JP2004334362A - Access log management method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an access log management method for enabling an information presentation requirement source to search an access log to obtain the position of necessary information without false detection, and enabling the confirmation of the authenticity of a disclosed record. <P>SOLUTION: A server manager encrypts each word in the access log, and presents it to the information presentation requirement source as an encrypted log C. The information presentation requirement source searches the encrypted log by a retrieving keyword ω obtained by converting a keyword W by the same cipher, and requires a disclosure of the record corresponding to an identifier I of the corresponding record. The server manager discloses only a plaintext R of the corresponding record to the information presentation requirement source. Thereby, the server manager need not disclose a plaintext except the corresponding record, and the information presentation requirement source can specify the position of the keyword. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

【数２】

【００２３】
準備としてステップＳ１でサーバ管理者は公開鍵Ｐ_１と秘密鍵Ｓ_１を作成し、ステップＳ２でこの公開鍵Ｐ_１を公開する。続くアクセスログの記録では、ステップＳ３でサーバ管理者は平文ログＭのレコード（Ｉ^ｉ，Ｒ^ｉ）を記録し、ステップＳ４で公開鍵Ｐ_１を用いてレコードＲ^ｉが生成される度に、提出用の暗号ログＣ^ｉを数３に示すように作成し、この暗号ログＣをＣ＝｛（Ｉ^１，Ｃ^１），（Ｉ^２，Ｃ^２），……（Ｉ^ｎ，Ｃ^ｎ）｝の形で記録する。ここでＣ^ｉ _１〜Ｃ^ｉ _ｍｉは数４で表され、Ｅ_Ｐ１（ｗ^ｉ _ｊ）を公開鍵Ｐ_１でワードｗ^ｉ _ｊを暗号化したものとするとき、数５を数６と書くことがある。
【数３】

【数４】

【数５】

【数６】

【００２４】
ステップＳ２での公開鍵Ｐ_１の公開により、ステップＳ５で公開鍵Ｐ_１を取得した情報提出要求元は、ステップＳ６でアクセスログの提出要求をしたとする。サーバ管理者がステップＳ７でこの要求があったことを判定すると、ステップＳ８でサーバ管理者は数２で示した暗号ログＣを提出する。
【００２５】
一方、情報提出要求元は、検索キーワードの作成を行う。つまり、情報提出要求元はステップＳ９でのキーワードＷを用い、ステップＳ１０で公開鍵Ｐ_１を用いてキーワードＷに対応する検索キーワードＥ_Ｐ１（Ｗ）＝ωを計算する。その後、ステップＳ１１でサーバ管理者から押収した暗号ログＣ上で検索キーワードＥ_Ｐ１（Ｗ）＝ωを含む暗号レコード（Ｉ^ｉ，Ｃ^ｉ）を検索する。この検索の結果、ステップＳ１２で該当するレコード（Ｉ^Ｌ，Ｃ^Ｌ）が見つかったと判定された場合、見つかったＣ^ｊ _ｊをＣ^Ｌ _ｊで表すと共に、そのレコードの識別子Ｉ^Ｌを得、ステップＳ１３でこの識別子Ｉ^Ｌのレコードの開示を要求する。
【００２６】
サーバ管理者はこの要求をステップＳ１４で判定し、これに対してステップＳ１５で該当する平文ログのレコードＲ^Ｌを開示する。ここで情報提出要求元は、数７で示したようにサーバ管理者がワードｗであると主張している＊ｗから成るレコード＊Ｒ^Ｌを受け取り、ステップＳ１５で公開鍵Ｐ_１を用いて開示されたレコード＊Ｒ^Ｌ の正当性を検証する。つまり、数８が成り立つことによって数９が成り立つことを検証することができる。
【数７】

【数８】

【数９】

【００２７】
上述した点を、さらに図２を用いて具体的に説明する。
管理者は公開鍵Ｐ_１と秘密鍵Ｓ_１とのペアを作成して公開鍵Ｐ_１を公開する。Ｅ_Ｐ１（ａ）＝α、Ｅ_Ｐ１（ｂ）＝β、Ｅ_Ｐ１（ｃ）＝γ、Ｅ_Ｐ１（ｄ）＝δ、Ｅ_Ｐ１（ｅ）＝εとおき、以下、この関係をＥ_Ｐ１（｛ａ，ｂ，ｃ，ｄ，ｅ｝）＝｛α，β，γ，δ，ε｝と略記すると、平文ログＭは、Ｍ＝｛（Ｉ^１，｛ａ，ｂ，ｃ，ｄ｝），（Ｉ^２，｛ａ，ｄ，ｂ，ｂ｝），（Ｉ^３，｛ｂ，ａ，ｃ，ｅ｝となり、この平文ログＭから作成される暗号ログＣは、Ｃ＝｛（Ｉ^１，｛α，β，γ，δ｝），（Ｉ^２，｛α，δ，β，β｝），（Ｉ^３，｛β，α，γ，ε｝となる。
【００２８】
捜査開始によって情報提出要求元が暗号ログＣを押収すると、キーワードＷと公開鍵Ｐ_１とからω＝Ｅ_Ｐ１（Ｗ）を作成し、このωと一致するＣ^ｊ _ｊを見つける。ここで、Ｗ＝ｅとすれば、ω＝εであり、３番目のレコードに一致することが分かる。そこで情報提出要求元はサーバ管理者から識別子Ｉ^３のレコードの平文＊Ｒ^３＝｛＊ｗ_０ ^３ _１，＊ｗ^３ _２，＊ｗ^３ _３，＊ｗ^３ _４｝−｛＊ｂ_０，＊ａ，＊ｃ，＊ｅ｝を受ける。そこで、数１０を確認することによって｛＊ｂ，＊ａ，＊ｃ，＊ｅ｝が正当な平文｛β，α，γ，ε｝であることを検証することができる。
【００２９】
アクセスログ管理方法としては、次に列挙する性質を満たすように構成するのが望ましい。つまり、性質１として、開示すべきレコード以外のレコードは可能な限り情報提出要求元に知られないこと、また性質２として、情報提出要求元は指定した文字列を含むレコード全ての位置を検出でき、かつ誤検出がないこと、さらに性質３として、情報提出要求元は開示されたレコードの真正性を検証できることである。上述したアクセスログ監視方法は、情報提出要求元が指定した文字列を含むレコード全ての位置を検出でき、かつ誤検出がないこと、また情報提出要求元は開示されたレコードの真正性を検証できるという性質２および性質３の必須要件を満足する。
【００３０】
本発明の他の実施の形態によるアクセスログ管理方法として、必須条件である性質２と性質３を満たすために、サーバ管理者は、アクセスログ中の各ワードの一方向性関数値を暗号ログとして情報提出要求元に提出するようにしてもよい。情報提出要求元はキーワードを同じ一方向性関数で変換して得られる暗号キーワードで、暗号ログ中の検索を行う。こうすることによって、サーバ管理者はログの平文を開示せずに済み、かつ、情報提出要求元はキーワードの位置を特定できる。サーバ管理者は、キーワードが見つかった位置に対応する該当レコードの平文を情報提出要求元に開示する。誤検出が起こらないためには、この一方向性関数は１対１間写像であればよい。このようにして上述した性質２が満足される。開示された平文が真正であることの検証は、開示された平文を一方向性関数で変換した結果が、予め提出されていた一方向性関数値に一致するかどうかを確認することによって達成され、従って、上述した性質３も満足される。
【００３１】
図４は、本発明の他の実施の形態によるアクセスログ監視方法を採用したアクセスログ監視装置の動作を示すフローチャートである。
先の実施の形態でサーバ管理者が提示するのは、公開鍵Ｐ_１の他に、暗号ログＣと情報提供要求元の検索によって選出された識別子Ｉ^Ｌのレコードの平文Ｒ^Ｌのみである。しかし、情報提供要求元が任意のキーワードＷを自由に暗号化して検索キーワードＥ_Ｐ１（Ｗ）を作成できるため、様々なキーワードＷで繰り返し検索するような総当り処理を行うことによって、直接関係のないログ全体の平文が徐々に判明していくという弱さがある。そこで、この弱さを解決するためには、キーワードＷについてサーバ管理者の同意があってはじめて検索できるようにし、情報提供要求元が自由にキーワードＷを暗号化して検索を行うことを防ぐようにすればよい。
【００３２】
本実施の形態では、検索用キーワードを平文のキーワードから直接作るのではなく、サーバ管理者のみが知る情報を用いて変換したキーワード（以下、これを検索用キーワードの素Ｗ´と称する）から作るようにしている。勿論、この検索用キーワードの素Ｗ´の正当性は、情報提供要求元によって検証可能でなければならないが、このような性質をもつ変換は、ディジタル署名を用いることによって実現できる。この変換を加えた手順においても、検索が可能であるためには、暗号ログの各ワードも暗号化する前に同様の変換が施されていることが必要である。
【００３３】
これらを実現するために、図４に示した準備としてのステップＳ１で、サーバ管理者は公開鍵Ｐ_０と秘密鍵Ｓ_０の第一のペアおよび公開鍵Ｐ_１と秘密鍵Ｓ_１の第二のペアをそれぞれ作成し、ステップＳ２で公開鍵Ｐ_０および公開鍵Ｐ_１を公開する。続くアクセスログの記録では、ステップＳ３でサーバ管理者は平文ログＭのレコード（Ｉ^ｉ，Ｒ^ｉ）を記録し、ステップＳ４で秘密鍵Ｓ_０および公開鍵Ｐ_１を用いてレコードＲ^ｉが生成される度に、提出用の暗号ログＣ^ｉを数３に示すように作成し、この暗号ログＣをＣ＝｛（Ｉ^１，Ｃ^１），（Ｉ^２，Ｃ^２），……（Ｉ^ｎ，Ｃ^ｎ）｝の形で記録する。ここでＣ^ｉ _１はサーバ管理者の秘密鍵Ｓ_０で署名されたワードｗ^ｉ _ｊ＝Ｅ_Ｓ０（ｗ^ｉ _ｊ）を公開鍵Ｐ_１でさらに暗号化したもので、Ｃ^ｉ _１＝Ｅ_Ｐ１（Ｅ_Ｓ０（ｗ^ｉ _ｊ））である。
【００３４】
ステップＳ２での公開鍵Ｐ_０，Ｐ_１の公開により、ステップＳ５で公開鍵Ｐ_０，Ｐ_１を取得した情報提出要求元は、ステップＳ６でアクセスログの提出要求をしたとする。サーバ管理者がステップＳ７でこの要求があったことを判定すると、ステップＳ８でサーバ管理者は数２で示した暗号ログＣを提出する。
【００３５】
この暗号ログＣを受け取った情報提出要求元は、ステップＳ１７でキーワードＷをサーバ管理者に提示する。これを受け取ったサーバ管理者は、ステップＳ１８としてキーワードＷを用いての検索に同意した場合、検索キーワードの素Ｗ´を計算してＷ´＝Ｅ_Ｓ０（Ｗ）を情報提出要求元に渡す。この検索キーワードの素Ｗ´を受け取った情報提出要求元は、ステップＳ１９として検索キーワードの素Ｗ´の検証を行う。つまり、サーバ管理者が検索キーワードの素Ｗ´であると主張する＊Ｗ´に対して、公開鍵Ｐ_０を用いてＥ_Ｐ０（＊Ｗ´）＝Ｗとなることを確認することによって検索キーワードの素Ｗ´の正当性を検証することができる。
【００３６】
情報提出要求元は、続いてステップＳ１０として検索キーワードの作成を行い、検証された検索キーワードの素Ｗ´から、公開鍵Ｐ_１を用いて検索キーワードＥ_Ｐ１（Ｗ´）＝ω´＝Ｅ_Ｐ１（Ｅ_Ｓ０（Ｗ））を計算する。その後、ステップＳ１１でサーバ管理者から押収した暗号ログＣ上で検索キーワードＥ_Ｐ１（Ｗ´）＝ω´を含む暗号レコード（Ｉ^ｉ，Ｃ^ｉ）を検索する。この検索の結果、ステップＳ１２で該当するレコード（Ｉ^Ｌ，Ｃ^Ｌ）が見つかったと判定された場合、見つかったＣ^ｊ _ｊをＣ^Ｌ _ｊで表すと共に、情報提出要求元はそのレコードの識別子Ｉ^Ｌを得、ステップＳ１３でこの識別子Ｉ^Ｌのレコードの開示をサーバ管理者に要求する。
【００３７】
サーバ管理者はこの要求をステップＳ１４で判定し、これに対してステップＳ１５で該当する平文ログのレコードＲ´^Ｌを秘密鍵Ｓ_０で署名したものを開示する。こうして情報提出要求元は、サーバ管理者が該当する平文ログのレコードＲ´^Ｌを秘密鍵Ｓ_０で署名したものだと主張する数１０で示したレコード＊Ｒ´^Ｌを受け取る。
【数１０】

