JP2010272899A - Key generating system, key generating method, blind server device, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a server for efficiently generating a secret key of a user while blinding user's ID for the server holding a master key in an ID based encryption system. <P>SOLUTION: In the blind server 200, a public information acquiring section 202 acquires public information and a hash function H (x) from a partial secret key generating server 100 for generating a master secret key k. A hash value calculating section 204 inputs the ID of a data receiving terminal device 400, and calculates a hash value h from the ID by the hash function H(x). A blind processing section 205 generates an ID' obtained by blinding the ID from the public information and the hash value h. An information transmitting section 208 transmits the ID' to the partial secret key generating server 100 to generate a partial key d' on the basis of the public information, the master secret key k and the ID'. A secret key generating section 206 generates a secret key d on the basis of the public information, the hash value h and the partial key d'. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a key generation system, a key generation method, a blind server device, and a program. The present invention particularly relates to a blind ID (identifier) based encryption system capable of domain management.

  ID-based encryption (IBE: Identity, Based, Encryption) was introduced in 1984 by Shamir as an approach to facilitate the management of public key certificates in PKI (Public, Key, Infrastructure). A complete IBE scheme was proposed by Boneh and Franklin in 2001, 17 years after the introduction, and various systems using the scheme have been proposed to date (for example, Patent Document 1, Non-Patent Documents 1 to 3). 4). Above all, in IBE, since PKG (Private / Key / Generator) generates a user secret key, the key escrow problem that all user secret keys are known to PKG has been discussed. In order to solve this problem, a technique called blind ID-based encryption has begun to attract attention.

  Conventionally, in an asymmetric network system in which a high-speed unidirectional line is added to a bidirectional network, an anonymous communication method has been proposed in which a server cannot identify a client and a communication eavesdropper cannot know the communication contents. (For example, refer to Patent Document 2).

Japanese Patent Laying-Open No. 2005-210639 JP-A-10-336168

Dan Boneh, et al. , “Identity-Based Encryption from The Weil Pairing,” Advances in Cryptology—CRYPTO 2001, volume 2139, pages 213-229, Springer, 2001 Sattam S. Al-Riyami, et al. , “Certificateate Public Key Cryptography,” Advances in Cryptology-ASIA CRYPT 2003, volume 2894, pages 452-473, Springer, 2003 Byongcheon Lee, et al. , “Secure Key Issuing in ID-based Cryptography,” Proceedings of the Second Australian Information Security, Co., Ltd., ASW 2004, vol. Vipul Goyal, “Reduce Trust in the PKG in Identity Based Cryptologies,” Advances in Cryptology-CRYPTO 2007, volume 4622, pages 430-4447, pages 430-4447.

  Non-Patent Document 1 relates to an invention of an original scheme and system that is an actual solution of IBE. In this document, a hierarchical IBE is devised. Hierarchical IBE has the aim of configuring sub-PKGs under the root PKG and distributing the load per PKG. However, since the secret key and user secret key of the sub PKG are generated using the root secret key of the root PKG, the secret keys of all sub PKGs and all user secret keys are known from the root secret key of the root PKG. In this regard, there has been a problem that the key escrow problem exists in a form similar to or higher in risk than ordinary IBE.

  Non-Patent Document 2 relates to a technique for solving an IBE key deposit problem called CL-PKC (Certificateless, Public, Key, Cryptography). Data required for the PKG to generate an actual secret key called a partial secret key is sent to the user, and the user generates a secret key. However, this technique requires a user to create a user public key, and also needs to disclose the user public key as public information, which makes it difficult to manage and download the user public key as in the case of PKI. was there.

  Non-Patent Document 3 is a technique for solving the IBE key deposit problem, which is advantageous compared to Non-Patent Document 1 and Non-Patent Document 2 in that the number of authentications to PKG is reduced and a secure channel is not used. It is about. This technology uses a key distribution relay server called KPA (Key / Privacy / Authority) in addition to PKG, but the user accesses all KPAs and generates a secret key if they do not obtain a partial secret key from each. There is a problem that it is expensive to generate a secret key because it cannot be performed.

  Non-Patent Document 4 relates to a technique for proving the fraud of a secret key illegally generated by a PKG called A-IBE (Accountable / Authenticity / Identity / Based / Encryption). Although the IBE key deposit problem can be solved in the same manner as the above-described technique, there is a problem that the ID cannot be blinded to the PKG.

  Patent Document 1 is a hierarchical IBE key generation system that does not rely on the security of conventional encrypted communication using a mapping such as Weil and Pairing, and is based on other mathematical problems. The present invention relates to a system for ensuring safety. However, as with the normal hierarchical IBE system, since the master secret key of the relay server is generated from the root PKG, there is a problem that there is a key escrow problem in that all the user secret keys are known to the root PKG. was there.

  Patent Document 2 relates to a method of browsing content while blinding only client information by using a relay server for content requested by a client from a content server. However, this method is based on the premise that the client information is not included in the content itself, and if the client information is included in the content itself, such as a user public key (ID) in IBE, There was a problem that it was impossible to operate the system while blinding client information.

  An object of the present invention is to provide a server that efficiently generates a user's secret key while blinding the user's ID with respect to a server that holds a master key in an ID-based encryption scheme, for example.

A key generation system according to one aspect of the present invention includes:
For a terminal device that receives ciphertext encrypted by an ID (identifier) -based encryption method using predetermined public information and a hash value obtained from a terminal identifier for identifying itself by a predetermined hash function, A key generation system for generating a secret key for decrypting a sentence,
An information disclosure unit for storing the public information and the hash function in a storage device;
A key generation server device including a master key generation unit that generates a master key serving as a basis of the secret key from a public information stored by the information disclosure unit;
A public information acquisition unit that acquires public information and a hash function stored by the information disclosure unit of the key generation server device;
A hash value calculation unit that inputs the terminal identifier and calculates the hash value by a processing device using a hash function acquired by the public information acquisition unit from the input terminal identifier;
A blind processing unit that generates a blind identifier obtained by blindly blinding the terminal identifier from the public information acquired by the public information acquisition unit and the hash value calculated by the hash value calculation unit;
A blind server device comprising: an information transmission unit that transmits the blind identifier generated by the blind processing unit to the key generation server device;
The key generation server device further includes:
An information receiving unit that receives the blind identifier transmitted by the information transmitting unit of the blind server device;
A partial key generation unit that generates a partial key by a processing device based on public information stored by the information disclosure unit, a master key generated by the master key generation unit, and a blind identifier received by the information reception unit When,
An information transmission unit that transmits the partial key generated by the partial key generation unit to the blind server device;
The blind server device further includes:
An information receiving unit that receives the partial key transmitted by the information transmitting unit of the key generation server device;
A secret key for generating the secret key by the processing device based on the public information acquired by the public information acquisition unit, the hash value calculated by the hash value calculation unit, and the partial key received by the information reception unit And a generation unit.

