JP2009171495A - Reply routing information producing apparatus, communication apparatus, anonymous communication method, program, and record medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform bidirectional anonymous communication by small reply routing information. <P>SOLUTION: The reply routing information including calculation results is generated and transmitted to a communication apparatus v[1] after performing following calculations on a cyclic group G, y[0]<SP>E[0]×r[0,0,0]</SP>×y[1]<SP>r[0,0,0]</SP>, g<SP>r[0,0,0]</SP>, y[1]<SP>r[1,0,0]</SP>, g<SP>r[1,0,0]</SP>, y[1]<SP>(e[0,1]+1)×r[0,1,0]</SP>×y[2]<SP>r[0,1,0]</SP>, g<SP>r[0,1,0]</SP>, (y[1]×y[2])<SP>r[1,1,0]</SP>, g<SP>r[1,1,0]</SP>, (y[1]×, ..., ×y[m-1])<SP>r[0,m,0]</SP>×y[m]<SP>(e[m-1,m]+1)×r[0,m,0]</SP>×y[m+1]<SP>r[0,m,0]</SP>, g<SP>r[0,m,0]</SP>, (y[1]×, ..., ×y[m-1]×y[m]×y[m+1])<SP>r[1,m,0]</SP>, g<SP>r[1,m,0]</SP>(m=2, ..., n-1). <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an anonymous communication technology for concealing communication path information to each communication device that relays information in a communication technology in which a plurality of independent communication devices transfer information in cooperation, and in particular, a reply is possible. Related to anonymity communication technology.

  There is an encryption communication technique for concealing communication path information from a communication device that relays information when a communication service in which a plurality of independent communication devices cooperate to transfer information is performed. For example, in a communication service in which information transmitted from a source communication device is repeatedly relayed by a plurality of independent communication devices and delivered to a destination communication device, such as an e-mail transmission service, necessary for relaying information This is a cryptographic communication technique for concealing non-communication path information (such as a communication device of a transmission source and a transmission destination) in each communication device that relays information. Such an encryption communication technique is generally called anonymous communication, and various methods such as onion routing and an improved method have been proposed as an implementation method thereof.

  Also, in such anonymous communication, if a reply can be made from any communication device that relays information or a destination communication device, communication error information from any communication device that relays information to the source communication device Or a response from the transmission destination communication device to the transmission source communication device. At this time, bi-directional anonymous communication can be realized if a reply can be performed while concealing communication path information not necessary for relay (such as a communication device of a transmission source and a transmission destination and a communication for which communication).

In the following, the information transmitted from the communication device v [0] is the communication device v [1], ..., v in the order of v [1], ..., v [n-1] (n ≧ 2). A case will be described in which the communication device v [n] is relayed by [n-1]. Further, the communication path information for specifying the communication path between the communication device v [h-1] (h = 1,..., N) and the communication device v [h] is represented by e [h-1, h ]. That is, the communication path from the transmission source communication device v [0] to the transmission destination communication device v [n]
v [0], e [0,1], v [1], ..., v [n-1], e [n-1, n], v [n]… (1)
And

  Here, each communication device v [f] (f = 0, ..., n) has several communication paths in addition to e [f-1, f] and e [f, f + 1]. They are connected and can communicate with communication devices other than v [f-1] and v [f + 1]. Therefore, in order for the information transmitted from the communication device v [0] and returned to the transmission information relayed by the one or more communication devices v [h] to reach the communication device v [0] Each communication device v [h] located on the path needs to know the communication path information e [h-1, h]. That is, the information required for each communication device v [h] to relay the return information is the communication path information e [h-1, h]. And in order to realize bidirectional anonymous communication, each communication device v [h] can know the communication path information e [h-1, h] and e [h, h + 1], respectively. It must be in a state where it cannot know the other communication path information constituting the communication path of (1) above.

  One of the methods for realizing such bidirectional anonymous communication is the method disclosed in Non-Patent Document 1.

In the method of Non-Patent Document 1, when transmitting information from the communication device v [0] of the transmission source to the communication device v [n] of the transmission destination, the following multiple ciphertexts are added as return path information. Send. K _f (·) is a ciphertext that can be decrypted by the communication device v [f], and E [0] is unique information unique to the communication device v [0].

K _n (e [n-1, n], K _n-1 (e [n-2, n-1], ..., K ₁ (e [0,1], K ₀ (E [0]) ) ...)… (2)
When each communication device v [f] decrypts this multiple ciphertext in the order of v [n], ..., v [0], each communication device v [f] decrypts K _f (·). Communication channel information e [f-1, f] can be obtained each time. On the other hand, since each communication device v [f] cannot decrypt the other ciphertext K _i (•) (i ≠ k), the other communication path information e [i−1, i] is determined from the return path information of (2). Can't get. Thereby, bidirectional | two-way anonymous communication is realizable.

  However, in the method of Non-Patent Document 1, any transmission device v [m] (m = 2,..., N−1) is transmitted before the transmission information arrives at the destination communication device v [n]. I can't reply. This is because, unless the communication device v [n] first decrypts, any other communication device v [m] cannot decrypt the multiple ciphertext of the equation (2), and the communication path information e [m−1, m This is because you cannot get. Therefore, in the method of Non-Patent Document 1, for example, the communication device v [m + 1] next to the communication device v [m] between the communication device v [0] and the communication device v [n] fails. The communication device v [m] cannot return error information to the communication device v [0].

A simple method for solving this problem is for each communication device v [h] (h = 1,..., N), return path information starting from each communication device v [h].
K _n (e [n-1, n], K _n-1 (e [n-2, n-1], ..., K ₁ (e [0,1], K ₀ (E [0]) ) ...)
K _n-1 (e [n-2, n], K _n-2 (e [n-3, n-2], ..., K ₁ (e [0,1], K ₀ (E [0 ])) ...)… (3)
K _n-2 (e [n-3, n], K _n-1 (e [n-4, n-2], ..., K ₁ (e [0,1], K ₀ (E [0 ])) ...)
..
K ₁ (e [0,1], K ₀ (E [0])
And transmitting all of them added to the transmission information. However, this will increase the size of the reply path information to O (n ² ).
There is a method of Non-Patent Document 2 as a method that can solve such a problem.

In the method of Non-Patent Document 2, transmission information γ transmitted from the communication device v [0] is relayed by each communication device v [m] in the order of v [1], ..., v [n-1]. Until the communication device v [n] is reached, each communication device v [h] (h = 1,..., N) can be decoded only by itself. The reply path information that encrypts h] is generated and attached to the transmission information. When replying, each communication device v [h] decodes the reply path information generated by itself and obtains the communication path information e [h-1, h], thereby enabling reply by anonymous communication. In this case, the total size of the reply route information is O (n).
DL Chaum, “Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms,” Communications of the ACM, Vol. 24, NO.2, pp.84-88 (1981). H. Toriyama, N. Kunihiro, and K. Ohta: “Return Message-Receivable Anonymous Routing Scheme without Reveal of Sender ID,” SCIS2007, 3B4-6 (Jan. 2007).

  However, the method of Non-Patent Document 2 has a problem that a complete anonymous reply cannot be achieved. That is, the communication device v [m] trying to perform fraud in the method of Non-Patent Document 2 becomes some mark when encrypting the communication path information e [m−1, m] (when transmitting transmission information γ). Information δ can be encrypted and included in the reply path information. When the reply information sent using the reply path information generated in this way reaches the communication device v [m], the communication device v [m] can decode the information δ. Thereby, the communication device v [m] can obtain information that the reply information is a reply to the transmission information γ.

  The present invention has been made in view of these points, and uses return path information having the same order size as the number n of communication apparatuses constituting the path, and information necessary for relaying information to each communication apparatus. It aims at providing the technique which can perform two-way anonymous communication, concealing other information.

The present invention relates to communication devices v [1],..., Information transmitted from the communication device v [0] in the order of v [1],. This is applied to anonymous communication relayed by v [n-1] and received by the communication device v [n]. In the present invention, the communication path information for specifying the communication path between the communication device v [h-1] (h = 1,..., N) and the communication device v [h] is represented by e [h -1, h], unique information unique to each communication device v [f] (f = 0, ..., n) is E [f], G is a cyclic group, and g is a cyclic group G X [f] (f = 0, ..., n) is a secret key x [f] of each communication device v [f], and y [f] is each secret key x [f] The public key y [f] = g ^{x [j]} ∈ G respectively corresponding to. The communication path between the communication device v [h-1] and the communication device v [h] is at least for transmitting information from the communication device v [h] to the communication device v [h-1]. It means a communication channel.

[Reply Route Information RI [0] Generation Processing]
First, an arbitrary integer r [0, j, 0], r [1, j, 0] respectively corresponding to at least n communication devices v [j] (j = 0, ..., n-1) And the operation α [0,0,0] = y [0] ^{E [0] ・ r [0,0,0]}・ y [1] ^{r [0,0,0]} ∈G 、 β [0 , 0,0] = g ^{r [0,0,0]} ∈ G, α [1,0,0] = y [1] ^{r [} 1,0,0 ^] ∈ G, β [1,0,0] = g ^{r [} 1,0,0 ^] ∈ G, α [0,1,0] = y [1] ^{(e [0,1] +1) ・ r [0,1,0]}・ y [2] ^{r [0,1,0]} ∈ G, β [0,1,0] = g ^{r [0,1,0]} ∈ G, α [1,1,0] = (y [1] ・ y [2 ]) ^{r [1,1,0]} ∈ G, β [1,1,0] = g ^{r [1,1,0]} ∈ G Furthermore, for each of m = 2, ..., n-1, the operation α [0, m, 0] = (y [1] ···· y [m-1]) ^{r [0, m, 0]}・ y [m] ^{(e [m-1, m] +1) ・ r [0, m, 0]}・ y [m + 1] ^{r [0, m, 0]} ∈G 、 β [0, m, 0] = g ^{r [0, m, 0]} ∈ G, α [1, m, 0] = (y [1] ・ ・ ・ ・ ・ y [m-1] ・ y [m] ・ y [ m + 1]) ^{r [1, m, 0]} ∈G, β [1, m, 0] = g ^{r [1, m, 0]} ∈G. And four operation results α [0, j, 0], β [0, j, 0], α [1, j, 0], β [1, j, 0] (j = 0, ..., Return path including n pieces of block information RB [0,0], ..., RB [n-1,0], where information including n-1) is block information RB [j, 0], respectively. Information RI [0] is generated. Here, the size of the reply route information RI [0] is O (n).
Each communication device v [f] (f = 0,..., N) executes the following processing.

[Communication device v [0] transmission processing]
First, the communication device v [0] transmits the reply route information RI [0] to the communication device v [1].

[Transmission / reception processing / reply start processing of each communication device v [u] (u = 1, ..., n)]
The communication device v [u] receives the reply path information RI [u-1] transmitted from the communication device v [u-1], and α [1, j, u-1 ] = β [1, j, u-1] Select block information satisfying ^{x [u]} ∈ G, and set it as block information RB [+, u-1]. The communication device v [u] then calculates α [0, j, u-1] / β [0, [α] for α [0, j, u-1] of the block information RB [+, u-1]. j, u-1] ^{2 · x [u]} ∈ G, and the operation result is set as a new α [0, j, u-1] of the block information RB [+, u-1] and the block information RB [+ , u-1].

Here, when the communication device v [u] does not reply, the communication device v [u] has block information included in the reply path information RI [u-1] except for the block information RB [+, u-1]. For each α [0, j, u-1], β [0, j, u-1] of RB [0, u-1], ..., RB [n-1, u-1] An operation α [0, j, u-1] / β [0, j, u-1] ^{x [u]} ∈G is performed, and each of these operation results is added to each new α [0, j, u-1 ], The block information RB [0, u-1], ..., RB [n-1, u-1] is updated, and the reply path information RI [u] excluding the block information RB [+, u-1] -1] has block information RB [0, u-1],..., RB [n-1, u-1], α [1, j, u-1], β [0, j, The operation α [1, j, u-1] / β [1, j, u-1] ^{x [u]} ∈G is performed on u−1], and each of these operation results is added to each new α The block information RB [0, u-1], ..., RB [n-1, u-1] is updated as [1, j, u-1], and the reply path information RI updated by at least these is updated. [u-1] is transmitted to the communication device v [u + 1] as the reply route information RI [u].

On the other hand, when the communication device v [u] makes a reply, the communication device v [u] sends the block information RB [0, u-1],..., RB included in the reply path information RI [u-1]. For each α [0, j, u-1] and β [0, j, u-1] of [n-1, u-1], the operations α [0, j, u-1] · β [ 0, j, u-1] ^{x [u]} ∈ G, and each of these calculation results is regarded as each new α [0, j, u-1] and the block information RB [0, u-1], ..., RB [n-1, u-1] is updated, and at least the reply path information RI [u-1] updated thereby is set as the reply path information RI [u] to the communication device v [u- Reply to [1]. This reply is made to the communication device v [u-1] by the communication device v [u] to which the reply route information RI [u-1] is transmitted from the communication device v [u-1]. . Thus, any communication device v [u] can make this reply.