【００３８】
このレコード＊Ｒ´^Ｌを受け取った情報提出要求元は、ステップＳ１６で公開鍵Ｐ_１を用いて開示されたレコード＊Ｒ´^Ｌ の正当性を検証する。つまり、数１１が成り立つことによってサーバ管理者から受け取ったレコード＊Ｒ´^Ｌ の正当性を検証する。その後、情報提出要求元は、ステップＳ２０でレコードＲ´^Ｌから公開鍵Ｐ_０を用いて数１２を計算してレコードの平文Ｒ^Ｌを得る。
【数１１】

【数１２】

【００３９】
本実施の形態で先に示した実施の形態と異なるのは、検索用の暗号ログの要素がＣ^ｊ _ｊ＝Ｅ_Ｐ１（Ｗ^ｊ _ｊ）であったのに対して、Ｃ^ｊ _ｊ＝Ｅ_Ｐ１（Ｅ_Ｓ０（Ｗ^ｊ _ｊ））としていること、また該当する平文を開示するのではなく平文を署名したものを開示している点である。前者は、情報提出要求元が任意のキーワードで勝手な検索ができないようにするためであり、後者は、平文を開示したのでは押収した暗号ログのレコードに対応するかどうかを情報提出要求元が検証できないためである。
【００４０】
上述した点を図３を用いて具体的に説明する。
サーバ管理者は、鍵ペアである公開鍵Ｐ_０と暗号鍵Ｓ_０および他の鍵ペアである公開鍵Ｐ_１と暗号鍵Ｓ_１を作成し、それぞれの公開鍵Ｐ_０，Ｐ_１をそれぞれ公開する。Ｅ_Ｓ０（｛ａ，ｂ，ｃ，ｄ，ｅ｝）＝｛ａ´，ｂ´，ｃ´，ｄ´，ｅ´｝、Ｅ_Ｐ１（｛ａ´，ｂ´，ｃ´，ｄ´，ｅ´｝）＝｛α´，β´，γ´，δ´，ε´｝とすると、平文ログＭ＝｛（Ｉ^１，｛ａ，ｂ，ｃ，ｄ｝），（Ｉ^２，｛ａ，ｄ，ｂ，ｂ｝），Ｉ^３，｛ｂ，ａ，ｃ，ｅ｝）｝となり、これに対応する暗号ログＣは、Ｃ＝｛（Ｉ^１，｛α´，β´，γ´，δ´｝），（Ｉ^２，｛α´，δ´，β´，β´｝），Ｉ^３，｛β´，α´，γ´，ε´｝）｝となる。
【００４１】
捜査が開始されて情報提出要求元が暗号ログＣを押収したとする。情報提出要求元はキーワードＷを指定して検索を行う。ここではキーワードＷ＝ｅとする。情報提出要求元はサーバ管理者にキーワードｅを渡す。サーバ管理者はＷ´＝Ｅ_Ｓ０（ｅ）を計算し、この検索用キーワードの素を情報提出要求元に渡す。これを受けた情報提出要求元は、検索用キーワードの素Ｗ´として受け取った＊Ｗ´に対して、公開鍵Ｐ_０を用いてＤＰ_０（＊Ｗ´）＝ｅとなることを確認することにより、＊Ｗ´＝Ｗ´＝Ｅ_Ｓ０（ｅ）であることを検証することができる。その後、情報提出要求元は、公開鍵Ｐ_１を用いてＷ´から検索キーワードω´＝Ｅ_Ｐ１（Ｗ´）＝Ｅ_Ｐ１（Ｅ_Ｓ０（ｅ））＝ε´を作成する。
【００４２】
これと一致するＣ^ｊ _ｊは３番目のレコードに見つけることができるので、情報提出要求元は識別子Ｉ^３のレコードの開示用データをサーバ管理者に要求する。これを受けたサーバ管理者は、開示用データＥ_Ｓ０（｛ｂ，ａ，ｃ，ｅ｝）＝｛ｂ´，ａ´，ｃ´，ｅ´｝を情報提出要求元に渡す。情報提出要求元は、開示用データ｛ｂ´，ａ´，ｃ´，ｅ´｝として受け取った｛＊ｂ´，＊ａ´，＊ｃ´，＊ｅ´｝に対して、公開鍵Ｐ_１を用いて、Ｅ_Ｐ１｛＊ｂ´，＊ａ´，＊ｃ´，＊ｅ´｝＝｛β´，α´，γ´，ε´｝であることを確認することによって正当な開示用データＲ´^３＝｛ｂ´，ａ´，ｃ´，ｅ´｝を受け取ったことを検証することができる。続いて情報提出要求元は、検証されたこの開示用データＲ´^３｛ｂ´，ａ´，ｃ´，ｅ´｝から、公開鍵Ｐ_０を用いて、Ｄ_Ｐ０（｛ｂ´，ａ´，ｃ´，ｅ´｝）＝｛ｂ，ａ，ｃ，ｅ｝なる平文を得る。
【００４３】
この実施の形態では、検索キーワードとしてＥ_Ｐ１（Ｅ_Ｓ０（ｅ））を用いているため、秘密鍵Ｓ_０を知っているサーバ管理者の同意がなければ、情報提出要求元は検索を行うことができないので、先の実施の形態の場合のように総当り処理によって関係ない他の平文が明らかになることはなく、総当り処理に対する耐性を備えている。
【００４４】
しかし、開示された平文｛ｂ，ａ，ｃ，ｅ｝と検索用暗号文｛β´，α´，γ´，ε´｝との対応関係が情報提出要求元に知られてしまう。サーバ管理者が同意したキーワードであるｅとεとの対応が知られることは当然であるが、他のワードであるａ，ｂ，ｃを検索するための暗号文が知られることは望ましくない。何故なら、それによってそれらを含んでいる他のレコードの内容が露呈してしまうからである。これを解決するためには、次のような対策が必要である。
【００４５】
つまり、第一の要件として同じワードであってもレコードが異なれば暗号文が異なるようにすること、第二の要件としてサーバ管理者から渡される特定のレコードの開示情報からそれ以外のレコードの情報の推測が困難であるようにすることが必要である。第一の要件に対しては、各ワードを暗号化する際に、暗号化結果が各レコードに固有な情報、例えば、レコード識別子Ｉ^ｉに依存して変わるように各ワードにレコード識別子Ｉ^ｉを付加して暗号化することによって実現できる。
【００４６】
第二の要件を詳細に分析すると次のようになる。平文の開示という目的から、第三要件として開示データから平文が得られる必要がある。一方、開示データが押収した暗号ログのレコードに確かに対応するものであることを情報提出要求元が検証できるためには、第三の要件として情報提出要求元が利用できる情報（開示データ、公開鍵Ｐ_０、公開鍵Ｐ_１、レコード識別子Ｉ^Ｌなど）から 暗号ログ中のレコードが構成できなければならない。ところが、第三要件と第四要件を同時に満足すると、情報提出要求元が開示されたレコードの平文ログ中のワードと、暗号ログ中の任意のレコード識別子Ｉ^ｉのレコードのワードとの対応関係を調べることができることになってしまう。従って、第二の要件を満足するためには、第三要件あるいは第四要件のどちらかの要求をなくす必要がある。第三要件は開示の本来の目的であるので、必然的に第四要件の性質をもたない、すなわち検証が不要となる開示方法が必要となる。
【００４７】
そこでレコードの開示方法を次のようにする。
サーバ管理者は、ログの生成に応じて、レコード単位で開示できる開示用暗号ログＶ＝｛（Ｉ^１，Ｖ^１），（Ｉ^２，Ｖ^２），……，（Ｉ^ｎ，Ｖ^ｎ）｝をも機械的に作成するようにする。情報提出要求元は暗号ログＣと開示用暗号ログＶを共に押収する。押収時において、開示用暗号ログＶは暗号ログＣと同様に適切に作成されており、また押収時にはサーバ管理者による改ざんを受けていないと仮定されるので、検証の必要がない。ただし、Ｖ´を解読するための鍵の検証は必要である。そこで、Ｖ´は情報提出要求元では作成することができず、かつ、その正当性を情報提出要求元が公開鍵Ｐ_０とレコード識別子Ｉ^ｉを用いて検証できるような鍵Ｋ´を用いて復号化できるようにレコードＲ^ｉを暗号化したものとすればよい。具体的には、復号鍵をＫ^ｉ＝Ｅ_Ｓ０（Ｉ^ｉ）とし、簡単化のために暗号鍵も同じになる共通鍵暗号系Ｆを用いて、Ｖ^ｉ＝Ｆ_Ｋｉ（Ｒ^ｉ）とする。共通鍵Ｋ^ｉの検証は、Ｉ^ｉ＝Ｅ_Ｐ０（Ｋ´）が成り立つことを確認することによって行うことができる。
【００４８】
図５は、上述したレコードの開示方法を反映させた本発明のさらに他の実施の形態によるアクセスログ監視装置の動作を示すフローチャートである。
先ず、ステップＳ１で、サーバ管理者は公開鍵Ｐ_０と秘密鍵Ｓ_０の第一のペアおよび公開鍵Ｐ_１と秘密鍵Ｓ_１の第二のペアをそれぞれ作成し、ステップＳ２で公開鍵Ｐ_０および公開鍵Ｐ_１を公開する。続くアクセスログの記録では、ステップＳ３でサーバ管理者は平文ログＭのレコード（Ｉ^ｉ，Ｒ^ｉ）を記録し、ステップＳ４で秘密鍵Ｓ_０および公開鍵Ｐ_１を用いてレコードＲ^ｉが生成される度に、提出用の暗号ログＣ^ｉを数３に示すように作成し、この暗号ログＣをＣ＝｛（Ｉ^１，Ｃ^１），（Ｉ^２，Ｃ^２），……（Ｉ^ｎ，Ｃ^ｎ）｝の形で記録する。ここでＣ^ｉ _１はサーバ管理者の秘密鍵Ｓ_０で署名されたワードｗ^ｉ _ｊ＝Ｅ_Ｓ０（ｗ^ｉ _ｊ）を公開鍵Ｐ_１でさらに暗号化したもので、Ｃ^ｉ _１＝Ｅ_Ｐ１（Ｉ^ｉ｜Ｅ_Ｓ０（ｗ^ｉ _ｊ））である。ここで｜は連接を表している。
【００４９】
さらにステップＳ２１でサーバ管理者は、開示用暗号ログの記録、つまりＲ^ｉが生成される度に、数１２に示した開示用暗号ログＶ^ｉも同時に作成する。ステップＳ２での公開鍵Ｐ_０，Ｐ_１の公開により、ステップＳ５で公開鍵Ｐ_０，Ｐ_１を取得した情報提出要求元は、ステップＳ６でアクセスログの提出要求をしたとする。サーバ管理者がステップＳ７でこの要求があったことを判定すると、ステップＳ８でサーバ管理者は数２で示した暗号ログＣを提出する。
【００５０】
この暗号ログＣを受け取った情報提出要求元は、ステップＳ１７でキーワードＷをサーバ管理者に提示する。これを受け取ったサーバ管理者は、ステップＳ１８としてキーワードＷを用いての検索に同意した場合、検索キーワードの素Ｗ´を計算してＷ´＝Ｅ_Ｓ０（Ｗ）を情報提出要求元に渡す。この検索キーワードの素Ｗ´を受け取った情報提出要求元は、ステップＳ１９として検索キーワードの素Ｗ´の検証を行う。つまり、サーバ管理者が検索キーワードの素Ｗ´であると主張する＊Ｗ´に対して、公開鍵Ｐ_０を用いてＥ_Ｐ０（＊Ｗ´）＝Ｗとなることを確認することによって検索キーワードの素Ｗ´の正当性を検証することができる。
【００５１】
情報提出要求元は、続いてステップＳ１０として検索キーワードの作成を行い、検証された検索キーワードの素Ｗ´から、公開鍵Ｐ_１を用いて各レコードの識別子Ｉ^ｉ毎に検索キーワードＥ_Ｐ１（Ｉ^ｉ｜Ｗ´）＝ω´＝Ｅ_Ｐ１（Ｉ^ｉ｜Ｅ_Ｓ０（Ｗ））を計算する。その後、ステップＳ１１でサーバ管理者から押収した暗号ログＣ上で検索キーワードＥ_Ｐ１（Ｉ^ｉ｜Ｗ´）＝ω´を含む暗号レコード（Ｉ^ｉ，Ｃ^ｉ）を検索する。この検索の結果、ステップＳ１２で該当する検索キーワードω^ＬおよびＣ^Ｌ _ｊが一致するレコードＲ^Ｌが見つかったと判定された場合、情報提出要求元はそのレコードの識別子Ｉ^Ｌを得、ステップＳ１３でこの識別子Ｉ^Ｌのレコードの開示をサーバ管理者に要求する。
【００５２】
サーバ管理者はこの要求をステップＳ１４で判定し、これに対してステップＳ１５で該当する平文ログの開示用暗号ログＶ^Ｌを複合化するための開示用複合鍵Ｋ^Ｌ＝Ｅ_Ｓ０（Ｉ^Ｌ）を計算して情報提出要求元に渡す。こうして情報提出要求元は、サーバ管理者が該当する開示用複合鍵Ｋ^Ｌだと主張する＊Ｋ^Ｌを受け取る。この開示用複合鍵だと思われる＊Ｋ^Ｌを受け取った情報提出要求元は、ステップＳ１６で公開鍵Ｐ_０を用いて開示された＊Ｋ^Ｌ の正当性を検証する。つまり、Ｉ^Ｌ＝Ｅ_Ｐ０（＊Ｋ^Ｌ）が成り立つことによってサーバ管理者から受け取った＊Ｋ^Ｌ の正当性を検証する。その後、情報提出要求元は、検証された開示用複合鍵Ｋ^Ｌを用いて開示用暗号ログＶ^Ｌから数１３を計算してレコードの平文Ｒ^Ｌを得る。
【数１３】

【００５３】
上述した点を図６を用いて具体的に説明する。
サーバ管理者は、２つの鍵ペア、つまり公開鍵Ｐ_０と秘密鍵Ｓ_０および公開鍵Ｐ_１と秘密鍵Ｓ_１を作成し、それぞれの公開鍵Ｐ_０，Ｐ_１とを公開する。Ｅ_Ｓ０（｛ａ，ｂ，ｃ，ｄ，ｅ｝）＝｛ａ´，ｂ´，ｃ´，ｄ´，ｅ´｝、Ｅ_Ｐ１（｛Ｉ^ｉ｜ａ´，Ｉ^ｉ｜ｂ´，Ｉ^ｉ｜ｃ´，Ｉ^ｉ｜ｄ´，Ｉ^ｉ｜ｅ´｝）＝｛α^ｉ，β^ｉ，γ^ｉ，δ^ｉ，ε^ｉ｝とすると、平文ログＭ＝｛（Ｉ^１，｛ａ，ｂ，ｃ，ｄ｝），（Ｉ^２，｛ａ，ｄ，ｂ，ｂ｝），Ｉ^３，｛ｂ，ａ，ｃ，ｅ｝）｝となり、これに対応する暗号ログＣは、Ｃ＝｛（Ｉ^１，｛α^１，β^１，γ^１，δ^１｝），（Ｉ^２，｛α^２，δ^２，β^２，β^２｝），Ｉ^３，｛β^３，α^３，γ^３，ε^３｝）｝となる。またＫ^ｉ＝Ｅ_Ｓ０（Ｉ^ｉ）とおくと、開示用暗号ログＶは、数１４となる。
【数１４】

