fig1 shows an overall configuration of a system in which a method according to an embodiment of the invention is implemented . the method according to an embodiment of the invention is implemented by utilizing a framework ( a virtual execution framework 10 ) that is based on virtual machines or vms . virtual machines are known in the art , and are described in detail , for example , in shamon : a system for distributed mandatory access control , by jonathan m . mccune , trent jaeger , stefan berger ramon caceres , and reiner sailer , an will not be described further herein . the virtual execution framework 10 is a kind of computer and serves as a calculation framework of a third - party institution having a memory space 100 under control of the framework 10 . multiple computers including a computer a 20 and a computer b 30 independently upload data and / or modules to the memory space 100 or download data and / or modules ( programs or program codes for execution by computers ) from the memory space 100 . the computers also upload data from the memory space 100 to an external storage 400 or download data from the external storage 400 to the memory space 100 independently or in cooperation with each another . for example , the computer a 20 can represent a computer managed by one financial institution and the computer b 30 can represent a computer managed by another financial institution . the memory space 100 and the virtual execution framework 10 that controls the space 100 represent a computer that can serve as a substitute for a trusted institution . a computer 500 of a third party ( e . g ., an auditing firm ) can also represent a computer that is able to upload or download data and / or modules to and from the memory space 100 . although access to the memory space 100 allowed to the computer 500 of a third party ( e . g ., an auditing firm ) is limited , the computer 500 can still substitute for a trusted institution and serve as a calculation framework of the third - party institution in that it has access to the memory space 500 , though partially , for the purpose of auditing . the term “ external ” of the external storage 400 is intended to merely mean transport to outside the memory space 100 and has no further technically special meaning herein : the term “ external ” should be construed in a broad sense . in a case the memory space 100 is located inside a firewall and data is transported outside the firewall after double encryption , which will be described below , public cloud can be utilized more efficiently while minimizing information leakage risk . fig2 schematically shows a configuration of a memory space 100 which is under control of the virtual execution framework on which a method according to an embodiment of the invention is implemented as well as that of memory spaces 200 , 300 under control of the multiple computers ( computers a and b ) 20 , 30 . to the inside ( of the boundary ) of the memory space 100 , data and modules can be uploaded from the computers a 20 and b 30 . in the example of fig2 , twelve unit spaces are shown as dotted - line boxes . the twelve unit spaces are diagrammatically shown with position numbers forming a matrix , 11 , 12 , 13 , 21 , 22 , 23 , 31 , 32 , 33 , 41 , 42 and 43 . chain lines are further drawn through the twelve unit spaces . the chain lines are imaginary lines implying that the connection and direction of communication can be controlled , representing possible communications between uploaded data and / or modules . as a rule of depiction in the subsequent drawings , existence of actual connection of communication is represented by a solid line instead of a chain line and direction of communication is represented by an arrow . herein , control of connection and direction of communication through control by the virtual execution framework 10 is called “ enforcement ”. put differently , enforced processing means that only limited connection and direction of communication is allowed , and thus any action that the computers a 20 and b 30 have not mutually agreed on or accepted cannot be carried out , in the expectation that the computers will agree to recognize the virtual execution framework 10 as a substitute for a trusted institution . inside ( the boundary ) of the memory space 100 , it is a fundamental rule that the virtual execution framework 10 enforces processing by whoever the action entity is , or an action of whoever triggers processing . the direction of communication is one of the important control factors that are enforced . in practice , the virtual execution framework 10 is constructed on a certain physical computer ( a host computer ), and realized in hardware or software , or a combination thereof . the virtual execution framework 10 controls communication of a virtual machine ( vm ) as follows . communication between an entity outside the host computer and a virtual machine is realized by the virtual execution framework transferring incoming data to the host computer from the outside entity to the virtual machine , or by the virtual execution framework intercepting outgoing data from a virtual machine and transmitting the data to the entity outside the host computer . data communication between virtual machines is realized