JP2009302861A - System of transferring authority for decoding encrypted text - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a transferring system capable of maintaining the size of a converted PKE encrypted text and decoding the encrypted text by the same decoding processing when converting an IBE encrypted text to the PKE encrypted text. <P>SOLUTION: Using a conversion key generated by a secret key generation apparatus based on a main secret key, an ID which is a public key in an IBE system, a PKE public key, and a public key for re-encryption in a PKE system, an encrypted text conversion apparatus converts an IBE encrypted text from a decoding authority holder apparatus to a PKE encrypted text to be decoded in a decoding authority transfer target apparatus, and transmits the converted encrypted text to the decoding authority transfer target apparatus. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a ciphertext decryption authority delegation system that enables a ciphertext generated by an ID-based encryption method to be decrypted using a secret key that is different from a secret key corresponding to the public key.

  Conventionally, in a cipher using public key cryptography, a ciphertext encrypted with a certain public key can be decrypted only by a person having a corresponding secret key. In recent years, due to its usefulness, a ciphertext decryption authority delegation system (hereinafter, delegation system) that can decrypt a ciphertext encrypted with a public key using a secret key different from the corresponding secret key. Is being researched. The delegation system is composed of three parties: a decryption authority holder, a decryption authority delegation subject, and a ciphertext converter, or four parties including a trusted third party (hereinafter, TTP). The transfer of the decryption right in this configuration is performed by a decryption authority holder or TTP generating a conversion key for ciphertext conversion and transferring it to the ciphertext converter.

  When the plaintext held by the decryption authority holder is shared with the decryption authority transfer target person, the decryption authority holder first transmits the ciphertext obtained by encrypting the plaintext with his / her public key to the ciphertext converter. The ciphertext converter holding the conversion key converts the ciphertext received from the decryption authority holder so that it can be decrypted with the private key held by the decryption authority transfer target person, and transmits it to the decryption authority transfer target person. The decryption authority transfer target person decrypts the received converted ciphertext using his / her private key, and reproduces the plaintext. Such a delegation system is required to satisfy the following requirements from a cryptographic point of view. That is, (1) the decryption authority holder does not need to transfer his / her decryption secret key to anyone other than himself / herself, and (2) unless the ciphertext converter performs conversion, The three requirements are that it cannot be reproduced, and (3) that the ciphertext converter alone cannot reproduce the plaintext from the ciphertext of the decryption authority holder.

  As a device for realizing delegation, a computer, for example, a personal computer, is generally used as a device used by a decryption authority holder or a decryption authority delegation subject (hereinafter referred to as a decryption authority owner device or a decryption authority delegation subject device). A mobile phone terminal, a PDA (Personal Digital Assistant) terminal, a server, etc. are applied, and a device composed of a server called a proxy is applied as a device used by a ciphertext converter (hereinafter, ciphertext conversion device). The Each of the computers that realize the decryption authority holder device and the decryption authority transfer target device has a function for executing a public key encryption algorithm, and the public key necessary for encryption and the private key necessary for decryption are provided. Remembered. In addition, the proxy that realizes the ciphertext conversion apparatus is equipped with a function for executing a conversion algorithm for converting the ciphertext transmitted from the device of the decryption authority holder, and stores a conversion key.

  Such a delegation system can be applied to a content supply technology via a storage device used by an unspecified number of users, for example. Now, it is assumed that the decryption authority holder is a content owner, and the content encrypted using his / her public key is stored in a storage device used by an unspecified number of users. Here, when sharing content with a third party, the decryption authority holder designates the third party as a decryption authority transfer target person, generates a conversion key for the decryption authority transfer target person, and uses the access controller of the storage device. Send to a ciphertext converter. The ciphertext converter that receives the content request from the decryption authority transfer target device for the decryption authority transfer target person re-encrypts the content ciphertext using the conversion key, and the converted ciphertext is subject to the decryption authority transfer target To the user's device. The decryption authority transfer target person's device decrypts the content using the decryption authority transfer target person's private key stored therein. The encrypted conversion text device alone cannot decrypt the content, and since the content is stored in an encrypted state in the storage device of the encrypted conversion text device, the decryption authority holder and the decryption authority transfer target are safe. You can share content. In addition, when the content is shared, the decryption authority holder does not need to perform additional calculations, so that the content can be shared efficiently.

  As public encryption methods used for realizing the delegation system, a standard public key encryption method (hereinafter referred to as PKE) using a random number as a public key and an ID-based encryption method (hereinafter referred to as Non-Patent Document 1). IBE: Identity Based Encryption). The IBE method is a public key encryption method that uses an arbitrary character string such as a telephone number or an e-mail address as a public key. Since the public key and its owner are easily associated with each other, the key in standard public key encryption is used. It is attracting attention as a technology that greatly reduces the complexity of management. In IBE, a third party called a secret key generator is required to generate a secret key. The secret key generator generates a secret key for each user using the main secret key and distributes it to each user. Since the secret key generator can decrypt all the ciphertext encrypted with the public key of each user, it must be a reliable third party.

For the transfer of ciphertext decryption authority between a device that performs encryption processing using the PKE method and a device that performs encryption processing using the IBE method, a classification as shown in FIG. 7 can be considered. That is, an IBE-IBE method for converting an IBE ciphertext having a certain ID as a public key into an IBE ciphertext having another ID as a public key, and converting a PKE ciphertext with a certain public key into a PKE ciphertext with another public key PKE-PKE method, IBE-PKE method for converting an IBE ciphertext with a certain ID as a public key into a PKE ciphertext with a certain public key, an IBE ciphertext with a certain ID as a public key This is a PKE-IBE system for converting to a PKE. For example, Non-Patent Document 2 proposes a ciphertext decryption authority delegation method that performs conversion based on the IBE method proposed in Non-Patent Document 1 described above.
Note that Non-Patent Document 3 proposes an IBE method using a calculation different from that of Non-Patent Document 1.
[BF01] D. Boneh, M. Franklin, “Identity based encryption from the Weil paring”, extended abstract in Advances in Cryptology-Crypto 2001, LectureNotes in Computer Science, Vol. 2139, Springer-Verlag, pp. 213-229, Aug.2001. (Internet URL: http://eprint.iacr.org/2001/090/) [GA07] M.Green, G.Ateniese, “Indentity-Based Proxy Re-Encryption”, ACNS 2007, LNCS 4521, pp.288-306,2007 (Internet URL: http://eprint.iacr.org/2006/ 473) [BB04] D.Boneh and X.Boyen, “Efficient selectiveid secure identity based encryption without random oracle”, In Advances in Cryptology-EUROCRYPT´04, Lecture Notes in Computer Science, LNCS 3027, pp. 223-238. SpringerVerlag, 2004 (Internet URL: http://crypto.stanford.edu/~dabo/papers/bbibe.pdf)

