JP2019086744A - Encryption system, user system, encryption method, and encryption program - Google Patents

Abstract

To improve the safety of an attribute base encryption.SOLUTION: A encryption system is equipped with: a key issuing mechanism; and a user system which includes a first user terminal having a first attribute including one or more attributes, and a second user terminal. The key issuing mechanism generates a first public key, and discloses the first public key. The second user terminal generates a second public key, and discloses the second public key. The key issuing mechanism generates a first secret key corresponding to the first attribute according to a request from the first user terminal, and distributes the first secret key to the first user terminal. The second user terminal generates a second secret key corresponding to the first attribute according to a request from the first user terminal, and distributes the second secret key to the first user terminal. The first user terminal generates an encryption key for encryption of an attribute-based signal by using the first public key and the second public key, and generates a first decryption key for decryption of the attribute-based encryption by using the first secret key and the second secret key.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an encryption system, a user system, an encryption method, and an encryption program.

  In recent years, with the increase in the number and size of electronic files, cloud storage services have become widespread. In using cloud storage, encryption is applied to electronic files to protect personal information and confidential information. Attribute-based encryption is known as an encryption method (see, for example, Patent Document 1, Patent Document 2, and Non-Patent Document 1). The attribute-based encryption is a cryptographic technology that gives a plurality of attributes for each user and allows only a user who satisfies the decryption condition (policy) set based on the user's attribute to decrypt the ciphertext.

  In attribute-based encryption, it is necessary to manage a master secret key that can decrypt all ciphertexts. In many systems, a key issuing authority manages the master secret key. Therefore, when constructing a system using a server or the like on the cloud, it is necessary to manage the master secret key on the server, and information that should originally be kept secret will be disclosed to the server manager or the like. It becomes. In order to cope with such a problem, a method has been proposed in which the administrator authority of the master secret key is distributed and arranged to a plurality of key issuing organizations. For example, Non-Patent Document 1 describes that an encryption key and a decryption key are generated by combining secret keys issued by a plurality of key issuing organizations.

Japanese Patent Application Publication No. 2014-531850 JP, 2017-126851, A

Huang Lin, Zhenfu Cao, Xiaohui Liang, Jun Shao, "Secure Threshold Multi-Authority Attribute Based Encryption Without a Central Authority", Progress in Cryptology-INDOCRYPT 2008, pp 426-436

  However, in the system described in Non-Patent Document 1, when a plurality of key issuing organizations collude, all ciphertexts can be decrypted. For this reason, further improvement of safety is desired in this technical field.

  An encryption system according to an aspect of the present invention is a system using attribute-based encryption. The cryptographic system comprises a key issuing authority and a user system comprising a first user terminal having a first attribute comprising one or more attributes and a second user terminal. The key issuing organization generates the first public key and makes the first public key public. The second user terminal generates a second public key and makes the second public key public. The first user terminal requests the key issuing organization for the first secret key corresponding to the first attribute and also requests the second user key for the second secret key corresponding to the first attribute. The key issuing organization generates a first secret key and distributes the first secret key to the first user terminal in response to a request from the first user terminal. The second user terminal generates a second secret key and distributes the second secret key to the first user terminal in response to a request from the first user terminal. The first user terminal generates an encryption key for attribute-based encryption encryption using the first public key and the second public key, and decrypts the attribute-based encryption using the first secret key and the second secret key. Generating a first decryption key for the

  In this encryption system, the first user terminal uses the first public key generated by the key issuing organization and the second public key generated by the second user terminal in the user system for encryption of attribute-based encryption. Generate an encryption key for The first user terminal uses the first secret key generated by the key issuing organization and the second secret key generated by the second user terminal in the user system to generate a first decryption key for attribute based encryption. Generate As described above, the second user terminal in the user system plays a role as a key issuing organization, which can reduce the possibility of decryption of a ciphertext by collusion by the key issuing organization. As a result, it is possible to improve the security of attribute-based encryption.

  The second user terminal may have a second attribute that includes one or more attributes. The second user terminal may request the key issuing organization for a third secret key corresponding to the second attribute, and may generate a fourth secret key corresponding to the second attribute. The key issuing organization may generate a third secret key and distribute the third secret key to the second user terminal in response to a request from the second user terminal. The second user terminal may generate an encryption key using the first public key and the second public key, and may use the third secret key and the fourth secret key to perform second decryption for attribute-based encryption. You may generate a key. In this case, the second user terminal generates an encryption key for encryption of attribute-based encryption using the first public key generated by the key issuing organization and the second public key generated by the second user terminal itself. Do. The second user terminal generates a second decryption key for decryption of the attribute-based encryption using the third secret key generated by the key issuing organization and the fourth secret key generated by the second user terminal itself. As described above, the second user terminal in the user system plays a role as a key issuing organization, which can reduce the possibility of decryption of a ciphertext by collusion by the key issuing organization. As a result, it is possible to improve the security of attribute-based encryption.

  The cryptographic system may further comprise another key issuing authority. The second user terminal may delegate one or more of the plurality of attributes used in the user system to another key issuing organization as a set of delegation attributes. The first user terminal may request the second secret key from another key issuing organization if the first attribute is included in the set of delegation attributes. Another key issuing organization may generate a second secret key and distribute the second secret key to the first user terminal in response to a request from the first user terminal. In this case, since the second user terminal does not have to generate and distribute the secret key related to the transfer attribute, the burden on the user of the second user terminal can be reduced.

