JP2010161527A - Cipher communication system, terminal device, and secret key generating method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable a transmitting side terminal device to generate a cipher text by using the ID of a receiving side terminal device and a public parameter, and further to avoid escrow properties. <P>SOLUTION: A key generation device 10 uses a master secret key and public ID information corresponding to any user, generates a first secret key of a hierarchical ID-based encryption method using the public ID information as an ID, and outputs the first secret key. A terminal device 30 uses the first secret key and secret ID information and generates a second secret key of the hierarchical ID-based encryption method using a set of the public ID information and the secret ID information as an ID. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to ID-based encryption technology, and more particularly to generation of a secret key for ID-based encryption.

  In a normal public key cryptosystem such as RSA, the terminal device on the transmission side needs to obtain a public key in advance. In this case, it is necessary for the transmitting terminal device to guarantee in some way that the acquired public key is the public key of the valid receiving terminal device. This is because the terminal device on the transmission side generates a ciphertext using the public key of the unauthorized terminal device and prevents the encrypted text from being decrypted by the unauthorized terminal device. Therefore, in a normal public key cryptosystem, the validity of the public key is secured by a public key certificate issued by a certificate authority. However, in this case, complicated processing such as acquisition / verification of the public key certificate must be performed before the encryption communication is started.

  On the other hand, an ID-based encryption scheme has been proposed (see, for example, Non-Patent Documents 1 to 3). In the ID-based encryption method, the key issuing device generates a secret key of the receiving terminal device using the master secret key and the ID (for example, telephone number or URL) of the receiving device acquired, and the receiving terminal device To issue. The transmitting terminal device can generate a ciphertext using only the ID and public parameter of the receiving terminal device. In the case of the ID-based encryption method, if the terminal device knows the ID of the terminal device on the receiving side, it can be confident that the ciphertext generated using this ID can be decrypted only by a valid terminal device. For this reason, the ID-based encryption method does not need to obtain a public key certificate in advance unlike the ordinary public key encryption method, and is more convenient than the ordinary public key encryption method.

D. Boneh and M. Franklin, "Identify-based encryption from the Weil pairing", Advances in Cryptology 0 CRYTPO '01, volume 2139 of LNCS, pages 213-229, Springer, 2001. Matthew Green and Susan Hohenberge, "Blind Identity-Based Encryption and Simulatable Oblivious Transfer", ASIACRYPT 2007, LNCS 4833, pp. 265-282, 2007. Le Trieu Phong and Wakaha Ogata, "Blind HIBE and its Application to Blind Decryption", SCIS 2008, Jan. 2008.

  In the ID-based encryption method, the key issuing device acquires the ID of the receiving terminal device and generates a secret key for the terminal device. Therefore, the secret key of the receiving terminal device is known to the key issuing device, and the ciphertext generated using this ID can be decrypted not only by the receiving terminal device but also by the key issuing device ( Escrow properties). The escrow property is a property that is useful in a situation where the key issuing device censors the contents of the ciphertext, but it is an undesirable property from the viewpoint of privacy protection depending on the application.

  The present invention has been made in view of the above points, and a technology that enables a terminal device on the transmission side to generate a ciphertext using the ID and public parameters of the terminal device on the reception side, and avoids escrow properties. The purpose is to provide.

  In the first aspect of the present invention, the master secret key for generating each secret key of the hierarchical ID-based encryption method and the public ID information corresponding to the user who uses the secret key are stored at least in the first form. Using the storage unit, the master secret key read from the first storage unit and the public ID information corresponding to one of the users, the public ID information is set as an ID according to the key generation procedure of the hierarchical ID-based encryption method. A key generation device including a first secret key generation unit that generates a first secret key of a hierarchical ID-based encryption method, an output unit that outputs the first secret key, and secret ID information corresponding to a certain user , A second storage unit in which is stored, an input unit to which the first secret key output from the key generation device is input, secret ID information read from the second storage unit, and the first secret key input to the input unit And the hierarchical ID-based encryption method A cryptographic communication system comprising: a terminal device including a second secret key generation unit that generates a second secret key of a hierarchical ID-based encryption scheme using a set of public ID information and secret ID information as an ID according to a generation procedure And a secret key generation method thereof. Here, the key generation device and the terminal device are devices independent from each other, the secret ID information is private information to the key generation device, and the second secret key is a combination of the public ID information and the secret ID information. Is a secret key for decrypting the ciphertext of the hierarchical ID-based encryption scheme with ID as the ID.

In the second embodiment of the present invention, at least a master secret key for generating each secret key of the hierarchical ID-based encryption method and public ID information corresponding to a user who uses the secret key are stored. A first storage unit, an input unit to which randomized secret ID information obtained by randomizing secret ID information corresponding to a certain user is randomized, a master secret key, and randomized secret ID information The public ID information corresponding to the corresponding user is read from the first storage unit, and in accordance with the key generation procedure of the hierarchical ID-based encryption method using these, the ID of the hierarchical ID-based encryption method using the public ID information as an ID A first secret key generation unit for generating a first secret key;
Using the first secret key and the randomized secret ID information, according to the key generation procedure of the hierarchical ID-based encryption method, the first of the hierarchical ID-based encryption method using the combination of the public ID information and the randomized secret ID information as an ID. A key generation device including a second secret key generation unit that generates two secret keys, an output unit that outputs the second secret key, and an input unit to which the second secret key output from the key generation device is input A random removal unit that restores the third secret key of the hierarchical ID-based encryption scheme using the second secret key and a random number as an ID, and a set of public ID information and secret ID information; and And a secret key generation method therefor are provided. Here, the key generation device and the terminal device are devices independent from each other, the secret ID information is private information to the key generation device, and the third secret key is a combination of the public ID information and the secret ID information. Is a secret key for decrypting the ciphertext of the hierarchical ID-based encryption scheme with ID as the ID.

  In the present invention, the terminal device can obtain its own secret key without the secret ID information being known to the key generation device. Therefore, the secret key used by the terminal device is not known to the key generation device. The secret key is a secret key of the hierarchical ID-based encryption method, and the terminal device on the transmission side can generate a ciphertext using the ID of the terminal device on the reception side and the public parameter.

  In the present invention, the terminal device on the transmission side can generate the ciphertext using the ID of the terminal device on the reception side and the public parameter, and the escrow property can be avoided.

