JP2012070054A - Decryption system, general-purpose terminal, highly-reliable terminal, key generation device, decryption method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To efficiently decrypt a cipher text using an ID base cipher to be recorded in a general-purpose terminal by a highly-reliable terminal.SOLUTION: A decryption system of the present invention includes a general-purpose terminal, a highly-reliable terminal, and a key generation device. The key generation device includes a secret key generation section and a cipher key generation section. The highly-reliable terminal includes a specific data transmission section, a random number generation section, an elliptic scalar magnification section, a session key calculation section, and a decryption section. The general-purpose terminal includes a bearing section and a transmission section. The elliptic scalar magnification section defines a value, which is obtained by magnifying a cipher key p by elliptic scalar through the use of a random number x, as a mask key p'. The bearing section of the general-purpose terminal acquires a mask session key k' as in an equation of k'=e(p',R), based on the mask key p' and an encryption session key R as against a cipher text C. The session key calculation section acquires a session key k, based on the mask session key k', through the use of the inverse element of the random number x. The decryption section acquires a plaintext M by decrypting the cipher text C through the use of the session key k.

Description

  The present invention relates to a decryption system, a general-purpose terminal, a highly reliable terminal, a key generation apparatus, a decryption method, and a program that reduce the risk of information leakage.

  There is a technology that uses ID-based encryption (Non-Patent Document 1) when transmitting confidential information by e-mail or the like. In such a technique, an encrypted mail received by a personal computer (general-purpose terminal) is normally decrypted on the personal computer. However, since the personal computer is used for general purposes, there is a risk that the decrypted information will be leaked if an illegal program is installed on the personal computer or if it is infected with a virus. Therefore, in order to reduce the risk of leakage of a private key for plaintext or ID-based encryption, there is a technique for transmitting a ciphertext received by a general-purpose terminal such as a personal computer to a mobile phone and decrypting it on the mobile phone.

Dan Boneh, Matthew Franklin, “Identity-Based Encryption from the Weil Pairing”, Appears in SIAM J. of Computing, Vol.32, No.3, pp.586-615, 2003.

  Mobile phones are safer than decryption methods on personal computers because they are less likely to install malicious programs than personal computers. However, since mobile phones have scarce computing resources, there is a problem that responsiveness decreases when performing operations that require a large amount of calculation such as pairing.

  In the present invention, ciphertext using ID-based encryption recorded by a general-purpose terminal (hereinafter referred to as “general-purpose terminal”) having sufficient computing resources such as a personal computer is calculated with high reliability like a mobile phone. The purpose is to perform decoding efficiently with a terminal with scarce resources (hereinafter referred to as a “highly reliable terminal”).

q is a prime number, e is pairing on an elliptic curve, and H is a hash function that converts arbitrary length data into a point on the elliptic curve. The first decryption system of the present invention includes a general-purpose terminal, a high-reliability terminal, and a key generation device, and decrypts the ciphertext C recorded by the general-purpose terminal on the high-reliability terminal. The key generation device includes a secret key generation unit and an encryption key generation unit. The highly reliable terminal includes a specific data transmission unit, a random number generation unit, an elliptic scalar multiplication unit, a session key calculation unit, and a decryption unit. The general-purpose terminal includes a pairing unit and a transmission unit. The specific data transmission unit of the high reliability terminal transmits data D specifying the high reliability terminal to the key generation device. The secret key generation unit of the key generation device selects a master secret key s that is an integer between 1 and q-1. The encryption key generation unit generates the encryption key p using the data D specifying the highly reliable terminal and the master secret key s, and transmits the encryption key p to the highly reliable terminal. In particular,
p = s · H (D)
You can ask as follows. The random number generation unit of the highly reliable terminal generates a random number x of 1 or more and q−1 or less. The elliptic scalar multiplication unit transmits a value obtained by multiplying the encryption key p by an elliptic scalar using the random number x as a mask key p ′ and transmits it to the general-purpose terminal. The pairing unit of the general-purpose terminal obtains the mask session key k ′ from the mask key p ′ and the encrypted session key R for the ciphertext C,
k ′ = e (p ′, R)
Seek like. The transmission unit transmits the mask session key k ′ and the ciphertext C to the highly reliable terminal. The session key calculation unit of the trusted terminal obtains the session key k from the mask session key k ′ using the inverse element of the random number x. The decryption unit decrypts the ciphertext C using the session key k, obtains plaintext M, and displays it on the highly reliable terminal.

