JP2008299683A - Security method for information recording medium, information processing device, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To allow a plurality of information processing devices to share an information recording medium safely without needing cumbersome processing. <P>SOLUTION: Each secret key SK(i) is stored in a recording part 13 of each PC 10-i (i belongs to a set ä1, ..., n}). Each code text IBE(MPK, ID(i), KA) in which a common key KA is encrypted by an ID-BASE encryption system using a master public key MPK and identification information ID(i) of each PC 10-i is stored in a USB memory 20. Each PC 10-i decrypts the code text IBE(MPK, ID(i), KA) stored in the USB memory 20 using its own secret key SK(i) to extract a common key KA. Then, each PC 10-i generates another code text SE(KA, M(i)) of plain text M(i) using the extracted common key KA, and stores it in the USB memory 20. Each PC 10-i decrypts the code text SE(KA, M(i)) read from the USB memory 20 using the extracted common key KA. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a technology for concealing information, and more particularly to a technology for concealing and storing information in an information recording medium shared by a plurality of information processing apparatuses.

  It is important to prevent leakage of data stored in a portable information recording medium shared by a plurality of information processing apparatuses such as a USB (universal serial bus) memory. As a countermeasure, conventionally, a method of encrypting data by a common key encryption method and storing it in an information recording medium has been used. In this case, a general method is to encrypt the data M stored in the information recording medium with the common key K of the common key cryptosystem and store only the ciphertext C in the information recording medium. The common key K is generally stored in the information processing apparatus or stored in the form of a password by the user.

  However, in the method of storing the common key K in the information processing apparatus, it is necessary to share the common key K among a plurality of information processing apparatuses that share the information recording medium. However, the process of sharing the common key K, which is secret information, with a plurality of information processing devices in advance is complicated. Further, in the method of creating the common key K using a password, the user must store the password and enter the password for each information processing apparatus. Such processing is also complicated. Furthermore, in general, the length of a password considering the convenience of the user is not sufficiently long in terms of cryptography. Therefore, the ciphertext C generated using such a common key K is easily deciphered and has a security problem. These problems apply not only when a plurality of information processing apparatuses share a portable information recording medium, but also when a plurality of information processing apparatuses share a non-portable information recording medium.

On the other hand, the present applicant devised a method for solving such a problem and filed a patent application thereof (Japanese Patent Application No. 2007-113708 (unpublished)).
In the method of Japanese Patent Application No. 2007-113708, first, in the registration process, each information processing device PC (i) (i∈ {1, ..., n}, where n is an integer of 2 or more) sharing the information recording medium. Each corresponding public key cryptosystem secret key SK (i) is stored in the storage unit of the information processing device PC (i) corresponding to the secret key SK (i), and stored in each information processing device PC (i). Each ciphertext PE (PK (i), KA) obtained by encrypting the common key KA of the common key cryptosystem using the public key PK (i) of the corresponding public key cryptosystem is stored in the information recording medium.

  The information processing device PC (p) (p∈ {1, ..., n}) that performs plaintext encryption reads the ciphertext PE (PK (p), KA) from the information recording medium and stores it in the storage unit. The ciphertext PE (PK (p), KA) is decrypted using the encrypted secret key SK (p), the common key KA is extracted, and the plaintext M (p) is encrypted using the common key KA SE (KA, M (p)) is generated, and the ciphertext SE (KA, M (p)) is stored in the information recording medium.

  Then, the information processing apparatus PC (q) (q∈ {1,..., N}) that decrypts the ciphertext SE (KA, M (p)) receives the ciphertext PE (PK (q)) from the information recording medium. , KA) and ciphertext SE (KA, M (p)), and decrypts the ciphertext PE (PK (q), KA) using the secret key SK (q) stored in the storage unit. KA is extracted, and the ciphertext SE (KA, M (p)) is decrypted using the common key KA to extract plaintext M (p).

In this process, a complicated process for sharing the common key KA in advance between the information processing apparatus PC (p) and the information processing apparatus PC (q) is unnecessary. In the case of this processing, even if the data length of the common key KA is cryptographically safe, the convenience for the user is not lowered.
“BUFFALO” homepage, [May 18, 2007 search], Internet <URL http://buffalo.jp/products/slw/keitai.html>

However, the method of Japanese Patent Application No. 2007-113708 has room for further improvement in convenience.
That is, in the method of Japanese Patent Application No. 2007-113708, in the registration process, the common key of the common key cryptosystem is used using the public key PK (i) of the public key cryptosystem corresponding to each information processing apparatus PC (i) to be registered. Each ciphertext PE (PK (i), KA) obtained by encrypting KA is stored in the information recording medium. However, the public key PK (i) is just an enumeration of numbers, and just looking at the public key PK (i) determines whether or not it really belongs to the information processing device PC (i) to be registered. Can not. Therefore, in order to appropriately perform the registration process, it is necessary to strictly associate the information processing apparatus PC (i) to be registered with its public key PK (i).

In the method of Japanese Patent Application No. 2007-113708, the registration process is performed by associating the information processing apparatus PC (i) to be registered with its public key PK (i) by the following method.
First, an unregistered information processing device PC (s) generates a public key cryptography secret key SK (s) and a public key PK (s), and uses the secret key SK (s) as the information processing device PC (s). And the public key PK (s) is stored in the information recording medium (registration application).
Next, the ciphertext PE (PK (t), KA) (t∈ {1, ..., n}) is stored in the information recording medium, and the private key SK (t) is stored in its own storage unit The registered information processing device PC (t) reads the ciphertext PE (PK (t), KA) from the information recording medium, and uses the secret key SK (t) stored in the storage unit to encrypt the ciphertext PE (PK Decrypt (t), KA) to extract the common key KA. Further, the information processing device PC (t) reads the public key PK (s) from the information recording medium, and encrypts the common key KA using the public key PK (s), and the ciphertext PE (PK (s), KA ) And the ciphertext PE (PK (s), KA) is stored in the information recording medium (registration approval).

  As described above, in the method of Japanese Patent Application No. 2007-113708, it is necessary to strictly associate the information processing apparatus PC (i) to be registered with its public key PK (i), and thus information to be newly registered. The processing device PC (s) stores the public key PK (s) in the information recording medium (registration application), and another registered information processing device PC (t) reads the public key PK (s ) To register the information processing apparatus PC (s) (registration approval).

  The present invention has been made in view of these points, and can register a new information processing apparatus without performing complicated processing such as registration application and registration approval, and a plurality of information processing apparatuses can safely store information recording media. The purpose is to provide technology that can be shared.

  In the present invention, in order to solve the above problem, a common master secret key is assigned to each information processing apparatus PC (i) (i∈ {1,..., N}, n is an integer of 2 or more). Identification information ID (i) for identifying each information processing device PC (i) with MPK as a common master public key for each information processing device PC (i) generated using the master secret key MSK SK (i) is a secret key of the ID-BASE encryption method generated using the master secret key MSK. The process of storing the secret key SK (i) in the storage unit of the information processing device PC (i) corresponding to the secret key SK (i), the master public key MPK, and the identification information ID (i) A registration process comprising: storing each ciphertext IBE (MPK, ID (i), KA), which is obtained by encrypting the common key KA of the common key encryption system by the ID-BASE encryption system, in an information recording medium; The process of reading the ciphertext IBE (MPK, ID (p), KA) from the information recording medium by the external reading unit of any of the information processing devices PC (p) (p∈ {1, ..., n}) And the common key recovery unit of the information processing apparatus PC (p) decrypts the ciphertext IBE (MPK, ID (p), KA) using the secret key SK (p) stored in the storage unit. The process of extracting the key KA and the encryption unit of the information processing device PC (p) generates a ciphertext SE (KA, M (p)) obtained by encrypting the plaintext M (p) using the common key KA. And the external writing unit of the information processing device PC (p) records the ciphertext SE (KA, M (p)) as information. A process of storing in the body, a writing process comprising: an external reading unit of any of the information processing devices PC (q) (q∈ {1,..., N}) from the information recording medium to the ciphertext IBE (MPK, ID (q), KA) reading process, the external reading unit of the information processing device PC (q) reads the ciphertext SE (KA, M (p)) from the information recording medium, The common key recovery unit of the information processing device PC (q) decrypts the ciphertext IBE (MPK, ID (q), KA) using the secret key SK (q) stored in the storage unit to obtain the common key KA. The process of extracting, and the process of the decryption unit of the information processing device PC (q) decrypting the ciphertext SE (KA, M (p)) using the common key KA and extracting the plaintext M (p) And a reading process comprising:

  Here, in the registration process of the present invention, the identification information ID (i) for identifying the information processing apparatus PC (i) to be registered and the master public key MPK common to all information processing apparatuses are used, and the ID Generates ciphertext IBE (MPK, ID (i), KA) using the -BASE encryption method and stores it in the information recording medium. In this process, the registration application process in which the information processing apparatus to be registered stores its own public key in the information recording medium as in the method of Japanese Patent Application No. 2007-113708 becomes unnecessary. For example, the information processing device PC (r) (rε {1,..., N}) that performs registration first generates the common key KA, and the master public key MPK and one of the information processing devices PC (u ) (U∈ {1, ..., n}) and identification information ID (u), each ciphertext IBE ( The registration process can be performed simply by generating MPK, ID (u), KA) and storing the ciphertext IBE (MPK, ID (u), KA) in the information recording medium. Also, the encrypted text IBE (MPK, ID (t), KA) (t∈ {1, ..., n}) is stored in the information recording medium, and the secret key SK (t) is stored in its own storage unit. One of the information processing devices PC (t) reads the ciphertext IBE (MPK, ID (t), KA) from the information recording medium, and uses the secret key SK (t) to encrypt the ciphertext IBE (MPK, ID ( t), KA) is decrypted to extract the common key KA, and the identification information ID for identifying the master public key MPK and one of the information processing devices PC (g) (g∈ {1, ..., n}) (g) is used to generate each ciphertext IBE (MPK, ID (g), KA) by encrypting the common key KA using the ID-BASE encryption method, and the ciphertext IBE (MPK, ID (g), KA) ) Can be stored in the information recording medium.

  Further, in the processing of the present invention, complicated processing for sharing the common key KA in advance between the information processing device PC (p) and the information processing device PC (q) is unnecessary. In the case of this processing, even if the data length of the common key KA is cryptographically safe, the convenience for the user is not lowered.