  According to one aspect of the present invention, a blind server device acquires predetermined public information and a predetermined hash function from a key generation server device that generates a master key, inputs a terminal identifier, and uses a hash function from the terminal identifier. The hash value is calculated using the public information and the hash value to generate a blind identifier in which the terminal identifier is blinded. The blind identifier is transmitted to the key generation server device, and the partial value is based on the public information, the master key, and the blind identifier. Since the key is generated and the secret key is generated based on the public information, the hash value, and the partial key, the secret key of the user is efficiently generated while the user ID is blinded to the key generation server device. Is possible.

1 is a block diagram showing a configuration of a key generation system according to Embodiment 1. FIG. 2 is a diagram illustrating an example of a hardware configuration of each device according to Embodiment 1. FIG. 6 is a flowchart showing an operation of the partial secret key generation server according to the first embodiment. 4 is a flowchart showing an operation of the data receiving terminal device according to the first embodiment. 4 is a flowchart showing an operation of the blind server according to the first embodiment. 6 is a flowchart showing an operation of the partial secret key generation server according to the first embodiment. 3 is a flowchart showing an operation of the data transmission terminal apparatus according to the first embodiment. 4 is a flowchart showing an operation of the data receiving terminal device according to the first embodiment. 6 is a block diagram illustrating a configuration of a key generation system according to Embodiment 2. FIG. FIG. 10 is a block diagram illustrating a configuration of a key generation system according to Embodiment 3. 10 is a flowchart showing an operation of the blind server according to the third embodiment. 10 is a flowchart showing the operation of the partial secret key generation server according to the third embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

Embodiment 1 FIG.
FIG. 1 is a block diagram showing a configuration of a key generation system 10 according to the present embodiment.

  In FIG. 1, a key generation system 10 includes a partial secret key generation server 100 (key generation server device), a blind server 200 (blind server device), a data transmission terminal device 300, and a data reception terminal device 400 (terminal device). The partial secret key generation server 100 and the blind server 200 communicate with each other via a network 20 such as the Internet. The blind server 200 and the data receiving terminal device 400 communicate with each other via a secure network 30 such as a company internal network. The data transmission terminal device 300 and the data reception terminal device 400 communicate with each other via the network 20 such as the Internet. A plurality of blind servers 200 and a plurality of data transmission terminal devices 300 may be connected to the network 20. A plurality of data receiving terminal devices 400 may be connected to the network 30. For example, if a configuration is adopted in which a plurality of data receiving terminal devices 400 belonging to the same domain (such as a company department) are connected to the blind server 200 dedicated to the domain via the network 30 of the domain, domain management is easy. Can provide a secure system.

  The partial secret key generation server 100 is a server that generates a partial secret key in ID (identifier) -based encryption (IBE), and includes a prime number generation unit 101, a random number generation unit 102, an information disclosure unit 103, a master key generation unit 104, a partial A key generation unit 105, an information reception unit 106, and an information transmission unit 107 are included. Although not shown, the partial secret key generation server 100 includes hardware such as a processing device, a storage device, an input device, and an output device. The hardware is used by each unit of the partial secret key generation server 100.

  The blind server 200 is a relay server that blinds an ID, and includes a random number generation unit 201, a public information acquisition unit 202, an authentication unit 203, a hash value calculation unit 204, a blind processing unit 205, a secret key generation unit 206, and an information reception unit 207. And an information transmission unit 208. Although not shown, the blind server 200 includes hardware such as a processing device, a storage device, an input device, and an output device. The hardware is used by each part of the blind server 200.

  The data transmission terminal device 300 is a terminal used by a sender of encrypted data, and includes a random number generation unit 301, a public information acquisition unit 302, an encryption processing unit 303, an information reception unit 305, and an information transmission unit 306. Although not shown, the data transmission terminal device 300 includes hardware such as a processing device, a storage device, an input device, and an output device. The hardware is used by each unit of the data transmission terminal device 300.

  The data receiving terminal device 400 is a terminal used by a receiver of encrypted data, and includes a public information acquisition unit 402, a decryption processing unit 404, an information receiving unit 405, and an information transmitting unit 406. Although not shown, the data receiving terminal device 400 includes hardware such as a processing device, a storage device, an input device, and an output device. The hardware is used by each unit of the data receiving terminal device 400.

  FIG. 2 is a diagram illustrating an example of a hardware configuration of each device (partial secret key generation server 100, blind server 200, data transmission terminal device 300, and data reception terminal device 400) of the key generation system 10.

  In FIG. 2, a partial secret key generation server 100, a blind server 200, a data transmission terminal device 300, or a data reception terminal device 400 are computers, an LCD 901 (Liquid / Crystal / Display), a keyboard 902 (K / B). And hardware devices such as a mouse 903, an FDD 904 (Flexible Disk Drive), a CDD 905 (Compact Disk Drive), and a printer 906. These hardware devices are connected by cables and signal lines. Instead of the LCD 901, a CRT (Cathode / Ray / Tube) or other display device may be used. Instead of the mouse 903, a touch panel, a touch pad, a trackball, a pen tablet, or other pointing devices may be used.

  The partial secret key generation server 100, the blind server 200, the data transmission terminal device 300, or the data reception terminal device 400 includes a CPU 911 (Central Processing Unit) that executes a program. The CPU 911 is an example of a processing device. The CPU 911 includes a ROM 913 (Read / Only / Memory), a RAM 914 (Random / Access / Memory), a communication board 915, an LCD 901, a keyboard 902, a mouse 903, an FDD 904, a CDD 905, a printer 906, and an HDD 920 (Hard / Disk) via a bus 912. Connected with Drive) to control these hardware devices. Instead of the HDD 920, a flash memory, an optical disk device, a memory card reader / writer, or other storage medium may be used.