[Reply receiving process for each communication device v [u] (u = 1, ..., n)]
Further, when the reply path information RI [u + 1] is returned from the communication apparatus v [u + 1] to the communication apparatus v [u], the communication apparatus v [u] returns the reply path information RI [u + 1]. ] For any combination of block information RB [0, u + 1], ..., RB [n-1, u + 1] and any channel information e [y, u] Α [0, j, u + 1] = β [0, j, u + 1] ^{e [y, u]} Whether or not ∈G is satisfied and α [0, j, u + 1] = The channel information e [y, u] satisfying β [0, j, u + 1] ^{e [y, u]} ∈G is defined as channel information e [u-1, u]. Then, the communication device v [ ^u] returns return path information excluding block information satisfying α [0, j, u + 1] = β [0, j, u + 1] ^{e [y, u]} ∈G Each of block information RB [0, u + 1], ..., RB [n-1, u + 1] included in RI [u + 1] α [0, j, u + 1], β [0, j, u + 1] are calculated α [0, j, u + 1] · β [0, j, u + 1] ^{x [u]} ∈G, and the result of each of these operations Update the block information RB [0, u + 1], ..., RB [n-1, u + 1] as each α [0, j, u + 1], and at least the reply updated by this The route information RI [u + 1] is transmitted as the reply route information RI [u] to the communication path specified by the communication path information e [u-1, u]. Here, the reply path information is information updated by each communication device. And it is e [y, u] = that satisfies α [0, j, u + 1] = β [0, j, u + 1] ^{e [y, u]} ∈G in the communication device v [u]. Only for e [u-1, u]. In other words, each communication device v [u] can obtain the communication path information e [u-1, u] from the return path information RI [u + 1] transmitted from the communication apparatus v [u + 1]. However, other communication path information cannot be obtained from this reply path information RI [u + 1]. Thereby, the reply by anonymous communication is attained.

  In the present invention, the return route information having the same order size as the number of communication devices n constituting the route is used, and the two-way anonymous is concealed for each communication device while concealing information other than information necessary for relaying information. Communication can be performed.

  The best mode for carrying out the present invention will be described below with reference to the drawings.

〔overall structure〕
First, the overall configuration of this embodiment will be described.
FIG. 1A is a diagram showing the overall configuration of the anonymous communication system 1 of this form.
As shown in FIG. 1 (a), the anonymous communication system 1 of the present embodiment includes n (n ≧ 2) communication devices v [f] (f = 0,..., N) capable of communication through a network. ) Communication device 10 and communication devices 20-1 to 20-n.

  The communication device (v [0]) 10 is the communication device (v [n]) 20-n that is the destination of this anonymous communication and the communication device that sets the communication route up to that (the “reply route information generation device”). Communication devices (v [1] to v [n]) 20-1 to n are devices selected by the communication device (v [0]) 10. That is, although omitted in FIG. 1A, on the actual network, other than the communication device (v [0]) 10 and the communication devices (v [1] to v [n]) 20-1 to n. There are also a plurality of communication devices. Moreover, each communication apparatus of this form is mutually independent, and knowing which communication apparatus is a communication apparatus which comprises the anonymous communication system 1 is the communication apparatus (v [n ]) Only the communication device 10 that sets 20-n and the communication path up to that point.

  Also, e [h-1, h] (h = 1, ..., n) is a communication device v [h-1] (h = 1, ..., n) and a communication device v [h] It is communication path information for specifying the communication path between. Here, the communication path between the communication device v [h-1] and the communication device v [h] is at least for transmitting information from the communication device v [h] to the communication device v [h-1]. It means a communication channel. Further, as the communication path information e [h-1, h] for specifying the communication path between the communication apparatus v [h-1] and the communication apparatus v [h], for example, the communication apparatus v [h- Information for specifying the address 1) (IP address, etc.) can be exemplified. Further, information for specifying a set of the address of the communication device v [h-1] and the address of the communication device v [h] may be used as the communication path information e [h-1, h]. Note that there are actually communication apparatuses not shown in FIG. 1A, and communication paths between these communication apparatuses and each communication apparatus v [f] and each communication path information e [h-1, There is a communication path between communication devices v [f] other than the communication path specified by h].

  Further, in this embodiment, the communication device (v [0]) 10 exemplifies a case where the anonymous communication system 1 is configured by setting a communication device that is a transmission destination of anonymous communication and a communication path to the communication device. Other communication devices on the network can also set a communication device that is a destination of anonymous communication and a communication path to the communication device, and a plurality of independent anonymous communication systems can be configured on the network. Each communication device may relay a plurality of independent anonymous communication transmission information and reply information.

[Hardware configuration]
FIG. 1B is a block diagram illustrating a hardware configuration of the communication device (v [0]) 10 according to the present embodiment.
As illustrated in FIG. 1B, the communication device 10 of this embodiment includes a CPU (Central Processing Unit) 10a, an input unit 10b, a communication unit 10c, a RAM (Random Access Memory) 10d, and a ROM (Read Only Memory) 10e. And an auxiliary storage device 10f and a bus 10g.

  The CPU 10a in this example includes a control unit 10aa, a calculation unit 10ab, and a register 10ac, and executes various calculation processes according to various programs read into the register 10ac. The input unit 10b is, for example, an input device such as a keyboard or a mouse, an input terminal, or the like.

  The communication unit 10c is a LAN card, a modem, or the like. The RAM 10d is an SRAM (Static Random Access Memory), a DRAM (Dynamic Random Access Memory) or the like, and has a program area 10da for storing a predetermined program and a data area 10db for storing various data. The auxiliary storage device 10f is, for example, a hard disk, an MO (Magneto-Optical disc), a semiconductor memory, or the like, and has a program area 10fa for storing a predetermined program and a data area 10fb for storing various data. Yes. The bus 10g connects the CPU 10a, the input unit 10b, the communication unit 10c, the RAM 10d, the ROM 10e, and the auxiliary storage device 10f so that information can be exchanged.

  Note that the hardware configuration of the other communication devices (v [1] to v [n]) 20-1 to 20-n is the same as the hardware configuration of the communication device (v [0]) 10, and thus the description thereof is omitted. .

[Cooperation between hardware and software]
The communication apparatus (v [0]) 10 and the communication apparatuses (v [1] to v [n]) 20-1 to 20-n of the present embodiment are configured by reading a predetermined program into the hardware described above. . Hereinafter, functional configurations of the communication device (v [0]) 10 and the communication devices (v [1] to v [n]) 20-1 to 20-n configured as described above will be described.

<Communication device (v [0]) 10>
FIG. 2 is a block diagram illustrating a functional configuration of the communication apparatus 10 according to the present embodiment.
As shown in FIG. 2, the communication device 10 of the present embodiment includes a memory 11, an input unit 12, a transmission unit 13a, a reception unit 13b, a control unit 14, an arbitrary value setting unit 15a, and a first calculation unit. 15b, second computing unit 15c, third computing unit 15d, fourth computing unit 15e, fifth computing unit 15f, sixth computing unit 15g, seventh computing unit 15h, and eighth computing unit 15i. A ninth arithmetic unit 15j, a tenth arithmetic unit 15k, an eleventh arithmetic unit 15m, a twelfth arithmetic unit 15n, a thirteenth arithmetic unit 15p, a fourteenth arithmetic unit 15q, and a dummy block information generation unit 15r. A reply path information generation unit 15s, a determination unit 15t, and a reply message decoding unit 15u.

  Here, the memory 11 is configured by, for example, an auxiliary storage device 10f, a RAM 10d, a register 10ac, a cache memory, other devices that can physically hold bit information, or a combination of at least some of these devices. Storage area. The input unit 12 is, for example, an input unit 10b that is driven under the control of the CPU 10a in which a predetermined program is read. The transmission unit 13a and the reception unit 13b are communication units 10c that are driven under the control of the CPU 10a in which a predetermined program is read. Further, the control unit 14, the arbitrary value setting unit 15a, the first calculation unit 15b, the second calculation unit 15c, the third calculation unit 15d, the fourth calculation unit 15e, the fifth calculation unit 15f, 6 computing unit 15g, 7th computing unit 15h, 8th computing unit 15i, 9th computing unit 15j, 10th computing unit 15k, 11th computing unit 15m, 12th computing unit 15n, 13th computing unit The calculation unit 15p, the fourteenth calculation unit 15q, the dummy block information generation unit 15r, the reply path information generation unit 15s, the determination unit 15t, and the reply message decryption unit 15u, for example, have read a predetermined program CPU 10a. The communication device (v [0]) 10 executes each process under the control of the control unit 14. Each processing unit reads data necessary for processing from the memory 11 and stores the processing result in the memory 11.

<Communication Device (v [u]) 20-u that Performs Reception Processing of Reply Path Information RI [u-1]>
FIG. 3 shows a communication device (v [u-1]) that performs reception processing of the return path information RI [u-1] transmitted from the communication device v [u-1] (u = 1,..., N). ]) It is a block diagram showing a functional configuration of 20-u.
As shown in FIG. 3, the communication device (v [u]) 20-u includes a memory 21-u, an input unit 22-u, and transmission units 23a-u (“first transmission means” and “second” Transmission unit ”), reception unit 23b-u (corresponding to“ first reception unit ”and“ second reception unit ”), control unit 24-u, block information selection unit 25a-u, Block information update unit 25b-u, second block information update unit 25c-u, third block information update unit 25d-u, arbitrary value setting unit 25e-u, randomization units 25f-u, 25h-u And a sixth block information updating unit 25g-u and an order changing unit 25i-u.

  Here, the memory 21-u is configured by, for example, an auxiliary storage device, a RAM, a register, a cache memory, other devices that can physically hold bit information, or a combination of at least some of these devices. Storage area. The input unit 22-u is an input unit such as a keyboard that is driven under the control of the CPU in which a predetermined program is read. The transmission unit 23a-u and the reception unit 23b-u are communication units such as a LAN card that is driven under the control of the CPU loaded with a predetermined program. Further, the control unit 24-u, the block information selection unit 25a-u, the first block information update unit 25b-u, the second block information update unit 25c-u, and the third block information update unit 25d-u The arbitrary value setting unit 25e-u, the randomizing units 25f-u, 25h-u, the sixth block information updating unit 25g-u, and the order changing unit 25i-u, for example, read a predetermined program CPU. Note that (v [u]) 20-u executes each process under the control of the control unit 24-u. Each processing unit reads data necessary for processing from the memory 21-u and stores the processing result in the memory 21-u.

<Communication device (v [u]) 20-u performing reply start processing>
FIG. 4 shows a communication apparatus of this embodiment that performs a reply start process using reply path information RI [u-1] transmitted from the communication apparatus v [u-1] (u = 1,..., N). v [u]) is a block diagram showing a functional configuration of 20-u.
As shown in FIG. 4, the communication device 20-u includes a memory 21-u, an input unit 22-u, a transmission unit 23a-u, a reception unit 23b-u, a control unit 24-u, a block Information selection unit 25a-u, first block information update unit 25b-u, fourth block information update unit 26a-u, deletion unit 26b-u, arbitrary value setting unit 26c-u, and randomization unit 26d -U, order changing unit 26e-u, first arbitrary value setting unit 26f-u, seventh block information updating unit 26g-u, eighth block information updating unit 26h-u, and tenth block information updating Unit 26i-u and an eleventh block information update unit 26j-u.

  Here, the fourth block information update unit 26a-u, the deletion unit 26b-u, the arbitrary value setting unit 26c-u, the randomizing unit 26d-u, the order changing unit 26eu, and the first arbitrary value A setting unit 26f-u, a seventh block information update unit 26g-u, an eighth block information update unit 26h-u, a tenth block information update unit 26i-u, an eleventh block information update unit 26j-u, Is, for example, a CPU loaded with a predetermined program.

<Communication device (v [u]) 20-u that performs reply reception processing>
FIG. 5 shows a communication apparatus (v [u]) according to the present embodiment that performs a reception process of reply path information RI [u-1] returned from the communication apparatus v [u + 1] (0 ≦ u ≦ n−1). It is the block diagram which showed the function structure of 20-u (0 <= u <= n-1).
As shown in FIG. 5, the communication device 20-u includes an input unit 22-u, a transmission unit 23a-u (corresponding to “third transmission means”), a reception unit 23b-u, and a control unit 24- u, a determination unit 27a-u, a fifth block information update unit 27b-u, a ninth block information update unit 27c-u, a twelfth block information update unit 27d-u, and a second arbitrary value setting unit 27e. -U, 13th block information update unit 27f-u, 14th block information update means 27g-u, 15th block information update means 27h-u, 16th block information update means 27i-u, arbitrary value A setting unit 27j-u and a randomizing unit 27k-u are included.

  Here, the determination unit 27a-u, the fifth block information update unit 27b-u, the ninth block information update unit 27c-u, the twelfth block information update unit 27d-u, and the second arbitrary value setting unit 27e -U, 13th block information update unit 27f-u, 14th block information update means 27g-u, 15th block information update means 27h-u, 16th block information update means 27i-u, arbitrary value The setting unit 27j-u and the randomizing unit 27k-u are, for example, CPUs into which a predetermined program has been read.

  3 to 5, the functional configuration of the communication device 20-u has been described for each function of the communication device 20-u, but each communication device 20-u actually has all the functional configurations of FIGS. 3 to 5. It has. In the example of the present embodiment, the communication device 10 has all the functional configurations of FIGS. 3 to 5, and each communication device 20-u also has the functional configuration of the communication device 10. That is, in the example of this embodiment, the communication device 10 and each communication device 20-u have the same functional configuration, and use each function properly as necessary.

<Processing>
The transmission information transmitted from the communication device (v [0]) 10 includes communication devices (v [1],... In the order of v [1],..., V [n−1] (n ≧ 2). ., v [n-1]) 20-1 to 20-n and relayed to the communication device (v [n]) 20-n. This information transmission is performed using a known anonymous communication method such as onion routing, but the point that reply path information unique to this embodiment is added to the transmission information transmitted thereby is a difference from the conventional one. . Here, the process in which the communication device (v [0]) 10 starts anonymous communication is referred to as “transmission start processing”, and this transmission information is referred to as the communication device (v [1],..., V [n-1] ) Processing performed when receiving at 20-1 to 20-n is referred to as "transmission reception processing". In this embodiment, the process of sending information from the communication device v [h-1] (h = 1,..., N) to the communication device v [h] is called “transmission”, and the communication device v [h] The process of sending information from the communication device to the communication device v [h-1] is called “reply”.

