JP5432736B2 - Keyword search system for encrypted information, keyword search method, search request device, search agent device, program, recording medium - Google Patents

Description

  The present invention relates to a searchable encryption technique capable of performing keyword search for encrypted information (hereinafter referred to as encryption information), and more specifically, keyword search (for example, partial match search) other than exact match search is also possible. It relates to searchable encryption technology.

  PEKS (Public-key Encryption with Keyword Search) is known as a searchable encryption technique for performing a keyword search on encryption information without decrypting the encryption information and obtaining the search result (Non-Patent Documents 1 and 2). reference). For example, PEKS disclosed in Non-Patent Document 2 realizes PEKS by using ID-based encryption (anonymouse IBE) that cannot know which ID (identification) is used for encryption from encryption information.

D. Boneh, G. Di Crescenzo, R. Ostrovsky, and G. Persiano, "Public key encryption with keyword search", in proceedings of Eurocrypt 2004, LNCS 3027, pp. 506-522, 2004. [January 2010 12 days search], Internet <URL: http://crypto.stanford.edu/~dabo/papers/encsearch.pdf> M. Abdalla, M. Bellare, D. Catalano, E. Kiltz, T. Kohno, T. Lange, J. Malone-Lee, G. Neven, P. Paillier, and H. Shi, "Searchable encryption revisited: Consistency properties , relation to anonymous IBE, and extensions ", Journal of Cryptology, 21 (3), July 2008. [Search January 12, 2010], Internet <URL: http://www.cs.washington.edu/homes /yoshi/papers/PEKS/PEKS.pdf>

  In the prior art, for example, a keyword specified in advance when registering encryption information in a search engine and a search keyword used in a search are completely matched from the beginning to the end means search matching. Therefore, only exact match search was possible.

  Accordingly, an object of the present invention is to provide a searchable encryption technique capable of performing keyword search (for example, partial match search) other than complete match search in addition to keyword complete match search.

Keyword search system of the present invention comprises at least a search request device a search proxy device, the information including a character string in the keyword search system that performs keyword search by the search keyword with respect to the encryption information C ₁ obtained by encrypting there, as a registration keyword a keyword to be searched, the encryption information C _1, whether the information R ₁ capable of identifying a per encryption by predicate encryption scheme the information R ₁ using a registration keyword The search information C ₂ = (R ₁ , R ₂ ), which is a set with the information R ₂ obtained by the conversion, is attached, and the search request device uses the search keyword to convert the information R ₂ into the predicate encryption method includes a key generating unit for generating a decryption key k for decrypting ^*, and a transmitting unit for transmitting the decryption key k ^* to the search proxy device, the search proxy device receives a decryption key k ^* A signal unit, decodes the information R ₂ in the decoding key k ^* according predicate encryption method, and a determining whether or not the decoding decision section information obtained matches the information R _1.

As a specific example, the information R ₂ is obtained by encrypting the information R ₁ with the predicate encryption method attribute generated from the registration keyword, and the decryption key k ^* is the predicate encryption method predicate generated from the search keyword. Generated from

For example, the predicate encryption method is an inner product type predicate encryption method in which the true / false of the predicate logic is given by a standard inner product of an attribute vector and a predicate vector. When the sum of d-1 times at the maximum is allowed in the predicate logic, variables having components as components in the order in which all unary expressions of degree d or less composed of _r attribute variables X ₁ ,..., X _r are arranged in lexicographic order. An attribute vector obtained by setting a character included in the registration keyword in the vector _{Xr, d} , and the predicate is a predicate polynomial in which the predicate logic is expressed by a polynomial using the attribute variable and the character included in the search keyword. This is a predicate vector having as components the coefficients arranged in the order corresponding to the components of the variable vector _{Xr, d} .

で与えられ、
《２》検索方式が前方一致検索方式である場合、述語多項式は、

で与えられ、
《３》検索方式が後方一致検索方式である場合、述語多項式は、

で与えられ、
《４》検索方式が部分一致検索方式である場合、述語多項式は、

で与えられる。 The predicate polynomial is determined depending on the search method, rd _{i, j} (1 ≦ i, j ≦ r) is a random number, and the i-th character of the registration keyword W of r characters is w _i (1 ≦ i ≦ r). ), The i-th character of the search keyword S for t character is s _i (1 ≦ i ≦ t ≦ r),
<< 1 >> When the search method is an exact search method, the predicate polynomial is

Given in
<< 2 >> When the search method is a prefix search method, the predicate polynomial is

Given in
<< 3 >> When the search method is a backward match search method, the predicate polynomial is

Given in
<< 4 >> When the search method is a partial match search method, the predicate polynomial is

Given in.

で与えられ、
《２》検索方式が前方一致検索方式である場合、述語多項式は、

で与えられ、
《３》検索方式が後方一致検索方式である場合、述語多項式は、

で与えられ、
《４》検索方式が部分一致検索方式である場合、述語多項式は、

で与えられ、
復号判定部は、１≦ｉ≦ｒの各ｉについて、情報Ｒ_２[ｉ]を復号鍵ｋ^＊で復号し、得られた情報が情報Ｒ_１[ｉ]に一致するか否かを判定する。 Alternatively, the i-th character of the r-character registration keyword W is w _i (1 ≦ i ≦ r), where the first character w ₁ is the character string start symbol ST and the largest non-null character is the subscript. When (max + 1) is set to max, the character w _{max + 1} is the character string end symbol ED, and the partial keyword W _i (1 ≦ i ≦ r) is W _i = w _i w _{i + 1} ... w _r ‖null _i , however, null _i represents the i-1 pieces of null, the j-th character of _{W i} and be represented as _{w i, j,} the i-th character of the search for the keyword S of t character _s i (1 ≦ i ≦ t ≦ r), where the first character s ₁ is the character string start symbol ST, and the maximum subscript of the non-null character is max (max + 1). The character s _{max + 1} is as a string terminator ED, attribute vector, corresponding to the r number of partial keyword W _i is the r generated, the encryption information C _1, or per Distinguishable r pieces of information _{R 1} or a (hereinafter, _{R 1} [i] to (1 ≦ i ≦ r)) , obtained by encrypting the information _{R 1} [i] in the partial keyword _{W i} r Search information C ₂ (hereinafter referred to as C ₂ [i] = (R ₁ [i], R), which is a set of the information R ₂ (hereinafter referred to as R ₂ [i] (1 ≦ i ≦ r)). ₂ [i]) (1 ≦ i ≦ r) is attached, the predicate polynomial is determined depending on the search method, rd _{i, j} (1 ≦ i, j ≦ r) is a random number,
<< 1 >> When the search method is an exact search method, the predicate polynomial is

Given in
<< 2 >> When the search method is a prefix search method, the predicate polynomial is

Given in
<< 3 >> When the search method is a backward match search method, the predicate polynomial is

Given in
<< 4 >> When the search method is a partial match search method, the predicate polynomial is

Given in
The decryption determination unit decrypts the information R ₂ [i] with the decryption key k ^* for each i of 1 ≦ i ≦ r, and determines whether or not the obtained information matches the information R ₁ [i]. .

で与えられ、
《２》検索方式が前方一致検索方式である場合、述語多項式は、ｕ個（ｕ＝１）の述語多項式

で与えられ、
《３》検索方式が後方一致検索方式である場合、述語多項式は、ｕ個（ｕ＝ｒ−ｔ＋２）の述語多項式

で与えられ、
《４》検索方式が部分一致検索方式である場合、述語多項式は、ｕ個（ｕ＝ｒ−ｔ＋３）の述語多項式

で与えられ、
復号鍵ｋ^＊は、ｕ個の述語多項式に対応してｕ個生成され（以下、これをｋ^＊[c]（１≦ｃ≦ｕ）とする）、復号判定部は、１≦ｃ≦ｕの各ｃについて、情報Ｒ_２を復号鍵ｋ^＊[c]で復号し、得られた情報が情報Ｒ_１に一致するか否かを判定する。 Alternatively, the i-th character of the r-character registration keyword W is w _i (1 ≦ i ≦ r), where the first character w ₁ is the character string start symbol ST and the largest non-null character is the subscript. When (max + 1) is set to max, the character w _{max + 1} is the character string end symbol ED, and the partial keyword W _i (1 ≦ i ≦ r) is W _i = w _i w _{i + 1} ... w _r ‖null _i , however, null _i represents the i-1 pieces of null, the j-th character of _{W i} and be represented as _{w i, j,} the i-th character of the search for the keyword S of t character _s i (1 ≦ i ≦ t ≦ r), where the first character s ₁ is the character string start symbol ST, and the maximum subscript of the non-null character is max (max + 1). The character s _{max + 1} is As the string terminator ED, the predicate polynomial is determined depending on the search method, rd _{i, j} (1 ≦ i, j ≦ r) is a random number,
<< 1 >> When the search method is a perfect match search method, the predicate polynomial is u (u = 1) predicate polynomials.

