U.S. patent application number 13/074552 was filed with the patent office on 2011-07-21 for system and method for quantitative competition and recording medium having recorded thereon program for implementing the method.
This patent application is currently assigned to Nippon Telegraph and Telephone Corporation. Invention is credited to Kunio Kobayashi, Hikaru Morita, Koutarou Suzuki.
Application Number | 20110178893 13/074552 |
Document ID | / |
Family ID | 27476230 |
Filed Date | 2011-07-21 |
United States Patent
Application |
20110178893 |
Kind Code |
A1 |
Kobayashi; Kunio ; et
al. |
July 21, 2011 |
SYSTEM AND METHOD FOR QUANTITATIVE COMPETITION AND RECORDING MEDIUM
HAVING RECORDED THEREON PROGRAM FOR IMPLEMENTING THE METHOD
Abstract
A bid-opening device 20 receives from each bidding device
10.sub.m a bidding price index .gamma..sub.m=g(h.sup.k(IV.sub.m))
(where IV.sub.m is an initial value, h.sup.k indicates k-times
processing with a one-way function h and g is a one-way function)
and its identifier ID.sub.m. The received information is stored on
a common bulletin board 25. D.sub.m=h.sup.k(IV.sub.m) (where
D.sub.m=g(D.sub.m) is generated with k set as the upper limit value
K of the bidding price. The bulletin board 25 is checked for
.gamma..sub.m which matches this D.sub.m. If no match is found, m
is incremented by one, and the check for .gamma..sub.m-D.sub.m
matching is made for each of m bidding devices. Upon completion of
the matching for all the bidding devices, k is decremented by one,
and a check is made for for .gamma..sub.m which matches
D.sub.m=g(h.sup.k(IV.sub.m)), and the index k for which they match
is determined as the highest price bid. The bid-opening device 20
outputs that k and the identifier ID.sub.m of .gamma..sub.m.
Inventors: |
Kobayashi; Kunio; (Yokohama,
JP) ; Morita; Hikaru; (Yokohama, JP) ; Suzuki;
Koutarou; (Yokosuka, JP) |
Assignee: |
Nippon Telegraph and Telephone
Corporation
Tokyo
JP
|
Family ID: |
27476230 |
Appl. No.: |
13/074552 |
Filed: |
March 29, 2011 |
Related U.S. Patent Documents
|
|
|
|
|
|
Application
Number |
Filing Date |
Patent Number |
|
|
12488980 |
Jun 22, 2009 |
7941361 |
|
|
13074552 |
|
|
|
|
09619699 |
Jul 19, 2000 |
7567933 |
|
|
12488980 |
|
|
|
|
Current U.S.
Class: |
705/26.3 |
Current CPC
Class: |
G06Q 30/06 20130101;
G06Q 30/0601 20130101; G06Q 30/08 20130101; G06Q 40/00 20130101;
G06Q 40/04 20130101 |
Class at
Publication: |
705/26.3 |
International
Class: |
G06Q 30/00 20060101
G06Q030/00 |
Foreign Application Data
Date |
Code |
Application Number |
Jul 19, 1999 |
JP |
JP 205004/99 |
Sep 1, 1999 |
JP |
JP 247060/99 |
Jan 25, 2000 |
JP |
JP 2000-16020 |
Feb 24, 2000 |
JP |
JP 2000-47323 |
Claims
1-17. (canceled)
18. A server device for a system in which M participant devices
send their aimed values to said server device and said server
device determines which of said M participant devices has offered
the maximum or minimum one of said aimed values received, said
device comprising: a conversion table memory which has stored
therein a conversion table which defines the relationships between
a sequence of values selectable as said aimed values and a sequence
of indexes k of integral values respectively corresponding thereto,
for converting said aimed value PR.sub.m to the corresponding index
k.sub.m; a bulletin board on which said server device writes said
aimed value information an identifier received from each of said
participant devices; updated initial value generating means which
generates an updated initial value by processing said initial value
with a one-way function repeatedly in correspondence with values of
an index k which is a predetermined consecutive positive integers;
a counter which updates said index k one by one; and control means
which, upon each updating of said index k, compares said updated
initial value with said aimed value information on said bulletin
board to check whether they match, and determines m and k at the
time of first detection of a match.
19. The server device of claim 18, wherein: there are published on
said bulletin board .gamma..sub.m=g(h.sup.km(IV.sub.m)) as said
aimed value information; said updated initial value generating
means includes a one-way function g processor by which a response
D.sub.m=h.sup.k(IV.sub.m) received from said participant device in
correspondence with said index k is processed with a one-way
function g to generate g(D.sub.m) as said updated initial value;
and said control means makes a check to see if there exists on said
bulleting board said aimed value information .gamma..sub.m which
matches said updated initial value g(D.sub.m).
20. The server device of claim 19, wherein there is published on
said bulletin board C.sub.m=h.sup.K+1(IV.sub.m) received from said
participant device in advance, said server device further
comprising a one-way function h processor which processes said
response D.sub.m with a one-way function h to generate h(D.sub.m),
and wherein said control means checks whether C.sub.m=h(D.sub.m)
holds, and if not, rewrites said C.sub.m with said D.sub.m and
updates said index k on said counter.
21. The server device of claim 18, wherein: there are published on
said bulletin board C.sub.m=h.sup.K+1(IV.sub.m), said aimed value
information .gamma..sub.m=h.sup.k(IV.sub.m) and
h(PR.sub.m(+)R.sub.m) received from said each participant device,
said PR.sub.m and said R.sub.m being an aimed value and a random
number of said each participant device m; said control means
decides the maximum or minimum aimed value from said aimed values
PR.sub.m and said random numbers R.sub.m received from said
participant devices, and determines the index k.sub.mx
corresponding to said maximum or minimum aimed value and requests
said each participant device to send D.sub.m=h.sup.kmx(IV.sub.m)
corresponding to said index k.sub.mx; said updated initial value
generating means comprises a one-way function h processor for
processing D.sub.m with a one-way function h to generate
h.sup.K+1-kmx(D.sub.m), and a one-way function g processor for
processing D.sub.j with a one-way function g to generate
g(D.sub.j); and said control means makes a check to see if said
h.sup.K+1-kmx(D.sub.m) matches C.sub.m on said bulletin board and
if said g(D.sub.j) matches said .gamma..sub.m on said bulleting
board.
22. The server device of claim 18, wherein: there are published on
said bulletin board h(k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k))
together with said aimed value information .gamma..sub.m received
from said each participant device, said b.sub.m.sup.(k) being
select information whether said index k corresponds to its aimed
value and said R.sub.1 .sup.(k) being a random number generated for
said index k; said server device further comprises an operator for
operating k(+)b(+)R.sub.m.sup.(k), and a one-way function h
processor for processing the result of said operation with a
one-way function h to generate h(k(+)b(+)R.sub.m.sup.(k)), where b
is a predetermined value which indicates that said select
information b.sub.m.sup.(k) has selected the aimed value
corresponding to said index k; and said control means makes a check
for matching between said h(k(+)b(+)R.sub.m.sup.(k)) and said
h(k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k)) on said bulletin
board.
23. The server device of claim 18, wherein: there is published on
said bulletin board, as said aimed value information,
H.sub.m.sup.(K) generated by said each participant device which,
upon each processing of said initial value with a one-way function
h, added the processed value with select information
b.sub.m.sup.(k) indicating whether said value was an aimed value
for each value of said index k and repeated this processing from at
least the index k.sub.m corresponding to said aimed value to the
upper limit value K of said index k; said updated initial value
generating means includes a one-way function h processor by which
{H.sub.m.sup.(k-1), b.sub.m} received from said each participant
device in answer to an inquiry for said index k is processed with a
one-y function h to generate
H.sub.m.sup.(k)=h(H.sub.m.sup.(k-1).parallel.b.sub.m.sup.(k)); and
said server device includes an updated initial value comparator for
making a check to see if said H.sub.m.sup.(k) matches previously
received H.sub.m.sup.(k).
24. The server device of claim 18, wherein: letting an arbitrary
aimed value PR be represented by PR=F(k)+Q, where F(k) is a value
in said conversion table corresponding to said index k and Q is a
fraction which is a positive integer which satisfies
F(k+1)-F(k)>Q.gtoreq.0, there is published on said bulletin
board said fraction Q received from said each participant device,
together with said aimed value information; said server device
includes a sequencer for deciding the sequence of said fractions
Q.sub.m on said bulletin board; said updated initial value
generating means includes a one-way function h processor for
processing said initial value with a one-way function h by k times
to generate h.sup.k(IV.sub.m) and a one-way function g processor
for processing said h.sup.k(IV.sub.m) with a one-way function g to
generate D.sub.m=g(h.sup.k(IV.sub.m)); and control means makes a
check to see if said D.sub.m matches said aimed value information
on said bulletin board in the sequence of said fractions
Q.sub.m.
25. The server device of claim 18, wherein there is published on
said bulletin board H.sub.m.sup.K)=h.sup.K-km(g.sup.xm(IV.sub.m))
as said aimed value information received from said each participant
device, which further comprises a one-way function h processor by
which H.sub.m.sup.(k-1) received from said each participant device
as an answer to an inquiry for said k is processed with a one-way
function h to generate h(H.sub.m.sup.(k-1)), and a one-way function
g processor for processing said answer H.sub.m.sup.(k-1) with a
one-way function g to generate g(H.sub.m.sup.(k-1)); and wherein
said control means: makes a check to see if said
h(H.sub.m.sup.(k-1)) matches said aimed value information
H.sub.m.sup.(K) published on said bulletin board; if a match is
detected, updates said aimed value information H.sub.m.sup.(K) with
said H.sub.m.sup.(k-1) and decrements said index k on said counter
by one; and if a mismatch is detected, makes a check to see if said
g(H.sub.m.sup.(k-1)) matches said aimed value information
H.sub.m.sup.(K); and if a match is detected, determines, based on k
and m at that time, the maximum or minimum aimed value PR.sub.m and
the participant device m having offered said value PR.sub.m.
26. The server device of claim 18, wherein: letting an arbitrary
aimed value PR be represented by PR=F(k)+Q, where F(k) is a value
in said conversion table corresponding to said index k and Q is a
fraction which is a positive integer which satisfies
F(k+1)-F(k)>Q.gtoreq.0, there is published on said bulletin
board said fraction Q received from said each participant device,
together with said aimed value information; said server device
includes: a sequencer for deciding the sequence of said fractions
Q.sub.m on said bulletin board; and select information comparator
for checking whether said select information b.sub.m.sup.(k) is
equal to a value b indicating the selection of the aimed value
corresponding to said index k in said decided sequence of fractions
Q.sub.m.
27. The device of claim 18, wherein said sequence of index values k
and said sequence of values selectable as said aimed values on said
conversion table are monotone increasing values in the same
direction, and said server device determines the maximum aimed
value.
28. The device of claim 18, wherein said sequence of index values k
and said sequence of values selectable as said aimed values on said
conversion table are monotone increasing values in opposite
directions, and said server device determines the minimum aimed
value.
29. A recording medium on which there is recorded as a program the
procedure which is followed by an m-th one of M participant
devices, where m=1, 2, . . . , M, in a quantitative competition
method for a system in which said M participant devices send their
aimed values to a server device and said server device determines
which of said M participant devices has offered the maximum or
minimum one of said aimed values received, and there is provided a
conversion table showing the relationships between a sequence of
values selectable as said aimed values and a sequence of indexes k
of integral values respectively corresponding thereto, said
procedure comprising the steps of: (a) processing an initial value
inherent to said participant device m with a predetermined one-way
function by the number of times corresponding to said aimed value
to generate aimed value information
.gamma..sub.m=g(h.sup.km(IV.sub.m)) where g is a one-way function,
IV.sub.m is said initial value, k.sub.m is an index corresponding
to the aimed value of said participant device m and
h.sup.km(IV.sub.m) indicates processing of said initial value
IV.sub.m with a one-way function h by k.sub.m times; and (b)
sending said aimed value information
.gamma..sub.m=g(h.sup.km(IV.sub.m)) to said server device.
30. A recording medium on which there is recorded as a program the
procedure which is followed by an m-th one of M participant
devices, where m=1, 2, . . . , M, in a quantitative competition
method for a system in which said M participant devices send their
aimed values to a server device and said server device determines
which of said M participant devices has offered the maximum or
minimum one of said aimed values received, and there is provided a
conversion table showing the relationships between a sequence of
values selectable as said aimed values and a sequence of indexes k
of integral values respectively corresponding thereto, said
procedure comprising the steps of: (a-1) processing an initial
value inherent to said participant device m with a predetermined
one-way function by the number of times corresponding to said aimed
value to generate aimed value information
.gamma..sub.m=g(h.sup.km(IV.sub.m)) where g is a one-way function,
IV.sub.m is said initial value, k.sub.m is an index corresponding
to the aimed value of said participant device m and
h.sup.km(IV.sub.m) indicates processing of said initial value
IV.sub.m with a one-way function h by k.sub.m times; (a-2)
generating verification information C.sub.m=h.sup.K+1(IV.sub.m) and
sending said verification information to said server device
together with said aimed value information .gamma..sub.m; (b)
generating said initial value updated by the number of times
requested by said server device and sending said updated initial
value to said server device; and (c) sending said aimed value
information .gamma..sub.m=g(h.sup.km(IV.sub.m)) to said server
device.
31. The recording medium of claim 30, wherein said step (b)
includes a step of generating D.sub.m=h.sup.k(IV.sub.m) as said
updated initial value corresponding to said index k and sending
said updated initial value to said server device in response to its
request.
32. A recording medium on which there is recorded as a program the
procedure which is followed by an m-th one of M participant
devices, where m=1, 2, . . . , M, in a quantitative competition
method for a system in which said M participant devices send their
aimed values to a server device and said server device determines
which of said M participant devices has offered the maximum or
minimum one of said aimed values received, and there is provided a
conversion table showing the relationships between a sequence of
values selectable as said aimed values and a sequence of indexes k
of integral values respectively corresponding thereto, said
procedure comprising the steps of: (a-1) computing aimed value
information by .gamma..sub.m=g(h.sup.km(IV.sub.m)) where g is a
one-way function, IV.sub.m is said initial value, k.sub.m is an
index corresponding to the aimed value PR.sub.m of said participant
device m and h.sup.km(IV.sub.m) indicates processing of said
initial value IV.sub.m with a one-way function h by k.sub.m times;
(a-2) generating verification information
C.sub.m=h.sup.K+1(IV.sub.m); (a-3) generating h(PR.sub.m(+)R.sub.m)
from a random number R.sub.m and said aimed value PR.sub.m and
sending said h(PR.sub.m(+)R.sub.m) to said server device together
with said aimed value information .gamma..sub.m and said
verification information C.sub.m, said (+) indicating a
predetermined arbitrary operation; (b-1) sending said aimed value
PR.sub.m and said random number R.sub.m to said server device in
response to its request; and (b-2) generating
D.sub.m=h.sup.k(IV.sub.m) as said updated initial value
corresponding to said index k and sending said updated initial
value to said server device in response to its request to present
said h.sup.k(IV.sub.m).
33. The recording medium of claim 32, wherein said step (a-3) is a
step of generating h(PR.sub.m(+)R.sub.m) from a random number
R.sub.m, said aimed value PR.sub.m and additional information
I.sub.m about the sending of said aimed value information indicated
by said participant device m and sending said h(PR.sub.m(+)R.sub.m)
to said server device, said additional information I.sub.m being
sent to said server device in said step (b-2).
34. A recording medium on which there is recorded as a program the
procedure which is followed by an m-th one of M participant
devices, where m=1, 2, . . . , M, in a quantitative competition
method for a system in which said M participant devices send their
aimed values to a server device and said server device determines
which of said M participant devices has offered the maximum or
minimum one of said aimed values received, and there is provided a
conversion table showing the relationships between a sequence of
values selectable as said aimed values and a sequence of indexes k
of integral values respectively corresponding thereto, said
procedure comprising the steps wherein: (a) upon each processing of
said initial value with said one-way function h, said each
participant device generates an updated initial value by adding
said processed initial value with select information
b.sub.m.sup.(k) indicating whether said processed initial value is
an aimed value for one value of said index k, and generates
H.sub.m.sup.(K) by repeatedly performing this processing from at
least that index k.sub.m of a sequence of indexes which corresponds
to said aimed value to the upper limit value K, and sends said
H.sub.m.sup.(K) as said aimed value information to said server
device; (b-1) said server device requests said each participant
device to send an updated initial value {H.sub.m.sup.(k-1),
b.sub.m.sup.(k)} corresponding to each value of said index k in
descending order from K; and (b-2) said each participant device
generates and sends {H.sub.m.sup.(k-1), b.sub.m.sup.(k)} as said
updated initial value to said server device.
