JP2016076759A - Cryptographic system, encryption method, universal re-encryption key generation device and re-encryption key generation device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a proxy re-encryption system, at least one of convenience and safety of which is enhanced.SOLUTION: A universal re-encryption key generation device 700 generates a universal re-encryption key urk, by converting a user private key skso that an original cipher text oct, that can be decrypted by the user private key sk, cannot be decrypted. A re-encryption key generation device 300 generates a re-encryption key rkfor changing the decodable range of a cipher text, that can be decrypted by the user private key sk, and in which the information indicating the decodable range of the cipher text is set, from the universal re-encryption key urk, without using the user private key skand a master secret key msk.SELECTED DRAWING: Figure 1

Description

  The present invention relates to proxy re-encryption (Attribute-Based Proxy Re-Encryption, AB-PRE) in attribute-based encryption.

The agent re-encryption is a system that delegates the authority to decrypt the ciphertext to another person without decrypting the ciphertext. In other words, the agent re-encryption is a system that changes the decryptable range of the ciphertext without decrypting the ciphertext.
Non-Patent Document 1 describes the AB-PRE method. Non-Patent Document 2 describes an attribute-based encryption (Adaptable Attribute-Based Encryption, Ad-PRE) method in which a specific user can arbitrarily change an attribute.

Song Luo, Jianbin Hu, and Zhong Chen “Ciphertext Policy Attribute-Based Proxy Re-encryption” Junzuo Lai and Robert H. et al. Deng and Yanjing Yang and Jiang Weng. “Adaptable Ciphertext-Policy Attribute-Based Encryption”

  In the PRE, the re-encryption key used when changing the ciphertext access range needs to be generated differently for each access range to be changed. In the AB-PRE system described in Non-Patent Document 1, a user's secret key or master secret key is required to generate a re-encryption key. Therefore, every time a re-encryption key is generated, the user must perform processing using the secret key, which is less convenient, or every time a re-encryption key is generated, the master secret key is used. There is a problem that the process must be performed and safety is lowered.

  In the Ad-PRE method described in Non-Patent Document 2, the access range of any ciphertext can be freely changed as long as the entity has a specific high authority. However, since any ciphertext can be changed to any access range, there is a problem in terms of security.

  An object of the present invention is to provide an agent re-encryption method that improves at least one of convenience and security.

An encryption system according to the present invention includes:
A universal re-encryption key generation device that generates a universal re-encryption key by converting the user secret key so that the original ciphertext that can be decrypted by the user private key cannot be decrypted;
A re-encryption key for re-encrypting to change a decryptable range for an original ciphertext that can be decrypted with the user private key, and information indicating a range in which the original ciphertext can be decrypted is set. A re-encryption key generating device that generates the re-encryption key from the universal re-encryption key generated by the universal re-encryption key generating device.

  In the cryptographic system according to the present invention, the re-encryption key generation device generates a re-encryption key from the universal re-encryption key generated by the universal re-encryption key generation device. If the universal re-encryption key generation device generates one universal re-encryption key, the re-encryption key generation device can generate a re-encryption key for each access range to be changed. Therefore, it is possible to improve at least one of convenience and safety.

1 is a configuration diagram of a cryptographic system 10 according to a first embodiment. 2 is a functional configuration diagram of a key generation device 100 according to Embodiment 1. FIG. 2 is a functional configuration diagram of an encryption device 200 according to Embodiment 1. FIG. 2 is a functional configuration diagram of a universal re-encryption key generation apparatus 700 according to Embodiment 1. FIG. 2 is a functional configuration diagram of a re-encryption key generation apparatus 300 according to Embodiment 1. FIG. FIG. 3 is a functional configuration diagram of a re-encryption apparatus 400 according to the first embodiment. [Fig. 3] Fig. 3 is a functional configuration diagram of the decoding device 500 according to the first embodiment. 2 is a functional configuration diagram of a re-ciphertext decryption apparatus 600 according to Embodiment 1. FIG. 5 is a flowchart showing processing of a Setup algorithm according to the first embodiment. 5 is a flowchart showing processing of a KG algorithm according to the first embodiment. 5 is a flowchart showing processing of an Enc algorithm according to the first embodiment. 5 is a flowchart showing processing of a URKG algorithm according to the first embodiment. 4 is a flowchart showing processing of an RKG algorithm according to the first embodiment. 5 is a flowchart showing processing of a REnc algorithm according to the first embodiment. 5 is a flowchart showing processing of a Dec _Enc algorithm according to the first embodiment. 5 is a flowchart showing processing of a Dec _ReEnc algorithm according to the first embodiment. The key generation device 100, the encryption device 200, the re-encryption key generation device 300, the re-encryption device 400, the decryption device 500, the re-ciphertext decryption device 600, the universal re-generation described in the first embodiment. The figure which shows the example of a hardware constitution with the encryption key generation apparatus 700.

Ａが集合であるとき、数１０２は、Ａからｙを一様に選択することを表す。つまり、数１０２において、ｙは一様乱数である。

数１０３は、ｙにｚが設定されたこと、ｙがｚにより定義されたこと、又はｙがｚを代入されたことを表す。

ａが定数であるとき、数１０４は、機械（アルゴリズム）Ａが入力ｘに対しａを出力することを表す。

数１０５は、位数ｐの群を表す。

数１０６は、群Ｚ_ｐにおけるベクトル表現を表す。

Embodiment 1 FIG.
*** Explanation of notation ***
The notation in the following description will be described.
When A is a random value or distribution, Equation 101 represents selecting y from A randomly according to the distribution of A. That is, in Equation 101, y is a random number.

When A is a set, Equation 102 represents selecting y from A uniformly. That is, in Equation 102, y is a uniform random number.

Expression 103 indicates that z is set in y, y is defined by z, or y is substituted with z.

When a is a constant, the number 104 represents that the machine (algorithm) A outputs a for the input x.

Equation 105 represents a group of order p.

The number 106 denotes a vector representation in the group _{Z p.}

*** Explanation of basic concepts ***
<Bilinear map>
Symmetric bilinear pairing groups (p, _G, G T, g, e) is a prime number p, a cyclic additive group G of order p, and a cyclic multiplicative group _{G T} of order p, g ≠ 0∈G If, nondegenerate bilinear pairing that can be calculated in polynomial time e: a set of a G × G → G _T. Non-degenerate bilinear pairing is e (sg, tg) = e (g, g) ^st and e (g, g) ≠ 1.

<Access structure>
In the AB-PRE system described below, a monotone access structure is used.

{P ₁ ,. . . , P _n } is a set of users. User's collective family FＰ2 ^{{P1,. . . , Pn}} and any user set P _i and set P _j , if P _i εF and P _i ⊆P _j, then if P _j εF, then the user set family F is monotone. Here, F 2 ^{{P1,. . . , Pn}} of {P1,. . . , Pn} is {P ₁ ,. . . , P _n }.

  In addition to the set family F being monotone, if the set family F does not contain an empty set as an element, the set family F constitutes a monotone access structure. A set in the set family F is called a qualified set.

  In ABE, an attribute is represented by a set of users. That is, the access structure F is composed of a qualified set of attributes.

<Linear secret sharing method>
When the conditions 1 and 2 are satisfied, the secret sharing scheme is linear on the group Z _p under the set family F. That is, the linear secret sharing method.
Condition 1: shared information assigned to each of the sets Group F is formed by the vector on the group Z _p. Therefore, the shared information is called a share vector.
Condition 2: For the secret sharing scheme, there exists an L-row r-column matrix M called a shared generator matrix. i = 1,. . . , L for each integer i, a set ρ of an index ρ (i) that assigns a set of the set family F to the i-th row of the matrix M, and a vector v ^→ = (s, r ₂ ,. r _L ) is set. Here, the secret value sεZ _p and the random value r ₂ ,. . . , R _L εZ _p . And Mv ^→ = {M ₁ v ^→ ,. . . , M _L v ^→ } are L share vectors of the secret value s of the secret sharing scheme. The share vector M _i v ^→ corresponds to the index ρ (i).