The block diagram which illustrated the functional composition of the encryption communications system of a 1st embodiment. (A) is a figure which shows an example of a detailed structure of the key generation part of a key generation apparatus, (b) is a figure which shows an example of a detailed structure of the key generation part of a terminal device. The flowchart for demonstrating the production | generation method of the private key of 1st Embodiment. (A) is a flowchart for demonstrating an example of step S3, (b) is a flowchart for demonstrating an example of step S6. The block diagram which illustrated the functional composition of the encryption communications system of a 2nd embodiment. (A) is a figure which shows an example of a detailed structure of the key generation part of a key generation apparatus, (b) is a figure which shows an example of a detailed structure of the random removal part of a terminal device. The flowchart for demonstrating the production | generation method of the private key of 2nd Embodiment. (A) is a flowchart for demonstrating an example of step S17, (b) is a flowchart for demonstrating an example of step S20.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[Definition of symbols and terms]
First, symbols and terms used in the embodiment are defined.
E: An elliptic curve defined on a finite field F T of order _T. Weierstrass equation of the affine coordinate version
y ² + a ₁・ x ・ y + a ₃・ y = x ³ + a ₂・ x ² + a ₄・ x + a ₆ … (1)
It is defined as a set of points (x, y) satisfying (where a ₁ , a ₂ , a ₃ , a ₄ , a ₆ ∈ F _T ) and a special point O called an infinite point. A binary operation called elliptic addition can be defined for any two points on the elliptic curve E, and a unary operation called elliptic inverse can be defined for any one point on the elliptic curve E. In addition, it is well known that a group can be defined for this elliptic addition, and an operation called elliptic scalar multiplication can be defined using elliptic addition. Also, various algorithms for efficiently executing these operations on a computer are well known (for example, Reference 1 “Ian F. Braque, Gadiel Selossi, Nigel P. Smart = Author,“ Ellipse ”). "Curve cryptography", publication = Pearson Education, ISBN4-89471-431-0 "etc.).

#E: Number of elements in a finite set of rational points on the elliptic curve E. Number #E of rational points of the elliptic curve E defined on a finite field F _T is finite.
p: A large prime number that divides #E.

G: A cyclic group of order p. In the present embodiment, a finite set E [p] composed of p equal points of the elliptic curve E is used as the cyclic group G. Of the points A on the elliptic curve E, the elliptic scalar multiplication value p · A on the elliptic curve E is defined as a finite set of points A satisfying p · A = O. E [p] is a subgroup of E. Note that ε · ηεG means that an operation defined by G is performed on the elements ε and η of G. Furthermore, ε ^ν εG (νεZ) means that the operation defined by G is performed ν times on the element ε of G (ε · ε ... ε · εεG). Since G in this embodiment is a subgroup of a finite set of rational points on the elliptic curve E, ε · η∈G corresponds to elliptic addition of the points ε and η on the elliptic curve E, and ε ^ν ΕG corresponds to elliptic scalar multiplication (ν multiplication) of the point ε on the elliptic curve E.

g: Source of the cyclic group G. Since the order p of the cyclic group G in this embodiment is a prime number, any element of the cyclic group G may be selected as the generation source g.
Z _p : Module of residue class by p (Z / pZ). In the present embodiment, to represent the typical source and Z _p. An example of the representative element is an integer of 0 or more and p−1 or less. Note that εεZ _p indicates that ε is an element of the set Z _p .
Z _p ^* : Multiplicative group of residue class by p (Z / pZ) ^* . Z is a set of integers disjoint with _p and p.

G _T : A finite set that is an extension field based on the finite field F _T. An example is a finite set of one of the p th root of the algebraic closure of the finite field F _T.
e: non-degenerate bilinear pairing function (hereinafter referred to as “pairing function”), which is defined by the following equation.
G × G = G _T … (2)

The pairing function e used in this embodiment has the following properties.
[Property 1] For any point A ₁ on G, e (A ₁ , A ₁ ) = 1 holds.
[Property 2] For any two points A ₁ and A ₂ on G, e (A ₁ , A ₂ ) = e (A ₂ , A ₁ ) holds.
Relative [Property 3] three arbitrary points A ₁ on _{G, A 2, A 3,} e (A 1 + A 2, A 3) = e (A 1, A 3) e (A 2, A 3 ), And e (A ₁ , A ₂ + A ₃ ) = e (A ₁ , A ₂ ) e (A ₁ , A ₃ ) holds.
[Property 4] For an arbitrary point A ₁ on G, e (A ₁ , O) = 1 holds.
[Property 5] If a certain point A ₁ on G satisfies e (A ₁ , A ₂ ) = 1 for all points A ₂ on G, then A ₁ = O holds.

In addition, as a specific example of such a pairing function e, for example, Reference Document 2 ““ IEEE P1636.3 ^TM / D1 Draft Standard for Identity-based Public-key Cryptography Using Pairings ”, [URL: http: // grouper.ieee.org/groups/1363/IBC/material/P1363.3-D1-200805.pdf], pp.24-25, April 2008 "e (A ₁ , φ (A ₂ )) Can be illustrated. As described in Reference Document 2, this function can be realized by combining a mapping φ with a function such as Weil pairing or Tate pairing. Here, the mapping φ is as follows.
φ (x, y) = (v ^-1 x, v ^-3/2 y) (when elliptic curve E has a quadratic twist)
φ (x, y) = (v ^-1/3 x, v ^-1/2 y) (when elliptic curve E has a 4th or 6th order twist)

Where v is the square non-residue element vεF _T of the finite field F _T. For Weil pairing and Tate pairing, refer to Reference 3 “Alfred. J. Menezes, ELLIPTIC CURVE PUBLIC KEY CRYPTOSYSTEMS, KLUWER ACADEMIC PUBLISHERS, ISBN0-7923-9368-6, pp. 61-81”. It is disclosed. For the method of generating a non-supersingular curve that can be efficiently calculated by the pairing function, see Reference 4 “A. Miyaji, M. Nakabayashi, S. Takano,“ New explicit conditions of elliptic curve Traces for FR-Reduction, "IEICE Trans. Fundamentals, vol. E84-A, no05, pp. 1234-1243, May 2001", reference 5 "PSLM Barreto, B. Lynn, M. Scott," Constructing elliptic curves with prescribed embedding degrees, "Proc. SCN '2002, LNCS 2576, pp.257-267, Springer-Verlag. 2003". As an algorithm for calculating the pairing function on a computer, the well-known Miller algorithm (reference document 6 “VS Miller,“ Short Programs for functions on Curves, ”1986, Internet <http: //crypto.stanford .edu / miller / miller.pdf>".

