th layer processing is performed in the TEE trust region <NUM>), normal region basic processing time (processing time per unit data size in a case where the i-th layer processing is performed in the normal region <NUM>), and basic processing time of the semantic determination processing in the TEE trust region (processing time per unit data size of the semantic determination processing) may be determined in advance, or may be calculated from the specified parameter. A basic data transfer speed (transfer speed per unit data size) between the TEE trust region <NUM> and a normal region <NUM> is determined in advance.

The quantitative determination processing unit <NUM> calculates a predicted value Ta of the calculation time required for the i-th layer processing when the next i-th layer processing is executed in the TEE trust region <NUM> (S442). Ta is defined by, for example, the product of the TEE trust region basic processing time of the target computation (specified type of computation) and the input/output data size.

The quantitative determination processing unit <NUM> calculates a predicted value Tb of the calculation time required for the semantic determination processing when the semantic determination processing is executed in the TEE trust region <NUM> (S443). Tb is defined by, for example, the product of the basic processing time of the semantic determination processing and the input/output data size.

The quantitative determination processing unit <NUM> calculates a predicted value Tc of the calculation time required for the i-th layer processing when the i-th layer processing is executed in the normal region <NUM> (S444). Tc is defined by, for example, the product of the normal region basic processing time of the target computation and the input/output data size.

The quantitative determination processing unit <NUM> calculates an intermediate data input/output transfer time predicted value Td between the TEE trust region <NUM> and the normal region <NUM> (S445). Td is defined by, for example, the quotient obtained by dividing the input/output data size by the basic data transfer speed.

The quantitative determination processing unit <NUM> determines whether Ta is larger than Tb + Tc + Td (S446). Ta is processing time when the i-th layer processing is executed in the TEE trust region <NUM>, and Tb + Tc + Td is processing time when the i-th layer processing is executed in the normal region <NUM>.

When determining that Ta is larger than Tb + Tc + Td (S446: YES), the quantitative determination processing unit <NUM> determines that there is a quantitative effect because the processing time is shorter when the i-th layer processing is executed in the normal region <NUM> than when the i-th layer processing is executed in the TEE trust region <NUM> region (S447), inputs the data to the semantic determination processing unit <NUM>, and ends the quantitative determination processing.

When determining that Ta is smaller than Tb + Tc + Td (S446: NO), the quantitative determination processing unit <NUM> determines that there is no quantitative effect because the processing time is shorter when the i-th layer processing is executed in the TEE trust region <NUM> than when the i-th layer processing is executed in the normal region <NUM> region (S448), inputs the data and the parameter information used for the i-th layer processing to the i-th layer processing unit <NUM> of the TEE trust region <NUM>, and ends the quantitative determination processing.

For example, in a case where the processing of the normal region <NUM> can be executed at high speed by an acceleration chip such as the GPU <NUM>, there is a case where the processing can be executed at high speed on the order of about <NUM> times the processing of the TEE trust region <NUM>, and thus, there is a case where Tc becomes extremely smaller than Ta. In this case, since Tb + Tc + Td is extremely highly likely to become smaller than Ta, only the semantic determination processing may be performed with the quantitative determination processing omitted.

On the other hand, in a case where the processing in the normal region cannot be executed at high speed, the difference between Ta and Tc is small, and depending on Tb and Td, Ta becomes smaller than Tb + Tc + Td.

The predicted values Ta to Td calculated by the quantitative determination processing unit <NUM> (and/or the determination result by the quantitative determination processing unit <NUM>) may be notified to the user of the concealment information processing server <NUM> by the determination notification processing unit <NUM> displaying the predicted values Ta to Td on the display device <NUM>, may be notified to the user of the data holder terminal <NUM> by the determination notification processing unit <NUM> displaying the predicted values Ta to Td on the display device <NUM> of the data holder terminal <NUM>, and may be notified to the user of the processing result user terminal <NUM> by the determination notification processing unit <NUM> displaying the predicted values Ta to Td on the display device <NUM> of the processing result user terminal <NUM>. In this case, the input of a determination result (that is, the determination result in step S446) as to whether or not there is a quantitative effect for the notification may be received from the user via the input device <NUM>, the input device <NUM>, or the input device <NUM>, and the quantitative determination processing unit <NUM> may determine whether or not to execute the semantic determination processing in accordance with the determination result.

The quantitative determination processing unit <NUM> executes the quantitative determination only for the i-th layer in one quantitative determination processing, but may execute the quantitative determination processing for a plurality of layers (quantitative determination processing of all layers in the quantitative determination processing of the first time, for example) at a time.