Preferably, in the present invention, the ciphertext IBE (MPK, ID (r), KA) (r∈ {1,..., N}) is stored in the information recording medium, and the secret key SK is stored in its own storage unit. The information processing device PC (r) storing (r) reads the ciphertext IBE (MPK, ID (r), KA) from the information recording medium, and the secret key SK (r) stored in the storage unit ciphertext IBE using (MPK, ID (r), KA) and the process of extracting the common key KA to decode, and generating a new common key KA _{new new,} the information recording medium processing apparatus from PC ( p) (ciphertext SE (KA, M (p)) using the common key KA and the process of reading the ciphertext SE (KA, M (p)) corresponding to (p∈ {1, ..., n}) ) To extract plaintext M (p) and generate a ciphertext SE (KA _new , M (p)) by encrypting each plaintext M (p) using a _new common key KA _new and process, perform the re-encryption process comprising the steps of storing the ciphertext _{SE (KA new, M (p} )) to the information recording medium, and further, the master public key MPK and identification Using the broadcast ID (p), ID-BASE cryptosystem ciphertext new common key KA _{new new} encrypted by IBE (MPK, ID (p) , KA new) generates a ciphertext IBE (MPK, ID (p), KA _new ) are stored in the information recording medium, and the re-registration process is performed.

  Thereby, the common key can be updated. This update of the common key can be used for registration deletion processing, for example. In that case, the re-registration process is executed for the information processing apparatus PC (s) other than the information processing apparatus PC (w) (w∈ {1,. The stored ciphertext SE (KA, M (p)) (pε {1,..., N}) is deleted from the information recording medium. In this case, even if the old common key KA remains in the information processing apparatus PC (w) whose registration has been deleted, the information processing apparatus PC (w) can read the plaintext M from the information stored in the information recording medium. (p) cannot be decrypted. As a result, safety is improved.

  Preferably, in the present invention, the encryption unit of the information processing apparatus PC (p) generates a ciphertext SE (KA, M (p)) obtained by encrypting the plaintext M (p) using the common key KA. In the process, the block division unit of the encryption unit divides the plaintext M (p) into X (X ≧ 2) blocks MB (p, x) (x∈ {1,..., X}). The process, the random number generation unit of the encryption unit generates a random number E (p) for each plaintext M (p), and the external writing unit of the information processing apparatus PC (p) And a function value obtained by substituting at least the block number x of block MB (p, x) and the random number E (p) into a predetermined function π by the function calculation unit of the encryption unit. The process of calculating IV = π (x, E (p)), and the block encryption unit of the encryption unit uses the common key KA and sets each block MB (p, x) using the function value IV as an initial vector. Encrypted and calculated ciphertext SE (KA, M (p)) from ciphertext of all blocks MB (p, x) A step of generating to a process comprising a.

  In the preferred method, a random number E (p) is generated for each plaintext M (p), and a function value IV = π (x, E (p) in which a block number x and a random number E (p) are substituted into a predetermined function π. The ciphertext SE (KA, M (p)) is generated by block cipher using)). In this case, even if the value between blocks obtained by dividing a plaintext M (p) is the same, the ciphertext between the blocks is not the same. Furthermore, the block MB (p, x) of the block number x obtained by dividing the plaintext M (p) and the block MB of the same block number x obtained by dividing another plaintext M (p ′) ( Even if p ′, x) are the same, their ciphertexts are not the same. As a result, it is possible to prevent the plaintext identity from being inferred from the identity of the ciphertext and the safety from being lowered. Such a block encryption method is particularly suitable for the use of the present invention in which a plurality of plaintexts are repeatedly encrypted with the same common key KA and the generated plurality of ciphertexts are stored in the same information recording medium. .

  Further, preferably, when performing encryption using the random number E (p), the registration process uses the master public key MPK and the identification information ID (i), and the ciphertext authentication key by the ID-BASE encryption method. Each ciphertext IBE (MPK, ID (i), KB) obtained by encrypting KB is stored in an information recording medium. Further, in the writing process, the information processing device PC (p) reads the ciphertext IBE (MPK, ID (p), KB) from the information recording medium, and uses the secret key SK (p) stored in the storage unit. The ciphertext IBE (MPK, ID (p), KB) is decrypted to extract the ciphertext authentication key KB, and at least the ciphertext authentication key KB, the random number E (p), and the ciphertext generated by the encryption unit Generate an authenticator AU (KB, E (p), SE (KA, M (p))) for the ciphertext SE (KA, M (p)) using SE (KA, M (p)) The authenticator AU (KB, E (p), SE (KA, M (p))) is stored in the information recording medium.

  In this way, the ciphertext SE (KA, M (p)) using the ciphertext authentication key KB, the random number E (p), and the ciphertext SE (KA, M (p)) generated by the encryption unit. By generating the authenticator AU (KB, E (p), SE (KA, M (p))), the reliability of the ciphertext SE (KA, M (p)) can be improved. Furthermore, the random number E (p) used to generate the ciphertext SE (KA, M (p)) is diverted to the generation of the authenticator AU (KB, E (p), SE (KA, M (p))). Therefore, it is not necessary to generate a new random number for generating an authenticator or store a random number other than the random number E (p) in the storage unit in order to verify the authenticator.

  As described above, in the present invention, a new information processing apparatus can be registered without performing complicated processes such as registration application and registration approval, and a plurality of information processing apparatuses can safely share an information recording medium.

  The best mode for carrying out the present invention will be described below with reference to the drawings.

[First Embodiment]
First, a first embodiment of the present invention will be described.
<Configuration>
FIG. 1 is a conceptual diagram illustrating the overall configuration of an information recording medium sharing system 1 according to this embodiment.

  As illustrated in FIG. 1, the information recording medium sharing system 1 includes n (n is an integer of 2 or more) personal computers (hereinafter referred to as “PC”) 10-1 to n (“information processing apparatus PC ( i) (corresponding to i∈ {1,..., n} ”), the USB memory 20 (corresponding to“ information recording medium ”) shared between these PCs 10-1 to n, and ID-BASE encryption An ID-BASE key generation device 30 for generating a key for (IBE: Identity Based Encryption).

  The PCs 10-1 to 10-n store the ciphertext in the USB memory 20 and share information with each other by decrypting the plaintext from the ciphertext stored in the USB memory 20. In addition, the PCs 10-1 to n of this embodiment and the ID-BASE key generation device 30 are connected by a dedicated line or a communication path that is secured by encryption of communication information.

  In this embodiment, a personal computer is illustrated as an example of an information processing apparatus, and a USB memory is illustrated as an example of an information recording medium. However, the present invention is not limited to this. ID-BASE encryption is an encryption method that uses identification information (for example, an e-mail address, URL, user name, etc.), which is unique information of a user, as a public key. Regarding ID-BASE encryption, for example, “D. Boneh, M. Franklin,“ Identity based encryption from the Weil pairing ”, Crypto 2001, Lecture Notes in Computer Science, Vol. 2139, Springer-Verlag, pp.213-229 , 2001 (Reference 1) ".

  FIG. 2A is a block diagram illustrating the functional configuration of the PC 10-i (iε {1,..., N}) according to the present embodiment, and FIG. 2B illustrates the USB memory 20 according to the present embodiment. It is the block diagram which illustrated the functional composition of.

  As shown in FIG. 2A, the PC 10-i includes an external writing unit 11a, an external reading unit 11b, an internal writing unit 12a, an internal reading unit 12b, a storage unit 13, and a common key generation unit 14a. , Key concealment unit 14c, common key restoration unit 14d, encryption unit 14e, decryption unit 14f, deletion unit 14g, application execution unit 14h, control unit 14i, temporary memory 14j, and input unit 15, an output unit 16, and a communication unit 17. As shown in FIG. 2B, the USB memory 20 includes an interface unit 21, a storage unit 22, and a control unit 23. The storage unit 22 includes areas 22a to 22c. .

  The PC 10-i of this embodiment is a Neumann computer having a communication function, which includes a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory), a LAN card, and the like. By reading, the functional configuration shown in FIG.

  Specifically, an OS (Operating System) and application software are installed in the PC 10-i in this example. When the USB memory 20 is mounted and mounted on the USB port of the PC 10-i, the security program is read from the area 22a of the storage unit 22 of the USB memory 20 into the PC 10-i. Then, when the CPU of the PC 10-i executes a security program or application software on the OS, the functional configuration shown in FIG. Instead of the PC 10-i reading the security program from the USB memory 20, each PC 10-i may be configured to read the security program from another recording medium, or the security program may be downloaded and read via the Internet or the like. It may be a configuration. In such a case, it is not necessary to store the security program in the USB memory 20.

<Processing>
Next, the processing of this embodiment will be described.
The processing according to this embodiment includes (1) a process of distributing a master public key MPS and a secret key SK (i) to each PC 10-i (key distribution process), and (2) n PCs 10-i sharing the USB memory 20. Are registered in the USB memory 20 (registration process), (3) the PC 10-i writes the ciphertext to the USB memory 20 (write process), and (4) the PC 10-i reads the ciphertext from the USB memory 20. (5) Deletion of registration from the USB memory 20 (deletion process). Hereinafter, each process will be described.

[Key distribution process]
First, the key distribution process will be described.
In the key distribution process, the ID-BASE key generation device 30 follows the well-known ID-BASE encryption algorithm (see, for example, Reference 1), the master public key MPK common to all PCs 10-i, and each PC 10- An i-specific secret key SK (i) is generated and delivered to each PC 10-i. An example of this process will be described below.

<Example of key generation processing>
First, the random number generation unit of the ID-BASE key generation device 30 randomly determines a point (sx, sy) on the elliptic curve E. The information of the point (sx, sy) is securely stored in the memory of the ID-BASE key generation device 30 as the master secret key MSK. Further, the parameter setting unit of the ID-BASE key generation device 30 determines the integer parameter P. Then, the scalar multiplication unit calculates a scalar multiplication value P · MSK (a point on the elliptic curve E) obtained by multiplying the master secret key MSK by P on the elliptic curve E. Then, the ID-BASE key generation device 30 outputs MPK = (P, P · MSK) as a master public key. For scalar multiplication on an elliptic curve, for example, a known elliptic scalar multiplication method such as a binary expansion method or a window NAF method is used. The scalar multiplication unit of the ID-BASE key generation apparatus 30 uses the identification information ID (i), which is information unique to each PC 10-i, and the master secret key MSK, and uses the master secret key MSK on the elliptic curve E. Is a scalar multiplication value ID (i) · MSK (a point on the elliptic curve E). The ID-BASE key generation apparatus 30 outputs the calculation result as a secret key SK (i) (end of explanation of << Example of key generation process >>).