  Hierarchical Identity-Based Encryption: Hierarchical Identity-Based Encryption: Hierarchical ID-based encryption is hierarchized, and each hierarchized ID is associated with each hierarchized device, and the secret key of each device is hierarchized. ID-based encryption method that can be generated. In this method, a device that can use the master secret key can generate a secret key corresponding to each ID by using the master secret key and each ID, and even if the device cannot use the master secret key, Using the secret key generated for the ID and the ID of the lower layer, a secret key corresponding to the ID of the lower layer can be generated. Specific configurations of the ID-based encryption are disclosed in various documents. For example, in addition to Non-Patent Documents 2 and 3, Reference 7 “C. Gentry, A. Silverberg,“ Hierarchical ID-based cryptography, ” Proceedings of ASIACRYPT 2002, Lecture Notes in Computer Science, Springer-Verlag, 2002. ", Reference 8" Dan Boneh, Xavier Boyen, and Eu-Jin Goh, "Hierarchical identity based encryption with constant size ciphertext," Proceedings of Eurocrypt 2005 , volume 3494 of LNCS, pages 440-456. ”, reference 9“ Xavier Boyen and Brent Waters, “Anonymous Hierarchical Identity-Based Encryption,” Proceedings of CRYPTO 2006, volume 4117 of LNCS. ”, and the like.

H: arbitrary bit length collision hash function to transfer the bit stream to Z _p of the original _{^{({0,1} * → Z p}} ). Such a hash function H can be easily configured from a known hash function such as SHA-1 and a remainder operation.

[First Embodiment]
First, a first embodiment of the present invention will be described. In this embodiment, the public ID information is used in the key generation device, the first secret key is generated by performing the first-level secret key generation processing of the hierarchical ID-based encryption method, and the first secret key is generated in the terminal device on the receiving side. Using the key and the secret ID information, a second secret key is generated by performing a second-layer secret key generation process of the hierarchical ID-based encryption scheme.

<Overall configuration>
FIG. 1 is a block diagram illustrating a functional configuration of the cryptographic communication system 1 according to the first embodiment. 2A is a diagram illustrating an example of a detailed configuration of the key generation unit 16 of the key generation device 10, and FIG. 2B is an example of a detailed configuration of the key generation unit 36 of the terminal device 30. FIG. 2A and 2B is an example in which the method of Non-Patent Document 3 is used as the hierarchical ID-based encryption method. However, the present invention is not limited to this, and other hierarchical ID-based encryption methods disclosed in Non-Patent Document 2 and Reference Documents 7 to 9 described above may be used.

  As illustrated in FIG. 1, the cryptographic communication system 1 of the present embodiment includes a key generation device 10 that generates a secret key of a hierarchical ID-based encryption method, and a transmission-side terminal device 20 that generates and transmits a ciphertext. A receiving-side terminal device 30 that receives and decrypts the ciphertext. The key generation device 10 and the terminal devices 20 and 30 each have a communication function. The key generation device 10 and the terminal device 30 are configured to be able to communicate with each other, and the terminal device 20 and the terminal device 30 can transmit from the terminal device 20 to the terminal device 30. Configured. Further, the key generation device 10 and the terminal device 30 are devices independent of each other, and they are managed by an independent administrator or based on a security policy that does not leak specific secret information to each other, Managed by the same administrator.

<Configuration of Key Generation Device 10>
The key generation device 10 is executed by reading a predetermined program into a known computer including, for example, a CPU (central processing unit), a RAM (random-access memory), a magnetic recording device, a magneto-optical recording medium, a communication device, and the like. It is a device constituted by. As illustrated in FIG. 1, the key generation device 10 of the present embodiment includes a storage unit 11 (corresponding to a “first storage unit”), a temporary memory 12, a control unit 13, and a transmission unit 14 (“output unit”). ), A receiving unit 15, and a key generation unit (TA ₀ ) 16 (corresponding to “first key generation unit”). The key generation unit (TA ₀ ) 16 illustrated in FIG. 2A includes a random number generation unit 16a and a first hierarchy calculation unit 16b, and the first hierarchy calculation unit 16b includes calculation units 16ba, 16 bb. The storage unit 11 and the temporary memory 12 are storage areas configured by, for example, a RAM, a magnetic recording device, a magneto-optical recording medium, or a combination of at least some of them. The control unit 13 and the key generation unit (TA ₀ ) 16 are, for example, processing units configured by reading a predetermined program into the CPU, and the transmission unit 14 and the reception unit 15 are, for example, predetermined The communication device is driven under the control of the CPU loaded with the program. The key generation device 10 executes each process under the control of the control unit 13. In addition, data generated by each calculation process is stored in the temporary memory 12 one by one, and read and used in other calculation processes.

<Configuration of Sending Terminal Device (Sender) 20>
The transmission-side terminal device 20 is a device configured by, for example, reading and executing a predetermined program on a known computer including a CPU, a RAM, a magnetic recording device, a magneto-optical recording medium, a communication device, and the like. . As illustrated in FIG. 1, the terminal device 20 of the present embodiment includes a storage unit 21, a temporary memory 22, a control unit 23, a transmission unit 24 (corresponding to “output unit”), an encryption unit 25, And an input interface unit 26. The storage unit 21 and the temporary memory 22 are storage areas configured by, for example, a RAM, a magnetic recording device, a magneto-optical recording medium, or a combination of at least a part thereof. The control unit 23 and the encryption unit 25 are processing units configured by, for example, reading a predetermined program into the CPU. The transmission unit 24 is a communication device that is driven under the control of a CPU loaded with a predetermined program, for example, and the input interface is a keyboard functioning under the control of the CPU loaded with the predetermined program, An input device such as a mouse. In addition, the terminal device 20 executes each process under the control of the control unit 23. Further, data generated in each arithmetic process is stored in the temporary memory 22 one by one, and read and used in other arithmetic processes.

<Configuration of Receiving Terminal Device (Receiver) 30>
The terminal device 30 on the receiving side is a device configured by, for example, reading and executing a predetermined program on a known computer including a CPU, a RAM, a magnetic recording device, a magneto-optical recording medium, a communication device, and the like. . As illustrated in FIG. 1, the terminal device 30 of this embodiment includes a storage unit 31 (corresponding to a “second storage unit”), a temporary memory 32, a control unit 33, a transmission unit 34, and a reception unit 35 ( A key generation unit (TA ₁ ) 36 (corresponding to a “second secret key generation unit”), a decryption unit 37, and an output interface unit 38. Also, illustrated key generation unit in FIG. _{2 (b) (TA 1)} 36 has a random number generating unit 34a, and a second layer calculation unit 34b, the second layer calculation unit 34b, the operating section 34 ba, 34bb. The storage unit 31 and the temporary memory 32 are storage areas configured by, for example, a RAM, a magnetic recording device, a magneto-optical recording medium, or a combination of at least a part thereof. The control unit 33, the key generation unit (TA ₁ ) 36, and the decryption unit 37 are, for example, processing units configured by reading a predetermined program into the CPU. The transmission unit 34 and the reception unit 35 are, for example, communication devices that are driven under the control of a CPU loaded with a predetermined program. The output interface unit 38 is a control of the CPU loaded with a predetermined program. It is an output device such as a liquid crystal display or a speaker driven under the control of In addition, the terminal device 30 executes each process under the control of the control unit 33. In addition, data generated in each calculation process is stored in the temporary memory 32 one by one, and read and used in other calculation processes.

