JP2012227879A - Oblivious transfer system, oblivious transfer method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an oblivious transfer system capable of implementing oblivious transfer which is efficient and capable of general-purpose combination.SOLUTION: A system parameter generation device comprises: a system parameter generation part generating common reference information; and a crs transmission part transmitting the common reference information to a transmission device and a reception device. The transmission device comprises: an encryption database generation part generating cryptograms Cto C, and generates an encryption database; a T transmission part transmitting the encryption database to the reception device; a reply generation part which verifies a knowledge identification impossibility proof, generates a non-dialog zero knowledge proof when the knowledge identification impossibility proof is correct, and generates a reply; and an R transmission part transmitting the reply to the reception device. The reception device comprises: a request generation part which verifies a signature included in the cryptograms Cto C, generates the knowledge identification impossibility proof when the signature is correct, and generates a request; a Q transmission part transmitting the request to the transmission device; and a document acquisition part which verifies the non-dialog zero knowledge proof, and calculates a document mfrom a cryptogram Cand outputs the document when the non-dialog zero knowledge proof is correct.

Description

  The present invention relates to a lost communication system, a lost communication method, and a program used for searching information in a database in a telecommunications system.

Adaptive loss communication means that a recipient communicates with a sender having a document (m ₁ ,..., _{M N} ) (N is a positive integer equal to or greater than 2) and corresponds to the number b specified by the recipient. This is a method for obtaining a document _mb to be processed. The sender cannot know at all about the number b. Recipients can get only the specified document. And the above communication can be repeated adaptively many times. This technique can be applied to secure database retrieval (for example, retrieval of patent documents in the Patent Office database). Conventionally, there are Non-Patent Documents 1 and 2 as typical adaptive lost communication that achieves high security called universal connection possibility.

M. Green and S. Hohenberger. Universally Composable Adaptive Oblivious Transfer. In ASIACRYPT’08, volume 5350 of Lecture Notes in Computer Science, pages 179-197. Springer, 2008. A. Rial, M. Kohlweiss, and B. Preneel. Universally Composable Adaptive Priced Oblivious Transfer. In Pairing, volume 5671 of Lecture Notes in Computer Science, pages 231-247. Springer, 2009.

  However, since Non-Patent Document 1 uses a signature scheme that can sign group elements, very special cryptographic assumptions are required, and ordinary cryptographic assumptions are used for security reasons. Less reliable than the one. Non-Patent Document 2 does not use the signature method as described above, but uses a method with an added function called adaptive lost communication with a price. For this reason, a strong cryptographic assumption different from the above is required, and the reliability is lower than that using the usual cryptographic assumption on the basis of security. Although the existing methods represented by Non-Patent Documents 1 and 2 achieve the strongest security of universal connectivity, the protocol for adaptive lost communication is a non-standard (strong) cryptographic assumption The only problem was that it needed.

  On the other hand, in order to realize adaptive lost communication with universal combining possibility using only standard (weak) cryptographic assumptions, a signature scheme using standard cryptographic assumptions is combined. Therefore, it is possible to construct a protocol for adaptive lost communication. However, simply combining the signature schemes based on these standard (weak) cryptographic assumptions, although functioning as an adaptive lost communication, is a problem that it is not easy to prove universal connectivity. . Also, Waters signature is known as one of the signature schemes using standard cryptographic assumptions. However, since Waters signature cannot be signed for group elements, it is a signature used for adaptive lost communication. Therefore, it is difficult to incorporate the Waters signature into the adaptive lost communication.

  Therefore, the present invention provides a lost communication system that can realize an adaptive lost communication that uses only standard cryptographic assumptions and that can be proved to have universal combining possibilities.

  The lost communication system of the present invention includes a system parameter generation device, a transmission device, and a reception device. The system parameter generation device includes a system parameter generation unit and a crs transmission unit.

The system parameter generation unit combines a bilinear mapping parameter by combining an arbitrary λ-bit prime number with respect to input 1 ^λ , a cyclic multiplicative group of the prime order, a bilinear mapping, and a generation source of the cyclic multiplicative group. And generating Groth-Sahai proof transmitting device parameters and receiving device parameters, and bilinear mapping parameters, transmitting device parameters, receiving device parameters, common reference information from the first coefficient group set from the generation source crs is generated. The crs transmission unit transmits the common reference information crs to the transmission device and the reception device.

The transmission device includes an encrypted database generation unit, a T transmission unit, a T storage unit, a reply generation unit, and an R transmission unit. The encrypted database generation unit receives the document (m ₁ ,..., _{M N} ) (N is a positive integer equal to or greater than 2) and the common reference information crs, and uses the first key pair and the second key of the Waters dual signature. Generate a pair, generate a third key pair for the Boneh-Boyen signature, generate a secret key, generate a public key using the first key pair, the second key pair, and the third key pair, and a Waters dual signature First signature and second signature, and a third signature of a Boneh-Boyen signature, and a document (m ₁ ,..., _{M N} ), a value included in the first key pair, included in the second key pair values, common reference information crs, first signature, the second signature, by using the third signature, the ciphertext _C 1, ..., and generates a _{C N,} and the public key, the ciphertext _C 1, ..., and _{C N} Generate an encrypted database from The T transmitting unit transmits the encrypted database to the receiving device. The T storage unit stores an encrypted database and a secret key. The reply generator receives the common reference information crs, the encrypted database, the secret key, and the request Q, verifies the knowledge identification impossible proof, and uses the secret key and the request Q when the knowledge identification impossible proof is correct. Blind decryption is executed, a non-interactive zero knowledge proof of the Groth-Sahai proof is generated using the encrypted database, common reference information crs, and request Q, and a reply R including the non-interactive zero knowledge proof is generated. The R transmission unit transmits a reply R to the receiving device.

The receiving device includes a request generation unit, a Q transmission unit, a Q storage unit, and a document acquisition unit. Request generation unit, an encryption database, a common reference information crs, and inputs the index xi], ciphertext C _1, ..., verifies the signature contained in the C _N, if the signature is correct, corresponding to the index xi] ciphertext C _xi] to, perform re-randomization using the common reference information crs, ciphertext C _xi], common reference information crs, using the public key to generate a knowledge indistinguishable proof Groth-Sahai proof, A request Q including a knowledge indistinguishable proof and a Q _priv including the request Q and an index ξ are generated. The Q transmission unit transmits the request Q to the transmission device. The Q storage unit stores the request Q and Q _priv . Document acquisition unit includes a reply R, and Q _priv, the encrypted database, and inputs the common reference information crs, verifies the non-interactive zero-knowledge proof, if non-interactive zero-knowledge proof is correct, Q _priv, encryption Using the sentences C ₁ ,..., C _N and the common reference information crs, the document m _ξ is calculated from the cipher text C _ξ and output.

  According to the lost communication system of the present invention, unlike the conventional method that achieves universal combining possibility, it is a signature method for integer elements and has stronger security than the usual security of F-forgery impossible. By using a signature scheme (a modified version of Waters dual signature), using only a very standard cryptographic assumption called the decision linear assumption, it realizes universal joinability, and also has proven security. Lost communication can be realized.