  The ID-BASE key generation apparatus 30 uses each key pair (MPK, SK (i)) of the master public key and the secret key generated as in the above example, and each PC 10-i corresponding to each SK (i). Send to. Each PC 10-i receives the key pair (MPK, SK (i)) and stores it in its storage unit 13.

[Registration process]
Next, the registration process will be described.
FIG. 3 is a diagram showing each functional block and data flow related to the registration process of this embodiment, and FIG. 9 is a sequence diagram for explaining the registration process of this embodiment. In the following, an example in which the PC 10-1 performs registration processing between the PC 10-1 and the PC 10-2 will be described. Further, it is assumed that an OS, a security program, and application software are installed in the PC 10-i as a premise of each process. Although not described below, each process is executed under the control of the control units 14i and 23, and each data in the calculation process in the PC 10-i is read and written to the temporary memory 14j one by one.

  First, when the USB memory 20 is mounted and mounted on the PC 10-1, the output unit 16 of the PC 10-1 displays an input instruction for the identification information ID (i) of the PC 10-i to be registered. In accordance with this input instruction, the user inputs the identification information ID (i) of the PC 10-i to be registered into the input unit 15 (FIG. 3 (a)). In the example of this embodiment, the identification information ID (1) and ID (2) of the PCs 10-1 and PC-2 are input to the input unit 15 and stored in the storage unit 13 (step S1).

  Next, the common key generation unit 14a of the PC 10-1 generates (for example, randomly generates) the common key KA and outputs it (step S2). The internal reading unit 12b reads the master public key MPK and the identification information ID (1) and ID (2) from the storage unit 13. The common key KA, master public key MPK, and identification information ID (1), ID (2) are input to the key concealment unit 14c. The key concealment unit 14c uses the master public key MPK and the identification information ID (1) and ID (2), and encrypts each ciphertext IBE () obtained by encrypting the common key KA of the common key encryption method by the ID-BASE encryption method. MPK, ID (1), KA) and IBE (MPK, ID (2), KA) are generated (step S3). Below, the process of step S3 when using the master public key MPK generated in the above-mentioned << Example of key generation process >> is illustrated. Note that the identification information ID (i) in this example is an integer, for example, information in which a character string of a mail address is expressed numerically.

<< Example of processing in step S3 >>
First, the random number generator of the key concealment unit 14c randomly determines the point r = (rx, ry) on the above-described elliptic curve E, and the scalar multiplication unit of the key concealment unit 14c determines the point r on the elliptic curve E. Is multiplied by ID (i) on the elliptic curve E, and a scalar multiplication value ID (i) · r (a point on the elliptic curve E) is calculated. Further, the scalar multiplication unit of the key concealment unit 14c is a scalar multiplication value P · r (ellipse) obtained by multiplying the point r on the elliptic curve E by P (P is a part of the master public key MPK) on the elliptic curve E. Point on curve E).

  Next, the pairing calculation unit of the key concealment unit 14c substitutes the function value CK () by substituting ID (i) · r and P · MSK (part of the master public key MPK) into the known pairing function Pair. i) = Pair (ID (i) · r, P · MSK) is calculated. The pairing function Pair is, for example, Weil Pairing or Tate Pairing, and satisfies the relationship of Pair (ID (i) · r, P · MSK) = Pair (P · r, ID (i) · MSK) ( See Reference 1 and “Alfred. J. Menezes, ELLIPTIC CURVE PUBLIC KEY CRYPTOSYSTEMS, KLUWER ACADEMIC PUBLISHERS, ISBN 0-7923-9368-6, pp. 61-81 (reference 2)”). Next, the common key encryption unit of the key concealment unit 14c encrypts the common key KA by using the function value CK (i) as a key and the common key encryption method (Camellia, AES, etc.), and the ciphertext CE (CK (CK ( i), KA) and the scalar multiplication value P · r are output as ciphertext IBE (MPK, ID (i), KA) = (CE (CK (i), KA), P · r) ( << End of description of example of processing in step S3}.

  The identification information ID (1), ID (2) read from the storage unit 13 by the internal reading unit 12b, and the ciphertexts IBE (MPK, ID (1), KA), IBE (MPK, ID (2), KA) is sent to the external writing unit 11a. The external writing unit 11a sends these to the interface unit 21 (FIG. 3B) of the USB memory 20, and the interface unit 21 sends the identification information ID (1) and the ciphertext IBE (MPK, ID (1), KA). And the identification information ID (2) and the ciphertext IBE (MPK, ID (2), KA) are associated and stored in the area 22b of the storage unit 22 (step S4).

  Thus, registration of the PCs 10-1 and 2 is completed. For the sake of simplification of explanation, the case where only registration of the PCs 10-1 and 2 is performed is illustrated here. However, it is also possible for the PC 10-1 to register other PCs 10-i by a similar method. In the following, all PCs 10-i (i∈ {1,..., N}) are registered, and each identification information ID (i) and ciphertext IBE (MPK, ID (i), KA) are stored in the USB memory. It is assumed that it is stored in the area 22b of the 20 storage units 22.

[Writing process / Reading process]
Next, the writing process and the reading process of this embodiment will be described. It is assumed that the OS, security program, and application software are installed in the PC 10-i.

  FIG. 4 is a diagram showing each functional block and data flow related to the writing process of this embodiment, and FIG. 5 shows each functional block and data flow related to the reading process of this embodiment. FIG. FIG. 10 is a sequence diagram for explaining the writing process and the reading process of the present embodiment. Here, an example is shown in which the PC 10-1 writes the ciphertext to the USB memory 20 (writing process), and the PC 10-2 reads the ciphertext from the USB memory 20 and decrypts it (reading process).

  First, it is assumed that the USB memory 20 is mounted and mounted on the PC 10-1. In this state, the application execution unit 14h (FIG. 4A) of the PC 10-1 that executes application software such as Word or Excel (registered trademark) sends the ciphertext of plaintext M (1) to the control unit 14i. A write request to the USB memory 20 is made. With this as a trigger, the internal reading unit 12b of the PC 10-1 reads the identification information ID (1) from the storage unit 13 and sends it to the external reading unit 11b of the PC 10-1. The external reading unit 11b reads the ciphertext IBE (MPK, ID (1), KA) associated with the identification information ID (1) from the area 22b (FIG. 4B) of the storage unit 22 of the USB memory 20. Is read (step S21).

  The ciphertext IBE (MPK, ID (1), KA) is sent to the common key restoration unit 14d (FIG. 4A) of the PC 10-1. Also, using this as a trigger, the internal reading unit 12b of the PC 10-1 reads the secret key SK (1) from the storage unit 13 and sends the secret key SK (1) to the common key restoration unit 14d. The common key restoration unit 14d decrypts the ciphertext IBE (MPK, ID (1), KA) using the secret key SK (1) and decrypts the common key KA [KA = PD (SK (1), IBE (MPK, ID (1), KA))] is extracted, and the common key KA is sent to the encryption unit 14e (step S22). Hereinafter, a decryption process of the ciphertext IBE (MPK, ID (1), KA) encrypted in << Example of process in step S3 >> will be exemplified.

<< Example of processing in step S22 >>
In this example, first, the pairing calculation unit of the common key restoration unit 14d adds the ciphertext IBE (MPK, ID (i), KA) = (CE (CK (i), KA)) to the above-described pairing function Pair. , P · r) and Pair (P · r, ID (1) · MSK) are calculated by substituting P · r, which is a part of P · r, and the secret key SK (1) = ID (1) · MSK. Here, from the property of the pairing function Pair (Pair (ID (i) · r, P · MSK) = Pair (P · r, ID (i) · MSK)), Pair (P · r, ID ( 1) · MSK) = Pair (ID (1) · r, P · MSK) = CK (i). Next, the common key decryption unit of the common key restoration unit 14d uses this Pair (P · r, ID (1) · MSK) = CK (i) and uses the ciphertext IBE (MPK, ID (i), KA). = (CE (CK (i), KA), P · r) is part of CE (CK (i), KA) and is extracted by extracting KA (<< Example of processing in step S22 >>) ).

  Further, the application execution unit 14h of the PC 10-1 sends the plaintext M (1) to the encryption unit 14e, and the encryption unit 14e uses the common key KA and the plaintext M (1) by the common key encryption method. A ciphertext SE (KA, M (1)) is generated by encrypting (step S23). SE (α, β) means a ciphertext obtained by encrypting β using the common key α by a predetermined common key cryptosystem. Examples of the common key encryption method include Camellia and AES.

  The generated ciphertext SE (KA, M (1)) is sent to the interface unit 21 of the USB memory 20 by the external writing unit 11a, and is stored in the area 22c (FIG. 4B) of the storage unit 22 therefrom. (Step S24 / End of writing process).

Next, the USB memory 20 is mounted and mounted on the PC 10-2. In this state, the application execution unit 14h of the PC 10-2 makes a request for reading the ciphertext SE (KA, M (1)) from the USB memory 20 to the control unit 14i. With this as a trigger, the control unit 14 i gives an instruction to the external reading unit 11 b (FIG. 5A) of the PC 10-2, and the external reading unit 11 b of the PC 10-2 has an area 22 c ( The ciphertext SE (KA, M (1)) is read from FIG. 5B (step S25), and the ciphertext IBE (MPK, ID (2), KA) is further read from the area 22b (step S26). Next, the internal reading unit 12b (FIG. 5A) of the PC 10-2 reads the secret key SK (2) from the storage unit 13. Then, the common key recovery unit 14d of the PC 10-2 decrypts the ciphertext IBE (MPK, ID (2), KA) using the secret key SK (2) and uses the common key KA [KA = PD (SK ( 2), IBE (MPK, ID (2), KA))] is extracted (step S27). After that, the decryption unit 14f of the PC 10-2 decrypts the ciphertext SE (KA, M (1)) using the common key KA to obtain plaintext M (1) [M (1) = SD (KA, SE (KA, M (1))] is extracted (step S28), where SD (α, β) means a result value obtained by decrypting β with the common key α by the common key cryptosystem.
The extracted plaintext M (1) is sent to the application execution unit 14h of the PC 10-2 (end of the reading process).