Given in
<< 2 >> When the search method is a prefix match search method, the predicate polynomial is u (u = 1) predicate polynomials.

Given in
<< 3 >> When the search method is a backward match search method, the u predicate polynomials are u (u = rt−2) predicate polynomials.

Given in
<< 4 >> When the search method is a partial match search method, the number of predicate polynomials is u (u = rt−3) predicate polynomials.

Given in
Decryption keys k ^* are generated corresponding to u predicate polynomials (hereinafter referred to as k ^* [c] (1 ≦ c ≦ u)), and the decryption determination unit 1 ≦ c ≦ u determining for each c, decodes the information R ₂ in the decryption key k ^{* [c],} whether information obtained matches the information R ₁ in.

Keyword search method of the invention comprises the search proxy device with at least the search request unit, definitive keyword search system performs a keyword search by the search keyword information to the encryption information C ₁ obtained by encrypting containing the string A keyword search method in which a keyword to be searched is used as a registration keyword, information R ₁ that can identify whether or not the encrypted information C ₁ is a hit, and a predicate using the information R ₁ as a registration keyword Search information C ₂ = (R ₁ , R ₂ ), which is a set with information R ₂ obtained by encryption using an encryption method, is attached, and the key generation unit of the search requesting device uses the search keyword. a key generating step of generating a decryption key k ^* for decrypting the information R ₂ a predicate encryption scheme, transmission of the search request apparatus, the search proxy device decryption key k ^* A transmitting step signal to the receiving unit of the search proxy device, a receiving step of receiving the decryption key k ^*, the decoding judgment unit of the search proxy device decodes information R ₂ in the decoding key k ^* according predicate encryption scheme, the resulting information has a decoding judgment step of judging whether or not to match the information R _1.

Further, the search requesting apparatus of the present invention uses information R _{1 that} can identify whether or not the encrypted information C ₁ obtained by encrypting information including a character string using the keyword to be searched as a registration keyword. And search information C ₂ = (R ₁ , R ₂ ), which is a set with information R ₂ obtained by encrypting the information R ₁ using a registration keyword with a predicate encryption method, is attached. A search request device that includes a search request device and a search agent device and is included in a keyword search system that performs a keyword search with respect to the cipher information C ₁ using a search keyword, and uses the search keyword to predicate information R ₂ It includes a key generation unit that generates a decryption key k ^* for decryption by an encryption method, and a transmission unit that transmits the decryption key k ^* to the search agent device.

Further, the search agent device of the present invention uses information R _{1 that} can identify whether or not the encrypted information C ₁ obtained by encrypting information including a character string using the keyword to be searched as a registration keyword. And search information C ₂ = (R ₁ , R ₂ ), which is a set with information R ₂ obtained by encrypting the information R ₁ using a registration keyword with a predicate encryption method, is attached. retrieval request unit and includes a retrieval agent apparatus, a search proxy device included in the keyword search system for performing a keyword search by the search keyword with respect to the encryption information C _1, was generated using the search keyword, information R a decryption key k ^* for decrypting ₂ by predicate encryption scheme, a receiver for receiving from the search requesting device, decodes the information R ₂ in the decoding key k ^* according predicate encryption scheme, resulting information There and a decoding judgment unit judges whether matching information R _1.

  In addition, the computer can be operated as a search requesting device by a program that causes the computer to function as the search requesting device of the present invention. It is possible to make a computer function as a search request device and to distribute a program. Similarly, the computer can be operated as a search agent device by a program that causes the computer to function as the search agent device of the present invention. Other programs can be used by a computer-readable program recording medium that records such a program. It is possible to make the computer function as a search agent device and to distribute the program.

According to the present invention, information R ₁ that can identify whether or not the encrypted information C ₁ is hit, and information R ₂ that is obtained by encrypting the information R ₁ by a predicate encryption method using a registration keyword The search information C ₂ = (R ₁ , R ₂ ) as a set is attached, and the search request side uses the search keyword to decrypt the information R ₂ by the predicate encryption method k ^*. And the search agent decrypts the information R ₂ with the decryption key k ^* according to the predicate encryption method, and determines whether the obtained information matches the information R _{1. The} predicate corresponding to the search method Due to the logic configuration, keyword search (for example, partial match search) other than complete match search is possible in addition to keyword complete match search.

1 is a configuration diagram of a keyword search system according to an embodiment. The figure which shows the process sequence of the keyword search method concerning embodiment. The figure which shows the process sequence of the keyword search method regarding the modification 1. FIG. The figure which shows the process sequence of the keyword search method regarding the modification 2. FIG. 3 is a functional block diagram of an encryption information generation device, a search request device, a search proxy device, and a storage device according to the embodiment.

Embodiments of the present invention will be described with reference to the drawings.
In the information processing described below, information including character strings is subject to encryption. However, in the actual encryption process, the characters themselves, which are text information that allows humans to recognize the semantic content, are encrypted. Instead, for example, character code information (byte representation such as EUC-JP, Shift_JIS, UTF-8, etc.) assigned to the character is to be encrypted. Therefore, in the following description, for example, substituting or setting the character w for the variable X (X = w) is not substituting or setting the character w as the text information for the variable X, but the character w as the character code information. Should be understood as substituting or setting to the variable X. Since this is a conventional means of cryptographic processing, its detailed description is omitted. In this specification, the symbol “→” indicating that a vector is conventionally used may be omitted as a vector notation. Therefore, it should be reasonably understood from the description of the entire specification whether or not a certain symbol is a vector.

[Keyword search system]
As shown in FIG. 1, the keyword search system 1 of this embodiment includes at least an encryption information generation device 100, a search request device 200, a search proxy device 300, and a storage device 400. These devices can communicate with each other via a communication network 5 which is, for example, the Internet.

  The keyword search process in the keyword search system 1 will be described with reference to FIG. Refer to FIG. 5 for the functional configuration of each device.

<< Cryptographic information generation process >>
Encryption information generating unit 101 of the encryption information generating apparatus 100 obtains the encryption information C ₁ encrypts the information M containing the string (step S1). There is no limitation on the encryption method (Enc, Dec). As this encryption method, for example, a common key encryption method or a public key encryption method can be used. In the case of a common key cryptosystem, the information M is encrypted with a common key shared between the cipher information generation device 100 and the search device 200. In the case of the public key cryptosystem, the information M is encrypted with the public key of the search device 200. That is, the information processing for obtaining the encryption information _{C 1} in accordance with the encryption algorithm _Enc, a C 1 = Enc (M).

The search information generation unit 102 of the cryptographic information generation apparatus 100 arbitrarily sets information R ₁ that can identify whether or not the search is successful (for example, sets zero as a numerical value to the information R ₁ ). obtain information R ₂ is encrypted by the predicate encryption scheme ₁ in registration keyword W (step S2). The registration keyword is a keyword to be searched that is preset by the user, for example. The search information C ₂ is C ₂ = (R ₁ , R ₂ ). Encryption process to obtain information R ₂ is realized by the inner product type predicate encryption scheme, for example. For details of the inner product type predicate cryptosystem, see Reference A, for example.
(Reference A) T. Okamoto and K. Takashima, "Hierarchical predicate encryption for inner-products", In ASIACRYPT, pp.214-231, 2009.

Here, an example of encryption processing using the inner product type predicate encryption method will be described.
In the predicate encryption, certain information G is incorporated into an encrypted message in the process of encryption by a sender, and a receiver having information H that satisfies a specific relationship with the information G knows the decryption of the encrypted message or knows the message. This is a method that can acquire information about a message without any problem. The sender does not necessarily need to know the information H that the receiver has at the time of encryption. In addition, the sender does not necessarily have to identify the recipient before encryption. The sender can freely and actively determine the information G with the initiative. In theory, the information G is expressed as an attribute I (variable) and the information H is expressed as a predicate logic f (propositional function, Boolean function). A specific relationship that the information G and the information H should satisfy at the time of decoding is, for example, f (I) = 1. In the inner product type predicate encryption method, the true / false of the predicate logic is given by the standard inner product of the attribute vector and the predicate vector. Here, the predicate logic is expressed by a multivariable polynomial. This multivariable polynomial is also called a predicate polynomial. A variable representing an attribute is called an attribute variable.