<Processing>
Next, the processing of this embodiment will be described.
[Preprocessing]
First, a master secret key (MK) and a public parameter (P) for generating each secret key of the hierarchical ID-based encryption method are set by an administrator of the key generation device 10 (FIG. 1). The master secret key (MK) is secret information and is stored only in the storage unit 11 of the key generation device 10. On the other hand, the public parameter (P) is public information and is stored in the storage unit 11 of the key generation device 10, the storage unit 21 of the terminal device 20, and the storage unit 31 of the terminal device 30. The storage unit 31 of the terminal device 30 further stores public ID information (ID ₁ ) and secret ID information (ID ₂ ). Set of these public ID information (ID ₁₎ and the secret ID information (ID ₂₎ is used as the ID of the user using the secret key.

The public ID information (ID ₁ ) is information corresponding to publicly disclosed information, and examples thereof include the official name (real name, etc.), address, telephone number, and email address of the user who uses the private key. And URL (Uniform Resource Locator), information corresponding to the organization name and career information. On the other hand, the secret ID information (ID ₂ ) is information corresponding to information disclosed only to a person who has a specific relationship with the user who uses the secret key, and an example thereof is that of the user who uses the secret key. Information corresponding to the nickname, the name of the pet, the name of the property, the name of the hobby, etc.

<< Pre-processing when using the method of Non-Patent Document 3 >>
An example in which the method of Non-Patent Document 3 is used as the hierarchical ID-based encryption method is shown.
The public ID information (ID ₁ ) and the secret ID information (ID ₂ ) in this example are configured as follows.
ID ₁ ∈Z _p … (3)
ID ₂ ∈Z _p … (4)
Specifically, for example, the public key information (ID ₁ ) is obtained by inputting public information (such as the user's official name) that has been made public to the hash function H described above, and the secret key is used. The secret value information (ID ₂ ) is a hash value obtained by inputting information (such as a user's nickname) disclosed only to a person who has a specific relationship with the user to be entered into the hash function H described above.

Also choose a random number α∈Z _p ^* ,
g ₁ = g ^α ∈G… (5)
And Also random elements
h ₁ , h ₂ ∈G… (6)
And the generator of the multiplicative group G ^* from the elements excluding the infinity point O of the cyclic group G
g ₂ ∈G ^* … (7)
Is selected. And the master secret key (MK) and public parameter (P)
MK = g ₂ ^α ∈G ^* … (8)
P = [g, g ₁ , g ₂ , h ₁ , h ₂ ]… (9)
(End of explanation of << preprocessing when using the method of Non-Patent Document 3 >>).

[Secret key generation process]
FIG. 3 is a flowchart for explaining a secret key generation method according to the first embodiment. FIG. 4A is a flowchart for explaining an example of step S3, and FIG. 4B is a flowchart for explaining an example of step S6. 4A and 4B is an example using the method of Non-Patent Document 3 as a hierarchical ID-based encryption method, the present invention is not limited to this.

In the receiving side terminal device 30 (FIG. 1) requesting generation of the secret key, first, the public ID information (ID ₁ ) stored in the storage unit 31 is read, and the transmission unit 34 transmits the public ID information (ID _1). ) Is transmitted (output) to the key generation apparatus 10 (step S1). The public ID information (ID ₁ ) is received by the reception unit 15 of the key generation device 10 (step S 2) and input to the key generation unit (TA ₀ ) 16.

The key generation unit (TA ₀₎ 16 from the storage unit 11 reads the master secret key (MK) and a public parameter (P), these public ID information (ID ₁₎ and the use of hierarchical ID-based cryptosystem In accordance with the key generation procedure, a first secret key (SK (ID ₁ )) of a hierarchical ID-based encryption scheme using the public ID information (ID ₁ ) as an ID is generated (step S3).

<< Step S3 when the method of Non-Patent Document 3 is used >>
In step S3 when the method of Non-Patent Document 3 is used as the hierarchical ID-based encryption method, first, the random number generation unit 16a (FIG. 2) of the key generation unit (TA ₀ ) 16 performs random numbers.
r ₁ ∈Z _p … (10)
Is selected and output (step S3a). Next, the arithmetic unit of the first layer calculation unit 16b 16ba is an element of the read from the storage unit 11 the master secret key (MK = g ₂ ^α) and public parameters _{(P) (g 1, h} 1), it is sent The public ID information (ID ₁ ) and the output random number (r ₁ ),

の演算を行い（ステップＳ３ｂ）、演算部１６ｂｂが、記憶部１１から読み込んだ公開パラメータ（P）の要素（g）と、出力されたランダム数（r₁）とを用い、

(Step S3b), the calculation unit 16bb uses the element (g) of the public parameter (P) read from the storage unit 11 and the output random number (r ₁ ),

の演算を行い（ステップＳ３ｂ）、第１階層演算部１６ｂが、第１秘密鍵

Is calculated (step S3b), and the first hierarchy calculation unit 16b receives the first secret key.

を出力する（ステップＳ３ｄ／《非特許文献３の方式を用いた場合のステップＳ３》の説明終わり）。

(Step S3d / << End of description of Step S3 when the method of Non-Patent Document 3 is used).

The generated first secret key (SK (ID ₁ )) is sent to the transmission unit 14, and the transmission unit 14 transmits (outputs) the first secret key (SK (ID ₁ )) to the terminal device 30 ( Step S4). The first secret key (SK (ID ₁ )) is received (input) by the receiving unit 35 of the terminal device 30 (FIG. 1) (step S5) and sent to the key generating unit (TA ₁ ) 36. The key generation unit (TA ₁ ) 36 reads the secret ID information (ID ₂ ) and the public parameter (P) from the storage unit 31, and uses these and the first secret key (SK (ID ₁ )) to create a hierarchical type In accordance with the key generation procedure of the ID-based encryption method, the second secret key (SK (ID _1, ID) of the hierarchical ID-based encryption method using the combination of the public ID information (ID ₁ ) and the secret ID information (ID ₂ ) as an ID. ₂ )) is generated (step S6). This second secret key (SK (ID _1, ID ₂ )) decrypts the ciphertext of the hierarchical ID-based encryption method using the combination of the public ID information (ID ₁ ) and the secret ID information (ID ₂ ) as an ID. It is a secret key to do.