However, when the IBE ciphertext is converted into the PKE ciphertext by the proposed method shown in Non-Patent Document 2, the PKE ciphertext converted by the ciphertext conversion device is the normal PKE ciphertext and Are in different forms. Thereby, when the decryption authority transfer target person decrypts the converted PKE ciphertext and obtains plaintext, it is necessary to perform a calculation different from the decryption of the normal PKE ciphertext. That is, (1) when converting an IBE ciphertext to a PKE ciphertext, the size increases compared to the PKE ciphertext created by the original PKE cipher, and (2) decrypting the PKE ciphertext converted from the IBE ciphertext In this case, there is a problem that it is necessary to perform a decryption process different from that of the original PKE encryption method and increase the amount of calculation.
The present invention has been made in view of such a situation, and an object of the present invention is to convert a converted PKE ciphertext even when an IBE ciphertext is converted into a PKE ciphertext by a ciphertext converter. Is the same as the ciphertext size created by the PKE encryption method, and provides a ciphertext decryption authority delegation system that enables conversion that can be decrypted by the same decryption process.

  In order to solve the above-described problems, the present invention provides a device for a decryption authority holder that performs an encryption process using an ID-based encryption method, and a decryption authority transfer target person that performs an encryption process using a standard public key encryption system. A secret key generation device for generating a secret key of an ID-based cryptosystem used for a device for decryption authority holder based on a main secret key, and ID-based encryption based on an ID corresponding to the device for decryption authority holder A ciphertext decryption authority delegation system comprising: a ciphertext conversion apparatus that converts a ciphertext encrypted by a method so that the decryption authority delegation target apparatus can decrypt the encrypted text, and the decryption authority delegation target apparatus Comprises public key generation means for generating a public key by a standard public key cryptosystem and a re-encryption public key corresponding to the public key, and the secret key generation apparatus stores storage means for storing the main secret key And memory The ciphertext conversion apparatus based on the main secret key stored in the stage, the ID corresponding to the decryption authority holder apparatus, and the public key and re-encryption public key generated by the decryption authority transfer target apparatus A conversion key generation unit that generates a conversion key used when converting the ciphertext, and a conversion key transmission unit that transmits the conversion key generated by the conversion key generation unit to the ciphertext conversion apparatus. An apparatus includes a conversion key receiving unit that receives a conversion key from a secret key generation device, and a ciphertext receiving unit that receives a ciphertext encrypted by an ID-based encryption method based on an ID corresponding to a device for a decryption authority holder And a ciphertext conversion processing means for converting the ciphertext received by the ciphertext receiving means based on the conversion key received by the conversion key receiving means, and the decryption authority delegation for the ciphertext converted by the ciphertext conversion processing means For the target device Characterized in that it comprises a transformed cipher text transmitting means for signal, a.

  In addition, the present invention provides a device for a decryption authority holder that performs encryption processing by an ID-based encryption method, a device for a decryption authority transfer target person that performs encryption processing by a standard public key encryption method, and a decryption authority holder A secret key generating device for generating a secret key of an ID-based encryption method used for the device for the device based on the main secret key, and encryption encrypted by the ID-based encryption method based on the ID corresponding to the device for the holder of the decryption authority A ciphertext decryption authority delegation method in a ciphertext decryption authority delegation system, comprising: a ciphertext conversion apparatus that converts a sentence so that it can be decrypted by a decryption authority delegation target apparatus; The public key generating means includes a step of generating a public key by a standard public key cryptosystem and a re-encrypting public key corresponding to the public key, and a secret provided with a storage means for storing the main secret key The conversion key generation unit of the generation device uses the main secret key stored in the storage unit, the ID corresponding to the decryption authority holder device, the public key generated by the decryption authority transfer target device, and the re-encryption Based on the public key, the step of generating a conversion key used when the ciphertext conversion apparatus converts the ciphertext, and the conversion key transmitting means sends the conversion key generated by the conversion key generation means to the ciphertext conversion apparatus. The step of transmitting, the step of receiving the conversion key from the secret key generation device by the conversion key receiving unit of the ciphertext conversion device, and the ciphertext receiving unit ID based on the ID corresponding to the device for the owner of decryption authority Receiving a ciphertext encrypted by the base encryption method, and converting a ciphertext received by the ciphertext receiving means based on a conversion key received by the conversion key receiving means. , Strange Rear ciphertext transmission means, a ciphertext converted by the ciphertext conversion processing means, characterized in that it comprises the steps of: transmitting the decryption authority delegation subject's system.

