JP2018067859A - Cryptographic system and method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an encryption technology of less computational complexity than before.SOLUTION: A cryptographic system includes an encryption device 1 having an encryption unit 11 outputting encryption information including encryption data, encrypted the encryption object data based on the encryption conditions containing reference information and range information, and the encryption conditions, and a decryption device 2 including an attribute information acquisition unit 21 for acquiring attribute information, i.e., the information corresponding to the encryption conditions, a judgement unit 22 for judging whether or not the acquired attribute information is included in a range determined by the reference information and range information of the encryption conditions included in the encryption information, and a decryption unit 23 for decrypting the encryption information included in the encryption information, based on the encryption conditions included in the encryption information, when a judgement was made that the acquired attribute information is included in the range.SELECTED DRAWING: Figure 1

Description

  The present invention relates to data encryption technology and decryption technology.

  Functional encryption, which is an advanced technology of public key cryptography, has a feature that conditions such as persons and groups that can be decrypted at the time of encryption can be specified by a general logical expression (AND condition, OR condition). By using functional encryption, data with attribute information can be managed in the cloud while encrypted, and each user can realize a system that can decrypt only attribute information data that satisfies the access conditions set for him / her. (For example, refer nonpatent literature 1.).

Nikkei Electronics, Nikkei Business Publications, 2012.7.23, p.87-95

  In functional encryption, the pass / fail of the condition is determined based on the matching of character strings and numerical values. For this reason, if you want to specify a range of a certain numeric value or character string as a condition, you need to specify all the character strings or numeric values in the range as an OR condition. The numerical value to be expressed is expressed in bits and the condition is judged for each bit. For this reason, there was a possibility that the calculation amount would be enormous.

  It is an object of the present invention to provide an encryption system and method that require a smaller amount of calculation than before.

  An encryption system according to an aspect of the present invention is an encryption system that outputs encrypted data including encrypted data obtained by encrypting data to be encrypted based on an encryption condition including reference information and range information, and an encryption condition. Attributes acquired within the range determined by the reference information and range information of the encryption conditions included in the encryption information, the attribute information acquisition unit that acquires attribute information that is information corresponding to the encryption conditions, A determination unit that determines whether information is included, and if it is determined that the acquired attribute information is included in the range, decrypts the encrypted data included in the encryption information based on the encryption condition included in the encryption information And a decoding device including a decoding unit.

  By specifying the range using only two pieces of information, that is, the reference information and the range information, the amount of calculation can be reduced as compared with the conventional case.

The block diagram for demonstrating the example of a cryptographic system. The flowchart for demonstrating the example of an encryption method. The figure for demonstrating the example of encryption conditions. The figure for demonstrating the example of encryption conditions.

[Embodiment]
Embodiments of the present invention will be described below.

  As shown in FIG. 1, the cryptographic system includes, for example, an encryption device 1 and a decryption device 2. The encryption device 1 includes an encryption unit 11, for example. The decoding device 2 includes, for example, an attribute information acquisition unit 21, a determination unit 22, and a decoding unit 23.

  The encryption method is realized, for example, by the processing of steps E1 and D1 to D3 in FIG.

<Encryption unit 11>
The encryption unit 11 of the encryption device 1 generates encrypted data by encrypting data to be encrypted using information obtained by combining the reference information and the range information as an encryption condition (step E1). The data to be encrypted is, for example, plain text data. And the encryption part 11 outputs the encryption information containing encryption data and encryption conditions.

  In this way, the encryption unit 11 outputs the encrypted data including the encrypted data and the encryption condition obtained by encrypting the data to be encrypted based on the encryption condition including the reference information and the range information.

  Hereinafter, examples of encryption conditions will be described. An example of the encryption condition when the encryption condition is position information is “N38.124343: W139.343200: CR10”. The encryption condition “N38.124343: W139.343200: CR10” includes reference information “N38.124343: W139.343200” and range information “CR10”. “N38.124343” in the reference information “N38.124343: W139.343200” represents the latitude of the reference position, which is the reference position, and “W139.343200” represents the longitude of the reference position. . “CR” in the range information “CR10” indicates that the range is designated by a circle, and “10” indicates the radius length R (see FIG. 3). The unit of the radius length R is a unit of a predetermined length such as km, m, or cm. When the unit of the radius length R is m, the encryption condition “N38.124343: W139.343200: CR10” is centered on the reference position of latitude “N38.124343” and longitude “W139.343200”. It means the inside of a circle with a radius of 10m.