【００５４】
捜査が開始されて情報提出要求元が暗号ログＣおよび開示用暗号ログＶを押収したとする。情報提出要求元はキーワードＷを指定して検索を行う。ここではキーワードＷ＝ｅとする。情報提出要求元はサーバ管理者にキーワードｅを渡す。サーバ管理者は検索用キーワードの素Ｗ´＝Ｅ_Ｓ０（ｅ）を計算し、この検索用キーワードの素Ｗ´を情報提出要求元に渡す。これを受けた情報提出要求元は、検索用キーワードの素Ｗ´として受け取った＊Ｗ´に対して、公開鍵Ｐ_０を用いてＤＤ_Ｐ０（＊Ｗ´）＝ｅとなることを確認することにより、＊Ｗ´＝Ｗ´＝Ｅ_Ｓ０（ｅ）＝ｅ´であることを検証することができる。その後、情報提出要求元は、公開鍵Ｐ_１を用いて各レコードＫ^ｉ内を検索するための検索用キーワードω^１＝Ｅ_Ｐ１（Ｉ^１｜Ｗ^１）、ω^２＝Ｅ_Ｐ１（Ｉ^２｜Ｗ^２）、ω^３＝Ｅ_Ｐ１（Ｉ^３｜Ｗ^３）を作成する。
【００５５】
識別子Ｉ^３のレコードにω^３＝Ｃ^３ _４を見つけることができるので、情報提出要求元は識別子Ｉ^３のレコードの開示用複合鍵Ｋ^３をサーバ管理者に要求する。これを受けたサーバ管理者は、Ｋ^３＝Ｅ_Ｓ０（Ｉ^３）を計算してこれを情報提出要求元に渡す。情報提出要求元は、開示用複合鍵Ｋ^３として受け取った＊Ｋ^３に対して、公開鍵Ｐ_０を用いて、Ｉ^３＝Ｄ_Ｐ０（Ｋ^３）であることを確認することによって正当な開示用複合鍵Ｋ^３を受け取ったことを検証することができる。続いて情報提出要求元は、検証されたこの開示用複合鍵Ｋ^３を用いて数１５で示す当該レコードの平文を得ることができる。
【数１５】