  A user system according to another aspect of the present invention is a system that includes an attribute-based encryption including a first user terminal having a first attribute including one or more attributes and a second user terminal. The first user terminal acquires the first public key generated by the external key issuing organization and the second public key generated by the second user terminal, and uses the first public key and the second public key. Generate an encryption key for attribute based encryption. The first user terminal requests the key issuing organization for the first secret key corresponding to the first attribute and also requests the second user key for the second secret key corresponding to the first attribute. The first user terminal acquires the first secret key from the key issuing organization, acquires the second secret key from the second user terminal, and uses the first secret key and the second secret key to decrypt the attribute-based encryption. Generate a first decryption key.

  In this user system, the first user terminal uses the first public key generated by an external key issuing organization and the second public key generated by the second user terminal in the user system to encrypt attribute-based encryption. An encryption key for encryption. The first user terminal uses the first secret key acquired from the external key issuing organization and the second secret key acquired from the second user terminal in the user system to generate a first decryption key for attribute-based encryption. Generate As described above, the second user terminal in the user system plays a role as a key issuing organization, which can reduce the possibility of decryption of a ciphertext by collusion by the key issuing organization. As a result, it is possible to improve the security of attribute-based encryption.

  The second user terminal may have a second attribute that includes one or more attributes. The second user terminal may request the key issuing organization for a third secret key corresponding to the second attribute, and may generate a fourth secret key corresponding to the second attribute. The second user terminal may generate the encryption key using the first public key and the second public key. The second user terminal may obtain the third secret key from the key issuing authority, and generate the second decryption key for decryption of the attribute-based encryption using the third secret key and the fourth secret key. In this case, the second user terminal encrypts for encryption of attribute-based encryption using the first public key generated by the external key issuing organization and the second public key generated by the second user terminal itself. Generate a key. Also, the second user terminal generates a second decryption key for attribute-based encryption decryption using the third secret key acquired from the external key issuing organization and the fourth secret key generated by the second user terminal itself. Do. As described above, the second user terminal in the user system plays a role as a key issuing organization, which can reduce the possibility of decryption of a ciphertext by collusion by the key issuing organization. As a result, it is possible to improve the security of attribute-based encryption.

  The second user terminal may delegate one or more of the plurality of attributes used in the user system to another key issuing organization as a set of delegation attributes. The first user terminal may request the second secret key from another key issuing organization if the first attribute is included in the set of delegation attributes. In this case, since the second user terminal does not have to generate and distribute the secret key related to the transfer attribute, the burden on the user of the second user terminal can be reduced.

  An encryption method according to still another aspect of the present invention includes a first user terminal having a first attribute including one or more attributes and a second user terminal, and in a user system using attribute-based encryption, the first user terminal It is an encryption method performed by the terminal. This encryption method comprises the steps of acquiring a first public key generated by an external key issuing organization and a second public key generated by a second user terminal, and using the first public key and the second public key. Generating an encryption key for encryption of attribute-based encryption; requesting a first private key according to the first attribute from the key issuing organization; and generating a second private key according to the first attribute as the second user The step of requesting the terminal, the step of acquiring the first secret key from the key issuing organization, and the step of acquiring the second secret key from the second user terminal, and the attribute-based encryption using the first secret key and the second secret key Generating a first decryption key for decryption.

  In this encryption method, the first user terminal uses the first public key generated by an external key issuing organization and the second public key generated by the second user terminal in the user system to encrypt attribute-based encryption. An encryption key for encryption. The first user terminal uses the first secret key acquired from the external key issuing organization and the second secret key acquired from the second user terminal in the user system to generate a first decryption key for attribute-based encryption. Generate As described above, the second user terminal in the user system plays a role as a key issuing organization, which can reduce the possibility of decryption of a ciphertext by collusion by the key issuing organization. As a result, it is possible to improve the security of attribute-based encryption.

  An encryption program according to still another aspect of the present invention includes a computer, a first public key generated by an external key issuing organization, and a second public key generated by a user terminal belonging to a user system together with the computer. Obtaining, generating an encryption key for encryption of attribute-based encryption using the first public key and the second public key, and a first according to a first attribute including one or more attributes of the computer. Requesting a secret key from the key issuing organization, and requesting a second secret key corresponding to the first attribute from the user terminal, acquiring the first secret key from the key issuing authority, and obtaining the second secret key from the user terminal It is an encryption program for executing the step of acquiring and the step of generating a first decryption key for decryption of attribute-based encryption using the first secret key and the second secret key.

  In this encryption program, the computer encrypts for encryption of attribute-based encryption using the first public key generated by the external key issuing organization and the second public key generated by the user terminal in the user system. Generate a key. The computer generates a first decryption key for decryption of the attribute-based encryption using the first secret key acquired from the external key issuing organization and the second secret key acquired from the user terminal in the user system. As described above, when the user terminal in the user system plays a role as a key issuing organization, it is possible to reduce the possibility that a ciphertext is decrypted by collusion by the key issuing organization. As a result, it is possible to improve the security of attribute-based encryption.

  According to the present invention, the security of attribute-based encryption can be improved.

FIG. 1 is a diagram showing the configuration of a cryptographic system according to an embodiment. FIG. 2 is a diagram showing an example of an access structure used in attribute-based encryption. FIG. 3 is a sequence diagram showing an initial setting process in the cryptographic system shown in FIG. FIG. 4 is a sequence diagram showing an encryption key generation process in the encryption system shown in FIG. FIG. 5 is a sequence diagram showing a decryption key generation process in the encryption system shown in FIG. FIG. 6 is a sequence diagram showing an encryption process in the encryption system shown in FIG. FIG. 7 is a sequence diagram showing decryption processing in the encryption system shown in FIG. FIG. 8 is a sequence diagram showing delegation processing in the encryption system shown in FIG. FIG. 9 is a sequence diagram showing a secret key generation process in the encryption system shown in FIG.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In the description of the drawings, the same elements will be denoted by the same reference symbols, without redundant description.