  When the range is designated by a square, for example, the symbol “SR” can be used instead of “CR” in the above example. In this case, it is assumed that the numerical value following “SR” represents the length S of one half of the square. The unit of length S that is half of one side is a unit of a predetermined length such as km, m, or cm. When the unit of length S of half of one side is m, the encryption condition “N38.124343: W139.343200: SR10” is the reference position of latitude “N38.124343” and longitude “W139.343200”. It means the inside of a square whose center half is 10m long.

  An example of the encryption condition when the encryption condition is time information is “20160808 M + 5”. The encryption condition “20160808 M + 5” includes reference information “20160808” and range information “M + 5”. The reference information “20160808” represents that the reference time is August 8, 2016. “M” in the range information “M + 5” indicates that the unit of the numerical value included in the range information is the month, and “+” indicates that the time is after the reference time. The encryption condition “20160808 M + 5” means five months from August 8, 2016.

  As units of numerical values included in the range information, units other than the month such as year, hour, minute may be used. Symbols “Y”, “H”, and “m” can be used instead of “M”, for example, to express years, hours, and minutes as units of numerical values included in the range information. In addition, the symbol “-” can be used in place of “+” to represent the previous time from the reference time, and the symbol “±” can be used in place of “+” to represent the time before and after the reference time. it can.

  Information other than position information and time information may be used as the encryption condition. For example, the number of network connections of the decoding device 2, the remaining battery level, a character string, and the like may be used.

  When the network connection count is used as the encryption condition, by specifying “≦” or “≧” as the reference information as the reference information and the range information as a range, a range that is greater than or equal to a certain number of times Can be specified as the encryption condition.

  When the remaining battery level is used as the encryption condition, the reference battery level is set as the reference information, and “≦” or “≧” is specified as the range information. It can be specified as an encryption condition.

  When a character string is used as the encryption condition, a character string in a certain range can be specified as the encryption condition as long as the range information can be determined by the program. Specifically, by specifying that a specific character string (for example, abc) as reference information and the remaining three characters can be arbitrarily specified (for example, XXX) as range information, a range of character strings with different endings can be specified. It can be specified as an encryption condition.

  A plurality of encryption conditions may be combined by a logical connector such as and and or. For example, the encryption condition “20160808 M + 1 AND 1200 H + 4” represents a range of one month from August 8, 2016 and four hours from 12:00. The encryption condition “20160808 M + 1 or 20161010 D ± 10” represents a range of one day from August 8, 2016, or 10 days before and after October 10, 2016.

<Attribute information acquisition unit 21>
The decoding device 2 is an information portable terminal such as a PC, a mobile phone, a smartphone, or a tablet terminal.

  The attribute information acquisition unit 21 of the decryption device 2 acquires attribute information that is information corresponding to the encryption condition (step D1). The acquired attribute information is output to the determination unit 22.

  For example, when the encryption condition is position information, the attribute information acquisition unit 21 acquires the current position of the decryption device 2 as attribute information. For example, when the encryption condition is time information, the attribute information acquisition unit 21 acquires the current time as attribute information.

<Determining unit 22>
The determination unit 22 determines whether the attribute information acquired by the attribute information acquisition unit 21 is included in the range determined by the reference information and the range information of the encryption condition included in the received encryption information (step D2). The determination result is output to the decoding unit 23. If it is determined that the attribute information is included in the range determined by the reference information and the range information of the encryption condition, the encryption condition used for generating the decryption key is also output to the decryption unit 23. Further, when it is determined that the attribute information is not included in the range determined by the reference information and the range information of the encryption condition, the attribute information may also be output to the decryption unit 23.