【００５６】
この実施の形態によるアクセスログ監視方法によれば、異なるレコードに含まれている同一のワードは、異なる暗号文に変換されているため、情報提出要求元はＲ^３＝｛ｂ，ａ，ｃ，ｅ｝と｛β^３，α^３，γ^３，ε^３｝の対応を知ることができるが、α^１，β^１，γ^１，α^２，β^２，γ^２を知らないので、サーバ管理者が開示しなかった１行目や２行目の内容が明らかになることはない。
【００５７】
上述したアクセスログ監視方法の実施に際して、無料でＷｅｂページを公開できるサイトのサーバ管理者は、２組の公開鍵Ｐ_０，Ｐ_１および秘密鍵Ｓ_０，Ｓ_１を作成し、それぞれの公開鍵Ｐ_０，Ｐ_１を公開する。サーバ管理者は、ファイルのアップロード／ダウンロードに関わる記録をレコードＲ^ｉ＝｛ｔｉｍｅ^ｉ，ｃｌｉｅｎｔＩＰ^ｉ，ａｃｔｉｏｎ^ｉ，ｆｉｌｅ＿ｎａｍｅ^ｉ｝の形でとり、アクセスログＭ＝｛（Ｉ^１，Ｒ^１），（Ｉ^２，Ｒ^２），（Ｉ^３，Ｒ^３）｝を記録すると共に、暗号ログＣ＝｛（Ｉ^１，Ｃ^１），（Ｉ^２，Ｃ^２），（Ｉ^３，Ｃ^３）｝、また開示用暗号ログＶ＝｛（Ｉ^１，Ｖ^１），（Ｉ^２，Ｖ^２），（Ｉ^３，Ｖ^３）｝を記録する。ここで、Ｃ^ｉ＝Ｅ_Ｐ１（Ｉ^ｉ｜Ｅ_Ｓ０（Ｒ^ｉ）、Ｖ^ｉ＝Ｆ_Ｋｉ（Ｒ^ｉ）、Ｋ^ｉ＝Ｅ_Ｓ０（Ｉ^ｉ）である。
【００５８】
またファイル名がパスを含むものである場合、各パス階層毎にフィールドを分けておくことも可能である。必要ならば、時刻も年月日時分秒ごとにフィールドに分けておくことも可能である。また、証拠となる暗号ログＣと開示用暗号ログＶの信頼性を高めるために、暗号ログＣと開示用暗号ログＶ、あるいは、それらのハッシュ値を普段からサーバ管理者が情報提出要求元である警察などへ定期的に送っておいたり、普段からサーバ管理者が情報提出要求元に定期的に送って署名を得たものを保存しておいたり、普段からサーバ管理者が定期的に公証人へ送ったり、この公証人の署名を得たものをサーバ管理者が保存しておくようにしてもよい。特に、特願２００１−３２９４１８号に記載されたような管理機能付公開鍵暗号系を用いれば、情報提出要求元に渡す証拠の暗号文とは異なる暗号文を公証人に預けておくことも可能である。この公証人に預ける暗号文は、情報提出要求元に渡した暗号文が真正であることを検証する役割を果たす。
【００５９】
さらに本発明によるアクセスログ管理方法は、住民基本台帳ネットワークへの応用も可能である。現在、いくつかの自治体が、住民の意向に鑑みて住民基本台帳ネットワークへの参加を見合わせている。これらの住民は、直接所属する自治体には住民票を登録するが、その住民票が県や国や他の自治体などの情報提出要求元から参照可能になることに反対している。そこでサーバ管理者である自治体が、より上位の自治体や国等の情報提出要求元に対して、証拠となる暗号文を提出しておけば、情報提出要求元は自治体の同意を得たキーワードだけについての検索を実施可能であり、検索結果として見つかった各住民の個人情報の開示は、各自治体が同意することによって成されることになる。このようにして、住民基本台帳における個人情報漏洩の危惧は払拭できる。
【００６０】
尚、上述した実施の形態では、サーバ管理者と情報提出要求元とで構成するアクセスログ管理方法として説明したが、サーバ管理者が所有するシステムを主要な構成要素とし、これを多数のクライアントが利用するようにすれば、不測の事態に対して情報提出要求元からの情報提供があった場合でも、他のクライアントのプライバシーを保護しながらこれに協力することができ、質の良いサービスと信頼性の高いサービスを提供することができる。
【００６１】
【発明の効果】
以上説明したように本発明のアクセスログ管理方法によれば、情報提出要求元は指定した文字列を含むレコード全ての位置を誤検出なく検出することができ、しかも、開示されたレコードの真正性を検証することができる。また最良の実施の形態においては、開示すべきレコード以外について開示することなく、プライバシーを保護することができる。
【図面の簡単な説明】
【図１】本発明の一実施の形態によるアクセスログ管理方法を採用したアクセスログ管理装置の動作を示すフローチャートである。
【図２】図１に示したアクセスログ管理方法の手順を示す説明図である。
【図３】他のアクセスログ管理方法の手順を示す説明図である。
【図４】本発明の他の実施の形態によるアクセスログ管理方法を採用したアクセスログ管理装置の動作を示すフローチャートである。
【図５】本発明のさらに他の実施の形態によるアクセスログ管理方法を採用したアクセスログ管理装置の動作を示すフローチャートである。
【図６】図５に示したアクセスログ管理方法の手順を示す説明図である。
【符号の説明】
Ｃ 暗号ログ
Ｋ 開示用複合鍵
Ｍ 平文ログ
Ｐ_１，Ｐ_２ 公開鍵
Ｒ レコード
Ｓ_１，Ｓ_２ 秘密鍵
Ｖ 開示用暗号ログ
Ｗ キーワード
Ｗ´ キーワードの素[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an access log management method of a server computer, and in particular, a submission request source such as a police can search information in an access log to request disclosure of information necessary for an investigation of a network crime, and the privacy of a client of the server computer can be improved. Access log management methods to be protected.
[0002]
[Prior art]
The server access log is one of the important clues in investigating network crime, etc. If the entire access log is seized by seizing the hard disk related to the police or other information requesting source, it is unrelated to the crime Even the client information is passed to the submission requester, causing a problem with privacy protection. Currently, the issue of privacy protection and investigative power is either to disclose all or not to disclose all, and to search for serious crimes, one must choose to disclose all. It is a situation that cannot be obtained. If the information submission request source can selectively disclose only the records that meet the conditions specified by the information submission request source, and the information submission request source can be confident that the records that have not been disclosed do not meet the conditions With it, criminal investigations and privacy issues open up a new possibility of partial disclosure.
A similar study from the viewpoint of selective disclosure is a method in which a user makes a special inquiry to the data owner and discloses only the data while keeping secret which data was extracted (for example, non- Patent Literature 1 and Non-Patent Literature 2), and are established as Symmetrically private information retrieval. Also, there is known an information disclosure method in which a character string search for an encrypted text is entrusted to another person, and the owner of the text data searches for the keyword determined by the user on the text and knows the position of the keyword. In the same manner as described above, a keyword encrypted with the same secret key as text data encrypted with the secret key is passed to another person, search is commissioned, and the position of the keyword is known (for example, 3).
[0003]
[Non-patent document 1]
B. Chor, O.M. Golgreich, E .; Kushilevitz, and M.S. Sudan, "Private information retrieval", In Proc. of 36th FOCS, pp. 41-50, 1995.
[Non-patent document 2]
S. K. Misra and P.M. Sarkar, "Symmetrically Private Information Retrieval", INDOCRYPT, pp. 147-64. 225-236,2000.
[Non-Patent Document 3]
D. X. Song, D.S. Wagner, and A.W. Perrig, "Practical Technologies for Searches on Encrypted Data", Proc. of IEEE Security and Privacy Symposium, May 2000.
[0004]
[Problems to be solved by the invention]
However, in the above-described information disclosure methods described in Non-Patent Documents 1 and 2, the user designates several positions and a special function group so as to include 1-bit data to be extracted and possesses the data. And obtains the value of the function group for those bits from the owner, and obtains one bit of information to be extracted from these functions, but cannot obtain information on other bits. Nor can the owner know which bit of information was retrieved. Therefore, the disclosure is selective in the sense that the owner restricts only the amount of information provided to the user, and cannot be applied to a search for data in which the user does not know where to retrieve the data. In the information disclosure method described in Non-Patent Document 3, another person entrusted with the search only knows the encrypted text and the encrypted keyword, and does not know the encryption key. However, it cannot be applied to a situation where the owner of the text data (server administrator) is different from the information submission request source such as the police who searches by specifying a keyword. That is, the search cannot be performed unless the secret key is passed to the information submission request source, and if the secret key is passed, all the text data is disclosed to the information submission request source.
[0005]
SUMMARY OF THE INVENTION It is an object of the present invention to provide an access method which enables an information submission request source to search in an access log to obtain the position of necessary information without erroneous detection and to confirm the authenticity of a disclosed record. It is to provide a log management method.
[0006]
[Means for Solving the Problems]
In order to achieve the above object, the present invention provides a step of submitting a one-way function value of each word in an access log to an information submission request source as an encryption log. A step of performing a search in the encrypted log using the search keyword obtained by the conversion, a step of requesting the server administrator to disclose the plaintext log based on the search result, and only the plaintext of the corresponding record based on the disclosure request And a step of disclosing
[0007]
According to the access log management method of the present invention, the information submission request source can detect the positions of all records including the specified character string without erroneous detection, and can verify the authenticity of the disclosed records. it can.
[0008]
According to a second aspect of the present invention, a server administrator submits an encryption log obtained by encrypting each word in an access log with a public key of a public key cryptosystem to an information submission request source; Searching the encrypted log with a search keyword obtained by encrypting the keyword with the public key of the same public key cryptosystem, and requesting the server administrator to disclose the plaintext log based on the search result And a step of disclosing only the plaintext of the record based on the disclosure request.
[0009]
According to the second aspect of the present invention, similarly, the information submission request source can detect the positions of all the records including the specified character string without erroneous detection, and furthermore, check the authenticity of the disclosed records. Can be verified.