For example, a predicate polynomial p (X ₁ , X ₃ , which returns 1 only when _three attribute variables X ₁ , X ₂ , X ₃ are (X ₁ = w ₁ or X ₂ = w ₂ and X ₃ = w ₃ ). X ₂ , X ₃ ) is expressed by equation (1) using a random number rd. In the expression (1), the logical OR is expressed by a product operation, and the logical AND is expressed by a sum operation.
p (X ₁ , X ₂ , X ₃ ) = (X ₁ −w ₁ ) (X ₂ −w ₂ ) + rd (X ₃ −w ₃ ) (1)

r number of attributes variable _{X 1,} X 2, ..., in order to handle the logical sum of the d-1 times for the _{X r, X 1, X 2} , ..., all of the following monomials degree d consisting _{X r} It is necessary to prepare. A vector having each component in the order in which this monomial is included in a lexicographic order including 1 is called a d-order variable vector with respect to the attribute variables X ₁ , X ₂ ,..., X _r and is expressed as X _{r, d} . The lexicographic order is one in which an order is introduced into a Cartesian product set of d identical ordered sets {1, X ₁ , X ₂ ,..., X _r }. Since lexicographic order is discussed and well known in, for example, naive set theory, no further details will be given.

Let the i-th character of the r-character registration keyword W be w _i (1 ≦ i ≦ r). For the attribute variable X _i (1 ≦ i ≦ r), let X _i = w _i . At this time, the fact that the vector x is the attribute vector x on the variable vector X _{r, d} means that the expression (2) is satisfied. In this embodiment, r is set to a fixed value (an integer satisfying 1 ≦ r) as a system specification. If the length (number of characters) of the registration keyword W is less than r, it is padded with null characters until r is reached. As a specific example, when r = 2, d = 2, _{Xr, d} = (1, X ₁ , X ₂ , X ₁ ² , X ₁ X ₂ , X ₂ ² ), the attribute vector x is x = (1 , W ₁ , w ₂ , w ₁ ² , w ₁ w ₂ , w ₂ ² ).

When r logical variables X ₁ , X ₂ ,..., X _r are allowed to be ORed up to d times, a multivariable polynomial p (X _α ,..., X _β ) composed of attribute variables representing predicate logic is used. (1 ≦ α ≦ β ≦ r) is called a predicate polynomial on the variable vector X _{r, d} .

This variable vector _{X r,} predicate polynomial p on the _{d (X α, ..., X} β) , and I thought variable vector _{X r,} standard inner product of the _d and the predicate vector _{v <X r, d, v} > a, p The coefficients of (X _α ,..., X _β ) are set as components of the predicate vector v in the order corresponding to the components of the variable vectors X _{r, d} . The other components of the predicate vector v are set to 0. This predicate vector is also called a predicate vector on the variable vector _{Xr, d} .

  Although d is set as a system specification to a fixed value satisfying 1 ≦ d ≦ r, in this embodiment, d = r. That is, a logical sum corresponding to the maximum number of characters of the registration keyword is allowed in the predicate polynomial.

An example of encryption processing using the inner product type predicate encryption method is as follows. The search information generation unit 102 generates an attribute vector x from the registration keyword W according to the equation (3). This equation (3) means that X _i = w _i (1 ≦ i ≦ r) in the variable vector X _{r, r} .

x = (x ₁ , x ₂ ,..., x _n ) ∈F _q ⁿ . That is, x _i (1 ≦ i ≦ n) is an element of the n-dimensional direct product F _q ⁿ . F _q is a finite field, and q is a prime number or a power value of a prime number. The search information generation unit 102 randomly selects δ ₁ , δ ₂ , and ζ from F _q and calculates Expression (4) to obtain information R ₂ . Information _{R 2} is _{R 2 = (cipher1, cipher2)} .

The public parameters are, for example, generators g ₁ , g ₂ , g _T of the cyclic group G ₁ , G ₂ , G _T of order q, a non-degenerate bilinear map e: G ₁ × G ₂ → G _T ( However, e (g ₁ , g ₂ ) = g _T ), order q, and an orthogonal basis B of the (n + 3) -dimensional vector space V is included. The secret key includes an orthogonal basis B ^* of the dual vector space V ^* . When the algebraic structure is a finite field F _q , q is a prime number or a power value of a prime number. The bilinear map e is, for example, Tate pairing or Weil pairing.

The orthogonal base B and the orthogonal base B ^* will be described.
Assume that an arbitrary element of the (n + 3) -dimensional vector space V is expressed as an element of the (n + 3) -dimensional direct product G ₁ ^{n + 3} of the cyclic group G ₁ as shown in Expression (5). An arbitrary element of the (n + 3) -dimensional vector space V can also be expressed as in Expression (6) using the standard basis A of the (n + 3) -dimensional vector space V. However, a _i is an element of the (n + 3) -dimensional direct product G ₁ ^{n + 3} and z _i is an element of the (n + 3) -dimensional direct product F _q ^{n + 3} . Also, 1 is an additive unit.

The orthogonal basis B is obtained by applying the (n + 3) order square matrix X to the standard basis A as shown in the equation (7). The symbol T represents transposition. Note that the matrix X is kept secret as is the secret key.

Similarly, an arbitrary element of the dual vector space V ^* that is dual to the vector space V is expressed as an element of the (n + 3) -dimensional direct product G ₂ ^{n + 3} of the cyclic group G ₂ as shown in Expression (8). . Dual space V ^* any original can also be expressed as Equation (9) using the dual space V ^* of the standard basis A ^*. However, a _i ^* is an element of the (n + 3) -dimensional direct product G ₂ ^{n + 3} and y _i ^* is an element of the (n + 3) -dimensional direct product F _q ^{n + 3} . Also, 1 is an additive unit.

The orthogonal basis B ^* is obtained by applying the (n + 3) order square matrix ^T (X ⁻¹ ) to the standard basis A ^* as shown in Expression (10). The symbol E represents a unit matrix.

Transmission unit 108 of the encryption information generating apparatus 100 transmits the encrypted information _{C 1} and the search information _{C 2} to the storage apparatus 400 as one set (step S3). The receiving unit 409 of the storage device 400 receives a set (C ₁ , C ₂ ) of encryption information and search information (step S4). The storage unit 401 of the storage device 400 normally stores a plurality of (C ₁ , C ₂ ) received from the encryption information generation device 100. Furthermore, the storage unit 400 of the storage device 400 generally stores a plurality of (C ₁ , C ₂ ) received from a plurality of encryption information generation devices. Each group (C ₁ , C ₂ ) is assigned a unique index.

《Search request process》
The key generation unit 201 of the search requesting device 200 uses the secret key (orthogonal basis B ^* ) and the search keyword S input by the user and the predicate logic of the search method $ specified by the user, for example. generating a decryption key ^{k *} for decoding information _{R 2} included in the use information _{C 2} (step S5). The secret key (orthogonal basis B ^* ) is the secret key of the search requesting device 200.

Information processing for obtaining the decryption key k ^* follows a key generation algorithm corresponding to the predicate encryption method performed by the search information generation unit 102 of the encryption information generation apparatus 100. In this embodiment, the information processing for obtaining the decryption key k ^* is realized by the inner product type predicate encryption method. Specifically, the key generation unit 201 first generates a predicate vector v on the variable vector _{Xr, r} .

The i-th character of the t-character search keyword S is s _i (1 ≦ i ≦ t ≦ r). If t <r, s _i = 0 (t <i ≦ r). The key generation unit 201 determines a predicate polynomial p (X _α ,..., X _β ) on X _{r, r} corresponding to the search method $ and obtains a predicate vector v on X _{r, r} as described later. . X _r, predicate polynomial p on _{r (X α, ..., X} β) method of finding a from _{X r,} predicate vector v on _r are as described above.

Here, the predicate polynomial of each search method $ will be described. rd _{i, j} (1 ≦ i, j ≦ r) is a random number.

<< 1 >> Perfect match search method (cm)
The exact match search method is a search method for searching for a case where w _i = s _i holds for an arbitrary i (1 ≦ i ≦ r).
The predicate polynomial p (X _α ,..., X _β ) in the exact match search method is given by equation (11).

<< 2 >> Forward matching search method (fm)
The forward matching search method is a search method for searching for a case where w _i = s _i holds for an arbitrary i (1 ≦ i ≦ t).
The predicate polynomial p (X _α ,..., X _β ) in the forward matching search method is given by equation (12).

<< 3 >> Backward match search method (bm)
The backward matching search method is a search method for searching for a case where w _i = s _i holds for an arbitrary i (r−t + 1 ≦ i ≦ r).
The predicate polynomial p (X _α ,..., X _β ) in the backward matching search method is given by equation (13).