  The RAM 914 is an example of a volatile memory. The ROM 913, the FDD 904, the CDD 905, and the HDD 920 are examples of nonvolatile memories. These are examples of the storage device. The communication board 915, the keyboard 902, the mouse 903, the FDD 904, and the CDD 905 are examples of input devices. The communication board 915, the LCD 901, and the printer 906 are examples of output devices.

  The communication board 915 is connected to a LAN (Local / Area / Network) or the like. The communication board 915 is not limited to a LAN, but is an IP-VPN (Internet, Protocol, Private, Network), a wide area LAN, an ATM (Asynchronous / Transfer / Mode) network, or a WAN (Wide / Area / Network) It does not matter if it is connected to. LAN, WAN, and the Internet are examples of the networks 20 and 30.

  The HDD 920 stores an operating system 921 (OS), a window system 922, a program group 923, and a file group 924. The programs in the program group 923 are executed by the CPU 911, the operating system 921, and the window system 922. The program group 923 includes programs that execute the functions described as “˜units” in the description of the present embodiment. The program is read and executed by the CPU 911. The file group 924 includes data, information, and signal values described as “˜data”, “˜information”, “˜ID (identifier)”, “˜flag”, and “˜result” in the description of this embodiment. And variable values and parameters are included as items of “˜file”, “˜database”, and “˜table”. The “˜file”, “˜database”, and “˜table” are stored in a storage medium such as the RAM 914 or the HDD 920. Data, information, signal values, variable values, and parameters stored in a storage medium such as the RAM 914 and the HDD 920 are read out to the main memory and the cache memory by the CPU 911 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. It is used for processing (operation) of the CPU 911 such as calculation, control, output, printing and display. During the processing of the CPU 911 such as extraction, search, reference, comparison, calculation, calculation, control, output, printing, and display, data, information, signal values, variable values, and parameters are temporarily stored in the main memory, cache memory, and buffer memory. Remembered.

  The arrows in the block diagrams and flowcharts used in the description of this embodiment mainly indicate input / output of data and signals. Data and signals are recorded in memory such as RAM 914, FDD904 flexible disk (FD), CDD905 compact disk (CD), HDD920 magnetic disk, optical disk, DVD (Digital Versatile Disc), or other recording media Is done. Data and signals are transmitted by a bus 912, a signal line, a cable, or other transmission media.

  In the description of the present embodiment, what is described as “to part” may be “to circuit”, “to device”, “to device”, and “to step”, “to process”, “to”. ~ Procedure "," ~ process ". That is, what is described as “˜unit” may be realized by firmware stored in the ROM 913. Alternatively, what is described as “˜unit” may be realized only by software, or only by hardware such as an element, a device, a board, and wiring. Alternatively, what is described as “to part” may be realized by a combination of software and hardware, or a combination of software, hardware and firmware. Firmware and software are stored as programs in a recording medium such as a flexible disk, a compact disk, a magnetic disk, an optical disk, and a DVD. The program is read by the CPU 911 and executed by the CPU 911. That is, the program causes the computer to function as “to part” described in the description of the present embodiment. Or a program makes a computer perform the procedure and method of "-part" described by description of this Embodiment.

  FIG. 3 is a flowchart showing an operation in which the partial secret key generation server 100 generates a master secret key and a public parameter.

The prime number generation unit 101 of the partial secret key generation server 100 generates a prime number p by the processing device. The information disclosure unit 103 of the partial secret key generation server 100 uses the processing device to generate a cyclic group G, G ₁ , bilinear mapping e: G × G → G ₁ with the prime number p generated by the prime number generation unit 101 as an order. The generation source g of the generated cyclic group G is stored in the storage device. That is, the partial secret key generation server 100 uses the prime number generation unit 101 to generate a prime number p, generates cyclic groups G and G ₁ with the prime number p as an order (step S101), and generates a generation source of the cyclic group G. It is set as g (step S102). When G × G → G ₁ exists, G ₁ has a bilinear map e (step S103).

The random number generation unit 102 of the partial secret key generation server 100 generates random numbers g ₂ and g ₃ (g ₂ , g ₃ εG) by the processing device. That is, the partial secret key generation server 100 uses the random number generation unit 102 to generate random numbers g ₂ and g ₃ such that g ₂ and g ₃ ∈G (step S104).

The random number generation unit 102 of the partial secret key generation server 100 generates a random number α (αεZ _q ) by the processing device. That is, the partial secret key generation server 100 uses the random number generation unit 102 to generate a random number α such that αεZ _q (step S105).

を計算し、当該計算結果を文字列ｘのハッシュ値として出力するハッシュ関数Ｈ（ｘ）を処理装置で生成する。即ち、部分秘密鍵生成サーバ１００は、乱数生成部１０２により、ｕ_ｊ∈Ｇとなるような乱数ｕ_ｊを生成し、任意の文字列ｘをｎビットにセグメントするａ_ｊを上記のように用いるハッシュ関数Ｈ（ｘ）を生成する（ステップＳ１０６）。 The random number generation unit 102 of the partial secret key generation server 100 generates t (t> 1) random numbers u _j (u _j εG, j = 1,..., T). When an arbitrary character string x is input, the information disclosure unit 103 of the partial secret key generation server 100 receives t pieces of data obtained by dividing the character string x into n (n = | x | / t) bits. Using a _j and the random number u _j generated by the random number generation unit 102,

And a hash function H (x) that outputs the calculation result as a hash value of the character string x is generated by the processing device. That is, the partial secret key generation server 100 uses the random number generation unit 102 to generate a random number u _j such that u _j εG, and uses a _j that segments an arbitrary character string x into n bits as described above. A hash function H (x) is generated (step S106).

The information disclosure unit 103 of the partial secret key generation server 100 generates g ₁ (g ₁ = g ^α ) by the processing device, and stores g, g ₁ , g ₂ , and g ₃ as public information in the storage device. In addition, the information disclosure unit 103 stores the generated hash function H (x) in a storage device. Here, the public information and the hash function H (x) are combined and defined as a public parameter params = (g, g ₁ , g ₂ , g ₃ , H (x)). That is, the partial secret key generation server 100 generates g ₁ (= g ^α ) by using the information disclosure unit 103, sets the public parameters as g, g ₁ , g ₂ , g ₃ , H, and publishes them (step S107). .