  For example, when the encryption condition is “N38.124343: W139.343200: CR10”, the current position of the decryption device 2 acquired by the attribute information acquisition unit 21 is the latitude “N38.124343” and the longitude “W139”. It is determined whether it is included in a circle with a radius of 10 m centered at the position of “.343200”.

<Decoding unit 23>
When the determination unit 22 determines that the attribute information acquired by the attribute information acquisition unit 21 is included in the range determined by the reference information and range information of the encryption condition, the decryption unit 23 includes the encryption included in the encryption information. Based on the conditions, the encrypted data included in the encryption information is decrypted (step D3).

  When the determination unit 22 determines that the attribute information acquired by the attribute information acquisition unit 21 is included in the range determined by the reference information and the range information of the encryption condition, the decryption unit 23 first includes the encryption information. The decryption key corresponding to the encryption condition to be acquired is acquired. When the decryption key corresponding to the encryption condition included in the encryption information is stored in advance, the decryption unit 23 acquires the decryption key by reading the decryption key corresponding to the encryption condition included in the encryption information. To do.

  The decryption unit 23 may acquire the decryption key by making a decryption key generation request to the decryption key generation device 3 (shown by a broken line in FIG. 1) outside the decryption device 2. For example, the decryption device 2 transmits decryption key generation request information including the encryption condition to the decryption key generation device 3. Upon receiving the decryption key generation request information, the decryption key generation device 3 generates a decryption key corresponding to the encryption condition included in the decryption key generation request information, and transmits the generated decryption key to the decryption device 2. Generation of a decryption key corresponding to the encryption condition can be performed, for example, by calculating an output value when the encryption condition is input to a predetermined decryption key generation function and using the output value as the decryption key.

  Then, the decryption unit 23 decrypts the encrypted data using the decryption key.

  Thus, by specifying the range only with two pieces of information, that is, the reference information and the range information, the amount of calculation can be reduced as compared with the conventional case.

  If the determination unit 22 determines that the attribute information is not included in the range determined by the reference information and the range information of the encryption condition, the decryption unit 23 replaces the encryption condition with the attribute information. An attempt may be made to decrypt the encrypted data included in the encryption information. Since the encryption condition and the attribute information are different information, in this case, the encrypted data cannot be correctly decrypted.

[Program and recording medium]
When each process in the encryption device 1 and the decryption device 2 is realized by a computer, the processing contents of the functions that the encryption device 1 and the decryption device 2 should have are described by a program. Then, by executing this program on a computer, the processing of the encryption device 1 and the decryption device 2 is realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  Each processing means may be configured by executing a predetermined program on a computer, or at least a part of these processing contents may be realized by hardware.

[Modification]
Needless to say, other modifications are possible without departing from the spirit of the present invention.

DESCRIPTION OF SYMBOLS 1 Encryption apparatus 11 Encryption part 2 Decryption apparatus 21 Attribute information acquisition part 22 Determination part 23 Decryption part 3 Decryption key generation apparatus

Claims (2)

An encryption device including an encryption unit that outputs encrypted data including encrypted data obtained by encrypting data to be encrypted based on an encryption condition including reference information and range information, and the encryption condition;
Whether the acquired attribute information is included in a range determined by the attribute information acquisition unit that acquires attribute information that is information corresponding to the encryption condition and the reference information and range information of the encryption condition included in the encryption information. When it is determined that the acquired attribute information is included in the range, the determination unit that determines the encrypted data included in the encryption information is decrypted based on the encryption condition included in the encryption information A decoding device including a decoding unit;
Including cryptosystem. Encryption in which an encryption unit of the encryption device outputs encrypted data including encrypted data obtained by encrypting data to be encrypted based on an encryption condition including reference information and range information, and the encryption condition. Steps,
An attribute information acquisition step in which the attribute information acquisition unit of the decryption apparatus acquires attribute information that is information corresponding to the encryption condition;
A determination step in which a determination unit of the decryption apparatus determines whether the acquired attribute information is included in a range determined by reference information and range information of the encryption condition included in the encryption information;
When the decryption unit of the decryption apparatus determines that the acquired attribute information is included in the range, the decryption unit decrypts the encrypted data included in the encryption information based on the encryption condition included in the encryption information. A decoding step to
Encryption method including

Images