  In the anonymous communication system 1 of this embodiment, any communication device (v [c + 1]) 20- (c + 1) (c is an integer of u + 1 ≦ c ≦ n−1) is sent. Reply to information. The reply information is relayed to the communication devices (v [c],..., V [1]) 20-c to 1 in the order of v [c],. v [0]) is delivered to 10. Here, a process in which the communication device (v [c + 1]) 20- (c + 1) starts a reply is called a “reply start process”, and the reply information is transmitted to the communication devices (v [c],..., V [ 1]) The processing performed when 20-c to 1 and the communication device (v [0]) 10 receive is referred to as “reply reception processing”.

  In the following, after describing the “premise” of each process, “transmission start process”, “transmission reception process”, “reply start process”, and “reply reception process” for each communication device will be described.

[Assumption]
The premise of “transmission start processing”, “transmission reception processing”, “reply start processing”, and “reply reception processing” will be described.

First, G is a cyclic group of order q (q is a large prime number), and g is a generator of the cyclic group G. In this embodiment, it is assumed that the cyclic group G, the generation source g thereof, and information on the order q are described in the program for configuring each communication device. From the viewpoint of safety, it is desirable that the cyclic group G is difficult to solve the discrete logarithm problem constructed there in polynomial time. In addition, as an implementation example of such a cyclic group G, for example, a group formed by rational points on an elliptic curve used for elliptic curve cryptography, a finite field multiplicative group used for Elgamal cryptography, or the like can be used. (See, for example, “Tatsuaki Okamoto, Hiroshi Yamamoto,“ Contemporary Cryptography ”, Publishing of Industrial Books, ISBN 4-7828-5353-X (reference 1)”). When a group of rational points on the elliptic curve is used as the cyclic group G, the element is a point on the elliptic curve, and when a multiplicative group of a finite field is used, the element is an integer. In addition, there are various specific methods for realizing a group of rational points on an elliptic curve on a computer. In fact, it consists of a group of rational points on an elliptic curve and is implemented on a computer. There are various possible elliptic curve cryptosystems (for example, Reference 1 and “Ian F. Braque, Gadiel Sellosi, Nigel P. Smart = Author, Jiro Suzuki = translation,“ Elliptic Curve Crypto ”, publication = Pearson Education, ISBN4-89471-431-0 (Reference 2) ”). The operation on the cyclic group G means an operation defined by the cyclic group G. Here, γ · δ∈G means that an operation defined in the cyclic group G is performed using the elements γ and δ of the cyclic group G as operands. Also, γ / δεG means that an operation defined by the cyclic group G is performed using the element γ of the cyclic group G and the inverse element 1 / δ of the element δ of the cyclic group G as operands. Furthermore, γ ^σ ∈ G means that the operation defined in the cyclic group G is performed σ times on γ that is an element of the cyclic group G. For example, γ ⁵ ∈ G is γ · γ · γ · It means γ · γ∈G. When the cyclic group G is a group formed by rational points on the elliptic curve, for example, elliptic addition on the elliptic curve corresponds to “operation on the cyclic group G”. In this case, γ · δ∈G is the elliptic addition of the point γ and the point δ on the elliptic curve, and γ / δ∈G is the inverse point of the point γ on the elliptic curve and the point δ on the elliptic curve − Ellipse addition with δ, and γ ^σ ∈ G is an elliptic scalar multiplication (σ times) operation for the point γ on the elliptic curve. Further, the addition of an ellipse between the point ε on the elliptic curve and the inverse original point −η of the point η on the elliptic curve may be “calculation on the cyclic group G”. In this case, γ · δ∈G is an elliptic addition of the point γ on the elliptic curve and the inverse element −δ of the point δ on the elliptic curve, and γ / δ∈G is the point γ and the point on the elliptic curve. Ellipse addition with δ, and γ ^σ ∈ G is the inverse scalar point of the point γ on the elliptic curve minus the elliptic scalar multiplication (σ times) of γ. Further, when the cyclic group G is a finite field multiplicative group, for example, a product operation modulo p (p = 2q + 1) corresponds to an “operation on the cyclic group G”. In this case, γ · δ∈G is γ · δ mod p when γ and δ are considered as elements of an integer set, and γ / δ∈G is γ / δ when γ and δ are considered as elements of an integer set. [delta] mod p becomes, gamma ^sigma ∈G is, gamma, a gamma ^sigma mod p when viewed with the original a [delta] integer set. Further, for example, multiplication of ε mod p and 1 / η mod p may be “an operation on the cyclic group G”. In this case, γ · δ∈G is γ / δ mod p when γ and δ are regarded as elements of an integer set, and γ / δ∈G is γ · δ when γ and δ are regarded as elements of an integer set. δ mod p, and γ ^σ ∈ G is (1 / γ) ^σ mod p when γ and δ are regarded as elements of an integer set.

  Also, the unique information unique to each communication device v [f] (f = 0,..., N) is E [f]. As the unique information E [f], for example, the MAC address, IP address, user name, user telephone number, etc. of each communication device can be exemplified. The unique information E [0] is stored in the memory 11 of the communication device (v [f]) 10, and each unique information E [h] (h = 1,..., N) corresponds to each. It is assumed that it is stored in the memory 21-h of the communication device (v [h]) 20-h.

Further, the secret key of each communication device v [f] is x [f] εZ _q, and the public key corresponding to each secret key x [f] is y [f] = g ^{x [j]} εG. . However, Z _q = (0,1 ..., q-1). Although it is desirable to set the secret key x [f] satisfying x [f] εZ _q from the viewpoint of calculation efficiency, a configuration in which another integer is set as x [f] may be used. The secret key x [0] is input from the input unit 12 of the communication device (v [0]) 10 and is securely stored in the memory 11, and each secret key x [h] (h = 1,..., N) ) Are input from the input unit 22-h of the corresponding communication device (v [h]) 20-h and stored safely in the memory 21-h.

  Further, the input unit 12 of the communication device (v [0]) 10 discloses each communication device (v [f]) 20-f (f = 0,..., N) constituting the anonymous communication system 1. It is assumed that the key y [f] is input and stored in the memory 11. Further, the input unit 12 of the communication device (v [0]) 10 is connected to each communication device (v [h]) 20-h (h = 1,..., N) constituting the anonymous communication system 1, respectively. It is assumed that the corresponding communication path information e [h−1, h] is input and stored in the memory 11.

  Furthermore, communication path information for specifying each communication path between the communication device v [y] (y is an integer other than u) and the communication device v [u] is expressed as e [y, f]. The input unit 12 of the communication device (v [0]) 10 includes a list of communication path information e [y, 0] corresponding to each communication device v [y] that can communicate with the communication device (v [0]) 10. Are input and stored in the memory 11. Similarly, the input unit 22-u of each communication device (v [h]) 20-h corresponds to each communication device v [y] that can communicate with the communication device (v [h]) 20-h. It is assumed that a list of communication path information e [y, h] is input and stored in the memory 21-h. Note that the communication device v [y] includes a communication device that does not constitute the anonymous communication system 1.

[Transmission start processing]
Next, transmission start processing performed by the communication device (v [0]) 10 will be described.
6 and 7 are flowcharts for explaining the transmission start process of the present embodiment. The transmission start process according to this embodiment will be described below with reference to this figure.

First, the arbitrary value setting unit 15a of the communication device (v [0]) 10 (FIG. 2) corresponds to each of the n communication devices v [j] (j = 1,..., N−1). [0, j, 0], r [1, j, 0], r [0, *, 0] εZ _q are selected at random and stored in the memory 11 (step S12). In terms of computational efficiency, it is desirable to select r [0, j, 0], r [1, j, 0], r [0, *, 0] from Z _q. The configuration may be selected. Further, as a method for randomly selecting these values, for example, a method of generating a pseudo random number and mapping it to Z _q or an integer can be exemplified. Since these items are common to other processes that randomly select a value from Z _q , the same description is omitted below.

Next, the first calculation unit 15b reads E [0], y [0], y [1], and r [0,0,0] from the memory 11, and calculates α [0,0,0] = y. [0] ^{E [0] · r [0,0,0]} · y [1] ^{r [0,0,0]} ∈G and store the result α [0,0,0] in the memory 11 (Step S13). Further, the second calculation unit 15c reads r [0,0,0] from the memory 11, performs the calculation β [0,0,0] = g ^{r [0,0,0]} ∈G, and the calculation result β [0,0,0] is stored in the memory 11 (step S14). Further, the third calculation unit 15d reads y [1] and r [1,0,0] from the memory 11, and calculates α [1,0,0] = y [1] ^{r [1,0,0].} ΕG is performed, and the calculation result α [1,0,0] is stored in the memory 11 (step S15). Further, the fourth calculation unit 15e reads r [1,0,0] from the memory 11, performs the calculation β [1,0,0] = g ^{r [} 1,0,0 ^] ∈G, and the calculation result β [1,0,0] is stored in the memory 11 (step S16). Here, four sets of α [0,0,0], β [0,0,0], α [1,0,0], β [1,0,0] generated in steps S13 to S16 Is expressed as block information RB [0,0] = (α [0,0,0], β [0,0,0], α [1,0,0], β [1,0,0]) .

Further, the fifth calculation unit 15f reads y [1], y [2], e [0,1], and r [0,1,0] from the memory 11, and calculates α [0,1,0]. = y [1] ^{(e [0,1] +1) · r [0,1,0]} · y [2] ^{r [0,1,0]} ∈ G and the result α [0,1 , 0] is stored in the memory 11 (step S17). In addition, the sixth operation unit 15g reads r [0,1,0] from the memory 11, performs the operation β [0,1,0] = g ^{r [0,1,0]} ∈G, and the operation result β [0,1,0] is stored in the memory 11 (step S18). Further, the seventh calculation unit 15h reads y [1], y [2], and r [1,1,0] from the memory 11, and calculates α [1,1,0] = (y [1] · y [2]) ^{r [1,1,0]} εG is performed, and the calculation result α [1,1,0] is stored in the memory 11 (step S19). Further, the eighth operation unit 15i reads r [1,1,0] from the memory 11, performs the operation β [1,1,0] = g ^{r [1,1,0]} ∈G, and the operation result β [1,1,0] is stored in the memory 11 (step S20). Here, four sets of α [0,1,0], β [0,1,0], α [1,1,0], β [1,1,0] generated in steps S17 to S20. Is expressed as block information RB [1,0] = (α [0,1,0], β [0,1,0], α [1,1,0], β [1,1,0]) .

In addition, the ninth arithmetic unit 15j reads y [1], ..., y [m-1], y [m], and y [from memory 11 for each of m = 2, ..., n-1. Read m + 1], r [0, m, 0] and e [m-1, m], and calculate α [0, m, 0] = (y [1] ...... y [m- 1]) ^{r [0, m, 0]}・ y [m] ^{(e [m-1, m] +1) ・ r [0, m, 0]}・ y [m + 1] ^{r [0, m, 0]} εG is performed, and the calculation result α [0, m, 0] is stored in the memory 11 (step S21). In addition, the tenth calculation unit 15k reads r [0, m, 0] from the memory 11, and calculates β [0, m, 0] = g ^r for each of m = 2 ^{,. [0, m, 0]} ∈ G is performed, and the calculation result β [0, m, 0] is stored in the memory 11 (step S22). In addition, the eleventh arithmetic unit 15m reads out y [1],..., Y [m-1], y [m], y [from the memory 11 for each of m = 2,. m + 1] and r [1, m, 0] are read and the operation α [1, m, 0] = (y [1] ・ ... ・ y [m-1] ・ y [m] ・ y [m + 1]) ^{r [1, m, 0]} ∈ G is performed, and the calculation result α [1, m, 0] is stored in the memory 11 (step S23). Further, the twelfth calculation unit 15n reads r [1, m, 0] from the memory 11 for each of m = 2,..., N−1, and calculates β [1, m, 0] = g ^{r. [1, m, 0]} ∈ G is performed, and the calculation result β [1, m, 0] is stored in the memory 11 (step S24). Here, α [0, m, 0], β [0, m, 0], α [1, m, 0], β [1, m, 0] for each m generated in steps S21 to S24. The block information RB [m, 0] = (α [0, m, 0], β [0, m, 0], α [1, m, 0], β [1, m, 0] ) (m = 2, ..., n-1) Note that the block information RB [j, 0] (j = 0,..., N−1) is information for specifying a return path in anonymous communication.

Further, the thirteenth operation unit 15p reads r [0, *, 0] from the memory 11, performs the operation α [0, *, 0] = y [0] ^{r [0, *, 0]} ∈G, The calculation result α [0, *, 0] is stored in the memory 11 (step S25). Further, the fourteenth operation unit 15q reads r [0, *, 0] from the memory 11, performs the operation β [0, *, 0] = g ^{r [0, *, 0]} εG, and the operation result β [0, *, 0] is stored in the memory 11 (step S26). Here, a set of α [0, *, 0] and β [0, *, 0] generated in steps S25 and S26 is used as reply content storage information RB [*, 0] = (α [0, *, 0], β [0, *, 0]). Note that the reply content storage information RB [*, 0] is information for encrypting the reply content.