<< 4 >> Partial match search method (pm)
The partial match search method is a search method for searching for a case where w _i = s _i is satisfied for all i satisfying (j ≦ i ≦ t + j−1 ≦ r).
The predicate polynomial p (X _α ,..., X _β ) in the partial match search method is given by equation (14).

<< 5 >> Complete mismatch search method (ncm)
The complete mismatch search method is a search method for searching for a case where w _i = s _i does not hold for all i (1 ≦ i ≦ r). This is obtained as a complementary set of search results hit by the exact match search method.

<< 6 >>"Excluded" search method (npm)
The “does not include” search method is a search method for searching for a case where there is no j that satisfies w _i = s _i for all i satisfying j ≦ i ≦ t + j−1 ≦ r. This is obtained as a complementary set of search results hit by the partial match search method.

Next, the key generation unit 201 selects σ and η randomly from F _q for the predicate vector v = (v ₁ , v ₂ ,..., V _n ) ∈F _q ⁿ , and formula (15) is obtained. The decryption key k ^* is obtained by calculation.

The transmission unit 208 of the search request device 200 transmits the decryption key k ^* to the search proxy device 300 (step S6).

《Search agency process》
The receiving unit 309 of the search proxy device 300 receives the decryption key k ^* (step S7).

  The control unit 305 of the search proxy device 300 controls the transmission unit 308 so as to transmit all search information stored in the storage unit 401 of the storage device 400 to the search proxy device 300 to the storage device 400. In response to this, the transmission unit 408 of the storage device 400 transmits all the search information stored in the storage unit 401 together with the index to the search agent device 300, and the reception unit 309 of the search agent device 300 receives these information. Is received (step S8).

The decryption determination unit 301 of the search proxy device 300 sets all the search information as targets for the decryption determination process, and individually decrypts the search information using the decryption key k ^* to determine whether or not the search is successful ( Step S9). Specifically, the decoding determination unit 302 obtains information R for all search information according to the equation (16) (decoding process), and determines whether R = R ₁ is successful (determination process).

Transmission unit 308 of the search proxy apparatus 300 transmits the index of the search information R = _{R 1} is satisfied to the search request unit 200 (step S10).

《Search result reception process》
Receiving unit 209 of the search request unit 200 receives the index of the search information R = _{R 1} is satisfied (step S11).

  The control unit 205 of the search requesting device 200 controls the transmitting unit 208 to encrypt the storage device 400 corresponding to the index received from the search proxy device 300 and stored in the storage unit 401 of the storage device 400. In response to this request, the transmission unit 408 of the storage device 400 transmits the encryption information corresponding to the index to the search request device 200, and the reception unit 209 of the search request device 200. Receive these (step S12).

Decoding unit 206 of the search request unit 200, if necessary, obtain information M by decrypting the encrypted information _{C 1} received from the storage device 400 (step S13). Information processing for obtaining the information M follows a decryption algorithm Dec corresponding to the encryption method (Enc, Dec) performed by the encryption information generation unit 101 of the encryption information generation apparatus 100. That is, M = Dec (C ₁ ).

<Modification>
In the above embodiment _, the dimension n of the variable vector X _{r, d} is the sum of combinations in which the sum of mononomials of order i and lower is selected from r characters to q characters (1 ≦ q ≦ i). expressed.

According to Expression (17), the dimension n of the variable vector _{Xr, d} increases in the factorial order of the number r of characters of the registration keyword and the number d of the logical sum. Therefore, in each modification, a variable vector _{Xr, 1} that does not use a logical sum although it is a search that uses a logical sum is configured. Therefore, in each modification, ST is introduced as a character string start symbol and ED is introduced as a character string end symbol in the registration keyword and the search keyword. For convenience of explanation, these symbols are expressed by two characters such as ST and ED. However, in the modification, a character having a length of 1 character as a character string start symbol and a character length as a character string end symbol. Note that the symbol is set. Of course, the lengths of these symbols may be arbitrarily set. In this case, although the expression of the predicate polynomial and the subscripts appearing there change, there is no particular significance in practical use. Setting a length symbol is sufficient. Refer to FIG. 3 for Modification 1 and FIG. 4 for Modification 2.

[Modification 1]
Let ST be the first character w ₁ of the registration keyword W. When the maximum subscript of a non-null character is set to max, the (max + 1) -th character w _{max + 1 is set} to ED. For the registration keyword W, a partial keyword W _i (1 ≦ i ≦ r) is defined as W _i = w _i w _{i + 1} ... W _r ‖null _i . Here, null _i represents i−1 nulls. The j-th character of W _i will be expressed as _{w i, j.}

In the modification 1, the process of step S2 of the embodiment is changed as follows. The search information generation unit 102 of the cryptographic information generation apparatus 100 arbitrarily sets r pieces of information R ₁ [i] (1 ≦ i ≦ r) that can identify whether or not the search is successful (for example, all are numerical values). This information R ₁ [i] is encrypted with the partial keyword W _i to obtain information R ₂ [i] (step S2a). Specifically, the search information generation unit 102 generates r attribute vectors x _i (1 ≦ i ≦ r) from r partial keywords W _i according to Expression (18). Let x _i = (x ₁ [i], x ₂ [i],..., x _n [i]) ∈F _q ⁿ .

Then, the search information generation unit 102 randomly selects δ ₁ , δ ₂ , and ζ from F _q and calculates Expression (19) to obtain information R ₂ [i] (1 ≦ i ≦ r ). The information R ₂ [i] is R ₂ [i] = (cipher1 [i], cipher2 [i]) (1 ≦ i ≦ r).

In the first modification, the predicate vector is configured in the same manner as in the embodiment. Note that ST is the first character s ₁ of the search keyword S. Further, when the maximum subscript of a non-null character is set to max, the (max + 1) -th character s _{max + 1 is set} to ED.

In the modification 1, each process of step S3, S4 of embodiment is changed as follows. The transmission unit 108 of the encryption information generation apparatus 100 sends the encryption information C ₁ and the r pieces of search information C ₂ [i] = (R ₁ [i], R ₂ [i]) as a set to the storage apparatus 400. Transmit (step S3a). The receiving unit 409 of the storage device 400 receives the set of cipher information and search information (C ₁ , C ₂ [1], C ₂ [2],..., C ₂ [r]) (step S4a). The storage unit 401 of the storage device 400 normally stores a plurality of (C ₁ , C ₂ [1], C ₂ [2],..., C ₂ [r]) received from the cryptographic information generation device 100. Yes. Furthermore, the storage unit 401 of the storage device 400 generally has a plurality of (C ₁ , C ₂ [1], C ₂ [2],..., C ₂ [ r]) is stored. Each group (C ₁ , C ₂ [1], C ₂ [2],..., C ₂ [r]) is associated with a unique index.

In the first modification, the processing itself in step S5 of the embodiment is not changed, but the predicate polynomial p (X _α ,..., X _β ) corresponding to each search method is changed as follows.

<< 1 >> Perfect match search method (cm)
In the first modification, the predicate polynomial p (X _α ,..., X _β ) in the exact match search method is given by equation (20).

<< 2 >> Forward matching search method (fm)
In the first modification, the predicate polynomial p (X _α ,..., X _β ) in the forward matching search method is given by equation (21).

<< 3 >> Backward match search method (bm)
In the first modification, the predicate polynomial p (X _α ,..., X _β ) in the backward matching search method is given by equation (22).

<< 4 >> Partial match search method (pm)
In the first modification, the predicate polynomial p (X _α ,..., X _β ) in the partial match search method is given by equation (23).

  << 5 >> The completely inconsistent search method (ncm) and << 6 >> the “does not include” search method (npm) are the same as in the embodiment.

In the first modification, there is no substantial change for each process after step S6 of the embodiment as long as r pieces of search information are attached to one piece of encryption information. In addition, the process of step S9 in embodiment is changed as follows. The decryption determination unit 301 of the search proxy device 300 sets all the search information as targets for the decryption determination process, and individually decrypts the search information using the decryption key k ^* to determine whether or not the search is successful ( Step S9a). Specifically, the decryption determination unit 301 obtains information R [i] for all search information according to the equation (23a) (decryption process), and determines whether R [i] = R ₁ [i] is successful or not. (Determination process).

  According to the first modification, the number of times of the decryption determination process is r times for one piece of encryption information as compared with the above-described embodiment, but the dimension of the variable vector is increased in the factorial order by using the logical sum. Compared to the above-described embodiment, there is a great merit in the case of a search using a logical sum.