The second decryption system of the present invention also includes a general-purpose terminal, a high-reliability terminal, and a key generation device, and decrypts the ciphertext C recorded by the general-purpose terminal on the high-reliability terminal. The key generation device includes a secret key generation unit, a random number generation unit, and an elliptic scalar multiplication unit. The highly reliable terminal includes a specific data transmission unit, a mask key transmission unit, a session key calculation unit, and a decryption unit. The general-purpose terminal includes a pairing unit and a transmission unit. The specific data transmission unit of the high reliability terminal transmits data D specifying the high reliability terminal to the key generation device. The secret key generation unit of the key generation device selects a master secret key s that is an integer between 1 and q-1. The random number generator generates a random number x of 1 to q-1. The elliptic scalar multiplication unit obtains a mask key p ′ that is a value obtained by multiplying the encryption key p generated using the data D specifying the high-reliability terminal and the master secret key s by the elliptical scalar by the random number x. In particular,
p = s · H (D)
The value obtained by calculating p and multiplying the elliptical scalar by using the random number x may be used as the mask key p ′. Then, information for obtaining the inverse element of the mask key p ′ and the random number x is transmitted to the highly reliable terminal. The mask key transmission unit of the highly reliable terminal transmits the mask key p ′ to the general-purpose terminal. The pairing unit of the general-purpose terminal obtains the mask session key k ′ from the mask key p ′ and the encrypted session key R for the ciphertext C,
k ′ = e (p ′, R)
Seek like. The transmission unit transmits the mask session key k ′ and the ciphertext C to the highly reliable terminal. The session key calculation unit of the trusted terminal obtains the session key k from the mask session key k ′ using the inverse element of the random number x. The decryption unit decrypts the ciphertext C using the session key k, obtains plaintext M, and displays it on the highly reliable terminal.

  According to the decryption system of the present invention, pairing with a large amount of computation is performed on a general-purpose terminal while plain text is concealed, and pairing computation is not performed on a highly reliable terminal. Therefore, even when a highly reliable terminal with high reliability but scarce computing resources is used, decoding can be performed efficiently. Further, according to the second decryption system of the present invention, the generation of the random number x is not performed by the reliable terminal. Therefore, even a highly reliable terminal that cannot generate cryptographically secure random numbers can be decrypted while ensuring safety.

FIG. 3 is a diagram illustrating a functional configuration example of the decoding system according to the first embodiment. FIG. 3 is a diagram illustrating an example of a processing flow of the decoding system according to the first embodiment. FIG. 5 is a diagram illustrating a functional configuration example of a decoding system according to a second embodiment. FIG. 10 is a diagram illustrating an example of a processing flow of the decoding system according to the second embodiment.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted. In the present specification, q is a prime number, e is pairing on an elliptic curve, and H is a hash function that converts arbitrary length data into points on the elliptic curve.

  FIG. 1 shows a functional configuration example of the decoding system of the first embodiment, and FIG. 2 shows an example of a processing flow of the decoding system of the first embodiment. The decryption system according to the first embodiment includes a general-purpose terminal 100, a high-reliability terminal 200, and a key generation device 300 that are connected via a network 1000. C is decoded on the high reliability terminal 200 and displayed. A “general-purpose terminal” is a general-purpose terminal that has sufficient computing resources such as a personal computer. A “highly reliable terminal” is a terminal that has high reliability, such as a mobile phone, but lacks computational resources. The network connecting the transmission source device 900 and the general-purpose terminal 100, the network connecting the general-purpose terminal 100 and the high-reliability terminal 200, and the network connecting the high-reliability terminal 200 and the key generation device 300 may be different. For example, all networks may be the Internet. A network connecting the transmission source device 900 and the general-purpose terminal 100 is the Internet, and a network connecting the general-purpose terminal 100 and the high-reliability terminal 200 is a short-range communication means such as Bluetooth, and a network connecting the high-reliability terminal 200 and the key generation device 300. May be a line connection or information exchange via a recording medium.

  The key generation device 300 includes a secret key generation unit 310, an encryption key generation unit 320, and a recording unit 390. The highly reliable terminal 200 includes a specific data transmission unit 210, a random number generation unit 220, an elliptic scalar multiplication unit 230, a session key calculation unit 240, a decryption unit 250, and a recording unit 290. The general-purpose terminal 100 includes a pairing unit 110, a transmission unit 120, and a recording unit 190. The specific data transmission unit 210 of the high reliability terminal 200 transmits data D specifying the high reliability terminal 200 to the key generation device 300 (S210). The data D for specifying the high-reliability terminal 200 is, for example, a mobile phone ID, and is preferably information that is not impersonated.