35. A recording medium on which there is recorded as a program the
procedure which is followed by an m-th one of M participant
devices, where m=1, 2, . . . , M, in a quantitative competition
method for a system in which said M participant devices send their
aimed values to a server device and said server device determines
which of said M participant devices has offered the maximum or
minimum one of said aimed values received, and there is provided a
conversion table showing the relationships between a sequence of
values selectable as said aimed values and a sequence of indexes k
of integral values respectively corresponding thereto, said
procedure comprising the steps of: (a) generating
H.sub.m.sup.(K)=h.sup.K-km(g.sup.xm(IV.sub.m)) as said aimed value
information using a predetermined positive integer x.sub.m, an
initial value IV.sub.m and one-way functions h and g, and sends
said aimed value information to said server device; (b-1) decides
whether its received index k from said server device is the index
k.sub.m corresponding to said aimed value; (b-2) if the result of
decision in step (b-1) is k=k.sub.m, generating and sending
H.sub.m.sup.(k-1)=g.sup.xm-1(IV.sub.m) as said updated initial
value to said server device; and (b-3) if the result of decision in
said step (b-1) is not k=k.sub.m, generating and sending
H.sub.m.sup.(k-1)=h.sup.k-km-1(g.sup.xm(IV.sub.m)) as said updated
initial value to said server device.
36. A recording medium on which there is recorded as a program the
procedure which is followed by an m-th one of M participant
devices, where m=1, 2, . . . , M, in a quantitative competition
method for a system in which said M participant devices send their
aimed values to a server device and said server device determines
which of said M participant devices has offered the maximum or
minimum one of said aimed values received, and there is provided a
conversion table showing the relationships between a sequence of
values selectable as said aimed values and a sequence of indexes k
of integral values respectively corresponding thereto, letting the
initial value of said each participant device be represented by
IV.sub.m, said procedure comprising the steps of: (a) generating
H.sub.m.sup.(K)=h.sup.K-km(g.sup.xm(IV.sub.m)) as said aimed value
information using a predetermined positive integer x.sub.m, an
initial value IV.sub.m and one-way functions h and g, and sends
said aimed value information to said server device; (b-1) decides
whether its received index k from said server device is the index
k.sub.m corresponding to said aimed value; (b-2) if the result of
decision in step (b-1) is k=k.sub.m, generating
H.sub.m.sup.(k-1)=g.sup.xm-1(IV.sub.m) as said updated initial
value and sending said updated initial value to said server device
together with a flag indicating that said k and k.sub.m are equal;
and (b-3) if the result of decision in said step (b-1) is not
k=k.sub.m, generating and sending
H.sub.m.sup.(k-1)=h.sup.k-km-1(g.sup.xm(IV.sub.m)) as said updated
initial value to said server device.
37. A recording medium on which there is recorded as a program the
procedure which is followed by an m-th one of M participant
devices, where m=1, 2, . . . , M, in a quantitative competition
method for a system in which said M participant devices send their
aimed values to a server device and said server device determines
which of said M participant devices has offered the maximum or
minimum one of said aimed values received, and there is provided a
conversion table showing the relationships between a sequence of
values selectable as said aimed values and a sequence of indexes k
of integral values respectively corresponding thereto, said
procedure comprising the step of: (a) processing, with a
predetermined one-way function h and through the use of said
conversion table, information
k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k), which contains each index k
equal to or larger than an index k.sub.m corresponding to said
aimed value, select information b.sub.m.sup.(k) indicating whether
said index k corresponds to said aimed value, and a random number
R.sub.m.sup.(k), to generate at least K-k.sub.m+1 pieces of aimed
value information h(k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k)), and
sends these pieces of aimed value information to said server
device, A(+)B representing a predetermined arbitrary operation.
38. The recording medium of claim 37, wherein said procedure
further comprises a step of sending to said server device a random
number R.sub.m.sup.(k) corresponding to the index k received from
said server device.
39. The recording medium of claim 37, wherein said step (a)
includes a step of sending a random number R.sub.m.sup.(k) to said
server device together with said
h(k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k)).
40. The recording medium of claim 30, wherein let an arbitrary
aimed value be represented by PR=F(k)+Q, where F(k) is a value in
said conversion table corresponding to said index k and Q is a
fraction which is a positive integer which satisfies
F(k+1)-F(k)>Q.gtoreq.0; said procedure further comprises a step
wherein, letting said aimed value PR.sub.m of said each participant
device m be represented by PR.sub.m=F(k.sub.m)+Q.sub.m, said each
participant device m sends said fraction Q.sub.m to said server
device together with said aimed value information
.gamma..sub.m.
41. The recording medium of claim 30, wherein said sequences of
indexes k and values selectable as said aimed values are both
monotonous increasing values in the same direction.
42. The recording medium of claim 30, wherein said sequences of
indexes k and values selectable as said aimed values are both
monotonous increasing values in opposite directions.
43. The recording medium of claim 30, wherein said procedure
further comprises the steps of: (0-1) sending the identifier
ID.sub.m of said each participant device to a provisional
identifier registration device; (0-2) receiving a provisional
identifier AID.sub.m from said provisional identifier registration
device; and (0-3) sending said provisional identifier AID.sub.m as
an identifier to said server device together with said aimed value
information.
44. A recording medium on which there is recorded as a program the
procedure which is followed by a server device in a quantitative
competition method for a system in which a plurality of participant
devices send their aimed values to said server device and said
server device determines which of said participant devices has
offered the maximum or minimum one of said aimed values received,
and there is provided a conversion table showing the relationships
between a sequence of values selectable as said aimed values and a
sequence of indexes k of integral values respectively corresponding
thereto, said procedure comprising the steps of: (a) receiving,
from each of participant devices, h(H.sub.m.sup.(K)) generated as
aimed value information of said each participant device by
repeating, for each of a sequence of index values k from at least
k.sub.m corresponding to an aimed value of said each participant
device to an upper limit index value K, processing of: combining an
initial value of said each participant device with select
information to provide combined information and operating a one-way
function h on said combined information to generate an updated
value, said select information indicating whether said each index
value k is an aimed value or not, and publishing said aimed value
information h(H.sub.m.sup.(K)) on a bulletin board accessible from
all of said participant devices and any other devices as well; (b)
requesting said each participant device to send an updated initial
value {H.sub.m.sup.(k-1), b.sub.m.sup.(k)} corresponding to each
value of said index k in descending order from K; (c) publishing
said updated initial value {H.sub.m.sup.(k-1), b.sub.m.sup.(k)} on
said bulletin board; (d) processing said updated initial value
{H.sub.m.sup.(k-1), b.sub.m.sup.(k)} with said one-way function h
to generate
H.sub.m.sup.(k)=h(H.sub.m.sup.(k-1).parallel.b.sub.m.sup.(k)); (e)
checking whether said updated initial value H.sub.m.sup.(k) matches
H.sub.m.sup.(k) in {H.sub.m.sup.(k), b.sub.m.sup.(k+1)} previously;
and (f) if a match is detected in said step (e), deciding whether
said select information b.sub.m.sup.(k) represents that the
corresponding index k is the index k.sub.m of said aimed value; and
(g) if the result of decision in said step (f) is true, outputting
said index k concerned and the corresponding participant device
number m, and if the result of decision is false, said server
device returns to said step (b) and repeats processing for the next
index value k.
45. A recording medium on which there is recorded as a program the
procedure which is followed by a server device in a quantitative
competition method for a system in which a plurality of participant
devices send their aimed values to said server device and said
server device determines which of said participant devices has
offered the maximum or minimum one of said aimed values received,
and there is provided a conversion table showing the relationships
between a sequence of values selectable as said aimed values and a
sequence of indexes k of integral values respectively corresponding
thereto, said procedure comprising the steps wherein said server
device: (a) receives H.sub.m.sup.(K) as said aimed value
information from said each participant device which, upon each
processing of said initial value with said one-way function h,
generates an updated initial value by adding said processed initial
value with select information b.sub.m.sup.(k) indicating whether
said processed initial value is an aimed value for one value of
said index k, and generates H.sub.m.sup.(K) by repeatedly
performing this processing from at least that index k.sub.m of a
sequence of indexes which corresponds to said aimed value to the
upper limit value K, and publishes said aimed value information
H.sub.m.sup.(K) on a bulletin board accessible from all of said
participant device; (b) for each value of said index k in order
descending from K, inquires said each participant device about
whether it has bid for said index k, said each participant device
responding YES or NO to said inquiry; (c) upon first detection of
the response YES, requests said each participant device to send its
updated initial value H.sub.m.sup.(k-1); and (d) receives
H.sup.m.sup.(k-1)=h(H.sub.m.sup.(k-2).parallel.b.sub.m.sup.(k-1))
as said updated initial value from said each participant device and
publishes said received updated initial value on said bulletin
board; (e) letting a and a represent predetermined values of said
select information b.sub.m.sup.(k) indicating bidding and not
bidding, respectively, generates, for said participant device m
having bid for the current index k, H.sub.m=h( . . .
h(h(H.sub.m.sup.(k-1).parallel.a).parallel.a) . . . .parallel.a)
through the use of said updated initial value H.sub.m.sup.(k-1),
and for every one of the other participant devices m, generates
H.sub.m=h( . . . h(h(H.sub.m.sup.(k-1).parallel.a).parallel.a) . .
. .parallel.a) through the use of said updated initial values
H.sub.m.sup.(k-1); (f) checks whether said H.sub.m for said each
participant device matches said H.sub.m.sup.(k) published on said
bulletin board; and (g) if a match is detected in said step (f),
determines that said participant device having responded YES is the
winning bidding device, and publishes the current value of said
index k as the index k.sub.m of the aimed value of said winning
bidding device.
46. A recording medium on which there is recorded as a program the
procedure which is followed by a server device in a quantitative
competition method for a system in which a plurality of participant
devices send their aimed values to said server device and said
server device determines which of said participant devices has
offered the maximum or minimum one of said aimed values received,
and there is provided a conversion table showing the relationships
between a sequence of values selectable as said aimed values and a
sequence of indexes k of integral values respectively corresponding
thereto, said procedure comprising the steps of: (a) letting the
initial value of said each participant device be represented by
IV.sub.m, receiving from said each participant device
H.sub.m.sup.(K)=h.sup.K-km(g.sup.xm(IV.sub.m)) generated as said
aimed value information using a predetermined positive integer
x.sub.m, said initial value IV.sub.m and one-way functions h and g;
(b) publishing said aimed value information A.sub.m on a bulletin
board accessible from all of said participant devices; and (c)
sending said index k to said each participant device to ask for its
updated initial value; (d) processing said updated initial value
H.sub.m.sup.(k-1) with said one-way function h to generate
h(H.sub.m.sup.(k-1)); (e) deciding whether said
h(H.sub.m.sup.(k-1)) is equal to said aimed value information
H.sub.m.sup.(K); (f) if it is decided in said step (e) that they
are equal, updating said aimed value information H.sub.m.sup.(K)
with said updated initial value H.sub.m.sup.(k-1), then
decrementing said index k by one and returning to said step (c);
(g) if it is decided in said step (e) that they are not equal,
processing said updated initial value H.sub.m.sup.(k-1) with said
one-way function g to generate g(H.sub.m.sup.(k-1)); and (h)
deciding whether said g(H.sub.m.sup.(k-1)) matches said aimed value
information H.sub.m.sup.(K); and (i) deciding that the aimed value
of said participant device corresponding to m and k having provided
said match is the maximum or minimum, if a match is detected in
said step (h).
47. A recording medium on which there is recorded as a program the
procedure which is followed by a server device in a quantitative
competition method for a system in which a plurality of participant
devices send their aimed values to said server device and said
server device determines which of said participant devices has
offered the maximum or minimum one of said aimed values received,
and there is provided a conversion table showing the relationships
between a sequence of values selectable as said aimed values and a
sequence of indexes k of integral values respectively corresponding
thereto, said procedure comprising the steps wherein said server
device: (a), letting the initial value of said each participant
device be represented by IV.sub.m, where m=1, 2, . . . , M, M being
an integer equal to or greater than 2, receives from each
participant device, as said aimed value information,
H.sub.m.sup.(K)=h.sup.K-km(g.sup.xm(IV.sub.m)) using a
predetermined positive integer x.sub.m, said initial value IV.sub.m
and one-way functions h and g, and publishes said received aimed
value information on a bulletin board accessible from all of said
participant devices; (b) for each value of said index k in order
descending from K, inquires said each participant device about
whether it has bid for said index k, said each participant device
responding YES or NO to said inquiry; (c) upon first detection of
the response YES, requests said each participant device to send its
updated initial value H.sub.m.sup.(k-1); (d) receives from said
each participant device H.sub.m.sup.(k-1)=g.sup.xm-1(IV.sub.m) if
k=k.sub.m and H.sub.m.sup.(k-1)=h.sup.k-km-1(g.sup.xm(IV.sub.m)) if
k.noteq.k.sub.m; (e) for said updated initial value
H.sub.m.sup.(k-1) received from said participant device having
responded YES, generates H.sub.m=h.sup.K-kmg(H.sub.m.sup.(k-1)) and
for said updated initial value received from said each participant
device having responded NO, generates
H.sub.m=h.sup.K+1-kg(H.sub.m.sup.(k-1)) (f) checks whether said
H.sub.m for said each participant device matches said
H.sub.m.sup.(K) published on said bulletin board; and (g) if a
match is detected in said step (f), determines that said
participant device having responded YES is the winning bidding
device, and publishes the current value of said index k as the
index K.sub.m of the aimed value of said winning bidding
device.
48. A recording medium on which there is recorded as a program the
procedure which is followed by a server device in a quantitative
competition method for a system in which a plurality of participant
devices send their aimed values to said server device and said
server device determines which of said participant devices has
offered the maximum or minimum one of said aimed values received,
and there is provided a conversion table showing the relationships
between a sequence of values selectable as said aimed values and a
sequence of indexes k of integral values respectively corresponding
thereto, said procedure comprising the steps of: (a) letting the
initial value of said each participant device be represented by
IV.sub.m, receiving from said each participant device
H.sub.m.sup.(K)=h.sup.K-km(g.sup.xm(IV.sub.m)) generated as said
aimed value information using a predetermined positive integer
x.sub.m, said initial value IV.sub.m and one-way functions h and g;
(b) publishing said aimed value information H.sub.m.sup.(K) on a
bulletin board accessible from all of said participant devices; and
(c) sending said index k to said each participant device to ask for
its updated initial value; (d) checking whether its received
updated initial value H.sub.k,m is added with said flag; (e) if it
is decided in said step (d) that said flag is added, processing
said updated initial value H.sub.m.sup.(k-1) with said one-way
function g to generate g(H.sub.m.sup.(k-1)); (f) deciding whether
said g(H.sub.m.sup.(k-1)) matches said aimed value information
H.sub.m.sup.(K); (g) if it is decided in said step (d) that no flag
is added, processing said updated initial value H.sub.m.sup.(k-1)
with said one-way function h to generate h(H.sub.m.sup.(k-1)); (h)
deciding whether said h(H.sub.m.sup.(k-1)) matches said aimed value
information H.sub.m.sup.(K); (i) if it is decided in said step that
they are equal, updating said aimed value information
H.sub.m.sup.(K) with said initial value H.sub.m.sup.(k-1), then
decrementing said index k by one and returning to said step (c);
and (j) if it is decided in said step (h), processing said initial
value H.sub.m.sup.(k-1) with said one-way function g to generate
g(H.sub.m.sup.(k-1)) and returning to said step (f); and (k) if a
match is detected in said step (f), deciding that the aimed value
of said participant device corresponding to m and k having provided
said match is the maximum or minimum.
49. A recording medium on which there is recorded as a program the
procedure which is followed by a server device in a quantitative
competition method for a system in which a plurality of participant
devices send their aimed values to said server device and said
server device determines which of said participant devices has
offered the maximum or minimum one of said aimed values received,
and there is provided a conversion table showing the relationships
between a sequence of values selectable as said aimed values and a
sequence of indexes k of integral values respectively corresponding
thereto, and m=1, 2, . . . , M, M being an integer equal to or
greater than 2; said procedure comprising the steps of: (a)
receiving from each of said participant devices at least
K-k.sub.m+1 pieces of aimed value information
h(k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k)) generated by processing,
with a predetermined one-way function h and through the use of said
conversion table, information
k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k), which contains each index k
equal to or larger than an index k.sub.m corresponding to said
aimed value, select information b.sub.m.sup.(k) indicating whether
said index k corresponds to said aimed value, and a random number
R.sub.m.sup.(k), A(+)B representing a predetermined arbitrary
operation between A and B; (b) receiving and publishing said aimed
value information on a bulletin board accessible from all of said
participant devices; (c) obtaining said random number R.sub.m
corresponding to each of said sequence of indexes k; (d)
calculating h(k(+)a(+)R.sub.m.sup.(k)), where a is a predetermined
value with which said select information b.sub.m.sup.(k) indicates
said aimed value; (e) checking said aimed values on said bulletin
board for matching with said calculated h(k(+)a(+)R.sub.m.sup.(k));
and (f) if a match is detected in said step (e), deciding that the
aimed value of the aimed value information of a participant device
having sent said random number R.sub.m.sup.(k) at that time is the
maximum or minimum value.