[Deleting process]
Next, the deletion process of this embodiment will be described. It is assumed that the OS, security program, and application software are installed in the PC 10-i.

  6 to 8 are diagrams showing each functional block and data flow related to the deletion process of this embodiment. FIG. 11 is a sequence diagram for explaining the deletion process of this embodiment.

  In the deletion process of the present embodiment, the data of the PC 10-w to be registered and deleted is not only deleted from the USB memory 20, but the common key KA used for plaintext encryption is reset in association with this, and the USB memory 20 is reset. Regenerate the stored ciphertext. As a result, it is possible to prevent the PC 10-w whose registration has been deleted from decrypting the ciphertext stored in the USB memory 20 using the common key KA acquired in the past. In the following, an example in which the PC 10-1 deletes the registration of the PC 10-2 from the USB memory 20 is shown.

  First, it is assumed that the USB memory 20 is mounted and mounted on the PC 10-1. In this state, the user designates the registration deletion target as follows, for example. First, the external reading unit 11b reads all the identification information ID (i) from the area 22b of the storage unit 22 of the USB memory 20. Each identification information ID (i) is output from the output unit 16 (for example, displayed on the screen). The user inputs the identification information ID (w) to be deleted to the input unit 15 while referring to the output identification information ID (i). In this example, it is assumed that the identification information ID (2) is input to the input unit 15. Based on the input result, the control unit 14i executes the deletion process as follows.

  First, the internal reading unit 12b of the PC 10-1 reads the identification information ID (1) from the storage unit 13, and sends the identification information ID (1) to the external reading unit 11a (FIG. 6A). The external reading unit 11a (FIG. 6A) obtains the ciphertext IBE (MPK, ID) associated with the identification information ID (1) from the area 22b (FIG. 6B) of the storage unit 22 of the USB memory 20. (1), KA) is read (step S31).

Next, the internal reading unit 12b of the PC 10-1 reads the secret key SK (1) from the storage unit 13 and sends the secret key SK (1) to the common key restoration unit 14d. Using the secret key SK (1), the common key restoration unit 14d decrypts the ciphertext IBE (MPK, ID (1), KA) read from the USB memory 20 and uses the common key KA [KA = PD (SK (1), IBE (MPK, ID (1), KA))] is extracted (step S32). Further, the common key generation unit 14a of the PC 10-1 generates a new common key KA _new (step S33).

  Further, the external reading unit 11b of the PC 10-1 reads the ciphertext SE (KA, M (i)) (i∈ {1,..., N}) corresponding to the PC 10-i from the USB memory 20 (Step S1). S34). The decryption unit 14f of the PC 10-1 uses the common key KA obtained by the common key restoration unit 14d to decrypt the ciphertext SE (KA, M (i)) to obtain plaintext M (i) [M (i ) = SD (KA, SE (KA, M (i))] is extracted (step S35).

Next, each extracted plaintext M (i) and a new common key KA _new are input to the encryption unit 14e of the PC 10-1, and the encryption unit 14e uses the new common key KA _new. A ciphertext SE (KA _new , M (i)) obtained by encrypting each plaintext M (i) is generated (step S36). Each ciphertext SE (KA _new , M (i)) is sent to the external writing unit 11a of the PC 10-1. The external writing unit 11a sends the ciphertext SE (KA _new , M (i)) to the interface unit 21 of the USB memory 20, and the interface unit 21 stores these in the area 22c of the storage unit 22 (FIG. 6B). (Step S37).

  Next, the external reading unit 11 b (FIG. 7A) of the PC 10-1 moves from the area 22 b of the storage unit 22 of the USB memory 20 to the PC 10-s (s ≠ 2) other than the PC 10-2 to be deleted. The identification information ID (s) is read (step S38).

The identification information ID (s) read in step S38 and the common key KA _new newly generated in step S33 are input to the key concealment unit 14c. The internal reading unit 12b reads the master public key MPK from the storage unit 13, and the master public key MPK is input to the key concealment unit 14c. Then, the key concealment unit 14c uses the master public key MPK and the identification information ID (s), and the ciphertext IBE (MPK, ID (s) obtained by encrypting the _new common key KA _new by the ID-BASE encryption method. , KA _new ) is generated (step S39). Each ciphertext IBE (MPK, ID (s), KA _new ) is sent to the interface unit 21 of the USB memory 20 by the external writing unit 11a of the PC 10-1. The interface unit 21 stores each ciphertext IBE (MPK, ID (s), KA _new ) in the area 22b of the storage unit 22 of the USB memory 20 in association with the identification information ID (s) (FIG. 7). (B)) (step S40).

  Next, the deletion unit 14g (FIG. 8A) of the PC 10-1 issues a deletion command, and the external writing unit 11a that has received the instruction instructs the area 22c of the storage unit 22 of the USB memory 20 (FIG. 8B). The ciphertext SE (KA, M (i)) is deleted from the ID, and the IBE (MPK, ID (i), KA) and the identification information ID (2) are deleted from the area 22b (FIG. 8B) (step S41). ).

[Second Embodiment]
Next, a second embodiment of the present invention will be described.
This embodiment is a modification of the first embodiment, in which a PC other than the PC 10-1 that generated the common key KA also executes the registration process. Below, only the registration process of this form is demonstrated.

[Registration process]
As a premise, the PCs 10-1 and 2 are registered as in the first embodiment, and ciphertexts IBE (MPK, ID (1), KA), IBE (MPK, ID (2), KA) are stored in the USB memory 20. It is assumed that the secret key SK (i) is stored in the storage unit of each PC 10-i. In this embodiment, an example will be described in which the PC 10-2 other than the PC 10-1 that has generated the common key KA performs the registration process of the PC 10-3.

FIG. 12 is a sequence diagram for explaining the registration process of this embodiment.
First, when the USB memory 20 is mounted and mounted on the PC 10-2, the output unit 16 (FIG. 2) of the PC 10-2 displays an input instruction for the identification information ID (i) of the PC 10-i to be registered. In accordance with this input instruction, the user inputs the identification information ID (i) of the PC 10-i to be registered into the input unit 15. In the example of the present embodiment, the identification information ID (3) of the PC 10-3 is input to the input unit 15 and stored in the storage unit 13 (step S51).

  Next, the external reading unit 11b of the PC 10-2 reads the ciphertext IBE (MPK, ID (2), KA) corresponding to the identification information ID (2) from the area 22b of the storage unit 22 of the USB memory 20 (step) S52). Next, the internal reading unit 12b of the PC 10-2 reads the secret key SK (2) from the storage unit 13. Then, the common key restoration unit 14d of the PC 10-2 decrypts the ciphertext IBE (MPK, ID (2), KA) using the secret key SK (2), and the common key KA [KA = PD (SK ( 2), IBE (MPK, ID (2), KA))] is extracted (step S53).

  Next, the internal reading unit 12b reads the master public key MPK and the identification information ID (3) from the storage unit 13. The common key KA, the master public key MPK, and the identification information ID (3) are input to the key concealment unit 14c. The key concealment unit 14c uses the master public key MPK and the identification information ID (3), and encrypts each ciphertext IBE (MPK, ID (3) obtained by encrypting the common key KA of the common key encryption method by the ID-BASE encryption method. ), KA) is generated (step S54).

  The identification information ID (3) read from the storage unit 13 by the internal reading unit 12b and the ciphertext IBE (MPK, ID (3), KA) generated by the key concealment unit 14c are sent to the external writing unit 11a. . The external writing unit 11a sends these to the interface unit 21 of the USB memory 20, and the interface unit 21 associates the identification information ID (3) with the ciphertext IBE (MPK, ID (3), KA) and stores them. The data is stored in the area 22b of the unit 22 (step S55).

  Thus, the registration process of the PC 10-3 is completed. The registered PC 10-3 can execute registration processing of other PCs 10 by the same processing. As a modification of the second embodiment, after the PC 10-1 that generates the common key KA stores the ciphertext IBE (MPK, ID (1), KA) in the USB memory 20, the ciphertext IBE (MPK , ID (1), KA) may be decrypted to obtain a common key KA, and ciphertext IBE (MPK, ID (i), KA) corresponding to another PC 10-i may be generated.

[Third Embodiment]
Next, a third embodiment of the present invention will be described.
The present embodiment is a modification of the first embodiment, in which an authenticator is attached to the ciphertext stored in the USB memory to prevent forgery of the ciphertext, and a key for creating an authenticator for ciphertext is used. It differs from the first embodiment in that it is encrypted with the identification information ID of each PC and stored in the USB memory. Below, it demonstrates centering around difference with 1st Embodiment, and simplifies description about the matter which is common in 1st Embodiment.

<Configuration>
The overall configuration of the information recording medium sharing system of the present embodiment is the same as that of the first embodiment except that the PCs 10-1 to n are replaced with the PCs 110-1 to 110 -n and the USB memory 20 is replaced with the USB memory 20.

  FIG. 13 is a block diagram illustrating a functional configuration of the PC 110-i (iε {1,..., N}) according to this embodiment. FIG. 14 is a block diagram illustrating the functional configuration of the USB memory 20 according to this embodiment. In FIGS. 13 and 14, portions common to the first embodiment are denoted by the same reference numerals as in the first embodiment.

  As shown in FIG. 13, the PC 110-i includes an external writing unit 11a, an external reading unit 11b, an internal writing unit 12a, an internal reading unit 12b, a storage unit 13, a common key generation unit 114a, and a key concealment. 114c, common key recovery unit 114d, encryption unit 114e, decryption unit 114f, deletion unit 14g, application execution unit 14h, control unit 14i, temporary memory 14j, and ciphertext authenticator generation 114n, ciphertext verification unit 114p, input unit 15, output unit 16, and communication unit 17. The PC 110-i of this embodiment is also a Neumann computer having a communication function, and the functional configuration shown in FIG. 13 is realized by reading a predetermined program.

  As shown in FIG. 14, the functional configuration of the USB memory 20 of this embodiment is the same as that of the first embodiment, but the data stored in the storage unit 22 is different from that of the first embodiment.