by the virtual execution framework 10 transferring data via the memory space of the host computer . in either case , the virtual execution framework 10 can enforce whether to permit communication and the direction of communication according to certain policies . the chain lines in fig2 just schematically represent one example , and connection and direction of communication may be controllable also between unit spaces on which chain lines are not drawn . for example , although a chain line , which indicates possible communication , in an oblique direction is drawn only between unit spaces 11 and 22 in the figure , direct communication may be performed between other unit spaces and its connection and direction may be controlled . to each of the unit spaces , data and a module can be uploaded , and at the time of upload or at a later time when a need for access limitation arises , acting subjects that are granted access to each unit space can be configured . acting subjects that are granted access to unit spaces include the computers a 20 , b 30 , and the computer 500 of a third party ( e . g ., an auditing firm ). acting subjects that are granted access may be centrally configured by the virtual execution framework 10 , cooperatively by the computers a 20 and b 30 under a mutual agreement , or by a third party ( e . g ., an auditing firm ) on consignment . a chain line is also drawn from inside ( the boundary of ) the memory space 100 to the outside thereof in connection with fig1 , data and / or modules are uploaded ( or entered ) from outside of the memory space 100 and downloaded ( or go out ) from inside of the memory space 100 on such a route crossing the boundary . in a memory space 200 under control of computer a , two unit spaces are schematically indicated with position numbers al and a 2 . in a memory space 300 under control of computer b , two unit spaces are schematically indicated with position numbers b 1 and b 2 . communication can also take place between any of these unit spaces and a unit space in the memory space 100 . the connection and direction of communication between each unit space of the memory space 100 and each one in the memory spaces 200 and 300 , which are under control of the computers a and b respectively , could also be enforced by the virtual execution framework 10 . it is preferable in terms of reduction in information leakage risk , however , that ( at least ) the contents of data and modules uploaded in the memory spaces 200 and 300 , which are under control of the computers a and b respectively , are kept invisible to the virtual execution framework 10 . the connection and direction of communication between the memory space 200 under control of the computer a and the memory space 400 of the external storage could be enforced by the virtual execution framework 10 . likewise , the connection and direction of communication between the memory space 300 under control of the computer b and the memory space 400 of the external storage could be enforced by the virtual execution framework 10 . it will be preferable , however , not to permit the virtual execution framework 10 to control them for reduction in information leakage risk . basically , the virtual execution framework 10 is preferably designed to just control the memory space 100 and provide a space or place for download and upload by the computers a 20 and b 30 , rather than being an action entity to perform download or upload . fig3 schematically illustrates upload of data and modules in implementing a method according to an embodiment of the invention . here , data a is possessed independently by the computer a 20 and is uploaded by the computer a 20 ( to unit space 11 ). data b is possessed independently by the computer b 30 and is uploaded by the computer b 30 ( to unit space 41 ). as acting subjects that are allowed to access each unit space can be configured individually at the time of upload or at a later time when necessity for access limitation arises , the data a may be configured to be inaccessible to the computer b 30 and data b be inaccessible to the computer a 20 . this setting can be effective when the computers a and b want to keep their own data confidential . thus , various settings for minimizing the risk of information leakage can be flexibly made for parties concerned about such risk ( computers a and b in this example ). a proxy decryption module a ( unit space 33 ), an encryption module a ( unit space a 1 ), and a decryption module a ( unit space a 2 ) are modules configured specifically on the computer a , which uploads the modules ( by the time that they are required for processing ). the encryption module a ( unit space al ) has a public key of the computer a and the decryption module a ( unit space a 2 ) has a secret key of the computer a . an encryption module b ( unit space 13 ) and a decryption module b ( unit space b 1 ) are modules configured specifically on the computer b , which uploads the modules ( by the time that they are required for processing ). upload of the encryption module b ( unit space 13 ) and the proxy decryption module a ( unit space 33 ) is performed via and under control of the virtual execution framework 10 . the encryption module b ( unit space 13 ) and