The master key generation unit 104 of the partial secret key generation server 100 uses a master secret key k (master) as a basis of a user secret key (secret key of the data receiving terminal device 400, etc.) from the public information stored by the information disclosure unit 103. Key) is generated by the processing device. Specifically, the master key generation unit 104, a g ₂ included in the public information and bottom, calculated by the processing device the power of the random number α generated by the random number generation unit 102 and the index, the calculation result Store in the storage device as a master secret key k. That is, the partial secret key generation server 100 generates the master secret key k represented by the following equation by the master key generation unit 104 (step S108).

  Steps S101 to S108 are performed periodically or in consideration of the compromise of the master secret key k, but may be performed for each encrypted communication.

  FIG. 4 is a flowchart showing an operation in which the data receiving terminal device 400 requests issuance of a user secret key. FIG. 5 is a flowchart showing an operation in which the blind server 200 generates a user secret key. FIG. 6 is a flowchart showing an operation in which the partial secret key generation server 100 generates a partial secret key.

  It is assumed that the authentication unit 203 of the blind server 200 stores the ID (terminal identifier) and password of the data receiving terminal device 400 in the storage device in advance. That is, as a precondition, the data receiving terminal device 400 registers an ID and a password in the blind server 200.

  The public information acquisition unit 202 of the blind server 200 acquires the public information and the hash function H (x) stored by the information disclosure unit 103 of the partial secret key generation server 100. That is, the blind server 200 acquires the public parameters disclosed by the partial secret key generation server 100 using the public information acquisition unit 202 (step S301). Note that step S301 may be performed only when the public parameters of the partial secret key generation server 100 are changed.

  The information transmitting unit 406 of the data receiving terminal device 400 transmits an ID for identifying itself and a password to the blind server 200. That is, the data receiving terminal device 400 transmits the ID and password to the blind server 200 using the information transmitting unit 406 (step S201).

  The information receiving unit 207 of the blind server 200 receives the ID and password transmitted by the information transmitting unit 406 of the data receiving terminal device 400. The authentication unit 203 of the blind server 200 determines whether or not the ID and password received by the information receiving unit 207 match the ID and password stored in the storage device in advance by the processing device, whereby the data receiving terminal device 400 authentications are performed. That is, the blind server 200 receives the ID and password transmitted from the data receiving terminal device 400 using the information receiving unit 207, and inputs them to the authentication unit 203 (step S302).

When the authentication by the authentication unit 203 is successful, that is, when the ID and the password match, the hash value calculation unit 204 of the blind server 200 inputs the ID and is acquired by the public information acquisition unit 202 from the input ID. The hash value h is calculated by the processing device using the hash function H (x). The blind processing unit 205 of the blind server 200 is configured to process an ID ′ (blind identifier) in which the ID is blinded from the public information acquired by the public information acquisition unit 202 and the hash value h calculated by the hash value calculation unit 204. Generate with In the present embodiment, the random number generation unit 201 of the blind server 200 generates a random number y (second random number) (yεZ _q ) by the processing device, and this random number y is generated when the blind processing unit 205 generates ID ′. Also use. That is, the blind processing unit 205 processes ID ′ from the public information acquired by the public information acquisition unit 202, the hash value h calculated by the hash value calculation unit 204, and the random number y generated by the random number generation unit 201. Generate by device. Specifically, the blind processing unit 205 multiplies the power using the g included in the public information as a base and the random number y as an exponent and the random number y by the processing device, and stores the multiplication result as ID ′. To remember. That is, when the authentication is successful, the blind server 200 generates an ID (ID ′) subjected to blind processing using the ID and the random number y generated by the random number generation unit 201 as shown in the following equation (step S303). In the following formula, i represents ID, and i ′ represents ID ′.

  The information transmission unit 208 of the blind server 200 uses the partial secret key generation server to generate the ID ′ generated by the blind processing unit 205 in order to cause the partial secret key generation server 100 to generate a partial secret key d ′ (partial key) described later. To 100. That is, the blind server 200 transmits the blind ID (ID ′) to the partial secret key generation server 100 using the information transmission unit 208 (step S304).

  The information reception unit 106 of the partial secret key generation server 100 receives the ID ′ transmitted by the information transmission unit 208 of the blind server 200. That is, the partial secret key generation server 100 receives the ID ′ transmitted from the blind server 200 using the information receiving unit 106 (step S401).

The partial key generation unit 105 of the partial secret key generation server 100 includes the public information stored by the information disclosure unit 103, the master secret key k generated by the master key generation unit 104, and the ID ′ received by the information reception unit 106. Based on the above, the partial secret key d ′ is generated by the processing device. In the present embodiment, the random number generation unit 102 of the partial secret key generation server 100 generates a random number r (third random number) (rεZ _q ) by the processing device, and the partial key generation unit 105 generates the partial secret key d ′. This random number r is also used when generating. That is, the partial key generation unit 105 includes the public information stored by the information disclosure unit 103, the master secret key k generated by the master key generation unit 104, the ID ′ received by the information reception unit 106, and the random number generation unit 102. Based on the generated random number r, a partial secret key d ′ is generated by the processing device. Specifically, the partial key generation unit 105 multiplies the master secret key k, the power of ID ′ and g ₃ included in the public information by the base, and the power of the random number r as an exponent by the processing device. The multiplication result is stored in the storage device as the partial secret key d ₀ ′. In addition, the partial key generation unit 105 calculates a power using the g included in the public information as a base and the random number r as an exponent by the processing device, and stores the calculation result as additional information d ₁ ′ in the storage device. Here, the partial secret key d ′ is obtained by adding the additional information d ₁ ′ to the partial secret key d ₀ ′. That is, the partial secret key generation server 100 generates a random number r using the random number generation unit 102, and generates a partial secret key d ′ using the generated random number r as shown in the following equation (step S402).