<< Step S6 when the method of Non-Patent Document 3 is used >>
In step S6 when the method of Non-Patent Document 3 is used as the hierarchical ID-based encryption method, first, the random number generation unit 34a (FIG. 2) of the key generation unit (TA ₁ ) 36 performs random numbers.
r ₂ ∈Z _p … (14)
Is selected and output (step S6a). Next, the arithmetic unit of the second layer calculation unit 34b 34 ba is first secret key inputted _{(SK (ID 1) = (} d 0, d 1)) (Expression (13)), read from the storage unit 31 Using the secret ID information (ID ₂ ) and public parameters (P) elements (g ₁ , h ₂ ) and the output random number r ₂ ,

の演算を行い（ステップＳ６ｂ）、演算部３４ｂｂが、記憶部３１から読み込んだ公開パラメータPの要素gと、出力されたランダム数r₂とを用い、

It performs the operation of (step S6b), the arithmetic unit 34bb is used and elements g of public parameters P read from the storage unit 31, and a random number r ₂ output,

の演算を行い（ステップＳ６ｃ）、第２階層演算部３４ｂが、第２秘密鍵

Is calculated (step S6c), and the second hierarchy calculation unit 34b receives the second secret key.

を出力する（ステップＳ６ｄ／《非特許文献３の方式を用いた場合のステップＳ６》の説明終わり）。

(Step S6d / << end of description of step S6 when using the method of Non-Patent Document 3).

[Encryption / decryption processing]
Public ID information (ID ₁ ), secret ID information (ID ₂ ) and plaintext M to be encrypted corresponding to the terminal device 30 are input to the input interface unit 26 of the terminal device 20 (FIG. 1) that performs encryption. These are sent to the encryption unit 25. The encryption unit 25 uses this and the public parameter P read from the storage unit 21 to generate a ciphertext HIBE (ID ₁ , ID ₂ , M) according to the encryption procedure of the hierarchical ID-based encryption method.

のように、暗号文HIBE(ID₁,ID₂,M)を生成する。 For example, when the method of Non-Patent Document 3 is used, the encryption unit 25 generates a random number sεZ _p and inputs the input public ID information (ID ₁ εZ _p ) and secret ID information (ID ₂ ε Z _p ), plaintext (M∈G _T ), public parameters P = [g, g ₁ , g ₂ , h ₁ , h ₂ ] and a random number s∈Z _p

The ciphertext HIBE (ID ₁ , ID ₂ , M) is generated as shown in FIG.

The generated ciphertext HIBE (ID ₁ , ID ₂ , M) is transmitted from the transmission unit 24, received by the reception unit 35 of the terminal device 30, and sent to the decryption unit 37. The decryption unit 37 decrypts the ciphertext HIBE (ID ₁ , ID ₂ , M) using the second secret key (SK (ID _1, ID ₂ )) generated by the key generation unit (TA ₁ ) 36.

For example, when using the method of Non-Patent Document 3, the decoding unit 37 uses (SK (ID _1, ID ₂ )) = (δ ₀ , δ ₁ , δ ₂ ) (formula (17)),

の演算によって復号を行う。なお、式(19)の左辺は、

Decoding is performed by the operation of The left side of equation (19) is

となり、前述の［性質２］［性質３］よって、式(20)は

Therefore, according to the above [Property 2] [Property 3], the equation (20) is

と変形できる。これにより、式(19)の演算によって平文Mが復号されることが分かる。

And can be transformed. Thereby, it is understood that the plaintext M is decrypted by the calculation of the equation (19).

<Features of this embodiment>
In this embodiment, only the public ID information (ID ₁ ) is transmitted from the terminal device 30 to the key generation device 10, and the secret ID information (ID ₂ ) is not transmitted. Therefore, the key generation device 10 that does not know the secret ID information (ID ₂ ) cannot know the second secret key (SK (ID _1, ID ₂ )) of the terminal device 30. Thereby, escrow property can be avoided. The terminal device 20 can generate a ciphertext using the public ID information of the terminal device 30 and (ID ₁₎ and ID consisting of a set of the secret ID information (ID ₂₎ and the public parameters, it is highly convenient.

  As described above, as the hierarchical ID-based encryption method used in the present invention, any known method may be used, but from a ciphertext generated according to the hierarchical ID-based encryption method. It is desirable to use Anonymous Hierarchical Identity-Based Encryption (for example, see Non-Patent Document 3, Reference Document 9, etc.), which makes it difficult to specify an ID corresponding to the ciphertext.

[Second Embodiment]
Next, a second embodiment of the present invention will be described. In the present embodiment, the public ID information is used in the key generation device to generate the first secret key by performing the first-level secret key generation process of the hierarchical ID-based encryption method, and further randomize with the first secret key Using the secret ID information, the second-level secret key is generated by performing the second-level secret key generation process of the hierarchical ID-based encryption method. Then, the randomness of the second secret key is removed by the terminal device on the receiving side, and the third secret key of the hierarchical ID-based encryption method using the combination of the public ID information and the secret ID information as an ID is restored. In addition, as a blind key issuing method in which the key generation device issues a key randomized by the hierarchical ID-based encryption method and the terminal device restores the key, for example, publicly disclosed in Non-Patent Documents 2 and 3 This method can be used. In this embodiment, an example using the blind key issuing method of Non-Patent Document 3 is shown as an example.
In the following description, differences from the first embodiment will be mainly described, and description of matters common to the first embodiment will be omitted.

<Overall configuration>
FIG. 5 is a block diagram illustrating a functional configuration of the cryptographic communication system 100 according to the second embodiment. 6A is a diagram illustrating an example of a detailed configuration of the key generation unit 116 of the key generation device 110, and FIG. 6B is an example of a detailed configuration of the random removal unit 139 of the terminal device 130. FIG. 6A and 6B is an example in which the method of Non-Patent Document 3 is used as the hierarchical ID-based encryption method. However, the present invention is not limited to this, and other hierarchical ID-based encryption methods disclosed in Non-Patent Document 2 and Reference Documents 7 to 9 described above may be used. In these drawings, the same reference numerals as those in the first embodiment are used for portions common to the configuration of the first embodiment, and description thereof is omitted.