The access structure F is a set of the matrix M described above and the index set ρ. That is, F = (M, ρ).
Suppose that the secret sharing scheme is LSSS under the access structure F = (M, ρ). Then, an arbitrary qualified set S∈F, and I⊂ {1, 2,. . . , L} is I = {i: ρ (i) εS}. If {λ _i = M _i v ^→ } _iεI is a set of correct share vectors of the secret value s according to the secret sharing _{scheme 定 数} , a constant {Σ _iεI ω _i · λ _i = s { there are ω _i ∈Z _{p} i∈I.} The constant {ω _i εZ _p } can be calculated in polynomial time for the size of the matrix M.

*** Explanation of configuration ***
In the first embodiment, an AB-PRE scheme for ciphertext policies will be described. The ciphertext policy means that the policy is embedded in the ciphertext, that is, the access structure F is embedded.

A basic configuration of the AB-PRE method will be described.
The AB-PRE scheme is an encryption method including eight algorithms: Setup, KG, URKG, RKG, Enc, REnc, Dec _Enc , and Dec _ReEnc .

(Setup: Setup process)
The Setup algorithm is a probabilistic algorithm that outputs the public key pk, the master secret key msk, and the re-encrypted secret key rsk with the attribute U and the security parameter 1 ^λ as inputs.

(KG: Key generation process)
The KG algorithm is a probabilistic algorithm that outputs a user secret key sk _S with a public key pk, a master secret key msk, and a qualified set S of attributes as inputs.

(Enc: encryption process)
The Enc algorithm is a probabilistic algorithm that outputs the original ciphertext oct _F with the public key pk, the access structure F, and the message m as inputs.

(URKG: Universal encryption key generation process)
The URKG algorithm is a stochastic algorithm that receives a public key pk and a user secret key sk _S and outputs a universal re-encryption key urk _S.

(RKG: Re-encryption key generation process)
The RKG algorithm uses a public key pk, a universal re-encryption key urk _S , a re-encryption secret key rsk, and an access structure F ′ as inputs, and outputs a re-encryption key rk _{S → F ′.} It is.

(REnc: re-encryption process)
The REnc algorithm is a probabilistic algorithm that receives the public key pk, the re-encryption key rk _{S → F ′,} and the original cipher text oct _F , and outputs the re-cipher text rct _{F ′} .

(Dec _Enc : Decoding process)
The Dec _Enc algorithm is a deterministic algorithm that receives the public key pk, the user secret key sk _S, and the original ciphertext oct _F and outputs a message m or a symbol 表 す representing a decryption failure.

(Dec _ReEnc : Re-ciphertext decryption step)
The Dec _ReEnc algorithm is a deterministic algorithm that outputs a message m or a symbol 表 す indicating a decryption failure with the public key pk, the user secret key sk _{S ′,} and the re-ciphertext rct _{F ′} as inputs.

FIG. 1 is a configuration diagram of an encryption system 10 according to the first embodiment.
The encryption system 10 includes a key generation device 100, an encryption device 200, a re-encryption key generation device 300, a re-encryption device 400, a decryption device 500, and a re-ciphertext decryption device 600. The key generation apparatus 100 includes a universal re-encryption key generation apparatus 700.
Here, the device used by the user having the qualified set S of attributes is the decryption device 500, and the device used by the user having the qualified set S 'of attributes is the re-ciphertext decryption device 600.

The key generation device 100 receives the attribute U and the security parameter 1 ^λ and executes the Setup algorithm to generate a public key pk, a master secret key msk, and a re-encrypted secret key rsk. Further, the key generation device 100 receives the public key pk, the master secret key msk, and the qualified set S of user attributes, and executes the KG algorithm to set the qualified set S of attributes. A secret key sk _S is generated. Similarly, the key generation device 100 inputs the public key pk, the master secret key msk, and the user attribute qualified set S ′, and executes the KG algorithm to set the attribute qualified set S ′. The generated user secret key sk _{S ′} is generated.
Then, the key generation device 100 discloses the public key pk. Further, the key generation device 100 secretly outputs the user secret key sk _S to the decryption device 500 and the universal re-encryption key generation device 700, and the key generation device 100 re-encrypts the user secret key sk _{S ′.} Secretly output to the sentence decryption apparatus 600. Further, the key generation device 100 secretly outputs the re-encryption secret key rsk to the re-encryption key generation device 300.
Note that the Setup algorithm is executed only once when the cryptographic system 10 is set up. Thereafter, the Setup algorithm is executed when, for example, at least one of the public key pk, the master secret key msk, and the re-encryption secret key rsk needs to be changed. The KG algorithm is executed every time a user secret key for each user is generated.

The encryption device 200 receives the public key pk, the access structure F, and the message m, executes the Enc algorithm, sets the access structure F as information indicating a decryptable range, and encrypts the message m The original ciphertext oct _F is generated. The encryption device 200 outputs the original ciphertext oct _F to the re-encryption device 400 and the decryption device 500.

The universal re-encryption key generation apparatus 700 receives the public key pk and the user secret key sk _S and executes the URKG algorithm so that the ciphertext decryptable with the user secret key sk _S cannot be decrypted. The key sk _S is converted to generate a universal re-encryption key urk _S. The universal re-encryption key generation device 700 secretly outputs the universal re-encryption key urk _S to the re-encryption key generation device 300.

The re-encryption key generation apparatus 300 receives the public key pk, the universal re-encryption key urk _S , the re-encryption secret key rsk, and the access structure F ′, and executes the RKG algorithm to re-encrypt. A key rk _{S → F ′} is generated. The re-encryption key rk _{S → F ′} generated here changes the decryptable range of the ciphertext oct _F that can be decrypted with the user secret key sk _S used when generating the universal re-encryption key urk _S. The access structure F ′ is set as information indicating the decryptable range. The re-encryption key generation apparatus 300 outputs the re-encryption key rk _{S → F ′} to the re-encryption apparatus 400.

The re-encryption apparatus 400 receives the public key pk, the re-encryption key rk _{S → F ′,} and the original ciphertext oct _F , executes the REnc algorithm, and performs the decryption set in the original ciphertext oct _F Information indicating a possible range is changed from the access structure F to the access structure _{F ′} to generate a re-ciphertext rct _{F ′} . The re-encryption device 400 outputs the re-ciphertext rct _{F ′} to the re-ciphertext decryption device 600.

The decryption apparatus 500 receives the public key pk, the user secret key sk _S, and the original ciphertext oct _F , executes the Dec _Enc algorithm, and outputs a message m or a symbol 表 す indicating decryption failure.

The re-ciphertext decryption apparatus 600 receives the public key pk, the user secret key sk _{S ′,} and the re-ciphertext rct _{F ′} as input, executes the Dec _ReEnc algorithm, and _displays the message m or a symbol indicating decryption failure Output ⊥.

FIG. 2 is a functional configuration diagram of the key generation device 100 according to the first embodiment.
The key generation device 100 includes an information acquisition unit 110, a master key generation unit 120, a master key storage unit 130, a user secret key generation unit 140, and a key output unit 150.
Further, as described above, the key generation apparatus 100 includes the universal re-encryption key generation apparatus 700. The configuration of universal re-encryption key generation apparatus 700 will be described later.

The information acquisition unit 110 includes an attribute U, a security parameter 1 ^λ, and a qualified set S of attributes input by an administrator of the cryptographic system 10, a public key pk and a master secret key msk stored in the master key storage unit 130. To get. The information acquisition unit 110 includes a security parameter acquisition unit 111, an attribute category acquisition unit 112, a master key acquisition unit 113, and a qualified set acquisition unit 114 as functions for acquiring each information.

The master key generation unit 120 generates a public key pk, a master secret key msk, and a re-encryption secret key rsk using the security parameter 1 ^λ acquired by the information acquisition unit 110 and the attribute U. The master key generation unit 120 includes a mapping generation unit 121, a parameter generation unit 122, an access structure generation unit 123, an encoding function generation unit 124, and a key element generation unit 125.

  The master key storage unit 130 stores the public key pk generated by the master key generation unit 120, the master secret key msk, and the re-encryption secret key rsk.