  FIG. 1 is a diagram showing the configuration of a cryptographic system according to an embodiment. As shown in FIG. 1, the encryption system 1 is a system that performs encryption and decryption using attribute-based encryption. Attribute-based encryption is an encryption technology in which only a user who can satisfy a decryption condition (policy) set based on the attribute of the user can decrypt the ciphertext. The encryption system 1 includes a user system 10, a plurality of key issuing organizations (in the present embodiment, key issuing organizations 20A to 20C), a public server 30, and a cloud storage 40. The user system 10, the key issuing organizations 20A to 20C, the public server 30, and the cloud storage 40 are communicably connected to each other by the network NW. The network NW may be configured by either wired or wireless. Examples of the network NW include a mobile communication network, the Internet, and a wide area network (WAN).

  The user system 10 is a user-side system that uses attribute-based encryption. The user system 10 includes a plurality of user terminals (in the present embodiment, user terminals 11A to 11C). The user terminal is a terminal device used by the user. Examples of the user terminal include a desktop PC (Personal Computer), a notebook PC, a smartphone, and a tablet terminal. Here, the user terminals 11A to 11C belong to the same organization. The user terminals 11A to 11C are communicably connected to each other by a LAN or the like, and are connected to the network NW via a gateway device (not shown). The user terminals 11A to 11C may not belong to the same organization.

  The user terminals 11A to 11C physically have one or more processors, a main storage device such as a random access memory (RAM) and a read only memory (ROM), an auxiliary storage device such as a hard disk device, and an input device such as a keyboard. , An output device such as a display, and hardware such as a communication module which is a data transmission / reception device. Each function of the user terminals 11A to 11C is controlled by one or more processors by causing one hardware such as a main storage to read one or more predetermined computer programs (encryption programs). , And reading and writing data in the main storage device and the auxiliary storage device.

  Each of the users UA to UC has one or more attributes (hereinafter referred to as "combination of attributes"). The user UA uses the user terminal 11A (first user terminal), the user UB uses the user terminal 11B (second user terminal), and the user UC uses the user terminal 11C. For example, in the user terminals 11A to 11C, the users UA to UC encrypt data with attribute-based encryption using an application for attribute-based encryption, and the encrypted data (hereinafter referred to as "ciphertext"). Are stored in the cloud storage 40. Also, the users UA to UC use the user terminals 11A to 11C to acquire a ciphertext from the cloud storage 40 and decrypt the ciphertext. At least one of the user terminals 11A to 11C plays a role as a key issuing organization. In the present embodiment, the user terminal 11B plays a role as a key issuing organization.

  The key issuing authorities 20A to 20C generate public keys and private keys of attribute-based encryption. The public key is a key common to all users (user terminals 11A to 11C). The secret key is a key unique to each user (user terminals 11A to 11C), and is generated according to the combination of the user's attributes. A detailed description of the generation of the public key and the secret key will be described later. The key issuing organizations 20A to 20C are provided outside the user system 10. The key issuing organizations 20A to 20C transmit public information including the public key to the public server 30. The user terminal 11B also has the same function as that of the key issuing organizations 20A to 20C.

  The public server 30 is a server device for publicizing public information. The public server 30 receives the public information from each of the key issuing organizations 20A to 20C, and stores the public information in a storage device (not shown). The public server 30 transmits public information to each organization in response to a request from each organization included in the encryption system 1.

  The cloud storage 40 is also referred to as online storage, and is a service that shares data on the network NW. The cloud storage 40 includes, for example, a single or a plurality of file servers. The cloud storage 40 receives data from the user terminals 11A to 11C and stores the received data. The cloud storage 40 transmits the stored data to the user terminals 11A to 11C in response to the request from the user terminals 11A to 11C. Instead of the cloud storage 40, a storage device (local storage) provided in the user system 10 may be used.

  Next, attribute-based encryption will be described with reference to FIG. FIG. 2 is a diagram showing an example of an access structure used in attribute-based encryption. The access structure shown in FIG. 2 is shown in a tree format. The access structure represents a decryption condition (policy) that permits decryption. A policy is expressed by logical sum and logical product of attributes. In FIG. 2, the user who satisfies the condition of {attribute AT1∧ (attribute AT2∧attribute AT3)} ∨ attribute AT4 can decrypt the ciphertext. "∨" indicates a logical sum, and "∧" indicates a logical product. Each user specifies an access structure when encrypting data using an application for attribute based encryption.

  For example, it is assumed that the user UA of the user terminal 11A belongs to the development department, experiences the overseas branch office, and is in charge of the project P. In this case, the attributes of the user UA are "development department", "overseas branch office experienced person", and "project P person in charge". It is assumed that the user UB of the user terminal 11B belongs to the information group and is in charge of IoT (Internet of Things). In this case, the attributes of the user UB are “information G” and “IoT”. It is assumed that the user UC of the user terminal 11C belongs to the general affairs section. In this case, the attribute of the user UC is "General Affairs Division".