[Modification 2]
In order to construct the variable vector _{Xr, 1} that does not use the logical sum while performing the retrieval using the logical sum, in the second modification, a plurality of predicate vectors are generated from a single search keyword (note that it always depends on various conditions). A plurality of predicate vectors are not generated. Here, from the viewpoint of explaining a characteristic case, it is assumed that the generated predicate vectors are “multiple”). A decryption key k ^* corresponding to each predicate vector is generated. That is, in a characteristic case, a plurality of decryption keys k ^* are generated.

Let ST be the first character w ₁ of the registration keyword W. When the maximum subscript of a non-null character is set to max, the (max + 1) -th character w _{max + 1 is set} to ED. For the registration keyword W, a partial keyword W _i (1 ≦ i ≦ r) is defined as W _i = w _i w _{i + 1} ... W _r ‖null _i . Here, null _i represents i−1 nulls. The j-th character of W _i will be expressed as _{w i, j.} Further, the first character s ₁ of the search keyword S is set to ST. Further, when the maximum subscript of a non-null character is set to max, the (max + 1) -th character s _{max + 1 is set} to ED.

  In the modification 2, each process of step S2, S5, S6, S7, S9 of embodiment is changed as follows.

The search information generation unit 102 of the encryption information generation apparatus 100 arbitrarily sets information R ₁ that can identify whether or not the search is successful (for example, zero as a numerical value), and uses the registration keyword W as the information R _1. obtain information _{R 2} is encrypted (step S2b). Specifically, the search information generation unit 102 generates the attribute vector x from the registration keyword W according to the equation (23b). x = (x ₁ , x ₂ ,..., x _n ) ∈F _q ⁿ .

Then, the search information generating unit 102 randomly selects δ ₁ , δ ₂ , ζ from F _q and calculates the equation (23c) to obtain information R ₂ . Information _{R 2} is _{R 2 = (cipher1, cipher2)} .

The key generation unit 201 of the search requesting device 200 uses the secret key (orthogonal basis B ^* ) and the search keyword S input by the user and the predicate logic of the search method $ specified by the user, for example. generating a plurality of decryption keys ^{k *} for decoding information _{R 2} included in the use information _{C 2} (step S5b).

The i-th character of the t-character search keyword S is s _i (1 ≦ i ≦ t ≦ r). If t <r, s _i = 0 (t <i ≦ r). The key generation unit 201 determines a predicate polynomial p (X _α ,..., X _β ) on X _{r, r} corresponding to the search method $ and obtains a predicate vector v on X _{r, r} as described later. . X _r, predicate polynomial p on _{r (X α, ..., X} β) method of finding a from _{X r,} predicate vector v on _r are as described above.

In the second modification, unlike the embodiment, the predicate polynomial p (X _α ,..., X _β ) corresponding to each search method is changed as follows.

<< 1 >> Perfect match search method (cm)
In the second modification, the predicate polynomial p (X _α ,..., X _β ) in the exact match search method is given by equation (24).

<< 2 >> Forward matching search method (fm)
In the second modification, the predicate polynomial p (X _α ,..., X _β ) in the forward matching search method is given by equation (25).

<< 3 >> Backward match search method (bm)
In the second modification, the predicate polynomial p (X _α ,..., X _β ) in the backward matching search method is given by Expression (26). In this case, rt + 2 predicate polynomials are obtained.

<< 4 >> Partial match search method (pm)
In the second modification, the predicate polynomial p (X _α ,..., X _β ) in the partial match search method is given by equation (27). In this case, rt + 3 predicate polynomials are obtained.

  << 5 >> The completely inconsistent search method (ncm) and << 6 >> the “does not include” search method (npm) are the same as in the embodiment.

Next, the key generation unit 201 calculates σ, v for the u predicate vectors v [c] = (v ₁ [c], v ₂ [c],..., V _n [c]) ∈F _q ⁿ . By randomly selecting η from F _q and calculating equation (28), u decryption keys k ^* [c] are obtained (1 ≦ c ≦ u). In the case of << 1 >>, << 2 >> and << 5 >>, u = 1. In the case of << 3 >>, u = rt + 2. In the case of << 4 >> and << 6 >>, u = rt−3.

The transmission unit 208 of the search request device 200 transmits u decryption keys k ^* [c] to the search proxy device 300 (step S6b). The receiving unit 309 of the search proxy device 300 receives u decryption keys k ^* [c] (step S7b).

The decryption determination unit 301 of the search proxy device 300 sets all the search information as targets for the decryption determination process, and decrypts the search information individually using u decryption keys k ^* [c]. It is determined whether or not (step S9b). Specifically, the decoding determination unit 301 obtains information R [c] for all search information according to the equation (29) (decoding process), and R [c] = R ₁ (1 ≦ c ≦ u) Success or failure is determined (determination process).

In Modification 2, although one piece of search information is attached to one piece of encrypted information, u pieces of decryption keys k ^* [c] are generated from one piece of search keyword. The number of times is u times for one piece of cipher information as compared with the above-described embodiment. However, the use of a logical sum makes the variable vector dimension larger in the factorial order, and the number of times of processing can be increased by a constant number. Therefore, in the case of a search using a logical sum, the merit is great compared to the above-described embodiment.

  In the above-described embodiment and each modification, the search agent device 300 can only grasp the connection between the search information and the encryption information in the composite determination process, so what is the content of the encryption information (information M) and the search keyword S? It does not leak to the search agent device 300.

  In addition, in the above-mentioned embodiment and each modification, it is also possible to implement the encryption information generation device 100 and the search request device 200 as the same entity. In this case, the encryption information generation device 100 may be replaced with the search request device 200 in the above-described embodiment and each modification. In the above-described embodiment and each modification, the search agent device 300 and the storage device 400 can be implemented as the same entity. In this case, the storage device 400 may be replaced with the search agent device 300 in the above-described embodiment and each modification. It is good also as a modification which combined these both forms. In these cases, the communication between the encryption information generation device 100 and the search request device 200 and the communication between the search proxy device 300 and the storage device 400 described in the above embodiment and each modification are not required. .

  Hardware entities (encryption information generation device, search request device, search proxy device, storage device) included in the keyword search system are an input unit to which a keyboard or the like can be connected, an output unit to which a liquid crystal display or the like can be connected, a hardware entity A communication unit to which a communication device (for example, a communication cable) that can communicate with the outside can be connected, a CPU (Central Processing Unit) [a cache memory, a register, or the like may be provided. ], A RAM or ROM that is a memory, an external storage device that is a hard disk, and a bus that connects the input unit, output unit, communication unit, CPU, RAM, ROM, and external storage device so that data can be exchanged have. If necessary, a hardware entity may be provided with a device (drive) that can read and write a recording medium such as a CD-ROM. A physical entity having such hardware resources includes a general-purpose computer.

  The external storage device of the hardware entity stores a program necessary for realizing the above functions and data necessary for processing the program (not limited to the external storage device, for example, reading a program) It may be stored in a ROM that is a dedicated storage device.) Data obtained by the processing of these programs is appropriately stored in a RAM or an external storage device. In the above description, a storage device such as a RAM or a register that stores an operation result, an address of a storage area thereof, or the like is simply referred to as a “storage unit”.

  In the hardware entity, each program stored in an external storage device (or ROM, etc.) and data necessary for processing each program are read into a memory as necessary, and are interpreted and executed by a CPU as appropriate. . As a result, the CPU implements predetermined functions (for example, an encryption information generation unit, a search information generation unit, a key generation unit, a decryption unit, a decryption determination unit, and a control unit).

In the details of the hardware entity described in each embodiment, numerical calculation processing in number theory may be required, but numerical calculation processing in number theory itself is achieved in the same manner as in the well-known technique. A detailed description of the arithmetic processing method and the like has been omitted (software that can perform numerical calculation processing in number theory indicating the technical level of this point includes, for example, PARI / GP, KANT / KASH, etc. About PARI / GP For example, see the Internet <URL: http://pari.math.u-bordeaux.fr/> [searched on January 13, 2010] For KANT / KASH, for example, the Internet <URL: http: / /www.math.tu-berlin.de/algebra/> [Search January 13, 2010].)
Reference literature B can be cited as a literature regarding this point.
(Reference B) H. Cohen, "A Course in Computational Algebraic Number Theory", GTM 138, Springer-Verlag, 1993.

  The present invention is not limited to the above-described embodiment, and can be appropriately changed without departing from the spirit of the present invention. In addition, the processing described in the above embodiment may be executed not only in time series according to the order of description but also in parallel or individually as required by the processing capability of the apparatus that executes the processing. .