[0010]
According to a third aspect of the present invention, a cipher text obtained by encrypting each word in an access log with a secret key using two public keys and a secret key pair is further encrypted with a public key. A process in which a server administrator submits an encryption log to an information submission request source, and a search using a search keyword obtained by encrypting with a public key based on the element of a search keyword that the server administrator has encrypted with a secret key. , A step of requesting the server administrator to disclose the plaintext log based on the search result, and a step of disclosing only the plaintext of the corresponding record based on the disclosure request.
[0011]
According to the access log management method of the third aspect, similarly, the information submission request source can detect the positions of all records including the specified character string without erroneous detection, and furthermore, the authenticity of the disclosed records Can be verified. In addition, since the search is performed with the search keyword obtained by encrypting with the public key based on the element of the search keyword encrypted by the server administrator with the secret key, the search is performed only with the consent of the server administrator. The information requester can freely search the keyword by encrypting the keyword, suppress the gradual discovery of the plain text of the whole log that is not directly related, and protect the privacy of records other than records to be disclosed. Can be protected.
[0012]
According to the present invention, a record identifier is linked to a cipher text obtained by encrypting each word in an access log with a secret key by using two public key and secret key pairs and a common key cryptosystem. A server administrator submitting an encryption log for retrieval obtained by encrypting the object with a public key, and an encryption log for disclosure obtained by encrypting a record identifier encrypted with a secret key as a common key to an information submission request source; and A step of performing a search with a search keyword obtained by encrypting with a public key a concatenated record identifier with a search keyword element obtained by encrypting with a secret key by a server administrator, and based on the search result. The method includes a step of requesting the server administrator to disclose a plaintext log, and a step of disclosing only the plaintext of the corresponding record by the server administrator based on the disclosure request.
[0013]
According to the access log management method of the present invention, the same word contained in different records is converted into different ciphertexts by considering the concatenation of record identifiers. The correspondences that can be known can be limited, and the privacy of those that should not be disclosed can be better protected.
[0014]
According to a fifth aspect of the present invention, there is provided a step of submitting a one-way function value of each word in an access log to an information submission request source as an encryption log, and using the same one-way function as a keyword at the information submission request source. When a request for disclosure of a plaintext log is made based on a search result in a cryptographic log performed with a search keyword obtained by conversion, the process includes the step of disclosing only the plaintext of the record based on the disclosure request. Features.
[0015]
According to the access log management method of the fifth aspect, since the server administrator performs each of the above-described steps, the information submission request source does not erroneously detect the positions of all records including the specified character string. It is possible to detect the information, verify the authenticity of the disclosed record, and provide a reliable service to each client.
[0016]
Further, according to the present invention, a step of submitting an encryption log obtained by encrypting each word in an access log with a public key of a public key cryptosystem to an information submission request source, When the disclosure of the plaintext log is requested based on the search result in the encryption log performed by the search keyword obtained by encrypting the record with the public key of the same public key cryptosystem, the plaintext of the corresponding record is And step of disclosing only
[0017]
According to the access log management method of the present invention, since the server administrator similarly performs the above-described steps, the information submission request source incorrectly positions all records including the specified character string. Detection can be performed without detection, and the authenticity of the disclosed record can be verified, so that a highly reliable service can be provided to each client.
[0018]
Further, according to the present invention, a cipher text obtained by encrypting each word in the access log with a secret key using two public keys and a secret key pair is further encrypted with a public key. Submitting an encrypted log to the information submission requester and a search result obtained by using a search keyword obtained by encrypting the element of the search keyword obtained by encrypting with the private key from the server administrator with the public key. A step of disclosing only the plaintext of the record based on the disclosure request when the disclosure of the plaintext log is requested.
[0019]
According to the access log management method of the present invention, the information submission request source receiving the service of the server administrator can detect the positions of all the records including the specified character string without erroneous detection. , The authenticity of the disclosed record can be verified. In addition, since the server administrator passed the element of the search keyword encrypted with the secret key, the information submission request source can search only with the consent of the server administrator, and the information provision request source can freely use the keyword. Can be encrypted and searched to prevent the plaintext of the whole log that is not directly related from being gradually revealed, thereby protecting the privacy of other clients.
[0020]
Further, according to the present invention, a record identifier is concatenated to a cipher text obtained by encrypting each word in an access log with a secret key using two public keys and a secret key pair and a common key cryptosystem. A server administrator submitting a search encryption log obtained by encrypting the encrypted information with a public key and a disclosure encryption log obtained by encrypting a record identifier encrypted with a secret key as a common key to an information submission request source Requesting disclosure of a plaintext log based on a search result obtained by using a search keyword obtained by encrypting with a public key a concatenation of a record identifier with a keyword encrypted by a server administrator with a secret key A step of disclosing only the plaintext of the record based on the disclosure request.
[0021]
According to the access log management method of the present invention, the same word contained in different records is converted into different ciphertexts by considering the concatenation of record identifiers. The ability to limit the correspondence that can be known, better protect the privacy of those that should not be disclosed, and provide server administrators with reliable services to other clients Can be.
[0022]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a flowchart showing an operation of an access log management device using an access log management method according to an embodiment of the present invention.
First, the recording format of the access log is defined.¹, R², …… RⁿAnd each record RⁱIs the identifier Iⁱ, Usually uniquely identified by a record number. The plaintext log M is written as M = ｛(I¹, R¹), (I², R²), ... (Iⁿ, Rⁿ)｝ Each record RⁱIs m shown in Equation 1.ⁱWords, each record RⁱIs represented by Equation 2. The search by the information submission request source means that the record R including the keyword WⁱIdentifier IⁱShall be specified.
(Equation 1)

(Equation 2)