  In the access structure of FIG. 2, attribute AT1 is "Development Department", attribute AT2 is "overseas branch office experienced person", attribute AT3 is "person in charge of Project P", and attribute AT4 is "General Affairs Department" Suppose. In this case, since the combination of the attributes of the user UA and the user UC satisfies the policy, the user UA and the user UC can decrypt the ciphertext. On the other hand, since the combination of the attributes of the user UB does not satisfy the policy, the user UB can not decrypt the ciphertext.

  Next, an operation example of the cryptographic system 1 will be described with reference to FIGS. 3 to 7. FIG. 3 is a sequence diagram showing an initial setting process in the cryptographic system shown in FIG. FIG. 4 is a sequence diagram showing an encryption key generation process in the encryption system shown in FIG. FIG. 5 is a sequence diagram showing a decryption key generation process in the encryption system shown in FIG. FIG. 6 is a sequence diagram showing an encryption process in the encryption system shown in FIG. FIG. 7 is a sequence diagram showing decryption processing in the encryption system shown in FIG.

  For convenience of explanation, only users UA and UB are illustrated for the user, and only key issuing organizations 20A and 20B are illustrated for the key issuing organization. In addition, the user terminal 11B plays a role as a key issuing organization. It is set in advance which user terminal and key issuing organization will be the key issuing organization of the private key and the public key in the cryptographic system 1. Alternatively, the key issuing organization 20A may designate an institution as a key issuing organization.

  As shown in FIG. 3, in the cryptographic system 1, first, an initialization process is performed. Specifically, each user applies for a usage attribute. Although only the users UA and UB are described here, the same applies to other users. The user UA applies the usage attribute to the key issuing organization 20A using the user terminal 11A (step S11). Similarly, the user UB applies the usage attribute to the key issuing organization 20A using the user terminal 11B (step S11). The application of the usage attribute includes a user attribute or an attribute (combination of attributes) that the user wants to use, and identification information (user identification information) for identifying the user. As the user identification information, a combination of a login ID and a password registered in advance in a web page or the like may be used. The IP (Internet Protocol) address of the user terminal used by the user may be used as the user identification information.

Subsequently, when the key issuing organization 20A receives an application of usage attribute from each user, it performs initial setting (step S12). In step S12, the key issuing authority 20A is a cyclic group G1 consisting of a generator _{g 1} of the prime p1 and quantile, a cyclic group G2 consisting of a generator _{g 2} for the prime p2 and of order, the formula (1) And determine a cyclic group GT having a bilinear mapping e represented by. The cyclic group G1 is a cyclic group having a prime number p1 as an order, and is a cyclic group in which multiplication is defined. The cyclic group G2 is a cyclic group having a prime number p2 as an order, and is a cyclic group in which multiplication is defined. The cyclic group GT is a cyclic group in which addition and multiplication are defined. Then, the key issuing organization 20A determines a bilinear map e which satisfies the equation (1). The bilinear mapping e is a mapping that has two arguments and is represented by e (···).

Subsequently, the key issuing organization 20A randomly determines a random number b (bεZ _p1 ) and calculates an element g ₁ ^b .

In addition, the key issuing organization 20A determines, from the cyclic group G1, random numbers h ₁ , h ₂ ,..., H _N (h ₁ , h ₂ ,...,) For N attributes applied by each user. Choose h _N ∈ G 1) at random.

The key issuing organization 20A then generates a generator g ₁ , a generator g ₂ , an element g ₁ ^b , a bilinear map e, random numbers h ₁ , h ₂ , ..., h _N , and a key issuing organization (here, The public information is transmitted to the public server 30 in order to publicize the identification information (issuing institution identification information) for specifying the key issuing organizations 20A and 20B and the user terminal 11B as public information (step S13). As the issuing agency identification information, for example, the IP address of the key issuing agency is used. Then, the public server 30 stores the public information in a storage device (not shown) (step S14).

Although the key issuing organization 20A carries out step S12 after receiving the application for use attribute from all the users, the execution timing of step S12 is not limited to this. For example, the key issuing organization 20A may select the generators g ₁ and g ₂ , calculate the source g ₁ ^b , and determine the bilinear mapping e before receiving an application for usage attribute from the user. The generator g ₁ , the generator g ₂ , the element g ₁ ^b , the bilinear map e, and the issuing organization identification information may be transmitted to the public server 30 before receiving an application for use attribute from the user. When the key issuing organization 20A receives an application for a new attribute from the user, it selects a random number h _n (n is an integer of 1 to N) corresponding to the attribute, and transmits the selected random number h _n to the public server 30. May be In addition, each user may be associated with a combination of user attributes, and the correspondence relationship between each user and the combination of user attributes may be managed in the key issuing organization 20A. The key issuing organization 20A may transmit the correspondence between each user and the combination of the user's attributes to another key issuing organization.

  Subsequently, each user (user terminal 11A and user terminal 11B) and a key issuing organization other than the key issuing organization 20A among the plurality of key issuing organizations (here, the key issuing organization 20B) Is acquired (step S15). In addition, each organization in the encryption system 1 acquires the IP address of the public server 30 in advance.

Subsequently, as shown in FIG. 4, in the cryptographic system 1, an encryption key generation process is performed. In the encryption key generating process, first, (here, the key issuing authority 20A, 20B and the user terminal 11B) each key issuing authority generates a public key PK ^j (step S21). Each key issuing organization is assigned a number j (j is an integer from 1 to Nc). The total number Nc is the total number of key issuing authorities that generate the public key PK ^j and the secret key SK _u ^j . In step S21, the j-th key issuing organization generates a random number a _j and performs the calculation shown in equation (2) to generate a public key PK ^j .