50. The recording medium of claim 49, wherein said procedure
further comprises a step of repeating said steps (c), (d) and (e)
if a match is detected in said step (d).
51. The recording medium of claim 50, wherein said step (c)
includes the steps of: requesting said each participant device to
send said random number R.sub.m.sup.(k) corresponding to said index
k; and receiving said random number R.sub.m.sup.(k) from said each
participant device.
52. The recording medium of claim 50, wherein: said step (a)
includes a step of receiving said random number R.sub.m.sup.(k)
sent from said each participant device together with said aimed
value information h(k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k)); said
step (b) includes a step of storing said random number
R.sub.m.sup.(k) in a nonpublic memory; and said step (c) includes
the steps of: requesting said each participant device to send said
random number R.sub.m.sup.(k) corresponding to said index k; and
receiving said random number R.sub.m.sup.(k) from said each
participant device.
53. The recording medium of claim 44, wherein said sequences of
indexes k and values selectable as said aimed values are both
monotonous increasing values in the same direction, and in said
step (c) said server device determines the maximum aimed value.
54. The recording medium of claim 44, wherein said sequences of
indexes k and values selectable as said aimed values are both
monotonous increasing values in opposite directions, and in said
step (c) said server device determines the minimum aimed value.
55. The recording medium of claim 44, wherein let an arbitrary
aimed value be represented by PR=F(k)+Q, where F(k) is a value in
said conversion table corresponding to said index k and Q is a
fraction which is a positive integer which satisfies
F(k+1)-F(k)>Q.gtoreq.0; said step (a) includes a step wherein,
letting said aimed value PR.sub.m of said each participant device m
be represented by PR.sub.m=F(k.sub.m)+Q.sub.m, said server device
receives from each participant device m said aimed value
information generated by processing said initial value with said
one-way function h by the number of times corresponding to k.sub.m,
together with said fraction Q.sub.m, where m=1, 2, . . . , M, said
M being an integer equal to or greater than 2, and said server
device publishes said aimed value information and said fraction
Q.sub.m on a bulletin board accessible from all of said participant
devices; said step (c) includes a step where said server device
makes a check for matching between said updated initial value and
said aimed value information for each index value in an ascending
or descending order of said fraction Q.sub.m where m=1, 2, . . . ,
M; and said step (d) includes a step wherein, upon first detection
of a match in said step (c), said server device finishes said check
and determines, from k.sub.m and m at the time of detecting the
match, that PR.sub.m=F(k.sub.m)+Q.sub.m is said maximum or minimum
aimed value.
56. The recording medium of claim 49, wherein let an arbitrary
aimed value be represented by PR=F(k)+Q, where F(k) is a value in
said conversion table corresponding to said index k and Q is a
fraction which is a positive integer which satisfies
F(k+1)-F(k)>Q.gtoreq.0; said step (a) includes a step wherein,
letting said aimed value PR.sub.m of said each participant device m
be represented by PR.sub.m=F(k.sub.m)+Q.sub.m, said server device
receives said fraction Q.sub.m together with said aimed value
information; said step (b) includes a step of publishing said
fraction Q.sub.m on said bulletin board together with said aimed
value information, where m=1, 2, . . . , M, said M being an integer
equal to or greater than 2; said step (e) includes a step of making
said check for matching for each index value in an ascending or
descending order of said fraction Q.sub.m where m=1, 2, . . . , M;
and said step (f) includes a step wherein, upon first detection of
a match in said step (c), said server device finishes said check
and determines, from k.sub.m and m at the time of detecting the
match, that PR.sub.m=F(k.sub.m)+Q.sub.m is said maximum or minimum
aimed value.
57. A quantitative competition system which comprises a server
device and M participant devices each connected via a communication
channel to said server device and in which said M participant
devices send their aimed values to said server device and said
server device determines which of said M participant devices has
offered the maximum or minimum one of said aimed values received,
each of said participant devices comprising: aimed value generating
means for generating an aimed value PR.sub.m; aimed value
transforming means provided with a conversion table memory having
stored therein a conversion table which defines the relationships
between a sequence of values selectable as said aimed values and a
sequence of indexes corresponding thereto, for converting said
aimed value PR.sub.m to the corresponding index k.sub.m and which
processes said aimed value with a predetermined one-way function by
the number of times corresponding to said aimed value to obtain
aimed value information; and sending means for sending to said
server device said aimed value information and an identifier
identifying said participant device; and said server device
comprising: a conversion table memory which has stored therein a
conversion table which is the same as said conversion table; a
bulletin board on which said server device writes said aimed value
information an identifier received from said each participant
device; updated initial value acquiring means which acquires an
updated initial value obtained by processing said initial value
with a one-way function repeatedly in correspondence with values of
an index k which is a predetermined consecutive positive integers;
a counter which updates said index k one by one; and control means
which, upon each updating of said index k, compares said updated
initial value with said aimed value information on said bulletin
board to check whether they match, and determines m and k at the
time of first detection of a match.
58. The system of claim 57, wherein said each participant device
has initial value updating means for processing said initial value
with a one0way function h to generate an updated initial value and
for sending said updated initial value to said server device, and
said updated initial value acquiring means of said server device
receives said updated initial value from said each participant
device.
59. The system of claim 57, wherein said updated initial value
acquiring means of said server device processes said initial value
with a one-way function h to generate said updated initial
value.
60. The system of claim 58, wherein said aimed value transformer of
said each participant device comprises: a one-way function h
processor which processes an initial value IV.sub.m inherent to
said participant device with a one-way function h by the number of
times corresponding to said index k.sub.m to obtain an output
h.sup.km(IV.sub.m); and a one-way function g processor which
processes said output from said one-way function h processor with a
one-way function g to obtain said aimed value information.
61. The system of claim 60, wherein said aimed value transformer of
said each participant device includes verification information
generating means for processing said initial value IV.sub.m with
said one-way function h by K+1 times to generate
C.sub.m=h.sup.K+1(IV.sub.m) as verification information and for
sending said verification information to said server device;
wherein there is published on said bulletin board
C.sub.m=h.sup.K+1(IV.sub.m) received from said each participant
device in advance, said server device further comprising a one-way
function h processor which processes said response D.sub.m with a
one-way function h to generate h(D.sub.m), and wherein said control
means checks whether C.sub.m=h(D.sub.m) holds, and if not, rewrites
said C.sub.m with said D.sub.m and updates said index k on said
counter.
62. The system of claim 57, wherein said each participant device
comprises: a random generator for generating a random number
R.sub.m; an operating device for operating said random number
R.sub.m and said aimed value PR.sub.m to obtain PR.sub.m(+)R.sub.m,
where (+) represents a predetermined arbitrary operation; one-way
function h processing means for processing said PR.sub.m(+)R.sub.m
with a one-way function h to obtain h(PR.sub.m(+)R.sub.m); and
verification information generating means for processing said
initial value IV.sub.m with said one-way function h K+1 times to
generate C.sub.m=h.sup.K+1(IV.sub.m); and wherein: said
h(PR.sub.m(+)R.sub.m) and said verification information are sent to
said server device together with said aimed value information; in
said server device: there are published on said bulletin board
C.sub.m=h.sup.K+1(IV.sub.m), said aimed value information
.gamma..sub.m=h.sup.k(IV.sub.m) and h(PR.sub.m(+)R.sub.m) received
from said each participant device, said PR.sub.m and said R.sub.m
being an aimed value and a random number of said each participant
device m; said control means decides the maximum or minimum aimed
value from said aimed values PR.sub.m and said random numbers
R.sub.m received from said participant devices, and determines the
index k.sub.mx corresponding to said maximum or minimum aimed value
and requests said each participant device to send
(D.sub.m)=h.sup.kmx(IV.sub.m) corresponding to said index k.sub.mx;
said updated initial value acquiring means comprises a one-way
function h processor for processing D.sub.m with a one-way function
h to generate h.sup.K+1-kmx(D.sub.m), and a one-way function g
processor for processing D.sub.j with a one-way function g to
generate g(D.sub.j); and said control means makes a check to see if
said h.sup.K+1-kmx(D.sub.m) matches C.sub.m on said bulletin board
and if said g(D.sub.j) matches said .gamma..sub.m on said bulleting
board.
63. The system of claim 57, wherein said aimed value transformer of
said each participant device comprises: a conversion table memory
which has stored therein a conversion table which defines indexes
k=1, 2, . . . , K corresponding to K kinds of values selectable as
aimed values; a select information generator which generates select
information b.sub.m.sup.(k) indicating whether to select an aimed
value corresponding to each of said indexes k=1, 2, . . . , K; a
random generator which generates a random number R.sub.m.sup.(k)
inherent to said participant device m and said index k; an
operating device which receives said index k, said random number
R.sub.m.sup.(k) and said select information b.sub.m.sup.(k) and
performs an operation k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k); a
one-way function h processor which processes said
k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k) with a one-way function h to
obtain h(k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k)); and a control
device which computes said h(k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k))
for each of said indexes k and provides the k pieces information as
said aimed value information; in said server device: there are
published on said bulletin board
h(k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k)) together with said aimed
value information .gamma..sub.m received from said each participant
device; said server device further comprises an operator for
operating k(+)b(+)R.sub.m.sup.(k), and a one-way function h
processor for processing the result of said operation with a
one-way function h to generate h(k(+)b(+)R.sub.m.sup.(k)), where b
is a predetermined value which indicates that said select
information b.sub.m.sup.(k) has selected the aimed value
corresponding to said index k; and said control means makes a check
for matching between said h(k(+)b(+)R.sub.m.sup.(k)) and said
h(k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k)) on said bulletin
board.
64. The system of claim 57, wherein said aimed value transformer of
said each participant device comprises: a conversion table memory
which has stored therein a conversion table which defines indexes
k=1, 2, . . . , K corresponding to K kinds of values selectable as
aimed values, for converting said aimed value PR.sub.m to the
corresponding index k.sub.m; initial value updating means which,
for each index k, processes an initial value with a one-way
function h and adds the processed initial value with select
information b.sub.m.sup.(k) for said index k to obtain an updated
initial value and repeats this processing until k=K is reached,
thereby generating H.sub.m.sup.(K); a one-way function h processor
for outputting said updated initial value H.sub.m.sup.(k) from said
initial value updating means as said aimed value information;
select information generator which generates said select
information b.sub.m.sup.(k) whether said aimed value corresponds to
each index k from at least k.sub.m to K; a concatenator which
concatenates said H.sub.m.sup.(k-1) from said one-way function h
processor and said select information b.sub.m.sup.(k) to generate
H.sub.m.sup.k=h(H.sub.m.sup.(k-1).parallel.b.sub.m.sup.(k)); a
buffer which temporarily holds the output from said concatenator
and outputs said output for the next value of said index k; a
storage part which, for each value of said index k, stores
H.sub.m.sup.(k) corresponding thereto; and a second one-way
function h processor by which H.sub.m.sup.(k), obtained by
repeating processing until k=K, is processed with a one-way
function h to generate h(H.sub.m.sup.(k), said h(H.sub.m.sup.(k)
being output as said aimed value information; wherein said sending
means is a means which responds to a request of said server device
for said index k to read out H.sub.m.sup.(k) from said storage part
and send said H.sub.m.sup.(k) to said server device; in said server
device: there are published on said bulletin board, as said aimed
value information, h(H.sub.m.sup.(k)) obtained by processing, with
a one-way function h, H.sub.m.sup.(k) generated by said each
participant device which, upon each processing of said initial
value with a one-way function h, added the processed value with
select information b.sub.m.sup.(k) indicating whether said value
was an aimed value for each value of said index k and repeated this
processing from at least the index k.sub.m corresponding to said
aimed value to the upper limit value K of said index k; said
initial value updating means includes a one-way function h
processor by which {H.sub.m.sup.(k-1), b.sub.m} received from said
each participant device in answer to an inquiry for said index k is
processed with a one-y function h to generate
H.sub.m.sup.(k)=h(H.sub.m.sup.(k-1).parallel.b.sub.m.sup.(k)); and
said server device includes an updated initial value comparator for
making a check to see if said H.sub.m.sup.(k) matches
H.sub.m.sup.(k) in {H.sub.m.sup.(k), b.sub.m.sup.(k+1)} previously
received.
65. The system of claim 57, wherein said aimed value transformer of
said each participant device comprises: a conversion table memory
which has stored therein a conversion table which defines indexes
k=1, 2, . . . , K corresponding to K kinds of values selectable as
aimed values, for converting said aimed value PR.sub.m to the
corresponding index k.sub.m; a one-way function g processor which
processes said initial value IV.sub.m with a one-way function g by
a predetermined number of times x.sub.m to generate
g.sup.xm(IV.sub.m); a one-way function h processor which processes
said g.sup.xm(IV.sub.m) with a one-way function h K-k.sub.m times
to generate H.sub.m.sup.(K)=h.sup.K-km(g.sup.xm(IV.sub.m)) as said
aimed value information; and response generating means which
responds to a request from said server device for k to decide
whether k=k.sub.m, and if true, generates
H.sub.m.sup.(k-1)=h.sup.k-km-1(g.sup.xm(IV.sub.m)) and if false,
generates H.sub.m.sup.(k-1)=g.sup.xm-1(IV.sub.m); and wherein said
sending means sends said H.sub.m.sup.(k-1) in response to said
request from said server device for said k; and in said server
device: there is published on said bulletin board
H.sub.m.sup.(K)=h.sup.K-km(g.sup.xm(IV.sub.m)) as said aimed value
information received from said each participant device, which
further comprises a one-way function h processor by which
H.sub.m.sup.(k-1) received from said each participant device as an
answer to an inquiry for said k is processed with a one-way
function h to generate h(H.sub.m.sup.(k-1)), and a one-way function
g processor for processing said answer H.sub.m.sup.(k-1) with a
one-way function g to generate g(H.sub.m.sup.(k-1)); and said
control means: makes a check to see if said h(H.sub.m.sup.(k-1))
matches said aimed value information H.sub.m.sup.(K) published on
said bulletin board; if a match is detected, updates said aimed
value information H.sub.m.sup.(K) with said H.sub.m.sup.(k-1) and
decrements said index k on said counter by one; and if a mismatch
is detected, makes a check to see if said g(H.sub.m.sup.(k-1))
matches said aimed value information H.sub.m.sup.(K); and if a
match is detected, determines, based on k and m at that time, the
maximum or minimum aimed value PR.sub.m and the participant device
m having offered said value PR.sub.m.
66. The system of claim 57, wherein said aimed value transformer of
said each participant device comprises; a conversion table memory
which has stored therein a conversion table which defines the
relationships between a sequence of values selectable as said aimed
values and a sequence of indexes k of integral values respectively
corresponding thereto, for converting said aimed value PR.sub.m to
the corresponding index k.sub.m; a fraction calculating part which,
letting an arbitrary aimed value PR be represented by PR=F(k)+Q,
where F(k) is a value in said conversion table corresponding to
said k and Q is a fraction which is a positive integer which
satisfies F(k+1)-F(k)>Q.gtoreq.0, calculates said fraction
Q.sub.m=PR.sub.m-F(k.sub.m) based on F(k.sub.m) obtained from said
conversion table and said aimed value PR.sub.m; and a one-way
function h processor which processes said initial value IV.sub.m
with said one-way function h by the number of times corresponding
to said k.sub.m to generate said aimed value information; and
wherein said sending means sends said fraction Q.sub.m to said
server device together with said aimed value information; and in
said server device: there is published on said bulletin board said
fraction Q.sub.m received from said each participant device
together with said aimed value information; and said server device
comprises: a sequencer for deciding the sequence of said fractions
Q.sub.m on said bulletin board; and select information comparator
for checking whether said select information b.sub.m.sup.(k) is
equal to a value b indicating the selection of the aimed value
corresponding to said index k in said decided sequence of fractions
Q.sub.m.
67. The system of claim 57, wherein said sequence of index values k
and said sequence of values selectable as said aimed values on said
conversion table are monotone increasing values in the same
direction, and said server device determines the maximum aimed
value.
68. The system of claim 57, wherein said sequence of index values k
and said sequence of values selectable as said aimed values on said
conversion table are monotone increasing values in opposite
directions, and said server device determines the minimum aimed
value.
Description
CROSS REFERENCE TO RELATED APPLICATIONS
[0001] This application is a Divisional of co-pending application
Ser. No. 12/488,980, filed on Jun. 22, 2009 (now allowed), which is
a Divisional of application Ser. No. 09/619,699, filed on Jul. 19,
2000 (now U.S. Pat. No. 7,567,933), and for which priority is
claimed under 35 U.S.C. .sctn.120; and this application claims
priority of Application No. 205004/99 filed in Japan on Jul. 19,
1999 under 35 U.S.C. .sctn.119; Application No. 247060 filed in
Japan on Sep. 1, 1999 under 35 U.S.C. .sctn.119 Application No.
2000-16020 filed in Japan on Jan. 25, 2000 under 35 U.S.C.