The secret key generation unit 310 of the key generation device 300 selects the master secret key s that is an integer between 1 and q−1 and records it in the recording unit 390 (S310). The encryption key generation unit 320 generates the encryption key p using the data D specifying the highly reliable terminal 200 and the master secret key s, transmits it to the highly reliable terminal 200, and records it in the recording unit 390 (S320). In particular,
p = s · H (D)
You can ask as follows. Note that the data exchange in step S210 and step S320 may be performed through a single connection through the network, or may be disconnected from the key generation device 300 and then connected to the high-reliability terminal 200. In the case of reconnection, the recording unit 390 of the key generation device 300 records the information specifying the highly reliable terminal 200 in association with the address and telephone number of the highly reliable terminal. Then, spoofing can be prevented by transmitting the encryption key p using an address or a telephone number corresponding to information for specifying the highly reliable terminal 200.

  The random number generation unit 220 of the highly reliable terminal 200 generates a random number x of 1 or more and q−1 or less and records it in the recording unit 290 (S220). The elliptic scalar multiplication unit 230 uses the value obtained by multiplying the encryption key p by the elliptic scalar using the random number x as a mask key p ′ and transmits it to the general-purpose terminal 100 (S230).

The general-purpose terminal 100 may record the ciphertext C and the encrypted session key R for the ciphertext C in the recording unit 190 in advance, or may obtain the ciphertext C from the transmission source device 900 (S900). ). The pairing unit 110 of the general-purpose terminal 100 uses an encryption session key R for the mask key p ′ and the ciphertext C (generally, R = rP, where P is a parameter indicating a point on the elliptic curve, and r is 0 From the value selected from an integer of q-1 or less, the mask session key k ′ is
k ′ = e (p ′, R)
(S110). The transmission unit 120 transmits the mask session key k ′ and the ciphertext C to the reliable terminal 200 (S120).

The session key calculation unit 240 of the highly reliable terminal 200 obtains the session key k from the mask session key k ′ using the inverse element of the random number x (S240). For example,
k = ^k′−x
The session key k may be obtained as follows. The decryption unit 250 uses the session key k to convert the ciphertext C into M = Dec (k, C)
The plaintext M is obtained by decrypting as described above and displayed on the high-reliability terminal 200 (S250).

  As described above, according to the decryption system of the first embodiment, the pairing with a large amount of calculation is performed on the general-purpose terminal 100 while the plaintext is concealed, and the pairing calculation is not performed on the high-reliability terminal 200. Therefore, even when a highly reliable terminal with high reliability but scarce computing resources is used, decoding can be performed efficiently.

  In the first embodiment, the highly reliable terminal generates the random number x. However, many existing mobile phones cannot generate cryptographically secure random numbers. Therefore, in the second embodiment, an example in which the random number x is not generated by a highly reliable terminal is shown.

  FIG. 3 shows a functional configuration example of the decoding system of the second embodiment, and FIG. 4 shows an example of a processing flow of the decoding system of the second embodiment. The decryption system according to the second embodiment includes a general-purpose terminal 100, a high-reliability terminal 400, and a key generation device 500 that are connected via a network 1000. C is decoded on the high reliability terminal 400 and displayed. The network 1000 may be a single network or a separate network.

  The key generation device 500 includes a secret key generation unit 310, a random number generation unit 530, an elliptic scalar multiplication unit 540, and a recording unit 590. The highly reliable terminal 400 includes a specific data transmission unit 210, a mask key transmission unit 430, a session key calculation unit 240, a decryption unit 250, and a recording unit 490. The general-purpose terminal 100 is the same as that in the first embodiment. The specific data transmission unit 210 of the high reliability terminal 400 transmits data D specifying the high reliability terminal to the key generation device (S210).

The secret key generation unit 310 of the key generation device 500 selects the master secret key s that is an integer between 1 and q−1 and records it in the recording unit 590 (S310). The random number generation unit 530 generates a random number x between 1 and q−1 and records it in the recording unit 590 (S530). The elliptic scalar multiplication unit 540 obtains a mask key p ′ that is a value obtained by multiplying the encryption key p generated using the data D specifying the high-reliability terminal 400 and the master secret key s by an elliptic scalar by the random number x. In particular,
p = s · H (D)
The value obtained by calculating p and multiplying the elliptical scalar by using the random number x may be used as the mask key p ′. Then, information for obtaining the inverse element of the mask key p ′ and the random number x is transmitted to the high reliability terminal 400 (S540). The mask key transmission unit 430 of the highly reliable terminal 400 transmits the mask key p ′ to the general-purpose terminal 100 (S430).