  In addition, the dummy block information generation unit 15r generates four original sets G [1, d, 0], G [2, d, 0], G [3, d, 0], G [4 , d, 0] εG are randomly selected and stored in the memory 11 D times (D ≧ 1) (step S27). The four sets of G [1, d, 0], G [2, d, 0], G [3, d, 0], G [4, d, 0] for each d generated by Dummy block information DB [d, 0] = (G [1, d, 0], G [2, d, 0], G [3, d, 0], G [4, d, 0]) ( d = 1, ..., D). The dummy block information DB [d, 0] plays a role of preventing the return communication path from being estimated from the length of the return path information.

  Next, the reply path information generation unit 15s generates the n pieces of block information RB [0,0],..., RB [n−1,0] generated in steps S13 to S24 and in step S27. D dummy block information DB [1,0],..., DB [D, 0] are read from the memory 11. Then, the reply path information generation unit 15s performs block information RB [0,0], ..., RB [n-1,0], DB [1,0], ..., DB [D, 0] While maintaining the arrangement order of each of the four sets, a block information sequence in which the arrangement order between the block information is randomly rearranged is generated, and the reply content storage information RB [*, Reply route information RI [0] = (RB [j, 0] with 0] = (α [0, *, 0], β [0, *, 0]) added to a specific position (for example, head position) , DB [d, 0], RB [*, 0]) (j = 0,..., N−1) are generated and stored in the memory 11 (step S28).

  Here, the reply route information RI [0] generated in this way indicates which block information is which block RB [j, 0] and which position information is block DB [d, 0]. Does not include information to indicate. Other communication devices do not hold such information. Thereby, it is possible to reduce the risk that the communication path is estimated from the reply path information RI [0]. On the other hand, since the reply content storage information RB [*, 0] is added to a specific position of the reply route information RI [0], the other communication devices can return the reply content storage information RB from the reply route information RI [0]. [*, 0] can be extracted. Also, the reply route information RI [0] includes block information RB [0,0], ..., RB [n-1,0], DB [1,0], ..., DB [D, 0 ] Since the arrangement order of each quadruple is maintained, the other communication devices determine the division between the block information, the division between the four elements constituting the block information, and the arrangement order thereof. I can know.

  Next, the transmission unit 13a reads the reply path information RI [0] from the memory 11, and transmits the reply path information RI [0] to the communication device (v [1]) 20-1 (step S29). The reply route information RI [0] is added to a message or the like and transmitted using a known anonymous communication method such as onion routing. In the following, description of a known anonymous communication method used for transmission of the reply route information RI [0] will be omitted, and only the processing unique to this embodiment relating to the reply route information will be explained. “Sending information to a communication device” includes processing to send information to the communication device via some relay device in addition to processing to send information to the communication device without going through the relay device. It is a concept that includes.

[Transmission and reception processing]
Next, the communication device (v [u]) 20-u that has received the reply path information RI [u-1] transmitted from the communication device v [u-1] (u = 1,..., N) A transmission / reception process to be performed will be described.

  8 and 9 are flowcharts for explaining the transmission start processing of this embodiment. The transmission start process according to this embodiment will be described below with reference to this figure.

  First, the reply path information RI [u-1] = (RB [j, u-1], DB [d, u] transmitted from the communication device v [u-1] (u = 1, ..., n) -1], RB [*, u-1]) (j = 0, ..., n-1) is received by the receiving unit 23b-u of the communication device (v [u]) 20-u (FIG. 3). Received and stored in the memory 21-u (step S31). Note that RI [u-1] = (RB [j, u-1], DB [d, u-1], RB [*, u-1]) is the communication device v [u-1] (u = 1, ..., n) means the reply route information updated (generated when u = 1). Also, RB [j, u-1] = (α [0, j, u-1], β [0, j, u-1], α [1, j, u-1], β [1, j , u-1]) (j = 0, ..., n-1) and DB [d, u-1] = (G [1, d, u-1], G [2, d, u-1], G [3, d, u-1], G [4, d, u-1]) (d = 1, ..., D) and RB [*, u-1] = (α [0, *, u-1], β [0, *, u-1]). The reply path information RI [u-1] received in step S31 is the reply path information RI [0] transmitted from the communication device (v [0]) 10 when u = 1, and u When ≧ 2, the reply route information RI [0] is in the order of v [1], ..., v [u-1] and the communication devices (v [1], ..., v [u- 1]) Reply route information RI [u-1] updated from 20-1 to (u-1) and transmitted from the communication device (v [u-1]) 20- (u-1).

Next, the block included in the reply path information RI [u-1] stored in the memory 21-u by the block information selection unit 25a-u using the secret key x [u] stored in the memory 21-u. From the information, block information satisfying α [1, j, u-1] = β [1, j, u-1] ^{x [u]} ∈G is selected, and the block information RB [+, u-1] is selected. (Step S32). Information Inf (RB [+, u-1]) specifying the block information RB [+, u-1] is stored in the memory 21-u. The communication device (v [u]) 20-u includes block information RB [0, u-1], ..., RB [n-1, u-1] and a dummy DB [1, u-1 ], ..., DB [D, u-1] cannot be distinguished. Therefore, the block information selection unit 25a-u sets the third element of each block information other than the reply content storage information RB [*, u-1] included in the reply route information RI [u-1] as α [1, j, u-1], the fourth element is β [1, j, u-1] and α [1, j, u-1] = β [1, j, u-1] ^{x [ It} is verified whether or not ^u] ∈ G is satisfied, and block information RB [+, u−1] that satisfies this is searched.

Next, the first block information update unit 25b-u reads the information Inf (RB [+, u-1]) from the memory 21-u, and returns the reply path information RI [u-1] stored in the memory 21-u. ] Identifies block information RB [+, u-1], and calculates α [0, j, u for α [0, j, u-1] of the identified block information RB [+, u-1] -1] / β [0, j, u-1] ^{2 · x [u]} ∈ G, and the operation result is converted into a new α [0, j, u- The block information RB [+, u-1] is updated as 1], thereby updating the reply path information RI [u-1] stored in the memory 21-u (step S33).

  Next, the control unit 24-u determines whether or not the communication device (v [u]) 20-u sends a reply (step S34). Note that the case where the communication device (v [u]) 20-u sends a reply is, for example, when u = n or when the communication device (v [u + 1]) 20- (u + 1) breaks down. For example, the communication error information needs to be returned to the communication device (v [0]) 10.

  Here, when it is determined that the communication device (v [u]) 20-u sends a reply, a reply start process of the communication device v [u] described later is executed.

On the other hand, if it is determined that the communication device (v [u]) 20-u does not send a reply, first, the second block information update unit 25c-u reads information Inf (RB [+] from the memory 21-u. , u-1]), and the block information RB [+, u-1] is specified from the reply path information RI [u-1] stored in the memory 21-u. Then, the second block information updating unit 25c-u receives the block information RB [0, u-1],... Included in the reply path information RI [u-1] excluding the block information RB [+, u-1]. ., RB [n-1, u-1] α [0, j, u-1], β [0, j, u-1] / β [0, j, u-1] ^{x [u]} ∈ G, and each of these calculation results is regarded as each new α [0, j, u-1] and the block information RB [0, u− 1], ..., RB [n-1, u-1] are updated. The second block information updating unit 25c-u is configured to block information RB [0, u-1], ..., RB [n-1, u-1] and block information DB [1, u-1], ..., DB [D, u-1] cannot be distinguished from each other, and all block information DB [1, u-1], ..., DB [D included in the reply path information RI [u-1] , u-1] for G [1, d, u-1] and G [2, d, u-1], respectively, G [1, d, u-1] = G [1, d , u-1] / G [2, d, u-1] ^{x [u]} ∈ G, and each of these operation results is regarded as a new G [1, d, u-1] Update [1, u-1], ..., DB [D, u-1]. As a result, the reply path information RI [u-1] stored in the memory 21-u is updated (step S35).

Further, the third block information updating unit 25d-u reads the information Inf (RB [+, u-1]) from the memory 21-u and returns the reply path information RI [u-1] stored in the memory 21-u. Block information RB [+, u-1] is specified. Then, the third block information update unit 25d-u includes the block information RB [0, u-1],... Included in the reply path information RI [u-1] excluding the block information RB [+, u-1]. ., RB [n-1, u-1] α [1, j, u-1], β [1, j, u-1] / β [1, j, u-1] ^{x [u]} ∈ G, and each of these operation results is regarded as each new α [1, j, u-1] and the block information RB [0, u− 1], ..., RB [n-1, u-1] are updated. The third block information update unit 25d-u is configured to block information RB [0, u-1], ..., RB [n-1, u-1] and block information DB [1, u-1], ..., DB [D, u-1] cannot be distinguished from each other, and all block information DB [1, u-1], ..., DB [D included in the reply path information RI [u-1] , u-1] for G [3, d, u-1] and G [4, d, u-1], respectively, G [3, d, u-1] = G [3, d , u-1] / G [4, d, u-1] ^{x [u]} ∈ G, and each of these operation results is regarded as a new G [3, d, u-1] Update [1, u-1], ..., DB [D, u-1]. As a result, the reply route information RI [u-1] stored in the memory 21-u is updated (step S36).

After that, the arbitrary value setting unit 25e-u receives r1 [0, j, u], r1 [1, corresponding to n communication devices v [j] (j = 1,..., N−1), respectively. j, u], r1 [0, *, u] εZ _q are selected at random and stored in the memory 21-u (step S37).

Next, the randomizing unit 25f-u converts each element of the reply path information RI [u-1] stored in the memory 21-u to α [0, j, u-1] = α [0, j, u -1] ^{r1 [0, j, u]} ∈G, G [1, d, u-1] = G [1, d, u-1] ^{r1 [0, j, u]} ∈G
β [0, j, u-1] = β [0, j, u-1] ^{r1 [0, j, u]} ∈G, G [2, d, u-1] = G [2, d, u -1] ^{r1 [0, j, u]} ∈G
α [1, j, u-1] = α [1, j, u-1] ^{r1 [1, j, u]} ∈G, G [3, d, u-1] = G [3, d, u -1] ^{r1 [1, j, u]} ∈G
β [1, j, u-1] = β [1, j, u-1] ^{r1 [1, j, u]} ∈G, G [4, d, u-1] = G [4, d, u -1] ^{r1 [1, j, u]} ∈G
(Step S38).

Furthermore, the sixth block information update unit 25g-u uses the secret key x [u] stored in the memory 21-u, and includes reply path information RI [u-1] stored in the memory 21-u. Operation α [0, *, u-1] for α [0, *, u-1], β [0, *, u-1] of reply content storage information RB [*, u-1] β [0, *, u-1] ^{x [u]} ∈ G is performed, and the result of the operation is set as a new α [0, *, u-1], and the response content storage information RB [*, u-1] Is updated accordingly, and the reply route information RI [u-1] is updated (step S39).

Next, the randomizing unit 25h-u uses each information stored in the memory 21-u,
α [0, *, u-1] = α [0, *, u-1] ^{r1 [0, *, u]} ∈G
β [0, *, u-1] = β [0, *, u-1] ^{r1 [0, *, u]} ∈G
The return route information RI [u-1] stored in the memory 21-u is updated by these calculation results (step S40).

  Next, the order changing unit 25i-u performs the order of RB [j, u-1] and DB [d, u-1] constituting the reply path information RI [u-1] stored in the memory 21-u. Are rearranged at random, and the reply route information RI [u-1] is updated (step S41).

  Then, the reply path information RI [u-1] that has been updated as described above is stored in the memory 21-u as reply path information RI [u]. After that, the reply route information RI [u] is sent to the transmitter 23a-u, and the sender 23a-u sends the reply route information RI [u] to the communication device (v [u + 1]) 20- (u + 1). ) (Step S42).

[Reply start processing]
Next, the communication device (v [u]) 20-u is applied to the reply route information RI [u-1] transmitted from the communication device v [u-1] (u = 1,..., N). A process when the reply start process is performed will be described.

  FIG. 10 is a flowchart for explaining the reply start process of this embodiment. Hereinafter, the reply start processing of this embodiment will be described with reference to this figure.

First, the fourth block information update unit 26a-u of the communication device (v [0]) 10 (FIG. 4) stores in the memory 21-u using the secret key x [u] stored in the memory 21-u. .., RB [n-1, u-1] block information RB [0, u-1],... RB [n-1, u-1] ], β [0, j, u-1] are calculated α [0, j, u-1] and β [0, j, u-1] ^{x [u]} ∈ G, respectively. The block information RB [0, u-1],..., RB [n-1, u-1] is updated with the calculation result as each new α [0, j, u-1]. The fourth block information updating unit 26a-u is configured to block information RB [0, u-1], ..., RB [n-1, u-1] and block information DB [1, u-1], ..., DB [D, u-1] cannot be distinguished from each other, and all block information DB [1, u-1], ..., DB [D included in the reply path information RI [u-1] , u-1] for G [1, d, u-1] and G [2, d, u-1], respectively, G [1, d, u-1] = G [1, d , u-1] · G [2, d, u-1] ^{x [u]} ∈G, and each of these calculation results is set as the new G [1, d, u-1] Update [1, u-1], ..., DB [D, u-1]. As a result, the reply path information RI [u-1] stored in the memory 21-u is updated (step S51).

  Next, the deletion unit 26b-u uses the block information RB [j, u-1] (j = 0,..., N) included in the reply path information RI [u-1] stored in the memory 21-u. -1) by deleting α [1, j, u-1], β [1, j, u-1] and RB [j, u-1] = (α [0, j, u-1], β [0, j, u-1]) and block information DB [d, u-1] (d = 0, ..., D) from G [3, d, u-1], G [4, d, u-1] is deleted and DB [d, u-1] = (G [1, d, u-1], G [2, d, u-1]) is stored in the memory 21-u. The returned reply route information RI [u-1] is updated (step S52). This update is a process of deleting information not used thereafter from the reply content storage information RI [u-1].