<FIG> is a flowchart illustrating an example of the semantic determination processing. The semantic determination processing unit <NUM> of the TEE trust region <NUM> compares the input data of the i-th layer with the input data of the first layer, and calculates similarity Pa between the input data of the i-th layer and the input data of the first layer (S451). The semantic determination processing unit <NUM> calculates similarity Pb between the input data of the i-th layer and the inference result of the final layer on the basis of the input data of the i-th layer and the parameter information <NUM> (S452).

The semantic determination processing unit <NUM> calculates content (for example, personal name, human face, outline of human body, and so on) Pc of personal information in the input data of the i-th layer (S453). The semantic determination processing unit <NUM> calculates content (for example, company name, design information, image of component, business confidentiality, parameter information of deep learning model, and so on) of trade secret information in the input data of the i-th layer (S454). That is, in steps S452 and S453, the semantic determination processing unit <NUM> determines how much secret information is included in the input data of the i-th layer.

The semantic determination processing unit <NUM> compares Pa, Pb, Pc, and Pd with predetermined thresholds (for Pa, Pb, Pc, and Pd, respectively), and determines whether any of them exceeds the threshold (S455). If determining that any of Pa, Pb, Pc, and Pd exceeds the threshold (S455: Yes), the semantic determination processing unit <NUM> determines that there is a semantic risk (or a semantic risk is large) (S456), inputs the data and the parameter information used for the i-th layer processing to the i-th layer processing unit <NUM> of the TEE trust region <NUM>, and ends the semantic determination processing.

If determining that none of Pa, Pb, Pc, and Pd exceeds the threshold (S455: No), the semantic determination processing unit <NUM> determines that there is no semantic risk (or the semantic risk is small) (S457), inputs the data and the parameter information used for the i-th layer processing to the i-th layer processing unit <NUM> of the normal region <NUM>, and ends the semantic determination processing.

Pa to Pd calculated by the semantic determination processing unit <NUM> (and/or the determination result by the semantic determination processing unit <NUM>) may be notified to the user of the concealment information processing server <NUM> by the determination notification processing unit <NUM> displaying the predicted values Ta to Td on the display device <NUM>, may be notified to the user of the data holder terminal <NUM> by the determination notification processing unit <NUM> displaying the predicted values Ta to Td on the display device <NUM> of the data holder terminal <NUM>, and may be notified to the user of the processing result user terminal <NUM> by the determination notification processing unit <NUM> displaying the predicted values Ta to Td on the display device <NUM> of the processing result user terminal <NUM>.

In this case, the input of a determination result (that is, the determination result in step S455) as to whether or not there is a semantic risk (or whether the semantic risk is large or small) for the notification may be received from the user via the input device <NUM>, the input device <NUM>, or the input device <NUM>, and the semantic determination processing unit <NUM> may determine whether to execute the i-th layer processing in the normal region <NUM> or to execute the i-th layer processing in the TEE trust region <NUM> in accordance with the determination result.

In the semantic determination processing of <FIG>, the semantic determination processing unit <NUM> calculates all the values of Pa to Pd and uses them for determination, but may calculate only some values (for example, only Pc or the like) and use them for determination. In step S456, the semantic determination processing unit <NUM> determines whether any of Pa to Pd exceeds the threshold, but may determine, for example, whether all of Pa to Pd exceed the threshold, or may determine whether the total value (may be a total value of weighting by a predetermined weight) of Pa to Pd exceeds a predetermined value.

The concealment information processing server <NUM> determines whether to execute the i-th layer processing in the normal region <NUM> or to execute the i-th layer processing in the TEE trust region <NUM> for each layer, but when determining that the processing of the i-th layer is executed in the normal region <NUM>, may omit the quantitative determination processing and the semantic determination processing for the i + <NUM>-th and subsequent layers, and determines that all processing of the i + <NUM>-th and subsequent layers are executed in the normal region <NUM>.

As described above, when executing, for the input information, the inference processing including processing of a plurality of layers such as CNN, the concealment information processing server <NUM> according to the first embodiment executes the quantitative determination processing before executing the data processing of each layer. In the quantitative determination processing, the concealment information processing server <NUM> calculates a predicted value of the data processing time of a layer in the TEE trust region <NUM> of the layer to be executed next and a predicted value of the data processing time of the layer in the normal region <NUM> including the determination time of the semantic determination processing and the data input/output time, and performs the data processing of each layer in a region where the predicted value of the data processing time is smaller, so that the data processing time can be shortened (processing overhead of outputting intermediate data in the TEE trust region <NUM> to the normal region <NUM> can be reduced).