<Processing>
Next, the processing of this embodiment will be described.
The processing of this embodiment can also be roughly divided into (1) key distribution process, (2) registration process, (3) write process, (4) read process, and (5) delete process. Hereinafter, each process will be described.

[Key distribution process]
The key distribution process is the same as in the first embodiment. The description is omitted here.

[Registration process]
FIG. 15 is a diagram showing each functional block and data flow related to the registration process of this embodiment, and FIG. 21 is a sequence diagram for explaining the registration process of this embodiment. In the following, an example in which the PC 110-1 performs registration processing between the PC 110-1 and the PC 110-2 will be described. Further, it is assumed that an OS, a security program, and application software are installed in the PC 110-i as a premise of each process. Although not described below, each process is executed under the control of the control units 14i and 23, and each data in the calculation process in the PC 110-i is read and written to the temporary memory 14j one by one.

First, as in the first embodiment, the identification information ID (1) and ID (2) of the PCs 10-1 and PC-2 are input to the input unit 15 (FIG. 15A) and stored in the storage unit 13. (Step S61).
Next, the common key generation unit 114a of the PC 110-1 generates (for example, randomly generates) the common keys KA and KB and outputs them (step S62). The internal reading unit 12b reads the master public key MPK and the identification information ID (1) and ID (2) from the storage unit 13. The common key KA, master public key MPK, and identification information ID (1), ID (2) are input to the key concealment unit 114c. The key concealment unit 114c uses the master public key MPK and the identification information ID (1) and ID (2), and each ciphertext IBE () obtained by encrypting the common key KA of the common key encryption method by the ID-BASE encryption method. MPK, ID (1), KA), IBE (MPK, ID (2), KA), ciphertext IBE (MPK, ID (1), KB), IBE (MPK, ID) (2), KB) is generated (step S63).

  The identification information ID (1), ID (2) read from the storage unit 13 by the internal reading unit 12b and the ciphertexts IBE (MPK, ID (1), KA), IBE (MPK, ID (2), KA), IBE (MPK, ID (1), KB), and IBE (MPK, ID (2), KB) are sent to the external writing unit 11a. The external writing unit 11a sends these to the interface unit 21 (FIG. 15B) of the USB memory 20, and the interface unit 21 sends the identification information ID (1) and the ciphertext IBE (MPK, ID (1), KA). , IBE (MPK, ID (1), KB) and the identification information ID (2) and ciphertext IBE (MPK, ID (2), KA), IBE (MPK, ID (2), KB) They are associated and stored in the area 22b of the storage unit 22 (step S64).

  Thus, registration of the PCs 110-1 and 2 ends. Here, for simplification of explanation, a case where only registration of the PCs 110-1 and 2 is performed is illustrated. However, it is also possible for the PC 110-1 to register other PCs 110-i by the same method as described above. In the following, all PCs 110-i (iε {1, ..., n}) are registered, and each identification information ID (i), ciphertext IBE (MPK, ID (i), KA), IBE (MPK , ID (i), KB) is stored in the area 22 b of the storage unit 22 of the USB memory 20.

[Writing process / Reading process]
Next, the writing process and the reading process of this embodiment will be described. It is assumed that the OS, security program, and application software are installed on the PC 110-i.

  FIG. 16 is a diagram showing each functional block and data flow related to the writing process of this embodiment, and FIG. 17 shows each functional block and data flow related to the reading process of this embodiment. FIG. FIG. 22 is a sequence diagram for explaining the writing process and the reading process of this embodiment. Here, an example is shown in which the PC 110-1 writes the ciphertext to the USB memory 20 (writing process), and the PC 110-2 reads the ciphertext from the USB memory 20 and decrypts it (reading process).

  First, it is assumed that the USB memory 20 is mounted and mounted on the PC 110-1. In this state, the application execution unit 14h (FIG. 16A) of the PC 110-1 makes a request to write the ciphertext of plaintext M (1) to the USB memory 20 to the control unit 14i. With this as a trigger, the internal reading unit 12b of the PC 110-1 reads the identification information ID (1) from the storage unit 13, and sends this to the external reading unit 11b of the PC 110-1. The external reading unit 11b reads the ciphertext IBE (MPK, ID (1), KA) associated with the identification information ID (1) from the area 22b (FIG. 16B) of the storage unit 22 of the USB memory 20. , IBE (MPK, ID (1), KB) is read (step S71).

  The ciphertexts IBE (MPK, ID (1), KA), IBE (MPK, ID (1), KB) are sent to the common key restoration unit 114d (FIG. 16 (a)) of the PC 110-1. Also, using this as a trigger, the internal reading unit 12b of the PC 110-1 reads the secret key SK (1) from the storage unit 13, and sends the secret key SK (1) to the common key restoration unit 114d. The common key restoration unit 114d decrypts the ciphertexts IBE (MPK, ID (1), KA), IBE (MPK, ID (1), KB) using the secret key SK (1), and uses the common key KA [KA = PD (SK (1), IBE (MPK, ID (1), KA))], KB [KB = PD (SK (1), IBE (MPK, ID (1), KB))] Step S72). The common key KA is sent to the encryption unit 114e of the PC 110-1, and the common key KB is sent to the ciphertext authenticator generation unit 114n. Further, the application execution unit 14h of the PC 110-1 sends the plaintext M (1) to the encryption unit 114e, and the encryption unit 114e uses the common key KA and the plaintext M (1) by the common key encryption method. A ciphertext SE (KA, M (1)) is generated by encrypting (step S73). The generated ciphertext SE (KA, M (1)) is sent to the ciphertext authenticator generation unit 114n.

  The ciphertext authenticator generation unit 114n uses at least the common key KB and the ciphertext SE (KA, M (1)) to encrypt the ciphertext authenticator AU (KB, SE) of the ciphertext SE (KA, M (1)). (KA, M (1))) is generated (step S74). The ciphertext authenticator AU (KB, SE (KA, M (1))) is generated as follows, for example.

AU (KB, SE (KA, M (1))) = HMAC (KB, SE (KA, M (1)))… (1)
HMAC (α, β) (m is an integer greater than or equal to 1), γ (+) δ is the exclusive OR of γ and δ, opad and ipad are constant bit strings, and H (σ) is σ When a hash value is used and γ | δ is a bit concatenation of γ and δ,
H ((α (+) opad) | H ((α (+) ipad) | β))… (2)
(See “Mihir Bellare, Ran Canetti and Hugo Krawczyk,“ Keying Hash Functions for Message Authentication ”, CRYPTO'96, pp1-15, 1996.”, etc.)

  The ciphertext authenticator AU (KB, SE (KA, M (1))) is not limited to the formula (2), and the ciphertext SE (KA, M (1)) is used by using the common key KB. As long as the information can prove the validity of (), any information such as an electronic signature may be used.

  The ciphertext SE (KA, M (1)) generated in this way and the ciphertext authenticator AU (KB, SE (KA, M (1))) are transferred to the USB memory 20 by the external writing unit 11a. Is stored in the area 22c (FIG. 16B) of the storage unit 22 (step S75 / end of the writing process).

  Next, the USB memory 20 is mounted and mounted on the PC 110-2. In this state, the application execution unit 14h of the PC 110-2 sends the ciphertext SE (KA, M (1)) and the ciphertext authenticator AU (KB, SE (KA, M) from the USB memory 20 to the control unit 14i. (1))) and read request. Using this as a trigger, under the control of the control unit 14i, the external reading unit 11b (FIG. 17A) of the PC 110-2 encrypts from the area 22c (FIG. 17B) of the storage unit 22 of the USB memory 20. The text SE (KA, M (1)) and the ciphertext authenticator AU (KB, SE (KA, M (1))) are read (step S76), and the ciphertext IBE (MPK, ID (2) is read from the area 22b. ), KA), IBE (MPK, ID (2), KB) are read (step S77). Next, the internal reading unit 12b (FIG. 17A) of the PC 110-2 reads the secret key SK (2) from the storage unit 13. Then, the common key recovery unit 114d of the PC 110-2 uses the secret key SK (2) to convert the ciphertexts IBE (MPK, ID (2), KA), IBE (MPK, ID (2), KB), respectively. Decrypt the common key KA (KA = PD (SK (2), IBE (MPK, ID (2), KA))), KB (KB = PD (SK (2), IBE (MPK, ID (2), KB))] is extracted (step S78).

  Thereafter, the common key KB, the ciphertext SE (KA, M (1)), and the ciphertext authenticator AU (KB, SE (KA, M (1))) are input to the ciphertext verification unit 114p of the PC 110-2. The ciphertext verification unit 114p uses the common key KB and the ciphertext authenticator AU (KB, SE (KA, M (1))), and the ciphertext SE (KA, M (1)) is valid. It is verified whether or not (step S79). For example, in the example in which the certifier AU (KB, SE (KA, M (1))) is generated by the above-described equation (2) in step S74, the ciphertext verification unit 114p of the PC 110-2 is input. HMAC (KB, SE (KA, M (1))) is calculated using the common key KB and ciphertext SE (KA, M (1)), and the operation result and the input AU (KB, SE ( It is determined whether or not KA, M (1))) = HMAC (KB, SE (KA, M (1))).

  Here, if they are not equal, it is determined that the ciphertext SE (KA, M (1)) is invalid, and the control unit 14i ends the process with an error. On the other hand, if they are equal, it is assumed that the ciphertext SE (KA, M (1)) is valid, and the decryption unit 114f of the PC 110-2 uses the common key KA to encrypt the ciphertext SE (KA, M ( 1)) is decrypted to extract plaintext M (1) [M (1) = SD (KA, SE (KA, M (1))] (step S80). The data is sent to the application execution unit 14h of the PC 110-2 (end of reading process).

[Deleting process]
Next, the deletion process of this embodiment will be described. It is assumed that the OS, security program, and application software are installed on the PC 110-i.

  18 to 20 are diagrams showing each functional block and data flow related to the deletion process of this embodiment. 23 and 24 are sequence diagrams for explaining the deletion process of this embodiment.

  It is assumed that the USB memory 20 is mounted and mounted on the PC 110-1. Also in this embodiment, the registration of the PC 110-2 is deleted as in the first embodiment.

  First, the internal reading unit 12b of the PC 110-1 reads the identification information ID (1) from the storage unit 13 and sends it to the external reading unit 11a (FIG. 18). The external reading unit 11a reads the ciphertext IBE (MPK, ID (1), KA) associated with the identification information ID (1) from the area 22b (FIG. 19) of the storage unit 22 of the USB memory 20 (step S91). ).