Next, the arbitrary value setting unit 26c-u sets r3 [0, j, u] ∈Z _q corresponding to each of the n communication devices v [j] (j = 1,..., N−1). A random selection is made and stored in the memory 21-u (step S53).

Then, the randomizing unit 26d-u uses each element stored in the memory 21-u,
α [0, j, u-1] = α [0, j, u-1] ^{r3 [0, j, u]} ∈G, G [1, d, u-1] = G [1, d, u -1] ^{r3 [0, j, u]} ∈G
β [0, j, u-1] = β [0, j, u-1] ^{r3 [0, j, u]} ∈G, G [2, d, u-1] = G [2, d, u -1] ^{r3 [0, j, u]} ∈G
To update the reply route information RI [u-1] stored in the memory 21-u (step S54).

  Next, the order rearrangement unit 26e-u stores the RB [j, u-1], DB [d, u-1] constituting the reply route information RI [u-1] stored in the memory 21-u. The order is rearranged at random, and the communication path information RI [u-1] is updated (step S55).

Next, the first arbitrary value setting unit 26f-u randomly sets r [0, *, u], r [1, *, u] ∈Z _q and sets r [0, *, u] , r [1, *, u] εZ _q are stored in the memory 21-u (step S56).

Then, the seventh block information update unit 26g-u performs α [0] of the reply content storage information RB [*, u-1] included in the reply route information RI [u-1] stored in the memory 21-u. , *, u−1] using r [0, *, u] stored in the memory 21-u, and the operation M · α [0, *, u− 1] Perform ^{r [0, *, u]} ∈ G, update the reply content storage information RB [*, u-1] as the new α [0, *, u-1], and Thereby, the reply route information RI [u-1] stored in the memory 21-u is updated (step S57). The reply message M may be generated from information input from the input unit 22-u, or may be predetermined (for example, communication error information).

Also, the eighth block information update unit 26h-u performs β [0] of the reply content storage information RB [*, u-1] included in the reply route information RI [u-1] stored in the memory 21-u. , *, u-1], using r [0, *, u] stored in the memory 21-u, the operation β [0, *, u-1] ^{r [0, *, u]} ∈G And the reply content storage information RB [*, u-1] is updated with the calculation result as a new β [0, *, u-1], and the reply path stored in the memory 21-u is thereby updated. Information RI [u-1] is updated (step S58).

Next, the tenth block information update unit 26i-u performs α [[of the reply content storage information RB [*, u-1] included in the reply route information RI [u-1] stored in the memory 21-u. For 0, *, u−1], r [1, *, u] stored in the memory 21-u is used, and the operation α [1, *, u-1] = α [0, *, u− 1] Perform ^{r [1, *, u]} ∈ G, add the operation result α [1, *, u-1] as an element of the reply content storage information RB [*, u-1], and To update the reply route information RI [u-1] stored in the memory 21-u (step S59).

Further, the eleventh block information update unit 26j-u performs β [0] of the reply content storage information RB [*, u-1] included in the reply route information RI [u-1] stored in the memory 21-u. , *, u-1], using r [1, *, u] stored in the memory 21-u, the operation β [1, *, u-1] = β [0, *, u-1 ] Perform ^{r [1, *, u]} ∈ G and add the calculation result β [1, *, u-1] as an element of the reply content storage information RB [*, u-1]. The reply route information RI [u-1] stored in the memory 21-u is updated (step S60).

  Then, the reply path information RI [u-1] that has been updated as described above is stored in the memory 21-u as reply path information RI [u]. Thereafter, the reply path information RI [u] is sent to the transmitter 23a-u, and the sender 23a-u sends the reply path information RI [u] to the communication device (v [u-1]) 20- (u-1). ) (Step S61).

[Reply receiving process of communication device v [u + 1] (1≤u≤n-1)]
Next, the communication device (v [u]) 20-u (1) is returned to the reply path information RI [u + 1] returned from the communication device v [u + 1] (1 ≦ u ≦ n−1). ≦ u ≦ n−1) will be described when the reply reception process is performed.

  First, the receiving unit 22-u of the communication device (v [u]) 20-u (FIG. 5) returns the reply path information RI [u] returned from the communication device (v [u + 1]) 20- (u + 1). +1] is received and stored in the memory 21-u (step S71).

  When 1 ≦ u ≦ n−2, the reply path information RI [u + 1] received in step S71 is the reply path information RI [0] transmitted from the communication device (v [0]) 10. , V [1], ..., v [c] (c is an integer of u + 1≤c≤n-1) in the order of communication devices (v [1], ..., v [c]) Updated at 20-1 to c, transmitted to the communication device (v [c + 1]) 20-(c + 1) performing the reply, updated at the communication device (v [c + 1]) 20-(c + 1), It is returned to the communication device v [c], and in the order of v [c], ..., v [u + 1], the communication device (v [c], ..., v [u + 1]) 20- The reply route information RI [u + 1] updated from c to (u + 1) and returned from the communication device (v [u + 1]) 20- (u + 1).

  When u = n−1, the reply path information RI [u + 1] received in step S71 is the reply path information RI [0] transmitted from the communication device (v [0]) 10 Updated in the order of [1], ..., v [n-1] in the communication devices (v [1], ..., v [n-1]) 20-1 to (n-1), It is transmitted to the communication device (v [n]) 20-n that makes a reply, updated by the communication device (v [n]) 20-n, and the communication device (v [n-1]) 20- (n-1) Is the reply route information RI [n] replied to.

Next, the determination unit 27a-u uses x [u], E (u), e [y, u] stored in the memory 21-u, and (1) a reply path stored in the memory 21-u. Α [0, j, u +] for any combination of block information RB [j, u + 1] included in information RI [u + 1] and any channel information e [y, u] 1] = β [0, j, u + 1] ^{e [y, u]} εG is satisfied, or (2) the reply path information RI [u + 1] stored in the memory 21-u includes It is determined whether the block information RB [j, u + 1] satisfies α [0, j, u + 1] = β [0, j, u + 1] ^{x [u] · E (u)} ∈G ( Step S72).

Here, when u ≠ 0, the condition (2) is not satisfied, and the block information RB [j, u + 1] and the channel information e [y, u] satisfying the condition (1) There are pairs. The determination unit 27a-u obtains block information RB [j, u + 1] and communication path information e [y, u] that satisfy the condition 1), respectively.
e [u-1, u] = {e [y, u] | α [0, j, u + 1] = β [0, j, u + 1] ^{x [u] · e [y, u]} ∈ G}
RB [++, u + 1] = {RB [j, u + 1] | α [0, j, u + 1] = β [0, j, u + 1] ^{[u] ・ e [y, u ]} ∈G}
And information inf (RB [++, u + 1]) for specifying RB [++, u + 1] and channel information e [u-1, u] are stored in the memory 21-u. (Step S73).

Next, the fifth block information update unit 27b-u uses the information inf (RB [++, u + 1]) stored in the memory 21-u to generate block information RB [++, u + 1]. Using the secret key x [u] specified and stored in the memory 21-u, the block information RB [0,0 included in the reply path information RI [u + 1] excluding the block information RB [++, u + 1] [alpha] [0, j, u + 1] · β [0 for each α [0, j, u + 1] of u + 1], ..., RB [n-1, u + 1] , j, u + 1] ^{x [u]} ∈ G, and each of these calculation results is regarded as each new α [0, j, u + 1], β [0, j, u + 1] The information RB [0, u + 1], ..., RB [n-1, u + 1] is updated, and thereby the reply route information RI [u + 1] stored in the memory 21-u is updated. (Step S74).

Next, the ninth block information update unit 27c-u performs α [[of the reply content storage information RB [*, u + 1] included in the reply route information RI [u + 1] stored in the memory 21-u. [0, *, u + 1], β [0, *, u + 1], using the secret key x [u] stored in the memory 21-u, and the operation α [0, *, u + 1] / β [0, *, u + 1] ^{x [u]} ∈ G, the calculation result is set as a new α [0, *, u + 1], and the reply content storage information RB [*, u + 1 ], Thereby updating the reply route information RI [u + 1] stored in the memory 21-u (step S75).

In addition, the twelfth block information update unit 27d receives α [1, *] of the reply content storage information RB [*, u + 1] included in the reply route information RI [u + 1] stored in the memory 21-u. , u + 1], β [1, *, u + 1], using the secret key x [u] stored in the memory 21-u, the operation α [1, *, u + 1] / β [ 1, *, u + 1] ^{x [u]} ∈ G, and update the response content storage information RB [*, u + 1] with the result as the new α [1, *, u + 1] As a result, the reply route information RI [u + 1] stored in the memory 21-u is updated (step S76).

Also, the second arbitrary value setting unit 27e-u randomly selects r2 [0, *, u], r2 [1, *, u] ∈Z _q , and selects the selected r2 [0, *, u], r2 [1, *, u] εZ _q is stored in the memory 21-u (step S77).

Then, α [0, *, u +] of the reply content storage information RB [*, u + 1] included in the reply route information RI [u + 1] updated as described above and stored in the memory 21-u. [1], α [1, *, u + 1] for the operation α [0, *, u + 1] · α [1 using r2 [0, *, u] stored in the memory 21-u , *, u + 1] ^{r2 [0, *, u]} ∈ G, the calculation result is set as a new α [0, *, u + 1], and the reply content storage information RB [*, u + 1 ], Thereby updating the reply route information RI [u + 1] stored in the memory 21-u (step S78).

Next, the fourteenth block information update unit 27g-u performs the reply content storage information RB [*, u + 1] β [[[u + 1]] included in the reply path information RI [u + 1] stored in the memory 21-u. [0, *, u + 1], β [1, *, u + 1] is calculated using r2 [0, *, u] stored in the memory 21-u, β [0, *, u + 1] · β [1, *, u + 1] ^{r2 [0, *, u]} ∈ G, and the operation result is set as a new β [0, *, u + 1], and the response content storage information RB [*, u + 1] is updated, and thereby the reply path information RI [u + 1] stored in the memory 21-u is updated (step S79).

In addition, the fifteenth block information updating unit 27h-u performs α [1] of the reply content storage information RB [*, u + 1] included in the reply route information RI [u + 1] stored in the memory 21-u. , *, u + 1 ^{] with} respect to the operation α [1, *, u + 1] ^{r2 [1, *, u]} ∈G using r2 [1, *, u] stored in the memory 21-u And the reply content storage information RB [*, u + 1] is updated with the calculation result as a new α [1, *, u + 1], and the reply path stored in the memory 21-u is thereby updated. Information RI [u + 1] is updated (step S80).

Also, the sixteenth block information updating unit 27i-u performs β [1] of the reply content storage information RB [*, u + 1] included in the reply route information RI [u + 1] stored in the memory 21-u. , *, u + 1] for the operation β [1, *, u + 1] ^{r2 [1, *, u]} ∈G using r2 [1, *, u] stored in the memory 21-u And the reply content storage information RB [*, u + 1] is updated with the calculation result as a new β [1, *, u + 1], and the reply path stored in the memory 21-u is thereby updated. Information RI [u + 1] is updated (step S81).

Next, the arbitrary value setting unit 27j-u sets r4 [0, j, u] ∈Z _q corresponding to each of the n communication devices v [j] (j = 1,..., N−1). A random selection is made and stored in the memory 21-u (step S82).

Then, the randomizing unit 27k-u uses each element stored in the memory 21-u,
α [0, j, u + 1] = α [0, j, u + 1] ^{r4 [0, j, u]} ∈G,
G [1, d, u + 1] = G [1, d, u + 1] ^{r4 [0, j, u]} ∈G,
β [0, j, u + 1] = β [0, j, u + 1] ^{r4 [0, j, u]} ∈G,
G [2, d, u + 1] = G [2, d, u + 1] ^{r4 [0, j, u]} ∈G
To update the reply route information RI [u + 1] stored in the memory 21-u (step S83).

  Next, the order rearranging unit 26e-u stores the RB [j, u + 1], DB [d, u + 1] constituting the reply path information RI [u + 1] stored in the memory 21-u. The order is rearranged at random, and the communication path information RI [u + 1] is updated (step S84).

  Then, the reply path information RI [u + 1] updated as described above is stored in the memory 21 + u as reply path information RI [u]. Thereafter, the reply path information RI [u] is sent to the transmitter 23a-u, and the sender 23a-u sends the reply path information RI [u] to the communication device (v [u-1]) 20- (u-1). ) (Step S85).

[Reply receiving process of communication device v [1]]
FIG. 11 and FIG. 12 illustrate processing when the communication device (v [0]) 10 performs reply reception processing on the reply route information RI [1] returned from the communication device v [1]. It is a flowchart of. Hereinafter, a process when the communication device (v [0]) 10 performs a reply reception process on the reply route information RI [1] returned from the communication device v [1] will be described using these drawings. .

  First, the receiving unit 13b of the communication device (v [0]) 10 (FIG. 2) receives the reply path information RI [1] returned from the communication device (v [1]) 20-1, and stores it in the memory 11. Store (step S71).

  Note that the reply path information RI [1] received in step S71 includes the reply path information RI [0] transmitted from the communication device (v [0]) 10 as v [1],. c] (c is an integer of u + 1 ≦ c ≦ n−1), updated by the communication devices (v [1],..., v [c]) 20-1 to c, and replies Sent to the communication device (v [c + 1]) 20- (c + 1), updated by the communication device (v [c + 1]) 20- (c + 1), returned to the communication device v [c], and v [ c],..., v [1] in the order of the communication devices (v [c],..., v [1]) 20-c to 1 and the communication device (v [1]) 20 is updated. -Reply route information RI [1] returned from -1.