  The information transmission unit 107 of the partial secret key generation server 100 transmits the partial secret key d ′ generated by the partial key generation unit 105 to the blind server 200. That is, the partial secret key generation server 100 transmits the partial secret key d ′ to the blind server 200 using the information transmission unit 107 (step S403).

  The information reception unit 207 of the blind server 200 receives the partial secret key d ′ transmitted by the information transmission unit 107 of the partial secret key generation server 100. That is, the blind server 200 receives the partial secret key d ′ using the information receiving unit 207 (step S305).

The secret key generation unit 206 of the blind server 200 includes the public information acquired by the public information acquisition unit 202, the hash value h calculated by the hash value calculation unit 204, and the partial secret key d ′ received by the information reception unit 207. Based on the above, a secret key d (user secret key) is generated by the processing device. In the present embodiment, the random number generation unit 201 of the blind server 200 generates a random number z (first random number) (zεZ _q ) by the processing device, and the secret key generation unit 206 generates this secret key d when generating the secret key d. A random number z is also used. Further, in the present embodiment, the random number y described above is also used when the secret key generation unit 206 generates the secret key d. That is, the secret key generation unit 206 generates the public information acquired by the public information acquisition unit 202, the hash value h calculated by the hash value calculation unit 204, the partial secret key d ′ received by the information reception unit 207, and random number generation. Based on the random number y and the random number z generated by the unit 201, the secret key d is generated by the processing device. Specifically, the secret key generation unit 206 uses the partial secret key d ₀ ′ included in the partial secret key d ′ and the additional information d ₁ ′ included in the partial secret key d ′ as the base, and the random number y as an index. and the quotient of the exponentiation, the bottom of the product of g ₃ and the hash value h included in the public information, multiplied by the processing device the power of bets for the random number z and index, the multiplication result as the secret key d ₀ Store in the storage device. Also, the secret key generation unit 206 multiplies the additional information d ₁ ′ included in the partial secret key d ′ by a power that uses g included in the public information as a base and a random number z as an exponent, stored in the storage device the multiplication results as the additional information d _1. In this case, obtained by adding the additional information d ₁ to the secret key d ₀ is the secret key d. That is, the blind server 200 generates the random number z by using the random number generation unit 201 and generates the secret key d using the partial secret key d ′, the random number y, and the random number z as shown in the following equation (step S306).

Incidentally, in the above equation, 2-4 line equation of the private key d ₀ is not calculated by the secret key generating unit 206 of the blind server 200, the private key d _0, the master secret key k, the hash the product of the g ₃ in the value h and the public information and the bottom, and shows that the equivalent to multiplication powers bets to the sum of the random number r and the random number z and index. In this way, the secret key generation unit 206 of the blind server 200 can generate the secret key d ₀ based on the master secret key k without using the master secret key k that only the partial secret key generation server 100 knows. it can. Further, in the above formula, the second and third lines of the additional information d ₁ formula are not calculated by the secret key generation unit 206 of the blind server 200, and the additional information d ₁ includes g included in the public information. It shows that it corresponds to the power of the base and the sum of the random number r and the random number z as an exponent. As described above, the secret key generation unit 206 of the blind server 200 can generate the additional information d ₁ including the information of the random number r without using the random number r known only by the partial secret key generation server 100.

  The information transmission unit 208 of the blind server 200 transmits the secret key d generated by the secret key generation unit 206 to the data receiving terminal device 400. That is, the blind server 200 transmits the secret key d using the information transmission unit 208 (step S307).

  The information receiving unit 405 of the data receiving terminal device 400 receives the secret key d transmitted by the information transmitting unit 208 of the blind server 200. That is, the data receiving terminal device 400 receives the secret key d using the information receiving unit 405 (step S202).

  Steps S201 and S202, steps S301 to S307, and steps S401 to S403 are performed periodically or in consideration of compromise of the private key d of the data receiving terminal device 400, but may be performed for each encrypted communication. Good.

  As described above, according to the present embodiment, the blind server 200 acquires the public information and the hash function H (x) from the partial secret key generation server 100 that generates the master secret key k, and the data receiving terminal device 400 IDs are input, a hash value h is calculated from the ID by a hash function H (x), ID 'blinded with ID is generated from public information and hash value h, and ID' is partially secret key generation server To generate the partial key d ′ based on the public information, the master secret key k, and ID ′, and to generate the secret key d based on the public information, the hash value h, and the partial key d ′. It is possible to efficiently generate the user's secret key d while blinding the user's ID to the partial secret key generation server 100. Further, by using the random number y, the random number z, and the random number r, it is possible to provide a more secure system.

  According to the present embodiment, by installing a relay server, it is possible to reduce the risk of PKG (Private / Key / Generator) in the conventional IBE, that is, to avoid the key escrow problem. In addition, there is no need to generate and publish a user public key. In addition, the generation cost of the user secret key is reduced. Further, since the user secret key is generated while blinding the user ID, only the user secret key paired with the ID can be generated without exposing the ID to the server corresponding to the PKG in the conventional IBE, and the user's anonymity Will increase. Furthermore, domain management becomes possible.

  FIG. 7 is a flowchart showing an operation in which the data transmission terminal apparatus 300 encrypts data.

  The public information acquisition unit 302 of the data transmission terminal device 300 acquires the public information and the hash function H (x) stored by the information disclosure unit 103 of the partial secret key generation server 100. That is, the data transmission terminal device 300 acquires a public parameter from the partial secret key generation server 100 using the public information acquisition unit 302 (step S501). Note that step S501 may be performed only when the public parameters of the partial secret key generation server 100 are changed.