  Next, the internal reading unit 12b (FIG. 18) of the PC 110-1 reads the secret key SK (1) from the storage unit 13 and sends it to the common key restoration unit 14d. Using the secret key SK (1), the common key restoration unit 14d decrypts the ciphertext IBE (MPK, ID (1), KA) read from the USB memory 20 and uses the common key KA [KA = PD (SK (1), IBE (MPK, ID (1), KA))] is extracted (step S92).

Next, the common key generation unit 114a of the PC 110-1 generates new common keys KA _new and KB _new (step S93).

  Further, the external reading unit 11b of the PC 110-1 reads the ciphertext SE (KA, M (i)) (iε {1,..., N}) corresponding to the PC 110-i from the USB memory 20 (step S94), and sends it to the decoding unit 114f. The decryption unit 114f decrypts the ciphertext SE (KA, M (i)) using the common key KA obtained by the common key restoration unit 114d, and plaintext M (i) [M (i) = SD (KA, SE (KA, M (i))] is extracted (step S95).

Next, each extracted plaintext M (i) and a new common key KA _new are input to the encryption unit 114e of the PC 110-1, and the encryption unit 114e uses the new common key KA _new. A ciphertext SE (KA _new , M (i)) obtained by encrypting each plaintext M (i) is generated (step S96). Further, the ciphertext authenticator generation unit 114n receives the ciphertext SE (KA _new , M (i)) and the new common key KB _new, and the ciphertext authenticator generation unit 114n performs the same as in step S74. , the ciphertext SE ciphertext authenticator for AU _{(KA new, M (i)} ) (KB new, SE (KA new, M (i))) to generate a (step S97).

The generated ciphertexts SE (KA _new , M (i)) and their ciphertext authenticators AU (KB _new , SE (KA _new , M (i))) are the external writing unit 11a of the PC 110-1. Sent to. The external writing unit 11 a stores the ciphertext SE (KA _new , M (i)) and the ciphertext authenticator AU (KB _new , SE (KA _new , M (i))) in the USB memory 20. The interface unit 21 sends them to the interface unit 21 and stores them in the area 22c (FIG. 19) of the storage unit 22 (step S98).

Next, the external reading unit 11b (FIG. 18) of the PC 110-1 uses the identification information ID (s) (s∈ {1,..., N}, s) other than the PC 110-2 to be deleted from the USB memory 20. ≠ 2) are read (step S99), and they are sent to the key concealment unit 114c. Also, the internal reading unit 12b reads the master public key MPK from the storage unit 13 and sends it to the key concealment unit 114c. The key ciphering unit 114c includes a respective identification information ID (s) using the master public key MPK, the newly generated common key KA _{new new} common key generation unit 114a, a KB _{new new,} by the respective ID-BASE cryptosystem Encryption is performed to generate ciphertexts IBE (MPK, ID (s), KA _new ), IBE (MPK, ID (s), KB _new ) (step S100).

Each ciphertext IBE (MPK, ID (s), KA _new ), IBE (MPK, ID (s), KB _new ) is transferred to the interface unit 21 (FIG. 19) of the USB memory 20 by the external writing unit 11a of the PC 110-1. Sent to. Then, the interface unit 21 stores the ciphertexts IBE (MPK, ID (s), KA _new ), IBE (MPK, ID (s), KB _new ) in the area 22 b of the storage unit 22 of the USB memory 20. Each is stored in association with the identification information ID (s) (FIG. 19) (step S101).

  Next, the deletion unit 14g (FIG. 20A) of the PC 110-1 issues a deletion command, and the external writing unit 11a receiving the command issues the area 22c of the storage unit 22 of the USB memory 20 (FIG. 20B). The ciphertext SE (KA, M (i)) and ciphertext authenticator AU (KB, SE (KA, M (i))) are deleted from the ciphertext IBE (MPK, ID (i), KA ), IBE (MPK, ID (i), KB) and identification information ID (2) are deleted (FIG. 20B) (step S102).

[Fourth Embodiment]
Next, a fourth embodiment of the present invention will be described. This embodiment is a modification of the third embodiment. The only difference from the third embodiment is that the configuration of the key concealment unit 114c and the common key restoration unit 114d that conceal and decrypt a plurality of common keys is devised to reduce the amount of calculation. Hereinafter, only the key concealment unit 114c and the common key restoration unit 114d of this embodiment will be described.

<Key concealment unit 114c>
FIG. 25A is a block diagram showing the configuration of the key concealment unit 114c of this embodiment. Hereinafter, the secret key KA.KB, the master public key MPK, and the identification information ID (1) are input to the key concealment unit 114c of the present embodiment, and the key concealment unit 114c uses the ciphertext IBE (MPK , ID (1), KA), IBE (MPK, ID (1), KB) will be described as an example.

  First, the random number generation unit 114ca of the key concealment unit 114c generates a random number Z (1) (for example, an integer having a bit length of 384 bits), which is converted into the public key encryption unit 114cb and the random number division unit 114cc of the key concealment unit 114c. And send to. The public key encryption unit 114cb encrypts the random number Z (1) by the ID-BASE encryption method using the input master public key MPK and the identification information ID (1), and the ciphertext C (1) = IBE (MPK , ID (1), Z (1)). In addition, the random number dividing unit 114cc divides the random number Z (1) into 2 (example of Y = 2) random numbers Z (1, y) (y∈ {1, 2}) (for example, bit length 128 bits). . Each divided random number Z (1, y) is sent to the common key encryption unit 114cd of the key concealment unit 114c. The common key encryption unit 114cd uses the random number Z (1, 1) as a key and a ciphertext SE (Z (1, 1), KA) obtained by encrypting the common key KA by a common key encryption method (Camellia, AES, etc.). Is generated. Further, the common key encryption unit 114cd generates a ciphertext SE (Z (1, 2), KB) obtained by encrypting the common key KB by the common key encryption method using the random number Z (1, 2) as a key.

Then, the key concealment unit 114c
IBE (MPK, ID (1), KA) = ((C (1), SE (Z (1, 1), KA)))
IBE (MPK, ID (1), KB) = ((C (1), SE (Z (1, 2), KB)))
Is output.

<Common key restoration unit 114d>
FIG. 25B is a block diagram showing the configuration of the common key restoration unit 114d of this embodiment. Hereinafter, using this figure, the ciphertext IBE (MPK, ID (1), KA), IBE (MPK, ID (1), KB) and the secret key SK (1) are stored in the common key restoration unit 114d of this embodiment. A description will be given by taking as an example a process in which the common key restoration unit 114d receives and decrypts the ciphertext IBE (MPK, ID (1), KA), IBE (MPK, ID (1), KB).

  First, the public key decryption unit 114da of the common key restoration unit 114d uses the input secret key SK (1) to generate ciphertext C (1) = IBE (MPK, ID (1), Z (1)). Decryption is performed to extract a random number Z (1) [Z (1) = PD (SK (1), C (1))]. The random number Z (1) is input to the random number dividing unit 114db of the common key restoring unit 114d, and the random number dividing unit 114db converts the random number Z (1) into the random number dividing unit 114cc (FIG. 25A). It is divided into 2 (example of Y = 2) random numbers Z (1, y) (y∈ {1, 2}) (for example, bit length 128 bits).

  Next, a random number Z (1, y) (y∈ {1, 2}) and ciphertext SE (Z (1, 1), KA), SE ( Z (1, 2), KB) is entered. The common key decryption unit 114 dc uses the random number Z (1, 1) as a key, decrypts the ciphertext SE (Z (1, 1), KA) by the common key cryptosystem, and the random number Z (1, 2). Is used as a key, and the KB obtained by decrypting the ciphertext SE (Z (1, 2), KB) by the common key cryptosystem is calculated. Then, the common key restoration unit 114d outputs the common keys KA and KB.

  As described above, the key concealment unit 114c of the present embodiment uses the secret key SK (1) by performing one encryption process by the ID-BASE encryption method and two encryption processes by the common key encryption method. Decryptable ciphertext can be created. The amount of computation required for this is smaller than the amount of computation when each of the secret keys KA and KB is encrypted by two encryption processes using the ID-BASE encryption method. Such an effect of reducing the amount of calculation can be obtained at the time of decoding.

[Fifth Embodiment]
Next, a fifth embodiment of the present invention will be described. This embodiment is also a modification of the third embodiment. While improving the security by devising the processing of the encryption unit 114e and the decryption unit 114f, and using the random numbers used for the processing to generate a ciphertext authenticator, while suppressing an increase in the amount of computation The point that the security of the ciphertext authenticator is improved is different from the third embodiment. Only the differences from the third embodiment will be described below.

<Writing process of this embodiment>
FIG. 26 is a diagram showing each functional block and data flow related to the writing process of this embodiment. Here, an example in which the PC 110-1 writes the ciphertext to the USB memory 20 is shown.

  It is assumed that the USB memory 20 is mounted and mounted on the PC 110-1. First, the application execution unit 14h of the PC 110-1 designates the sector number se (1 sector = 512 bytes) to the control unit 14i and makes a request to write the ciphertext of plaintext M (1) to the USB memory 20. . With this as a trigger, the same processing as steps S71 and 72 (FIG. 22) of the third embodiment is executed.

  Next, the common key KA, the designated sector number se, and plaintext M (1) are input to the encryption unit 114e, and the encryption unit 114e encrypts the plaintext M (1) using the common key KA. The encrypted ciphertext SE (KA, M (1)) is generated, and the random number E (1) and the ciphertext SE (KA, M (1)) are output. Details of the encryption unit 114e will be described below.

[Details of Encryption Unit 114e of this Embodiment]
FIG. 28A is a block diagram showing details of the encryption unit 114e of this embodiment.
First, the block division unit 114ea of the encryption unit 114e receives X (X ≧ 2) (for example, X = 32) blocks MB (p, x) (x∈ {1,. .., X}). Each block MB (p, x) is sent to the block encryption unit 114ed, and the block number x is sent to the function calculation unit 114ec.