Next, the determination unit 15t uses x [0], E (0), e [y, 0] stored in the memory 11, and (1) the reply path information RI [1] stored in the memory 11 is Α [0, j, 1] = β [0, j, 1] ^e for a combination of any block information RB [j, 1] included and any channel information e [y, 0] ^{[y, 0]} εG is satisfied, or (2) any block information RB [j, 1] included in the reply path information RI [1] stored in the memory 11 is α [0, j, 1] = It is determined whether or not β [0, j, 1] ^{x [0] · E (u)} εG is satisfied (step S72).

Here, in the case of the communication device v [1], the condition (1) is not satisfied, and the condition (2) is satisfied. In this case, the reply message decrypting unit 15u performs the α [0, *, 1], β [0] of the reply content storage information RB [*, 1] included in the reply route information RI [1] stored in the memory 11. , *, 1] is calculated α [0, *, 1] / β [0, *, 1] ^{x [0]} ∈ G, and the calculation result is stored in the memory 11 as a reply message M∈G. (Step S86).

[Features of this embodiment]
As described above, the information size of the reply route information RI [0] of the present embodiment is O (n).

Further, in this embodiment, the reply route information RI [0] transmitted from the communication device v [0] is updated to v [1], ..., v [c], and any communication device that performs a reply start process Delivered to v [c + 1]. First, since the communication device v [c + 1] knows the communication path to the immediately preceding communication device v [c], it can reply to the communication device v [c]. Further, as can be understood by following the above processing, each of the communication devices v [c],..., V [1] performs the processing of step S72, thereby each communication device being the next reply destination. However, it is not possible to obtain communication path information to other communication devices on the anonymous communication path. This means that each communication path information on the anonymous communication path is encrypted and stored in each block information RB constituting the reply path information, and the communication path information to the next transmission destination is encrypted in step S33 at the time of transmission. A special update process is performed on the block information RB [+, u-1], and an update operation is performed on each block information RB other than RB [+, u-1] in steps S35 and S36. This is because the update / restoration process is executed in step S74. That is, as will be apparent if the above processing is followed step by step, as a result of performing such processing, each communication device becomes α [0, j, u + 1] = β [0, j, u + in step S72. 1] The block information that detects the block information satisfying ^{x [u] · e [y, u]} ∈ G is a block obtained by encrypting the communication path information for specifying the communication path to the next communication device of the return destination. Information only. If the discrete logarithm problem in the cyclic group G is difficult and each communication device does not know the secret key of the other communication device, each communication device establishes a communication path to a communication device other than its own reply destination. The specified communication path information cannot be obtained.

  As described above, in this embodiment, reply path information with a small information size can be used, and a reply by anonymous communication can be performed in any communication device on the transmission path.

[Modifications, etc.]
The present invention is not limited to the embodiment described above. For example, in the present embodiment, the case where the respective communication devices are independent from each other is illustrated, but a configuration in which at least some of the communication devices are managed by the same administrator may be employed.

  In this embodiment, each communication device 20-u has all the functional configurations shown in FIGS. However, at least some of the communication devices 20-u may be configured to include only a part of the functional configuration illustrated in FIGS. For example, if the destination communication device v [n] is fixed to the communication device 20-n, the communication device 20-n may not have the functional configuration shown in FIG. 3 and FIG. .

  In this embodiment, the communication device 10 also has all the functional configurations of FIGS. 3 to 5, and each communication device 20-u also has the functional configuration of the communication device 10. However, the communication apparatus 10 may not have the functional configuration of FIGS. 3 to 5 or may have a partial functional configuration. Also, each communication device 20-u may not have the functional configuration of the communication device 10, or may have a partial functional configuration. Furthermore, the configuration may be such that only some of the communication devices 20-u further include at least a part of the functional configuration of the communication device 10.

If there is no need to encrypt the reply message M, the process of randomly selecting r [0, *, 0] εZ _q in step S12, the process of steps S25 and S26, and the reply route information RI [ [0] is omitted, RB [*, 0] is added, processing in step S39, processing in steps S56 to S60, processing in steps S75 to S81, etc. May be.

  Further, although the safety is lowered, the processes related to the dummy block information included in step S27, step S54, step S83, and the like, and their processing units may be omitted. In addition, the block information rearrangement process such as step S28, step S41, step S55, and step S84 and the processing units thereof may be omitted. Step S37, step S38, step S40, step S53, step S54, step Randomization processing such as S82 and step S83, and their processing units may be omitted.

  Furthermore, although the process of step S52 is a process of deleting information that will not be used thereafter from the reply content storage information, the process of step S52 and its processing unit may be omitted.

  Further, in this embodiment, the case where the communication device v [0] configuring the anonymous communication system is a reply path information generation device, but other devices that do not configure the anonymous communication system (for example, a reliable third party device) ) May be a reply path information generation device. In this case, the reply path information generation device sends reply path information to the communication device v [0], and the communication device v [0] sends the reply route information to the communication device v [1]. At this time, the communication device v [0] may randomize the reply path information and then transmit it to the communication device v [1].

  In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory. Specifically, for example, the magnetic recording device may be a hard disk device or a flexible Discs, magnetic tapes, etc. as optical discs, DVD (Digital Versatile Disc), DVD-RAM (Random Access Memory), CD-ROM (Compact Disc Read Only Memory), CD-R (Recordable) / RW (ReWritable), etc. As the magneto-optical recording medium, MO (Magneto-Optical disc) or the like can be used, and as the semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory) or the like can be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  The present invention can be used, for example, in fields such as electronic voting and electronic bidding that require anonymity of communication paths.

Fig.1 (a) is the figure which showed the whole structure of the anonymous communication system of this form. FIG. 1B is a block diagram illustrating a hardware configuration of the communication apparatus (v [0]) of this embodiment. FIG. 2 is a block diagram illustrating a functional configuration of the communication apparatus according to the present embodiment. FIG. 3 shows a communication device (v [u-1]) that performs reception processing of the return path information RI [u-1] transmitted from the communication device v [u-1] (u = 1,..., N). ]) Is a block diagram showing a functional configuration. FIG. 4 shows a communication apparatus of this embodiment that performs a reply start process using reply path information RI [u-1] transmitted from the communication apparatus v [u-1] (u = 1,..., N). It is the block diagram which showed the function structure of v [u]). FIG. 5 shows a communication apparatus (v [u]) according to the present embodiment that performs a reception process of reply path information RI [u-1] returned from the communication apparatus v [u + 1] (0 ≦ u ≦ n−1). It is the block diagram which showed the function structure of (0 <= u <= n-1). FIG. 6 is a flowchart for explaining the transmission start processing of this embodiment. FIG. 7 is a flowchart for explaining the transmission start processing of this embodiment. FIG. 8 is a flowchart for explaining the transmission start processing of this embodiment. FIG. 9 is a flowchart for explaining the transmission start processing of this embodiment. FIG. 10 is a flowchart for explaining the reply start process of this embodiment. FIG. 11 is a flowchart for explaining processing when the communication device (v [0]) performs reply reception processing on the reply route information RI [1] returned from the transmission device v [1]. . FIG. 12 is a flowchart for explaining processing when the communication device (v [0]) performs return reception processing on the return route information RI [1] returned from the transmission device v [1]. .

Explanation of symbols

1 Communication system

Claims (11)