  As illustrated in FIG. 5, the cryptographic communication system 100 according to the present embodiment includes a key generation device 110 that generates a secret key of a hierarchical ID-based encryption method, and a transmission-side terminal device 20 that generates and transmits a ciphertext. A receiving-side terminal device 130 that receives and decrypts the ciphertext. The key generation device 110 and the terminal devices 20 and 130 each have a communication function. The key generation device 110 and the terminal device 130 are configured to be able to communicate with each other, and the terminal device 20 and the terminal device 130 can transmit from the terminal device 20 to the terminal device 130. Configured. In addition, the key generation device 110 and the terminal device 130 are devices independent of each other, and they are managed by an independent administrator, or based on a security policy that specific secret information is not leaked to each other, Managed by the same administrator.

<Configuration of Key Generation Device 110>
The key generation device 110 is a device configured by reading and executing a predetermined program on a known computer including a CPU, a RAM, a magnetic recording device, a magneto-optical recording medium, a communication device, and the like. As illustrated in FIG. 5, the key generation device 110 of the present embodiment includes a storage unit 11 (corresponding to a “first storage unit”), a temporary memory 12, a control unit 13, and a transmission unit 14 (“output unit”). ), Receiving unit 15, key generation unit (TA ₀ ) 16 (corresponding to “first key generation unit”), and key generation unit (TA ₁ ) 117 (corresponding to “second key generation unit”). And a verification unit 118. The key generation unit (TA ₁ ) 117 illustrated in FIG. 6A includes a random number generation unit 117a and a second hierarchy calculation unit 117b, and the second hierarchy calculation unit 117b includes calculation units 117ba, 117bb. The key generation unit (TA ₁ ) 117 and the verification unit 118 are, for example, processing units configured by reading a predetermined program into the CPU. Further, the key generation device 110 executes each process under the control of the control unit 13. In addition, data generated by each calculation process is stored in the temporary memory 12 one by one, and read and used in other calculation processes.

<Configuration of Sending Terminal Device (Sender) 20>
Since it is the same as 1st Embodiment, description is abbreviate | omitted.

<Configuration of Receiving Terminal Device (Receiver) 130>
The terminal device 130 on the reception side is a device configured by, for example, reading and executing a predetermined program on a known computer including a CPU, a RAM, a magnetic recording device, a magneto-optical recording medium, a communication device, and the like. . As illustrated in FIG. 5, the terminal device 130 according to the present embodiment includes a storage unit 31 (corresponding to a “second storage unit”), a temporary memory 32, a control unit 33, a transmission unit 34, and a reception unit 35 ( Equivalent to an “input unit”), a decoding unit 37, an output interface unit 38, a zero knowledge proving unit 131, a random value generating unit 136, a randomizing unit 137, and a random removing unit 139. The random removal unit 139 illustrated in FIG. 6B includes a random number generation unit 139a and a random removal calculation unit 139b, and the random removal calculation unit 139b includes calculation units 139ba and 139bb. Note that the zero knowledge proving unit 131, the random value generating unit 136, the randomizing unit 137, and the random removing unit 139 are, for example, processing units configured by reading a predetermined program into the CPU. The terminal device 130 executes each process under the control of the control unit 33. In addition, data generated in each calculation process is stored in the temporary memory 32 one by one, and read and used in other calculation processes.

<Processing>
Next, the processing of this embodiment will be described.
[Preprocessing]
Since it is the same as 1st Embodiment, description is abbreviate | omitted.

[Secret key generation process]
FIG. 7 is a flowchart for explaining a secret key generation method according to the second embodiment. FIG. 8A is a flowchart for explaining an example of step S17, and FIG. 8B is a flowchart for explaining an example of step S20. 8A and 8B is an example in which the method of Non-Patent Document 3 is used as the hierarchical ID-based encryption method, the present invention is not limited to this.

The random value generation unit 136 of the terminal device 130 on the receiving side (FIG. 5) generates a random value yεZ _p and stores it in the storage unit 31. Next, the randomizing unit 137 reads the secret ID information (ID ₂ ), the random value (y), and the public parameter (P) from the storage unit, and uses them to convert the secret ID information (ID ₂ ) to the random value (y). And randomized secret ID information (R (ID ₂ )) is generated (step S11).

の演算によってランダム化秘密ＩＤ情報（R(ID₂)）生成する。 For example, when using the method of Non-Patent Document 3, the randomizing unit 137

To generate randomized secret ID information (R (ID ₂ )).

The generated randomized secret ID information (R (ID ₂ )) is stored in the storage unit 31. Then, the public ID information (ID ₁ ) and the randomized secret ID information (R (ID ₂ )) stored in the storage unit 31 are read, and the transmission unit 34 transmits them to the key generation device 110 (output). (Step S12). The public ID information (ID ₁₎ and randomized secret ID information (R (ID _2)), received by the receiving portion 15 of the key generation device 110 (corresponding to "input section") (input) (Step S13). The public ID information (ID ₁ ) is sent to the key generation unit (TA ₀ ) 16, and the randomized secret ID information (R (ID ₂ )) is sent to the key generation unit (TA ₁ ) 117 and the verification unit 118. Sent.

Next, the zero knowledge proof unit 131 of the terminal device 130 and the verification unit 118 of the key generation device 110 communicate using the transmission units 14 and 35 and the reception units 15 and 34, and the zero knowledge proof unit 131 performs the key generation device. A zero knowledge proof that the terminal device 130 knows the secret ID information (ID ₂ ) and the random value (y) is given to the verification unit 118 of 110 (step S14). A well-known method may be used for this zero knowledge proof (for example, see “Tatsuaki Okamoto, Hiroshi Yamamoto,“ Contemporary Cryptography (Series / Mathematics of Information Science) ”, Sangyo Tosho Co., Ltd., etc.). For example, zero knowledge proof is made by the following procedure.

1. The zero knowledge proof unit 131 uniformly selects a random value uεZ _p and calculates a ₁ = g ^u εG and a ₂ = g ₁ ^u εG.
2. The zero knowledge proof unit 131 sends a ₁ ∈G and a ₂ ∈G to the verification unit 118.
3. The verification unit 118 uniformly selects the random value wε {0, 1} and sends it to the zero knowledge proof unit 131.
4). The zero knowledge proof unit 131 sends b ₁ = u + w · yεZ _p and b ₂ = u + w · ID ₂ εZ _p to the verification unit 118.
5). The verification unit 118 verifies whether or not g ^b1 · g ₁ ^b2 = {R (ID ₂ )} ^w · g ^u · g ₁ ^u ∈G is satisfied.