The random number generation unit 301 of the data transmission terminal device 300 generates a random number s (fourth random number) (sεZ _q ) by the processing device. The encryption processing unit 303 of the data transmission terminal device 300 acquires the ID, for example, by receiving the ID of the data reception terminal device 400 from the data reception terminal device 400, and is acquired by the public information acquisition unit 302 from the acquired ID. A hash value h is calculated by the processing device using the hash function H (x). Also, the cryptographic processing unit 303 acquires the plaintext M by receiving, for example, an input of the plaintext M from the user by the input device. Then, the encryption processing unit 303 encrypts the acquired plaintext M by using the calculated hash value h, the public information acquired by the public information acquisition unit 302, and the random number s generated by the random number generation unit 301. Sentence C is generated by the processing device. Specifically, the encryption processing unit 303 sets the point g when the plaintext M and the bilinear map e (g ₁ , g ₂ ) (g ₁ and g ₂ included in the public information are points on the elliptic curve. a ₁ and a point g ₂ is in the bilinear mapping) the base is multiplied by the processing device the power of bets for the random number s and index stored in the storage device the multiplication result as a ciphertext C _0. In addition, the cryptographic processing unit 303 calculates a power using the product of the hash value h and g ₃ included in the public information as a base and the random number s as an exponent, and the calculation result is used as the first additional information C. ₁ is stored in the storage device. The encryption processing unit 303, a base-g included in the public information, calculated by the processing device the power of the random number s and index stored in the storage device the calculation result as the second additional information C _2. Here, those obtained by adding the first additional information C ₁ and the second additional information C ₂ is the ciphertext C to the ciphertext C _0. That is, the data transmission terminal device 300 generates a random number s using the random number generation unit 301, and uses the public parameter, the random number s, the ID of the data reception terminal device 400, and the plaintext M as shown in the following formula. C is calculated (step S502).

  The information transmission unit 306 of the data transmission terminal device 300 transmits the ciphertext C generated by the encryption processing unit 303 to the data reception terminal device 400. That is, the data transmission terminal device 300 transmits the ciphertext C to the data reception terminal device 400 using the information transmission unit 306 (step S503).

  FIG. 8 is a flowchart showing an operation in which the data receiving terminal device 400 decrypts the encrypted data.

  The public information acquisition unit 402 of the data receiving terminal device 400 acquires the public information and the hash function H (x) stored by the information disclosure unit 103 of the partial secret key generation server 100. That is, the data receiving terminal device 400 acquires a public parameter from the partial secret key generation server 100 using the public information acquisition unit 402 (step S601). Note that step S601 may be performed only when the public parameters of the partial secret key generation server 100 are changed.

  The information receiving unit 405 of the data receiving terminal device 400 receives the ciphertext C transmitted by the information transmitting unit 306 of the data transmitting terminal device 300. That is, the data receiving terminal device 400 receives the ciphertext C using the information receiving unit 405 (step S602).

The decryption processing unit 404 of the data reception terminal device 400 uses the public information stored by the information disclosure unit 103 of the partial secret key generation server 100 and the secret key d received by the information reception unit 405 to use the information reception unit 405. The decrypted ciphertext C is decrypted by the processing device, and the plaintext M is restored. Specifically, the decryption processing unit 404 includes the ciphertext C ₀ included in the ciphertext C and the bilinear mapping (d ₁ , C ₁ ) (additional information d ₁ included in the secret key d and the ciphertext C. When the first additional information C ₁ is a point on the elliptic curve, the product of the point d ₁ and the point C ₁ is a bilinear map), and the bilinear map (d ₀ , C ₂ ) ( and the point d ₀ and the point C ₂ is in the bilinear mapping when the second additional information C ₂ contained in the secret key d ₀ ciphertext C included in the secret key d and the point on the elliptic curve ), And the division result is stored in the storage device as plaintext M. Then, the decryption processing unit 404 outputs, for example, the plain text M stored in the storage device to the display screen by the output device. That is, the data receiving terminal device 400 calculates the plaintext M using the public parameter, the secret key d, and the ciphertext C as shown in the following equation (step S603).

In the key generation system 10, the data receiving terminal device 400 can directly acquire the secret key d from the partial secret key generation server 100 without using the blind server 200. In this case, the following formula is obtained.

  As described above, in the key generation system 10 according to the present embodiment, the sender generates encrypted data using the random number generation unit 301 and the public information acquisition unit 302 of the data transmission terminal device 300, and the information transmission unit 306 is used for transmission. The receiver receives the encrypted data using the information receiving unit 405 of the data receiving terminal device 400, and communicates with the blind server 200 and the partial secret key generation server 100 using the public information acquisition unit 402 and the information receiving unit 405. Receive the private key. The data receiving terminal device 400 can decrypt the encrypted data using the encrypted data, the public information, and the secret key.

  In the present embodiment, the recipient can receive the secret key via the blind server 200 without leaking the ID to the partial secret key generation server 100. Further, using the blind server 200 enables domain management. Further, although the blind server 200 owns the recipient's private key, the partial secret key generation server 100 cannot own the recipient's private key, so a more secure system can be provided. Further, it is not necessary for the blind server 200 to generate and manage a master secret key and public parameters. Further, the information disclosed by the blind server 200 is unnecessary for the recipient, and decryption is possible only with the public information of the partial secret key generation server 100. Further, the information disclosed by the blind server 200 is unnecessary for the sender, and encryption is possible only with the public information of the partial secret key generation server 100.

  In the present embodiment, there is no problem even if the number of data transmission terminal devices 300 is N. Further, there is no problem even if the number of data receiving terminal devices 400 is N. Further, although there are no problems with the number of blind servers 200, it is desirable that there be one blind server 200 for each domain. The partial secret key generation server 100 also has a conventional PKG function, and can be operated in the conventional manner without blinding.

Embodiment 2. FIG.
In the present embodiment, differences from the first embodiment will be mainly described.

  FIG. 9 is a block diagram showing the configuration of the key generation system 10 according to the present embodiment.

  9, the key generation system 10 includes a partial secret key generation server 100, blind servers 200a and 200b (blind server devices), and data transmission / reception terminal devices 500a and 500b (terminal devices). The partial secret key generation server 100 and the blind servers 200a and 200b communicate with each other via the network 20 such as the Internet. The blind server 200a and the data transmission / reception terminal device 500a communicate with each other via a secure network 30a such as a company internal network. Similarly, the blind server 200b and the data transmission / reception terminal device 500b communicate with each other via a secure network 30b such as a company internal network. The data transmission / reception terminal devices 500a and 500b communicate with each other via the network 20 such as the Internet. A plurality of data transmission / reception terminal devices 500a and 500b may be connected to the networks 30a and 30b. For example, if a configuration is adopted in which a plurality of data transmission / reception terminal devices 500a belonging to the same domain are connected to the blind server 200a dedicated to the domain via the network 30a of the domain, a secure system with easy domain management is provided. can do. Further, for example, one partial secret key generation server 100 manages N blind relay servers (blind servers 200a, 200b, etc.), and N users (data transmission / reception terminal device 500a) that can transmit and receive data by one relay server. , B, etc.) may be managed.