  In addition, the present invention provides a device for a decryption authority holder that performs encryption processing by an ID-based encryption method, a device for a decryption authority transfer target person that performs encryption processing by a standard public key encryption method, and a decryption authority holder A secret key generating device for generating a secret key of an ID-based encryption method used for the device for the device based on the main secret key, and encryption encrypted by the ID-based encryption method based on the ID corresponding to the device for the holder of the decryption authority A ciphertext conversion apparatus that converts a sentence so that it can be decrypted by a decryption authority transfer target person device, and a ciphertext conversion apparatus in a ciphertext decryption authority transfer system, which is generated by a secret key generation apparatus, The main secret key stored in the secret key generation device, the ID corresponding to the device for the owner of decryption authority, and the public key by the standard public key cryptosystem generated by the device for transfer authority transfer target device And a conversion key receiving means for receiving a conversion key used when converting a ciphertext encrypted by the ID-based encryption method based on the public key for re-encryption, and an ID corresponding to the device for the decryption authority holder A ciphertext receiving means for receiving a ciphertext encrypted by an ID-based encryption method, and a ciphertext conversion for converting a ciphertext received by the ciphertext receiving means based on a conversion key received by the conversion key receiving means It is characterized by comprising processing means and converted ciphertext transmission means for transmitting the ciphertext converted by the ciphertext conversion processing means to the decryption authority transfer target user device.

  In addition, the present invention provides a device for a decryption authority holder that performs encryption processing by an ID-based encryption method, a device for a decryption authority transfer target person that performs encryption processing by a standard public key encryption method, and a decryption authority holder A secret key generating device for generating a secret key of an ID-based encryption method used for the device for the device based on the main secret key, and encryption encrypted by the ID-based encryption method based on the ID corresponding to the device for the holder of the decryption authority A ciphertext conversion device that converts a sentence so that it can be decrypted by a device for decryption authority transfer target, and a computer of the ciphertext conversion device in the ciphertext decryption authority delegation system, generated by a secret key generation device, According to the standard private key encryption method generated by the device for the decryption authority transfer target device, the ID corresponding to the device for the decryption authority holder, the main secret key stored in the secret key generation device Corresponding to a conversion key receiving step for receiving a conversion key used when converting a ciphertext encrypted by the ID-based encryption method based on the open key and the public key for re-encryption, and a device for decryption authority holder A ciphertext receiving step for receiving a ciphertext encrypted by an ID-based encryption method based on the ID, and a ciphertext for converting the ciphertext received by the ciphertext receiving means based on the conversion key received by the conversion key receiving means A ciphertext conversion program that executes a text conversion processing step and a post-conversion ciphertext transmission step of transmitting the ciphertext converted by the ciphertext conversion processing means to the decryption authority transfer target device.

  As described above, according to the present invention, the ciphertext converter enables conversion from the IBE ciphertext to the PKE ciphertext, and the size of the converted PKE ciphertext is changed to the PKE ciphertext. Thus, it is possible to provide a ciphertext decryption authority delegation system that is the same as the ciphertext size created in this way and that can decrypt the converted PKE ciphertext by the standard PKE method.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In the following embodiment, a delegation system is configured from the decryption authority holder device 10 using the IBE method proposed in Non-Patent Document 3 to the decryption authority delegation target device 20 using the PKE method. . In this embodiment, the IBE ciphertext is converted by the IBE method proposed in Non-Patent Document 3.

<Configuration>
FIG. 1 is a diagram showing a configuration of a delegation system 1 according to the present embodiment. The solid arrows between the devices in FIG. 1 indicate communication via a normal line, that is, a line that may be leaked to a third party, but communication data is not altered by the third party. A broken arrow indicates communication via a secure line that is safe, that is, secures a secret and prevents tampering.

  The delegation system 1 includes a decryption authority holder device 10, a decryption authority delegation target device 20, a ciphertext conversion device 30, and an IBE secret key generation device 40. The decryption authority holder device 10 employs IBE encryption, and the decryption authority transfer target device 20 employs PKE encryption.

  The IBE secret key generation device 40 includes a main secret key processing unit 41, a storage unit 42, a transmission / reception unit 43, and a conversion key generation unit 44. The IBE secret key generation device 40 is a computer device as a trusted third party. The main secret key processing unit 41 performs an IBE setup process for generating a main secret key by IBE method and a public parameter. The main secret key and the public parameter generated by the main secret key processing unit 41 are stored in the storage unit 42. In addition, the main secret key processing unit 41 inputs an IBE secret key to an apparatus adopting the IBE method by inputting a user ID corresponding to the apparatus, the generated main secret key, and a public parameter. Perform the generation process. The transmission / reception unit 43 transmits / receives information to / from the decryption authority holder device 10 and the decryption authority transfer target device 20. The conversion key generation unit 44 performs a conversion key generation process for generating a conversion key using the PKE public key, the PKE re-encryption public key, and the main secret key that are received from the decryption authority transfer target user device 20. .

  The decryption authority holder device 10 includes an ID-based encryption processing unit 11, a storage unit 12, and a transmission / reception unit 13. The transmission / reception unit 13 receives a secret key (IBE secret key) based on the IBE method generated based on the user ID (IBE public key) corresponding to itself generated by the IBE secret key generation device 40. The storage unit 12 stores a user ID corresponding to itself and the IBE private key received by the transmission / reception unit 13 from the IBE private key generation device 40. Here, the user ID is an ID for identifying a user (decryption authority holder) using ID-based encryption, and an arbitrary character string such as a telephone number or a mail address can be applied. The ID-based encryption processing unit 11 performs an IBE encryption process for generating an IBE ciphertext by encrypting a plaintext by using an ID-based encryption, and an IBE decryption process for decrypting the ciphertext by the ID-based encryption to calculate a plaintext.

  The decryption authority transfer target user device 20 includes a public key encryption processing unit 21, a key generation unit 22, a storage unit 23, and a transmission / reception unit 24. The key generation unit 22 performs a PKE key generation process for generating a PKE public key, a PKE re-encryption public key used when re-encrypting the PKE ciphertext, and a PKE private key based on the selected random number. The storage unit 23 is encrypted by the public key encryption processing unit 21 using a PKE encryption process that generates a PKE ciphertext by encrypting a plaintext using a public key (PKE public key) by the PKE method. A PKE decryption process is performed to decrypt the PKE ciphertext using a secret key (PKE secret key) based on the PKE method. If the key generation unit 22 does not accept the transfer of the decryption authority, the key generation unit 22 does not generate the public key for re-encryption and does not disclose it.