Each key issuing authority sends the public key PK ^j to the public server 30 to publish the public key PK ^j (step S22). Then, the public server 30 stores the public key PK ^j as public information in a storage device (not shown) (step S23).

Subsequently, (in this case, the user terminal 11A, 11B, and the key issuing authority 20A, 20B) each engine in the cryptographic system 1 obtains Nc number of the public key PK ^j from the public server 30 (step S24). Each engine produces an encryption key PK for encryption attribute-based encryption using the Nc-number of the public key PK ^j (step S25). Specifically, each organization adds each public key PK ^j as shown in Formula (3), and calculates the addition result e (g ₁ , g ₂ ) ^a .

Then, as shown in Expression (4), each organization sets the public information and the addition result e (g ₁ , g ₂ ) ^a as the encryption key PK for attribute-based encryption.

As described above, in the encryption key generation process, the key issuing organizations 20A and 20B generate the public key PK ^j (first public key) and publish the public key PK ^j . Similarly, the user terminal 11B generates a public key PK ^j (second public key) and publicizes the public key PK ^j . The user terminal 11A acquires the public key PK ^j generated by the key issuing organizations 20A and 20B and the public key PK ^j generated by the user terminal 11B, and uses these public keys PK ^j to perform attribute-based encryption An encryption key PK for encryption is generated.

  Subsequently, as shown in FIG. 5, in the cryptographic system 1, decryption key generation processing is performed. Here, a case where the user terminal 11A generates a decryption key will be described. In the decryption key generation process, first, the user terminal 11A requests a secret key from each key issuing organization (here, the key issuing organizations 20A and 20B and the user terminal 11B) (step S31). At this time, the user terminal 11A designates a combination (first attribute) of the attributes of the user UA, and requests a secret key corresponding to the combination of the attributes of the user UA.

  When each key issuing organization (here, the key issuing organizations 20A and 20B and the user terminal 11B) receives the request for the secret key from the user terminal 11A, it generates a secret key according to the combination of the attributes of the user UA ( Step S32). At this time, each key issuing organization may never deny the combination of the designated user UA's attributes if the combination of the designated user UA's attributes includes an attribute irrelevant to the user UA.

In step S32, first, each key issuing organization randomly determines a random number _su ^j for the user terminal 11A (user UA), and performs the calculation shown in equation (5). The random number _su ^j is a value determined for each user. The total number X of the attributes of the user UA (attributes included in the combination of the attributes of the user UA) is equal to or less than the total number N of attributes used in the user system 10. The random number h _ux is a random number h _n corresponding to the x-th attribute of the X attributes of the user UA.

Subsequently, each key issuing organization transmits (distributes) the secret key SK _u ^j shown in Formula (6) to the user terminal 11A (step S33).

Then, the user terminal 11A generates the decryption key SK _u for attribute-based encryption decryption using the Nc secret keys SK _u ^j (step S34). Specifically, as shown in the equations (7) and (8), the user terminal 11A adds the Nc secret keys SK _u ^j for each element, and uses the addition result as the decryption key SK _u . The decryption key SK _u includes X attribute keys (attribute keys K _{u1 to} K _uX ).

As described above, in the decryption key generation process, the user terminal 11A requests the key issuing organization 20A, 20B for the secret key SK _u ^j (first secret key) according to the combination of the attributes of the user UA, and the user terminal 11B Request the secret key SK _u ^j (second secret key) according to the combination of the attributes of the user UA. The key issuing authority 20A, 20B, in response to a request from the user terminal 11A, to distribute the secret key _SK ^{u j} to the user terminal 11A generates the secret key _SK ^{u j.} Similarly, the user terminal 11B, in response to a request from the user terminal 11A, to distribute the secret key _SK ^{u j} to the user terminal 11A generates the secret key _SK ^{u j.} The user terminal 11A acquires the secret key SK _u ^j from the key issuing organizations 20A and 20B, and acquires the secret key SK _u ^j from the user terminal 11B. Then, the user terminal 11A generates a decryption key SK _u (first decryption key) for decryption of the attribute-based encryption using these secret keys SK _u ^j .

  Subsequently, encryption processing will be described in which the user performs encryption using attribute-based encryption. Here, the case where the user terminal 11A performs encryption will be described. As shown in FIG. 6, in the encryption process, the user UA first encrypts desired data Msg using the user terminal 11A (step S41). For example, an encryption application for attribute-based encryption is pre-installed in the user terminal 11A. The user UA specifies a combination of attributes (access structure) that can decrypt the data in the cryptographic application. In the example of FIG. 2, a user having a combination of the attributes “Development Department”, “overseas branch office experienced person” and “person in charge of Project P”, or a user having a combination of attributes “General Affairs Division” can decode An access structure is specified. Each user can specify an arbitrary access structure, for example, can specify an access structure that the user can not decrypt.

Then, the user terminal 11A expresses the designated access structure in the form of a matrix M of l rows and m columns, using the linear secret sharing method. Note that the total number l of rows is an attribute included in the access structure, and even the overlapping attributes are equal to the number of attributes when counted separately. For example, in the example of FIG. 2, a matrix M represented by equation (9) is generated as an example of a matrix that satisfies the policy.

Then, the user terminal 11A randomly generates a vector v including m elements corresponding to the matrix M. As shown in equation (10), the vector v includes secret information s and random numbers z _{2 to} z _m .

Then, the user terminal 11A calculates the value λ _i using the vector v and the row M _i of the row _i of the matrix M (i is an integer of 1 to 1), as shown in Equation (11). Do.