.sctn.119; and Application No. 2000-47323 filed in Japan on Feb.
24, 2000 under 35 U.S.C. .sctn.119; the entire contents of all are
hereby incorporated by reference
BACKGROUND OF THE INVENTION
[0002] The present invention relates to a quantitative competition
system and method which compare aimed or intended values of
participants and publish the highest or lowest value but hide the
other values, and a recording medium on which there is recorded a
program for implementing the method. More particularly, the
invention pertains to a system and method for quantitative
comparison of secret values, for example, in electronic lottery,
electronic voting, or electronic sealed-bid auction under
circumstances where many participants are allowed to access the
server online across the Internet.
[0003] FIG. 1 is depicts in block form the configuration of a
conventional electronic competitive bidding or sealed-bid auction
system. A notice of auction is input to bidding devices 10.sub.1 to
10.sub.M, which send their identifiers ID.sub.1 to ID.sub.M and
bidding prices PR.sub.1 to PR.sub.M to a bid-opening device 20. In
this transfer of each data, if it is desirable to keep the data
secret, the bidding price is sent in compressed form, and if it is
necessary to identify the data, it is sent together with a digital
signature of the bidder. The bid-opening device 20 detects the
highest (or lowest) one of the bid values received from the bidding
devices 10.sub.1 to 10.sub.m, and outputs the winning bid and the
identifier corresponding thereto. This scheme is disclosed, for
example, in Japanese Patent Application Laid-Open Gazette No.
118876/90 entitled "Electronic Bidding System." On the other hand,
schemes which publish only the winning bid but hide other
information involved are disclosed, for example, in Kazuo SAKO,
"Auction Protocol Which Hides Bids of Losers," The Symposium on
Cryptography and Information Security, SCIS'99, and in Shingo
MIYAZAKI and Kouichi SAKURAI, "A Bulletin-Board Base Digital
Auction Scheme with Bidding Down Strategy," The Symposium on
Cryptography and Information Security SCIS'99.
[0004] The sealed-bid auction scheme to which the present invention
is applied satisfies the requirements mentioned below.
[0005] *Only bidding prices are used to determine the winning bid;
that is, the successful bidding device is not determined using
other information.
[0006] The bid-opening device and a provisional identifier
registration device neither cheat nor malfunction.
SUMMARY OF THE INVENTION
[0007] It is therefore an object of the present invention to
provide a quantitative competition system and method which ensure
the fairness of a sealed-bid auction, the validity of a successful
bid value, the undeniability of bidders, the anonymity of the
bidders and the freedom from double bidding.
[0008] The fairness of an auction means that it is possible to
prevent bidders from obtaining information on other bidding devices
prior to bidding in an attempt to make bids with unfair
advantage.
[0009] The validity of a successful bid value means that it is
possible to prevent an unfair determination of the winning bid.
[0010] The undeniability of bidders means that it is possible to
prevent them from denying their bid values at the bid-opening
time.
[0011] The anonymity of bidders means that it is possible to
prevent leakage of identification information of every bidding
device.
[0012] According to the present invention, each bidding device
transforms its bidding price to bidding price information through
utilization of a one-way function, and the bid-opening device uses
the bidding price information to determine the successful bid
without revealing the prices bid by unsuccessful bidders.
BRIEF DESCRIPTION OF THE DRAWINGS
[0013] FIG. 1 is a block diagram showing the general configuration
of an electronic competitive bidding system;
[0014] FIG. 2 is a flowchart showing the general procedure of an
electronic sealed-bid auction;
[0015] FIG. 3 is a block diagram depicting a bidding device which
uses one-way functions to generate a bid index;
[0016] FIG. 4 is a block diagram depicting a concrete example of a
bidding price transformer using one-way function processors;
[0017] FIG. 5 is a flowchart showing the procedure for generating
the bid index through the use of one-way functions;
[0018] FIG. 6 is a block diagram illustrating the functional
configuration of a bid-opening device 20 in a first embodiment of
the present invention which is designed to determine the highest
price bid as the winning bid;
[0019] FIG. 7 is a flowchart showing the operation of the
bid-opening device 20 depicted in FIG. 6;
[0020] FIG. 8 is a block diagram illustrating the functional
configuration of a bid-opening device in a second embodiment of the
present invention;
[0021] FIG. 9 is a flowchart showing the operation of the
bid-opening device depicted in FIG. 8;
[0022] FIG. 10 is a block diagram illustrating the functional
configuration of a bid-opening device in a third embodiment of the
present invention which is designed to determine the highest price
bid as the winning bid;
[0023] FIG. 11 is a flowchart showing the bid-opening procedure of
the bid-opening device depicted in FIG. 10;
[0024] FIG. 12 is a block diagram illustrating the functional
configuration of a bidding device in a fourth embodiment of the
present invention;
[0025] FIG. 13 is a block diagram illustrating the functional
configuration of a bid-opening device in the fourth embodiment;
[0026] FIG. 14 is a flowchart showing the bid-opening procedure of
the bid-opening device depicted in FIG. 13;
[0027] FIG. 15 is a block diagram illustrating the functional
configuration of a bidding device in a fifth embodiment of the
present invention;
[0028] FIG. 16 is a flowchart showing the bidding procedure of the
bidding device depicted in FIG. 15;
[0029] FIG. 17 is a block diagram illustrating the functional
configuration of a bid-opening device in a fifth embodiment of the
present invention;
[0030] FIG. 18 is a flowchart showing the bid-opening procedure of
the bid-opening device depicted in FIG. 17;
[0031] FIG. 19 is a flowchart showing the bid-opening procedure in
a modified form of the fifth embodiment;
[0032] FIG. 20 is a block diagram illustrating the functional
configuration of a bidding device in a sixth embodiment of the
present invention;
[0033] FIG. 21 is a flowchart showing the bidding procedure of the
bidding device depicted in FIG. 20;
[0034] FIG. 22 is a block diagram illustrating the functional
configuration of a bid-opening device in the sixth embodiment;
[0035] FIG. 23 is a flowchart showing the bid-opening procedure of
the bid-opening device depicted in FIG. 22;
[0036] FIG. 24 is a flowchart showing a modified form of the
bid-opening procedure depicted in FIG. 23;
[0037] FIG. 25 is a block diagram illustrating the functional
configuration of a bidding device in a seventh embodiment of the
present invention;
[0038] FIG. 26 is a flowchart showing the bidding procedure of the
bidding device depicted in FIG. 25;
[0039] FIG. 27 is a block diagram illustrating the functional
configuration of a bid-opening device in the seventh
embodiment;
[0040] FIG. 28 is a flowchart showing the bid-opening procedure of
the bid-opening device depicted in FIG. 27;
[0041] FIG. 29 is a flowchart showing a modified form of the
bid-opening procedure depicted in FIG. 28;
[0042] FIG. 30 is a block diagram illustrating the functional
configuration of a bidding device in an eighth embodiment of the
present invention;
[0043] FIG. 31 is a block diagram illustrating the functional
configuration of a bid0opening device in the eighth embodiment;
[0044] FIG. 32 is a flowchart showing the bid-opening procedure of
the bid-opening device depicted in FIG. 31;
[0045] FIG. 33 is a block diagram illustrating an electronic
sealed-bit auction system which utilizes a provisional identifier;
and
[0046] FIG. 34 is a flowchart showing the bidding procedure in the
system depicted in FIG. 33.
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
First Embodiment
[0047] The electronic competitive sealed-bid auction system
according to this embodiment comprises, as is the case with FIG. 1,
M bidding devices 10.sub.1 to 10.sub.M and a bid-opening device 21,
which are accessible to each other. This system operates as
depicted in the flowchart of FIG. 2.
[0048] Step S1: Input a notice of auction to each of the bidding
devices 10.sub.1 to 10.sub.M. The notice of auction describes
bidding conditions such as the name of an object for auction, the
highest and/or lowest price bid, the term for bidding and
qualifications for bidding, and a method of access to the
bid-opening device. The bidding conditions differ with objects for
auction.
[0049] Step S2: In response to the notice of auction which
describes the details of the auction, each bidding device 10.sub.m
(where m=1, 2, . . . , M) generates a bidding price, and sends to
the bid-opening device 20 the bidding price PR.sub.m and an
identifier ID.sub.m by which the bidding device 10.sub.m can be
identified.
[0050] Step S3: Having received from the respective bidding device
10.sub.1 to 10.sub.M their bidding prices PR.sub.1 to PR.sub.M and
identifiers ID.sub.1 to ID.sub.M, the bid-opening device 20
computes the highest (or lowest) one of the bidding prices and
determines it to be the winning bid.
[0051] Step S4: The bid-opening device 20 outputs the winning bid
and the identifier of the bidding device having submitted it.
[0052] The above procedure is the same as in the prior art. Since
the communication channel between each bidding device 10.sub.m and
the bid-opening device 20 is not an anonymous channel, in
particular, such a procedure as shown in FIG. 2 allows each bidding
device 10.sub.m to learn the bidding prices of the other bidding
devices by wiretapping. To avoid this, according to the present
invention, each bidding device 10m uses one-way functions to
transform the bidding price to bidding price information, which is
sent to the bid-opening device 20.
[0053] Referring to FIG. 3, the bidding device 10m comprises an
input part 11, an information storage part 12, a control part 13
and a bidding price transformer 14. The control part 13 follows a
control procedure stored in the information storage part 12 to
control operations of the respective parts. The notice of auction,
which describes the bidding conditions, is provided in advance via
a channel to the bidding device 10.sub.m from the bid-opening
device 20 or some other device. In the information storage part 12
there are also stored the identifier ID.sub.m of this bidding
device 10m and an initial value IV.sub.m which is used for bidding.
At the time of bidding, the bidding price PR.sub.m provided to the
input part 11 is fed via the control part 13 into the bidding price
transformer 14. The bidding price transformer 14 uses one-way
functions to transform the bidding price PR.sub.m to bidding price
information .gamma..sub.m in integral form. The bidding price
information .gamma..sub.m and the identifier ID.sub.m are sent from
a transceiver (not shown) to the bid-opening device 20 via a
communication channel. Based on the bidding price information from
every bidding device 10.sub.m, the bid-opening device 20 decides
the winning bid.
[0054] In this embodiment, the bidding price transformer 14 is
supplied with the initial value IV.sub.m read out of the
information storage part 12 by the control part 13 and the bidding
price PR.sub.m, and processes the initial value IV.sub.m by a
one-way function by the number of times corresponding to the
bidding price PR.sub.m as described below. A one-way function is
such a function that, given a variable x, y(=h(x)) can easily be
computed from x, but when given y, very high computational
complexity is needed to compute x such that y=h(x). An output
value, obtained by processing the initial value IV.sub.m with the
one-way function h by k times like h( . . . h(h(h(IV.sub.m))) . . .
), will hereinafter be represented by h.sup.k(IV.sub.m).
[0055] A concrete example of the bidding price transformer 14 is
depicted in FIG. 4 and its procedure in FIG. 5. The bidding price
transformer 14 comprises a data storage part 14S, conversion table
memory 15, a one-way function h processor 16 and a one-way function
g processor 17. Incidentally, the examples of the bidding device
10.sub.m depicted in FIGS. 3 and 4 will also be referred to in
describing second and third embodiments of the invention later on,
in which case the broken-lined data storage part 14S is provided to
store the result D.sub.m of each computation by the one-way
function h and the final result C.sub.m of computation. A
conversion table, which is stored in the conversion table memory
15, is contained as one bidding condition in the notice of auction,
for instance. Each bidding device 10m reads out the conversion
table from a bulletin board 25 of the bid-opening device 20 which
will be described later on with reference to FIG. 6. The conversion
table is a table on which there are shown appropriately-separated K
bidding prices from the lowest to the highest bidding price and a
series of corresponding indexes k=1, 2, . . . , K. Each bidding
device 10.sub.m selects a desired bidding price from the conversion
table and uses the corresponding index k as a bidding price index
k.sub.m. In the FIG. 4 example the bidding prices corresponding to
the indexes k=1, 2, . . . , K are arranged to monotonously
increase, but by arranging them to monotonously decrease, the
lowest bidding price can be made a winning bid.
[0056] The one-function h processor is supplied with the initial
value IV.sub.m and the price index k.sub.m corresponding to the
bidding price PR.sub.m read out of the conversion table memory 15,
and repeatedly processes the initial value IV.sub.m with the
one-way function h by the number of times corresponding to the
price index k.sub.m. As a result, h.sup.km(IV.sub.m) is obtained.
The one-way function g processor 17 further processes the output
value h.sup.km(IV.sub.m) with a one-way function g to compute
.gamma..sub.m=g(h.sup.km(IV.sub.m)), and output it as bidding price
information.
[0057] Step S1: Input the bidding price PR.sub.m and the initial
value IV.sub.m.
[0058] Step S2: Read out of the conversion table memory 15 the
price index k.sub.m corresponding to the bidding price
PR.sub.m.
[0059] Step S3: In the one-way function h processor 16, set the
initial value of a variable t at 0 and the initial value IV.sub.m
as .gamma..sub.m, and repeat steps S4 and S5.
[0060] Step S4: Determine if t is smaller than k.sub.m.
[0061] Step S5: If t<k.sub.m, update .gamma..sub.m with the
value of h(.gamma..sub.m) at that time, then increment t by one,
and return to step S4.
[0062] Step S6: When t becomes no longer smaller than k.sub.m,
.gamma..sub.m=h.sup.km(IV.sub.m), which is processed by the one-way
function g processor 17 such that
.gamma..sub.m.rarw.g(.gamma..sub.m).
[0063] Step S7: Output, as the bidding price information,
.gamma..sub.m obtained in step S6.
[0064] BID-Opening Device (Successful Bid: Highest Bidding Price
Bid)
[0065] FIG. 6 is a block diagram of the bid-opening device 20,
which comprises a control unit 21, and a one-way function h
processor 22, a one-way function g processor 23, an
adder/subtractor 24, a bulletin board 25, a program storage part
27S, an information storage part 35 and an update data storage part
36 which are all connected to the control unit 21. In the program
storage part 27S there is stored a bid-opening procedure as a
program, and the control unit 21 follows the program to control
operations of the respective parts. The one-way function h
processor 22 and the one-way function g processor 23 are
series-connected. The parts except the bulletin board 25 constitute
a winning bid selector 27. The number of bidding devices are M, and
the initial value IV.sub.m unique to each bidding device 10.sub.m
(where m=1, 2, . . . , M) is prestored by some means in the
information storage part 35. In the bulletin board 25 there are
also recorded other bidding conditions including a conversion table
25A; furthermore, verification information and the results of
auction to be published are written in the bulletin board 25. The
pieces of information are accessible from any external devices as
well as from the bidding devices. In this case, however, assume
that only the bid-opening device 20 is allowed to write in the
bulletin board 25 (This applies to other embodiments).
[0066] In FIG. 7 there is depicted the procedure of operation of
the bid-opening device 20. In this example the bidding price
corresponding to the largest price index k.sub.m is made a
successful bid as follows. The index value is decremented one by
one from the largest index K corresponding to the upper limit of
the bidding price specified in the conversion table; a check is
made for the presence of the bidding price information
.gamma..sub.m (where m=1, 2, . . . , M) corresponding to each index
k is present; and when the bidding price information .gamma..sub.m
corresponding to the index k is detected for the first time, the
detected bidding price information .gamma..sub.m is determined to
be the winning bid, and m (the bidding device number) at that time
is computed, with which the bid-opening procedure ends.
[0067] Step S0: The bidding device 10.sub.m inputs its bidding
price information .gamma..sub.m and identifier ID.sub.m (where m=1,
2, . . . , M) to the bid-opening device 20.
[0068] Step S1: The control unit 21 records the bidding price
information .gamma..sub.m and the identifier ID.sub.m in the
bulletin board 25 accessible from arbitrary external devices (the
bidding devices 10.sub.1 to 10.sub.M and other devices which are
not bidders).
[0069] Step S2: To precalculate D.sub.m.sup.(1), D.sub.m.sup.(2), .
. . , D.sub.m.sup.(K) such that
D.sub.m.sup.(k)=h(D.sub.m.sup.(k-1)) in the subsequent steps S3 to
S6, the control unit 21 sets the bidding price index k.rarw.1, then
reads out ID.sub.m from the information storage part 35, and
substitutes it for D.sub.m.sup.(0).
[0070] Step S3: The control unit 21 determines whether k>K.
[0071] Step S4: If not k>K, process D.sub.m.sup.(k-1) by the
one-way function h processor 22 to obtain D.sub.m.sup.(k).
[0072] Step S5: Store D.sub.m.sup.(k) in the update data storage
part 36.
[0073] Step S6: Increment k by the adder/subtractor 24 such that
k.rarw.k+1.
[0074] Step S7: If k>K in step S3, it means that
D.sub.m.sup.(1)=h(D.sub.m.sup.(0))=h(IV.sub.m),
D.sub.m.sup.(2)=h(D.sub.m.sup.(1))=h.sup.2(IV.sub.m) . . . ,
D.sub.m.sup.(K)=h.sup.K(IV.sub.m) have all been obtained, then set
k.rarw.K.