  The ciphertext conversion apparatus 30 includes a ciphertext conversion processing unit 31, a storage unit 32, and a transmission / reception unit 33. The transmission / reception unit 33 receives the conversion key generated and transmitted by the IBE private key generation device 40. The storage unit 32 stores the conversion key received by the transmission / reception unit 33. The ciphertext conversion processing unit 31 uses the conversion key stored in the storage unit 32 to convert the IBE ciphertext encrypted by the decryption authority holder device 10 by the IBE method into a PKE ciphertext. Process.

  2 and 3 are diagrams for explaining an outline of the operation of the delegation system 1 in the present embodiment. As shown in FIG. 2, the IBE private key generation device 40 uses the main private key to generate the IBE private key of the decryption authority holder device 10 (step (1)). On the other hand, the decryption authority transfer target device 20 generates its own PKE public key, re-encryption public key, and PKE private key by the PKE method. Here, the decryption authority transfer target device 20 publishes the PKE public key and the re-encryption public key via the network (step (2)). The IBE private key generation device 40 receives the public PKE public key and the re-encryption public key. The IBE secret key generation device 40 converts the conversion key based on the main secret key generated in step (1) and the PKE public key and re-encryption public key received from the decryption authority transfer target device 20 in step (2). Is transmitted to the ciphertext conversion apparatus 30 (step (3)).

  Then, as shown in FIG. 3, when the decryption authority holder device 10 receives the IBE ciphertext encrypted with the public ID (IBE public key), the decryption authority (step (1)). The holder device 10 transmits the IBE ciphertext to the ciphertext conversion device 30 (step (2)). Here, as the IBE ciphertext, for example, the mail server or the like uses the ID corresponding to the decryption authority holder device 10 to generate the IBE ciphertext in which the content of the e-mail is encrypted by the IBE method, and the decryption authority holder The decryption authority holder device 10 may generate an IBE ciphertext by itself and transmit it to the ciphertext conversion device 30. Then, the ciphertext conversion apparatus 30 converts the IBE ciphertext into the PKE ciphertext using the stored conversion key, and transmits the PKE ciphertext to the decryption authority transfer target person device 20 (step (3)). The decryption authority transfer target device 20 decrypts the converted PKE ciphertext using its own PKE private key to obtain plaintext (step (4)).

Next, with regard to the encryption processing applied to the present embodiment, each of the encryption processing by the IBE method, the encryption processing by the PKE method, and the conversion processing from the IBE ciphertext to the PKE ciphertext will be described in detail. .
<IBE setup process>
First, an IBE setup process (SetUp _IBE (k)) based on the IBE method applied to the present embodiment will be described. The IBE setup process is performed by the main secret key processing unit 41 of the IBE secret key generation apparatus 40. In the IBE setup process, the security parameter k is input, p is a prime number, G and G ₁ are cyclic groups of order p, g is a generator of G, and a bilinear map is e (hat): G × G → and _{G 1.} Here, e (hat) is indicated by adding a symbol “^” on e in the following expression. Further, elements g ₂ and h are selected at random from G. In addition, the element α is randomly selected from Z _p ^* which is a set of natural numbers other than 0 that are less than the prime number p. Here, it is assumed that the main secret key (mk) is mk = g ₂ ^α , and the public parameters (params) are params = <g, g ₁ , g ₂ , h> (where g ₁ = g ^α ).

<IBE secret key generation processing>
Next, IBE private key generation processing (KeyGen _IBE (mk, params, ID)) according to the IBE method applied to the present embodiment will be described. The IBE secret key generation process is performed by the main secret key processing unit 41 of the IBE secret key generation apparatus 40. In the IBE secret key generation process, a main secret key (mk = g ₂ ^α ), a public parameter (params), and a user ID (ID∈Z _p ^* ) are input, and an element u is randomly selected from Z _p ^*. Thus, the secret key sk _ID of IBE is calculated by the following equation (1).

<IBE encryption processing>
Next, IBE encryption processing (Enc _IBE (ID, params, M)) by the IBE method applied to the present embodiment will be described. The IBE encryption processing is performed by, for example, the ID-based encryption processing unit 11 of the decryption authority holder device 10. In the IBE encryption process, a user ID (ID), a public parameter (params), elements (g ₁ , g ₂ ) on G ₁ , and plaintext (M) are input, and element r is obtained from Z _p ^*. Randomly selected, the IBE ciphertext (C _IBE ) is calculated and encrypted by the following equation (2).

<IBE decoding process>
Next, IBE decoding processing (DEC _IBE (sk _ID , params, C _IBE )) applied to the present embodiment will be described. The IBE decryption process is performed by the ID-based encryption processing unit 11 of the decryption authority holder device 10. In the IBE decryption process, the private key (sk _ID ), the public parameter (params), and the IBE ciphertext (C _IBE ) are input and the plaintext (M) is calculated and decrypted by the following equation (3).

<PKE key generation process>
Next, a PKE key generation process (KeyGen (Pk, params)) by the PKE method applied to the present embodiment will be described. The PKE key generation process is performed by the key generation unit 22 of the decryption authority transfer target person device 20. In PKE key generation process, select a random number ^{_{x (x∈ R Z p *)}} , the PKE public key and PK (= ^{g x),} the PKE private key and SK (= x). If the decryption authority transfer target person accepts the transfer of the decryption authority, a re-encryption public key (PK _R = g ₂ ^{1 / X} ) is further generated. Here, the PKE public key (PK) and the re-encryption public key (PK _R ) are made public.

<PKE encryption processing>
Next, PKE encryption processing (ENC _PKE (PK, M, params)) by the PKE method applied to the present embodiment will be described. The PKE encryption processing is performed by the public key encryption processing unit 21 of the decryption authority transfer target user device 20. In the PKE encryption process, a PKE public key (PK = g ^x ), plaintext (M), and public parameters (params) are input, an element v is randomly selected from Z _p ^* , and the following equation (4) ) To calculate the _PKE ciphertext (C _PKE = <X, Y>).