The user secret key generation unit 140 uses the attribute qualified set S acquired by the information acquisition unit 110, the public key pk, and the master secret key msk to obtain the user secret key sk _S including the attribute qualified set S. Generate. The user secret key generation unit 140 includes an attribute set determination unit 141, a random number generation unit 142, and a key element generation unit 143.

The key output unit 150 publishes the public key pk generated by the master key generation unit 120, for example, by outputting it to a public server. In addition, the key output unit 150 outputs the re-encryption secret key rsk generated by the master key generation unit 120 to the re-encryption key generation apparatus 300. In addition, the key output unit 150 outputs the user secret key sk _S generated by the user secret key generation unit 140 to the decryption device 500 and the universal re-encryption key generation device 700. To output is to transmit via a network, for example.

FIG. 3 is a functional configuration diagram of the encryption device 200 according to the first embodiment.
The encryption device 200 includes an information acquisition unit 210, a ciphertext generation unit 220, and a ciphertext output unit 230.

  The information acquisition unit 210 acquires the public key pk generated by the key generation device 100, the message m and the access structure F input by the user of the encryption device 200. The information acquisition unit 210 includes a public key acquisition unit 211, a message acquisition unit 212, and an access structure acquisition unit 213 as functions for acquiring each information.

The ciphertext generation unit 220 encrypts the message m using the public key pk acquired by the information acquisition unit 210 and the access structure F, and encrypts elements C ₀ , C ₁ , C _{2 of the} original ciphertext oct _{F. i} and D _i are generated. The ciphertext generation unit 220 includes a random vector generation unit 221, a random number generation unit 222, and an encryption element generation unit 223.

The ciphertext output unit 230 includes the access structure F acquired by the information acquisition unit 210 and the cipher elements C ₀ , C ₁ , C ₂ generated by the ciphertext generation unit 220 _{. The} original ciphertext oct _F including _i and D _i is output to the decryption device 500 and the re-encryption device 400. To output is to transmit via a network, for example.

FIG. 4 is a functional configuration diagram of universal re-encryption key generation apparatus 700 according to Embodiment 1.
The universal re-encryption key generation apparatus 700 includes an information acquisition unit 710, a universal re-encryption key generation unit 720, and a universal re-encryption key output unit 730.

The information acquisition unit 710 acquires the public key pk generated by the key generation device 100 and the user secret key sk _S. The information acquisition unit 710 includes a public key acquisition unit 711 and a user secret key acquisition unit 712 as functions for acquiring each information.

The universal re-encryption key generation unit 720 uses the public key pk acquired by the information acquisition unit 710 and the user secret key sk _S, and the converted user secret key sk _d that is an element of the universal re-encryption key urk _S. : = (RK ₀ , RK ₁ , RK _2.i ) and parameter ciphertext ct _{dF ^} : = (RC ^ ₀ , RC ^ ₁ , RC ^ _2.i , RD ^ _i ). The universal re-encryption key generation unit 720 includes a random number generation unit 721, a decryption key conversion unit 722, a random vector generation unit 723, and a parameter encryption unit 724.

The universal re-encryption key output unit 730 includes a qualified set S of attributes included in the user secret key sk _S acquired by the information acquisition unit 710, and the converted user secret generated by the universal re-encryption key generation unit 720. The universal re-encryption key urk _S including the key sk _d and the parameter ciphertext ct _{dF ^} is output to the re-encryption key generation apparatus 300. To output is to transmit via a network, for example.

FIG. 5 is a functional configuration diagram of the re-encryption key generation apparatus 300 according to the first embodiment.
The re-encryption key generation apparatus 300 includes an information acquisition unit 310, a re-encryption key generation unit 320, and a re-encryption key output unit 330.

The information acquisition unit 310 includes a public key pk and a re-encryption secret key rsk generated by the key generation device 100, a universal re-encryption key uruk _S generated by the universal re-encryption key generation device 700, and a user secret key. An access structure F ′ input by a user or the like using sk _S is acquired. The information acquisition unit 310 includes a public key acquisition unit 311, a universal re-encryption key acquisition unit 312, and an access structure acquisition unit 313 as functions for acquiring each information.

The re-encryption key generation unit 320 uses the public key pk, the re-encryption secret key rsk, the universal re-encryption key urk _S, and the access structure F ′ acquired by the information acquisition unit 310 to re-encrypt the key rk. _A converted ciphertext ct _{dF ′} : = (RC ^ ′ ₀ , RC ^ ′ ₁ , RC ^ ′ _2.i , RD ^ ′ _i ) that is an element of _{S → F ′} is generated. The re-encryption key generation unit 320 includes a random vector generation unit 321, a random number generation unit 322, and an attribute setting unit 323.

The re-encryption key output unit 330 includes a qualified set S of attributes included in the universal re-encryption key uruk _S acquired by the information acquisition unit 310, the access structure F ′ acquired by the information acquisition unit 310, The re-encryption key rk _{S → F ′} including the converted cipher text ct _dF generated by the encryption key generation unit 320 is output to the re-encryption device 400. To output is to transmit via a network, for example.

FIG. 6 is a functional configuration diagram of the re-encryption apparatus 400 according to the first embodiment.
The re-encryption device 400 includes an information acquisition unit 410, a re-encryption determination unit 420, a re-encryption unit 430, and a re-ciphertext output unit 440.

The information acquisition unit 410 includes the public key pk generated by the key generation device 100, the re-encryption key rk _{S → F ′} generated by the re-encryption key generation device 300, and the original generated by the encryption device 200. The ciphertext oct _F is acquired. The information acquisition unit 410 includes a public key acquisition unit 411, a re-encryption key acquisition unit 412, and an original ciphertext acquisition unit 413 as functions for acquiring each information.

The re-encryption determination unit 420 adds the attribute set S included in the re-encryption key rk _{S → F ′} acquired by the information acquisition unit 410 and the original ciphertext oct _F acquired by the information acquisition unit 410. Based on the access structure F included, it is determined whether re-encryption is possible.

When the re-encryption determination unit 420 determines that re-encryption is possible, the re-encryption unit 430 includes the public key pk acquired by the information acquisition unit 410, the re-encryption key rk _{S → F ′,} and the original Using the ciphertext oct _F , decryption information dec _d = ReC ₁ that is an element of the re-ciphertext rct _{F ′} is generated. The re-encryption unit 430 includes a constant calculation unit 431 and a pairing calculation unit 432.

The re-ciphertext output unit 440 includes the access structure F ′ and the converted ciphertext ct _dF included in the re-encryption key rk _{S → F ′} acquired by the information acquisition unit 410 and the ciphertext included in the original ciphertext oct _F. The re-ciphertext rct _{F ′} including the element ReC ₀ = C ₀ and the converted user secret key sk _d generated by the re-encryption unit 430 is output to the re-ciphertext decryption apparatus 600. To output is to transmit via a network, for example.

FIG. 7 is a functional configuration diagram of the decoding device 500 according to the first embodiment.
The decryption device 500 includes an information acquisition unit 510, a ciphertext determination unit 520, a decryption unit 530, and a result output unit 540.

The information acquisition unit 510 acquires the public key pk and the user secret key sk _S generated by the key generation device 100 and the original ciphertext oct _F generated by the encryption device 200. The information acquisition unit 510 includes a public key acquisition unit 511, a user secret key acquisition unit 512, and an original ciphertext acquisition unit 513 as functions for acquiring each information.

The ciphertext determination unit 520 includes the qualified set S of attributes included in the user secret key sk _S acquired by the information acquisition unit 510 and the access structure F included in the original ciphertext oct _F acquired by the information acquisition unit 510. Based on the above, it is determined whether decoding is possible.

When the ciphertext determination unit 520 determines that the decryption is possible, the decryption unit 530 is acquired by the information acquisition unit 510 using the public key pk and the user secret key sk _S acquired by the information acquisition unit 510. The original ciphertext oct _F is decrypted to generate a message m. The decryption unit 530 includes a constant calculation unit 531 and a pairing calculation unit 532.