[0075] Step S8: Read out D.sub.m.sup.(K)=h.sup.K(IV.sub.m) from the
update data storage part 36 and process it by the one-way function
g processor 23 to obtain
D.sub.m.sup.(k).rarw.g(D.sub.m.sup.(k)).
[0076] Step S9: For m=1, 2, . . . , M, the control unit 21 makes a
check to see if there exists on the bulletin board 25 the bidding
price information .gamma..sub.m of the same value as
D.sub.m.sup.(k).
[0077] Step S10: If there does not exist on the bulletin board 25
the information .gamma..sub.m of the same value as D.sub.m.sup.(k),
the control unit 21 inputs k to the adder/subtractor 24 to
decrement k by one (i.e., k.rarw.k-1), then returns to step S8, and
in steps S8 and S9 it makes a check to see if there exists on the
bulletin board 25 the bidding price information .gamma..sub.m of
the same value as D.sub.m.sup.(k)=g(h.sup.k(IV.sub.m)) for m=1, 2,
. . . , M.
[0078] Step S11: If the information .gamma..sub.m of the same value
as D.sub.m.sup.(k) is found on the bulletin board 25 in step S9,
then the control unit 21 regards it as the successful price bid and
outputs the index k at this time and the bidding device identifier
ID.sub.m corresponding to the information .gamma..sub.m, with which
the procedure ends.
[0079] As described above, a check is made first for a bidding
device 10.sub.m having input the bidding price information
.gamma..sub.m equal to D.sub.m.sup.(k)(=g(h.sup.k(IV.sub.m))) when
the price index k is at the upper limit value K; if no such a
bidding device is found, then a check is made for a bidding device
10.sub.m having input the bidding price information .gamma..sub.m
equal to D.sub.m.sup.(k) when the index k is decremented by one,
i.e. k.rarw.k-1; and if no such a bidding device is found, then a
check is made for a bidding device 10.sub.m having input the
bidding price information .gamma..sub.m equal to D.sub.m.sup.(k)
when the index is further decremented by one, i.e. k.rarw.k-1. By
making a check, for each decremented value of k, for the bidding
device 10.sub.m having input the bidding price information
.gamma..sub.m equal to D.sub.m.sup.(k)(=g(h.sup.k(IV.sub.m))), it
is possible to find out the price information .gamma..sub.m
corresponding to the largest index k, that is, the highest bidding
price PR.sub.m.
[0080] Furthermore, each bidding device 10m sends
h.sup.km+1(IV.sub.m) to the bid-opening device 20 in advance, and
the bid-opening device 20 publishes it on the bulletin board 25
and, after determining the successful bidding price, publishes on
the bulletin board 25 the highest bidding price index k and the
identifier ID.sub.m of the successful bidding device and the
verification information h.sup.k(IV.sub.m); in this instance, since
k ought to equal k.sub.m, it is possible for an arbitrary device,
except the bid-opening device 20, to verify the validity or
fairness of the bid-opening process by processing he published
verification information h.sup.k(IV.sub.m) with the one-way
function h to obtain h.sup.k+1(IV.sub.m) and making sure that it
matches h.sup.km+1(IV.sub.m) published prior to the determination
of the winning bid. Alternatively, the verification of the
bid-opening procedure can be made by publishing the verification
information h.sup.k(IV.sub.m) of each bidding device on the
bulletin board 25 in advance and making a check to see if the
value, obtained by processing h.sup.km(IV.sub.m) published on the
bulletin board 25 with the one-way function h by (K-k.sub.m) times,
matches h.sup.k(IV.sub.m).
[0081] In the case where the lowest price bid is the winning bid,
the bidding prices corresponding to the price indexes k on the
conversion table are arranged so that they monotonously increase
from the lowest value, as referred to previously.
[0082] In the embodiment described above, all the bidding device
10.sub.1 to 10.sub.M send h.sup.km+1(IV.sub.m) to the bid-opening
device 20 in advance for verification of the results of
bid-opening, and the bid-opening device 20 writes it on the
bulletin board. It is easy to compute h.sup.k+1(z) from h.sup.k(z)
in the computation h.sup.k+1(z)=h(h.sup.k(z)) using the one-way
function, but the computation of h.sup.k(z) from h.sup.k+1(z)
involves too enormous computational complexity to deal with
practically. Accordingly, even if the bidding device publishes in
advance h.sup.kv(IV.sub.m) computed using an index k.sub.v larger
than the bidding price index k.sub.m, there is no possibility of
other devices learning the index k.sub.m unless the bid-opening is
performed in terms of the index k.sub.m.
[0083] The value k.sub.v of the verification information
h.sup.kv(IV.sub.m) may be a value k.sub.v=k.sub.m+A which is
obtained by adding the bidding price index k.sub.m with a
predetermined integer A equal to or greater than 1, or a value
k.sub.v=K+A which is obtained by adding the maximum index K with
the integer A. In the former case, h.sup.km(IV.sub.m) is processed
A times with the one-way function h and the resulting value is
checked for matching the published information h.sup.kv(IV.sub.m).
In the latter case, h.sup.km(IV.sub.m) is processed K+A-k.sub.m
times with the one-way function h and the resulting value is
checked for matching the published information
h.sup.kv(IV.sub.m).
[0084] In the embodiment described above, the bidding devices
10.sub.1 to 10.sub.M each convert the bidding price PR to the index
k by the conversion table and the initial value IV.sub.m is
processed with the one-way function by the number of times
corresponding to the index k, but the use of the conversion table
is not essential to the present invention. For example, the index k
itself may be the bidding price, in which case neither of the
bidding devices the bid-opening device requires the conversion
table and any one of a series of value k which monotonously
increase one by one within a predetermined range defined by the
upper and lower limits given as one of the conditions for auction
is chosen as the bidding price PR.
Second Embodiment
[0085] In the first embodiment the bid-opening device 20 must be
informed of the initial value IV.sub.m of each bidding device
10.sub.m. In this embodiment, however, the bid-opening device 20
requires the bidding device 10.sub.m to send
D.sub.m=h.sup.k(IV.sub.m) corresponding to the price index k, and
hence it does not need the initial value IV.sub.m. Since the price
index k varies one by one such that k=1, 2, . . . , K, this
embodiment utilizes the fact that
h.sup.k+1(IV.sub.m)=h(h.sup.k(IV.sub.m)) holds; the bid-opening
device 20 verifies the response h.sup.k(IV.sub.m) from the bidding
device in reply to an inquiry k, then computes
g(h.sup.k(IV.sub.m)), and checks it for matching the bidding price
information .gamma..sub.m (where m=1, 2, . . . , M).
[0086] A description will be given of the case where the highest
bid is the successful bid.
[0087] The bidding device 10.sub.m has a configuration in which the
data storage part 14S indicated by the broken line in FIG. 4 is
added to the bidding price transformer 14. The bidding device
10.sub.m precomputes D.sub.m=h.sup.k(IV.sub.m) by the one-way
function h processor 16 for each value k=1, 2, . . . , K+1, and
stores it in the data storage part 14S. When inquired about k from
the bid-opening device 20, the bidding device 10.sub.m reads out of
the data storage part 14S the data h.sup.k(IV.sub.m) corresponding
to k and sends it as the response D.sub.m=h.sup.k(IV.sub.m) to the
bid-opening device 20. Furthermore, the bidding device 10.sub.m
sends to the bid-opening device 20 the data h.sup.K+1(IV.sub.m) as
the verification information C.sub.m, together with the bidding
price information .gamma..sub.m. As depicted in FIG. 8, the
bid-opening device 20 comprises a control unit 21, a one-way
function h processor 22, a one-way function g processor 23, a
subtractor 24, a program storage part 27S and a bulletin board 25
accessible from other devices. On the bulletin board 25 there are
published a conversion table 25A along with conditions for
auction.
[0088] The bid-opening device 20 operates as depicted in FIG.
9.
[0089] The bidding devices 10.sub.m each send h.sup.K+1(IV.sub.m)
as the verification information C.sub.m in advance to the
bid-opening device 20 together with the bidding price information
.gamma..sub.m and the identifier ID.sub.m. The bid-opening device
20 publishes these pieces of data on the bulletin board 25. Let it
be assumed here that M bids are submitted, and hence m=1, 2, . . .
, M.
[0090] Step S1: Write and hence publish on the bulletin board 25
the plural pieces of data sent to the bid-opening device 20, that
is, the bidding price information
.gamma..sub.m(=g(h.sup.km(IV.sub.m))), the verification information
C.sub.m and the identifier ID.sub.m.
[0091] Step S2: Set the initial value of the index k at the upper
limit value K by control unit 21.
[0092] Step S3: Request each bidding device 10.sub.m to present
D.sub.m=h.sup.k(IV.sub.m). The bidding device 10.sub.m reads out of
the data storage part 14S the data h.sup.k(IV.sub.m), and sends it
to the bid-opening device 20 as D.sub.m.
[0093] Step S4: Record and hence publish on the bulletin board 25
the data D.sub.m sent from every bidding device 10.sub.m.
[0094] Step S5: Generates h(D.sub.m) for each D.sub.m by the
one-way function h processor 22.
[0095] Step S6: Make a check to see if all the pieces of data
h(D.sub.m) match all the pieces of verification information C.sub.m
on the bulletin board 25; if no mismatch is found, then determine
that they are all correct or valid, and continue the subsequent
steps. If a mismatch is found, then sends an error message to every
bidding device 10.sub.m and finish the bid-opening operation.
[0096] Step S7: When no mismatch is found in step S6, generate data
g(D.sub.m) by the one-way function g processor 23.
[0097] Step S8: Make a check to see if each data g(D.sub.m) matches
the bidding price information .gamma..sub.m; if no match is found,
update C.sub.m on the bulletin board 25 with D.sub.m
(C.sub.m.rarw.D.sub.m).
[0098] Step S10: Set k.rarw.k-1 by the subtractor 24 and return to
step S3.
[0099] Step S11: If even one of the pieces of information
.gamma..sub.m is found to match with g(D.sub.m) in step S8, decide
k at that time as the price index corresponding to the winning bid,
and output the index k and the identifier ID.sub.m of the bidding
device 10.sub.m having offered the successful bid.
[0100] In this instance, the values of losing bids other than the
winning one are kept secret from even the bid-opening device
20.
[0101] In this embodiment, too, the lowest price bid can be chosen
as the winning bid simply by arranging the bidding prices in such a
manner as to monotonously decrease relative to a monotonously
increasing index k on the conversion table, or by arranging the
bidding prices in such a manner as to monotonously increase
relative to a monotonously decreasing index k.
Third Embodiment
[0102] In the second embodiment described above, as depicted in
FIG. 9, the bid-opening device 20 requires all the bidding devices
to present h.sup.k(IV.sub.m) and receive it for each value of the
price index k until the first detection of a match between
g(D.sub.m) and .gamma..sub.m in step S3. Accordingly, the
sealed-bit auction scheme according to the second embodiment has
the defect of a large communication cost. This embodiment requires
the bid-opening device 20 to be informed of nothing but the initial
value IV.sub.m, publishes only the winning bid, that is, hides the
losing bids, and reduces the communication cost.
[0103] The bidding device 10.sub.m is identical in construction as
in the second embodiment, and in the constructions of FIGS. 3 and 4
the data storage part 14S is provided in which there are prestored
D.sub.m.sup.(1), . . . , D.sub.m.sup.(K) and
C.sub.m=D.sub.m.sup.(k+1). The bid-opening device 20, shown in FIG.
10, is basically identical in construction with the bid-opening
device of FIG. 8, and no description will be repeated, but as will
be described below with reference to FIG. 11, the operation of the
bid-opening device in this embodiment differs from the operation
depicted in FIG. 9.
[0104] Step S0: The bidding devices 10.sub.1 to 10.sub.m each send
in advance the verification information C.sub.m
(=h.sup.k+1(IV.sub.m)) to the bid-opening device 20 together with
the bidding price information .gamma..sub.m (=g(h.sup.km(IV.sub.m))
and the identifiers ID.sub.m.
[0105] Step S1: The bid-opening device 20 first publishes the
plural pieces of bidding price information .gamma..sub.m and
verification information C.sub.m and the identifiers ID.sub.m on
the bulletin board 25.
[0106] Step S2: Set the count value k of a counter 24 at the upper
limit value K.
[0107] Step S3: Inquire of all the bidding devices 10.sub.m (where
m=1, 2, . . . , M) about whether they have bid the price k.
[0108] Step S4: Decide whether there is bidding device having bid
with the price index k.
[0109] Step S5: If no bidding device have bid the price, decrement
k by the subtractor 24 to k.rarw.k-1 and return to step S3.
[0110] Step S6: When it is found that any one of the bidding
devices 10.sub.m has bid with the price index k, request all the
bidding devices 10m to present h.sup.k(IV.sub.m). Each bidding
device 10.sub.m reads out of the data storage part 14S the data
D.sub.m=h.sup.k(IV.sub.m) precalculated corresponding to k as
depicted in FIG. 4, and sends the read-out data D.sub.m to the
bid-opening device 20.
[0111] Step S7: Publishes all the responses D.sub.m from the
bidding devices 10.sub.m on the bulletin board 25.
[0112] Step S8: For all the responses D.sub.m, generate
h.sup.K-k+1(D.sub.m) by the one-way function h processor 22.
[0113] Step S9: Check whether each data h.sup.K-k+1(D.sub.m)
matches the corresponding verification information C.sub.m on the
bulletin board 25. If no mismatch is found, decide that the
responses Dm are all correct, and proceed to the subsequent steps.
If a mismatch is found, send an error message to each bidding
device 10.sub.m and finish this bid-opening session for the price
index k.
[0114] Step S10: When no mismatch is found in step S9, generate
g(D.sub.j) by the one-way function g processor 23 for the response
D.sub.j (where 1.ltoreq.j.ltoreq.M) from the bidding device
10.sub.j which has identified itself as having bid with the price
k.
[0115] Step S11: Check whether g(D.sub.j) matches the bidding price
information .gamma..sub.j of the bidding device 10j on the bulletin
board 25. If they match, decide that the bidding device 10.sub.j
has bid the price k. If they do not match, send an error message to
all the bidding devices and discontinue the session.
[0116] As described above, in this embodiment, when no bidding
device identifies itself as having bid the price k in reply to the
inquiry in step S3, the bidding devices 10.sub.m are not required
to send D.sub.m(=h.sup.k(IV.sub.m)) to the bid-opening device 20,
and hence the communication cost is small as compared with that in
the second embodiment accordingly.
[0117] As described below, a check is made, if necessary, to see if
another bidding device 10m (different from the device 10j) has bid
a value higher than k.
[0118] Step S12: For t such that k.ltoreq.t.ltoreq.K and all m's
except j (1.ltoreq.m.ltoreq.M, m.noteq.j), it is checked whether
g(h.sup.t-k(h.sup.k(IV.sub.m))) matches the bidding price
information .gamma..sub.m on the bulletin board 25 for t=k, k+1, .
. . K, and if a match is found, then send an error message to each
bidding device concerned and discontinue the bid-opening
session.
[0119] Step S13: If no match is found, then output the winning
bidding price k and the identifier ID.sub.j of the bidding device
having offered the winning bid.
[0120] With this check or verification, if a bidding device makes a
false response to the inquiry about whether it has bid, for
example, with k, this dishonest bidding device is detected; that
is, this embodiment satisfies the "undeniability" requirement. When
this checking does not takes place, the bid-opening device 20
outputs k and ID.sub.j when deciding in step S11 that the bidding
device 10.sub.j has bid with k.
[0121] In this way, this embodiment keeps losing bids, except the
winning one, secret from even the bid-opening device 20 and reduces
the communication cost.
[0122] While in the above the highest price bid is the winning bid,
the lowest price bid can be chosen as the successful bid simply by
arranging monotonously decreasing (or increasing) values of the
bidding price PR on the conversion table in a one-to-one
correspondence with monotonously increasing (or decreasing) values
of the price index k.
Fourth Embodiment
[0123] This embodiment is intended to permit simplification of the
processing in the bid-opening device 20 and reduction of the
communication cost.
[0124] As depicted in FIG. 12, each bidding device 10.sub.m has a
construction in which a random generator 18 and an operation part
19 are added to the bidding device shown in FIGS. 3 and 4. The
random generator 18 generates a random number R.sub.m known only to
the bidding device 10.sub.m. The operation part 19 uses the random
number R.sub.m and the bidding price PR.sub.m to perform a
predetermined operation such as a bit concatenation, exclusive
ORing, addition, or multiplication (which operation will
hereinafter be denoted by (+)), then processes the operation result
with the one-way function h, and sends the processed output
h(PR.sub.m(+)R.sub.m) to the bid-opening device 20, together with
the bidding price information .gamma..sub.m=g(h.sup.km(IV.sub.m))
and the identifier ID.sub.m.