1 is a block diagram showing a configuration of a lost communication system according to Embodiment 1. FIG. FIG. 3 is a sequence diagram illustrating an operation of the lost communication system according to the first embodiment. FIG. 3 is a block diagram illustrating a configuration of a system parameter generation unit included in the system parameter generation apparatus according to the first embodiment. 5 is a flowchart illustrating an operation of a system parameter generation unit included in the system parameter generation apparatus according to the first embodiment. FIG. 3 is a block diagram illustrating a configuration of an encrypted database generation unit included in the transmission apparatus according to the first embodiment. 6 is a flowchart illustrating an operation of an encrypted database generation unit included in the transmission apparatus according to the first embodiment. FIG. 3 is a block diagram illustrating a configuration of a request generation unit included in the reception device according to the first embodiment. 6 is a flowchart illustrating an operation of a request generation unit included in the receiving apparatus according to the first embodiment. FIG. 3 is a block diagram illustrating a configuration of a reply generation unit included in the transmission device according to the first embodiment. 6 is a flowchart illustrating an operation of a reply generation unit included in the transmission apparatus according to the first embodiment. FIG. 3 is a block diagram illustrating a configuration of a document acquisition unit included in the receiving apparatus according to the first embodiment. 6 is a flowchart illustrating an operation of a document acquisition unit included in the receiving apparatus according to the first embodiment. The table | surface which shows the difference with the loss communication system of this invention, and a prior art. The figure which represented the difference with the loss communication system of this invention, and a prior art on a coordinate axis.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

In this specification, λ represents a security parameter. See Appendix for bilinear mapping. BMSSetup is a bilinear mapping parameter consisting of G and G _T that are cyclic multiplicative groups of λ-bit prime p and prime order p, bilinear mapping e, and generator g of group G with respect to input 1 ^λ . A standard algorithm that outputs Γ: = (p, G, G _T , e, g) is used. In the present invention, Groth-Sahai proof is used. See Appendix C for the Groth-Sahai proof algorithm, a brief description (see reference 7 [GS08] for full details). See Appendix B1 for the Waters dual signature and Appendix B2 for the Boneh-Boyen signature.

<Glossary of terms used in this specification>
In this specification,

Means that a random number is generated inside the algorithm and output at random. Also,

, It means that a value is randomly selected from an integer ring Z _p modulo a prime number p.

  First, an outline of the operation of the lost communication system 100 according to the first embodiment of the present invention will be described with reference to FIGS. 1 and 2. FIG. 1 is a block diagram illustrating a configuration of a lost communication system 100 according to the present embodiment. FIG. 2 is a sequence diagram showing the operation of the lost communication system 100 according to the present embodiment.

  The lost communication system 100 according to the present embodiment includes a system parameter generation device 10, a transmission device 20, and a reception device 30. The system parameter generation device 10 includes a system parameter generation unit 11 and a crs transmission unit 12.

In the following, description will be made in the order of procedures actually performed. The system parameter generation unit 11 combines a bilinear mapping by combining an arbitrary λ-bit prime number with respect to an input 1 ^λ , a cyclic multiplicative group of the prime order, a bilinear mapping, and a generation source of the cyclic multiplicative group. Generate parameters, generate parameters for the transmitter and receiver of Groth-Sahai proof, and refer to the bilinear mapping parameters, parameters for the transmitter, parameters for the receiver, and the first coefficient group set from the source Information crs is generated (S11). The crs transmission unit 12 transmits the common reference information crs to the transmission device and the reception device (S12).

The transmission device 20 includes an encrypted database generation unit 21, a T transmission unit 22, a T storage unit 23, a reply generation unit 24, and an R transmission unit 25. The encrypted database generation unit 21 receives the document (m ₁ ,..., _{M N} ) (N is a positive integer greater than or equal to 2) and the common reference information crs, and inputs the first key pair and the second of the Waters dual signature. Generate a key pair, generate a third key pair for the Boneh-Boyen signature, generate a secret key, generate a public key using the first key pair, the second key pair, and the third key pair, A first signature and a second signature of a signature are generated, a third signature of a Boneh-Boyen signature is generated, a document (m ₁ ,..., _{M N} ), a value included in the first key pair, and a second key pair Cipher text C ₁ ,..., _CN is generated using the included value, common reference information crs, first signature, second signature, and third signature, and the public key and cipher text C _{1 ,.} An encrypted database is generated from the above (S21). The T transmitting unit 22 transmits the encrypted database to the receiving device (S22). The T storage unit 23 stores the encrypted database and the secret key (S23).

The receiving device 30 includes a request generation unit 31, a Q transmission unit 32, a Q storage unit 33, and a document acquisition unit 34. Request generation unit 31, and encrypted database, and the common reference information crs, and inputs the index xi], ciphertext C _1, ..., verifies the signature contained in the C _N, if the signature is correct, the index xi] corresponding ciphertext C _xi], then perform the re-randomization using the common reference information crs, ciphertext C _xi], common reference information crs, using the public key to generate a knowledge indistinguishable proof Groth-Sahai certification Then, the request Q including the knowledge indistinguishable proof and the Q _priv including the request Q and the index ξ are generated (S31). The Q transmission unit 32 transmits the request Q to the transmission device (S32). The Q storage unit 33 stores the request Q and Q _priv (S33).

  The reply generation unit 24 of the transmission device 20 receives the common reference information crs, the encrypted database, the secret key, and the request Q, verifies the knowledge identifiable proof, and when the knowledge identifiable proof is correct, Perform blind decryption using request Q, generate non-interactive zero knowledge proof of Groth-Sahai proof using encrypted database, common reference information crs, and request Q, and return R including non-interactive zero knowledge proof Generate (S24). The R transmitter 25 transmits a reply R to the receiving device (S25).

The document acquisition unit 34 of the receiving device 30 inputs the reply R, Q _priv , the encrypted database, and the common reference information crs, verifies the non-interactive zero knowledge proof, and when the non-interactive zero knowledge proof is correct , Q _priv , ciphertext C ₁ ,..., C _N and common reference information crs are used to calculate and output document m _ξ from ciphertext C _ξ (S34).

  As described above, the lost communication system 100 according to the present embodiment is different from the conventional method that achieves general connection possibility, and has a signature method for integer elements and is stronger than the normal security of F-non-forgery. By using a signature scheme with security (a modified version of Waters dual signature), using only a very standard cryptographic assumption called the decision linear assumption, we can realize universal combining possibilities and Proven adaptive lost communication can be realized.

  Next, the lost communication system of the present embodiment will be described in more detail with reference to FIGS. FIG. 3 is a block diagram illustrating a configuration of the system parameter generation unit 11 included in the system parameter generation apparatus 10 of the present embodiment. FIG. 4 is a flowchart showing the operation of the system parameter generation unit 11 provided in the system parameter generation apparatus 10 of this embodiment. FIG. 5 is a block diagram illustrating a configuration of the encrypted database generation unit 21 included in the transmission device 20 of the present embodiment. FIG. 6 is a flowchart showing the operation of the encrypted database generation unit 21 provided in the transmission apparatus 20 of this embodiment. FIG. 7 is a block diagram illustrating a configuration of the request generation unit 31 included in the reception device 30 according to the present embodiment. FIG. 8 is a flowchart showing the operation of the request generation unit 31 provided in the receiving device 30 of this embodiment. FIG. 9 is a block diagram illustrating a configuration of the reply generation unit 24 included in the transmission device 20 of the present embodiment. FIG. 10 is a flowchart showing the operation of the reply generation unit 24 provided in the transmission apparatus 20 of this embodiment. FIG. 11 is a block diagram illustrating a configuration of the document acquisition unit 34 included in the receiving device 30 of this embodiment. FIG. 12 is a flowchart showing the operation of the document acquisition unit 34 provided in the receiving device 30 of this embodiment.

  In the following, description will be made in the order of procedures actually performed. As described above, the lost communication system 100 according to this embodiment includes the system parameter generation device 10, the transmission device 20, and the reception device 30. As described above, the system parameter generation device 10 includes the system parameter generation unit 11 and the crs transmission unit 12. The system parameter generation unit 11 includes a bilinear mapping parameter generation unit 11a, a transmission device parameter generation unit 11b, a reception device parameter generation unit 11c, a first coefficient setting unit 11d, and a system parameter generation unit 11e. .