The information transmitted from the communication device v [0] is in the order of v [1], ..., v [n-1] (n ≧ 2), and the communication devices v [1], ..., v [n- 1] is a reply path information generating device that generates reply path information for anonymous communication that is relayed in 1 and received by the communication device v [n],
The communication path information for specifying the communication path between the communication device v [h-1] (h = 1, ..., n) and the communication device v [h] is e [h-1, h]. The unique information unique to each communication device v [f] (f = 0, ..., n) is E [f], G is a cyclic group, g is a generator of the cyclic group G, and x [f ] Is a secret key x [f] of each communication device v [f] that is an integer, and y [f] is a public key y [f] = g ^{x [f]} ∈ corresponding to each secret key x [f] A memory in which at least channel information e [h-1, h], unique information E [0], and public key y [f] ∈G are stored,
Set any integer r [0, j, 0], r [1, j, 0] corresponding to at least n communication devices v [j] (j = 0, ..., n-1) And arbitrary value setting means for outputting the set arbitrary integer r [0, j, 0], r [1, j, 0],
The operation α [0,0,0] = y [0] ^{E [0] · r [0,0,0]} · y [1] ^{r [0,0,0]} ∈ G is performed and the operation result α [ First computing means for outputting 0,0,0];
Second operation means for performing an operation β [0,0,0] = g ^{r [0,0,0]} ∈G and outputting the operation result β [0,0,0];
Third operation means for performing an operation α [1,0,0] = y [1] ^{r [} 1,0,0 ^] ∈ G and outputting the operation result α [1,0,0];
Fourth operation means for performing an operation β [1,0,0] = g ^{r [} 1,0,0 ^] ∈G and outputting the operation result β [1,0,0];
Perform the operation α [0,1,0] = y [1] ^{(e [0,1] +1) · r [0,1,0]} · y [2] ^{r [0,1,0]} ∈G , Fifth calculation means for outputting the calculation result α [0,1,0],
Sixth operation means for performing an operation β [0,1,0] = g ^{r [0,1,0]} ∈ G and outputting the operation result β [0,1,0];
The operation α [1,1,0] = (y [1] · y [2]) ^{r [1,1,0]} ∈ G is performed and the operation result α [1,1,0] is output. Computing means;
An eighth operation means for performing an operation β [1,1,0] = g ^{r [1,1,0]} ∈G and outputting the operation result β [1,1,0];
For each of m = 2, ..., n-1, the operation α [0, m, 0] = (y [1] ・ ... ・ y [m-1]) ^{r [0, m, 0]}・ Y [m] ^{(e [m-1, m] +1) ・ r [0, m, 0]}・ y [m + 1] ^{r [0, m, 0]} ∈G ninth operation means for outputting α [0, m, 0];
For each of m = 2, ..., n−1, the operation β [0, m, 0] = g ^{r [0, m, 0]} ∈ G is performed and the result β [0, m, 0 10th computing means for outputting
For each of m = 2, ..., n-1, the operation α [1, m, 0] = (y [1] ・ ... ・ y [m-1] ・ y [m] ・ y [m +1]) ^{r [1, m, 0]} ∈ G, eleventh calculation means for outputting the calculation result α [1, m, 0];
For each of m = 2, ..., n−1, the operation β [1, m, 0] = g ^{r [1, m, 0]} ∈G is performed, and the result β [1, m, 0 Twelfth computing means for outputting
Four operation results α [0, j, 0], β [0, j, 0], α [1, j, 0], β [1, j, 0] (j = 0, ..., n- Return path information RI including n pieces of block information RB [0,0], ..., RB [n-1,0], where information including 1) is block information RB [j, 0], respectively. Return route information generating means for generating [0] and outputting the return route information RI [0],
A reply path information generating device characterized by comprising: The reply path information generating device according to claim 1,
Further comprising a transmission means for transmitting the reply path information RI [0] to the communication device v [1],
Function as the communication device v [0],
A reply path information generation device characterized by the above. The reply path information generating device according to claim 1 or 2,
The arbitrary value setting means is means for further setting an arbitrary integer r [0, *, 0] and outputting the set arbitrary integer r [0, *, 0].
A thirteenth arithmetic means for performing an operation α [0, *, 0] = y [0] ^{r [0, *, 0]} ∈ G and outputting the operation result α [0, *, 0];
14th operation means for performing an operation β [0, *, 0] = g ^{r [0, *, 0]} ∈ G and outputting the operation result β [0, *, 0], and further comprising:
The reply route information generation means includes reply route information RI [[0, *, 0], reply content storage information RB [*, 0] that includes β [0, *, 0]. 0] is a means for generating
A reply path information generation device characterized by the above. The information transmitted from the communication device v [0] is in the order of v [1], ..., v [n-1] (n ≧ 2), and the communication devices v [1], ..., v [n- 1] is a communication device functioning as any one of the anonymous communication devices v [u] (u = 1,..., N) relayed by the communication device v [n].
At least communication path information e [y, u] for specifying each communication path between the communication device v [y] (y is an integer other than u) and the communication device v [u], and an integer A memory for storing the secret key x [u] of the communication device v [u];
Let G be a cyclic group, and the four elements α [0, j, u-1], β [0, j, u-1], α [1, j, u-1], β [1, j, u-1] is block information RB [j, u-1] (j = 0, ..., n-1), and n pieces of block information RB [0, u-1], .., Reply route information RI [u sent from the communication device v [u-1] when the information including RB [n-1, u-1] is taken as the reply route information RI [u-1] -1], first receiving means;
From the block information included in the reply path information RI [u-1] received by the first receiving means, α [1, j, u-1] = β [1, j, u-1] ^{x [u ]} Block information selection means for selecting block information satisfying ∈G and setting it as block information RB [+, u-1];
[Alpha] [0, j, u-1] / β [0, j, u-1] ^{2 · x} for α [0, j, u-1] of the block information RB [+, u-1] ^[u] ∈ G, and update the block information RB [+, u-1] as the new α [0, j, u-1] of the block information RB [+, u-1] First block information updating means for updating the reply route information RI [u-1] thereby,
Block information RB [0, u-1] included in the reply path information RI [u-1] excluding the block information RB [+, u-1] when the communication device v [u] does not reply , ..., RB [n-1, u-1] α [0, j, u-1], β [0, j, u-1] -1] / β [0, j, u-1] ^{x [u]} ∈ G, and each of these calculation results is regarded as each new α [0, j, u-1] and the block information RB [0 , u-1], ..., RB [n-1, u-1], thereby updating the return path information RI [u-1], second block information updating means;
Block information RB [0, u-1] included in the reply path information RI [u-1] excluding the block information RB [+, u-1] when the communication device v [u] does not reply , ..., RB [n-1, u-1] α [1, j, u-1], β [1, j, u-1] -1] / β [1, j, u-1] ^{x [u]} ∈ G, and each of these calculation results is regarded as each new α [1, j, u-1], and the block information RB [0 , u-1], ..., RB [n-1, u-1], thereby updating the return path information RI [u-1], third block information updating means;
When the communication device v [u] does not reply, at least the reply route information RI [u-1] updated by the first to third block information update means is used as the reply route information RI [u]. first transmission means for transmitting to u + 1],
When the communication device v [u] makes a reply, the block information RB [0, u-1], ..., RB [n-1, u-1 included in the reply path information RI [u-1] ] For each α [0, j, u-1], β [0, j, u-1] respectively α [0, j, u-1] · β [0, j, u-1] ^{x [u]} ∈ G is performed, and each of these operation results is set as each new α [0, j, u-1], and the block information RB [0, u-1], ..., RB [n− 1, u-1], thereby updating the reply route information RI [u-1], fourth block information updating means;
When the communication device v [u] makes a reply, at least the reply route information RI [u-1] updated by the fourth block information update unit is used as the reply route information RI [u]. A second sending means for replying to
A second receiving means for receiving reply path information RI [u + 1] sent back from the communication device v [u + 1] when 1 ≦ u ≦ n−1;
Any block information RB [0, u + 1],..., RB [n−1, u + 1] included in the reply path information RI [u + 1] and any channel information e [ It is determined whether α [0, j, u + 1] = β [0, j, u + 1] ^{e [y, u]} ∈G is satisfied for the combination with ^{y, u]} , and α [ 0, j, u + 1] = β [0, j, u + 1] ^{e [y, u] The} channel information e [y, u] that satisfies ∈G is used as the channel information e [u-1, u Determination means for outputting as
Blocks included in the reply route information RI [u + 1] excluding block information satisfying α [0, j, u + 1] = β [0, j, u + 1] ^{e [y, u]} ∈G For each α [0, j, u + 1], β [0, j, u + 1] of information RB [0, u + 1], ..., RB [n-1, u + 1] Each operation α [0, j, u + 1] · β [0, j, u + 1] ^{x [u]} ∈G is performed, and each of these operation results is added to each new α [0, j, u + The fifth block for updating the block information RB [0, u + 1], ..., RB [n-1, u + 1] as 1] and thereby updating the reply path information RI [u + 1] Information updating means;
The reply path information RI [u + 1] updated by at least the fifth block information updating unit is set as the reply path information RI [u], and the communication path specified by the communication path information e [u-1, u] A third transmission means for transmitting,
When u = 1, the return route information RI [u-1] received by the first receiving unit is generated by the return route information generating device according to any one of claims 1 to 3, and the communication device v Reply route information RI [0] sent from [0]
When u ≧ 2, the reply path information RI [u-1] received by the first receiving unit is generated by the reply path information generating apparatus according to any one of claims 1 to 3, and the communication apparatus v [ 0] is sent in the order of v [1], ..., v [u-1], and the communication device v [1], ..., v [u-1 ] At least each of the first to third block information updating means, and the reply route information RI [u-1] transmitted from the communication device v [u-1],
In the case of 1 ≦ u ≦ n−2, the return route information RI [u + 1] received by the second receiving means is generated by the return route information generating device according to any one of claims 1 to 3. The reply route information RI [0] transmitted from the communication device v [0] is in the order of v [1], ..., v [c] (c is an integer of u + 1 ≦ c ≦ n−1). Then, at least each of the first to third block information update means of the communication devices v [1],..., V [c] is updated and transmitted to the communication device v [c + 1] that makes a reply. [c + 1] is updated by at least the first and fourth block information updating means, returned to the communication device v [c], and in the order of v [c], ..., v [u + 1], the communication device v [c],..., v [u + 1] is updated by at least each fifth block information updating means, and the reply route information RI [u + 1] returned from the communication device v [u + 1] is used. Yes,
When u = n−1, the reply path information RI [u + 1] received by the second receiving unit is generated by the reply path information generating device according to any one of claims 1 to 3 and communicated The reply route information RI [0] transmitted from the device v [0] is in the order of v [1], ..., v [n-1], and the communication devices v [1], ..., v [ n-1] is updated by at least each of the first to third block information updating means, transmitted to the communication device v [n] that makes a reply, and updated by at least the first and fourth block information updating means of the communication device v [n]. Reply route information RI [n] sent back to the communication device v [n-1],
A communication device. The communication device according to claim 4,
The first receiving means includes reply content storage information RB [*, u-1] including two elements α [0, *, u-1], β [0, *, u-1] of the cyclic group G Is a means for receiving reply route information RI [u-1] further including
When the communication device v [u] does not reply, the reply content storage information RB [*, u-1] included in the reply route information RI [u-1] received by the first receiving means α [0, *, u-1], β [0, *, u-1], β [0, *, u-1] ^{x [u]} ∈ G, and update the reply content storage information RB [*, u-1] with the result of the operation as a new α [0, *, u-1], thereby reply path information RI [u-1 6th block information update means for updating
The first transmission means sends the reply route information RI [u-1] updated by at least the first to third and sixth block information update means to the communication device v [u + 1] as reply route information RI [u]. Means to transmit,
First arbitrary value setting means for setting an arbitrary integer r [0, *, u] and outputting the set arbitrary integer r [0, *, u] when the communication device v [u] makes a reply When,
When the communication device v [u] makes a reply, α of the reply content storage information RB [*, u-1] included in the reply route information RI [u-1] received by the first receiving unit For [0, *, u-1], perform the operation M · α [0, *, u-1] ^{r [0, *, u]} ∈G when the return message is M∈G The seventh block for updating the reply content storage information RB [*, u-1] with the result as new α [0, *, u-1] and thereby updating the reply route information RI [u-1] Information updating means;
When the communication device v [u] makes a reply, β of the reply content storage information RB [*, u-1] included in the reply route information RI [u-1] received by the first receiving unit For [0, *, u-1], the operation β [0, *, u-1] ^{r [0, *, u]} ∈G is performed, and the result of the operation is calculated as a new β [0, *, u- 1], further comprising an eighth block information updating means for updating the reply content storage information RB [*, u-1] and thereby updating the reply route information RI [u-1],
When the communication device v [u] makes a reply, the second transmission means sends the reply path information RI [u-1] updated by at least the first, fourth, seventh, and eighth block information update means to the reply path. It is a means for returning to the communication device v [u-1] as information RI [u],
The second receiving means returns a reply including two elements α [0, *, u + 1] and β [0, *, u + 1] of the cyclic group G when 1 ≦ u ≦ n−1. Means for receiving reply route information RI [u + 1] further including content storage information RB [*, u + 1],
Α [0, *, u + 1], β [0] of the reply content storage information RB [*, u + 1] included in the reply route information RI [u + 1] received by the second receiving means , *, u + 1], the operation α [0, *, u + 1] / β [0, *, u + 1] ^{x [u]} ∈G is performed, and the result is calculated as a new α [0 , *, u + 1] is further provided with ninth block information updating means for updating the reply content storage information RB [*, u + 1], thereby updating the reply route information RI [u + 1],
The third transmission means uses the return path information RI [u + 1] updated by at least the fifth and ninth block information update means as the return path information RI [u], and uses the communication path information e [u-1, u]. Means for transmitting to the communication path specified by
When u = 1, the return route information RI [u-1] received by the first receiving unit is generated by the return route information generating device according to claim 3 and transmitted from the communication device v [0]. Reply route information RI [0],
When u ≧ 2, the return route information RI [u−1] received by the first receiving means is generated by the return route information generating device according to claim 3 and transmitted from the communication device v [0]. Return route information RI [0] is in the order of v [1], ..., v [u-1], and at least each of the communication devices v [1], ..., v [u-1]. 1 to 3 and 6 block information updating means, and the reply route information RI [u-1] transmitted from the communication device v [u-1].
In the case of 1 ≦ u ≦ n−2, the return route information RI [u + 1] received by the second receiving unit is generated by the return route information generating device according to claim 3, and the communication device v [ 0], the reply path information RI [0] is transmitted in the order of v [1], ..., v [c] (c is an integer of u + 1 ≦ c ≦ n−1). [1],..., V [c] are updated by at least each of the first to third and sixth block information updating means, transmitted to the communication device v [c + 1] that performs the reply, and the communication device v [c + 1] is updated by at least the first, fourth, seventh and eighth block information update means, is returned to the communication device v [c], and is communicated in the order of v [c], ..., v [u + 1]. Reply route information RI [u +] updated by at least the fifth and ninth block information updating means of the devices v [c],..., V [u + 1] and returned from the communication device v [u + 1]. 1]
When u = n−1, the return route information RI [u + 1] received by the second receiving unit is generated by the return route information generating device according to claim 3 and is transmitted to the communication device v [0]. Return route information RI [0] transmitted from the communication device v [1], ..., v [n-1] in the order of v [1], ..., v [n-1] At least updated by each of the first to third and sixth block information updating means and transmitted to the communication device v [n] that sends a reply. The reply route information RI [n] updated and returned to the communication device v [n-1].
A communication device. The communication device according to claim 5,
The first arbitrary value setting means further sets an arbitrary integer r [1, *, u] when the communication device v [u] sends a reply, and sets the arbitrary integer r [1, *, u ] To output
When the communication device v [u] makes a reply, α of the reply content storage information RB [*, u-1] included in the reply route information RI [u-1] received by the first receiving unit Perform the operation α [1, *, u-1] = α [0, *, u-1] ^{r [1, *, u]} ∈G on [0, *, u-1], and the result α [1, *, u-1] is added as an element of the reply content storage information RB [*, u-1], and the reply content storage information RB [*, u-1] after addition is added A tenth block information updating means for outputting route information RI [u-1];
When the communication device v [u] makes a reply, β of the reply content storage information RB [*, u-1] included in the reply route information RI [u-1] received by the first receiving unit Perform the operation β [1, *, u-1] = β [0, *, u-1] ^{r [1, *, u]} ∈G on [0, *, u-1], and the result β [1, *, u-1] is added as an element of the reply content storage information RB [*, u-1], and the reply content storage information RB [*, u-1] after addition is added Eleventh block information updating means for outputting route information RI [u-1],