If the verification unit 118 of the key generation device 110 determines that the zero knowledge proof is unacceptable, the process ends in error. On the other hand, when the verification unit 118 determines that the zero knowledge proof is acceptable, the key generation unit (TA ₀ ) 16 and the master secret key (MK) read from the storage unit 11 and the public received in step S13. The first secret key (SK (ID ₁ ) of the hierarchical ID-based encryption method using the ID information (ID ₁ ) and the public ID information (ID ₁ ) as an ID according to the key generation procedure of the hierarchical ID-based encryption method. ) Is generated (step S16). Since this process is the same as step S3 of the first embodiment, a description thereof will be omitted.

Next, the key generation unit (TA ₁₎ 117 is read public parameters (P) from the storage unit 11, using this with randomized secret ID information received in step _{S13 (R (ID 2))} , the hierarchy In accordance with the key generation procedure of the type ID-based encryption scheme, the second secret key of the hierarchical ID-based encryption scheme (ID) is a set of public ID information (ID ₁ ) and randomized secret ID information (R (ID ₂ )). SK (ID ₁ , R (ID ₂ )) is generated (step S17).

<< Step S17 when the method of Non-Patent Document 3 is used >>
In step S17 in the case of using the method of Non-Patent Document 3 as a hierarchical ID-based encryption scheme, first, the key generation unit (TA ₁₎ random number generation unit 117a of the 117 (FIG. 6) is the number of random
r ₂ ∈Z _p … (23)
Is selected and output (step S17a). Next, the calculation unit 117ba of the second hierarchy calculation unit 117b reads the input first secret key (SK (ID ₁ ) = (d ₀ , d ₁ )) (formula (13)) from the storage unit 11 The elements g ₁ and h _{2 of the} public parameter P, the received randomized secret ID information (R (ID ₂ )), and the output random number r ₂ are used.

の演算を行い（ステップＳ１７ｂ）、演算部１１７ｂｂが、記憶部１１から読み込んだ公開パラメータPの要素gと、出力されたランダム数r₂とを用い、

Performs the operation of (step S17b), calculating unit 117bb is used and elements g of public parameters P read from the storage unit 11, and a random number r ₂ output,

の演算を行い（ステップＳ１７ｃ）、第２階層演算部１１７ｂが、第２秘密鍵

Is calculated (step S17c), and the second hierarchy calculation unit 117b receives the second secret key.

を出力する（ステップＳ１７ｄ／《非特許文献３の方式を用いた場合のステップＳ１７》の説明終わり）。

(Step S17d / << End of description of Step S17 when the method of Non-Patent Document 3 is used).

The second secret key (SK (ID _1, R (ID ₂₎₎ is transmitted from the transmission unit 14 (output) (step S18), (input received by the receiving portion 35 of the terminal apparatus 130) ( Step S19) The second secret key (SK (ID ₁ , R (ID ₂ )) is sent to the random removal unit 139, and the random removal unit 139 receives the received second secret key (SK (ID ₁ , R (ID ₂ )), the random number (y) read from the storage unit 31 and the public parameter (P), and a set of public ID information (ID ₁ ) and secret ID information (ID ₂ ) is used as an ID The third secret key (SK (ID ₁ , ID ₂ )) of the hierarchical ID-based encryption method is restored (step S20), and the third secret key (SK (ID ₁ , ID ₂ )) is used as public ID information ( It becomes a secret key for decrypting a ciphertext of a hierarchical ID-based encryption scheme in which a set of ID ₁ ) and secret ID information (ID ₂ ) is an ID.

<< Step S20 when the method of Non-Patent Document 3 is used >>
In step S20 when the method of Non-Patent Document 3 is used as the hierarchical ID-based encryption method, first, the random number generation unit 139a (FIG. 6) of the random removal unit 139 performs random numbers.
z∈Z _p … (27)
Is selected and output (step S20a). Next, the calculation unit 139ba of the random removal calculation unit 139b inputs the input second secret key (SK (ID ₁ , R (ID ₂ )) (formula (26)) and the public parameter read from the storage unit 31 ( P) using the elements (g, g ₁ , h ₂ ) and random number (y) and the output random number (z)

の演算を行い（ステップＳ２０ｂ）、演算部１３９ｂｂが、入力された第２秘密鍵（SK(ID₁,R(ID₂))（式(26)）と、記憶部３１から読み込んだ公開パラメータ（P）の要素（g）と、出力されたランダム数（z）とを用い、

(Step S20b), the calculation unit 139bb inputs the input second secret key (SK (ID ₁ , R (ID ₂ )) (formula (26)) and the public parameter read from the storage unit 31 ( P) element (g) and the output random number (z)

の演算を行い（ステップＳ２０ｃ）、ランダム除去演算部１３９ｂが、

(Step S20c), the random removal calculation unit 139b

を出力する（ステップＳ２０ｄ／《非特許文献３の方式を用いた場合のステップＳ２０》の説明終わり）。

(Step S20d / << End of description of Step S20 when the method of Non-Patent Document 3 is used).

[Encryption / decryption processing]
Since it is the same as 1st Embodiment, description is abbreviate | omitted.

<Features of this embodiment>
In this embodiment, only the public ID information being transmitted from the terminal device 130 to the key generation device 110 (ID ₁₎ and randomized secret ID information (R (ID _2)), the secret ID information (ID ₂₎ is Not sent. Further, the terminal device 130 cancels the randomness of the second secret key (SK (ID ₁ , R (ID ₂ )) generated by the key generation device 110, and the public ID information (ID ₁ ) and the secret ID information ( the third private key hierarchical ID-based encryption scheme to set the ID of _{ID 2) (SK (ID 1} , ID 2)) to restore, the third secret key _{(SK (ID 1, ID 2} )) The key generation device 110 that does not know the secret ID information (ID ₂ ) cannot know the third secret key (SK (ID ₁ , ID ₂ )), thereby avoiding the escrow property. In addition, the terminal device 20 can generate a ciphertext by using an ID made up of a set of the public ID information (ID ₁ ) and the secret ID information (ID ₂ ) of the terminal device 130 and a public parameter, which is convenient. high.

  The present invention is not limited to the embodiment described above. For example, in each of the above-described embodiments, the key generation device, the terminal device, and the terminal devices transmit and receive information via the network. However, the key generation device and the terminal device and / or the terminal devices may be configured such that information is input / output through a portable recording medium. That is, the information output from the key generation device or the terminal device is stored in a portable recording medium, and the portable recording medium is mounted on another terminal device or the key generation device, and the information is read therefrom. There may be.