The bilinear mapping parameter generation means 11a executes the BMSsetup algorithm on the input 1 ^λ , and G and G _T which are cyclic multiplicative groups of λ-bit prime number p and prime order p, bilinear mapping e, group A bilinear mapping parameter Γ: = (p, G, G _T , e, g) composed of a generation source g of G is generated (SS11a).

The system parameter generation unit 11e generates common reference information crs: = (Γ, GS _S , GS _R , g ₁ , g ₂ , ζ) (SS11e). The crs transmission unit 12 transmits the common reference information crs to the transmission device 20 and the reception device 30 (S12).

  As described above, the transmission device 20 includes the encrypted database generation unit 21, the T transmission unit 22, the T storage unit 23, the reply generation unit 24, and the R transmission unit 25. The encrypted database generation unit 21 includes a first Waters key pair generation unit 21a, a second Waters key pair generation unit 21b, a BB key pair generation unit 21c, a secret key generation unit 21d, a public key generation unit 21e, and a second A coefficient setting unit 21f, a first Waters signature generation unit 21g, a second Waters signature generation unit 21h, and a BB signature generation unit 21i are provided.

Encrypted database generating means 21k is to the public key pk, the ciphertext _C 1, ..., and inputs the _{C N,} the encrypted database _{T: = (pk, C 1} , ..., C N) to generate the (SS21k) . The T transmitting unit 22 transmits the encrypted database T to the receiving device 30 (S22). The T storage unit 23 stores the encrypted database T and the secret key sk: = (x ₁ , x ₂ ) (S23).

  As described above, the receiving device 30 includes the request generation unit 31, the Q transmission unit 32, the Q storage unit 33, and the document acquisition unit 34. The request generation unit 31 includes a signature verification unit 31a, a rerandomization unit 31b, a knowledge identification impossible proof generation unit 31c, and a request generation unit 31d.

Signature verifying means 31a is ciphertext _C 1, ..., and _{C N,} and inputs the index xi], ciphertext _C 1, ..., signature Waters dual signature of the signature verification algorithm W. included in _{C N} Vrfy and the signature verification algorithm BB. Verified by running vrfy, ciphertext _C 1, ..., when the signature contained in the _{C N} is correct, and outputs the ciphertext C _xi] corresponding to the index ξ (SS31a).

The Q transmission unit 32 transmits the request Q to the transmission device (S32). The Q storage unit 33 stores the request Q and Q _priv (S33).

The reply generation unit 24 of the transmission device 20 includes knowledge identification impossible proof verification means 24a, blind decoding means 24b, non-interactive zero knowledge proof generation means 24c, and reply generation means 24d. The knowledge identification impossible proof verification unit 24a receives the Groth-Sahai proof knowledge identification impossible proof π and the parameter GS _R as inputs, and the Groth-Sahai proof verification verification algorithm GS. Vrfy (GS _R , π) is executed to verify the knowledge indistinguishable proof π (SS24a).

  The R transmission unit 25 transmits the reply R to the reception device 30 (S25).

  The document acquisition unit 34 of the receiving device 30 includes a zero knowledge proof verification unit 34a and a document generation unit 34b.

The zero-knowledge proof verification means 34a receives the reply R and the parameter GS _S as inputs, and uses the proof verification algorithm GS. The non-interactive zero knowledge proof δ is verified by Vrfy (GS _S , δ) = 1 (SS34a).

  As described above, the lost communication system 100 according to the present embodiment is different from the conventional method that achieves general connection possibility, and has a signature method for integer elements and is stronger than the normal security of F-non-forgery. By using a signature scheme with security (a modified version of Waters dual signature), using only a very standard cryptographic assumption called the decision linear assumption, we can realize universal combining possibilities and Proven adaptive lost communication can be realized.

<Comparison between the present invention and the prior art>
Next, a comparison between the present invention and the prior art will be described with reference to FIGS. FIG. 13 is a table showing the difference between the lost communication system of the present invention and the prior art. FIG. 14 is a diagram showing the difference between the lost communication system of the present invention and the prior art on the coordinate axis. In FIG. 13, reference numbers in this specification are shown in the left corner column. The second column from the left shows abbreviations representing these documents. In addition, UC indicates that the safety satisfies the universal connection possibility. “Full Sim” indicates that safety that is weaker than general connectivity, which is a fully simple safety, is satisfied. The assumption that q- is prefixed, such as the q-hiddenLRSW assumption, is called q assumption in the field of cryptography, and is the standard cryptographic assumption RSA assumption, DDH (decision Differ-Hellman) assumption, DLIN (decision linear). ) The grounds for safety are less reliable than the assumptions.
(Reference 1) [BB04] D. Boneh and X. Boyen. Efficient Selective-ID Secure Identity-
Based Encryption Without RandomOracles.In EUROCRYPT'04, volume 3027 of Lecture Notes in Computer Science, pages 223-238.Springer, 2004.
(Reference 2) [BF01] D. Boneh and MK Franklin. Identity-Based Encryption from the Weil Pairing. In CRYPTO'01, volume 2139 of Lecture Notes in Computer Science, pages 213-229. Springer, 2001.
(Reference 3) [CNS07] J. Camenisch, G. Neven, and A. Shelat. Simulatable Adaptive Oblivious Transfer. In EUROCRYPT'07, volume 4515 of Lecture Notes in Computer Science, pages 573-590. Springer, 2007.
(Reference 4) [CS97] J. Camenisch and M. Stadler. Efficient Group Signature Schemes for Large Groups (ExtendedAbstract). In CRYPTO'97, volume 1294 of Lecture Notes in Computer Science, pages 410-424.Springer, 1997.
(Reference 5) [GH08] M. Green and S. Hohenberger. Universally Composable Adaptive Oblivious Transfer. In ASIACRYPT'08, volume 5350 of Lecture Notes in Computer Science, pages 179-197. Springer, 2008.
(Reference 6) [GH11] M. Green and S. Hohenberger. Practical Adaptive Oblivious Transfer from a Simple Assumption. In TCC'01, volume 6597 of Lecture Notes in Computer Science, pages 347-363 Springer, 2011.http: / /eprint.iacr.org/2010/109.
(Reference 7) [GS08] J. Groth and A. Sahai. Efficient Non-interactive Proof Systems for Bilinear Groups. In EUROCRYPT'08, volume 4965 of Lecture Notes in Computer Science, pages 415-432. Springer, 2008.
(Reference 8) [JL09] S. Jarecki and X. Liu. Efficient Oblivious Pseudorandom Function with Applications to AdaptiveOT and Secure Computation of Set Intersection. In TCC, volume 5444 of Lecture Notes in ComputerScience, pages 577-594. Springer, 2009 .
(Reference 9) [KN09] K. Kurosawa and R. Nojima. Simple Adaptive Oblivious Transfer without Random Oracle. InASIACRYPT'09, volume 5912 of Lecture Notes in Computer Science, pages 334-346. Springer, 2009.
(Reference 10) [KNP10] K. Kurosawa, R. Nojima, and LT Phong. Efficiency-Improved Full Simulatable Adaptive OTunder the DDH Assumption. In SCN, volume 6280 of Lecture Notes in Computer Science, pages 172-181. Springer, 2010 .
(Reference 11) [RKP09] A. Rial, M. Kohlweiss, and B. Preneel. Universally Composable Adaptive Priced ObliviousTransfer. In Pairing, volume 5671 of Lecture Notes in Computer Science, pages 231-247. Springer, 2009.
(Reference 12) [Wat09] B. Waters. Dual System Encryption: Realizing Fully Secure IBE and HIBE under Simple Assumptions. In CRYPTO'09, volume 5677 of Lecture Notes in Computer Science, pages 619-636. Springer, 2009.
<End of comparison between the present invention and the prior art>

<Supplementary information about inventive step>
Linear cryptography: The scheme of the present invention consists of the following linear cryptographic signature. This basic structure is the same in References 5 and 11.