When the communication device v [u] makes a reply, the second transmission means returns the reply path information RI [u-1] updated by at least the first, fourth, seventh, eighth, tenth, and eleventh block information updating means. Is a means for returning the response route information RI [u] to the communication device v [u-1],
The second receiving means has four elements α [0, *, u + 1], β [0, *, u + 1], α [of the cyclic group G when 1 ≦ u ≦ n−1. Means for receiving reply path information RI [u + 1] including reply content storage information RB [*, u + 1] including 1, *, u + 1], β [1, *, u + 1] Yes,
Α [1, *, u + 1], β [1] of the reply content storage information RB [*, u + 1] included in the reply route information RI [u + 1] received by the second receiving means , *, u + 1], the operation α [1, *, u + 1] / β [1, *, u + 1] ^{x [u]} ∈G is performed, and the result is calculated as a new α [1 , *, u + 1], the twelfth block information updating means for updating the reply content storage information RB [*, u + 1], thereby updating the reply route information RI [u + 1],
Set an arbitrary integer r2 [0, *, u], r2 [1, *, u] and output the set arbitrary integer r2 [0, *, u], r2 [1, *, u] 2 arbitrary value setting means;
Α [0, *, u + 1] of the reply content storage information RB [*, u + 1] included in the reply route information RI [u + 1] updated by the fifth, ninth and twelfth block information updating means. ], α [1, *, u + 1], the operation α [0, *, u + 1] · α [1, *, u + 1] ^{r2 [0, *, u]} ∈G, The operation result is updated as new α [0, *, u + 1], and the reply content storage information RB [*, u + 1] is updated, thereby updating the reply route information RI [u + 1]. 13 block information update means;
Β [0, *, u + 1] of the reply content storage information RB [*, u + 1] included in the reply route information RI [u + 1] updated by the fifth, ninth, and twelfth block information updating means. ], β [1, *, u + 1], perform the operation β [0, *, u + 1] · β [1, *, u + 1] ^{r2 [0, *, u]} ∈G, The operation result is updated as new β [0, *, u + 1], and the reply content storage information RB [*, u + 1] is updated, whereby the reply route information RI [u + 1] is updated. 14 block information updating means;
Α [1, *, u + 1] of the reply content storage information RB [*, u + 1] included in the reply route information RI [u + 1] updated by the fifth, ninth and twelfth block information updating means. ] Is calculated α [1, *, u + 1] ^{r2 [1, *, u]} ∈ G, and the result is stored as the new α [1, *, u + 1] Fifteenth block information updating means for updating the information RB [*, u + 1], thereby updating the reply route information RI [u + 1];
Β [1, *, u + 1] of the reply content storage information RB [*, u + 1] included in the reply route information RI [u + 1] updated by the fifth, ninth and twelfth block information updating means. ] Is calculated β [1, *, u + 1] ^{r2 [1, *, u]} ∈ G, and the result is stored as the new β [1, *, u + 1] A 16th block information updating means for updating the information RB [*, u + 1] and thereby updating the reply route information RI [u + 1],
The third transmission means uses the return path information RI [u + 1] updated by at least the fifth, ninth, 12th to 16th block information update means as the return path information RI [u], and sets the communication path information e [u− 1, u] is a means for transmitting to the communication path specified by
In the case of 1 ≦ u ≦ n−2, the return route information RI [u + 1] received by the second receiving unit is generated by the return route information generating device according to claim 3, and the communication device v [ 0], the reply path information RI [0] is transmitted in the order of v [1], ..., v [c] (c is an integer of u + 1 ≦ c ≦ n−1). [1],..., V [c] are updated by at least each of the first to third and sixth block information updating means, transmitted to the communication device v [c + 1] that performs the reply, and the communication device v [c + 1] is updated by at least the first, fourth, seventh, eighth, tenth and eleventh block information updating means, and is sent back to the communication device v [c], and v [c], ..., v [u + 1] In order, at least each of the fifth, ninth, 12th to 16th block information update means of the communication devices v [c],..., V [u + 1] is updated and returned from the communication device v [u + 1]. Reply route information RI [u + 1]
When u = n−1, the return route information RI [u + 1] received by the second receiving unit is generated by the return route information generating device according to claim 3 and is transmitted to the communication device v [0]. Return route information RI [0] transmitted from the communication device v [1], ..., v [n-1] in the order of v [1], ..., v [n-1] At least updated by each of the first to third and sixth block information updating means, transmitted to the communication device v [n] that sends back, and at least the first, fourth, seventh, eighth, tenth of the communication device v [n] 11 is the reply path information RI [n] updated by the block information updating means and returned to the communication device v [n-1].
A communication device. The information transmitted from the communication device v [0] is in the order of v [1], ..., v [n-1] (n ≧ 2), and the communication devices v [1], ..., v [n- 1] is a communication device functioning as a communication device v [0] for anonymous communication that is relayed in 1 and received by the communication device v [n],
At least a memory in which the secret key x [0] and unique information E [0] of the communication device v [0] are stored,
Receiving means for receiving return route information RI [1] returned from the communication device functioning as the communication device v [1] according to claim 5;
Block information RB [j, 1] including elements α [0, j, 1], β [0, j, 1] of the cyclic group G included in the reply route information RI [1] received by the receiving means ] (J = 0, ..., n-1) to block information RB [α [0, j, 1] = β [0, j, 1] ^{x [0] · E (0)} ∈ G determination means for determining whether or not j, 1] exists;
When it is determined by the determining means that there is block information RB [j, 1] satisfying α [0, j, 1] = β [0, j, 1] ^{x [0] · E (0)} ∈G, For α [0, *, 1], β [0, *, 1] of the reply content storage information RB [*, 1] included in the reply route information RI [1] received by the receiving means, A reply message decoding means for performing an operation α [0, *, 1] / β [0, *, 1] ^{x [0]} ∈G and outputting the result of the calculation as a reply message M∈G;
A communication apparatus comprising: The information transmitted from the communication device v [0] is in the order of v [1], ..., v [n-1] (n ≧ 2), and the communication devices v [1], ..., v [n- 1] is an anonymous communication method of a communication device v [0] that performs anonymous communication that is relayed in 1 and received by the communication device v [n],
The communication path information for specifying the communication path between the communication device v [h-1] (h = 1, ..., n) and the communication device v [h] is e [h-1, h]. The unique information unique to each communication device v [f] (f = 0, ..., n) is E [f], G is a cyclic group, g is a generator of the cyclic group G, and x [f ] (F = 0, ..., n) is an integer secret key x [f] of each communication device v [f], and y [f] is a public key corresponding to each secret key x [f] When y [f] = g ^{x [j]} ∈ G, at least the channel information e [h-1, h], the unique information E [0], and the public key y [f] ∈G are stored in the memory. Stored,
Set any integer r [0, j, 0], r [1, j, 0] corresponding to at least n communication devices v [j] (j = 0, ..., n-1) And an arbitrary value setting process for outputting the set arbitrary integer r [0, j, 0], r [1, j, 0],
The first computing means performs the operation α [0,0,0] = y [0] ^{E [0] · r [0,0,0]} · y [1] ^{r [0,0,0]} ∈G A first calculation process for outputting the calculation result α [0,0,0];
A second calculation process in which the second calculation means performs the calculation β [0,0,0] = g ^{r [0,0,0]} ∈G and outputs the calculation result β [0,0,0];
The third calculation means performs the calculation α [1,0,0] = y [1] ^{r [} 1,0,0 ^] ∈ G and outputs the calculation result α [1,0,0]. Process,
A fourth calculation process in which a fourth calculation means performs a calculation β [1,0,0] = g ^{r [} 1,0,0 ^] ∈G and outputs the calculation result β [1,0,0];
The fifth calculating means calculates α [0,1,0] = y [1] ^{(e [0,1] +1) · r [0,1,0]} · y [2] ^{r [0,1, 0]} performed ∈G, a fifth operation process for outputting the operation result alpha [0,1,0],
A sixth operation process in which the sixth operation means performs the operation β [0,1,0] = g ^{r [0,1,0]} ∈G and outputs the operation result β [0,1,0];
The seventh calculation means performs the calculation α [1,1,0] = (y [1] · y [2]) ^{r [1,1,0]} ∈ G, and the calculation result α [1,1,0 A seventh calculation process for outputting
An eighth operation step in which the eighth operation means performs the operation β [1,1,0] = g ^{r [1,1,0]} ∈G and outputs the operation result β [1,1,0];
The ninth calculating means calculates α [0, m, 0] = (y [1]... Y [m-1]) ^{r [} for each of m = 2 ^{,. 0, m, 0]}・ y [m] ^{(e [m-1, m] +1) ・ r [0, m, 0]}・ y [m + 1] ^{r [0, m, 0]} ∈G And a ninth calculation process for outputting the calculation result α [0, m, 0],
The tenth operation means performs the operation β [0, m, 0] = g ^{r [0, m, 0]} ∈G for each of m = 2,..., N−1, and the operation result β A tenth computation process for outputting [0, m, 0];
The eleventh computing means computes α [1, m, 0] = (y [1],... Y [m-1], y [ m] · y [m + 1]) ^{r [1, m, 0]} ∈ G, and outputs the operation result α [1, m, 0];
The twelfth calculation means performs the calculation β [1, m, 0] = g ^{r [1, m, 0]} ∈G for each of m = 2,..., N−1, and the calculation result β A twelfth operation process for outputting [1, m, 0];
The reply path information generating means has four calculation results α [0, j, 0], β [0, j, 0], α [1, j, 0], β [1, j, 0] (j = 0 , ..., n-1), where n pieces of block information RB [0,0], ..., RB [n-1,0 A reply route information generation process for generating reply route information RI [0] including the response route information RI [0],
A transmission process in which the transmission means transmits the return route information RI [0] to the communication device v [1];
The anonymous communication method characterized by performing. The information transmitted from the communication device v [0] is in the order of v [1], ..., v [n-1] (n ≧ 2), and the communication devices v [1], ..., v [n- 1] An anonymous communication method of any communication device v [u] (u = 1, ..., n) that performs anonymized communication that is relayed in 1 and received by the communication device v [n],
At least communication path information e [y, u] for specifying each communication path between the communication device v [y] (y is an integer other than u) and the communication device v [u], and an integer The secret key x [u] of the communication device v [u] is stored in the memory,
The first receiving means uses G as a cyclic group, and the four elements α [0, j, u-1], β [0, j, u-1], α [1, j, u-1 of the cyclic group G ], β [1, j, u-1] are block information RB [j, u-1] (j = 0, ..., n-1) respectively, and n pieces of block information RB [0 , u-1], ..., sent from the communication device v [u-1] when the information including RB [n-1, u-1] is the return route information RI [u-1] A first reception process of receiving reply path information RI [u-1];
From the block information included in the reply path information RI [u-1] received by the first receiving unit, the block information selecting unit obtains α [1, j, u-1] = β [1, j, u -1] selects block information satisfying ^{x [u]} ∈ G, and sets the block information RB [+, u-1] as block information selection process,
The first block information updating means calculates α [0, j, u-1] / β [0, j on α [0, j, u-1] of the block information RB [+, u-1]. , u-1] ^{2 · x [u]} ∈ G, and the calculation result is set as new α [0, j, u-1] of the block information RB [+, u-1], and the block information RB [+ , u-1], thereby updating the reply route information RI [u-1],
When the communication device v [u] does not send a reply, the second block information update means includes block information included in the reply path information RI [u-1] except the block information RB [+, u-1]. For each α [0, j, u-1], β [0, j, u-1] of RB [0, u-1], ..., RB [n-1, u-1] An operation α [0, j, u-1] / β [0, j, u-1] ^{x [u]} ∈G is performed, and each of these operation results is added to each new α [0, j, u-1 ], The block information RB [0, u-1],..., RB [n-1, u-1] is updated, and thereby the second block information for updating the reply route information RI [u-1]. Update process,
When the communication device v [u] does not send a reply, the third block information update means includes block information included in the reply path information RI [u-1] excluding the block information RB [+, u-1]. For each α [1, j, u-1], β [0, j, u-1] of RB [0, u-1], ..., RB [n-1, u-1] An operation α [1, j, u-1] / β [1, j, u-1] ^{x [u]} ∈G is performed, and each of these operation results is added to each new α [1, j, u-1 ], The block information RB [0, u-1],..., RB [n-1, u-1] is updated, and thereby the third block information for updating the reply route information RI [u-1]. Update process,
When the communication device v [u] does not send a reply, the first sending means uses the reply path information RI [u-1] updated by at least the first to third block information updating means as the reply path information RI [u ] To the communication device v [u + 1] as a first transmission process;
When the communication device v [u] makes a reply, the fourth block information update means performs block information RB [0, u-1],..., RB included in the reply path information RI [u-1]. For each α [0, j, u-1] of [n-1, u-1], the operations α [0, j, u-1] · β [0, j, u-1] ^{x [u ]} ∈ G, and each of these calculation results is regarded as each new α [0, j, u-1], β [0, j, u-1], and the block information RB [0, u-1], ..., RB [n-1, u-1] is updated, and thereby the fourth block information update process of updating the reply route information RI [u-1],
When the communication device v [u] makes a reply, the second transmission means communicates at least the reply route information RI [u-1] updated by the fourth block information update means as the reply route information RI [u]. A second transmission process returning to the device v [u-1];
A second receiving process in which the second receiving means receives the reply path information RI [u + 1] sent back from the communication device v [u + 1] when 1 ≦ u ≦ n−1;
The determination means includes any block information RB [0, u + 1],..., RB [n−1, u + 1] included in the reply route information RI [u + 1] and any communication. Determine whether α [0, j, u + 1] = β [0, j, u + 1] ^{e [y, u]} ∈G is satisfied for the combination with the road information e [y, u] Then, the channel information e [y, u] satisfying α [0, j, u + 1] = β [0, j, u + 1] ^{e [y, u]} ∈G -1, u] to output channel information decoding process;
The fifth block information update means removes the reply path information RI excluding the block information satisfying the above α [0, j, u + 1] = β [0, j, u + 1] ^{e [y, u]} ∈G [u + 1] contains block information RB [0, u + 1], ..., RB [n-1, u + 1] α [0, j, u + 1], β [0, j , u + 1] are performed on each of the operations α [0, j, u + 1] · β [0, j, u + 1] ^{x [u]} ∈G, The block information RB [0, u + 1], ..., RB [n-1, u + 1] is updated as α [0, j, u + 1], and thereby the reply path information RI [u + 5], a fifth block information update process for updating 1],
The third transmission means is identified by the communication path information e [u-1, u] with the reply path information RI [u + 1] updated by at least the fifth block information updating means as the reply path information RI [u]. A third transmission process for transmitting to the communication path,
When u = 1, the reply path information RI [u-1] received in the first reception process is generated by the reply path information generating apparatus according to any one of claims 1 to 3, and the communication apparatus v Reply route information RI [0] sent from [0]
When u ≧ 2, the return route information RI [u−1] received in the first reception process is generated by the return route information generation device according to any one of claims 1 to 3 and is transmitted to the communication device v [ 0] is sent in the order of v [1], ..., v [u-1], and the communication device v [1], ..., v [u-1 ] At least each of the first to third block information update processes, and the reply route information RI [u-1] transmitted from the communication device v [u-1],
In the case of 1 ≦ u ≦ n−2, the return route information RI [u + 1] received in the second reception process is generated by the return route information generating device according to any one of claims 1 to 3. The reply route information RI [0] transmitted from the communication device v [0] is in the order of v [1], ..., v [c] (c is an integer of u + 1 ≦ c ≦ n−1). The communication device v [1],..., V [c] is updated in at least each of the first to third block information update processes, and transmitted to the communication device v [c + 1] that performs the reply. [c + 1] is updated in at least the first and fourth block information update process, is returned to the communication device v [c], and the communication devices are in the order of v [c], ..., v [u + 1]. v [c],..., v [u + 1] is updated at least in each fifth block information update process, and the reply route information RI [u + 1] returned from the communication device v [u + 1] is used. Yes,
When u = n−1, the reply path information RI [u + 1] received in the second reception process is generated by the reply path information generating device according to any one of claims 1 to 3 and communicated The reply route information RI [0] transmitted from the device v [0] is in the order of v [1], ..., v [n-1], and the communication devices v [1], ..., v [ n-1] is updated in at least each of the first to third block information updating processes, transmitted to the communication device v [n] that makes a reply, and updated in at least the first and fourth block information updating processes of the communication device v [n]. Reply route information RI [n] sent back to the communication device v [n-1],
An anonymous communication method characterized by that.   A program for causing a computer to function as the reply path information generation device according to any one of claims 1 to 3 or the communication device according to any one of claims 4 to 7.   A computer-readable recording medium storing the program according to claim 10.

Images