[0023]
As a preparation, in step S1, the server administrator sets the public key P₁And secret key S₁Is created, and in step S2, this public key P₁Publish. In the subsequent recording of the access log, in step S3, the server administrator sets the record (Iⁱ, Rⁱ) Is recorded, and in step S4, the public key P₁Record R usingⁱEvery time is generated, the encryption log C for submissionⁱIs created as shown in Expression 3, and the encrypted log C is expressed as C = ｛(I¹, C¹), (I², C²), ... (Iⁿ, Cⁿ) Record in the form of｝. Where Cⁱ ₁~ Cⁱ _miIs represented by Equation 4, and E_P1(Wⁱ _j) To the public key P₁And the word wⁱ _jIs expressed as Equation 6, Equation 5 may be written as Equation 6.
(Equation 3)

(Equation 4)

(Equation 5)

(Equation 6)

[0024]
Public key P in step S2₁Public key P in step S5₁It is assumed that the information submission request source who has obtained the access log submission request in step S6. If the server administrator determines in step S7 that this request has been made, the server administrator submits the encryption log C shown in Expression 2 in step S8.
[0025]
On the other hand, the information submission requester creates a search keyword. That is, the information submission request source uses the keyword W in step S9 and the public key P in step S10.₁Search keyword E corresponding to keyword W using_P1(W) = ω is calculated. After that, the search keyword E on the encrypted log C seized from the server administrator in step S11._P1(W) = encrypted record containing (ω)ⁱ, CⁱSearch). As a result of this search, the corresponding record (I^L, C^L) Is found, the found C^j _jTo C^L _jAnd the identifier I of the record^LAnd the identifier I is obtained in step S13.^LRequest disclosure of records.
[0026]
The server administrator determines this request in step S14, and responds to the corresponding plaintext log record R in step S15.^LIs disclosed. Here, the information submission request source is a record * R composed of * w that the server administrator claims to be the word w as shown in Expression 7.^LIs received, and the public key P is₁* R disclosed using^L  Verify the validity of That is, it can be verified that Expression 9 holds when Expression 8 holds.
(Equation 7)

(Equation 8)

(Equation 9)

[0027]
The above points will be specifically described with reference to FIG.
The administrator uses the public key P₁And secret key S₁And create a public key P₁Publish. E_P1(A) = α, E_P1(B) = β, E_P1(C) = γ, E_P1(D) = δ, E_P1(E) = ε, and this relationship is hereinafter referred to as E_P1Abbreviated as ({a, b, c, d, e}) = {α, β, γ, δ, ε}, the plaintext log M is M = {(I¹, {A, b, c, d}), (I², {A, d, b, b}), (I³, {B, a, c, e}, and the encrypted log C created from the plaintext log M is C = {(I¹, {Α, β, γ, δ}), (I², {Α, δ, β, β}), (I³, {Β, α, γ, ε}.
[0028]
When the information submission requester seizes the cryptographic log C at the start of the search, the keyword W and the public key P₁From ω = E_P1(W) is created, and C matching this ω^j _jFind out. Here, if W = e, then ω = ε, and it can be seen that it matches the third record. Therefore, the information submission request source is the identifier I from the server administrator.³Plaintext of record * R³= ｛* W₀ ³ ₁, * W³ ₂, * W³ ₃, * W³ ₄｝-｛* B₀, * A, * c, * e}. Therefore, by confirming Equation 10, it can be verified that {* b, * a, * c, * e} is valid plaintext {β, α, γ, ε}.
[0029]
It is desirable to configure the access log management method so as to satisfy the following properties. That is, as a property 1, a record other than a record to be disclosed is not known to the information submission requester as much as possible, and as a property 2, the information submission requester can detect the positions of all records including the specified character string. In addition, there is no erroneous detection, and the property 3 is that the information submission request source can verify the authenticity of the disclosed record. The above-described access log monitoring method can detect the positions of all the records including the character string specified by the information submission request source, and there is no false detection, and the information submission request source can verify the authenticity of the disclosed record. Satisfies the essential requirements of properties 2 and 3.
[0030]
As an access log management method according to another embodiment of the present invention, in order to satisfy properties 2 and 3 which are essential conditions, a server administrator sets a one-way function value of each word in an access log as an encryption log. You may make it submit to an information submission request source. The information submission request source searches the encryption log with the encryption keyword obtained by converting the keyword with the same one-way function. By doing so, the server administrator does not need to disclose the plain text of the log, and the information submission request source can specify the position of the keyword. The server administrator discloses the plain text of the record corresponding to the position where the keyword is found to the information submission request source. In order to prevent erroneous detection, the one-way function may be a one-to-one mapping. Thus, the property 2 described above is satisfied. Verification of the authenticity of the disclosed plaintext is achieved by confirming whether the result of converting the disclosed plaintext with the one-way function matches the previously submitted one-way function value. Therefore, the above property 3 is also satisfied.
[0031]
FIG. 4 is a flowchart showing an operation of an access log monitoring device employing an access log monitoring method according to another embodiment of the present invention.
In the above embodiment, the server administrator presents the public key P₁In addition to the above, the encryption log C and the identifier I selected by the search for the information providing request source^LPlaintext R of record^LOnly. However, the information providing request source freely encrypts an arbitrary keyword W and retrieves the search keyword E_P1Since (W) can be created, there is a weakness that by performing a brute force process of repeatedly searching with various keywords W, the plain text of the entire log that is not directly related is gradually found. Therefore, in order to solve this weakness, it is necessary to search for the keyword W only with the consent of the server administrator, and to prevent the information providing request source from freely encrypting the keyword W and performing the search. do it.
[0032]
In the present embodiment, a search keyword is not created directly from a plain text keyword, but is created from a keyword converted using information known only to the server administrator (hereinafter, referred to as a search keyword element W ′). Like that. Of course, the validity of the search keyword element W 'must be verifiable by the information providing request source, but a conversion having such a property can be realized by using a digital signature. In order to be searchable even in the procedure with this conversion, it is necessary that each word of the encryption log is also subjected to the same conversion before encryption.
[0033]
In order to realize these, in step S1 as a preparation shown in FIG.₀And secret key S₀First pair and the public key P₁And secret key S₁Of the public key P in step S2.₀And public key P₁Publish. In the subsequent recording of the access log, in step S3, the server administrator sets the record (Iⁱ, Rⁱ) Is recorded, and the secret key S₀And public key P₁Record R usingⁱEvery time is generated, the encryption log C for submissionⁱIs created as shown in Expression 3, and the encrypted log C is expressed as C = ｛(I¹, C¹), (I², C²), ... (Iⁿ, Cⁿ) Record in the form of｝. Where Cⁱ ₁Is the secret key S of the server administrator₀Word w signed withⁱ _j= E_S0(Wⁱ _j) To the public key P₁Is further encrypted by Cⁱ ₁= E_P1(E_S0(Wⁱ _j)).
[0034]
Public key P in step S2₀, P₁Public key P in step S5₀, P₁It is assumed that the information submission request source who has obtained the access log submission request in step S6. If the server administrator determines in step S7 that this request has been made, the server administrator submits the encryption log C shown in Expression 2 in step S8.
[0035]
The information submission request source that has received the encryption log C presents the keyword W to the server administrator in step S17. When the server administrator who has received this agrees with the search using the keyword W in step S18, the server administrator calculates the element W ′ of the search keyword and calculates W ′ = E._S0(W) to the information submission request source. The information submission request source that has received the search keyword element W ′ verifies the search keyword element W ′ in step S19. That is, * W ', which the server administrator claims to be the prime keyword W', is added to the public key P.₀Using E_P0By confirming that (* W ′) = W, the validity of the search keyword element W ′ can be verified.
[0036]
Subsequently, the information submission request source creates a search keyword in step S10, and extracts the public key P from the verified search keyword element W '.₁Search keyword E using_P1(W ′) = ω ′ = E_P1(E_S0(W)) is calculated. After that, the search keyword E on the encrypted log C seized from the server administrator in step S11._P1(W ′) = ω ′ⁱ, CⁱSearch). As a result of this search, the corresponding record (I^L, C^L) Is found, the found C^j _jTo C^L _jAnd the information submission request source is the identifier I of the record.^LAnd the identifier I is obtained in step S13.^LRequesting the server administrator to disclose the record.
[0037]
The server administrator determines this request in step S14, and in step S15, the record R 'of the corresponding plaintext log^LIs the secret key S₀Disclose what was signed in. In this manner, the information submission request source is the record R 'of the corresponding plaintext log by the server administrator.^LIs the secret key S₀A record * R 'indicated by the expression 10 which claims to be signed by^LReceive.
(Equation 10)

[0038]
This record * R '^LThe information submission request source that has received the public key P in step S16₁* R 'disclosed using^L  Verify the validity of In other words, the record * R 'received from the server administrator by satisfying the formula 11^L  Verify the validity of Thereafter, the information submission request source determines in step S20 that the record R '^LFrom public key P₀Is used to calculate Equation 12 to obtain the plaintext R of the record.^LGet.
(Equation 11)

(Equation 12)