[0125] FIG. 13 illustrates in block form the functional
configuration of the bid-opening device 20 in this embodiment, and
FIG. 14 is a flowchart for explaining its operation. The
bid-opening device 20 has a construction in which one-way function
h processors 22' and 22'' and an operation part 26 are added to the
device of FIG. 10 and a subtractor 37 is replaced for the counter
24. For simplicity sake, the program storage part 27S is not shown.
At the time of bidding every bidding device 10.sub.m (where m=1, 2,
. . . , M) sends h.sup.K+1(IV.sub.m) to the bid-opening device 20,
along with the bidding price information
.gamma..sub.m(=g(h.sup.km(IV.sub.m))), the identifier ID.sub.m and
the random number information h(PR.sub.m(+)R.sub.m).
[0126] Step S1: Receive .gamma..sub.m,
C.sub.m(=h.sup.K+1(IV.sub.m)), h(PR.sub.m(+)R.sub.m) and ID.sub.m
from each bidding device 20 and write and hence publish them on the
bulletin board 25.
[0127] Step S2: Request all the bidding devices 10.sub.m to present
their bidding prices PR.sub.m and random numbers R.sub.m.
[0128] Step S3: Upon receiving PR.sub.m and R.sub.m from each
bidding device 10m, compute (PR.sub.m(+)R.sub.m) in the operation
part 26, then compute h(PR.sub.m(+)R.sub.m) by the one-way function
h processor 22'', and make a check to determine whether the value
matches h(PR.sub.m(+)R.sub.m) published on the bulletin board
25.
[0129] Step S4: At this point the bid-opening device 20 learns all
the bidding prices. The bid-opening device 20 obtains from the
conversion table 25A a price index k.sub.mx corresponding to the
highest value among the bidding prices PR.sub.m. The bidding device
(the successful bidding device) which has bid k.sub.mx will
hereinafter be identified by 10.sub.j. At this point each bidding
device cannot learn the bidding prices of the other bidding
devices.
[0130] Step S5: Send k.sub.mx to all the bidding devices 10.sub.m
and request them to present D.sub.m=h.sup.kmx(IV.sub.m).
[0131] Step S6: Each bidding device 10m reads out
D.sub.m=h.sup.kmx(IV.sub.m) corresponding to k.sub.mx from the data
storage part 14S described previously with respect to FIG. 4, and
sends the read-out Dm to the bid-opening device 20, which writes on
the bulletin board 25 all the pieces of data D.sub.m sent from the
bidding devices 10.sub.m.
[0132] Step S7: For each Dm, calculates K+1-k.sub.mx by a
subtractor 37 and generate h.sup.K+1-kmx(D.sub.m) by the one-way
function h processor 22 from K+1-k.sub.mx and D.sub.m.
[0133] Step S8: Verify whether h.sup.K+1-kmx(D.sub.m) matches the
corresponding verification information C.sub.m on the bulletin
board 25. If no mismatch is found, decides that all the responses
Dm are correct, and proceed to the subsequent steps. If a mismatch
is found, sends an error message to each bidding device and
discontinue further operation.
[0134] Step S9: If no mismatch is found in step S8, generate
g(D.sub.j) by the one-way function g processor 23 for D.sub.j
presented by the successful bidding device 10.sub.j.
[0135] Step S10: Verify whether g(D.sub.j) matches the bidding
price information .gamma..sub.j in the bidding data of the bidding
device 20.sub.j on the bulletin board 25. If they match, decide
that the bidding device 10.sub.j has bid with the price index
k.sub.mx. If they do not match, send an error message to each
bidding device and discontinue the current bid-opening session.
[0136] As described below, a check is made, if necessary, to see if
another bidding device 10m (different from the device 10j) has bid
a value higher than k.sub.mx.
[0137] Step S11: For t=k.sub.mx+1, k.sub.mx+2, . . . , K, compute
h.sup.t-kmx(D.sub.m) by the one-way function processor 22' and
process the computed result by the one-way function g processor 23
to obtain g(h.sup.t-kmx(D.sub.m)), and verify whether this
g(h.sup.t-kmx(D.sub.m)) matches the bidding price information
.gamma..sub.m on the bulletin board 25 for all m's except j
(1.ltoreq.m.ltoreq.M, m.noteq.j).
[0138] Step S12: If a match is found, then send an error message to
each bidding device concerned and discontinue the current
bid-opening session. If no match found, then output the winning
bidding price index k.sub.mx and the identifier ID.sub.j of the
bidding device 10.sub.j having offered the winning bid.
[0139] For example, in the case where the bidding device 10m bids
with the random number information h(PR.sub.m(+)R.sub.m) and the
bidding price information .gamma..sub.m=g(h.sup.km(IV.sub.m) (where
PR.sub.m'>PR.sub.m) and presents a price PR.sub.m' higher than
the bidding price PR.sub.m and the random number R.sub.m in reply
to the request for the presentation of PR.sub.m and R.sub.m in step
S2 and the price PR.sub.m' becomes the highest bid value, if the
bidding device presents D.sub.m=h.sup.kmx(IV.sub.m) in reply to the
request for the presentation of h.sup.kmx(IV.sub.m) in step S5, it
will pass the verifications in steps S7 and S8, incurring the
possibility that the price PR.sub.m lower than PR.sub.m' becomes
the winning bid. However, this can be prevented because a mismatch
is found between g(D.sub.m)=g(h.sup.kmx(IV.sub.m)) and
.gamma..sub.m=g(h.sup.km(IV.sub.m) in steps S10 and S11.
[0140] With the bid-opening device 20, it is possible to specify
the winning bid and the corresponding successful bidding device
from PR.sub.m, R.sub.m and ID.sub.m with ease, reduce the
communication cost and verify that the winning bidding price and
the winning device determined from PR.sub.m, R.sub.m and ID.sub.m
are true.
Fifth Embodiment
[0141] In this embodiment each bidding device sends to the
bid-opening device bidding price information containing select
information which indicates whether to bid for each of K kinds of
biddable prices. As depicted in FIG. 15, the bidding price
transformer 14 of the bidding device 10m comprises a control part
41, a random generator 42, a one-way function h processor 43, a
select information generator 45, a (+) operation part 46 and an
adder 47.
[0142] Let PR.sub.m represent that one of the K kinds of price
indexes 1, 2, . . . , K which the bidding device 10.sub.m is to
actually to bid. The select information denoted by b.sub.m.sup.(k)
is defined as follows: b.sub.m.sup.(k)=0 when the bidding device
10.sup.m does not bid for the price index k such that
1.ltoreq.k.ltoreq.K, and b.sub.m.sup.(k)=1 when the bidding device
10.sub.m bids for the price index k. Accordingly, only one piece of
information b.sub.m.sup.(k) exists for k such that
1.ltoreq.k.ltoreq.K. As mentioned above, the two values of the
information b.sub.m.sup.(k) may be any values as long as they
differ from each other. The information b.sub.m.sup.(k) is known
only to the bidding device 10.sub.m, which uses it as a random
number for each value of the price index k. The bidding device
10.sub.m outputs {ID.sub.m,
h(1(+)b.sub.m.sup.(1)(+)R.sub.m.sup.(1)),
h(2(+)b.sub.m.sup.(2)(+)R.sub.m.sup.(2)), . . . ,
h(K(+)b.sub.m.sup.(K)(+)R.sub.m.sup.(K)} as bidding price
information.
[0143] A description will be given, with reference to FIG. 16, of
the procedure by which K pieces of bidding price information are
prepared.
[0144] Step S1: The bidding price PR.sub.m is determined and
input.
[0145] Step S2: Set the initial value of the price index k to
1.
[0146] Step S3: Make a check to see if k.ltoreq.K.
[0147] Step S4: If k.ltoreq.K, generate the random number
R.sub.m.sup.(k) by the random generator 42.
[0148] Step S5: Generate the rice select information
b.sub.m.sup.(k) by the select information generator 45 in
accordance with the bidding price PR.sub.m.
[0149] Step S6: The (+) operation part 46 inputs thereinto these
pieces of information R.sub.m.sup.(k) and b.sub.m.sup.(k), and
compute k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k). (+) indicates a
predetermined appropriate operation, which may be a concatenation,
addition, subtraction, multiplication, or the like.
[0150] Step S7: Process the result of this operation by the one-way
function h processor 43 to generate
h(k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k)).
[0151] Step S8: Increment k by one by the adder 47, followed by a
return to step S3.
[0152] Step S9: When k exceeds K and the processing for all values
of k ends, the bidding device 10.sub.m sends the identifier
ID.sub.m and the bidding price information
{h(1(+)b.sub.m.sup.(1)(+)R.sub.m.sup.(1)), . . . ,
h(K(+)b.sub.m.sup.(K)(+)R.sub.m.sup.(K))} to the bid-opening device
20.
[0153] By generating the bidding price information for each price
through utilization of the one-way function and sending all the
pieces of bidding price information to the bid-opening device 20 as
described above, the aimed bidding price can be kept secret.
[0154] FIG. 17 illustrates in block form the bid-opening device 20
which performs the bid-opening process based on such bidding price
information sent thereto. The bid-opening device 20 comprises a
control part 21, a one-way function h processor 22, a subtractor
24, an information storage part 35, a bulletin board 25 and a (+)
operation part 51. As is the case with FIG. 8, the program storage
part 27S is also provided but is not shown for the sake of
brevity.
[0155] FIG. 18 is a flowchart for explaining the operation of this
bid-opening device 20.
[0156] Step S0: Receive the bidding price information {ID.sub.m,
h(1(+)b.sub.m.sup.(1)(+)R.sub.m.sup.(1)),
h(2(+)b.sub.m.sup.(2)(+)R.sub.m.sup.(2)), . . . ,
h(K(+)b.sub.m.sup.(K)(+)R.sub.m.sup.(K))} from the bidding device
10.sub.m (where m=1, 2, . . . , M).
[0157] Step S1: Write and hence publish the bidding price
information on the bulletin board 25.
[0158] Step S2: Set the price index k to its highest value K.
[0159] Step S3: Request each bidding device 10.sub.m to present the
random number R.sub.m.sup.(k).
[0160] Step S4: The bidding devices 10.sub.m each send the random
number R.sub.m.sup.(k) to the bid-opening device 20, which writes
all the random numbers R.sub.m.sup.(k) on the bulletin board
25.
[0161] Step S5: Set b.sub.m.sup.(k)=1, then input b.sub.m.sup.(k)
and R.sub.m.sup.(k) to the (+) operation part 51 to perform an
operation k(+)1(+)R.sub.m.sup.(k), and process the result of
operation by the one-way function h processor 22 to obtain
h(k(+)1(+)R.sub.m.sup.(k)).
[0162] Step S6: For each m, make a check to see if a match is found
between the calculated h(k(+)1(+)R.sub.m.sup.(k)) and
h(k(+)1(+)R.sub.m.sup.(k)) on the bulletin board 25.
[0163] Step S7: If no match is found, decrement k such that
k.rarw.k-1, and return to step S3.
[0164] Step S8: If a match is found, determine the k as the
successful price index k, then output the price index k and the
identifier ID.sub.m of the bidding device 10.sub.m concerned, and
discontinue the current bid-opening session.
[0165] As described above, according to this embodiment, the
bidding price information corresponding to each price index is
generated using the one-way function and all the pieces of bidding
price information are sequentially opened in decreasing order from
the highest value. This enables non-winning bids to be kept
secret.
[0166] In the case of choosing the lowest price bid as the
successful bid in this embodiment, the bidding device 10.sub.m
similarly sends the bidding price information {ID.sub.m,
h(1(+)b.sub.m.sup.(1)(+)R.sub.m.sup.(1)),
h(2(+)b.sub.m.sup.(2)(+)R.sub.m.sup.(2)), . . . ,
h(K(+)b.sub.m.sup.(K)(+)R.sub.m.sup.(K))} to the bid-opening device
20. The bid-opening device 20 carries out about the same processing
as depicted in FIG. 18, but in step S2 the lowest value 1 of the K
kinds of biddable price indexes is set to k and in step S6 the
index k is incremented by one such that k.rarw.k+1.
[0167] In the case of choosing the highest price bid as the winning
bid in this embodiment, since random numbers R.sub.m.sup.(t)
received from all the bidding devices for t (where
k.ltoreq.t.ltoreq.K) are recorded on the bulletin board 25 in step
S4, it is possible to detect that b.sub.m.sup.(k)=0 for the index
larger than the winning price index k, by calculating
h(t(+)b.sub.m.sup.(t)(+)R.sub.m.sup.(t)) and comparing it with
h(k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k)) published on the bulletin
board 25. Accordingly, any one can determine if the winning price
index k is correct.
[0168] In this embodiment it is also possible for each bidding
device 10.sub.m to send the set of random numbers
{R.sub.m.sup.(k)}(k=1, . . . , K) to the bid-opening device 20 in
advance together with ID.sub.m and
h(k(+)b.sub.m.sup.(k)(+)R.sub.m.sup.(k)). In this case, however,
the random number R.sub.m.sup.(k) is not written on the bulletin
board 25 but is stored in the broken-lined information storage part
35. In FIG. 19 there is shown a flowchart for explaining the
processing which the bid-opening device 20 performs in such an
instance.
[0169] Step S0: Receive the bidding price information {ID.sub.m,
h(1(+)b.sub.m.sup.(1)(+)R.sub.m.sup.(1)),
h(2(+)b.sub.m.sup.(2)(+)R.sub.m.sup.(2)), . . . ,
h(K(+)b.sub.m.sup.(K)(+)R.sub.m.sup.(K))} and random number
information {R.sub.m.sup.(1), R.sub.m.sup.(2), . . . ,
R.sub.m.sup.(R)} from the bidding devices 10.sub.m (where m=1, 2, .
. . , M).
[0170] Step S1: Write and hence publish only the bidding price
information on the bulletin board 25 and store the random number
information in the storage part 35 indicated by the broken
line.
[0171] Step S2: Set the highest possible value K for the price
index k.
[0172] Step S3: For all m's, generate h(k(+)1(+)R.sub.m.sup.(k))
read out of the storage part 35 with b.sub.b.sup.(k)=1.
[0173] Step S4: Verify whether a match is found between
h(k(+)1(+)R.sub.m.sup.(k)) and the pieces of bidding rice
information written on the bulletin board 25.
[0174] Step S5: If no match is found, decrement the price index k
by one to k.rarw.k-1
[0175] and return to step S3.
[0176] Step S6: For the index k for which the mach was found, write
and publish all the random numbers R.sub.m.sup.(t)
(k.ltoreq.t.ltoreq.K) on the bulletin board 25.
[0177] Step S7: Determine k at this time as the winning price
index, then output this index k and the identifier ID.sub.m of the
bidding device 10.sub.m having submitted the winning bid, and
discontinue the current bid-opening session.
[0178] When the lowest bidding price bid is chosen as the
successful bid in this case, the index k is set to the smallest
possible value, 1 in this example, in step S2 in FIG. 19, then in
step S4 the index k is incremented by one, and in step S5 all
random numbers R.sub.m.sup.(t) which are 1.ltoreq.t.ltoreq.K are
published on the bulletin board 25. The other operations are the
same as those described above with reference to FIG. 19.
[0179] While in the above the select information b.sub.m.sup.(k)
has been described to be "0" or "1," they may be any values as long
as they are two predetermined different integers.
Sixth Embodiment
[0180] In the second embodiment described previously, at the time
of bidding each bidding device 10.sub.m sends the bidding price
information .gamma..sub.m=g(h.sup.km(IV.sub.m)) and the
verification information C.sub.m=h.sup.k+1(IV.sub.m) to the
bid-opening device 20, and at the time of bid-opening the
bid-opening device 20 requests the bidding device 10.sub.m to send
the information D.sub.m=h.sup.k(IV.sub.m), and verifies whether
h(D.sub.m) and C.sub.m match for the information D.sub.m received
from the bidding device 10.sub.m; if they match, then the
bid-opening device 20 further verifies whether g(D.sub.m) matches
the bidding price information .gamma..sub.m. These verifications
need to be made for all of m=1, 2, . . . , M. Accordingly, the
amount of data to be processed increases with an increase in the
number M of bidding devices used. In addition, the larger the
highest value K of the index k, the more the amount of multiple
processing by the one-way function h; hence it is necessary to
process an enormous amount of data.
[0181] To avoid this, the sixth embodiment utilizes one-way
functions to transform the bidding price index k.sub.m to
gm=H.sub.m.sup.(K)=h.sup.K-km)g.sup.xm(IV.sub.m)), which is sent to
the bid-opening device 20. x.sub.m is an arbitrary integer equal to
or greater than 1 which is determined by the bidding device
10.sub.m. When inquired about whether it has bid with the index k,
the bidding device 10.sub.m presents
H.sub.m.sup.(k-1)=h.sup.k-km-1(g.sup.xm(IV.sub.m)) if k is not its
aimed bidding price index k.sub.m, and if it is the aimed value,
the bidding device 10.sub.m presents
H.sub.m.sup.(k-1)=g.sup.xm-1(IV.sub.m). The bid-opening device 20
verifies the former with h(H.sub.m.sup.(k-1))=H.sub.m.sup.(K) and
the latter with g(H.sub.m.sup.(k-1))=H.sub.m.sup.(K).