  When the ciphertext determination unit 520 determines that the decryption is possible, the result output unit 540 outputs the message m decrypted by the decryption unit 530. When the ciphertext determination unit 520 determines that decryption is impossible, the result output unit 540 outputs a symbol 表 す indicating decryption failure. To output is to display on a display device, for example.

FIG. 8 is a functional configuration diagram of re-ciphertext decryption apparatus 600 according to Embodiment 1.
The re-ciphertext decryption apparatus 600 includes an information acquisition unit 610, a ciphertext determination unit 620, a decryption unit 630, and a result output unit 640.

The information acquisition unit 610 acquires the public key pk and user secret key sk _{S ′} generated by the key generation device 100 and the re-ciphertext rct _{F ′} generated by the re-encryption device 400. The information acquisition unit 610 includes a public key acquisition unit 611, a user secret key acquisition unit 612, and a re-ciphertext acquisition unit 613 as functions for acquiring each information.

The ciphertext determination unit 620 is included in the qualified set S ′ of attributes included in the user secret key sk _{S ′} acquired by the information acquisition unit 610 and the re-ciphertext rct _{F ′} acquired by the information acquisition unit 610. It is determined whether decoding is possible based on the access structure F ′.

When the ciphertext determination unit 620 determines that the decryption is possible, the decryption unit 630 uses the public key pk acquired by the information acquisition unit 610 and the user secret key sk _{S ′,} and the information acquisition unit 510 The acquired re-ciphertext rct _{F ′} is decrypted. The decoding unit 630 includes a constant calculation unit 631, a pairing calculation unit 632, a decoding unit 633, and a message calculation unit 634.

  When the ciphertext determination unit 620 determines that decryption is possible, the result output unit 640 outputs the message m decrypted by the decryption unit 630. When the ciphertext determination unit 620 determines that decryption is impossible, the result output unit 640 outputs a symbol 表 す indicating decryption failure. To output is to display on a display device, for example.

*** Explanation of operation ***
FIG. 9 is a flowchart showing the process of the Setup algorithm.
The Setup algorithm is executed by the key generation device 100 shown in FIG.

(S101: Information acquisition process)
The security parameter acquisition unit 111 acquires the security parameter 1 ^λ input from the input device by the administrator of the cryptographic system 10 or the like.
The attribute category acquisition unit 112 uses the attributes U = {1, 2,. . . , | U |}. The attribute U is information indicating an attribute category such as, for example, a department, a department, or an employee ID.

(S102: Mapping generation process)
The mapping generation unit 121 receives the security parameter 1 ^λ acquired in S101 and generates a parameter param _G : = (p, G, G _T , g, e) of the bilinear pairing group. Here, a cyclic additive group G and a cyclic multiplicative group G _T is the remainder group of order p.

(S103: Parameter generation processing)
The parameter generation unit 122 generates a parameter represented by Formula 107 by the processing device.

(S104: access structure generation process)
Access structure generating unit 123, by the processing device, the access structure authorized set S of attributes that satisfy the access structure ^{F ~} absence ^{F ~ = (M ~, ρ} ~) to generate. Here, the matrix ^{M ~} included in the access structure ^{F ~} is a matrix of ^{L ~} row ^{r ~} column.
The access structure F ^1- is used so that a parameter d described later is not extracted from the universal re-encryption key urk _S by an irregular procedure. When a qualified set of attributes S ^* exists to meet the access structure F ^~, if you use the user secret key sk S _* generated from the qualified set S ^*, to take out the parameter d from universal re-encryption key urk _S Will be possible. Therefore, it is necessary to generate an access structure F ^~ to the authorized set S of attributes that satisfy the access structure F ^~ is not present.

(S105: Encoding function generation process)
Encoding function generator 124, the processing unit, a member of the group Z _p of order p, and generates an encoding function E that converts into elements of a cyclic multiplicative group G _T.

マスター鍵記憶部１３０は、Ｓ１０６で生成された公開鍵ｐｋとマスター秘密鍵ｍｓｋと再暗号化秘密鍵ｒｓｋとを記憶装置に記憶する。 (S106: Key generation processing)
The key element generator 125, the processing device, and the parameter param _G generated bilinear pairing groups in S102, the parameter generated in S103, the access structure ^{F ~} generated in S104, is generated in S105 Using the encoding function E, the public key pk shown in Equation 108, the master secret key msk shown in Equation 109, and the re-encrypted secret key rsk shown in Equation 110 are generated.

The master key storage unit 130 stores the public key pk, the master secret key msk, and the re-encrypted secret key rsk generated in S106 in the storage device.

(S107: Key output process)
The key output unit 150 publishes the public key pk, for example, by outputting the public key pk to a public server via a network.
Also, the key output unit 150 secretly outputs the re-encrypted secret key rsk to the re-encrypted key generation apparatus 300 via the network. The secret output means, for example, that the re-encryption secret key rsk is encrypted by another encryption method and transmitted to the re-encryption key generation apparatus 300. Of course, the present invention is not limited to this, and the re-encrypted secret key rsk may be output to the re-encrypted key generation apparatus 300 by another method that does not leak to a third party.

FIG. 10 is a flowchart showing processing of the KG algorithm according to the first embodiment.
The KG algorithm is executed by the key generation device 100 shown in FIG.

(S201: Information acquisition process)
The master key acquisition unit 113 acquires the public key pk and the master secret key msk generated by the Setup algorithm.
The qualified set acquisition unit 114 acquires the qualified set S of the attributes of the user using the user secret key, which is input by the administrator of the encryption system 10 using the input device. The qualified set S of user attributes is information representing the attributes of the user. For example, when the attribute U input in S101 represents an attribute category of belonging department, belonging department, and employee ID, the attribute qualified set S is information representing the user's belonging department, belonging department, and employee ID.

(S202: attribute set determination processing)
Attribute set determining unit 141, the processing device determines the authorized set S of attributes acquired in step S201 is, whether they meet the access structure F ^~ included in the public key pk.
The specific method of determination is different depending on the access structure F ^~ design. However, when I = {i: ρ (i) εS} described in the explanation of the linear secret sharing method, a constant {ω _i εZ _p } that satisfies Σ _iεI ω _i · λ _i = s _This can be determined by determining whether _iεI exists.
If the authorized set S of attributes do not meet the access structure F ^~, the process proceeds to S203, if the authorized set S of attributes to meet the access structure F ^~, the process ends.

Further, in S104, and it generates an access structure F ^~ to the authorized set S of attributes that satisfy the access structure F ^~ is not present. Therefore, in principle, since the authorized set S of attributes entered in S201 does not satisfy the access structure F ^~, this processing may be omitted.

(S203: random number generation processing)
The random number generation unit 142 generates a random number represented by Formula 111 by the processing device.

(S204: Key element generation processing)
The key element generation unit 143 uses the public key pk, master secret key sk, and attribute qualified set S acquired in S201, and the random number generated in S203, and the key element shown in Expression 112 K ₀ , K ₁ , K _{2. i} , K ^ ₀ , K ^ ₁ , K ^ _{2. i} is generated.

Key elements K ₀ , K ₁ , K2 _{. i} is an element used to decrypt the original ciphertext. On the other hand, the key elements K ^ ₀ , K ^ ₁ , K ^ _{2. i} is an element used to decrypt the re-ciphertext.
Key element K2 _{. i} and key element K ^ _{2. In i} , a qualified set S of attributes which are attribute information of users who use the user secret key is set. That is, the attribute qualification set S that is the attribute information of the user who uses the user secret key is included in both the element used for decrypting the original ciphertext and the element used for decrypting the reciphertext. Is set.

(S205: Key output processing)
The key output unit 150 includes the qualified set S of attributes acquired in S201 and the key elements K ₀ , K ₁ , K ₂ generated in S204 _{. i} , K ^ ₀ , K ^ ₁ , K ^ _{2. The} user secret key sk _S including _i is secretly output to the decryption apparatus 500 via the network.