Subsequently, the user terminal 11A is randomly determining l random numbers _{r i.} Then, the user terminal 11A encrypts the data Msg to be encrypted using the value λ _i , the random number r _i and the encryption key PK, as shown in Expression (12), to generate a ciphertext. The random number h _((i) is a random number h _n corresponding to the attribute of the i-th row.

  Then, the user terminal 11A transmits the ciphertext to the cloud storage 40 (step S42). When receiving the ciphertext from the user terminal 11A, the cloud storage 40 stores the ciphertext in a storage device (not shown) (step S43).

  Subsequently, decryption processing in which a user decrypts a ciphertext using attribute-based encryption will be described. Here, the case where the user terminal 11A performs decryption will be described. As shown in FIG. 7, in the decryption process, the user UA first requests the cloud storage 40 to acquire a ciphertext using the user terminal 11A (step S51). Then, when the cloud storage 40 receives the request for acquiring the ciphertext from the user terminal 11A, the cloud storage 40 reads the requested ciphertext from the storage device (not shown) and transmits the ciphertext to the user terminal 11A (step S52).

Subsequently, the user terminal 11A receives the ciphertext from the cloud storage 40, performs decoding using the decryption key SK _u user UA (step S53). At this time, when the combination of the attributes of the user UA satisfies the policy set in the ciphertext, the user terminal 11A can calculate the value w _i satisfying the equation (13).

Then, the user terminal 11A decrypts the ciphertext using the value w _i and the decryption key SK _{u of the} user UA, as shown in equation (14), and obtains the original data Msg. The attribute key K _((i) is the attribute key K _ux corresponding to the attribute of the i-th row of the l attributes included in the matrix M (access structure).

As described above, each user can decrypt the ciphertext using the decryption key of the user only when the combination of the attributes of the user satisfies the policy set in the ciphertext. The security of attribute-based cryptography stems from the difficulty of the discrete logarithm problem. For example, the way of example, a generator g ₁ of the original g ₁ ^a1 Tokyo, is the property that it is difficult to calculate the random number a _1. Due to this property, it can be said that the above attribute-based encryption is secure.

  Next, another operation example of the cryptographic system 1 will be described with reference to FIGS. 8 and 9. FIG. 8 is a sequence diagram showing delegation processing in the encryption system shown in FIG. FIG. 9 is a sequence diagram showing a secret key generation process in the encryption system shown in FIG. Delegation means that the key issuing authority passes the authority over some of the N attributes to other authorities. For convenience of explanation, only users UA and UB are shown for the user, and only key issuing organizations 20A, 20B and 20C are shown for the key issuing organization. In addition, the user terminal 11B plays a role as a key issuing organization.

In the initial setting process, the user terminal 11B (user UB) arbitrarily selects the key issuing organization of the transferee from among the key issuing organizations that are approved to be the key determination organization of the transferee among a plurality of key issuing organizations. Select to Then, for example, in step S11, the user terminal 11B issues, in addition to the application for the usage attribute, a delegation attribute which is a delegation target attribute and a key issuing organization (key issuing organization 20C; another key issuing organization) of the delegation destination. The key issuing organization 20A is notified of the organization identification information. In step S13, the key issuing organization 20A transmits the public information including the transfer attribute and the issuing organization identification information of the key issuing organization of the transfer destination to the public server 30. As a result, the transfer attribute and the key issuing organization of the transfer destination are known in advance to each of the organizations in the cryptographic system 1. The user terminal 11B may delegate different delegation attributes to a plurality of key issuing organizations. The key issuing organization to be transferred may overlap with the key issuing organization that is generating the private key SK _u ^j and the public key PK ^j .

Here, the case where the user terminal 11B transfers some of the N attributes to the key issuing organization 20C will be described. First, the user terminal 11B generates a transfer key (step S61). In step S61, first, the user terminal 11B randomly determines the random number s _d ^j and performs the calculation shown in equation (15). The total number Y of delegation attributes is equal to or less than the total number N of attributes used in the user system 10. The random number h _dy is a random number h _n corresponding to the y-th attribute of the Y transfer attributes.

Then, the user terminal 11B transmits (distributes) the transfer key DK ^j shown in the equation (16) to the key issuing organization 20C (step S62). The transfer key DK ^j includes Y attribute keys (attribute keys K _d1 ^{j to} K _dY ^j ). Note that the original secret key SK _u ^j can not be determined from the transfer key DK ^j .

  Also, the key issuing organization 20C acquires public information from the public server 30 (step S63).

  Subsequently, as shown in FIG. 9, in the cryptographic system 1, decryption key generation processing is performed. Here, the case where the user terminal 11A performs decryption will be described. In the decryption key generation processing, first, the user terminal 11A determines whether or not the combination of the attributes of the user UA is included in the set of delegation attributes (step S71). If it is determined that the combination of the attributes of the user UA is not included in the set of delegation attributes (step S71: NO), the decryption key generation process shown in FIG. 5 is performed.

  On the other hand, when the user terminal 11A determines that the combination of the attributes of the user UA is included in the set of delegation attributes (step S71: YES), the user terminal 11A requests a secret key from each key issuing organization (step S72). Compared to step S31 of FIG. 5, the point of requesting a secret key to the key issuing organization 20C instead of the user terminal 11B is different. When each key issuing organization (here, key issuing organizations 20A to 20C) receives a request for a secret key from the user terminal 11A, it generates a secret key according to the combination of the user UA's attributes (step S73).