When determining that it is more efficient (data processing time is short) to output data to the normal region <NUM> and process the data by the quantitative determination processing, the concealment information processing server <NUM> executes the semantic determination processing in the TEE trust region <NUM> before outputting the data to the normal region <NUM>. In the semantic determination processing, the concealment information processing server <NUM> determines the presence or absence of confidential information such as an image of an individual, an image of a component, or character information corresponding to personal information and a trade secret, and, only in a case where there is no (or low) risk of leakage of the confidential information, outputs the data to the normal region <NUM> and causes the processing to be executed in the normal region <NUM>. This allows the concealment information processing server <NUM> to suppress leakage of the confidential information into the normal region <NUM> and to protect the confidential information from the cyber attacker who has taken over, by the cyberattack, the system administrator of the concealment information processing server <NUM> and the administrator authority of it.

Description about content similar to that of the first embodiment will be omitted, and differences will be mainly described. A system configuration example of the concealment information processing system <NUM> according to the second embodiment is similar to that in <FIG>, and a hardware configuration example is similar to that in <FIG>.

In the concealment information processing system <NUM> according to the second embodiment, the processing result user terminal <NUM> transmits, to the concealment information processing server <NUM>, a processing request for inference processing using the confidential information held by the plurality of data holder terminals <NUM>. On the basis of the processing request, the concealment information processing server <NUM> conceals and transmits, to each data holder terminal <NUM>, parameter information including the network configuration in an AI model of deep learning, which is a trade secret owned on the concealment information processing server <NUM>, and filter information and weight information.

Each data holder terminal <NUM> performs inference/learning processing using confidential information such as personal information held by each data holder terminal <NUM> while keeping parameter information of the trade secret of the concealment information processing business operator concealed, and provides the processing result to the processing result user terminal <NUM>. Each data holder terminal <NUM> may perform other optional data processing in addition to the inference processing and the learning processing.

<FIG> is an explanatory diagram illustrating an example of a data flow of distributed concealment inference/learning processing. The functional units illustrated in <FIG> are partially omitted. Each data holder terminal <NUM> of the second embodiment has a functional unit and information included in the concealment information processing server <NUM> of <FIG>, and can execute the concealment inference processing illustrated in <FIG> and <FIG>. That is, in the second embodiment, each data holder terminal <NUM> can function as the concealment information processing server <NUM> in the first embodiment. The concealment information processing server <NUM> in the second embodiment needs not include the normal region <NUM>.

First, the CPU <NUM> of the processing result user terminal <NUM> generates an encryption processing request <NUM> by encrypting the processing request including the confidential information of the processing result user, and transmits the encryption processing request <NUM> to the concealment information processing server <NUM>.

Next, the decryption processing unit <NUM> of the concealment information processing server <NUM> decrypts the received encryption processing request <NUM> on the TEE trust region <NUM>, generates and encrypts an inference/learning request <NUM> including the parameter information <NUM>, which is a trade secret of the concealment information processing business operator, and processing request <NUM> on the basis of the content of the decrypted processing request <NUM>, and transmits the inference/learning request <NUM> to each data holder terminal <NUM> on the basis of the content of the processing request <NUM> (the processing request includes information for identifying the data holder terminal <NUM>).

Next, the CPU <NUM> of each data holder terminal <NUM> decrypts the received inference/learning request <NUM> in each TEE trust region <NUM>. Furthermore, by using the parameter information in which the inference/learning request <NUM> includes confidential information <NUM>, confidential information <NUM>, and confidential information <NUM> of each data holder in the TEE trust region <NUM>, the CPU <NUM> of each data holder terminal <NUM> executes the concealment inference processing illustrated in <FIG> and <FIG>, encrypts the inference/learning result, and transmits the encrypted inference/learning result to the concealment information processing server <NUM>.

Here, in the second embodiment, when each data holder terminal <NUM> executes the concealment inference processing of <FIG> and <FIG>, the data <NUM> including the confidential information of the data holder that is the concealment target in <FIG> in the first embodiment corresponds to the inference/learning request <NUM> including the processing request <NUM> and parameter information <NUM> that are the concealment target in the second embodiment.

In the second embodiment, similarly to the parameter information <NUM> input from the normal region <NUM> to the TEE trust region <NUM> in <FIG> in the first embodiment, each data holder terminal <NUM> inputs the confidential information <NUM>, the confidential information <NUM>, and the confidential information <NUM> of each data holder from a normal region <NUM> to the TEE trust region <NUM>, and executes processing in and after the quantitative determination processing. The inference/learning request <NUM> may be other data processing.