Here, the case where the user secret key sk _S is generated has been described. However, the user secret key sk _{S ′} is also generated in the same manner as the user secret key sk _S.
When generating the user secret key sk _{S ′} , a qualified set S ′ of attributes is input in S 201, and key elements K ′ ₀ , K ′ ₁ , K ′ in S 204 _{. i} , K ^ ' ₀ , K ^' ₁ , K ^ ' _{2. i} is generated. In S205, the attribute qualified set S ′ and the key elements K ′ ₀ , K ′ ₁ , K′2 _{. i} , K ^ ' ₀ , K ^' ₁ , K ^ ' _{2. The} user secret key sk _{S ′} including _i is secretly output to the re-ciphertext decryption apparatus 600 via the network.

FIG. 11 is a flowchart showing processing of the Enc algorithm according to the first embodiment.
The Enc algorithm is executed by the encryption device 200 shown in FIG.
(S301: Information acquisition process)
The public key acquisition unit 211 acquires the public key pk generated by the Setup algorithm.
The message acquisition unit 212 acquires the message m to be encrypted input by the user of the encryption device 200 using the input device.
The access structure acquisition unit 213 acquires an access structure F = (M, ρ) indicating a range in which the original ciphertext oct _F can be decrypted, which is input by the user of the encryption apparatus 200 using the input device. Here, the matrix M included in the access structure F is a matrix of L rows and r columns.

(S302: random vector generation process)
The random vector generation unit 221 randomly generates a vector v = (s, v ₂ ,..., V _r ) εZ _p ^r by the processing device. Here, the leading element s of the vector v is a random number that is a secret value, and the remaining elements v ₂ ,. . . , _Vr are random numbers having no particular meaning. ^R in Z _p ^r means that the number of elements of the vector is r.

(S303: random number generation processing)
The random number generation unit 222 generates a random number represented by Expression 113 by the processing device.

(S304: Encryption element generation processing)
The cryptographic element generation unit 223 uses the public key pk, the message m, and the access structure F acquired in S301, the vector v generated in S302, and the random number generated in S303 by the processing device. 2. Cryptographic elements C ₀ , C ₁ , C _{2. i} and D _i are generated.

Cryptographic element C2 _{. In i} , an access structure F which is attribute information indicating a range in which the original ciphertext oct _F can be decrypted is set.

(S305: Ciphertext output processing)
The ciphertext output unit 230 includes the access structure F acquired in S301 and the cipher elements C ₀ , C ₁ , C ₂ generated in S304 _{. The} original ciphertext oct _F including _i and D _i is secretly output to the decryption device 500 and the re-encryption device 400 via the network.

FIG. 12 is a flowchart showing processing of the URKG algorithm according to the first embodiment.
The URKG algorithm is executed by the universal re-encryption key generation apparatus 700 shown in FIG.

(S401: Information acquisition process)
The public key acquisition unit 711 acquires the public key pk generated by the Setup algorithm. The user secret key acquisition unit 712 acquires the user secret key sk _S generated by the KG algorithm.

(S402: Parameter d generation processing)
The random number generation unit 721 generates a parameter d that is a random number represented by Formula 115 by the processing device.

つまり、復号鍵変換部７２２は、パラメータｄでユーザ秘密鍵ｓｋ_Ｓを変換して、変換後ユーザ秘密鍵ｓｋ_ｄを生成する。ここで、パラメータｄは乱数であるため、ユーザ秘密鍵ｓｋ_Ｓがランダム化されて、変換後ユーザ秘密鍵ｓｋ_ｄが生成されている。 (S403: Decryption key conversion process)
The decryption key conversion unit 722 uses the public key pk and the user secret key sk _S acquired in S401 and the parameter d generated in S402 by the processing device, and the converted user secret key sk _d shown in Expression 116. Key elements RK ₀ , RK ₁ , RK2 _{. i} is generated.

That is, the decryption key conversion unit 722 converts the user secret key sk _S using the parameter d, and generates a converted user secret key sk _d . Here, since the parameter d is a random number, the user secret key sk _S is randomized to generate the converted user secret key sk _d .

(S404: random vector generation process)
Random vector generator 723, the processing device, the random vector _{^{v ~ = (s ~, v}} ~ 2, ..., v ~ r~) generating a ^∈Z _p r~. Here, the first element s ^~ of the vector v ^~ is a random number that is a secret value, and the remaining elements v ^~ ₂ ,. . . , V ^to _r are random numbers having no particular meaning. It should be noted, r~ in the vector ^{v ~} is that of ^{r ~.}

(S405: random number generation processing)
The random number generation unit 721 generates a random number represented by Expression 117 by the processing device.

つまり、パラメータ暗号化部７２４は、公開鍵ｐｋに含まれる属性情報であるアクセス構造Ｆ^〜を設定したパラメータｄを暗号化して、パラメータ暗号文ｃｔ_ｄＦ＾を生成する。 (S406: Parameter encryption processing)
Parameter encryption unit 724, by the processor, using the public key pk acquired in S401, and the parameter d generated in S402, the vector ^v and ^~ generated in S404, the random number generated in step S405 , Encryption elements RC ^ ₀ , RC ^ ₁ , RC ^ of the parameter ciphertext ct _{dF ^} shown in _Formula 118 _{. i} and RD ^ _i are generated.

That is, the parameter encryption unit 724 encrypts the parameter d is set an access structure F ^~ is attribute information included in the public key pk, generates parameters ciphertext ct dF _^.

(S407: Universal re-encryption key output process)
The universal re-encryption key output unit 730 includes a qualified set S of attributes included in the user secret key sk _S acquired in S401 and the key elements RK ₀ and RK of the converted user secret key sk _d generated in S403. ₁ , RK _{2. i} and cryptographic elements RC ^ ₀ , RC ^ ₁ , RC ^ of the parameter ciphertext ct _{dF ^} generated in S406 _{. The} universal re-encryption key uruk _S including _i and RD ^ _i is secretly output to the re-encryption key generation apparatus 300 via the network.
The universal re-encryption key output unit 730 outputs the universal re-encryption key urk _S to the key output unit 150 of the key generation device 100, and the key output unit 150 outputs the universal re-encryption key urk _S to the re-encryption key. You may output to the production | generation apparatus 300 secretly.

FIG. 13 is a flowchart showing processing of the RKG algorithm according to the first embodiment.
The RKG algorithm is executed by the re-encryption key generation apparatus 300 shown in FIG.

(S501: Information acquisition process)
The public key acquisition unit 311 acquires the public key pk and the re-encrypted secret key rsk generated by the Setup algorithm.
The universal re-encryption key acquisition unit 312 acquires a universal re-encryption key urk _S generated by the URKG algorithm.
The access structure acquisition unit 313 accesses the access structure F ′ = (M ′, ρ ′) indicating the range in which the re-ciphertext rct _{F ′} input by the user using the user secret key sk _S can be decrypted. To get. Here, the matrix M ′ included in the access structure F ′ is a matrix of L ′ rows and r ′ columns.

(S502: random vector generation process)
Random vector generator 321, the processing device, the random vector ^{v ^ = (s ^ = s} ~ + s', v ^ 2, ..., v ^ r ') to produce a ∈ Z _p ^r'. Here, the leading element s ′ of the vector v ^ is a random number that is a secret value, and the remaining elements v ^ ₂ ,. . . , V ^ _r are random numbers that have no particular meaning.

(S503: random number generation processing)
The random number generation unit 322 generates a random number represented by Expression 119 by the processing device.

つまり、属性設定部３２３は、普遍再暗号化鍵ｕｒｋ_Ｓのパラメータ暗号文ｃｔ_ｄＦ＾の暗号要素に、属性情報であるアクセス構造Ｆ’を設定して、変換後暗号文ｃｔ_ｄＦ’を生成する。 (S504: attribute setting process)
The attribute setting unit 323 has the public key pk, the re-encryption secret key rsk, the universal re-encryption key urk _S, and the access structure F ′ acquired in S501 by the processing device, the vector v ^ generated in S502, Using the random number generated in S503, the cipher elements RC ^ ' ₀ , RC ^' ₁ , RC ^ 'of the converted ciphertext _ctdF' shown in Expression _{120.2 . i} , RD ^ ′ _i is generated.