the proxy decryption module a ( unit space 33 ) keep the public key of the computer b , and the decryption module b ( unit space b 1 ) keeps the secret key of the computer b . the decryption module a ( unit space a 2 ) should not be uploaded to the memory space 100 because the module can be decoded in the event that the virtual execution framework 10 comes under an outside attack . similarly , the decryption module b ( unit space b 1 ) should not be uploaded to the memory space 100 either . it is also possible to configure the encryption module b to be inaccessible to the computer a 20 , which setting can be effective when it is desirable that even an encryption technique that is used be hidden from others . as will be discussed later , output of the encryption module b is made to reach only the computer a by enforcement when exiting the memory space to the outside thereof . input from the computer b to the inside of the memory space is directed only to the proxy decryption module a by enforcement . a calculation module ( unit space 21 ) may be uploaded by the computers a 20 and b 30 cooperatively under a mutual agreement , or by either one of them . the calculation module may also be uploaded by a trusted institution ( e . g ., the computer 500 of a third party , such as an auditing firm ) as an arbiter or mediator in a neutral position , or under a commission from the computers a 20 and b 30 . fig4 schematically illustrates calculation of data ab which consolidates data a and data b in implementing a method according to an embodiment of the invention . the calculation module takes data a and data b as input , and outputs data ab as consolidated data . thus , data processing is enforced by the virtual execution framework 10 so that the start point of an arrow represents input and the end point represents output . this way of data processing is enforced regardless of who the action entity is or for an action regardless of who triggers processing . in relation to calculation of data ab , if the calculation module has been uploaded by the computer 500 of a third party ( an auditing firm ), data ab may be made accessible only to the computer 500 . this setting can be effective when auditing is the only purpose . it is also possible that even if data ab is calculated merely by simple averaging of data a and data b , their owners find no harm in knowledge of data a by the computer b and vice versa as long as the data is kept consolidated . in such a case , data ab may be made accessible only to the computers a and b . this setting can be effective when the data owners are expected not to dare to leak one another &# 39 ; s information . in some cases , control is exercised so as not to allow the computer a , computer b , or a third party to access data ab . this is the case when consolidation is not sufficient and the original data can be still identified after consolidation , or for intermediate calculation data prior to generation of data that can be disclosed to a third party , for instance . fig5 schematically illustrates double encryption of data ab , which is consolidated data , in implementing a method according to an embodiment of the invention . data ab is first encrypted by the encryption module b and further by the encryption module a . the order of encryption is enforced by the virtual execution framework 10 , but the order need not be b to a : communication from an encryption module x ( x ={ a , b }) within the memory space 100 has only to be enforced by the virtual execution framework 10 so that it is directed only to an external encryption module y ( i . e ., the one other than x ). the data thus dual - encrypted is uploaded to the external storage 400 . the data may be uploaded to the external storage 400 by either one or both of the computers a and b . in this manner , the data is externally stored . consolidation and further encryption of data lends itself to public cloud storage without concern for risk of information leakage . public cloud storage is commonly offered at a low cost and in a large capacity . fig6 schematically shows how data kept in an external storage is decrypted in implementing a method according to an embodiment of the invention . stored data is downloaded from the external storage 400 . the data may be downloaded by one or both of the computers a and b . the data is first decrypted by the decryption module a and then by the decryption module b . the order of decryption is enforced by the virtual execution framework 10 . prior to final restoration into the original data ab ( consolidated data ), the proxy decryption module a intervenes . fig7 shows a specific procedure of introducing encrypted information from an external module to an internal proxy module in implementing a method according to an embodiment of the invention . input from outside the memory space 100 is directed only to the proxy decryption module a by enforcement by the virtual execution framework 10 , but the order need not be b to a : communication destined for a proxy decryption module x ( x ={ a , b }), which serves as a “ proxy ” to handle decryption , inside the memory space 100 has only to be enforced by the virtual execution framework 10 so that it comes only from the external decryption