  Further, when the processing functions in the hardware entity described in the above embodiment are realized by a computer, the processing contents of the functions that the hardware entity should have are described by a program. Then, by executing this program on a computer, the processing functions in the hardware entity are realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used. Specifically, for example, as a magnetic recording device, a hard disk device, a flexible disk, a magnetic tape or the like, and as an optical disk, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only). Memory), CD-R (Recordable) / RW (ReWritable), etc., magneto-optical recording medium, MO (Magneto-Optical disc), etc., semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory), etc. Can be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, a hardware entity is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

Claims (10)

Including at least the search request unit and the search proxy device, a keyword search system that performs keyword search by the search keyword information to the encryption information C ₁ obtained by encrypting containing the string,
Using the keyword to be searched as a registration keyword, the encryption information C ₁ is encrypted with information R ₁ that can be identified as hit or not, and the information R ₁ is encrypted by the predicate encryption method using the registration keyword. The search information C ₂ = (R ₁ , R ₂ ) , which is a set with the information R ₂ obtained in this way, is attached,
The search request device includes:
Using the search keyword, a key generating unit for the information R ₂ to generate a decryption key k ^* for decrypting by said predicate encryption scheme,
A transmission unit for transmitting the decryption key k ^* to the search agent device;
Including
The search agent device is:
A receiving unit for receiving the decryption key k ^* ;
Said decoding the information R ₂ according to the predicate encryption scheme in the decryption key k ^*, obtained information is the information R decryption determining unit that determines whether to match _a
Including
The information R ₂ is obtained by encrypting the information R ₁ with the attribute of the pre-description encryption method generated from the registration keyword ,
The decryption key k ^* is generated from a predicate of a pre-description encryption method generated from the search keyword,
The predicate encryption method is an inner product type predicate encryption method in which the true / false of the predicate logic is given by the standard inner product of the attribute vector and the predicate vector,
The attribute is a degree d composed of _r attribute variables X ₁ ,..., X _r when the maximum number of characters of the registration keyword is r and a maximum of d−1 logical sums is allowed in the previous description word logic. An attribute vector obtained by setting a character included in the registration keyword in a variable vector X _{r, d} having each component in the order in which all of the following monomials are arranged in a lexicographic order :
The predescript word is obtained by arranging predicate polynomial coefficients in which predicate logic is expressed by a polynomial expression using the attribute variable and the character included in the search keyword in the order corresponding to the components of the variable vector _{Xr, d.} A predicate vector with components,
The predescriptor polynomial is determined depending on the search method, rd _{i, j} (1 ≦ i, j ≦ r) is a random number, and the i-th character of the registration keyword W of r characters is w _i (1 ≦ 1). i ≦ r), the i-th character of the search keyword S of t characters is s _i (1 ≦ i ≦ t ≦ r),
<< 1 >> When the search method is a perfect match search method, the predescriptor polynomial is

Given in
<< 2 >> When the search method is a prefix search method, the predescriptor polynomial is

Given in
<< 3 >> When the search method is a backward match search method, the predescriptor polynomial is

Given in
<< 4 >> When the search method is a partial match search method, the predescriptor polynomial is

Keyword search system characterized by being given by. Including at least the search request unit and the search proxy device, a keyword search system that performs keyword search by the search keyword information to the encryption information C ₁ obtained by encrypting containing the string,
Using the keyword to be searched as a registration keyword, the encryption information C ₁ is encrypted with information R ₁ that can be identified as hit or not, and the information R ₁ is encrypted by the predicate encryption method using the registration keyword. The search information C ₂ = (R ₁ , R ₂ ) , which is a set with the information R ₂ obtained in this way, is attached,
The search request device includes:
Using the search keyword, a key generating unit for the information R ₂ to generate a decryption key k ^* for decrypting by said predicate encryption scheme,
A transmission unit for transmitting the decryption key k ^* to the search agent device;
Including
The search agent device is:
A receiving unit for receiving the decryption key k ^* ;
Said decoding the information R ₂ according to the predicate encryption scheme in the decryption key k ^*, obtained information is the information R decryption determining unit that determines whether to match _a
Including
The information R ₂ is obtained by encrypting the information R ₁ with the attribute of the pre-description encryption method generated from the registration keyword ,
The decryption key k ^* is generated from a predicate of a pre-description encryption method generated from the search keyword,
The predicate encryption method is an inner product type predicate encryption method in which the true / false of the predicate logic is given by the standard inner product of the attribute vector and the predicate vector,
The attribute is a degree d composed of _r attribute variables X ₁ ,..., X _r when the maximum number of characters of the registration keyword is r and a maximum of d−1 logical sums is allowed in the previous description word logic. An attribute vector obtained by setting a character included in the registration keyword in a variable vector X _{r, d} having each component in the order in which all of the following monomials are arranged in a lexicographic order :
The predescript word is obtained by arranging predicate polynomial coefficients in which predicate logic is expressed by a polynomial expression using the attribute variable and the character included in the search keyword in the order corresponding to the components of the variable vector _{Xr, d.} A predicate vector with components,
The i-th character of the registration keyword W of r characters is w _i (1 ≦ i ≦ r), where the first character w ₁ is the character string start symbol ST and the maximum non-null character subscript is max The (max + 1) -th character w _{max + 1} is the character string end symbol ED, the partial keyword W _i (1 ≦ i ≦ r) is W _i = w _i w _{i + 1} ... W _r ‖null _i , However, null _i represents the i-1 pieces of null, the j-th character of _{W i} and be represented as _{w i, j,}
The i-th character of the search keyword S of t characters is s _i (1 ≦ i ≦ t ≦ r), where the first character s ₁ is the character string start symbol ST, and the maximum non-null character When the subscript is max, the (max + 1) th character s _{max + 1} is used as the character string end symbol ED.
The attribute vector is the r generated corresponding to the r partial keyword W _i,
The encrypted information C ₁ includes r pieces of information R ₁ (hereinafter, R ₁ [i] (1 ≦ i ≦ r)) that can be identified as hit or not, and the information R ₁ [i]. The search information C ₂ (hereinafter referred to as “R ₂ [i] (1 ≦ i ≦ r)”) is obtained as a set of r pieces of information R ₂ (hereinafter referred to as R ₂ [i] (1 ≦ i ≦ r)) obtained by encrypting with the partial keyword W _i. , C ₂ [i] = (R ₁ [i], R ₂ [i]) (assuming 1 ≦ i ≦ r),
The predescriptor polynomial is determined depending on the search method, rd _{i, j} (1 ≦ i, j ≦ r) is a random number,
<< 1 >> When the search method is a perfect match search method, the predescriptor polynomial is

Given in
<< 2 >> When the search method is a prefix search method, the predescriptor polynomial is

Given in
<< 3 >> When the search method is a backward match search method, the predescriptor polynomial is

Given in
<< 4 >> When the search method is a partial match search method, the predescriptor polynomial is

Given in
The decryption determination unit decrypts the information R ₂ [i] with the decryption key k ^* for each i of 1 ≦ i ≦ r, and whether the obtained information matches the information R ₁ [i]. A keyword search system characterized by determining whether or not. Including at least the search request unit and the search proxy device, a keyword search system that performs keyword search by the search keyword information to the encryption information C ₁ obtained by encrypting containing the string,
Using the keyword to be searched as a registration keyword, the encryption information C ₁ is encrypted with information R ₁ that can be identified as hit or not, and the information R ₁ is encrypted by the predicate encryption method using the registration keyword. The search information C ₂ = (R ₁ , R ₂ ) , which is a set with the information R ₂ obtained in this way, is attached,
The search request device includes:
Using the search keyword, a key generating unit for the information R ₂ to generate a decryption key k ^* for decrypting by said predicate encryption scheme,
A transmission unit for transmitting the decryption key k ^* to the search agent device;
Including
The search agent device is:
A receiving unit for receiving the decryption key k ^* ;
Said decoding the information R ₂ according to the predicate encryption scheme in the decryption key k ^*, obtained information is the information R decryption determining unit that determines whether to match _a
Including
The information R ₂ is obtained by encrypting the information R ₁ with the attribute of the pre-description encryption method generated from the registration keyword ,
The decryption key k ^* is generated from a predicate of a pre-description encryption method generated from the search keyword,
The predicate encryption method is an inner product type predicate encryption method in which the true / false of the predicate logic is given by the standard inner product of the attribute vector and the predicate vector,
The attribute is a degree d composed of _r attribute variables X ₁ ,..., X _r when the maximum number of characters of the registration keyword is r and a maximum of d−1 logical sums is allowed in the previous description word logic. An attribute vector obtained by setting a character included in the registration keyword in a variable vector X _{r, d} having each component in the order in which all of the following monomials are arranged in a lexicographic order :
The predescript word is obtained by arranging predicate polynomial coefficients in which predicate logic is expressed by a polynomial expression using the attribute variable and the character included in the search keyword in the order corresponding to the components of the variable vector _{Xr, d.} A predicate vector with components,
The i-th character of the registration keyword W of r characters is w _i (1 ≦ i ≦ r), where the first character w ₁ is the character string start symbol ST and the maximum non-null character subscript is max The (max + 1) -th character w _{max + 1} is the character string end symbol ED, the partial keyword W _i (1 ≦ i ≦ r) is W _i = w _i w _{i + 1} ... W _r ‖null _i , However, null _i represents the i-1 pieces of null, the j-th character of _{W i} and be represented as _{w i, j,}
The i-th character of the search keyword S of t characters is s _i (1 ≦ i ≦ t ≦ r), where the first character s ₁ is the character string start symbol ST, and the maximum non-null character When the subscript is max, the (max + 1) th character s _{max + 1} is used as the character string end symbol ED.
The predescriptor polynomial is determined depending on the search method, rd _{i, j} (1 ≦ i, j ≦ r) is a random number,
<< 1 >> When the search method is a perfect match search method, the predescription polynomial is u (u = 1) predicate polynomials.