  Also, the random number generation unit 114eb of the encryption unit 114e generates and outputs a random number E (1) for each plaintext M (1). Next, in the function calculation unit 114ec of the encryption unit 114e, the sector number se of the storage unit 22 of the USB memory 20 that stores the ciphertext of plaintext M (1), the random number E (1), the block number x, And the function calculation unit 114ec calculates a function value IV = π (x, E (1), se) obtained by substituting these into a predetermined function π for each block number x (for example, x, E (1 ), se bit concatenation is IV).

  Further, the function value IV, the block MB (1, x), and the common key KA are input to the block encryption unit 114ed of the encryption unit 114e. The block encryption unit 114ed encrypts each block MB (1, x) by a block encryption method (counter mode or the like) using the common key KA and the function value IV as an initial vector. Then, the block encryption unit 114ed generates a ciphertext SE (KA, M (1)) from the ciphertext of the calculated all blocks MB (1, x) (for example, all the blocks MB (1, x) The bit concatenated value of the ciphertext is output as ciphertext SE (KA, M (1)) (end of description of [Details of encryption unit 114e of this embodiment]).

  The generated ciphertext SE (KA, M (1)) is sent to the ciphertext authenticator generation unit 114n together with the random number E (1). The ciphertext authenticator generation unit 114n uses at least the common key KB, the ciphertext SE (KA, M (1)), and the random number E (1) to encrypt the ciphertext SE (KA, M (1)). A child AU (KB, E (1), SE (KA, M (1))) is generated.

  The ciphertext SE (KA, M (1)) generated as described above, its ciphertext authenticator AU (KB, SE (KA, M (1))), random number E (1), and application execution The sector number se sent from the unit 14h is sent to the interface unit 21 of the USB memory 20 by the external writing unit 11a (FIG. 26B). The interface unit 21 adds the ciphertext SE (KA, M (1)) and the ciphertext authenticator AU (KB, SE (KA, M (1)) to the sector in the area 22c of the storage unit 22 specified by the sector number se. ))) And random number E (1) are stored.

<Reading process of this embodiment>
FIG. 27 is a diagram showing each functional block and data flow related to the reading process of this embodiment. In this example, the PC 110-2 reads the ciphertext from the USB memory 20 and decrypts it.

  First, the USB memory 20 is mounted and mounted on the PC 110-2. Then, the application execution unit 14h of the PC 110-2 requests the control unit 14i to read the ciphertext from the USB memory 20 and to decrypt the ciphertext by designating the sector number se. Using this as a trigger, first, the external reading unit 11b of the PC 110-2 designates the sector number se, and from the area 22c of the storage unit 22 of the USB memory 20, the ciphertext SE (KA, M (1)) and The ciphertext authenticator AU (KB, E (1), SE (KA, M (1))) and the random number E (1) are read, and the ciphertext IBE (MPK, ID (2), KA is read from the area 22b. ), IBE (MPK, ID (2), KB).

  Next, the internal reading unit 12b (FIG. 27A) of the PC 110-2 reads the secret key SK (2) from the storage unit 13. Then, the common key recovery unit 114d of the PC 110-2 uses the secret key SK (2) to convert the ciphertexts IBE (MPK, ID (2), KA), IBE (MPK, ID (2), KB), respectively. Decrypt the common key KA (KA = PD (SK (2), IBE (MPK, ID (2), KA))), KB (KB = PD (SK (2), IBE (MPK, ID (2), KB))] is extracted.

  Thereafter, the ciphertext verification unit 114p of the PC 110-2 receives the common key KB, the ciphertext SE (KA, M (1)), and the ciphertext authenticator AU (KB, E (1), SE (KA, M (1)). )) And a random number E (1) are input, and the ciphertext verification unit 114p uses these to verify whether the ciphertext SE (KA, M (1)) is valid. If the ciphertext SE (KA, M (1)) is valid, the decryption unit 114f of the PC 110-2 uses the common key KA, the random number E (1), and the sector number se to encrypt the ciphertext SE (KA, M (1)) is decrypted, and plaintext M (1) [M (1) = SD (KA, SE (KA, M (1))] is extracted. explain.

[Details of Decoding Unit 114f of this Embodiment]
FIG. 28B is a block diagram showing details of the decoding unit 114f of the present embodiment.

  First, the block division unit 114fa of the decryption unit 114f converts the ciphertext SE (KA, M (1)) into X (X ≧ 2) (for example, X = 32) blocks SEB (KA, M (1), x ) (X∈ {1, ..., X}). This process is a reverse process of the process in which the block encryption unit 114ed in FIG. 28A generates the ciphertext SE (KA, M (1)) from the ciphertext of all the blocks MB (1, x). Each block SEB (KA, M (1), x) is sent to the block decoding unit 114ed, and the block number x is sent to the function calculation unit 114fc.

  Next, the sector number se, the random number E (1), and the block number x are input to the function calculation unit 114fc of the decryption unit 114f. The function calculation unit 114fc calculates a function value IV = π (x, E (1), se) obtained by substituting these into a predetermined function π for each block number x (for example, x, E (1), se) Bit concatenation is IV).

  The function value IV, the block SEB (KA, M (1), x), and the common key KA are input to the block decryption unit 114fd of the encryption unit 114e. The block encryption unit 114fd decrypts the block SEB (KA, M (1), x) by using a common key KA and a block decryption method (counter mode, etc.) with the function value IV as an initial vector, and each block MB Extract (1, x). This process is a reverse process of the process of the block encryption unit 114ed in FIG. Then, the block decryption unit 114fd generates a plaintext M (1) from the calculated all blocks MB (1, x) and outputs it. The output plaintext M (1) is sent to the application execution unit 14h of the PC 110-2 (end of description of [Details of the decryption unit 114f of this embodiment]).

  The encryption unit 114e and the decryption unit 114f of the present embodiment described above are similarly executed in the [deletion process], but description thereof is omitted here. Further, the configuration may be such that the sector number se is not used for the encryption processing and the decryption processing of the encryption unit 114e and the decryption unit 114f, or other information is used to generate the function value IV. There may be.

[Other variations, etc.]
The present invention is not limited to the above-described embodiment. For example, in the first embodiment, the common key is regenerated and the information in the USB memory is rewritten in the deletion process of deleting a specific PC from the registration, but the common key is not deleted from the registration. May be regenerated to rewrite the information in the USB memory. Such processing is effective, for example, when the common key is leaked to a third party.

  In each of the above-described embodiments, a personal computer is illustrated as an example of an information processing apparatus, and a USB memory is illustrated as an example of an information recording medium. However, the present invention is not limited to these. For example, a mobile phone, a personal digital assistant (PDA), or the like may be used as the information processing apparatus. As an information recording medium, a DVD-RAM (Random Access Memory), a CD-R (Recordable) / RW (ReWritable), an MO (Magneto-Optical disc), or the like may be used, or a non-portable type such as a hard disk. A recording medium may be used.

  In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  The program describing the processing contents executed by the PC can be recorded on a computer-readable recording medium. As the computer-readable recording medium, any of the above-described USB memory, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, and the like may be used. As a device, a hard disk device, a flexible disk, a magnetic tape or the like, and an optical disk such as a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only Memory), a CD-R (Recordable) / RW (ReWritable) or the like can be used as a magneto-optical recording medium, an MO (Magneto-Optical disc) or the like as a semiconductor memory, or an EEP-ROM (Electronically Erasable and Programmable-Read Only Memory) or the like.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a USB memory, DVD, or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, a computer may read the program directly from a portable recording medium and execute processing according to the program.

  Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  As a field of use of the present invention, for example, concealment of data stored in a USB memory can be exemplified.

FIG. 1 is a conceptual diagram illustrating the overall configuration of the information recording medium sharing system according to the first embodiment. FIG. 2A is a block diagram illustrating the functional configuration of the PC according to the first embodiment, and FIG. 2B is a block diagram illustrating the functional configuration of the USB memory according to the present embodiment. FIG. 3 is a diagram showing each functional block and data flow related to the registration process of the first embodiment. FIG. 4 is a diagram showing each functional block and data flow related to the writing process of the first embodiment. FIG. 5 is a diagram showing each functional block and data flow related to the reading process of the first embodiment. FIG. 6 is a diagram illustrating each functional block and data flow related to the deletion process of the first embodiment. FIG. 7 is a diagram showing each functional block and data flow related to the deletion process of the first embodiment. FIG. 8 is a diagram illustrating each functional block and data flow related to the deletion process of the first embodiment. FIG. 9 is a sequence diagram for explaining a registration process according to the first embodiment. FIG. 10 is a sequence diagram for explaining a writing process and a reading process according to the first embodiment. FIG. 11 is a sequence diagram for explaining the deletion process of the first embodiment. FIG. 12 is a sequence diagram for explaining a registration process according to the second embodiment. FIG. 13 is a block diagram illustrating a functional configuration of a PC according to the third embodiment. FIG. 14 is a block diagram illustrating a functional configuration of the USB memory according to the third embodiment. FIG. 15 is a diagram illustrating each functional block and data flow related to the registration process of the third embodiment. FIG. 16 is a diagram showing each functional block and data flow related to the writing process of the third embodiment. FIG. 17 is a diagram illustrating each functional block and data flow related to the reading process of the third embodiment. FIG. 18 is a diagram illustrating each functional block and data flow related to the deletion process of the third embodiment. FIG. 19 is a diagram illustrating each functional block and data flow related to the deletion process of the third embodiment. FIG. 20 is a diagram illustrating each functional block and data flow related to the deletion process of the third embodiment. FIG. 21 is a sequence diagram for explaining a registration process according to the third embodiment. FIG. 22 is a sequence diagram for explaining a writing process and a reading process of the third embodiment. FIG. 23 is a sequence diagram for explaining a deletion process according to the third embodiment. FIG. 24 is a sequence diagram for explaining a deletion process according to the third embodiment. FIG. 25A is a block diagram illustrating a configuration of a key concealment unit according to the fourth embodiment. FIG. 25B is a block diagram illustrating a configuration of the common key restoration unit according to the fourth embodiment. FIG. 26 is a diagram illustrating each functional block and data flow related to the writing process of the fifth embodiment. FIG. 27 is a diagram illustrating each functional block and data flow related to the reading process of the fifth embodiment. FIG. 28A is a block diagram illustrating details of the encryption unit according to the fifth embodiment. FIG. 28B is a block diagram showing details of the decoding unit of this embodiment.