<PKE decoding process>
Next, a PKE decoding process (DEC _PKE (SK, C _PKE , params)) by the PKE method applied to the present embodiment will be described. The PKE decryption process is performed by the public key encryption processing unit 21 of the decryption authority transfer target person device 20. In the PKE decryption process, the plaintext (M) is calculated and decrypted with the PKE private key (SK = x) and the PKE ciphertext (C _PKE ) as inputs. Here, the PKE ciphertext (C _PKE ) is expanded as <X, Y>, and decrypted by calculating M = Y / ^Xsk .

<Conversion key generation process>
Next, a conversion key generation process (KeyGen _PRO (mk) for generating a conversion key (rk _{ID → PK} ) used when converting the _IBE ciphertext (C _IBE ) according to the present embodiment into the PKE ciphertext (C _PKE ). ID, PK, PK _R , params)). The conversion key generation process is performed by the conversion key generation unit 44 of the IBE private key generation device 40. In the conversion key generation process, the main secret key (mk = g ₂ ^α ), the user ID (ID), the PKE public key (PK), the re-encryption public key (PK _R ), and the public parameters (params (= <G, g ₁ , g ₂ , h>)) are input. Here, when the following formula (5) is true, the conversion key generation process is interrupted on the assumption that an illegal public key is presented.

When the above equation (5) is false, a random number (tε _R Z _P ^* ) is selected from Z _p ^*, and a conversion key (rk _{ID → PK} ) is calculated by the following equation (6).

In this way, with the conversion key (rk _{ID → PK} ) generated using the IBE private key for decrypting the IBE ciphertext and the PKE public key (PK) of the decryption authority transfer target, decryption of the IBE method, PKE encryption can be performed at the same time.

<Ciphertext conversion processing>
Next, using the conversion key (rk _{ID → PK} ), the ciphertext conversion process (ReEnc (ID, rk _{ID →} ) for converting the _IBE ciphertext (C _IBE ) according to the present embodiment into the PKE ciphertext (C _PKE ). _PK , params, _CIBE )). The ciphertext conversion process is performed by the ciphertext conversion processing unit 31 of the ciphertext conversion apparatus 30. In the ciphertext conversion process, a user ID (ID) and a conversion key (rk _{ID → PK} ) are input, and an IBE ciphertext (C _IBE = <C ₁ , C ₂ , C ₃ >) to a PKE ciphertext (C _PKE ). Here, first, v ₁ and v ₂ are calculated by the following equation (7).

The above equation (7) is calculated, and if v ₁ ≠ v ₂ , the processing is interrupted because an illegal ciphertext conversion is requested. On the other hand, if v ₁ = v ₂ , the PKE ciphertext (C _PKE ) is calculated by the following equation (8).

The thus generated PKE ciphertext _{(C PKE),} like the PKE decoding process described above, expand PKE ciphertext _{(C PKE) <X, Y} > to, to calculate the M = Y ^{/ X SK} Thus, the plaintext (M) can be decrypted.

<Operation>
Next, an operation example of the delegation system 1 according to the present embodiment will be described in detail with reference to FIGS. 4 and 5.
FIG. 4 is a sequence diagram showing a setup process by the delegation system 1. First, the main secret key processing unit 41 of the IBE secret key generation device 40 performs the above-described IBE setup process, generates a main secret key (mk) and a public parameter (params), and stores them in the storage unit 42. . The public parameters (params) stored in the storage unit 42 are disclosed via the network, and when the transmission / reception unit 43 receives a public parameter acquisition request, the public parameter is transmitted according to the received acquisition request ( Step S1).

  In addition, the main secret key processing unit 41 of the IBE secret key generation device 40, the main secret key (mk) generated in step S1, the public parameter (params), and the ID of the disclosed decryption authority holder device 10 ( IBE public key) is input, and the IBE secret key generation process described above is performed to generate the IBE secret key of the IBE secret key generation device 40 (step S2). The transmission / reception unit 43 transmits the IBE private key of the IBE private key generation device 40 generated by the main private key processing unit 41 to the decryption authority holder device 10 via a secure line (step S3). The transmission / reception unit 13 of the decryption authority holder device 10 receives the IBE secret key transmitted from the IBE secret key generation device 40. The decryption authority holder apparatus 10 causes the storage unit 12 to store the IBE private key received by the transmission / reception unit 13.

On the other hand, the public key encryption processing unit 21 of the decryption authority transfer target person device 20 performs the above-described PKE key generation processing, and performs the PKE public key (PK), the re-encryption public key (PK _R ), and the PKE private key. (SK) is generated (step S4) and stored in the key generation unit 22. The transmission / reception unit 24 transmits the PKE public key (PK) and the re-encryption public key (PK _R ) generated by the public key encryption processing unit 21 to the IBE private key generation device 40 (step S5).

The transmission / reception unit 43 of the IBE private key generation device 40 receives the PKE public key (PK) and the re-encryption public key (PK _R ) transmitted from the decryption authority transfer target user device 20. Then, the conversion key generation unit 44 of the IBE private key generation device 40 includes the main private key (mk) generated in step S1, the ID that is the IBE public key of the decryption authority holder device 10, and the transmission / reception unit 43. With the received PKE public key (PK) and re-encryption public key (PK _R ) and the public parameter (params) generated in step S1, the above-described conversion key generation process is performed, and the conversion key (rk _{ID) → PK} ) is generated (step S6). The transmission / reception unit 43 of the IBE private key generation device 40 transmits the generated conversion key (rk _{ID → PK} ) to the ciphertext conversion device 30 (step S7). When the transmission / reception unit 33 of the ciphertext conversion device 30 receives the conversion key (rk _{ID → PK} ) transmitted from the IBE private key generation device 40, the transmission / reception unit 33 stores the conversion key in the storage unit 32.