[0039]
This embodiment is different from the above-described embodiment in that the element of the search encryption log is C^j _j= E_P1(W^j _j), But C^j _j= E_P1(E_S0(W^j _j)), And disclose the signed plain text instead of the corresponding plain text. The former is to prevent the information submission requester from performing arbitrary searches with arbitrary keywords. This is because it cannot be verified.
[0040]
The above points will be specifically described with reference to FIG.
The server administrator sets the public key P₀And encryption key S₀And another key pair, the public key P₁And encryption key S₁And create each public key P₀, P₁To each. E_S0({A, b, c, d, e}) = {a ′, b ′, c ′, d ′, e ′}, E_P1If ({a ′, b ′, c ′, d ′, e ′}) = {α ′, β ′, γ ′, δ ′, ε ′}, the plaintext log M = ｛(I¹, {A, b, c, d}), (I², {A, d, b, b}), I³, {B, a, c, e})}, and the corresponding encryption log C is C = {(I¹, {Α ', β', γ ', δ'}), (I², {Α ', δ', β ', β'}), I³, {Β ′, α ′, γ ′, ε ′｝)}.
[0041]
It is assumed that the investigation is started and the information submission request source seizes the cryptographic log C. The information submission request source performs a search by designating the keyword W. Here, it is assumed that the keyword is W = e. The information submission request source passes the keyword e to the server administrator. The server administrator is W '= E_S0(E) is calculated, and the element of the search keyword is passed to the information submission request source. Upon receipt of this, the information submission request source compares the public key P with * W ′ received as the search keyword element W ′.₀Using DP₀By confirming that (* W ′) = e, * W ′ = W ′ = E_S0(E) can be verified. After that, the information submission request source is the public key P₁From W 'using' = E_P1(W ') = E_P1(E_S0(E)) = ε ′ is created.
[0042]
C that matches this^j _jCan be found in the third record, so the information requesting source is the identifier I³Request the server administrator for the record disclosure data. Upon receiving this, the server administrator sets the disclosure data E_S0({B, a, c, e}) = {b ′, a ′, c ′, e ′} is passed to the information submission request source. The information submission request source receives the public key P with respect to {* b ', * a', * c ', * e'} received as the disclosure data {b ', a', c ', e'}.₁Using E_P1By confirming that {* b ′, * a ′, * c ′, * e ′} = {β ′, α ′, γ ′, ε ′}, valid disclosure data R ′³= {B ', a', c ', e'} can be verified. Subsequently, the information submission request source transmits the verified disclosure data R '.³From {b ′, a ′, c ′, e ′}, the public key P₀Using D_P0({B ', a', c ', e'}) = {b, a, c, e} is obtained.
[0043]
In this embodiment, E is used as a search keyword._P1(E_S0(E)), the secret key S₀Without the consent of the server administrator who knows the information, the information submission request source cannot perform the search, so that other unrelated plain texts will be revealed by the brute force processing as in the previous embodiment. No, it is resistant to brute force processing.
[0044]
However, the correspondence between the disclosed plaintext {b, a, c, e} and the search ciphertext {β ′, α ′, γ ′, ε ′} is known to the information submission request source. It is natural that the correspondence between the keywords e and ε that the server administrator has agreed with is known, but it is not desirable that the cipher text for searching for the other words a, b, and c be known. Because it exposes the contents of other records that contain them. To solve this, the following measures are required.
[0045]
In other words, the first requirement is to make the ciphertext different if the record is different even if the word is the same, and the second requirement is that from the disclosure information of a specific record passed from the server administrator to the information of other records It is necessary to make it difficult to guess. According to the first requirement, when each word is encrypted, the encryption result includes information unique to each record, for example, a record identifier I.ⁱDepends on the record identifier IⁱCan be implemented by encrypting by adding.
[0046]
A detailed analysis of the second requirement is as follows. For the purpose of plaintext disclosure, the third requirement is that plaintext must be obtained from the disclosed data. On the other hand, in order for the information submission request source to be able to verify that the disclosure data corresponds to the seized cryptographic log record, the information (disclosure data, disclosure Key P₀, Public key P₁, Record identifier I^LEtc.) must be able to compose the records in the cryptographic log. However, when the third requirement and the fourth requirement are satisfied at the same time, the word in the plaintext log of the record in which the information submission requester is disclosed and the arbitrary record identifier I in the encrypted log are obtained.ⁱWill be able to check the correspondence between the record and the word. Therefore, in order to satisfy the second requirement, it is necessary to eliminate the requirement of either the third requirement or the fourth requirement. Since the third requirement is the original purpose of disclosure, a disclosure method that does not necessarily have the properties of the fourth requirement, that is, does not require verification, is required.
[0047]
Therefore, the record disclosure method is as follows.
The server administrator can disclose the cipher log for disclosure V = ｛(I¹, V¹), (I², V²), ..., (Iⁿ, Vⁿ) Make｝ also created mechanically. The information submission requester seizes both the encryption log C and the disclosure encryption log V. At the time of seizure, the disclosure encryption log V is appropriately created similarly to the encryption log C, and it is assumed that no tampering has been performed by the server administrator at the time of seizure, so there is no need for verification. However, verification of the key for decrypting V 'is necessary. Therefore, V 'cannot be created by the information submission request source, and the information submission request source verifies its validity by the public key P₀And record identifier IⁱRecord R so that it can be decrypted using a key K 'that can be verified usingⁱMay be encrypted. Specifically, the decryption key is Kⁱ= E_S0(Iⁱ), And for the sake of simplicity, the common keyⁱ= F_Ki(Rⁱ). Common key KⁱVerification of Iⁱ= E_P0It can be performed by confirming that (K ′) holds.
[0048]
FIG. 5 is a flowchart showing the operation of the access log monitoring device according to still another embodiment of the present invention, reflecting the above-described record disclosure method.
First, in step S1, the server administrator sets the public key P₀And secret key S₀First pair and the public key P₁And secret key S₁Of the public key P in step S2.₀And public key P₁Publish. In the subsequent recording of the access log, in step S3, the server administrator sets the record (Iⁱ, Rⁱ) Is recorded, and the secret key S₀And public key P₁Record R usingⁱEvery time is generated, the encryption log C for submissionⁱIs created as shown in Expression 3, and the encrypted log C is expressed as C = ｛(I¹, C¹), (I², C²), ... (Iⁿ, Cⁿ) Record in the form of｝. Where Cⁱ ₁Is the secret key S of the server administrator₀Word w signed withⁱ _j= E_S0(Wⁱ _j) To the public key P₁Is further encrypted by Cⁱ ₁= E_P1(Iⁱ| E_S0(Wⁱ _j)). Here, | represents concatenation.
[0049]
Further, in step S21, the server administrator records the encryption log for disclosure,ⁱEvery time is generated, the disclosure encryption log V shown in Expression 12ⁱIs also created at the same time. Public key P in step S2₀, P₁Public key P in step S5₀, P₁It is assumed that the information submission request source who has obtained the access log submission request in step S6. If the server administrator determines in step S7 that this request has been made, the server administrator submits the encryption log C shown in Expression 2 in step S8.
[0050]
The information submission request source that has received the encryption log C presents the keyword W to the server administrator in step S17. When the server administrator who has received this agrees with the search using the keyword W in step S18, the server administrator calculates the element W ′ of the search keyword and calculates W ′ = E._S0(W) to the information submission request source. The information submission request source that has received the search keyword element W ′ verifies the search keyword element W ′ in step S19. That is, * W ', which the server administrator claims to be the prime keyword W', is added to the public key P.₀Using E_P0By confirming that (* W ′) = W, the validity of the search keyword element W ′ can be verified.
[0051]
Subsequently, the information submission request source creates a search keyword in step S10, and extracts the public key P from the verified search keyword element W '.₁, The identifier I of each recordⁱSearch keyword E for each_P1(Iⁱ| W ′) = ω ′ = E_P1(Iⁱ| E_S0(W)) is calculated. After that, the search keyword E on the encrypted log C seized from the server administrator in step S11._P1(Iⁱ| W ′) = ω ′ⁱ, CⁱSearch). As a result of this search, the corresponding search keyword ω in step S12^LAnd C^L _jR that matches^LIf it is determined that the record is found, the requestor of the information submission requests the identifier I of the record.^LAnd the identifier I is obtained in step S13.^LRequesting the server administrator to disclose the record.
[0052]
The server administrator determines this request in step S14, and responds to the request in step S15.^LKey K for disclosure for compounding^L= E_S0(I^L) Is calculated and passed to the information submission request source. In this way, the information submission request source is that the server administrator^L* K which claims to be^LReceive. * K that seems to be this composite key for disclosure^LThe information submission request source that has received the public key P in step S16₀* K disclosed using^L  Verify the validity of That is, I^L= E_P0(* K^L) Holds and * K received from the server administrator^L  Verify the validity of After that, the information submission requester sends the verified disclosure composite key K^LDisclosure log V using^LCalculates the expression 13 from^LGet.
(Equation 13)

[0053]
The above points will be specifically described with reference to FIG.
The server administrator has two key pairs, the public key P₀And secret key S₀And public key P₁And secret key S₁And create each public key P₀, P₁And publish. E_S0({A, b, c, d, e}) = {a ′, b ′, c ′, d ′, e ′}, E_P1(｛Iⁱ| A ', Iⁱ| B ', Iⁱ| C ', Iⁱ| D ', Iⁱ| E '｝) = ｛αⁱ, Βⁱ, Γⁱ, Δⁱ, Εⁱ｝, The plaintext log M = ｛(I¹, {A, b, c, d}), (I², {A, d, b, b}), I³, {B, a, c, e})}, and the corresponding encryption log C is C = {(I¹, ｛Α¹, Β¹, Γ¹, Δ¹｝), (I², ｛Α², Δ², Β², Β²｝), I³, ｛Β³, Α³, Γ³, Ε³｝)｝ Also Kⁱ= E_S0(Iⁱ), The encryption log for disclosure V is represented by Expression 14.
[Equation 14]