Explanation of symbols

1 Information recording medium sharing system 10, 110 PC (equivalent to “information processing device”)
20 USB memory (equivalent to “information recording medium”)

Claims (10)

n (n is an integer of 2 or more) information processing devices PC (i) (i∈ {1,..., n}) share the information recording medium, and store the ciphertext in the information recording medium. An information recording medium security method for decrypting plaintext from ciphertext stored in the information recording medium,
A common master secret key for each information processing device PC (i) is MSK, and a common master public key for each information processing device PC (i) generated using the master secret key MSK is MPK, A secret key when the ID-BASE encryption scheme secret key generated using the identification information ID (i) and master secret key MSK for identifying each information processing device PC (i) is SK (i) SK (i) is stored in the storage unit of the information processing apparatus PC (i) corresponding to the secret key SK (i), and the master public key MPK and the identification information ID (i) are used. A process of storing each ciphertext IBE (MPK, ID (i), KA) obtained by encrypting the common key KA of the common key encryption system by the BASE encryption system in the information recording medium,
Process in which the external reading unit of any one of the information processing devices PC (p) (p∈ {1,..., N}) reads the ciphertext IBE (MPK, ID (p), KA) from the information recording medium. And the common key recovery unit of the information processing apparatus PC (p) decrypts the ciphertext IBE (MPK, ID (p), KA) using the secret key SK (p) stored in the storage unit. The process of extracting the key KA and the encryption unit of the information processing device PC (p) generates a ciphertext SE (KA, M (p)) obtained by encrypting the plaintext M (p) using the common key KA. A process of storing, and an external writing unit of the information processing apparatus PC (p), the process of storing the ciphertext SE (KA, M (p)) in the information recording medium,
A process in which an external reading unit of any one of the information processing devices PC (q) (q∈ {1,..., N}) reads the ciphertext IBE (MPK, ID (q), KA) from the information recording medium. The external reading unit of the information processing apparatus PC (q) reads the ciphertext SE (KA, M (p)) from the information recording medium, and the common key restoration unit of the information processing apparatus PC (q) A process of decrypting the ciphertext IBE (MPK, ID (q), KA) using the secret key SK (q) stored in the storage unit and extracting the common key KA, and the information processing apparatus PC (q ) Decryption unit decrypts the ciphertext SE (KA, M (p)) using the common key KA and extracts the plaintext M (p), and a reading process comprising:
A security method for an information recording medium, comprising: The information recording medium security method according to claim 1,
The registration process is
The process of generating the common key KA by the common key generation unit of any information processing device PC (r) (r∈ {1, ..., n}), and the key concealment of the information processing device PC (r) Uses the master public key MPK and identification information ID (u) that identifies one of the information processing devices PC (u) (u∈ {1, ..., n}), and the ID-BASE encryption method The process of generating each ciphertext IBE (MPK, ID (u), KA) obtained by encrypting the common key KA of the common key cryptosystem, and the external writing unit of the information processing device PC (r) MPK, ID (u), KA) is stored in the information recording medium,
A security method for an information recording medium, comprising: The information recording medium security method according to claim 1 or 2,
The registration process is
Ciphertext IBE (MPK, ID (t), KA) (t∈ {1, ..., n}) is stored in the information recording medium, and the private key SK (t) is stored in its own storage unit The process of reading the ciphertext IBE (MPK, ID (t), KA) from the information recording medium by the external reading unit of any information processing apparatus PC (t) and the common key of the information processing apparatus PC (t) A process in which the restoration unit decrypts the ciphertext IBE (MPK, ID (t), KA) using the secret key SK (t) stored in the storage unit and extracts the common key KA, and the information processing apparatus PC The key concealment unit in (t) uses the master public key MPK and the identification information ID (g) that identifies one of the information processing devices PC (g) (g∈ {1, ..., n}) , The process of generating each ciphertext IBE (MPK, ID (g), KA) obtained by encrypting the common key KA using the ID-BASE encryption method, and the external writing unit of the information processing device PC (t) Storing IBE (MPK, ID (g), KA) in the information recording medium,
A security method for an information recording medium, further comprising: The information recording medium security method according to claim 1,
Ciphertext IBE (MPK, ID (r), KA) (r∈ {1, ..., n}) is stored in the above information recording medium, and private key SK (r) is stored in its own storage unit The external reading unit of the information processing device PC (r) reads the ciphertext IBE (MPK, ID (r), KA) from the information recording medium, and the common key recovery unit of the information processing device PC (r) The process of decrypting the ciphertext IBE (MPK, ID (r), KA) using the secret key SK (r) stored in the storage unit and extracting the common key KA, and the information processing apparatus PC (r) The common key generation unit generates a new common key KA _new, and the external reading unit of the information processing apparatus PC (r) transmits the information processing apparatus PC (p) (p∈ {1 , ..., n}) corresponding to the process of reading the ciphertext SE (KA, M (p)) and the decryption unit of the information processing apparatus PC (r) The process of decrypting (KA, M (p)) and extracting plaintext M (p) and the encryption unit of the information processing device PC (r) use the new common key KA _new . There are ciphertext SE for each plaintext M (p) encrypted and generating a _{(KA new, M (p)} ), external write unit of the information processing apparatus PC (r) is the ciphertext SE (KA _{new new} , M (p)) in the information recording medium, and a re-encryption process comprising:
The key ciphering unit of the information processing apparatus PC (r) is, using the master public key MPK identification information ID (p), ID-BASE cryptosystem ciphertext new common key KA _{new new} encrypted by IBE ( MPK, ID (p), KA _new ) and the external writing unit of the information processing device PC (r) use the ciphertext IBE (MPK, ID (p), KA _new ) to the information recording medium. A storing process, a re-registration process comprising,
A security method for an information recording medium, comprising: The information recording medium security method according to claim 4,
The re-registration process is a process executed for the information processing apparatus PC (s) other than the information processing apparatus PC (w) (w∈ {1,.
The security method of the information recording medium is as follows:
The deletion unit of the information processing device PC (r) transmits the ciphertext SE (KA, M (p)) (p∈ {1,..., N}) stored in the information recording medium from the information recording medium. Having a deletion process to delete,
A security method for an information recording medium. The information recording medium security method according to claim 1,
The process of generating the ciphertext SE (KA, M (p)) in which the encryption unit of the information processing apparatus PC (p) encrypts the plaintext M (p) using the common key KA,
A process in which the block division unit of the encryption unit divides the plaintext M (p) into X (X ≧ 2) blocks MB (p, x) (x∈ {1,..., X});
The random number generator of the encryption unit generates a random number E (p) for each plaintext M (p),
The external writing unit of the information processing device PC (p) stores a random number E (p) in the information recording medium,
The function calculation unit of the encryption unit substitutes a function value IV = π (x, E (p)) in which at least the block number x of block MB (p, x) and the random number E (p) are substituted into a predetermined function π. The process of calculating
The block encryption unit of the encryption unit encrypts each block MB (p, x) using the common key KA and the function value IV as an initial vector, and the ciphertext of all the calculated blocks MB (p, x) Generating ciphertext SE (KA, M (p)) from
A security method for an information recording medium. The information recording medium security method according to claim 6,
The registration process is
Record the above ciphertext IBE (MPK, ID (i), KB) obtained by encrypting the ciphertext authentication key KB by the ID-BASE encryption method using the master public key MPK and identification information ID (i). Comprising the process of storing on a medium;
The above writing process is
The external reading unit of the information processing device PC (p) reads the ciphertext IBE (MPK, ID (p), KB) from the information recording medium, and the common key recovery unit of the information processing device PC (p) A process of decrypting the ciphertext IBE (MPK, ID (p), KB) using the secret key SK (p) stored in the storage unit and extracting the ciphertext authentication key KB, and the information processing apparatus PC The ciphertext authentication unit (p) uses at least the ciphertext authentication key KB, the random number E (p), and the ciphertext SE (KA, M (p)) generated by the encryption unit. The process of generating the authenticator AU (KB, E (p), SE (KA, M (p))) of (KA, M (p)) and the external writing unit of the information processing device PC (p) Storing the authenticator AU (KB, E (p), SE (KA, M (p))) in the information recording medium,
A security method for an information recording medium. Information processing device PC (p) (pε {1,...) That stores ciphertext in an information recording medium shared with other information processing devices PC (q) (q∈ {1, ..., n}) ., n}, q ≠ p),
A storage unit for storing the ID-BASE encryption secret key SK (p);
Each ciphertext IBE (MPK) obtained by encrypting the common key KA of the common key encryption method by the ID-BASE encryption method using the identification information ID (p) for identifying the information processing device PC (p) and the master public key MPK. , ID (p), KA), and the identification information ID (q) that identifies the master public key MPK and the other information processing apparatus PC (q). An external reading unit that reads the ciphertext IBE (MPK, ID (p), KA) from the information recording medium storing at least each ciphertext IBE (MPK, ID (q), KA) obtained by encrypting the key KA; ,
A common key recovery unit that decrypts the ciphertext IBE (MPK, ID (p), KA) using the secret key SK (p) stored in the storage unit and extracts the common key KA;
An encryption unit that generates a ciphertext SE (KA, M (p)) obtained by encrypting plaintext M (p) using a common key KA;
An external writing unit for storing the ciphertext SE (KA, M (p)) in the information recording medium;
An information processing apparatus comprising: Information processing device PC (q) (qε that decrypts plaintext from ciphertext stored in an information recording medium shared with other information processing devices PC (p) (pε {1, ..., n}) {1, ..., n}, q ≠ p)
A storage unit for storing the secret key SK (q) of the ID-BASE encryption method;
Using the identification information ID (q) for identifying the information processing device PC (q) and the master public key MPK, the ciphertext IBE (MPK, ID (q), KA) and ciphertext IBE from the information recording medium storing at least the ciphertext SE (KA, M (p)) obtained by encrypting the plaintext M (p) using the common key KA. An external reading unit that reads (MPK, ID (q), KA) and ciphertext SE (KA, M (p));
A common key recovery unit that decrypts the ciphertext IBE (MPK, ID (q), KA) using the secret key SK (q) stored in the storage unit and extracts the common key KA;
A decryption unit that decrypts the ciphertext SE (KA, M (p)) using the common key KA and extracts the plaintext M (p);
An information processing apparatus comprising:   The program for making a computer perform each process of the security method of the information recording medium described in any one of Claim 1 to 7.

Images