That is, the attribute setting unit 323 sets the access structure F ′ that is attribute information to the encryption element of the parameter ciphertext ct _{dF ^} of the universal re-encryption key uruk _S , and generates the converted ciphertext ct _{dF ′} . .

(S505: Re-encryption key output process)
Re-encryption key output unit 330, after the authorized set S and the conversion of attributes included in the acquired access structure F 'and the universal re-encryption key Urk _S in step S501 the user's private key sk _d key element _RK 0, RK ₁ , RK _{2. i} and the cipher elements RC ^ ' ₀ , RC ^' ₁ , RC ^ 'of the converted ciphertext _ctdF' generated in S504 _{. The} re-encryption key rk _{S → F ′} including _i and RD ^ ′ _i is secretly output to the re-encryption device 400 via the network.

FIG. 14 is a flowchart showing processing of the REnc algorithm according to the first embodiment.
The REnc algorithm is executed by the re-encryption apparatus 400 shown in FIG.

(S601: Information acquisition process)
The public key acquisition unit 411 acquires the public key pk generated by the Setup algorithm.
The re-encryption key acquisition unit 412 acquires the re-encryption key rk _{S → F ′} generated by the RKG algorithm.
The original ciphertext acquisition unit 413 acquires the original ciphertext oct _F generated by the Enc algorithm.

(S602: Re-encryption determination process)
The re-encryption determination unit 420 uses the processing device to include the qualified set S of attributes included in the re-encryption key rk _{S → F ′} acquired in S601 to satisfy the access structure F included in the original ciphertext oct _F. It is determined whether or not.
The method of this determination, the authorized set S of the attributes described in S202 is the same as the method for determining whether to satisfy the access structure F ^~.
If the attribute qualified set S satisfies the access structure F, the process proceeds to S603. If the attribute qualified set S does not satisfy the access structure F, the process ends.

(S603: Constant calculation process)
The constant calculation unit 431 is a constant that satisfies Σ _i∈I ω _i M _i = (1, 0,..., 0) when I = {i: ρ (i) ∈S} by the processing device. ω _i εZ _p is calculated. Here, M _i is the i-th row of the matrix M.
As described in S202, when the qualified set S of attributes satisfies the access structure F, when I = {i: ρ (i) εS}, Σ _iεI ω _i · λ _i = s. There is a constant {ω _i εZ _p } _iεI . Therefore, the constant ω _i can be calculated.

つまり、ペアリング演算部４３２は、オリジナル暗号文ｏｃｔ_Ｆを、再暗号化鍵ｒｋ_Ｓ→Ｆ’に含まれる変換後ユーザ秘密鍵ｓｋ_ｄの鍵要素ＲＫ_０，ＲＫ_１，ＲＫ_２．ｉで復号して、復号情報ｄｅｃ_ｄ＝ＲｅＣ_１を生成する。 (S604: Pairing calculation processing)
The pairing calculation unit 432 uses the public key and the re-encryption key rk _{S → F ′} and the original ciphertext oct _F acquired in S601 and the constant ω _i calculated in S603, The calculation shown in 121 is executed to generate decryption information dec _d = ReC ₁ .

That is, the pairing calculation unit 432 converts the original ciphertext oct _F into the key elements RK ₀ , RK ₁ , RK _{2 of the} converted user secret key sk _d included in the re-encryption key rk _{S → F ′ . The} decryption information dec _d = ReC ₁ is generated by decoding with _i .

(S605: Re-ciphertext output process)
The re-ciphertext output unit 440 uses the access element F ′ included in the re-encryption key rk _{S → F ′} acquired in S601 and the cipher elements RC ^ ′ ₀ , RC ^ ′ ₁ , of the converted ciphertext ct _{dF ′} . RC ^ ' _{2. i} , RD ^ ′ _i, and the re-ciphertext rct _{F ′} including C ₀ = ReC ₀ included in the original ciphertext oct _F and the decryption information dec _d = ReC ₁ generated in S604 via the network Finally, the data is output to the re-ciphertext decryption apparatus 600.

FIG. 15 is a flowchart showing processing of the Dec _Enc algorithm according to the first embodiment.
The Dec _Enc algorithm is executed by the decoding device 500 shown in FIG.

(S701: Information acquisition process)
The public key acquisition unit 511 acquires the public key pk generated by the Setup algorithm.
The user secret key acquisition unit 512 acquires the user secret key sk _S generated by the KG algorithm.
The original ciphertext acquisition unit 513 acquires the original ciphertext oct _F generated by the Enc algorithm.

(S702: Ciphertext Judgment Processing)
The ciphertext determination unit 520 determines whether or not the qualified set S of attributes included in the user secret key sk _S acquired in S701 satisfies the access structure F included in the original ciphertext oct _F by the processing device. .
The method of this determination, the authorized set S of the attributes described in S202 is the same as the method for determining whether to satisfy the access structure F ^~.
If the attribute qualified set S satisfies the access structure F, the process proceeds to S703. If the attribute qualified set S does not satisfy the access structure F, the process proceeds to S705.

(S703: Constant calculation processing)
The constant calculation unit 531 is a constant that satisfies Σ _i∈I ω _i M _i = (1, 0,..., 0) when I = {i: ρ (i) ∈S} by the processing device. ω _i εZ _p is calculated. The process of S703 is the same as the process of S603.

つまり、ペアリング演算部５３２は、オリジナル暗号文ｏｃｔ_Ｆを、ユーザ秘密鍵ｓｋ_Ｓの鍵要素Ｋ_０，Ｋ_１，Ｋ_２．ｉを用いて復号して、メッセージｍを生成する。 (S704: Pairing calculation processing)
The pairing calculation unit 532 uses the public key pk, the user secret key sk _S, and the original ciphertext oct _F acquired in S701, and the constant ω _i calculated in S703, by the processing device, as shown in Equation 122. An operation is performed to generate a message m.

That is, the pairing calculation unit 532 converts the original ciphertext oct _F into the key elements K ₀ , K ₁ , K ₂ of the user secret key sk _{S. Decrypt} using _i to generate message m.

(S705: Result output processing)
The result output unit 540 outputs the generated message m when the message m is generated in S704. On the other hand, if the qualified set S of attributes does not satisfy the access structure F in S702, a symbol 表 す indicating decryption failure is output.

FIG. 16 is a flowchart showing processing of the Dec _ReEnc algorithm according to the first embodiment.
The Dec _ReEnc algorithm is executed by the re-ciphertext decryption apparatus 600 shown in FIG.

(S801: Information acquisition process)
The public key acquisition unit 611 acquires the public key pk generated by the Setup algorithm.
The user secret key acquisition unit 612 acquires the user secret key sk _{S ′} generated by the KG algorithm.
The reciphertext acquisition unit 613 acquires the reciphertext rct _{F ′} generated by the REnc algorithm.

(S802: Ciphertext Judgment Process)
The ciphertext determination unit 620 determines whether the qualified set S ′ of attributes included in the user secret key sk _{S ′} acquired in S801 satisfies the access structure F ′ included in the re-ciphertext rct _{F ′} by the processing device. Judge whether or not.
The method of this determination, the authorized set S of the attributes described in S202 is the same as the method for determining whether to satisfy the access structure F ^~.
If the attribute qualified set S ′ satisfies the access structure F ′, the process proceeds to S803. If the attribute qualified set S ′ does not satisfy the access structure F ′, the process proceeds to S807.

(S803: Constant calculation process)
When the processing unit sets I ′ = {i: ρ ′ (i) εS ′}, the constant calculation unit 631 calculates Σ _iεI′ω ′ _i M ′ _i = (1, 0 _,. , 0), a constant ω ′ _i ∈Z _p is calculated. Here, M ′ _i is the i-th row of the matrix M ′.