Next, the decryption processing unit <NUM> of the concealment information processing server <NUM> decrypts, in the TEE trust region, the encrypted inference result received from each data holder terminal <NUM>, then aggregates the decrypted inference results to generate, encrypt, and transmit, to the processing result user terminal <NUM>, an aggregation inference/learning result <NUM>. In a case where the inference/learning request <NUM> is a learning request, the decryption processing unit <NUM> may update the parameter information <NUM> using the aggregation inference/learning result <NUM>. In the end, the CPU <NUM> of the processing result user terminal <NUM> decrypts the encrypted aggregation inference/learning result to obtain an inference/result <NUM>.

As described above, on the basis of the processing request of inference/learning processing using the confidential information of the plurality of data holder terminals <NUM> from the processing result user terminal <NUM>, the concealment information processing system <NUM> according to the second embodiment transmits, to each data holder terminal <NUM>, the parameter information owned on the concealment information processing server <NUM> by the concealment information processing business operator, performs inference/learning processing using the confidential information such as personal information held by each data holder terminal <NUM>, and provides the processing result to the processing result user terminal <NUM>. Due to this, the concealment information processing system <NUM> according to the second embodiment achieves the following effects.

First, since the concealment information processing server <NUM> and each data holder terminal <NUM> decrypt and process the processing request of the processing result user terminal <NUM> only in the TEE trust region, the processing request can be concealed to the concealment information processing business operator and each data holder.

Since each data holder terminal <NUM> decrypts, only in the TEE trust region, the parameter information including the network configuration in the AI model of deep learning, which is a trade secret owned on the concealment information processing server <NUM> by the concealment information processing business operator, and the filter information and the weight information, and executes the concealment inference processing of <FIG> and <FIG>, it is possible to improve the processing efficiency of the deep learning inference processing in each data holder terminal <NUM> while keeping the trade secret concealed to each data holder.

Then, since each data holder terminal <NUM> performs the inference/learning processing without taking confidential information such as personal information of each data holder out of each data holder terminal <NUM>, it is possible to conceal the confidential information to the concealment information processing business operator and the processing result user.

As described above, according to the distributed concealment inference processing executed by the concealment information processing system <NUM> of the second embodiment, the data holder, the concealment information processing business operator, and the processing result user can perform the concealment inference/learning processing combining the data of a plurality of data holders while keeping each piece of confidential information concealed to the other two.

The present invention is not limited to the above-described embodiments, and includes various modifications and equivalent configurations within the scope of the appended claims. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and the present invention is not necessarily limited to those having all the described configurations. A part of the configuration of a certain embodiment may be added, deleted, or replaced with another configuration.

Some or all of the above-described configurations, functions, processing units, processing means, and the like may be achieved by hardware by being designed as an integrated circuit or the like, or may be achieved by software by a processor interpreting and executing a program for achieving each function.

Information such as a program, a table, and a file for achieving each function can be stored in a storage device such as a memory, a hard disk, and a solid state drive (SSD), or a recording medium such as an IC card, an SD card, and a DVD.

In the drawings, control lines and information lines considered to be necessary for description are illustrated, and not all control lines and information lines necessary for implementation are illustrated. In reality, almost all the configurations may be considered mutually connected.

The present invention can achieve a similar effect also in a case of concealing and providing, to an external organization or the like, confidential information that is highly confidential and restricted from being disclosed to the outside of a company by internal rules or the like, such as business secrets in addition to personal information.

Claim 1:
An information processing apparatus (<NUM>) that executes machine learning by a plurality of processing layers, the information processing apparatus, comprising:
a processor (<NUM>); and
a memory (<NUM>),
wherein
the memory (<NUM>) includes a normal region (<NUM>) and an isolation region (<NUM>) isolated from the normal region (<NUM>),
the normal region (<NUM>) holds a parameter of the machine learning,
the isolation region (<NUM>) holds input data to an i-th layer included in the plurality of processing layers and a parameter of the machine learning, and
the processor (<NUM>)
executes semantic determination processing of determining whether there is a risk in executing processing of the i-th layer for the input data in the normal region (<NUM>) on a basis of a content of secret information of the input data in the isolation region (<NUM>),
when determining that there is the risk, executes the processing of the i-th layer for the input data on a basis of the parameter held by the isolation region (<NUM>) in the isolation region (<NUM>), and
when determining that there is no risk, outputs the input data to the normal region (<NUM>), and executes the processing of the i-th layer for the input data on a basis of the parameter held by the normal region (<NUM>) in the normal region (<NUM>).