The general-purpose terminal 100 may record the ciphertext C and the encrypted session key R for the ciphertext C in the recording unit 190 in advance, or may obtain the ciphertext C from the transmission source device 900 (S900). ). The pairing unit 110 of the general-purpose terminal 100 obtains the mask session key k ′ from the mask key p ′ and the encrypted session key R for the ciphertext C,
k ′ = e (p ′, R)
(S110). The transmission unit 120 transmits the mask session key k ′ and the ciphertext C to the reliable terminal 400 (S120). The session key calculation unit 240 of the highly reliable terminal 400 obtains the session key k from the mask session key k ′ using the inverse element of the random number x (S240). The decryption unit 250 decrypts the ciphertext C using the session key k to obtain the plaintext M, and displays it on the highly reliable terminal 400 (S250).

  Thus, according to the decoding system of the second embodiment, the same effect as the first embodiment can be obtained. Further, the generation of the random number x is not performed by the highly reliable terminal. Therefore, even a highly reliable terminal that cannot generate cryptographically secure random numbers can be decrypted while ensuring safety. That is, many existing mobile phones can be used as highly reliable terminals.

[Evaluation of effect]
Next, it will be evaluated how much the calculation amount of the highly reliable terminal can be reduced by the present invention. When conventional pairing is performed by a highly reliable terminal, there is one pairing operation in the highly reliable terminal. In the highly reliable terminal of the first embodiment, there is one elliptic scalar multiplication operation (S230) and one expansion field power (S240). In the highly reliable terminal of the second embodiment, there is one expansion field power (S240). The ratio of the calculation amount is
Pairing: Elliptical scalar multiplication: Expansion field power ≒ 10: 5: 1
It is. Therefore, the calculation ratio of the high reliability terminal is
Conventional: Example 1: Example 2≈10: 6: 1
It becomes. As described above, since the amount of calculation of a highly reliable terminal having less calculation resources than the conventional method is reduced, the responsiveness can be improved.

[Program, recording medium]
The various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  INDUSTRIAL APPLICABILITY The present invention can be used for encryption communication that performs communication while preventing leakage of secret information.

DESCRIPTION OF SYMBOLS 100 General-purpose terminal 110 Pairing part 120 Transmission part 190,290,390,490,590 Recording part 200,400 Reliable terminal 210 Specific data transmission part 220,530 Random number generation part 230,540 Elliptical scalar multiplication part 240 Session key calculation part 250 Decryption unit 300, 500 Key generation device 310 Secret key generation unit 320 Encryption key generation unit 430 Mask key transmission unit 900 Transmission source device 1000 Network

Claims (10)