Regarding the inventive step of the present invention: In the present invention, the transmitting device uses the linear encryption method to encrypt the ciphertext.

を生成し，群Ｇの要素である

Is an element of group G

への署名を生成し、これらを受信装置に送信している。そして受信装置はインデックスξを選び、その暗号文に対して再ランダム化を行い、正しく再ランダム化を行ない、それに対応する署名を知っていることを証明する知識識別不可能証明（Ｇｒｏｔｈ−Ｓａｈａｉ証明による）を生成する。しかし、Ｇｒｏｔｈ−Ｓａｈａｉ証明は群要素に関する証明しか生成することができない。ゆえに上記のように（ρ_１やρ_２に対してではなく）

Signatures are generated and transmitted to the receiving device. Then, the receiving device selects the index ξ, re-randomizes the ciphertext, performs re-randomization correctly, and proves that it knows the corresponding signature (Groth-Sahai proof). To generate). However, the Groth-Sahai proof can only generate proofs about group elements. So as above (not for ρ ₁ or ρ ₂ )

に署名する必要がある。つまりメッセージが群Ｇの要素となっているような署名方式が必要と（一見）考えられる。なおこのような署名方式で安全なものは近年になって開発されたばかりであり、提案数自体が少ない上、それらは標準的でない暗号学仮定に基づいており、信頼性が低い。本発明ではＷａｔｅｒｓ双対署名を利用しているが、この方式は群要素に対して署名できない（整数に対して署名可能）。よって，Ｗａｔｅｒｓ双対署名を利用することで適応的紛失通信を構成することは非自明である。しかしこのままではＧｒｏｔｈ−Ｓａｈａｉ証明を利用できないため、Ｗａｔｅｒｓ双対署名を変形し（適応的紛失通信、明細書の暗号文のなかの

Need to sign. In other words, a signature scheme in which a message is an element of group G is necessary (at first glance). Such signature schemes that are secure have only been recently developed, and the number of proposals themselves is small, and they are based on non-standard cryptographic assumptions and are not reliable. Although the present invention uses the Waters dual signature, this method cannot sign group elements (it can sign integers). Therefore, it is not obvious to configure adaptive lost communication by using Waters dual signature. However, since the Groth-Sahai proof cannot be used as it is, the Waters dual signature is modified (adaptive lost communication, ciphertext in the description).

という要素が追加要素である）、通常の署名より高い安全性を達成すること（ρ_１やρ_２に対する署名の偽造ができない、という通常の安全性ではなく、

Is an additional element), achieving higher security than a normal signature (rather than the normal security that signatures for ρ ₁ and ρ ₂ cannot be forged,

に対する署名さえも偽造できない、というより強力な安全性）で、群要素に対して署名ができなくとも、Ｇｒｏｔｈ−Ｓａｈａｉ証明と組み合わせることを可能にした。またＧｒｏｔｈ−Ｓａｈａｉ証明を署名保持の証明に利用するには署名がすべて群要素である必要があるが、Ｗａｔｅｒｓ双対署名の署名は一つだけ群要素でないものが含まれている（明細書のｔａｇ_ｋがそれである）。しかし提案した適応的紛失通信の方式の中では，その群要素でない署名要素はブラインドして相手に直接送ることで

Even if the signature on the group element cannot be forged, it can be combined with the Groth-Sahai certificate. Further, in order to use the Groth-Sahai proof for proof of signature retention, all signatures need to be group elements, but only one signature of Waters dual signature includes one that is not a group element (tag in the specification) _k is that). However, in the proposed adaptive lost communication method, signature elements that are not group elements are blinded and sent directly to the other party.

署名の情報を漏らすことなくＧｒｏｔｈ−Ｓａｈａｉ証明を可能にしている。以上のことから従来の適応的紛失通信方式にＷａｔｅｒｓ双対署名を利用して改良することは非自明であり、本発明は従来技術に対して進歩性を有している。
＜本発明が有する進歩性についての補足おわり＞

Groth-Sahai certification is possible without leaking signature information. From the above, it is not self-evident to improve the conventional adaptive lost communication system using the Waters dual signature, and the present invention has an inventive step over the prior art.
<Supplementary conclusion about the inventive step of the present invention>

<Appendix A: Pairing>
An operation called pairing that satisfies bilinearity is defined at two points on an elliptic curve. Although the group on the elliptic curve is an ordinary additive group, it is described as a multiplicative group according to the convention of the Cryptologic Society. The G and _{G T} the group of order p. Here, p is a sufficiently large prime number. Bilinear map e between the two groups: G × G → G _T satisfies the following properties.
Bilinearity: e (ga, hb) = e (g, h) ^ab for any g, h ^[ epsilon] G and any ^a , ^{b [} epsilon] Z
Is established.
Non-degeneration: g satisfying e (g, g) ≠ 1 exists. That is if g if the generator of G e (g, g) the generator of _{G T.}
Computability: For any g, hεG, e (g, h) can be computed efficiently (ie in polynomial time). For more details, please refer to Chapter 13 of [BF01] and “Invitation to Modern Cryptography (by Atsushi Kurosawa, Science)”.
<Appendix A: End of pairing>

<Appendix B: Digital Signature>
[B1: Waters dual signature]

[B2: (Modified) Boneh-Boyen Signature]

F-signature: Consider a stronger security definition called F-secure against selective message attacks. Let F be a bijection that can be calculated efficiently. Signature scheme

は、以下のゲームによるアドバンテージが無視できるほど小さい場合には、選択メッセージ攻撃下においてＦ−セキュアと呼ばれる。
手順１（セットアップ）：挑戦者は、

Is called F-secure under a selective message attack if the following game advantage is negligibly small.
Step 1 (Setup): Challenger

を発生させてｖｋを敵対者に送る。
手順２（質問）：敵対者はメッセージ

To send vk to the adversary.
Step 2 (question): Adversary message

を挑戦者に送り、挑戦者は

To the challenger,

を返信する。これらの質問はｉ＝１〜Ｎまで適応的に挑戦者に送信される。ここで

Reply. These questions are adaptively sent to the challenger from i = 1 to N. here

を敵対者からの質問であるメッセージのセット

A set of messages that are questions from the adversary

を表すものとする。

.

Procedure 3 (output): The adversary outputs (y ^* , σ ^* ).