つまり、ペアリング演算部６３２は、変換後暗号文ｃｔ_ｄＦ’を、ユーザ秘密鍵ｓｋ_Ｓ’の鍵要素Ｋ＾’_０，Ｋ＾’_１，Ｋ＾’_２．ｉを用いて復号して、パラメータＥ（ｄ）を生成する。 (S804: Pairing calculation processing)
The pairing calculation unit 632 uses the public key pk, the user secret key sk _{S ′} and the re-ciphertext rct _{F ′} acquired in S801 by the processing device, and the constant ω ′ _i calculated in S803 to The calculation shown in 123 is executed to generate the parameter E (d).

That is, the pairing calculation unit 632 converts the converted ciphertext ct _{dF ′} into the key elements K ^ ′ ₀ , K ^ ′ ₁ , K ^ ′ of the user secret key sk _{S ′ .} Decode using _i to generate parameter E (d).

(S805: Decoding process)
The decoding unit 633 decodes the parameter E (d) generated in S804 using the encoding function E included in the public key pk acquired in S801 by the processing device, and generates a parameter d.

つまり、メッセージ計算部６３４は、パラメータｄが埋め込まれた復号情報ｄｅｃ_ｄ＝ＲｅＣ_１からパラメータｄを取り除いて得られた情報を用いて、暗号要素ＲｅＣ_０からメッセージｍを計算する。 (S806: Message calculation process)
The message calculation unit 634 calculates the message m by executing the calculation shown in Formula 124 using the re-ciphertext rct _{F ′} acquired in S801 and the parameter d generated in S805 by the processing device. .

That is, the message calculation unit 634 calculates the message m from the cipher element ReC ₀ using information obtained by removing the parameter d from the decryption information dec _d = ReC _{1 in} which the parameter d is embedded.

(S807: Result output process)
The result output unit 640 outputs the generated message m when the message m is generated in S806. On the other hand, if the qualified set S ′ of attributes does not satisfy the access structure F ′ in S802, a symbol 表 す indicating decryption failure is output.

*** Explanation of effects ***
As described above, in the cryptographic system 10 according to Embodiment 1, the universal re-encryption key generation device 700 generates the universal re-encryption key urk _S from the user secret key sk _S , and the re-encryption key generation device 300 A re-encryption key rk _{s → F ′} is generated from the universal re-encryption key urk _S. The user secret key sk _S is only necessary when generating the universal re-encryption key urk _S , and is not required when generating the re-encryption key rk _{s → F ′} . If one universal re-encryption key urk _S is generated, it is possible to generate a re-encryption key rk for each access range to be changed.
Therefore, for example, when the key generation device 100 generates the user secret key sk _S, if universal re-encryption key generator 700 has drifted to generate universal re-encryption key Urk _S, since, even a user secret key sk _S The re-encryption key rk can be generated without using the master secret key msk. Therefore, every time the re-encryption key rk is generated, it is not necessary for the user to perform processing using the user secret key sk _S, which is highly convenient. Further, every time the re-encryption key rk is generated, it is not necessary to perform processing using the master secret key msk, and the security is high.

In the above description, the AB-PRE method of the ciphertext policy has been described. However, the AB-PRE method of the key policy can be realized based on the same concept.
In this case, the key generation device 100 receives the access structure F instead of the attribute qualified set S and generates a user secret key. The encryption apparatus 200 receives the qualified set S of attributes instead of the access structure F as input and generates an original ciphertext. The re-encryption key generating apparatus 300 receives the qualified set S ′ of attributes as input instead of the access structure F ′ and generates a re-encryption key.

Therefore, a summary of both the ciphertext policy AB-PRE scheme and the key policy AB-PRE scheme is as follows.
The key generation device 100 generates a user secret key in which one of the attribute qualified set S and the access structure F, which are attribute information corresponding to each other, is set. The encryption device 200 generates an original ciphertext in which the other of the qualified set S of attributes and the access structure F is set.
The universal re-encryption key generation apparatus 700 converts the user secret key in which one of the attribute qualification set S and the access structure F, which are attribute information corresponding to each other, is converted with the parameter d, and the converted user secret key And a universal re-encryption key including the parameter ciphertext obtained by encrypting the parameter d. The re-encryption key generation apparatus 300 converts the converted user secret key, and the converted cipher in which one of the attribute set corresponding to attribute information S ′ and the access structure F ′ is set in the parameter ciphertext. Generate a re-encryption key containing the sentence.
The re-encryption device 400 decrypts the original ciphertext in which the other of the attribute qualified set S and the access structure F, which is attribute information, is set, with the converted user secret key included in the re-encryption key A re-ciphertext including the decryption information and the converted ciphertext is generated.
The decryption device 500 decrypts the original ciphertext using the user secret key in which the other of the attribute qualified set S and the access structure F as the attribute information is set. The re-ciphertext decryption apparatus 600 decrypts the re-ciphertext using the user secret key in which the other of the attribute qualified set S ′ and the access structure F ′ as attribute information is set.

  In the above description, the case of using a symmetric bilinear pairing group has been described. However, it is also possible to use an asymmetric bilinear pairing group, and it is possible to convert the above description into a description in the case of using an asymmetric bilinear pairing group formally.

In the above description, it is assumed that the key generation device 100 includes the universal re-encryption key generation device 700. However, the universal re-encryption key generation device 700 may be independent of other devices. In this case, the same effect can be obtained.
Further, the decryption apparatus 500 may include a universal re-encryption key generation apparatus 700. In this case, every time the re-encryption key is generated, there is a possibility that it takes time and effort for the user who operates the decryption apparatus 500.

  In the above description, the encryption device 200, the decryption device 500, and the re-ciphertext decryption device 600 are different devices. However, the encryption system 10 may include a device having a plurality of functions among the encryption device 200, the decryption device 500, and the re-ciphertext decryption device 600.

17 shows the key generation device 100, the encryption device 200, the re-encryption key generation device 300, the re-encryption device 400, the decryption device 500, and the re-ciphertext decryption device 600 shown in the first embodiment. FIG. 3 is a diagram illustrating an example of a hardware configuration of a universal re-encryption key generation apparatus 700.
Key generation apparatus 100, encryption apparatus 200, re-encryption key generation apparatus 300, re-encryption apparatus 400, decryption apparatus 500, re-ciphertext decryption apparatus 600, universal re-encryption key generation apparatus 700 Is a computer. Key generation apparatus 100, encryption apparatus 200, re-encryption key generation apparatus 300, re-encryption apparatus 400, decryption apparatus 500, re-ciphertext decryption apparatus 600, universal re-encryption key generation apparatus 700 Each element of can be realized by a program.
Key generation apparatus 100, encryption apparatus 200, re-encryption key generation apparatus 300, re-encryption apparatus 400, decryption apparatus 500, re-ciphertext decryption apparatus 600, universal re-encryption key generation apparatus 700 As a hardware configuration, an arithmetic device 901, an external storage device 902, a main storage device 903, a communication device 904, and an input / output device 905 are connected to the bus.

The arithmetic device 901 is a CPU (Central Processing Unit) that executes a program. The external storage device 902 is, for example, a ROM (Read Only).
Memory), flash memory, hard disk device, and the like. The main storage device 903 is, for example, a RAM (Random Access Memory). The communication device 904 is, for example, a communication board. The input / output device 905 is, for example, a mouse, a keyboard, a display device or the like.

The program is normally stored in the external storage device 902, and is loaded into the main storage device 903 and sequentially read into the arithmetic device 901 and executed.
The program includes an information acquisition unit 110, a master key generation unit 120, a user secret key generation unit 140, a key output unit 150, an information acquisition unit 210, a ciphertext generation unit 220, a ciphertext output unit 230, Information acquisition unit 310, re-encryption key generation unit 320, re-encryption key output unit 330, information acquisition unit 410, re-encryption determination unit 420, re-encryption unit 430, and re-ciphertext output unit 440, information acquisition unit 510, ciphertext determination unit 520, decryption unit 530, result output unit 540, information acquisition unit 610, ciphertext determination unit 620, decryption unit 630, and result output unit 640 A program that realizes the functions described as the information acquisition unit 710, the universal re-encryption key generation unit 720, and the universal re-encryption key output unit 730.
Furthermore, an operating system (OS) is also stored in the external storage device 902. At least a part of the OS is loaded into the main storage device 903, and the arithmetic device 901 executes the above program while executing the OS.
In the description of the first embodiment, the information that the master key storage unit 130 stores, the information that the above function acquires, generates, outputs, and the like are stored in the main storage device 903 as files. ing.