In step S73, the key issuing organization 20C randomly determines a random number _su ^j for the user terminal 11A (user UA), and performs the calculation shown in equation (17). The attribute key K _dux ^j is an attribute key K _dy ^j corresponding to the x-th attribute of the X attributes of the user UA. The secret key generation process of the key issuing organizations 20A and 20B is the same as that in step S32, and thus the description thereof is omitted.

Subsequently, each key issuing organization transmits (distributes) the secret key SK _u ^j shown in Formula (6) to the user terminal 11A (step S74). Then, as in step S34, the user terminal 11A generates the decryption key SK _u for decryption of the attribute-based encryption using the Nc secret keys SK _u ^j (step S75).

As described above, in the encryption system 1, the user system 10, the encryption method performed by the user terminal 11A, and the encryption program that causes the user terminal 11A to execute the encryption method, the user terminal 11A is generated by the key issuing organizations 20A and 20B. a public key PK ^j has, generates an encryption key PK for encryption attribute-based encryption using a public key PK ^j generated by the user terminal 11B in the user system 10. The user terminal 11A is decoded attribute-based encryption for decryption by using the secret key _SK ^{u j} generated by the user terminal 11B of the key issuing authority 20A, a secret key _SK ^{u j} and the user system 10 produced by 20B Generate key SK _u .

The same applies to the case where the user terminal 11B performs encryption and decryption. That is, the user terminal 11B requests the key issuing organization 20A, 20B for the secret key SK _u ^j (third secret key) according to the combination (second attribute) of the user UB's attributes, and the combination of the user UB's attributes A secret key SK _u ^j (fourth secret key) is generated according to. The key issuing authority 20A, 20B, in response to a request from the user terminal 11B, distributing the secret key _SK ^{u j} to the user terminal 11B generates a secret key _SK ^{u j.} The user terminal 11B generates the encryption key PK using the public key PK ^j , acquires the secret key SK _u ^j from the key issuing organizations 20A and 20B, and generates the secret key SK generated by the key issuing organizations 20A and 20B. generating a decryption key SK u for decoding the attribute-based encryption _(second decryption key) by using the secret key SK _u ^j _{to u} ^j and the user terminal 11B itself generated.

  As described above, when the user terminal 11B in the user system 10 plays a role as a key issuing organization, it is possible to reduce the possibility that a ciphertext is decrypted by collusion by the key issuing organization. That is, since the user UB has a part of the key management authority, even when all the key issuing organizations other than the user system 10 collude, the ciphertext can not be decrypted. As a result, it is possible to improve the security of attribute-based encryption.

The user terminal 11B delegates one or more (Y) of the plurality (N) of attributes used in the user system 10 to the key issuing organization 20C as a set of delegation attributes. Then, when the combination of the attributes of the user UA is included in the set of delegation attributes, the user terminal 11A requests the secret key SK _u ^j from the key issuing organization 20C of the delegation destination instead of the user terminal 11B. The key issuing authority 20C, in response to a request from the user terminal 11A, to distribute the secret key _SK ^{u j} to the user terminal 11A generates the secret key _SK ^{u j.} As described above, with respect to the attribute for which confidentiality is desired to be maintained in the user system 10, the user terminal 11B (user UB) itself plays the role of key issuing organization, and the key for the user (user UA etc.) of the user system 10 Create and distribute the Further, in order to reduce the burden on the user UB of the user terminal 11B, the user terminal 11B creates the transfer key DK ^j for the attribute not related to confidentiality and the attribute not related to the user system 10, The key issuing authority 20C delegates the generation and distribution of keys relating to the delegation attribute. As a result, the user terminal 11B is not required to generate and distribute the secret key relating to the transfer attribute, so the burden on the user UB of the user terminal 11B can be reduced. On the other hand, for attributes other than the transfer attribute, since the user UB has a part of the key management authority, even when all the key issuing organizations other than the user system 10 concur, it is possible to decrypt the ciphertext Can not. As a result, it is possible to improve the security of the attribute-based encryption while reducing the burden on the user UB.

  Note that the encryption system, user system, encryption method, and encryption program according to the present invention are not limited to the above embodiment.

  In the above embodiment, each user applies for the use attribute to the key issuing organization 20A, but may apply to the other key issuing organization. For example, as in the case where a key issuing organization to which a user of one organization applies for use attribute and a key issuing organization to which a user of another organization applies for use attribute are different, use attributes to two or more key issuing organizations Applications may be made. In such a case, one key issuing organization (e.g., key issuing organization 20A) may compile attributes applied to other key issuing organizations. The other key issuing organization applies for the use attribute to the key issuing organization 20A for the use attribute applied to itself. The key issuing organization 20A performs initialization as in the above embodiment.

  The cryptographic system 1 may not have the public server 30. In this case, the public information is directly distributed to each organization in the cryptographic system 1 by e-mail or the like.

  The attributes of the user may be determined by predetermined rules. For example, when the user is a company employee, attributes such as the department to which the user belongs and the year of employment are managed. In this case, these attributes may be collectively applied to the usage attribute in the management department of the company, and each user may not apply for the usage attribute.

  The user system 10 may include not only user terminals belonging to one organization but also user terminals belonging to different organizations. In this case, an attribute with the same name may be used by two or more organizations. Therefore, attribute names and the like are set so that the attributes of each organization can be uniquely identified. For example, when the user UA belongs to the company E, the user UB belongs to the company F, and the users UA and UB apply for the use attribute with respect to the attribute "general affairs section", The two attributes are distinguished as "company" and "general affairs section F company", or the attribute of the company name and the attribute of "general affairs section" are ANDed together.