[0182] The M bidding devices 10.sub.m indirectly bit the bidding
price index values k.sub.m to the bid-opening device 20, which
detects the largest one of the index values k.sub.m bit by the
bidding devices 10.sub.m. Each bidding device 10.sub.m and the
bid-opening device 20 have a conversion table in which K bidding
prices PR.sub.1, PR.sub.2, . . . , PR.sub.K are held in a
one-to-one correspondence with K kinds of index values 1, 2, . . .
, K in increasing order. In this embodiment, as the index value k
(where k=1, 2, . . . , K) increases, the value PR.sub.k becomes
larger; for example, PR.sub.1=10, PR.sub.2=15, PR.sub.3=30, . . . ,
PR.sub.K=3000.
[0183] FIG. 20 illustrates in block form the functional
configuration of the bidding device 10.sub.m and FIG. 21 is a
flowchart showing its bidding procedure. The bidding device
10.sub.m comprises an input part 11, a control part 13, a bidding
price transformer 14, a transceiver 18 and a storage part 12 all of
which are interconnected via a common bus 10B. The bidding price
transformer 14 is made up of a conversion table 15, a one-way
function h processor 16 and a one-way function g processor 17. The
control part 13 reads out a bidding procedure program stored in the
storage part 12, and follows it to control the respective parts to
perform bidding as described below.
[0184] Step S1: The bidding device 10.sub.m receives via the input
part 11 a value PR.sub.m selected from values PR.sub.1, PR.sub.2, .
. . , PR.sub.K, an initial value (a positive integer) IV.sub.m and
an arbitrary integer x.sub.m equal to or greater than 1.
[0185] Step S2: The control part 13 stores IV.sub.m and x.sub.m in
the storage part 12.
[0186] Step S3: The control part 13 refers to the conversion table
15 with PR.sub.m to convert it to an index value k.sub.m and stores
it in the storage part 12.
[0187] Step S4: The initial value IV.sub.m and the bidding price
x.sub.m are read out from the storage part 12, then input to the
one-way function g processor 17, wherein the initial value is
processed x.sub.m times with the one-say function g to obtain
g.sup.xm(IV.sub.m).
[0188] Step S5: If necessary, g.sup.xm(IV.sub.m) is stored in the
storage part 12.
[0189] Step S6: g.sup.xm(IV.sub.m), K and k.sub.m are input to the
one-way function h processor 16, wherein g.sup.xm(IV.sub.m) is
processed K-k.sub.m times with the one-way function h to obtain
H.sub.m.sup.(K)=h.sup.K-km(g.sup.xm(IV.sub.m)).
[0190] Step S7: H.sub.m.sup.(K) is sent as the bidding price
information to the bid-opening device 20 via the transceiver
18.
[0191] In this way, the bidding device 10.sub.m sends the aimed
bidding price index value k.sub.m to the bid-opening device 20.
[0192] Step S8: Upon beginning the bid-opening procedure by the
bid-opening device 20 after the bidding, each bidding device
10.sub.m receives an inquiry with the price index k from the
bit-opening device 20 by the transceiver 18 as depicted in FIG.
21.
[0193] Step S9: A check is made to see if the inquiry index value k
is equal to the bidding price index k.sub.m stored in the storage
part 12.
[0194] Step S10: If not equal, g.sup.xm(IV.sub.m) is read out of
the information storage part 12 and is input to the one-way
function h processor 16 together with k.sub.m and k, wherein
g.sup.xm(IV.sub.m) is processed k-k.sub.m-1 times with the one-way
function h to obtain response information H.sub.m.sup.(k-1) by the
following equation:
H.sub.m.sup.(k-1)=h.sup.k-km-1(g.sup.xm(IV.sub.m))
[0195] Step S11: The bidding device 10.sub.m sends the response
information H.sub.m.sup.(k-1) to the bid-opening device 20 via the
transceiver 18 and waits for the next inquiry about k.
[0196] Step S12: If the inquiry about k corresponds to its aimed
value, that is, if the index k is equal to k.sub.m in he storage
part 12, the bidding device 10.sub.m inputs the initial value
IV.sub.m and x.sub.m-1 to the one-way function g processor 17,
wherein the initial value IV.sub.m is processed xm-1 times to
obtain response information
H.sub.m.sup.(k-1)=g.sup.xm-1(IV.sub.m).
[0197] Step S13: The bidding device 10.sub.m sends the response
information H.sub.m.sup.(k-1) to the bid-opening device 20.
[0198] The functional configuration of the bid-opening device 20 is
depicted in FIG. 22 and its bid-opening procedure in FIG. 23. The
bid-opening device 20 comprises a control part 21, a program
storage part 27S, a one-way function h processor 22, a one-way
function g processor 23, a counter 24, a bulletin board 25, a
conversion table 25A, a transceiver 28, and an information storage
part 25, all of which are interconnected via a common bus 20B.
[0199] Step S1: Upon receiving the bidding information
.gamma..sub.m=H.sub.m.sup.(K) from each bidding device 10.sub.m by
the transceiver 28, the control part 21 writes the bidding
information H.sub.m.sup.(K) on the bulletin board 25 to publish
it.
[0200] Step S2: Set K as the initial value of k in the counter
24.
[0201] Step S3: Send the index value k on the counter 24 to each
bidding device 10.sub.m, and send thereto an inquiry about bidding
via the transceiver 28.
[0202] Step S4: Receive the response information H.sub.m.sup.(k-1)
by the transceiver 28 from all the bidding devices 10.sub.m.
[0203] Step S5: Input H.sub.m.sup.(k-1) to the one-way function h
processor 22 to process it with the one-way function h to obtain
h(H.sub.m.sup.(k-1)).
[0204] Step S6: Check whether the result of operation
h(H.sub.m.sup.(k-1)) is equal to the bidding information A.sub.m
for m in the storage part 35.
[0205] Step S7: If h(H.sub.m.sup.(k-1))=H.sub.m.sup.(K), store the
received information H.sub.m.sup.(k-1) as updated bidding
information H.sub.m.sup.(K) in the storage part 35 to update
H.sub.m.sup.(K).
[0206] Step S8: Decrement the count value k of the counter 24 by
one, then return to step S3, and inquire of each bidding device
10.sub.m about whether it has made a registration for the value
k.
[0207] Step S9: When it is found in step S6 that the response
information H.sub.m.sup.(k-1) from the bidding device 10.sub.m is
g.sup.xm-1(IV.sub.m) which is equal to the aimed index value,
h(H.sub.m.sup.(k-1)) does not become equal to
H.sub.m.sup.(K)=h.sup.ek+1-km-1(g.sup.xm(IV.sub.m))=g.sup.xm(IV.sub.m)
in step S9. Then, input H.sub.m.sup.(k-1) to the one-way function g
processor 23 to process H.sub.m.sup.(k-1) with the one-way function
g to obtain g(H.sub.m.sup.(k-1)).
[0208] Step S10: Make a check to see if g(H.sub.m.sup.(k-1)) is
equal to H.sub.m.sup.(K) corresponding to m stored in the storage
part 35.
[0209] Step S11: When the bidding device 10.sub.m has performed
correct processing,
h.sup.km+1-km-1(g.sup.xm(IV.sub.m))=g.sup.xm(IV.sub.m)=H.sub.m.sup.(K)
by the process of step S7 at the time of previous inquiry for
k=k.sub.m+1; hence, g(H.sub.m.sup.(k-1))=H.sub.m.sup.(K) holds. In
the inquiry processing for the index k which is decremented one by
one, the index k for which g(H.sub.m.sup.(k-1))=H.sub.m.sup.(K)
holds for the first time is the maximum value among the bidding
price indexes of all the bidding devices, and this index k is
converted to the value PR.sub.k by referring to the conversion
table 25A.
[0210] Step S12: Output the value PR.sub.k as the highest one of
the bid values, and if necessary, output the number m of the
winning bidding device 10.sub.m as well.
[0211] In the bidding procedure of FIG. 21, if k=k.sub.m in step S9
when inquired about whether it has bid k, the bidding device
10.sub.m may send to the bid-opening device 29 in step S13 not only
the response information H.sub.m.sup.(k-1) but also information
indicating k=k.sub.m (which information will hereinafter be
referred to as identity information). In this instance, upon
receiving the response information H.sub.m.sup.(k-1) in step S4 in
FIG. 23, the bid-opening device 20 makes a check for the identity
information; if not having received it, the device 20 performs the
operation h(H.sub.m.sup.(k-1)) and if having received the
information, g(H.sub.m.sup.(k-1)). Incidentally, in the event that
g(H.sub.m.sup.(k-1)).noteq.H.sub.m.sup.(K) in step S10 in FIG. 23,
the bid-opening device 20 may discontinue the current bid-opening
session for the reasons of dishonesty by the bidding device
concerned and request all the bidding devices 10.sub.m to rebid;
alternatively, the bid-opening device 20 may abandon inquiring that
bidding device but may continue inquiring the other bidding
device.
[0212] In the case where the bidding prices PR.sub.k are arranged
on each of the conversion tables 15 and 25A in such a decreasing
order as 3000, 2950, 2900, . . . , 100 in correspondence with the K
index values 1, 2, . . . , K, the price PR.sub.k corresponding to
the index value k for which g(H.sub.m.sup.(k-1))=H.sub.m.sup.(K)
holds for the first time in the inquiry about bidding k represents
the lowest one of the aimed bidding prices of all the bidding
devices 10.sub.m. The maximum value of the index may also be
obtained without using the conversion table 15. In this instance,
the bidding device 10.sub.m sends the index value k.sub.m, and
after step S10 in FIG. 23 the bid-opening device 20 outputs the
index value k as the highest value and, if necessary, together with
the number m (or ID.sub.m) of the bidding device 10.sub.m having
sent the index value k.sub.m.
[0213] In the bid-opening procedure depicted in FIG. 23, the
bid-opening device 20 inquires every bidding device 10.sub.m for
each value of the index k=K, K-1, K-2, . . . , and receives
H.sub.m.sup.(k-1)), and then processes it using the one-say
function h in step S5; hence this procedure requires high
communication cost and computational complexity. In FIG. 24 there
is depicted a modified form of the above-mentioned bid-opening
procedure whose communication cost and computational complexity are
reduced using the scheme described previously with reference to
FIG. 11. No description will be given of the bidding procedure
since it is exactly the same as in the FIG. 11 embodiment.
[0214] Step S0: Receive bidding price information
H.sub.m.sup.(K)=h.sup.K-km(g.sup.xm(IV.sub.m)) and the identifier
ID.sub.m from each bidding device.
[0215] Step S1: Publish the received H.sub.m.sup.(K) and ID.sub.m
on the bulletin board 25.
[0216] Step S2: Set the initial value of the index k at K.
[0217] Step S3: Inquire of all the bidding devices 10.sub.m about
whether they bid for the index k.
[0218] Step S4: Check the responses for YES (which means that the
bidding device concerned has bid for the index k).
[0219] Step S5: If no YES is found, decrement k by one and returns
to step S3 to repeat the same processing.
[0220] Step S6: If YES is found, request all the bidding devices
10.sub.m to send their bidding price information H.sub.m.sup.(k-1).
The response of the bidding device to this request is the same as
described previously in connection with FIG. 21.
[0221] Step S7: Publish the received information H.sub.m.sup.(k-1)
on the bulletin board 25.
[0222] Step S8: For the response H.sub.m.sup.(k-1) of an m
(representing the bidding device 10.sub.m) having bid for the index
k, compute
H.sub.m=h.sup.K-k(g(H.sub.m.sup.(k-1))
[0223] and for the responses H.sub.m.sup.(k-1) from the other m's
(the other bidding devices), compute
H.sub.m=h.sup.K+1-k(H.sub.m.sup.(k-1)).
[0224] Step S9: Check whether H.sub.m=H.sub.m.sup.(k) holds for all
the m's, and if a mismatch is detected for even one of them, send
an error message to all the bidding devices and discontinue the
current bid-opening session.
[0225] Step S10: If a match is detected for every one of them,
determine that the bidding device 10.sub.m of the number m having
responded YES is the winning bidder, and output the index k at that
time and its identifier ID.sub.m for publication
[0226] The bidding device 10m and the bid-opening device 20 can
each be implemented by a computer.
Seventh Embodiment
[0227] In the fifth embodiment described previously, each bidding
device 10.sub.m generates the select information b.sub.m.sup.(k)
indicating whether to bid for every price index k=1, 2, . . . , K,
and these pieces of select information are contained in K pieces of
information h(k(+)b.sub.b.sup.(k)(+)R.sub.m.sup.(k)), where k=1, 2,
. . . , K. In this embodiment, however, the plural pieces of select
information are contained in a single piece of bidding price
information through multiple processing with the one-way function
h.
[0228] FIG. 25 illustrates in block form the functional
configuration of each bidding device 10.sub.m. Assume that K
bidding prices PR and the k price indexes k=1, 2, . . . , K, which
have a one-to-one correspondence with each other, are both arranged
in monotone increasing order in the same direction. The bidding
select information for each index k will be identified as
b.sup.(k). In this embodiment a select information generating part
54 does not generate the select information b.sub.m.sup.(k) for all
the indexes k=1, 2, . . . , K but instead generates the select
information b.sub.m.sup.(k) only for indexes higher than the
bidding price index k.sub.m.
H.sub.m.sup.(k)=h(H.sub.m.sup.(k-1).parallel.b.sub.m.sup.(k)) is
calculated, with H.sub.m.sup.(km-1)=IV.sub.m as its initial value,
for each value of the price index k (=k.sub.m, k.sub.m+1, . . . ,
K) by a one-way function h processor 16, a concatenator 55 and a
buffer 56, and the calculation result H.sub.m.sup.(k) for each
value of k is stored in a data storage part 14S. The final
calculation result H.sub.m.sup.(K) will hereinafter be called
bidding price information. In this embodiment, a signature
Sig.sub.m(H.sub.m.sup.(K)) is generated by a signature generator
14S for the bidding price information 57.
[0229] FIG. 26 is a flowchart showing the bidding procedure of the
bidding device 10.sub.m depicted in FIG. 25.
[0230] In this embodiment, letting k.sub.m be the index that the
bidding device 10.sub.m bids, a select information generating part
54 generates K-k.sub.m+1 pieces of select information
b.sub.m.sup.(km), b.sub.m.sup.(km+1), . . . , b.sub.b.sup.(K)
corresponding to the indexes larger than the bidding price index
k.sub.m (step S1). Then, H.sub.m.sup.(km-1), H.sub.m.sup.(km),
H.sub.m.sup.(km+1), . . . , H.sub.m.sup.(K) are successively
generated by the following equations
H m ( k m - 1 ) = IV m ##EQU00001## H m ( k m ) = h ( H m ( k m - 1
) b m ( k m ) ) H m ( k m + 1 ) = h ( H m ( k m ) b m ( k m + 1 ) )
H m ( t ) = h ( H m ( t - 1 ) b m ( t ) ) H m ( K ) = h ( H m ( K -
1 ) b m ( K ) ) ##EQU00001.2##
[0231] and they are stored in the data storage part 14S (step S2).
Further, a signature .sigma..sub.m=Sig.sub.m(H.sub.m.sup.(K)) of
the bidding device 10.sub.m corresponding to the bidding price
information H.sub.m.sup.(K) is generated by the signature generator
14S (step S3). The bidding device 10.sub.m sends H.sub.m.sup.(K),
.sigma..sub.m and ID.sub.m as bidding information to the
bid-opening device 20 (step S4). After this, the bid-opening
procedure is started, and upon receiving an inquiry for each value
of the index k, the bidding device reads out {H.sub.m.sup.(k-1),
b.sub.m.sup.(k)} from the data storage part 14S, and sends it to
the bid-opening device (step S5).
[0232] The bid-opening device 2--comprises, as depicted in FIG. 27,
a control part 21, a one-way function h processor 22, a counter 24,
a bulletin board 25, an information storage part 35, comparators 58
and 59 and a signature verifier 33. The pieces of bidding
information H.sub.m.sup.(K), .sigma..sub.m and ID.sub.m are written
on the bulletin board 25. Then, the received information
H.sub.m.sup.(k-1) is processed by the one-way function h processor
22 to obtain H.sub.m.sup.(k)=h(H.sub.m.sup.(k-1)), which is
compared by the comparator 58 with H.sub.m.sup.(k) read out of the
bulletin board 25 to thereby verify whether they match. Further, it
is checked by the comparator 59 whether the received select
information b.sub.m.sup.(k) is 1, and if it is 1, then the bidding
device 10.sub.m corresponding to m at that time is determined as
the winning bidder.
[0233] FIG. 28 is flowchart showing the bid-opening procedure of
the bid-opening device 20.