A decryption system comprising a general-purpose terminal, a high-reliability terminal, and a key generation device, and decrypting a ciphertext C recorded by the general-purpose terminal,
q is a prime number, e is a pairing on an elliptic curve,
The key generation device includes:
A secret key generation unit that selects a master secret key s that is an integer between 1 and q−1;
An encryption key generation unit that generates an encryption key p using the data D specifying the highly reliable terminal and the master secret key s, and transmits the encryption key p to the highly reliable terminal;
The high-reliability terminal is
A specific data transmitter that transmits data D specifying the high-reliability terminal to the key generation device;
A random number generator for generating a random number x of 1 to q−1;
A value obtained by multiplying the encryption key p by an elliptic scalar using the random number x as a mask key p ′, and an elliptic scalar multiplication unit to be transmitted to the general-purpose terminal;
A session key calculation unit for obtaining a session key k from the mask session key k ′ received from the general-purpose terminal using an inverse element of the random number x;
A decryption unit that decrypts the ciphertext C received from the general-purpose terminal using the session key k to obtain plaintext M;
The general-purpose terminal is
From the mask key p ′ and the encrypted session key R for the ciphertext C, the mask session key k ′ is obtained.
k ′ = e (p ′, R)
The pairing part you want to
A decryption system comprising: a transmission unit that transmits the mask session key k ′ and the ciphertext C to the highly reliable terminal. A decryption system comprising a general-purpose terminal, a high-reliability terminal, and a key generation device, and decrypting a ciphertext C recorded by the general-purpose terminal,
q is a prime number, e is a pairing on an elliptic curve,
The key generation device includes:
A secret key generation unit that selects a master secret key s that is an integer between 1 and q−1;
A random number generator for generating a random number x of 1 to q−1;
A mask key p ′ that is a value obtained by multiplying the encryption key p generated using the data D specifying the trusted terminal and the master secret key s by an elliptic scalar by the random number x is obtained, and the mask key p ′ and the mask key p ′ An elliptic scalar multiplication unit that transmits information for obtaining an inverse element of the random number x to the high-reliability terminal;
The high-reliability terminal is
A specific data transmitter that transmits data D specifying the high-reliability terminal to the key generation device;
A mask key transmitter for transmitting the mask key p ′ to the general-purpose terminal;
A session key calculation unit for obtaining a session key k from the mask session key k ′ received from the general-purpose terminal using an inverse element of the random number x;
A decryption unit that decrypts the ciphertext C received from the general-purpose terminal using the session key k to obtain plaintext M;
The general-purpose terminal is
From the mask key p ′ and the encrypted session key R for the ciphertext C, the mask session key k ′ is obtained.
k ′ = e (p ′, R)
The pairing part you want to
A decryption system comprising: a transmission unit that transmits the mask session key k ′ and the ciphertext C to the highly reliable terminal.   The general purpose terminal which comprises the decoding system of Claim 1 or 2.   A highly reliable terminal constituting the decoding system according to claim 1.   A key generation apparatus constituting the decryption system according to claim 1. A decryption method for decrypting a ciphertext C recorded by the general-purpose terminal using a general-purpose terminal, a highly reliable terminal, and a key generation device,
q is a prime number, e is a pairing on an elliptic curve,
The reliable terminal is
A specific data transmission step of transmitting data D specifying the high-reliability terminal to the key generation device;
The key generation device is
A secret key generation step of selecting a master secret key s that is an integer between 1 and q−1;
An encryption key generation step of generating an encryption key p using the data D specifying the highly reliable terminal and the master secret key s, and transmitting the encryption key p to the highly reliable terminal;
The reliable terminal is
A random number generating step for generating a random number x of 1 to q−1;
A value obtained by multiplying the encryption key p by an elliptic scalar using the random number x as a mask key p ′, and transmitting to the general-purpose terminal an elliptic scalar multiplication step;
The general-purpose terminal is
From the mask key p ′ and the encrypted session key R for the ciphertext C, the mask session key k ′ is obtained.
k ′ = e (p ′, R)
The pairing step you want to
A transmission step of transmitting the mask session key k ′ and the ciphertext C to the trusted terminal;
The reliable terminal is
A session key calculation step for obtaining a session key k from the mask session key k ′ received from the general-purpose terminal using an inverse element of the random number x;
A decryption method comprising: decrypting the ciphertext C received from the general-purpose terminal using the session key k to obtain a plaintext M. A decryption method for decrypting a ciphertext C recorded by the general-purpose terminal using a general-purpose terminal, a highly reliable terminal, and a key generation device,
q is a prime number, e is a pairing on an elliptic curve,
The reliable terminal is
A specific data transmission step of transmitting data D specifying the high-reliability terminal to the key generation device;
The key generation device is
A secret key generation step of selecting a master secret key s that is an integer between 1 and q−1;
A random number generating step for generating a random number x of 1 to q−1;
A mask key p ′ that is a value obtained by multiplying the encryption key p generated using the data D specifying the trusted terminal and the master secret key s by an elliptic scalar by the random number x is obtained, and the mask key p ′ and the mask key p ′ An elliptic scalar multiplication step for transmitting information for obtaining an inverse element of the random number x to the reliable terminal;
The reliable terminal is
A mask key transmission step of transmitting the mask key p ′ to the general-purpose terminal;
The general-purpose terminal is
From the mask key p ′ and the encrypted session key R for the ciphertext C, the mask session key k ′ is obtained.
k ′ = e (p ′, R)
The pairing step you want to
A transmission step of transmitting the mask session key k ′ and the ciphertext C to the trusted terminal;
The reliable terminal is
A session key calculation step for obtaining a session key k from the mask session key k ′ received from the general-purpose terminal using an inverse element of the random number x;
Decrypting the ciphertext C received from the general-purpose terminal using the session key k to obtain plaintext M;
A decryption method.   A program causing a computer to function as the general-purpose terminal according to claim 3.   A program for causing a computer to function as the highly reliable terminal according to claim 4.   A program that causes a computer to function as the key generation device according to claim 5.

Images