FIG. 5 is a sequence diagram showing cryptographic delegation processing by the delegation system 1. First, the ID-based encryption processing unit 11 of the decryption authority holder apparatus 10 uses the ID that is its own IBE public key to perform the above-mentioned IBE encryption processing to encrypt the plaintext (M), and the IBE ciphertext Is generated (step S11). The transmission / reception unit 13 of the decryption authority holder device 10 transmits the IBE ciphertext (C _IBE ) generated in step S11 to the ciphertext conversion device 30 (step S12).

When the transmission / reception unit 33 of the ciphertext conversion device 30 receives the IBE ciphertext (C _IBE ) transmitted from the decryption authority holder device 10, the ciphertext conversion processing unit 31 performs the IBE secret key generation device 40 in step S 7. The conversion key (rk _{ID → PK} ) transmitted from and stored in the storage unit 32 is read out, and the ciphertext conversion process described above is performed (step S13). Then, the transmission / reception unit 33 transmits the PKE ciphertext (C _PKE ) converted from the _IBE ciphertext (C _IBE ) to the decryption authority transfer target person device 20 by the ciphertext conversion processing of the ciphertext conversion processing unit 31. (Step S14). When the transmitting / receiving unit 24 of the decryption authority transfer target person device 20 receives the PKE ciphertext (C _PKE ) transmitted from the ciphertext conversion apparatus 30, the public key encryption processing unit 21 of the decryption authority transfer target person device 20 Then, the above-described PKE decryption process is performed using its own private key (SK), and the PKE ciphertext (C _PKE ) is decrypted to obtain plaintext (M).

As described above, according to the present embodiment, it is possible to convert the IBE ciphertext (C _IBE ) into the PKE ciphertext (C _PKE ) that can be decrypted by the normal PKE decryption process according to the above equation (7). Become. As a result, for example, the decryption authority transfer target user device 20 performs a normal PKE ciphertext (C _PKE ) PKE decryption process and a PKE ciphertext (C _PKE ) decryption process converted from the _IBE ciphertext (C _IBE ). Can be performed by the same processing. Further, when converting the _IBE ciphertext (C _IBE ) by the ciphertext conversion device 30, the ciphertext conversion device 30 does not obtain plaintext information.

<Comparison of conversion processing between this embodiment and conventional technology>
Next, IBE (BF01) ciphertext (C _{IBE (BF01)} ) generated by the IBE proposed in Non-Patent Document 1 (hereinafter, IBE (BF01)) method is suggested in Non-Patent Document 2. Processing for converting to _PKE ciphertext (C (bar) _PKE ) by the conversion method described above will be described, and ciphertext conversion processing according to the present embodiment and ciphertext conversion processing according to Non-Patent Document 2 will be compared.

<IBE (BF01) setup process>
First, the IBE (BF01) setup process (SetUp _{IBE (BF01)} (k)) based on the IBE (BF01) method according to the prior art will be described. In the IBE (BF01) setup process, the security parameter (k) is input, p is a prime number, G and G ₁ are cyclic groups of order p, g is a generator of G, and a bilinear map is a hat (^ ) e: and _G × G → G _1. Also, a hash function H1: {0,1} → G, H2: providing a G → _{G 1.} The element s is randomly selected from Z _p ^* , and g ₁ = g _S , mk = s, params = <g, g ₁ , H ₁ , H ₂ >. Here, mk is a main secret key and params is a public parameter.

<IBE (BF01) secret key generation process>
Next, IBE (BF01) secret key generation processing (KeyGen _{IBE (BF01)} (mk, params, ID)) based on the IBE (BF01) method will be described. In the IBE (BF01) secret key generation process, the main secret key (mk = s), the public parameter (params), and the user ID (IDεZ _p ^* ) are input, and the IBE (BF01) is expressed by the following equation (9). ) Generate a secret key.

<IBE (BF01) Encryption Process>
Next, IBE (BF01) encryption processing (ENC _{IBE (BF01)} (ID, params, M)) based on the IBE (BF01) system will be described. In the IBE (BF01) encryption process, a user ID (ID), a public parameter (params), elements (g ₁ , g ^r ) on G ₁ , and plaintext (M) are input, and Z _p ^* The element r is selected at random, and the IBE (BF01) ciphertext (C _{IBE (BF01)} ) is calculated and encrypted by the following equation (10).

<IBE (BF01) Decoding Process>
Next, an IBE (BF01) decoding process (DEC _{IBE (BF01)} (sk _ID , params, _{CIBE (BF01)} )) based on the IBE (BF01) system will be described. In the IBE (BF01) decryption process, a secret key (sk _ID ), a public parameter (params), and an IBE (BF01) ciphertext (C _{IBE (BF01)} ) are input, and plaintext (M ) Is calculated and decoded.

<Conversion key generation processing (GA07)>
Next, a conversion key generation process (GA07) (KeyGen _{PRO (} ) for generating a conversion key (rk _{ID → PK} ) used when converting the IBE (BF01) ciphertext (C _{IBE (BF01)} ) into the PKE ciphertext. _GA07) (mk, sk _ID , PK)) will be described. In the conversion key generation process (GA07), the main secret key (mk = s), the secret key (sk _ID ) of the IBE user, and the public key (PK) of the PKE user are input, and a random number X∈ _R G ₁ is obtained. The conversion key (rk _{ID → PK} ) is calculated by the following equation (12). Here, Encrypt (PK, X) is an arbitrary PKE encryption process.

<Ciphertext conversion processing (GA07)>
Next, ciphertext conversion processing (ReEnc (ID, rk _{ID → PKE} , params, C) for converting the IBE (BF01) ciphertext according to the present embodiment into the PKE ciphertext using the conversion key (rk _{ID → PK} ). _{IBE (BF01)} )) will be described. In the ciphertext conversion process, a conversion key (rk _{ID → PK} ), a public parameter (params), and an IBE ciphertext (C _IBE = <C ₁ , C ₂ >) are input, and PKE is expressed by the following equation (13). Conversion into ciphertext (C (bar) _PKE ) that can be decrypted by the user is performed. Here, (C (bar) _PKE ) indicates a value shown on the left side of the following equation (13).