  Partial secret key generation server 100 is a server that generates a partial secret key in IBE, and is configured in the same manner as in the first embodiment.

  The blind servers 200a and 200b are relay servers that blind IDs, and are configured in the same manner as the blind server 200 in the first embodiment.

  The data transmission / reception terminal devices 500a and 500b are terminals used by users who transmit and receive encrypted data. The random number generation unit 501, the public information acquisition unit 502, the encryption processing unit 503, the decryption processing unit 504, the information reception unit 505, and information A transmission unit 506 is included. The operation of each unit of the data transmission / reception terminal devices 500a and 500b is the same as the operation of each unit having the same name in the data transmission terminal device 300 and the data reception terminal device 400 in the first embodiment (for example, the random number generation unit 501 (Same as the random number generation unit 301 of the data transmission terminal device 300, the public information acquisition unit 502 is the same as the public information acquisition unit 302 of the data transmission terminal device 300 and the public information acquisition unit 402 of the data reception terminal device 400) .

  For example, when the data transmission / reception terminal device 500a encrypts data and the data transmission / reception terminal device 500b decrypts the data, the data transmission / reception terminal device 500b requests the blind server 200b arranged on itself to issue a user secret key. To do. Operation in which partial secret key generation server 100 generates a master secret key and public parameters, operation in which blind server 200b generates a user secret key, and operation in which data transmission / reception terminal device 500b decrypts data encrypted by data transmission / reception terminal device 500a This is the same as in the first embodiment.

Embodiment 3 FIG.
In the present embodiment, differences from the first embodiment will be mainly described.

  FIG. 10 is a block diagram showing a configuration of the key generation system 10 according to the present embodiment.

  10, the key generation system 10 includes a partial secret key generation server 100, a blind server 200, a data transmission terminal device 300, and a data reception terminal device 400, as in the first embodiment.

  In the present embodiment, the partial secret key generation server 100 includes an authentication unit 108 in addition to the one shown in FIG.

  FIG. 11 is a flowchart showing an operation in which the blind server 200 generates a user secret key. FIG. 12 is a flowchart showing an operation in which the partial secret key generation server 100 generates a partial secret key.

  It is assumed that the authentication unit 108 of the partial secret key generation server 100 stores authentication information (for example, ID and password) of the blind server 200 in advance in a storage device. That is, as a precondition, the blind server 200 registers authentication information in the partial secret key generation server 100.

  Steps S301 to S303 are the same as those in the first embodiment shown in FIG.

  After step S <b> 303, the information transmission unit 208 of the blind server 200 transmits its authentication information to the partial secret key generation server 100 together with the ID ′ generated by the blind processing unit 205. In other words, the blind server 200 transmits the blind ID (ID ′) and authentication information to the partial secret key generation server 100 using the information transmission unit 208 (step S304a).

  The information receiving unit 106 of the partial secret key generation server 100 receives the authentication information together with the ID ′ transmitted by the information transmitting unit 208 of the blind server 200. The authentication unit 108 of the partial secret key generation server 100 determines whether or not the authentication information received by the information reception unit 106 matches the authentication information stored in the storage device in advance by the processing device. Authenticate. That is, the partial secret key generation server 100 receives the ID ′ and the authentication information transmitted from the blind server 200 using the information receiving unit 106, and inputs the authentication information to the authentication unit 108 (step S401a).

  The partial key generation unit 105 of the partial secret key generation server 100 generates the partial secret key d ′ by the processing device when the authentication by the authentication unit 108 is successful, that is, when the authentication information matches. That is, when the authentication is successful, the partial secret key generation server 100 generates the partial secret key d ′ as in the first embodiment (step S402a).

  Steps S306, S307, and S403 are the same as those in the first embodiment shown in FIGS.

  As described above, according to the present embodiment, the partial secret key generation server 100 generates the partial key d ′ only when the authentication of the blind server 200 is successful. Thus, it is possible to provide a highly reliable system.

  As mentioned above, although embodiment of this invention was described, you may implement combining 2 or more embodiment among these. Alternatively, one of these embodiments may be partially implemented. Or you may implement combining two or more embodiment among these partially.

  10 key generation system, 20, 30, 30a, b network, 100 partial secret key generation server, 101 prime number generation unit, 102 random number generation unit, 103 information disclosure unit, 104 master key generation unit, 105 partial key generation unit, 106 information Reception unit 107 Information transmission unit 108 Authentication unit 200, 200a, b Blind server 201 Random number generation unit 202 Public information acquisition unit 203 Authentication unit 204 Hash value calculation unit 205 Blind processing unit 206 Secret key generation Unit, 207 information reception unit, 208 information transmission unit, 300 data transmission terminal device, 301 random number generation unit, 302 public information acquisition unit, 303 encryption processing unit, 305 information reception unit, 306 information transmission unit, 400 data reception terminal device, 402 public information acquisition unit, 404 decryption processing unit, 405 information reception , 406 Information transmission unit, 500a, b Data transmission / reception terminal device, 501 Random number generation unit, 502 Public information acquisition unit, 503 Encryption processing unit, 504 Decryption processing unit, 505 Information reception unit, 506 Information transmission unit, 901 LCD, 902 Keyboard , 903 mouse, 904 FDD, 905 CDD, 906 printer, 911 CPU, 912 bus, 913 ROM, 914 RAM, 915 communication board, 920 HDD, 921 operating system, 922 window system, 923 program group, 924 file group.