  Note that the configuration of FIG. 17 is merely a key generation device 100, an encryption device 200, a re-encryption key generation device 300, a re-encryption device 400, a decryption device 500, a re-ciphertext decryption device 600, 1 shows an example of a hardware configuration with a universal re-encryption key generation device 700, which includes a key generation device 100, an encryption device 200, a re-encryption key generation device 300, a re-encryption device 400, The hardware configuration of the device 500, the re-ciphertext decryption device 600, and the universal re-encryption key generation device 700 is not limited to the configuration illustrated in FIG. 17, but may be other configurations.

DESCRIPTION OF SYMBOLS 10 Encryption system, 100 Key generation apparatus, 110 Information acquisition part, 111 Security parameter acquisition part, 112 Attribute category acquisition part, 113 Master key acquisition part, 114 Qualified set acquisition part, 120 Master key generation part, 121 Mapping generation part, 122 parameter generation unit, 123 access structure generation unit, 124 encoding function generation unit, 125 key element generation unit, 130 master key storage unit, 140 user secret key generation unit, 141 attribute set determination unit, 142 random number generation unit, 143 key element Generator, 150 key output unit, 200 encryption device, 210 information acquisition unit, 211 public key acquisition unit, 212 message acquisition unit, 213 access structure acquisition unit, 220 ciphertext generation unit, 221 random vector generation unit, 222 random number generation , 223 encryption element generation unit, 230 ciphertext output unit, 00 re-encryption key generation device, 310 information acquisition unit, 311 public key acquisition unit, 312 universal re-encryption key acquisition unit, 313 access structure acquisition unit, 320 re-encryption key generation unit, 321 random vector generation unit, 322 random number Generation unit, 323 Attribute setting unit, 330 Re-encryption key output unit, 400 Re-encryption device, 410 Information acquisition unit, 411 Public key acquisition unit, 412 Re-encryption key acquisition unit, 413 Original ciphertext acquisition unit, 420 Re Encryption determination unit, 430 re-encryption unit, 431 constant calculation unit, 432 pairing operation unit, 440 re-ciphertext output unit, 500 decryption device, 510 information acquisition unit, 511 public key acquisition unit, 512 user secret key acquisition unit 513 Original ciphertext acquisition unit 520 Ciphertext determination unit 530 Decryption unit 531 Constant calculation unit 532 Pairing operation unit 540 Result output , 600 reciphertext decryption device, 610 information acquisition unit, 611 public key acquisition unit, 612 user secret key acquisition unit, 613 reciphertext acquisition unit, 620 ciphertext determination unit, 630 decryption unit, 631 constant calculation unit, 632 Pairing operation unit, 633 decoding unit, 634 message calculation unit, 640 result output unit, 700 universal re-encryption key generation device, 710 information acquisition unit, 711 public key acquisition unit, 712 user secret key acquisition unit, 720 universal re-encryption Encryption key generation unit, 721 Random number generation unit, 722 Decryption key conversion unit, 723 Random vector generation unit, 724 Parameter encryption unit, 730 Universal re-encryption key output unit, U attribute, 1 ^λ security parameter, S, S ′ Yes qualification set, pk public key, msk master secret key, rsk re-encrypted secret _key, sk _S, sk S _'user's private key, m message ^F, F ', F ^~ access structure, oct _F original ciphertext, urk _S universal re-encryption key, sk _d conversion after the user's private _{key, ct dF ^} parameters ciphertext, rk _{S → F'} re-encryption key, ct _{dF ′} ciphertext after conversion, rct _{F ′} reciphertext, d parameter, Setup setup process, KG key generation process, Enc encryption process, URKG universal reencryption key generation process, RKG reencryption key generation process, REnc re Encryption step, Dec _Enc decryption step, Dec _ReEnc re-ciphertext decryption step.

Claims (8)

A universal re-encryption key generation device that generates a universal re-encryption key by converting the user secret key so that the original ciphertext that can be decrypted by the user private key cannot be decrypted;
A re-encryption key for re-encrypting to change a decryptable range for an original ciphertext that can be decrypted with the user private key, and information indicating a range in which the original ciphertext can be decrypted is set. And a re-encryption key generation device that generates the re-encryption key from the universal re-encryption key generated by the universal re-encryption key generation device. The universal re-encryption key generation apparatus encrypts the user secret key after conversion by converting the user secret key in which one of the qualified set S and the access structure F is set with the parameter d, and the parameter d. Generating the universal re-encryption key including the encrypted parameter ciphertext,
The re-encryption key generation device includes a re-encryption including the converted user secret key and a converted ciphertext in which one of a qualified set S ′ and an access structure F ′ is set as the parameter ciphertext. The cryptographic system according to claim 1, wherein the key is generated. The cryptographic system further includes:
Decryption information obtained by decrypting the original ciphertext in which the other of the qualified set S and the access structure F is set with the converted user private key included in the re-encryption key, the converted ciphertext, The cryptographic system according to claim 2, further comprising a re-encryption device that generates a re-ciphertext including The cryptographic system further includes:
The encryption system according to claim 3, further comprising: a re-ciphertext decryption device that decrypts the re-ciphertext using a user secret key in which the other of the qualified set S ′ and the access structure F ′ is set. The universal re-encryption key generation device has key elements K ₀ , K ₁ , K ₂ shown in Equation _{1 . 1.} Key elements RK ₀ , RK ₁ , RK shown in Equation 2 from the user private key including _{i .} a converted user secret key including _i , and a parameter ciphertext including the cipher elements RC ^ ₀ and RC ^ ₁ shown in Equation 3;
The re-encryption key generation apparatus includes cryptographic elements RC ^ ′ ₀ , RC ^ ′ ₁ , RC ^ ′ shown in Equation 4 _{. i} , RD ^ ′ Generate a converted ciphertext containing _i ,
The re-encryption device has cryptographic elements C ₁ and C ₂ shown in Equation 5 _. re-ciphertext including decryption information dec _d obtained by decrypting the original ciphertext including _i and D _i as shown in Equation ₆ and the cipher element ReC ₀ of the original ciphertext as shown in Equation 7;
The re ciphertext decryption apparatus, key shown in Equation 8 elements _{K ^ '0, K ^'} 1, K ^ '2. The encryption system according to claim 4, wherein the re-ciphertext is decrypted with a second user secret key including _i as shown in Equation 9.

A universal re-encryption key generating device for generating a universal re-encryption key by converting the user secret key so that the universal re-encryption key generation device cannot decrypt the original ciphertext that can be decrypted with the user secret key;
The re-encryption key generation device is a re-encryption key for re-encrypting the original ciphertext that can be decrypted with the user secret key, and re-encrypting the original ciphertext, and can decrypt the original ciphertext A re-encryption key generation step of generating a re-encryption key in which information indicating a valid range is set from the universal re-encryption key generated by the universal re-encryption key generation device. A decryption key conversion unit that converts a user secret key with a parameter d and generates a converted user secret key;
A parameter encryption unit that encrypts the parameter d to generate a parameter ciphertext;
Universal re-encryption comprising: a universal re-encryption key output unit that outputs a universal re-encryption key including the converted user secret key generated by the decryption key conversion unit and the parameter ciphertext generated by the parameter encryption unit Key generation device. A universal re-encryption key acquisition unit for acquiring a universal re-encryption key including the converted user secret key obtained by converting the user secret key with the parameter d and the parameter ciphertext obtained by encrypting the parameter d;
An attribute setting unit that sets attribute information in the parameter ciphertext included in the universal re-encryption key acquired by the universal re-encryption key acquisition unit, and generates a converted ciphertext;
Re-encryption that outputs a re-encryption key including the converted user secret key included in the universal re-encryption key acquired by the universal re-encryption key acquisition unit and the converted ciphertext generated by the attribute setting unit A re-encryption key generation device comprising an encryption key output unit.

Images