を

The

とした場合に、

If

かつ、

And,

が成り立つ場合には、敵対者がゲームに勝利したことになる。
ここで、

If this holds, the adversary has won the game.
here,

を、攻撃者

The attacker

がゲームに勝利する確率と定義して、全てのＰＰＴ攻撃者

Is defined as the probability of winning the game, and all PPT attackers

について、

about,

が成り立つとき、署名スキームＳｉｇは、選択メッセージ攻撃に対するＦ−セキュアである。
＜付録Ｂ：ディジタル署名おわり＞

The signature scheme Sig is F-secure against selective message attacks.
<Appendix B: Digital Signature End>

<Appendix C: Groth-Sahai Proof>
The Groth-Sahai proof system can efficiently perform non-dialogue indistinguishable (NIWI) proof and non-dialogue zero knowledge (NIZK) proof for satisfiability of equations (eg, pairing generation equation). . The certification system is based on the Groth-Sahai commitment scheme.
Groth-Sahai commitment scheme: In this scheme, first, bilinear mapping parameters

を生成する。
ＧＳ．ＣｏｍＳｅｔｕｐ（Γ）：共通参照情報ｃｒｓ_ＧＳＣを出力する。
ＧＳ．Ｃｏｍｍｉｔ（ｃｒｓ_ＧＳＣ，ｍ，ｄ）：コミットｍ∈Ｇである入力ｍ、共通参照情報ｃｒｓ_ＧＳＣ、デコミットメントｄ、として出力コミットメント

Is generated.
GS. ComSetup (Γ): Outputs common reference information crs _GSC .
GS. Commit (crs _GSC , m, d): Output commitment as input m, commit m ∈ G, common reference information crs _GSC , decommitment d

を生成する。
ＧＳ．ＥｘｐＣｏｍ（ｃｒｓ_ＧＳＣ，ｍ，ｂ，ｄ）：入力ｍ∈Ｚ_ｐ、基数ｂ∈Ｇ、共通参照情報ｃｒｓ_ＧＳＣ、デコミットメントｄ、ｃを

Is generated.
GS. ExpCom (crs _GSC , m, b, d): input mεZ _p , radix bεG, common reference information crs _GSC , decommitment d, c

として、出力（ｂ，ｃ）を生成する。
ＧＳ．Ｏｐｅｎｉｎｇ（ｃｒｓ_ＧＳＣ，ｃ，ｍ，ｄ）：ｄが（ｍ，ｃ）に対して正当なデコミットメントである場合、１を出力する。それ以外の場合は、０を出力する。すなわち、

To generate output (b, c).
GS. Opening (crs _GSC , c, m, d): 1 is output when d is a valid decommitment with respect to (m, c). Otherwise, 0 is output. That is,

である。（ｂ，ｃ）がｍの累乗で約束される検証の場合には、

It is. In the case of verification where (b, c) is promised by a power of m,

となる。

It becomes.

  There are two types of products in the common reference information for the Groth-Sahai commitment scheme. In one type, commitment is fully constrained, computationally constrained and extractable. In the other type, commitment is completely confidential, computationally constrained and ambiguous. These two types are computationally indistinguishable. This proof system is supported by cryptographic assumptions such as DLIN assumption (hereinafter, DLIN assumption will be used in this description). Statement S is a variable

と、定数

And a constant

と、Ｇ内の値であるコミットメント

And the commitment that is the value in G

により構成される。ＧｒｏｔｈとＳａｈａｉは、非対話知識証明（ＮＩＰＫ）の構築を以下の式で表した。

Consists of. Groth and Sahai expressed the construction of a non-dialogue knowledge proof (NIPK) with the following equation:

この証明πはコミットメントｃ_１，…，ｃ_ｍ，ｄ_１，…，ｄ_ｎを含む。ＧｒｏｔｈとＳａｈａｉは、これらのコミットメントからペアリング生成式を満足する値

This proof π commitment _{c 1, ..., c m,} d 1, ..., including _{d n.} Groth and Sahai are values that satisfy the pairing generation formula from these commitments.

を開くことのできる効率的なエキストラクタを提供する。ここで、ＣａｍｅｎｉｓｃｈとＳｔａｄｌｅｒ［ＣＳ９７］の記法、例えば、

An efficient extractor that can open Here, the notation of Camenisch and Stadler [CS97], for example,

を用いる。

Is used.

In this system, the prover performs a witness (evidence, group origin) using the same-type commitment scheme and the common reference information CRS. There are two types of common reference information CRS. One type provides a fully constrained commitment scheme and the other type provides a fully confidential commitment scheme. These two types are computationally indistinguishable.
Proof system: The proof system is composed of the following algorithms.
GS. Setup (Γ): Input

を実行して、出力である証明システムの共通参照情報ＧＳを生成する。共通参照情報ＧＳは、コミットメントスキームの共通参照情報ｃｒｓ_ＧＳＣを含む。
ＧＳ：Ｐｒｏｖｅ（ＧＳ，Ｓ，Ｗ）：ステートメントＳと、ｗｉｔｎｅｓｓ（証拠）

To generate the common reference information GS of the proof system as an output. The common reference information GS includes common reference information crs _GSC of the commitment scheme.
GS: Probe (GS, S, W): Statement S and witness (evidence)

とを入力とし、証明πを出力する。
ＧＳ．Ｖｒｆｙ（ＧＳ，π）：証明πを入力とし、照明を検証し、正当であれば１を出力し、それ以外は０を出力する。
ＧＳ．ＥｘｔＳｅｔｕｐ（Γ）：共通参照情報ＧＳ（その分布は通常の共通参照情報と一致する）と、正当なｗｉｔｎｅｓｓを導出するためのトラップドアｔｄ_ｅｘｔとを出力する。
ＧＳ．Ｅｘｔｒａｃｔ（ＧＳ，ｔｄ_ｅｘｔ，π）：証明πと、トラップドアｔｄ_ｅｘｔとを入力とし、各コミットメントＣ_ｉから抽出値

And proof π is output.
GS. Vrfy (GS, π): The proof π is input, the illumination is verified, 1 is output if it is valid, and 0 is output otherwise.
GS. ExtSetup (Γ): Outputs common reference information GS (the distribution of which coincides with normal common reference information) and trapdoor td _ext for deriving a valid witness.
GS. _{Extract (GS, td ext, π} ): certification and π, as input and the trap door _{td ext,} extraction value from each commitment _{C i}

を抽出して等式を満たす証拠

Evidence that satisfies the equation by extracting

を出力する。
ＧＳ．ＳｉｍＳｅｔｕｐ（Γ）：ＧＳ．Ｓｅｔｕｐ（Γ）の出力である通常の共通参照情報と計算量的識別不可能な模擬共通参照情報ＧＳ’と、模擬トラップドアｔｄ_ｓｉｍを出力する。
ＧＳ．ＳｉｍＰｒｏｖｅ（ＧＳ’，ｔｄ_ｓｉｍ，Ｓ）：模擬共通参照情報ＧＳ’と、模擬トラップドアｔｄ_ｓｉｍとを入力とし、ＧＳ．Ｖｒｆｙ（ＧＳ’，π）＝１を満たすステートメントＳの模擬証明πを出力する。
セキュリティ特性：本証明システムは以下の特性を満足する。
正当性：全ての

Is output.
GS. SimSetup (Γ): GS. The normal common reference information that is the output of Setup (Γ), the simulated common reference information GS ′ that cannot be quantitatively distinguished, and the simulated trap door td _sim are output.
GS. SimProbe (GS ′, td _sim , S): The simulated common reference information GS ′ and the simulated trap door td _sim are input, and GS. A simulation proof π of a statement S satisfying Vrfy (GS ′, π) = 1 is output.
Security characteristics: This certification system satisfies the following characteristics.
Justification: All

について、

about,

を満たす。
抽出性：

Meet.
Extractability:

および、証明πについて、

And for proof π

である場合に、

If

はステートメントＳを確率１で満足する。
共通参照情報ＣＲＳの識別不可能性：

Satisfies the statement S with probability 1.
Indistinguishability of common reference information CRS:

と、

When,

について、

about,

を満たす。
構成可能なｗｉｔｎｅｓｓの識別不可能性：全てのＰＰＴ攻撃者

Meet.
Configurable Witness indistinguishability: all PPT attackers

について、

about,

が成立する。
Ｇｒｏｔｈ−Ｓａｈａｉ証明システムは、制限されたステートメントのクラス（Σ_ＺＫはこのクラスを意味する）における構成可能なゼロ知識証明を提供する。
構成可能なゼロ知識：全てのＰＰＴ攻撃者

Is established.
The Groth-Sahai proof system provides a configurable zero knowledge proof in a restricted class of statements (Σ _ZK means this class).
Configurable zero knowledge: all PPT attackers