Given in
<< 2 >> When the search method is a prefix match search method, the predescription polynomial is u predicate polynomials (u = 1)

Given in
<< 3 >> When the search method is a backward match search method, the predescriptor polynomial is u (u = rt−2) predicate polynomials.

Given in
<< 4 >> When the search method is a partial match search method, the predescriptor polynomial is u (u = rt−3) predicate polynomials.

Given in
The u decryption keys k ^* are generated corresponding to u predicate polynomials (hereinafter referred to as k ^* [c] (1 ≦ c ≦ u)),
The decoding judgment unit determines for each c of 1 ≦ c ≦ u, decoding the information R ₂ in the decryption key k ^{* [c],} whether information obtained matches the information R ₁ A keyword search system characterized by Including at least the search request unit and the search proxy device, a keyword search system definitive keyword search method of performing a keyword search by the search keyword information including string for encryption information C ₁ obtained by encrypting,
Using the keyword to be searched as a registration keyword, the encryption information C ₁ is encrypted with information R ₁ that can be identified as hit or not, and the information R ₁ is encrypted by the predicate encryption method using the registration keyword. The search information C ₂ = (R ₁ , R ₂ ), which is a set with the information R ₂ obtained in this way, is attached,
The key generation portion of the search request apparatus, using the search keyword, a key generating step for said information R ₂ to generate a decryption key k ^* for decrypting by said predicate encryption scheme,
A transmission step in which the transmission unit of the search requesting device transmits the decryption key k ^* to the search agent device;
A receiving step in which a receiving unit of the search agent device receives the decryption key k ^* ;
A decryption determination unit that decrypts the information R ₂ with the decryption key k ^* according to a pre-description encryption scheme and determines whether the obtained information matches the information R ₁ And having steps
The information R ₂ is obtained by encrypting the information R ₁ with the attribute of the pre-description encryption method generated from the registration keyword ,
The decryption key k ^* is generated from a predicate of a pre-description encryption method generated from the search keyword,
The predicate encryption method is an inner product type predicate encryption method in which the true / false of the predicate logic is given by the standard inner product of the attribute vector and the predicate vector,
The attribute is a degree d composed of _r attribute variables X ₁ ,..., X _r when the maximum number of characters of the registration keyword is r and a maximum of d−1 logical sums is allowed in the previous description word logic. An attribute vector obtained by setting a character included in the registration keyword in a variable vector X _{r, d} having each component in the order in which all of the following monomials are arranged in a lexicographic order :
The predescript word is obtained by arranging predicate polynomial coefficients in which predicate logic is expressed by a polynomial expression using the attribute variable and the character included in the search keyword in the order corresponding to the components of the variable vector _{Xr, d.} A predicate vector with components,
The predescriptor polynomial is determined depending on the search method, rd _{i, j} (1 ≦ i, j ≦ r) is a random number, and the i-th character of the registration keyword W of r characters is w _i (1 ≦ 1). i ≦ r), the i-th character of the search keyword S of t characters is s _i (1 ≦ i ≦ t ≦ r),
<< 1 >> When the search method is a perfect match search method, the predescriptor polynomial is

Given in
<< 2 >> When the search method is a prefix search method, the predescriptor polynomial is

Given in
<< 3 >> When the search method is a backward match search method, the predescriptor polynomial is

Given in
<< 4 >> When the search method is a partial match search method, the predescriptor polynomial is

Given in
A keyword search method characterized by that . Including at least the search request unit and the search proxy device, a keyword search system definitive keyword search method of performing a keyword search by the search keyword information including string for encryption information C ₁ obtained by encrypting,
Using the keyword to be searched as a registration keyword, the encryption information C ₁ is encrypted with information R ₁ that can be identified as hit or not, and the information R ₁ is encrypted by the predicate encryption method using the registration keyword. The search information C ₂ = (R ₁ , R ₂ ), which is a set with the information R ₂ obtained in this way, is attached,
The key generation portion of the search request apparatus, using the search keyword, a key generating step for said information R ₂ to generate a decryption key k ^* for decrypting by said predicate encryption scheme,
A transmission step in which the transmission unit of the search requesting device transmits the decryption key k ^* to the search agent device;
A receiving step in which a receiving unit of the search agent device receives the decryption key k ^* ;
A decryption determination unit that decrypts the information R ₂ with the decryption key k ^* according to a pre-description encryption scheme and determines whether the obtained information matches the information R ₁ And having steps
The information R ₂ is obtained by encrypting the information R ₁ with the attribute of the pre-description encryption method generated from the registration keyword ,
The decryption key k ^* is generated from a predicate of a pre-description encryption method generated from the search keyword,
The predicate encryption method is an inner product type predicate encryption method in which the true / false of the predicate logic is given by the standard inner product of the attribute vector and the predicate vector,
The attribute is a degree d composed of _r attribute variables X ₁ ,..., X _r when the maximum number of characters of the registration keyword is r and a maximum of d−1 logical sums is allowed in the previous description word logic. An attribute vector obtained by setting a character included in the registration keyword in a variable vector X _{r, d} having each component in the order in which all of the following monomials are arranged in a lexicographic order :
The predescript word is obtained by arranging predicate polynomial coefficients in which predicate logic is expressed by a polynomial expression using the attribute variable and the character included in the search keyword in the order corresponding to the components of the variable vector _{Xr, d.} A predicate vector with components,
The i-th character of the registration keyword W of r characters is w _i (1 ≦ i ≦ r), where the first character w ₁ is the character string start symbol ST and the maximum non-null character subscript is max The (max + 1) -th character w _{max + 1} is the character string end symbol ED, the partial keyword W _i (1 ≦ i ≦ r) is W _i = w _i w _{i + 1} ... W _r ‖null _i , However, null _i represents the i-1 pieces of null, the j-th character of _{W i} and be represented as _{w i, j,}
The i-th character of the search keyword S of t characters is s _i (1 ≦ i ≦ t ≦ r), where the first character s ₁ is the character string start symbol ST, and the maximum non-null character When the subscript is max, the (max + 1) th character s _{max + 1} is used as the character string end symbol ED.
The attribute vector is the r generated corresponding to the r partial keyword W _i,
The encrypted information C ₁ includes r pieces of information R ₁ (hereinafter, R ₁ [i] (1 ≦ i ≦ r)) that can be identified as hit or not, and the information R ₁ [i]. The search information C ₂ (hereinafter referred to as “ R ₂ [i] (1 ≦ i ≦ r)”) is obtained as a set of r pieces of information R ₂ (hereinafter referred to as R ₂ [i] (1 ≦ i ≦ r)) obtained by encrypting with the partial keyword W _i. , C ₂ [i] = (R ₁ [i], R ₂ [i]) (assuming 1 ≦ i ≦ r),
The predescriptor polynomial is determined depending on the search method, rd _{i, j} (1 ≦ i, j ≦ r) is a random number,
<< 1 >> When the search method is a perfect match search method, the predescriptor polynomial is

Given in
<< 2 >> When the search method is a prefix search method, the predescriptor polynomial is

Given in
<< 3 >> When the search method is a backward match search method, the predescriptor polynomial is

Given in
<< 4 >> When the search method is a partial match search method, the predescriptor polynomial is