<Ciphertext decryption process (GA07)>
Next, a ciphertext (BF01) decryption process (DEC _PKE (SK, params, C (bar) _PKE )) for decrypting the C (bar) _PKE generated by the ciphertext (BF01) conversion process will be described. In the ciphertext decryption process (GA07), the PKE private key (SK), the public parameter (params), and the converted ciphertext (C (bar) _PKE ) are input, and the plaintext ( M) is decrypted. First, the ciphertext (C (bar) _PKE ) is expanded as C (bar) _PKE = <V, U, W>. Next, the random number X is calculated by an arbitrary PKE decoding process expressed by the following equation (14).

Then, the plaintext (M) is calculated and decrypted from the random number X and the ciphertext (C (bar) _PKE ) by the following equation (54).

As described above, in the prior art, the decryption of the ciphertext (C (bar) _PKE ), which is the result of converting the _IBE ciphertext (C _{IBE (BF01)} ), is first performed by the decryption process of the PKE method (the above formula (14)) After obtaining the random number X, the plaintext (M) is obtained by performing an additional calculation according to the above equation (15). That is, when the decryption authority transfer target person receives and decrypts the _PKE ciphertext (C _PKE ), the decryption process Decrypt (SK, C _PKE (C _PKE is the PKE ciphertext) according to the above equation (14). ) Only to obtain the plaintext (M), but when decrypting the ciphertext (C (bar) _PKE ) as the conversion result, additional processing (the above formula (15)) is required for decryption of the PKE method. In addition to being unable to perform the same processing, the size of W is the same as the size of the PKE ciphertext (C _PKE ). Therefore, the size of the ciphertext (C (bar) _PKE ) after conversion increases by V and U compared to the _PKE ciphertext (C _PKE ) without conversion.

Here, in the conversion key generation process (GA07) according to the prior art, as shown in the above formula (11), the secret key (sk _ID ) of the device for the owner of decryption authority is concealed using the random number (X), A conversion key (rk _{ID → PK} ) in which the random number (X) is encrypted with the PKE public key (PK) of the decryption authority transfer target device is generated. As shown in FIG. 6, when the decryption authority transfer target device decrypts the ciphertext (C _{IBE (BF01)} ), the above equation (using the PKE private key (SK)) 13) After the random number (X) is calculated by 13), the decryption authority transfer target device performs decryption using the private key (sk _ID ) of the decryption authority holder device concealed with the random number (X). It has become. In other words, when decrypting the converted ciphertext (C _{IBE (BF01)} ), the decryption authority transfer target user device must additionally perform a process similar to the decryption in the IBE method in addition to the decryption in the PKE method. .

Thus, in the above formula (11) of the conversion key generation process (GA07) in the prior art, the secret key (SK _ID ) of the decryption authority holder is used. On the other hand, in the conversion key generation process of the present embodiment, as shown in the above formula (5), the conversion key (rk _{ID → PK} ) using the PKE public key (PK) of the decryption authority delegation target device. ) Is generated. By the ciphertext conversion process (the above equation (7)) using the conversion key (rk _{ID → PK} ) generated in this way, the decryption of the IBE method and the encryption of the PKE method are simultaneously performed, and the PKE ciphertext (C _PKE ) can be generated. The PKE ciphertext (C _PKE ) converted in this way is encrypted with the re-encryption public key (PK _R ), and the decryption authority delegation target device is decrypted by a normal PKE decryption process. Is possible. Further, because the size of the converted PKE ciphertext _{(C PKE),} like the converted according to the prior art the PKE ciphertext (C _{(bar) PKE),} V, are not to be construed U, a W, There is no increase in size. In addition, it is possible to realize a safe delegation system against CPA (Chosen Plaintext Attack) from PKE users.

  As described above, according to the present embodiment, the ciphertext conversion apparatus converts the IBE ciphertext transmitted from the decryption authority holder into a PKE in the same format as the normal PKE method adopted by the decryption authority transfer target person. When converted into ciphertext and the decryption authority transfer target person obtains plaintext, it is possible to obtain plaintext by performing the same process as decryption of a normal PKE ciphertext. Furthermore, according to the present embodiment, even if the ciphertext converter and the decryption authority transfer target person collide, the primary secret key of the IBE secret key generation device cannot be restored. Further, when the ciphertext conversion apparatus converts the ciphertext, the ciphertext is decrypted by the ciphertext conversion apparatus, and the plaintext is not calculated.

  Note that a program for realizing the function of the processing unit in the present invention is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into the computer system and executed to execute the ciphertext decryption authority. May be delegated. Here, the “computer system” includes an OS and hardware such as peripheral devices. The “computer system” includes a WWW system having a homepage providing environment (or display environment). The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

It is a figure which shows the block configuration of the delegation system by one Embodiment of this invention. It is a figure which shows the setup processing procedure by one Embodiment of this invention. It is a figure which shows the encryption processing procedure by one Embodiment of this invention. It is a sequence diagram which shows the setup process by one Embodiment of this invention. It is a sequence diagram which shows the encryption process by one Embodiment of this invention. It is a figure which compares the encryption process by one Embodiment of this invention, and the encryption process by a prior art. It is a figure which shows the classification | category of the delegation system by IBE system and PKE system.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Decryption authority holder apparatus 11 ID-based encryption processing section 12 Storage section 13 Transmission / reception section 20 Decryption authority transfer target apparatus 21 Public key encryption processing section 22 Key generation section 23 Storage section 24 Transmission / reception section 30 Ciphertext conversion apparatus 31 Encryption Sentence conversion processing unit 32 Storage unit 33 Transmission / reception unit 40 IBE secret key generation device 41 Main secret key processing unit 42 Storage unit 43 Transmission / reception unit 44 Conversion key generation unit