について、

about,

Is established.
F-Extractable non-dialogue knowledge proof: In the Groth-Sahai proof system, it is possible to extract witness from the non-dialogue knowledge proof (NIWI or NIZK) by using the trapdoor td _ext . However, in this proof system, only the element of the group G can be committed, so that only the element of the group G can be extracted. Therefore, by selecting a message M∈Z _p in the certification system, commit the ^{g m} ∈G, with ^{g m} is The witness, when generating a non-interactive proof, to extract only the ^{g m} (Note that this is not m itself, but the output of the function F (m): = g ^m ). Because of this property, it is said that the Groth-Sahai proof system has F-extractability.
Theorem 2 [GS08]: If the DLIN assumption holds, the Groth-Sahai proof system can be instantiated efficiently.
<Appendix C: End of Groth-Sahai Proof>

<Appendix D: Cryptographic assumptions>

＜付録Ｄ：暗号学的仮定おわり＞

<Appendix D: End of cryptographic assumptions>

  In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

Claims (7)

A lost communication system comprising a system parameter generator, a transmitter, and a receiver,
The system parameter generation device includes:
A bilinear mapping parameter is generated by combining an arbitrary λ-bit prime number with respect to an input 1 ^λ , a cyclic multiplicative group of the prime order, a bilinear mapping, and a generator of the cyclic multiplicative group, and Groth -Sawai proof transmitting device parameters and receiving device parameters are generated, and the bilinear mapping parameters, the transmitting device parameters, the receiving device parameters, the common reference information crs from the first coefficient group set from the generation source A system parameter generator for generating
A crs transmitter that transmits the common reference information crs to a transmitter and a receiver;
The transmitter is
A document (m ₁ ,..., _{M N} ) (N is a positive integer greater than or equal to 2) and the common reference information crs are input to generate a first key pair and a second key pair of a Waters dual signature, and Boneh Generating a third key pair of a Boyen signature, generating a secret key, generating a public key using the first key pair, the second key pair, and the third key pair, and generating a first key of a Waters dual signature A signature and a second signature are generated, and a third signature of a Boneh-Boyen signature is generated, and the document (m ₁ ,..., _{M N} ), a value included in the first key pair, and included in the second key pair Ciphertext C ₁ ,..., _CN are generated using the common value information, the common reference information crs, the first signature, the second signature, and the third signature, and the public key and the ciphertext C ₁ are generated. ,..., _CN and an encrypted database generating unit for generating an encrypted database;
A T transmitter for transmitting the encrypted database to the receiving device;
A T storage unit for storing the encrypted database and the secret key;
The common reference information crs, the encrypted database, the secret key, and the request Q are input, and the knowledge identification impossible proof is verified. If the knowledge identification impossible proof is correct, the secret key and the request Q are used. Blind decryption is performed, a non-interactive zero knowledge proof of Groth-Sahai proof is generated using the encrypted database, the common reference information crs, and the request Q, and a reply R including the non-interactive zero knowledge proof is returned. A reply generator to generate;
An R transmitter that transmits the reply R to the receiving device,
The receiving device is:
And said encrypted database, said common reference information crs, and inputs the index xi], the ciphertext C _1, ..., verifies the signature contained in the C _N, if the signature is correct, corresponding to the index xi] ciphertext C _xi] to, perform re-randomized using the common reference information crs, the ciphertext C _xi], the common reference information crs, using the public key, Groth-Sahai proof of knowledge indistinguishable proof And a request generator that generates the request Q including the knowledge indistinguishable proof, and Q _priv including the request Q and the index ξ.
A Q transmitter that transmits the request Q to the transmitter;
A Q storage unit for storing the request Q and Q _priv ;
When the reply R, the Q _priv , the encrypted database, and the common reference information crs are input, the non-interactive zero knowledge proof is verified, and when the non-interactive zero knowledge proof is correct, the Q _private the ciphertext C _1, ..., lost communication system using C _N, the common reference information crs, characterized in that it comprises a and a document acquisition unit that calculates and outputs a document m _xi] from the cipher text C _xi] . A lost communication system comprising a system parameter generator, a transmitter, and a receiver,
The system parameter generation device includes a system parameter generation unit and a crs transmission unit,
The system parameter generator is
Bilinear mapping that generates a bilinear mapping parameter by combining an arbitrary λ-bit prime number with respect to input 1 ^λ , a cyclic multiplicative group of the prime order, a generator of the cyclic multiplicative group, and a bilinear mapping Parameter generation means;
Transmitter parameter generation means for generating a transmitter parameter by executing a Groth-Sahai proof parameter setting algorithm using the bilinear mapping parameter as input,
Receiving device parameter generation means for generating a receiving device parameter by executing a Groth-Sahai proof parameter setting algorithm using the bilinear mapping parameter as an input;
First coefficient setting means for setting a first coefficient group from the generation source;
System parameter generation means for generating common reference information crs from the bilinear mapping parameter, the transmission device parameter, the reception device parameter, and the first coefficient group,
The crs transmission unit transmits the common reference information crs to a transmission device and a reception device,
The transmission device includes an encrypted database generation unit, a T transmission unit, a T storage unit, a reply generation unit, and an R transmission unit,
The encrypted database generation unit
First Waters key pair generation means for generating a first key pair of Waters dual signature by executing the key generation algorithm of Waters dual signature by using the bilinear mapping parameter as input;
Second Waters key pair generation means for generating a second key pair of Waters dual signature by executing the key generation algorithm of Waters dual signature by using the bilinear mapping parameter as input;
BB key pair generation means for receiving the bilinear mapping parameter and the coefficient set by the secret key generation means as input and executing a key generation algorithm for the Boneh-Boyen signature to generate a third key pair of the Boneh-Boyen signature;
A secret key generating means for generating a secret key and setting a coefficient using the first coefficient group;
Public key generation means for generating a public key using the coefficient set by the secret key generation means, the first key pair, the second key pair, and the third key pair;
Second coefficient setting means for setting a second coefficient group using the coefficient set by the secret key generation means;
First Waters signature generation means for generating a first signature by executing a Waters dual signature signature generation algorithm with the second coefficient group as an input;
Second Waters signature generation means for generating a second signature by executing a Waters dual signature signature generation algorithm with the second coefficient group as an input;
BB signature generation means for generating a third signature by executing a signature generation algorithm of a Boneh-Boyen signature using the second coefficient group as an input;
Document (m ₁ ,..., _{M N} ) (N is a positive integer greater than or equal to 2), a value included in the first key pair, a value included in the second key pair, the first coefficient group, the first coefficient Ciphertext generation means for generating ciphertexts C ₁ ,..., _CN using two coefficient groups, the first signature, the second signature, and the third signature as inputs;
An encrypted database generating means for receiving the public key and the ciphertexts C ₁ ,..., _CN and generating an encrypted database;
The T transmitting unit transmits the encrypted database to the receiving device;
The T storage unit stores the encrypted database and the secret key;
The reply generator is
Knowledge-indistinguishable proof verification that verifies the knowledge-indistinguishable proof by executing a proof-verification algorithm of Groth-Sahai proof by inputting the knowledge-indistinguishable proof of Groth-Sahai proof and the parameters for the receiving device Means,
When the knowledge identification impossible proof is correct, the secret key and the coefficient set by the re-randomizing means are input, and blind decoding means for setting the coefficient;
A non-interactive zero-knowledge proof generation algorithm for Groth-Sahai proof with the coefficients set by the blind decoding means, the public key, the coefficients set by the re-randomizing means, the first coefficient group, and the common reference information crs as inputs. Non-interactive zero knowledge proof generating means for generating non-interactive zero knowledge proof,
Reply generating means for generating a reply R by combining the coefficient set by the blind decoding means and the non-interaction zero knowledge proof,
The R transmitting unit transmits the reply R to the receiving device,
The receiving device includes a request generation unit, a Q transmission unit, a Q storage unit, and a document acquisition unit,
The request generation unit
The ciphertext _C 1, ..., and the _{C N,} and inputs the index xi], the ciphertext _C 1, ..., the signature verification algorithm of the signature Waters dual signature included in _{C N} and the signature verification of the Boneh-Boyen signature verified by running the algorithm, the cipher text C _1, ..., when the signature contained in the C _N is correct, the signature verification means for outputting the ciphertext C _xi] corresponding to the index xi],
Re-randomization means for _{receiving the} ciphertext C _ξ and the first coefficient group and setting coefficients;
The coefficient set by the re-randomizing means, the ciphertext C _ξ , the bilinear mapping, the public key, the first coefficient group, and the receiving device parameters are input, and Groth-Sahai proof. A knowledge indistinguishable proof generating means for generating a knowledge indistinguishable proof of
Request generating means for _receiving the coefficients set by the re-randomizing means, the knowledge identifiable proof, and the index ξ, and generating requests Q and Q _priv ,
The Q transmission unit transmits the request Q to the transmission device,
The Q storage unit stores the request Q and Q _priv ,
The document acquisition unit
Zero knowledge proof verification means for verifying the non-interactive zero knowledge proof by means of a proof verification algorithm of Groth-Sahai proof with the reply R and the parameters for the transmission device as inputs;
Wherein when a non-interactive zero-knowledge proof is correct, and said Q _priv, said first coefficient group, the ciphertext C _1, ..., and C _N, and inputs the coefficients the blind decoding means is generated, the encryption lost communication system comprising: the document generation means for outputting the sentence C _xi] to calculate the document m _xi], a. A lost communication system comprising a system parameter generator, a transmitter, and a receiver,
The system parameter generation device includes a system parameter generation unit and a crs transmission unit,
The system parameter generator is
For an input 1 ^λ , a bilinear mapping parameter Γ: = (p) consisting of G and G _T which are cyclic multiplicative groups of λ-bit prime p, prime order p, bilinear mapping e, and generator g of group G , G, G _T , e, g), bilinear mapping parameter generation means;