Given in
In the decryption determination step, the decryption determination unit decrypts the information R ₂ [i] with the decryption key k ^* for each i of 1 ≦ i ≦ r, and the obtained information is the information R ₁ [i ] To match
A keyword search method characterized by that . Including at least the search request unit and the search proxy device, a keyword search system definitive keyword search method of performing a keyword search by the search keyword information including string for encryption information C ₁ obtained by encrypting,
Using the keyword to be searched as a registration keyword, the encryption information C ₁ is encrypted with information R ₁ that can be identified as hit or not, and the information R ₁ is encrypted by the predicate encryption method using the registration keyword. The search information C ₂ = (R ₁ , R ₂ ), which is a set with the information R ₂ obtained in this way, is attached,
The key generation portion of the search request apparatus, using the search keyword, a key generating step for said information R ₂ to generate a decryption key k ^* for decrypting by said predicate encryption scheme,
A transmission step in which the transmission unit of the search requesting device transmits the decryption key k ^* to the search agent device;
A receiving step in which a receiving unit of the search agent device receives the decryption key k ^* ;
A decryption determination unit that decrypts the information R ₂ with the decryption key k ^* according to a pre-description encryption scheme and determines whether the obtained information matches the information R ₁ And having steps
The information R ₂ is obtained by encrypting the information R ₁ with the attribute of the pre-description encryption method generated from the registration keyword ,
The decryption key k ^* is generated from a predicate of a pre-description encryption method generated from the search keyword,
The predicate encryption method is an inner product type predicate encryption method in which the true / false of the predicate logic is given by the standard inner product of the attribute vector and the predicate vector,
The attribute is a degree d composed of _r attribute variables X ₁ ,..., X _r when the maximum number of characters of the registration keyword is r and a maximum of d−1 logical sums is allowed in the previous description word logic. An attribute vector obtained by setting a character included in the registration keyword in a variable vector X _{r, d} having each component in the order in which all of the following monomials are arranged in a lexicographic order :
The predescript word is obtained by arranging predicate polynomial coefficients in which predicate logic is expressed by a polynomial expression using the attribute variable and the character included in the search keyword in the order corresponding to the components of the variable vector _{Xr, d.} A predicate vector with components,
The i-th character of the registration keyword W of r characters is w _i (1 ≦ i ≦ r), where the first character w ₁ is the character string start symbol ST and the maximum non-null character subscript is max The (max + 1) -th character w _{max + 1} is the character string end symbol ED, the partial keyword W _i (1 ≦ i ≦ r) is W _i = w _i w _{i + 1} ... W _r ‖null _i , However, null _i represents the i-1 pieces of null, the j-th character of _{W i} and be represented as _{w i, j,}
The i-th character of the search keyword S of t characters is s _i (1 ≦ i ≦ t ≦ r), where the first character s ₁ is the character string start symbol ST, and the maximum non-null character When the subscript is max, the (max + 1) th character s _{max + 1} is used as the character string end symbol ED.
The predescriptor polynomial is determined depending on the search method, rd _{i, j} (1 ≦ i, j ≦ r) is a random number,
<< 1 >> When the search method is a perfect match search method, the predescription polynomial is u (u = 1) predicate polynomials.

Given in
<< 2 >> When the search method is a prefix match search method, the predescription polynomial is u predicate polynomials (u = 1)

Given in
<< 3 >> When the search method is a backward match search method, the predescriptor polynomial is u (u = rt−2) predicate polynomials.

Given in
<< 4 >> When the search method is a partial match search method, the predescriptor polynomial is u (u = rt−3) predicate polynomials.

Given in
The u decryption keys k ^* are generated corresponding to u predicate polynomials (hereinafter referred to as k ^* [c] (1 ≦ c ≦ u)),
In the decryption determination step, the decryption determination unit decrypts the information R ₂ with the decryption key k ^* [c] for each c of 1 ≦ c ≦ u, and the obtained information matches the information R ₁ Determine whether to
A keyword search method characterized by that . The encryption information C ₁ obtained by encrypting the information including the character string using the keyword to be searched as a registration keyword is used to register the information R ₁ that can identify whether or not it is hit and the information R _1. The search information C ₂ = (R ₁ , R ₂ ), which is a set with the information R ₂ obtained by encrypting with the predicate encryption method using the keyword for the search, is attached.
A keyword search is performed on the cipher information C ₁ using a search keyword ,
The information R ₂ is obtained by encrypting the information R ₁ with the attribute of the pre-description encryption method generated from the registration keyword ,
Said information wherein the R ₂ predicate encryption scheme decryption key for decrypting the k ^* is generated from the predicate prior written word encryption scheme that is generated from the search keyword,
The predicate encryption method is an inner product type predicate encryption method in which the true / false of the predicate logic is given by the standard inner product of the attribute vector and the predicate vector,
The attribute is a degree d composed of _r attribute variables X ₁ ,..., X _r when the maximum number of characters of the registration keyword is r and a maximum of d−1 logical sums is allowed in the previous description word logic. An attribute vector obtained by setting a character included in the registration keyword in a variable vector X _{r, d} having each component in the order in which all of the following monomials are arranged in a lexicographic order :
The predescript word is obtained by arranging predicate polynomial coefficients in which predicate logic is expressed by a polynomial expression using the attribute variable and the character included in the search keyword in the order corresponding to the components of the variable vector _{Xr, d.} A predicate vector with components,
The predescriptor polynomial is determined depending on the search method, rd _{i, j} (1 ≦ i, j ≦ r) is a random number, and the i-th character of the registration keyword W of r characters is w _i (1 ≦ 1). i ≦ r), the i-th character of the search keyword S of t characters is s _i (1 ≦ i ≦ t ≦ r),
<< 1 >> When the search method is a perfect match search method, the predescriptor polynomial is

Given in
<< 2 >> When the search method is a prefix search method, the predescriptor polynomial is

Given in
<< 3 >> When the search method is a backward match search method, the predescriptor polynomial is

Given in
<< 4 >> When the search method is a partial match search method, the predescriptor polynomial is

Given in
At least retrieval request device a search proxy device an the search request unit included in the free inorganic keyword search system,
And a key generation unit for generating a pre-Kifuku No. key k ^*,
A search requesting device including a transmitting unit that transmits the decryption key k ^* to the search agent device. The encryption information C ₁ obtained by encrypting the information including the character string using the keyword to be searched as a registration keyword is used to register the information R ₁ that can identify whether or not it is hit and the information R _1. The search information C ₂ = (R ₁ , R ₂ ), which is a set with the information R ₂ obtained by encrypting with the predicate encryption method using the keyword for the search, is attached.
A keyword search is performed on the cipher information C ₁ using a search keyword ,
The information R ₂ is obtained by encrypting the information R ₁ with the attribute of the pre-description encryption method generated from the registration keyword ,
Said information wherein the R ₂ predicate encryption scheme decryption key for decrypting the k ^* is generated from the predicate prior written word encryption scheme that is generated from the search keyword,
The predicate encryption method is an inner product type predicate encryption method in which the true / false of the predicate logic is given by the standard inner product of the attribute vector and the predicate vector,
The attribute is a degree d composed of _r attribute variables X ₁ ,..., X _r when the maximum number of characters of the registration keyword is r and a maximum of d−1 logical sums is allowed in the previous description word logic. An attribute vector obtained by setting a character included in the registration keyword in a variable vector X _{r, d} having each component in the order in which all of the following monomials are arranged in a lexicographic order :
The predescript word is obtained by arranging predicate polynomial coefficients in which predicate logic is expressed by a polynomial expression using the attribute variable and the character included in the search keyword in the order corresponding to the components of the variable vector _{Xr, d.} A predicate vector with components,
The predescriptor polynomial is determined depending on the search method, rd _{i, j} (1 ≦ i, j ≦ r) is a random number, and the i-th character of the registration keyword W of r characters is w _i (1 ≦ 1). i ≦ r), the i-th character of the search keyword S of t characters is s _i (1 ≦ i ≦ t ≦ r),
<< 1 >> When the search method is a perfect match search method, the predescriptor polynomial is

Given in
<< 2 >> When the search method is a prefix search method, the predescriptor polynomial is

Given in
<< 3 >> When the search method is a backward match search method, the predescriptor polynomial is

Given in
<< 4 >> When the search method is a partial match search method, the predescriptor polynomial is

Given in
At least retrieval request device a search proxy device an the search proxy device included in the free inorganic keyword search system,
A receiving unit for the front Kifuku No. key k ^*, receiving from the search request device,
It said predicate encryption method said information R ₂ is decrypted by the decryption key k ^* accordingly search proxy device including a resulting information is the information R decryption determining unit that determines whether matching _1. A program for causing a computer to function as the search request device according to claim 7 or the search agent device according to claim 8 . A computer-readable recording medium on which the program according to claim 9 is recorded.

Images