[0054]
It is assumed that the investigation is started and the information submission request source seizes the encryption log C and the disclosure encryption log V. The information submission request source performs a search by designating the keyword W. Here, it is assumed that the keyword is W = e. The information submission request source passes the keyword e to the server administrator. The server administrator obtains the element of the search keyword W '= E_S0(E) is calculated, and the search keyword element W 'is passed to the information submission request source. Upon receipt of this, the information submission request source compares the public key P with * W ′ received as the search keyword element W ′.₀DD using_P0By confirming that (* W ′) = e, * W ′ = W ′ = E_S0(E) = e ′ can be verified. After that, the information submission request source is the public key P₁Using each record KⁱSearch keyword ω for searching inside¹= E_P1(I¹｜ W¹), Ω²= E_P1(I²｜ W²), Ω³= E_P1(I³｜ W³).
[0055]
Identifier I³In the record of ω³= C³ ₄Can be found, and the requestor of the information submission requests the identifier I³Key K for disclosing record³To the server administrator. Upon receiving this, the server administrator³= E_S0(I³) And pass it to the information submission requester. The information submission request source is the disclosure composite key K³* K received as³For the public key P₀By using I³= D_P0(K³), A valid disclosure composite key K³You can verify that you received. Subsequently, the source of the information submission request is the verified composite key K for disclosure.³Can be used to obtain the plaintext of the record shown in Expression 15.
(Equation 15)

[0056]
According to the access log monitoring method of this embodiment, since the same word included in different records is converted into different ciphertexts, the information submission request source is R³= {B, a, c, e} and {β³, Α³, Γ³, Ε³You can know the correspondence of｝, but α¹, Β¹, Γ¹, Α², Β², Γ², The contents of the first and second lines not disclosed by the server administrator will not be clarified.
[0057]
When implementing the above-described access log monitoring method, the server administrator of a site that can publish a Web page free of charge requires two sets of public keys P₀, P₁And secret key S₀, S₁And create each public key P₀, P₁Publish. The server administrator records the record related to file upload / download as record Rⁱ= ｛Timeⁱ, ClientIPⁱ, Actionⁱ, File_nameⁱロ グ, the access log M = ｛(I¹, R¹), (I², R²), (I³, R³)} And encrypting log C = {(I¹, C¹), (I², C²), (I³, C³)｝, And the disclosure encryption log V = Ｖ (I¹, V¹), (I², V²), (I³, V³) Record｝. Where Cⁱ= E_P1(Iⁱ| E_S0(Rⁱ), Vⁱ= F_Ki(Rⁱ), Kⁱ= E_S0(Iⁱ).
[0058]
When the file name includes a path, the field can be divided for each path hierarchy. If necessary, the time can also be divided into fields for year, month, day, hour, minute, and second. Further, in order to enhance the reliability of the cryptographic log C and the disclosure cryptographic log V as evidence, the server administrator usually sends the cryptographic log C and the disclosure cryptographic log V or their hash values to the information submission request source. The server administrator regularly sends it to a police station or the like, and the server administrator regularly sends it to the information submission requester and saves the signature, or the server administrator regularly notarizes it regularly. It may be sent to a person, or a server administrator may save a document that has been signed by the notary public. In particular, if a public key cryptosystem with a management function as described in Japanese Patent Application No. 2001-329418 is used, it is also possible to deposit a ciphertext different from the ciphertext of the proof to be passed to the information submission requester at the notary public. It is. The ciphertext entrusted to the notary public serves to verify that the ciphertext passed to the information submission request source is authentic.
[0059]
Further, the access log management method according to the present invention can be applied to a basic resident register network. At present, some municipalities have withdrawn from participating in the Basic Resident Register network in light of the residents' intentions. These inhabitants register a resident's card with the municipality to which they belong directly, but oppose that the resident's card can be referred to from information requesting sources such as prefectures, countries, and other municipalities. Therefore, if the municipality that is the server administrator submits the ciphertext as evidence to the higher-level municipality, country, or other information requesting source, the information submitting request source is only the keywords that have obtained the consent of the local government. Can be executed, and the disclosure of personal information of each inhabitant found as a result of the search is made by the consent of each local government. In this way, the fear of personal information leakage in the Basic Resident Register can be eliminated.
[0060]
In the above-described embodiment, an access log management method configured by a server administrator and an information submission request source has been described. However, a system owned by the server administrator is used as a main component, and this is used by many clients. By using this service, you can cooperate with other clients while protecting the privacy of other clients even in the event of information being provided by the information submission requester in the event of an unexpected event. Service can be provided.
[0061]
【The invention's effect】
As described above, according to the access log management method of the present invention, the information submission request source can detect the positions of all records including the specified character string without erroneous detection, and furthermore, the authenticity of the disclosed records can be improved. Can be verified. In the best embodiment, privacy can be protected without disclosing information other than records to be disclosed.
[Brief description of the drawings]
FIG. 1 is a flowchart showing an operation of an access log management device employing an access log management method according to an embodiment of the present invention.
FIG. 2 is an explanatory diagram showing a procedure of the access log management method shown in FIG.
FIG. 3 is an explanatory diagram showing a procedure of another access log management method.
FIG. 4 is a flowchart showing an operation of an access log management device employing an access log management method according to another embodiment of the present invention.
FIG. 5 is a flowchart showing an operation of an access log management device employing an access log management method according to still another embodiment of the present invention.
FIG. 6 is an explanatory diagram showing a procedure of the access log management method shown in FIG. 5;
[Explanation of symbols]
C Encryption log
K Compound key for disclosure
M plaintext log
P₁, P₂    Public key
R record
S₁, S₂    Secret key
V Encryption log for disclosure
W keyword
W 'keyword element

Claims (8)

A step of submitting the one-way function value of each word in the access log as an encryption log to an information submission request source; And a step of requesting the server administrator to disclose the plaintext log based on the search result, and a step of disclosing only the plaintext of the record based on the request for disclosure. Access log management method. A step in which the server administrator submits an encryption log obtained by encrypting each word in the access log with the public key of the public key cryptosystem to the information submission request source; Searching the encrypted log with a search keyword obtained by encrypting with the public key; requesting the server administrator to disclose the plaintext log based on the search result; A step of disclosing only the plaintext of the access log. Using two public keys and a secret key pair, the server administrator sends an information submission request to a cipher log obtained by encrypting each word in the access log with the secret key and further encrypting the cipher text with the public key. Based on the search keyword obtained by encrypting with the public key based on the element of the search keyword encrypted by the server administrator with the secret key. An access log management method comprising: requesting a server administrator to disclose a plaintext log; and disclosing only the plaintext of the corresponding record based on the disclosure request. Using two public keys and a secret key pair and a common key cryptosystem, each word in the access log is encrypted with a secret key, and a concatenation of a record identifier and a record identifier is obtained by encrypting with a public key. A step in which the server administrator submits the search encryption log and the disclosure encryption log in which the record identifier encrypted with the secret key is encrypted using the common key to the information submission request source, and encrypts the server administrator with the secret key. A step of performing a search with a search keyword obtained by encrypting a concatenated record identifier with a received keyword with a public key, and a step of requesting a server administrator to disclose a plaintext log based on the search result; A step of a server administrator disclosing only the plaintext of the record based on the disclosure request. A step of submitting the one-way function value of each word in the access log to the information submission request source as an encryption log, and a search keyword obtained by converting the keyword with the same one-way function at the information submission request source An access log management method comprising, when disclosure of a plaintext log is requested based on a search result in an encrypted log, disclosing only the plaintext of the corresponding record based on the disclosure request. A step of submitting an encryption log obtained by encrypting each word in the access log with a public key of a public key cryptosystem to an information submission request source, and encrypting a keyword at the information submission request source with a public key of the same public key cryptosystem When disclosure of a plaintext log is requested based on a search result in a cryptographic log performed by a search keyword obtained by the conversion, only the plaintext of the corresponding record is disclosed based on the disclosure request. Access log management method. Using two public keys and a secret key pair, an encryption log obtained by encrypting each word in the access log with the secret key and further encrypting with the public key is submitted to the information submission request source. When the server administrator requests disclosure of the plaintext log based on the search result obtained by the search keyword obtained by encrypting with the public key based on the keyword encrypted by the secret key from the process, Disclosing only the plaintext of the record based on the disclosure request. Using two public keys and a secret key pair and a common key cryptosystem, each word in the access log is encrypted with a secret key, and a concatenation of a record identifier and a record identifier is obtained by encrypting with a public key. A step in which the server administrator submits the search encryption log and the disclosure encryption log in which the record identifier encrypted with the secret key is encrypted using the common key to the information submission request source, and encrypts the server administrator with the secret key. When disclosure of a plaintext log is requested based on a search result obtained by performing a search keyword obtained by encrypting a keyword obtained by linking a record identifier with a public key, based on this disclosure request, Disclosing only plain text.

Images