In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. Needless to say, other modifications are possible without departing from the spirit of the present invention.
Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.
The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  The present invention can be used for encrypted communication using an ID-based encryption method.

1,100 cryptographic communication system

Claims (10)

A first storage unit storing at least a master secret key for generating each secret key of the hierarchical ID-based encryption method and public ID information corresponding to a user who uses the secret key;
A hierarchical type using the master secret key read from the first storage unit and public ID information corresponding to any user as an ID according to a key generation procedure of a hierarchical ID-based encryption method A first secret key generation unit that generates a first secret key of an ID-based encryption method;
An output unit that outputs the first secret key; and a key generation device including:
A second storage unit storing secret ID information corresponding to a certain user;
An input unit for inputting the first secret key output from the key generation device;
Using the secret ID information read from the second storage unit and the first secret key input to the input unit, according to a key generation procedure of a hierarchical ID-based encryption method, the public ID information and the secret ID information A second secret key generation unit that generates a second secret key of a hierarchical ID-based encryption scheme that uses a set of
The key generation device and the terminal device are independent devices,
The secret ID information is private information to the key generation device;
The second secret key is a secret key for decrypting a ciphertext of a hierarchical ID-based encryption scheme having a set of the public ID information and the secret ID information as an ID;
A cryptographic communication system characterized by the above. A first storage unit storing at least a master secret key for generating each secret key of the hierarchical ID-based encryption method and public ID information corresponding to a user who uses the secret key;
An input unit for inputting randomized secret ID information obtained by randomizing secret ID information corresponding to a certain user by a random number;
The master secret key and the public ID information corresponding to the user corresponding to the randomized secret ID information are read from the first storage unit, and the public key information is generated according to the key generation procedure of the hierarchical ID-based encryption method using them. A first secret key generation unit that generates a first secret key of a hierarchical ID-based encryption scheme using ID information as an ID;
A hierarchical ID base that uses the first secret key and the randomized secret ID information as an ID for a set of the public ID information and the randomized secret ID information according to a key generation procedure of a hierarchical ID base encryption scheme A second secret key generation unit for generating a second secret key of the encryption method;
An output unit that outputs the second secret key; and a key generation device including:
An input unit for inputting the second secret key output from the key generation device;
A random removal unit that uses the second secret key and the random number to restore a third secret key of a hierarchical ID-based encryption scheme that uses a set of the public ID information and the secret ID information as an ID. A terminal device,
The key generation device and the terminal device are independent devices,
The secret ID information is private information to the key generation device;
The third secret key is a secret key for decrypting a ciphertext of a hierarchical ID-based encryption scheme having a set of the public ID information and the secret ID information as an ID;
A cryptographic communication system characterized by the above. The encryption communication system according to claim 1 or 2,
The public ID information is information corresponding to public information of a user who uses a secret key,
The secret ID information is information corresponding to the information of the user that is disclosed only to those who have a specific relationship with the user who uses the secret key.
A cryptographic communication system characterized by the above. The cryptographic communication system of claim 3,
The public ID information is information corresponding to the official name of the user who uses the secret key,
The secret ID information is information corresponding to a nickname of a user who uses a secret key.
A cryptographic communication system characterized by the above. The cryptographic communication system according to any one of claims 1 to 4,
The hierarchical ID-based encryption method is an anonymous hierarchical ID-based encryption method in which it is difficult to specify an ID corresponding to the ciphertext from a ciphertext generated according to the hierarchical ID-based encryption method.
A cryptographic communication system characterized by the above. An output unit that outputs public ID information corresponding to a certain user;
A second storage unit storing secret ID information corresponding to the user;
An input unit for inputting a first secret key of a hierarchical ID-based encryption scheme corresponding to the public ID information;
Using the secret ID information read from the second storage unit and the first secret key input to the input unit, according to a key generation procedure of a hierarchical ID-based encryption method, the public ID information and the secret ID information A second secret key generation unit that generates a second secret key of a hierarchical ID-based encryption scheme with a set of
A terminal device. An output unit that outputs public ID information corresponding to a certain user and randomized secret ID information obtained by randomizing the secret ID information corresponding to the user with a random number;
An input unit for inputting a secret key of a hierarchical ID-based encryption scheme corresponding to the public ID information and the randomized secret ID information;
A random removal unit that restores a secret key of a hierarchical ID-based encryption scheme using the secret key and the random number as an ID of a set of the public ID information and the secret ID information;
A terminal device. A secret key generation method for generating a secret key in the cryptographic communication system according to claim 1, comprising:
A first secret key generation unit of the key generation device uses the master secret key read from the first storage unit and public ID information corresponding to any user to generate a key of a hierarchical ID-based encryption method Generating a first secret key of a hierarchical ID-based encryption scheme using the public ID information as an ID according to the procedure;
An output unit of the key generation device outputting the first secret key;
Inputting the first secret key to the input unit of the terminal device;
A second secret key generation unit of the terminal device uses the secret ID information read from the second storage unit and the first secret key input to the input unit to generate a key of a hierarchical ID-based encryption scheme Generating a second secret key of a hierarchical ID-based encryption scheme having a set of the public ID information and the secret ID information as an ID according to a procedure;
A secret key generation method comprising: A secret key generation method for generating a secret key in the cryptographic communication system according to claim 2, comprising:
Randomized secret ID information obtained by randomizing secret ID information corresponding to a certain user with a random number is input to the input unit of the key generation device;
The first secret key generation unit of the key generation device reads the master secret key and public ID information corresponding to the user corresponding to the randomized secret ID information from the first storage unit, and uses these Generating a first secret key of a hierarchical ID-based encryption scheme using the public ID information as an ID according to a key generation procedure of the type ID-based encryption scheme;
A second secret key generation unit of the key generation device uses the first secret key and the randomized secret ID information, and follows the public ID information and the randomized secret according to a key generation procedure of a hierarchical ID-based encryption method. Restoring a second secret key of a hierarchical ID-based encryption scheme having a pair with ID information as an ID;
An output unit of the key generation device outputting the second secret key;
Inputting the second secret key to the input unit of the terminal device;
A random removal unit of the terminal device uses the second secret key and the random number to obtain a third secret key of a hierarchical ID-based encryption scheme having a set of the public ID information and the secret ID information as an ID. Steps to restore,
A secret key generation method comprising:   The program for functioning a computer as a terminal device of Claim 6 or 7.

Images