Claims (9)

For a terminal device that receives ciphertext encrypted by an ID (identifier) -based encryption method using predetermined public information and a hash value obtained from a terminal identifier for identifying itself by a predetermined hash function, A key generation system for generating a secret key for decrypting a sentence,
An information disclosure unit for storing the public information and the hash function in a storage device;
A key generation server device including a master key generation unit that generates a master key serving as a basis of the secret key from a public information stored by the information disclosure unit;
A public information acquisition unit that acquires public information and a hash function stored by the information disclosure unit of the key generation server device;
A hash value calculation unit that inputs the terminal identifier and calculates the hash value by a processing device using a hash function acquired by the public information acquisition unit from the input terminal identifier;
A blind processing unit that generates a blind identifier obtained by blindly blinding the terminal identifier from the public information acquired by the public information acquisition unit and the hash value calculated by the hash value calculation unit;
A blind server device comprising: an information transmission unit that transmits the blind identifier generated by the blind processing unit to the key generation server device;
The key generation server device further includes:
An information receiving unit that receives the blind identifier transmitted by the information transmitting unit of the blind server device;
A partial key generation unit that generates a partial key by a processing device based on public information stored by the information disclosure unit, a master key generated by the master key generation unit, and a blind identifier received by the information reception unit When,
An information transmission unit that transmits the partial key generated by the partial key generation unit to the blind server device;
The blind server device further includes:
An information receiving unit that receives the partial key transmitted by the information transmitting unit of the key generation server device;
A secret key for generating the secret key by the processing device based on the public information acquired by the public information acquisition unit, the hash value calculated by the hash value calculation unit, and the partial key received by the information reception unit A key generation system comprising: a generation unit. The blind server device further includes:
A random number generator for generating the first random number by the processing device;
The secret key generation unit of the blind server device includes public information acquired by the public information acquisition unit, a hash value calculated by the hash value calculation unit, a partial key received by the information reception unit, and the random number generation unit The key generation system according to claim 1, wherein the secret key is generated by a processing device based on the first random number generated by. The random number generation unit of the blind server device further generates a second random number by the processing device,
The blind processing unit of the blind server device includes the blind information from the public information acquired by the public information acquisition unit, the hash value calculated by the hash value calculation unit, and the second random number generated by the random number generation unit. The identifier is generated by the processing device,
The secret key generation unit of the blind server device includes public information acquired by the public information acquisition unit, a hash value calculated by the hash value calculation unit, a partial key received by the information reception unit, and the random number generation unit The key generation system according to claim 2, wherein the secret key is generated by a processing device based on the first random number and the second random number generated by. The key generation server device further includes:
A random number generator for generating a third random number by the processing device;
The partial key generation unit of the key generation server device includes public information stored by the information disclosure unit, a master key generated by the master key generation unit, a blind identifier received by the information reception unit, and the random number generation unit 4. The key generation system according to claim 1, wherein the partial key is generated by a processing device based on the third random number generated by. The blind server device further includes:
An authentication unit that performs authentication of the terminal device by a processing device;
The key generation system according to any one of claims 1 to 4, wherein the hash value calculation unit of the blind server device inputs the terminal identifier when the authentication by the authentication unit is successful. The key generation server device further includes:
An authentication unit that performs authentication of the blind server device by a processing device;
The key generation system according to claim 1, wherein the partial key generation unit of the key generation server device generates the partial key when authentication by the authentication unit is successful. For a terminal device that receives ciphertext encrypted by an ID (identifier) -based encryption method using predetermined public information and a hash value obtained from a terminal identifier for identifying itself by a predetermined hash function, A key generation method for generating a secret key for decrypting a sentence,
A key generation server device stores the public information and the hash function in a storage device;
The key generation server device generates a master key that is a basis of the secret key from the public information stored in the storage device by a processing device,
The blind server device acquires the public information and the hash function stored by the key generation server device,
The blind server device inputs the terminal identifier, calculates the hash value by a processing device using the acquired hash function from the input terminal identifier,
The blind server device generates a blind identifier obtained by blinding the terminal identifier from the acquired public information and the calculated hash value by a processing device,
The blind server device transmits the generated blind identifier to the key generation server device;
The key generation server device receives the blind identifier transmitted by the blind server device;
The key generation server device generates a partial key in a processing device based on the public information stored in a storage device, the generated master key, and the received blind identifier,
The key generation server device transmits the generated partial key to the blind server device;
The blind server device receives the partial key transmitted by the key generation server device;
The key generation method, wherein the blind server device generates the secret key by a processing device based on the acquired public information, the calculated hash value, and the received partial key. For a terminal device that receives ciphertext encrypted by an ID (identifier) -based encryption method using predetermined public information and a hash value obtained from a terminal identifier for identifying itself by a predetermined hash function, A blind server device for generating a secret key for decrypting a sentence,
Release the public information and the hash function, and acquire the public information and the hash function from a key generation server device that generates a master key that is a basis of the secret key from the public information. And
A hash value calculation unit that inputs the terminal identifier and calculates the hash value by a processing device using a hash function acquired by the public information acquisition unit from the input terminal identifier;
A blind processing unit that generates a blind identifier obtained by blindly blinding the terminal identifier from the public information acquired by the public information acquisition unit and the hash value calculated by the hash value calculation unit;
An information transmission unit that transmits the blind identifier generated by the blind processing unit to the key generation server device, and causes the key generation server device to generate a partial key based on the public information, the master key, and the blind identifier When,
An information receiving unit for receiving the partial key from the key generation server device;
A secret key for generating the secret key by the processing device based on the public information acquired by the public information acquisition unit, the hash value calculated by the hash value calculation unit, and the partial key received by the information reception unit A blind server device comprising: a generation unit. For a terminal device that receives ciphertext encrypted by an ID (identifier) -based encryption method using predetermined public information and a hash value obtained from a terminal identifier for identifying itself by a predetermined hash function, A program for generating a secret key for decrypting a sentence,
Release the public information and the hash function, and acquire the public information and the hash function from a key generation server device that generates a master key that is a basis of the secret key from the public information. Processing,
A hash value calculation process in which the terminal identifier is input, and the hash value is calculated by a processing device using the hash function acquired by the public information acquisition process from the input terminal identifier;
Blind processing for generating a blind identifier by blindly blinding the terminal identifier from the public information acquired by the public information acquisition processing and the hash value calculated by the hash value calculation processing;
An information transmission process for transmitting the blind identifier generated by the blind process to the key generation server apparatus, and causing the key generation server apparatus to generate a partial key based on the public information, the master key, and the blind identifier; ,
An information reception process for receiving the partial key from the key generation server device;
A secret key for generating the secret key by a processing device based on the public information acquired by the public information acquisition process, the hash value calculated by the hash value calculation process, and the partial key received by the information reception process A program that causes a computer to execute generation processing.

Images