System parameter generation means for generating common reference information crs: = (Γ, GS _S , GS _R , g ₁ , g ₂ , ζ),
The crs transmission unit transmits the common reference information crs to a transmission device and a reception device,
The transmission device includes an encrypted database generation unit, a T transmission unit, a T storage unit, a reply generation unit, and an R transmission unit,
The encrypted database generation unit

The public key pk, the ciphertext _C 1, ..., as input and _{C N,} the encrypted database _{T: = (pk, C 1} , ..., C N) and a encrypted database generating means for generating ,
The T transmitting unit transmits the encrypted database T to the receiving device,
The T storage unit stores the encrypted database T and the secret key sk: = (x ₁ , x ₂ ),
The reply generation unit and π knowledge indistinguishable proof Groth-Sahai certificate, the parameter GS and _R as input, Groth-Sahai proof certificate verification algorithm GS. Knowledge identification impossible proof verification means for executing Vrfy (GS _R , π) to verify the knowledge identification impossible proof π;

The R transmitting unit transmits the reply R to the receiving device,
The receiving device includes a request generation unit, a Q transmission unit, a Q storage unit, and a document acquisition unit,
The request generation unit
The ciphertext _C 1, ..., and _{C N,} and inputs the index xi], the ciphertext _C 1, ..., signature Waters dual signature of the signature verification algorithm W. included in _{C N} Vrfy and the signature verification algorithm BB. Verified by running vrfy, the ciphertext C _1, ..., when the signature contained in the C _N is correct, the signature verification means for outputting the ciphertext C _xi] corresponding to the index xi],

The Q transmission unit transmits the request Q to the transmission device,
The Q storage unit stores the request Q and Q _priv ,
The document acquisition unit
Using the reply R and the parameter GS _S as inputs, a proof verification algorithm GS. For Groth-Sahai proof. Zero knowledge proof verification means for verifying the non-interaction zero knowledge proof δ by Vrfy (GS _S , δ) = 1;