module y ( e . g ., the one other than x ). however , for the proxy decryption module a to provide similar functions to the decryption module a , a cryptographic key that was used in the encryption module a for encryption has to be correctly conveyed to the proxy decryption module a . if the key is delivered only at a time it is required from outside to inside of the memory space 100 which is under control of the virtual execution framework 10 , security is ensured in that the virtual execution framework 10 is prevented from performing both encryption and decryption by itself the encryption module b requests an empty envelope from the proxy decryption module a . an empty envelope refers to key r for encrypting data to be placed in the envelope . the proxy decryption module a generates r by random number generation and encrypts r with the public key , pk_a , of the computer a , thereby generating envelope data , e ( pk_a , r ) ( where e ( k , m ) represents ciphertext resulting from encryption of a message m with a key k ). the proxy decryption module a sends back the envelope data to the encryption module b . a data acquisition request by the encryption module b ( attached with the envelope data ) is sent to the encryption module a by enforcement . the encryption module a wants to send a ′ s key ( designated as k_a ) for undoing the double encryption of data ab to the proxy decryption module a in an encrypted format . thus , the encryption module a decrypts the envelope data using the secret key sk_a of the computer a , which the decryption module a possesses , to obtain r , and encrypts k_a using r to generate e ( r , k_a ). e ( r , k_a ) is sent to the decryption module b , which decrypts e ( r , k_a ) once using the key of b ( designated as k_b ) for undoing double encryption of data ab . ( at this point , data ab is still encrypted with k_a .) the decryption module b sends data ab which has been decrypted once and is encrypted with k_a to the virtual execution framework with e ( r , k_a ). they are directed to the proxy decryption module a according to enforcement by the virtual execution framework . r has been generated in ( 3 ) and is possessed by the proxy decryption module a . thus , the proxy decryption module a can use r as a key to decrypt e ( r , k_a ) ( i . e ., to open the envelope ) to retrieve k_a . that is , since k_a , which the external decryption module a wanted to send at ( 6 ), now resides safely at the proxy decryption module a , the module a can use k_a to perform the final decryption to obtain data ab . through this procedure , only the decryption module a can pack the key in the envelope and only the proxy decryption module a can retrieve the key from the envelope . the present invention can be practiced in the form of a method or process for execution by a computer , or an apparatus to execute the same . for such computers , the virtual execution framework 10 , computer a 20 , computer b 30 , and computer 500 of a third party ( an auditing firm ) have been shown as subjects to control operation . however , aforementioned matters are not requirements of the present invention except that the memory space 100 is under control of the virtual execution framework 10 and that the virtual execution framework 10 is primarily responsible for enforcement : it does not mean operations according to the present invention are impracticable unless any of the entities is involved . fig8 shows relationships between data and modules that are uploaded or downloaded to / from the memory space 100 , and associated acting subjects in a table format . though it summarizes what has been described thus far , these relationships are intended to show that acting subjects are provided with freedom except for enforcement exercised by the virtual execution framework 10 . meanwhile , since the present invention does not fully permit human acts themselves to function as acting subjects , description of acting subjects should be permitted in claims depending on patent requirements of different countries . various modifications and applications could occur to those skilled in the art so that such entities independently or cooperatively control operations without departing from the scope of the invention . control of the memory space 100 by the virtual execution framework 10 may be realized by a program including codes for execution by a computer , and the program may be loaded as a program constituting part of a component that functions as the virtual execution framework 10 or the memory space 100 under control of the framework 10 . alternatively , the memory space 100 or its control by the virtual execution framework 10 may be realized in a wired logic ( a logic circuit ) that is constructed in hardware ( mainly for the purpose of enhanced processing speed ). the memory space 100 can be provided as a cloud service as an act of a service provider . offering of the external storage 400 can be viewed as ( part of ) a system that provides storage media for an archival purpose . such provisioning may also be configured to automatically occur when the amount of data stored on the computer a 20 has exceeded a certain limit or when the amount of data stored on the computer b 30 has exceeded a certain limit .