  Further, when the user terminal 11B transfers the transfer attribute to the key issuing organization 20C, the user terminal 11A, as in FIG. 5, each key issuing organization (in the example of FIG. 5, the key issuing organizations 20A and 20B and the user terminal 11B) Request a secret key. Then, when the user terminal 11B performs the process of step S71 and it is determined that the combination of the attributes of the user UA is not included in the set of delegation attributes (step S71: NO), the decryption key generation process shown in FIG. To be done. On the other hand, when the user terminal 11B determines that the combination of the attributes of the user UA is included in the set of delegation attributes (step S71: YES), the user terminal 11A notifies the user terminal 11A of the key issuing organization 20C of the delegation destination, and the user terminal 11A May request the key issuing authority 20C for the private key.

  DESCRIPTION OF SYMBOLS 1 ... Encryption system, 10 ... User system, 11A ... User terminal (1st user terminal), 11B ... User terminal (2nd user terminal), 11C ... User terminal, 20A ... Key issuing organization, 20B ... Key issuing organization, 20C ... key issuing organization (another key issuing organization), 30 ... public server, 40 ... cloud storage, NW ... network, UA ... user, UB ... user, UC ... user.

Claims (8)

An encryption system using attribute-based encryption
Key issuing authority,
A user system comprising a first user terminal having a first attribute comprising one or more attributes and a second user terminal;
Equipped with
The key issuing organization generates a first public key and makes the first public key public.
The second user terminal generates a second public key and makes the second public key public.
The first user terminal requests the key issuing organization for a first secret key corresponding to the first attribute, and requests a second secret key corresponding to the first attribute to the second user terminal.
The key issuing organization generates the first secret key and distributes the first secret key to the first user terminal in response to a request from the first user terminal.
The second user terminal generates the second secret key and distributes the second secret key to the first user terminal in response to a request from the first user terminal.
The first user terminal generates an encryption key for encryption of attribute-based encryption using the first public key and the second public key, and uses the first secret key and the second secret key. Cryptographic system for generating a first decryption key for decryption of attribute based cryptography. The second user terminal has a second attribute including one or more attributes;
The second user terminal requests the key issuing organization for a third secret key corresponding to the second attribute, and generates a fourth secret key corresponding to the second attribute.
The key issuing organization generates the third secret key and distributes the third secret key to the second user terminal in response to a request from the second user terminal.
The second user terminal generates the encryption key using the first public key and the second public key, and uses the third secret key and the fourth secret key to decrypt the attribute-based encryption. The cryptographic system according to claim 1, wherein a second decryption key is generated. Further equipped with another key issuing agency,
The second user terminal delegates one or more of the plurality of attributes used in the user system to the other key issuing organization as a set of delegation attributes,
The first user terminal requests the second secret key from the other key issuing organization if the first attribute is included in the set of delegation attributes.
The other key issuing organization generates the second secret key and distributes the second secret key to the first user terminal in response to a request from the first user terminal. The encryption system according to 2. A user system including a first user terminal having a first attribute including one or more attributes and a second user terminal, wherein the user system uses attribute-based encryption,
The first user terminal acquires a first public key generated by an external key issuing organization and a second public key generated by the second user terminal, and the first public key and the second public key are acquired. Generate an encryption key for attribute based encryption encryption using the key,
The first user terminal requests the key issuing organization for a first secret key corresponding to the first attribute, and requests a second secret key corresponding to the first attribute to the second user terminal.
The first user terminal acquires the first secret key from the key issuing organization, acquires the second secret key from the second user terminal, and uses the first secret key and the second secret key. A user system generating a first decryption key for decryption of attribute-based encryption. The second user terminal has a second attribute including one or more attributes;
The second user terminal requests the key issuing organization for a third secret key corresponding to the second attribute, and generates a fourth secret key corresponding to the second attribute.
The second user terminal generates the encryption key using the first public key and the second public key.
The second user terminal acquires the third secret key from the key issuing organization, and generates a second decryption key for attribute-based encryption decryption using the third secret key and the fourth secret key. The user system according to claim 4. The second user terminal delegates one or more of the plurality of attributes used in the user system to another key issuing organization as a set of delegation attributes,
The said 1st user terminal requests | requires the said 2nd secret key to the said another key issuing organization, when the said 1st attribute is contained in the set of the said transfer attribute, The 4th or Claim 5 User system. A cryptographic method performed by the first user terminal in a user system including a first user terminal and a second user terminal having a first attribute including one or more attributes and using attribute-based encryption,
Acquiring a first public key generated by an external key issuing organization and a second public key generated by the second user terminal;
Generating an encryption key for attribute-based encryption using the first public key and the second public key;
Requesting a first secret key according to the first attribute from the key issuing organization, and requesting a second secret key according to the first attribute from the second user terminal;
Acquiring the first secret key from the key issuing authority and acquiring the second secret key from the second user terminal;
Generating a first decryption key for decryption of attribute based encryption using the first secret key and the second secret key;
Cryptographic method comprising: On the computer
Acquiring a first public key generated by an external key issuing organization, and a second public key generated by a user terminal belonging to a user system together with the computer;
Generating an encryption key for attribute-based encryption using the first public key and the second public key;
Requesting a first secret key according to a first attribute including one or more attributes of the computer from the key issuing organization, and requesting a second secret key according to the first attribute from the user terminal;
Acquiring the first secret key from the key issuing authority and acquiring the second secret key from the user terminal;
Generating a first decryption key for decryption of attribute based encryption using the first secret key and the second secret key;
Cryptographic program to run.

Images