[0234] The bid-opening device 20 verifies respective signatures
.sigma..sub.m (where m=1, 2, . . . , M) and writes and publish the
received pieces of information H.sub.m.sup.(K), .sigma..sub.m and
ID.sub.m on the bulletin board 25.
[0235] The bid-opening device 20 sends k to the bidding device in
the order [k=K, K-1, K-2, . . . ] and asks for information
{H.sub.m.sup.(k-1), b.sub.m.sup.(k)} corresponding to each index k.
The information {H.sub.m.sup.(k-1), b.sub.m.sup.(k)} received from
each bidding device 10.sub.m is published on the bulletin board 25,
then it is checked whether
H.sub.m.sup.(k)=h(H.sup.(k-1),b.sub.m.sup.(k)) holds for the
information H.sub.m.sup.(k) received previously, and if it holds,
it is checked whether the select information b.sub.m.sup.(k) is 1.
When b.sub.m.sup.(k) is 0 for all of m=1, 2, . . . , M, the
bid-opening device 20 decrements k to k.rarw.k-1, then sends again
k to the bidding device and asks for the information
{H.sup.m.sup.(k-1), b.sub.m.sup.(k)}, thereafter performing the
same operation as described above. If the select information
b.sub.m.sup.(k) is 1 for any one of m=1, 2, . . . , M, then the
bidding device 10m corresponding to that m is determined as the
winning bidder. The bid-opening device 20 publishes the successful
bidding price index k.sub.m and the identifier ID.sub.m of the
wining bidding device 10.sub.m on the bulletin board 25.
[0236] According to this embodiment, since each bidding device does
not perform the multiple processing with the one-way function for
indexes smaller than the bidding price index k.sub.m, the
computational complexity is low accordingly.
[0237] The bid-opening device performs the bid-opening procedure as
described below.
[0238] Step S0: Receive the pieces of bidding information
H.sub.m.sup.(K), .sigma..sub.m and ID.sub.m from each bidding
device, then verifies respective signature .sigma..sub.m (where
m=1, 2, . . . , M), and writes and publishes the pieces of
information H.sub.m.sup.(K), .sigma..sub.m and ID.sub.m on the
bulletin board 25.
[0239] Step S1: Set the initial value of the index k to K.
[0240] Step S2: Send k to each bidding device 10.sub.m and ask for
{H.sub.m.sup.(k-1), b.sub.m.sup.(k)}.
[0241] Step S3: Write and publish on the bulletin board 25 the
information {H.sup.m.sup.(k-1), b.sub.m.sup.(k)} received from each
bidding device 10.sub.m.
[0242] Step S4: Process the received information
{H.sub.m.sup.(k-1), b.sub.m.sup.(k)} by the one-way function h
processor 22, thereby generating
H=h(H.sub.m.sup.(k-1).parallel.b.sub.m.sup.(k)).
[0243] Step S5: Verify by the comparator 58 whether H generated in
step S4 matches the previously received H.sub.m.sup.(k). If a
mismatch is detected, then send an error message to the bidding
device and discontinue the current bid-opening session.
[0244] Step S6: If no mismatch is found in step S5, then decides
that the response from every bidding device is valid, and make a
check by the comparator 59 to see if the received select
information b.sub.m.sup.(k) is 1.
[0245] Step S7: When the select information b.sub.m.sup.(k)
[0246] from all bidding devices 10.sub.m is 0, update k with k-1
and return to step S2.
[0247] Step S8: When any one of M pieces of select information
b.sub.m.sup.(k) is 1 in step S6, determine that the bidding device
10.sub.m corresponding to m, which provides that information
b.sub.m.sup.(k), is the winning bidder, and write and publish its
identifier ID.sub.m and the index k.sub.k of the winning bid on the
bulletin board 25, and end the bid-opening procedure.
[0248] In this embodiment the prices bid by the unsuccessful
bidders are each kept secret from the other participants. The
lowest price bid can be made a successful bid by using a conversion
table wherein the price PR monotonously increases in the direction
opposite to that in which the index k monotonously increases.
[0249] Incidentally, it is also possible to set
H.sub.m.sup.(0)=IV.sub.m,
H.sub.m.sup.(1)=h(H.sub.m.sup.(0).parallel.b.sub.m.sup.(1)), . . .
, H.sub.m.sup.(K)=h(H.sub.m.sup.(K-1).parallel.b.sub.m.sup.(K),
where b.sub.m.sup.(1)=b.sub.m.sup.(2)= . . .
=b.sub.m.sup.(km-1)=0.
[0250] The communication cost and computational complexity involved
in the bid-opening procedure of FIG. 27 can also be reduced, as
depicted in FIG. 27', by the application of the scheme described
previously with reference to FIG. 11. The bidding procedure is
exactly the same as in FIG. 25, and hence it will not be
described.
[0251] Step S0: Receive the bidding price information
H.sub.m.sup.(K)=h( . . .
h(h(H.sub.m.sup.(km-1).parallel.b.sub.m.sup.(km)).parallel.b.sub.m.su-
p.(km+1)) . . . .parallel.b.sub.m.sup.(K)) and the identifier
ID.sub.m from each bidding device.
[0252] Step S1: Publish the received H.sub.m.sup.(K) and
ID.sub.m.
[0253] Step S2: Set the initial value of the index k at K.
[0254] Step S3: Inquire of all the bidding devices 10.sub.m about
whether they bid for the index k.
[0255] Step S4: Check the responses for YES (which means that the
bidding device concerned has bid for the index k).
[0256] Step S5: If no YES is found, decrement k by one and returns
to step S3 to repeat the same processing.
[0257] Step S6: If YES is found, request all the bidding devices
10.sub.m to send their bidding price information
H.sub.m.sup.(k-1)=h( . . .
h(h(H.sub.m.sup.(km-1).parallel.b.sub.m.sup.(km)).parallel.b.sub.m.sup.(k-
m+1)) . . . .parallel.b.sub.m.sup.(K)). The response of the bidding
device to this request is the same as described previously in
connection with FIG. 21. For the bidding device having bid for the
current index k, k=k.sub.m; therefore,
H.sub.m.sup.(k-1)=H.sub.m.sup.(km-1)=IV.sub.m.
[0258] Step S7: Publish the received information H.sub.m.sup.(k-1)
on the bulletin board 25.
[0259] Step S8: For the response H.sub.m.sup.(k-1) of an m
(representing the bidding device 10.sub.m) having bid for the index
k, compute
H.sub.m=h( . . .
h(h(H.sub.m.sup.(k-1).parallel.1).parallel.0).parallel. . . .
0)
[0260] and for the responses H.sub.m.sup.(k-1) from the other m's
(the other bidding devices), compute
H.sub.m=h( . . . h(h(H.sub.m.sup.(k-1)).parallel.0).parallel.0) . .
. .parallel.0).
[0261] Step S9: Check whether H.sub.m=H.sub.m.sup.(k) holds for all
the m's, and if a mismatch is detected for even one of them, send
an error message to all the bidding devices and discontinue the
current bid-opening session.
[0262] Step S10: If a match is detected for every one of them,
determine that the bidding device 10.sub.m of the number m having
responded YES is the winning bidder, and output the index k at that
time and its identifier ID.sub.m for publication.
Eighth Embodiment
[0263] In each of the embodiments described above, the bidding
prices for the bidding price indexes k=1, 2, . . . , K in the
conversion table are discrete values such as 1000, 2000, 3000, . .
. , 10000, and each bidding device bids any one of the K prices but
cannot bid a value intermediate between such discrete prices unless
K prices are set in "1" increments. This embodiment is intended to
permit bidding an arbitrary price intermediate between the discrete
values. In this embodiment, an arbitrary bidding price PR within
the range defined by the highest and lowest bidding prices is
expressed by the following equation.
PR=F(k)+Q
[0264] where: 0.ltoreq.Q<F(k+1)-F(k)
[0265] F(k) represents the price corresponding to the index k
specified on the conversion table, and Q will hereinafter be
referred to as a fraction.
[0266] This embodiment is one that the bidding price PR defined
above is applied to the first embodiment described previously.
Bidding price information g(h.sup.k(IV.sub.m)) and Q.sub.m are sent
to the bid-opening device 20. Further, h.sup.K+1(IV.sub.m) is sent
as verification information to the bid-opening device 20 together
with the bidding price information. These pieces of information are
published on the bulletin board as is the case with the first
embodiment.
[0267] FIG. 30 is a block diagram illustrating the configuration of
each bidding device 10.sub.m, which is identical with the bidding
device of the first embodiment except that the bidding price
transformer 14 is provided with a fraction calculating part 14a.
The fraction calculating part 14A calculates, for a desired bidding
price PR.sub.m, Q.sub.m=PR.sub.m-F(k.sub.m) from the index k.sub.m
read out of the conversion table 15. As is the case with the first
embodiment, the one-way function h processor 16 and the one-way
function g processor 17 are used to compute
.gamma..sub.m=g(h.sup.km(IV.sub.m)) from the index k.sub.m which
satisfies F(k.sub.m+1)>PR.sub.m.gtoreq.F(k.sub.m) and the
initial value IV.sub.m. In this embodiment, .gamma..sub.m, Q.sub.m
and ID.sub.m are sent as bidding information to the bid-opening
device 20.
[0268] The bid-opening device 20 has, as depicted in FIG. 31, a
sequencer 61 added to the bid-opening device 20 in FIG. 6
embodiment. The pieces of bidding information .gamma..sub.m,
Q.sub.m and ID.sub.m are written and published on the bulletin
board 25. The sequencer 61 reads out Q.sub.1, Q.sub.2, . . . ,
Q.sub.M from the bulletin board 25, then sequences them in
descending order, and sequences m=1, 2, . . . , M corresponding to
the sequenced Q.sub.m, thereafter outputting them in the sequential
order. The control part 21 checks, for each index k, whether
ID.sub.m and .gamma..sub.m match each other in the sequence of m
defined by the sequencer 61. The bidding device 10.sub.m, which
corresponds to m for which the match was detected for the first
time, is determined as the winning bidder.
[0269] FIG. 32 is a flowchart depicting the bid-opening procedure
of the bid-opening device 20 shown in FIG. 31, which steps S0 to S7
are identical with steps S0 to S7 in FIG. 7 but differ in step 8
and the subsequent steps. Roughly speaking, steps S8 and S9 are new
steps added between steps S7 and S8 in FIG. 7. Step S8 and the
subsequent steps will be described below.
[0270] In step S8 the bid-opening device 20 makes a check to
determine whether the matching in steps S6 to S11 has been
completed for all fractions Q.sub.m for the current value of k. If
not completed, the procedure goes to step S9. In step S9, the
bid-opening device 20 selects the largest one of the remaining
fractions Q.sub.m to determine the corresponding m. In step S10,
the device 20 reads out of the data storage part 36 updated data
D.sub.m.sup.(k)=h.sup.k(IV.sub.m) corresponding to that m, and
processes the read-out data by the one-way function g processor 23,
thereby updating it such that
D.sub.m.sup.(k).rarw.g(D.sub.m.sup.(k)). In step S11, the control
device 21 makes a check to see if the updated data D.sub.m.sup.(k)
corresponding to m matches the bidding price information
.gamma..sub.m corresponding to m on the bulletin board 25, and if
not, then the procedure returns to step S8.
[0271] When it is decided in step S8 that the matching for all the
fractions Q.sub.m for the current k has been completed, the
bid-opening device 20 decrements k by one in step S12, and returns
to step S8, repeating the same procedure as mentioned above. When
it is decided in step S11 that the updated data D.sub.m.sup.(k) and
the bidding price information .gamma..sub.m match, the bid-opening
device 20 determines in step S13 that the index k at that time is
the successful index, and outputs the identifier ID.sub.m
corresponding to that information .gamma..sub.m and the successful
bidding price F(k)+Q.sub.m (or merely the index k).
[0272] Since D.sub.m.sup.(k) and gm are matched for the current
value of the index k in the descending order of the fractions
Q.sub.m as described above, the highest bidding price can be
determined at the first detection of matching between
D.sub.m.sup.(k) and .gamma..sub.m. The value m selected in step S9
is determined by the sequencer 61 which sequences in descending
order the fractions Q.sub.1, Q.sub.2, . . . , Q.sub.M read out of
the bulletin board 25, and sequences m correspondingly, as
explained before.
[0273] In the case where the lowest bidding price bid is a
successful bid, the bidding prices are arranged in monotonous
increasing order in the direction opposite to that in which the
values of the index k are arranged in monotonous decreasing order,
and the sequencer 61 sequences the fractions Q.sub.1, Q.sub.2, . .
. , Q.sub.M in ascending order, and sequences m correspondingly. In
step S9 the smallest one of the unprocessed fractions Q.sub.m is
chosen, and the corresponding m is determined. The sequencer 61
determines the order of m.
[0274] The technique that uses may fractions Q.sub.m as described
above can be applied not only to the first embodiment but also to
the other embodiments explained heretofore.
[0275] Electronic Competitive Auction System With Provisional
Identifier Device
[0276] In the embodiments described above, since the bidding device
identifier ID.sub.m is contained in the bidding information and
sent to the bid-opening device 20, it can be said that these
embodiments employ what is called a sealed-bit auction system. FIG.
33 illustrates in block form an electronic competitive auction
system which uses a provisional identifier registration device to
implement a secret-bit auction.
[0277] Each bidding device 10.sub.m is adapted to communicate with
a provisional identifier registration device 70. Referring to FIG.
34, the operation of this electronic competitive auction system
will be described below.
[0278] Step S0: Notice of auction is input to each bidding device
10.sub.m.
[0279] Step S1: Upon receiving the notice of auction, the bidding
device 10.sub.i outputs the identifier ID.sub.m to the provisional
identifier registration device 70.
[0280] Step S2: For the identifier ID.sub.m provided thereto, the
provisional identifier registration device 70 issues a provisional
identifier AID.sub.m then stores ID.sub.m and AID.sub.m in pair
form on a recording medium 71, and sends the provisional identifier
AID.sub.m to the bidding device 10.sub.i.
[0281] Step S3: The bidding device 10.sub.m: generates the bidding
price PR.sub.m;
[0282] Step S4: Transforms the bidding price PR.sub.m to the
bidding price information .gamma..sub.m; and
[0283] Step S5: Sends the bidding price information .gamma..sub.m
and the provisional identifier AID.sub.m to the bid-opening device
20.
[0284] Step S6: The bid-opening device 20: calculates a successful
bid from the bidding price indexes received from all the bidding
deices; and
[0285] Step S7: Outputs the successful bid and the provisional
identifier of the bidding device having offered the successful
bid.
[0286] Thus, it is possible to keep the auction participants
secret. Incidentally, when inquiring the provisional identifier
registration device 70, the bid-opening device 20 can learn the
identifier ID.sub.m corresponding to the successful bid from the
provisional identifier AID.sub.m. This method can be applied to all
of the embodiments explained hereinbefore.
[0287] The bidding device 10.sub.m and the bid-opening device 20
can be implemented by interpreting and executing programs with a
computer.
EFFECT OF THE INVENTION
[0288] As described above, according to the present invention,
since the bidding price is transformed to a bidding price
information through utilization of a one-way function and is then
sent to the bid-opening device, it is possible to keep the bidding
price of each bidding device secret from the other bidding devices
prior to bidding, ensuring fairness of auction.
[0289] By publishing h.sup.K+1(IV.sub.m) and h.sup.kmx(IV.sub.m)
corresponding to a winning bidding price on the bulletin board, it
is possible for all bidding devices to verify whether the winning
bidding price was correctly bid without being altered.
[0290] Furthermore, the present invention permits determination of
the winning bid while hiding the other bidding prices.
[0291] According to the second embodiment, the bids of losing
bidders, except the winning bid, are kept secret even from the
bid-opening device.
[0292] According to the third embodiment, the bids of losing
bidders, except the winning bid, are kept secret even from the
bid-opening device, and in addition, the amount of data for
communication with the bidding device can be reduced.
[0293] According to the fourth embodiment, there is no fear of the
bidding price of each bidding device being revealed to the other
devices, and at the bid-opening time the successful bid can easily
be specified directly from the bidding price; furthermore, the
validity of the winning bid can be verified.
[0294] According to the fifth embodiment, bidding price information
including each bidding price index is generated using a one-way
function, and the bidding price information for all bidding price
indexes is sent to the bid-opening device; hence, the aimed bidding
price can be kept secret.
[0295] According to the sixth embodiment, either
h(H.sub.m.sup.(k-1))=H.sub.m.sup.(K) or
g(H.sub.m.sup.(k-1))=H.sub.m.sup.(K) needs only to be verified for
each index value and for each bidding device.
[0296] According to the seventh embodiment, each bidding device
generates the bidding price information including select
information for only indexes larger than the bidding price index
k.sub.m in the fifth embodiment, the computational complexity can
be reduced.
[0297] According to the eighth embodiment, since a desired bidding
price is expressed by the sum of fractions Q of a price F(k)
corresponding to the index k, an arbitrary price can be bid with a
small number of indexes.
* * * * *