Claims (4)

Used for a decryption authority holder device that performs encryption processing using an ID-based encryption scheme, a decryption authority transfer target device that performs encryption processing using a standard public key cryptosystem, and the decryption authority holder device A secret key generating device that generates a secret key of the ID-based encryption method based on a main secret key; and a ciphertext encrypted by the ID-based encryption method based on an ID corresponding to the device for the owner of decryption authority A ciphertext decryption authority delegation system comprising: a ciphertext conversion device that converts the decryption authority transfer target person so that the decryption is possible;
The decryption authority transfer target device is:
Public key generation means for generating a public key by the standard public key cryptosystem and a re-encryption public key corresponding to the public key,
The secret key generation device
Storage means for storing the main secret key;
The primary secret key stored in the storage means, the ID corresponding to the decryption authority holder device, the public key generated by the decryption authority transfer target device, and the re-encryption public key Conversion key generation means for generating a conversion key to be used when the ciphertext conversion apparatus converts the ciphertext based on:
Conversion key transmission means for transmitting the conversion key generated by the conversion key generation means to the ciphertext conversion apparatus,
The ciphertext conversion apparatus comprises:
Conversion key receiving means for receiving the conversion key from the secret key generation device;
Ciphertext receiving means for receiving ciphertext encrypted by the ID-based encryption method based on the ID corresponding to the decryption authority holder device;
Ciphertext conversion processing means for converting the ciphertext received by the ciphertext receiving means based on the conversion key received by the conversion key receiving means;
Converted ciphertext transmission means for transmitting the ciphertext converted by the ciphertext conversion processing means to the decryption authority transfer target person device;
A ciphertext decryption authority delegation system comprising: Used for a decryption authority holder device that performs encryption processing using an ID-based encryption scheme, a decryption authority transfer target device that performs encryption processing using a standard public key cryptosystem, and the decryption authority holder device A secret key generating device that generates a secret key of the ID-based encryption method based on a main secret key; and a ciphertext encrypted by the ID-based encryption method based on an ID corresponding to the device for the owner of decryption authority A ciphertext decryption authority delegation method in a ciphertext decryption authority delegation system, comprising:
The decryption authority transfer target device,
Public key generation means generating a public key by the standard public key cryptosystem and a re-encryption public key corresponding to the public key;
Of the secret key generation device comprising storage means for storing the main secret key,
The conversion key generating means includes the primary secret key stored in the storage means, the ID corresponding to the decryption authority holder device, the public key generated by the decryption authority transfer target device, and the Generating a conversion key to be used when the ciphertext conversion apparatus converts a ciphertext based on a re-encryption public key;
A conversion key transmitting means transmitting the conversion key generated by the conversion key generating means to the ciphertext conversion apparatus;
Of the ciphertext conversion apparatus,
A conversion key receiving means receiving the conversion key from the secret key generation device;
A step of receiving a ciphertext encrypted by the ID-based encryption method based on the ID corresponding to the decryption authority holder device;
Ciphertext conversion processing means converts the ciphertext received by the ciphertext receiving means based on the conversion key received by the conversion key receiving means;
A post-conversion ciphertext transmission unit that transmits the ciphertext converted by the ciphertext conversion processing unit to the decryption authority transfer target person device;
A ciphertext decryption authority delegation method comprising: Used for a decryption authority holder device that performs encryption processing using an ID-based encryption scheme, a decryption authority transfer target device that performs encryption processing using a standard public key cryptosystem, and the decryption authority holder device A secret key generating device that generates a secret key of the ID-based encryption method based on a main secret key; and a ciphertext encrypted by the ID-based encryption method based on an ID corresponding to the device for the owner of decryption authority A ciphertext conversion device that converts the decryption authority transfer target device so that it can be decrypted by the ciphertext decryption authority transfer system, the ciphertext conversion device,
Generated by the private key generated by the private key generation device and stored in the private key generation device, the ID corresponding to the decryption authority holder device, and the decryption authority transfer target device Conversion key reception for receiving a conversion key used for converting a ciphertext encrypted by the ID-based encryption method based on the public key by the standard public key encryption method and the public key for re-encryption Means,
Ciphertext receiving means for receiving ciphertext encrypted by the ID-based encryption method based on the ID corresponding to the decryption authority holder device;
Ciphertext conversion processing means for converting the ciphertext received by the ciphertext receiving means based on the conversion key received by the conversion key receiving means;
Converted ciphertext transmission means for transmitting the ciphertext converted by the ciphertext conversion processing means to the decryption authority transfer target person device;
A ciphertext conversion apparatus comprising: Used for a decryption authority holder device that performs encryption processing using an ID-based encryption scheme, a decryption authority transfer target device that performs encryption processing using a standard public key cryptosystem, and the decryption authority holder device A secret key generating device that generates a secret key of the ID-based encryption method based on a main secret key; and a ciphertext encrypted by the ID-based encryption method based on an ID corresponding to the device for the owner of decryption authority A ciphertext conversion device that converts the decryption authority transfer target device so that it can be decrypted, and a computer of the ciphertext conversion device in the ciphertext decryption authority transfer system comprising:
Generated by the private key generated by the private key generation device and stored in the private key generation device, the ID corresponding to the decryption authority holder device, and the decryption authority transfer target device Conversion key reception for receiving a conversion key used for converting a ciphertext encrypted by the ID-based encryption method based on the public key by the standard public key encryption method and the public key for re-encryption Steps,
A ciphertext receiving step of receiving a ciphertext encrypted by the ID-based encryption method based on the ID corresponding to the device for the decryption authority holder;
A ciphertext conversion processing step for converting the ciphertext received by the ciphertext receiving means based on the conversion key received by the conversion key receiving means;
A post-conversion ciphertext transmission step of transmitting the ciphertext converted by the ciphertext conversion processing means to the decryption authority transfer target person device;
Ciphertext conversion program that executes

Images