Lost communication system characterized by. A lost communication method using a system parameter generator, a transmitter, and a receiver,
The system parameter generation device includes:
A bilinear mapping parameter is generated by combining an arbitrary λ-bit prime number with respect to an input 1 ^λ , a cyclic multiplicative group of the prime order, a bilinear mapping, and a generator of the cyclic multiplicative group, and Groth -Sawai proof transmitting device parameters and receiving device parameters are generated, and the bilinear mapping parameters, the transmitting device parameters, the receiving device parameters, the common reference information crs from the first coefficient group set from the generation source A system parameter generation step for generating
A crs transmission step of transmitting the common reference information crs to a transmission device and a reception device;
The transmitter is
A document (m ₁ ,..., _{M N} ) (N is a positive integer greater than or equal to 2) and the common reference information crs are input to generate a first key pair and a second key pair of a Waters dual signature, and Boneh Generating a third key pair of a Boyen signature, generating a secret key, generating a public key using the first key pair, the second key pair, and the third key pair, and generating a first key of a Waters dual signature A signature and a second signature are generated, and a third signature of a Boneh-Boyen signature is generated, and the document (m ₁ ,..., _{M N} ), a value included in the first key pair, and included in the second key pair Ciphertext C ₁ ,..., _CN are generated using the common value information, the common reference information crs, the first signature, the second signature, and the third signature, and the public key and the ciphertext C ₁ are generated. ,..., _CN and an encrypted database generation step for generating an encrypted database;
T transmitting step of transmitting the encrypted database to the receiving device;
A T storing step for storing the encrypted database and the secret key;
The common reference information crs, the encrypted database, the secret key, and the request Q are input, and the knowledge identification impossible proof is verified. If the knowledge identification impossible proof is correct, the secret key and the request Q are used. Blind decryption is performed, a non-interactive zero knowledge proof of Groth-Sahai proof is generated using the encrypted database, the common reference information crs, and the request Q, and a reply R including the non-interactive zero knowledge proof is returned. A reply generation step to generate;
An R transmission step of transmitting the reply R to the receiving device; and
The receiving device is:
And said encrypted database, said common reference information crs, and inputs the index xi], the ciphertext C _1, ..., verifies the signature contained in the C _N, if the signature is correct, corresponding to the index xi] ciphertext C _xi] to, perform re-randomized using the common reference information crs, the ciphertext C _xi], the common reference information crs, using the public key, Groth-Sahai proof of knowledge indistinguishable proof Generating a request Q including the knowledge indistinguishable proof, and generating a Q _priv including the request Q and an index ξ.
A Q transmission step of transmitting the request Q to the transmission device;
A Q storage step of storing the request Q and Q _priv ;
When the reply R, the Q _priv , the encrypted database, and the common reference information crs are input, the non-interactive zero knowledge proof is verified, and when the non-interactive zero knowledge proof is correct, the Q _private , And a document acquisition step of calculating and outputting a document m _ξ from the ciphertext C _ξ using the ciphertext C ₁ ,..., C _N and common reference information crs. Method. A lost communication method using a system parameter generator, a transmitter, and a receiver,
The system parameter generation device executes a system parameter generation step and a crs transmission step,
The system parameter generation step includes:
Bilinear mapping that generates a bilinear mapping parameter by combining an arbitrary λ-bit prime number with respect to input 1 ^λ , a cyclic multiplicative group of the prime order, a generator of the cyclic multiplicative group, and a bilinear mapping A parameter generation substep;
A transmission device parameter generation sub-step for generating a transmission device parameter by executing a Groth-Sahai proof parameter setting algorithm using the bilinear mapping parameter as an input;
A receiving device parameter generation sub-step for generating a receiving device parameter by executing a Groth-Sahai proof parameter setting algorithm using the bilinear mapping parameter as an input;
A first coefficient setting sub-step for setting a first coefficient group from the generation source;
A system parameter generation sub-step for generating common reference information crs from the bilinear mapping parameter, the transmission device parameter, the reception device parameter, and the first coefficient group;
The crs transmission step transmits the common reference information crs to a transmission device and a reception device,
The transmitter performs an encrypted database generation step, a T transmission step, a T storage step, a reply generation step, and an R transmission step,
The encrypted database generation step includes:
A first Waters key pair generation substep that takes the bilinear mapping parameters as input and executes a Waters dual signature key generation algorithm to generate a Waters dual signature first key pair;
A second Waters key pair generation sub-step that receives the bilinear mapping parameter as input and executes a Waters dual signature key generation algorithm to generate a Waters dual signature second key pair;
BB key pair generation substep of generating a third key pair of a Boneh-Boyen signature by executing the key generation algorithm of the Boneh-Boyen signature by using the bilinear mapping parameter and the coefficient set by the secret key generation substep as inputs When,
A secret key generation sub-step of generating a secret key and setting a coefficient using the first coefficient group;
A public key generation substep for generating a public key using the coefficient set by the secret key generation substep, the first key pair, the second key pair, and the third key pair;
A second coefficient setting sub-step for setting a second coefficient group using the coefficient set by the secret key generation sub-step;
A first Waters signature generation sub-step that receives the second coefficient group as input and executes a signature generation algorithm of a Waters dual signature to generate a first signature;
A second Waters signature generation sub-step that receives the second coefficient group as input and executes a Waters dual signature signature generation algorithm to generate a second signature;
A BB signature generation sub-step for generating a third signature by executing a signature generation algorithm of a Boneh-Boyen signature using the second coefficient group as an input;
Document (m ₁ ,..., _{M N} ) (N is a positive integer greater than or equal to 2), a value included in the first key pair, a value included in the second key pair, the first coefficient group, the first coefficient A ciphertext generation sub-step for generating ciphertexts C ₁ ,..., _CN using two coefficient groups, the first signature, the second signature, and the third signature as inputs;
An encrypted database generation sub-step for receiving the public key and the ciphertexts C ₁ ,..., _CN and generating an encrypted database;
The T transmitting step transmits the encrypted database to the receiving device,
The T storing step stores the encrypted database and the secret key;
The reply generation step includes
Knowledge-indistinguishable proof verification that verifies the knowledge-indistinguishable proof by executing a proof-verification algorithm of Groth-Sahai proof by inputting the knowledge-indistinguishable proof of Groth-Sahai proof and the parameters for the receiving device Substeps,
When the knowledge identifiable proof is correct, the secret key and the coefficient set by the re-randomization sub-step are input, and a blind decryption sub-step for setting a coefficient;
Non-interactive zero-knowledge proof of Groth-Sahai proof using the coefficient set by the blind decoding substep, the public key, the coefficient set by the re-randomization substep, the first coefficient group, and the common reference information crs as inputs A non-interactive zero knowledge proof generation substep for generating a non-interactive zero knowledge proof by executing a generation algorithm;
A reply generation substep for generating a reply R by combining the coefficient set by the blind decoding substep and the non-interactive zero knowledge proof;
The R transmission step transmits the reply R to the receiving device,
The receiving device executes a request generation step, a Q transmission step, a Q storage step, and a document acquisition step,
The request generation step includes:
The ciphertext _C 1, ..., and the _{C N,} and inputs the index xi], the ciphertext _C 1, ..., the signature verification algorithm of the signature Waters dual signature included in _{C N} and the signature verification of the Boneh-Boyen signature verified by running the algorithm, the cipher text C _1, ..., when the signature contained in the C _N is correct, the signature verification substep outputting a ciphertext C _xi] corresponding to the index xi],
A re-randomization sub-step for setting the coefficients by inputting the ciphertext C _ξ and the first coefficient group;
The coefficient set by the re-randomization sub-step, the ciphertext C _ξ , the bilinear mapping, the public key, the first coefficient group, and the receiving device parameter are input, and Groth-Sahai. A knowledge indistinguishable proof generation substep for generating a knowledge indistinguishable proof of the proof;
A request generation substep for generating a request Q, Q _priv using the coefficient set by the rerandomization substep, the knowledge identifiable proof, and the index ξ as inputs;
The Q transmission step transmits the request Q to the transmission device,
The Q storing step stores the request Q and Q _priv ,
The document acquisition step includes:
A zero knowledge proof verification sub-step of inputting the reply R and the parameter for the transmitting device and verifying the non-interactive zero knowledge proof by a proof verification algorithm of Groth-Sahai proof;
When the non-interactive zero knowledge proof is correct, the Q _priv , the first coefficient group, the ciphertext C ₁ ,..., C _N and the coefficient generated by the blind decryption substep are input, lost communication method characterized by having a, a document generation substep of calculating and outputting document m _xi] from the ciphertext C _xi]. A lost communication method using a system parameter generator, a transmitter, and a receiver,
The system parameter generation device executes a system parameter generation step and a crs transmission step,
The system parameter generation step includes:
For an input 1 ^λ , a bilinear mapping parameter Γ: = (p) consisting of G and G _T which are cyclic multiplicative groups of λ-bit prime p, prime order p, bilinear mapping e, and generator g of group G , G, G _T , e, g) to generate bilinear mapping parameter generation substeps;

System parameter generation sub-step for generating common reference information crs: = (Γ, GS _S , GS _R , g ₁ , g ₂ , ζ),
The crs transmission step transmits the common reference information crs to a transmission device and a reception device,
The transmitter performs an encrypted database generation step, a T transmission step, a T storage step, a reply generation step, and an R transmission step,
The encrypted database generation step includes:

The public key pk, the ciphertext _C 1, ..., as input and _{C N,} the encrypted database _{T: = (pk, C 1} , ..., C N) and the encrypted database generation substep of generating, a Have
The T transmitting step transmits the encrypted database T to the receiving device,
The T storing step stores the encrypted database T and the secret key sk: = (x ₁ , x ₂ ),
The reply generation step and π knowledge indistinguishable proof Groth-Sahai certificate, the parameter GS and _R as input, Groth-Sahai proof certificate verification algorithm GS. A knowledge indistinguishable proof verification sub-step of executing Vrfy (GS _R , π) to verify the knowledge indistinguishable proof π;

The R transmission step transmits the reply R to the receiving device,
The receiving device executes a request generation step, a Q transmission step, a Q storage step, and a document acquisition step,
The request generation step includes:
The ciphertext _C 1, ..., and _{C N,} and inputs the index xi], the ciphertext _C 1, ..., signature Waters dual signature of the signature verification algorithm W. included in _{C N} Vrfy and the signature verification algorithm BB. Verified by running vrfy, the ciphertext C _1, ..., when the signature contained in the C _N is correct, the signature verification substep outputting a ciphertext C _xi] corresponding to the index xi],

The Q transmission step transmits the request Q to the transmission device,
The Q storing step stores the request Q and Q _priv ,
The document acquisition step includes:
Using the reply R and the parameter GS _S as inputs, a proof verification algorithm GS. For Groth-Sahai proof. A zero knowledge proof verification sub-step of verifying the non-interactive zero knowledge proof δ by Vrfy (GS _S , δ) = 1;

Lost communication method characterized by.   The program which gives the instruction | command which should perform the lost communication method in any one of Claim 4 to 6 with respect to a computer.

Images