JP3638501B2 - Anonymous communication path - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
In the present invention, when conducting a questionnaire survey or electronic voting, for example, electronically via a telecommunication device, the contents of the answer and the contents of the vote are correctly obtained while maintaining the anonymity of the questionnaire respondent and the voter. It is related with the anonymous communication path applied to the communication which can be performed.
[0002]
[Prior art]
MIX-NET has been proposed as a means for realizing an anonymous communication path by a telecommunications system. MIX-NET is a system in which _m decryption servers M ₁ ,..., M _m are connected via a registered communication path. Regarding MIX-NET, the technique disclosed in Japanese Patent Application No. 11-333727 will be described.
It is assumed that the public parameters g, p, q are held in the storage devices of all decryption servers. However, p and q are large prime numbers, and q divides p−1. g is a secret key for each decryption server M _i (i = 1, 2,..., m) having an order q in Z _p ^* (Z _p ^* is a set of 1, 2,..., p−1). Hold a _i and x _i in storage. The corresponding public key y _i satisfies y _i = h _i ^xi mod p for h _i = h _i−1 ^ai mod p (where h ₀ = g). The input to Mix-net is a list L ₀ consisting of n entries. Each entry in L ₀ is a pair (G, C) of key information G and ciphertext C. Each (G, C) is G: = g ^r mod p, C: = ε (ε (... (Ε (msg, K _m ), K _m−1 ),...), K ₁ for plaintext msg. ) Is a value obtained by calculation like Here, r is a random number selected independently for each ciphertext from {0,..., Q−1}, and K _i is K _i : = H (y _i ^r mod p) using the hash function H. Ε (α, β) is an encryption function that encrypts message α using β as an encryption key. That is, C is a ciphertext obtained by multiplying plaintext msg with keys K _m ,..., K ₁ .
[0003]
The decryption server M ₁ operates as follows with respect to the input L ₀ . (G ′, C ′) is calculated for each key information-ciphertext pair (G, C) in L ₀ . Here, G ′ = G ^a1 modp, C ′ = D _K1 (C). However, D _K1 is a decryption function based on the key K1 = H ((G ′) ^{× 1} modp). At this time, since (G ′) ^x1 = G ^a1x1 = g ^ra1x1 = y ₁ ^r modp holds, C ′ = D _K1 (C) = ε (ε (... (Ε (msg, K _m ), K _m−1 ),...), K ₂ ), and finally C ′ is the result of decrypting the ciphertext encrypted multiple times only once. The decryption server M ₁ shuffles each (G ′, C ′) obtained by executing this one-time decryption (the order is changed randomly), and the obtained list of ciphertexts in the random order is represented by L _1. and output as, be sent to the next of the decoding server M _2. Thereafter, the decryption servers M ₂ ,..., M _m repeat the same procedure. Finally, the output L _m from the decoding server M _m is a list of plain msg obtained by decoding all encrypted hung on multiple.
[0004]
Unless each decryption server reveals the decryption key or the random replacement used for shuffling, it is difficult to determine which plaintext corresponds to which ciphertext because of the nature of the encryption function. Therefore, the creator of each input ciphertext does not know which plaintext is input, and can maintain anonymity here.
[0005]
[Problems to be solved by the invention]
However, in the anonymous communication path shown in Japanese Patent Application No. 11-333727, when an illegal process such as a server failure or rewriting of illegal input data occurs in the decryption server, the output plaintext correctly decrypts the input ciphertext. May not match. An object of the present invention is to provide an anonymous communication path that solves the above-described problems and can finally obtain a normal output even when an illegal process occurs in a decryption server.
[0006]
[Means for Solving the Problems]
According to the present invention, at least one verification server for confirming that each decoding server is functioning normally is provided. A group of servers composed of the one decryption server and the verification server is called a decryption block, and within one decryption block, the output of the decryption server (partial decryption result) is verified by all the verification servers belonging to the group, Only when all the verification servers recognize that the output of the decryption server is normal, the output of the decryption block is correct, and each verification server belonging to one decryption block receives the partial decryption key of the decryption server. If the verification server of the block to which it belongs does not recognize the validity of the output, the partial decryption key held by the verification server is output (disclosed). When it is determined that the partial decryption result of a certain decryption block is not correct, decryption and verification operations are performed on behalf of the decryption block other than the decryption block using the partial decryption key output (publicized).
[0007]
With this configuration, if all servers including the decryption server operate normally in at least one decryption block, and if at least one server operates normally in all decryption blocks, a correct plaintext list is output. Is guaranteed.
[0008]
DETAILED DESCRIPTION OF THE INVENTION
Examples of the present invention will be described below. This embodiment shows an anonymous communication path that functions normally regardless of which m-1 servers have failed. In the following, p is a prime number in which the discrete logarithm problem cannot be obtained in Z _p (Z _p is a set of 0, 1, 2,..., P−1). gεZ _p ^* is a generator of Z _p ^* . In addition, arithmetic operations performed in the following description are performed with mod p unless otherwise stated.
[0009]
y _i is the public information of the decryption block S _i , h ₀ = g for the secret information a _i , x _i and defined as follows for i (1 < i < m).
h _i = h _i-1 ^ai (1)
y _i = h _i ^xi (2)
The input to the anonymous communication path is a list L ₀ composed of n ciphertexts. Each input ciphertext in L ₀ is represented as (G, C). Each input ciphertext (G, C) is G: = g ^r mod p, C: = Ε (ε (... (Ε (msg, K _m ), K _m−1 ),...), K ₁ ). Here, r is a random number selected independently for each ciphertext from {0,..., Q−1}, and K _i is K _i : = H (y _i ^r mod p) using the hash function H. Ε (α, β) is an encryption function that encrypts message α using β as an encryption key. For example, a DES encryption operation may be used as ε. After all, C is a ciphertext obtained by multiply encrypting plaintext msg with keys K1,..., Km.
-Outline of device Fig. 1 shows an anonymous communication path. m-number of decoded block B _1, ..., B _m is provided, the verification server V _i ... V _i of decoding one server M _i and m-1 units in each decoding _block, the number m servers with _m The decryption server M _i and the verification server V _{i, 1} −V _{i, m} in each decryption block are connected by the secret communication path 11. Furthermore, electronic bulletin board 12 is provided, all the decoding server M _i, all of the validation server _{V i, 1 ... V i,} m is connected to the bulletin board plurality of decoded server M ₁ ... M _m Forums 12 A connected information communication network is configured. There are n (G, A list L ₀ composed of C) is input and released, and public information y ₁ ,..., Y _m , h ₁ ,..., H _m and parameters p and g are also disclosed on the bulletin board 12. Each decoding block is composed of m servers, but each server operates independently. Instead of the bulletin board 12, a broadcast communication channel with caller authentication may be used. In other words, it may be a broadcast communication channel that knows which server has output and prevents spoofing.
・ Decryption server M _i
FIG. 2 shows a functional configuration of the decryption server. Decoding server M _i is the input unit 110, output unit 120, key selection unit 130, decoding unit 140, shuffle unit 150 for stirring the list of pairs of key information and ciphertext, belongs decoded block B _i part decryption key ( Secret information) A memory 160 storing a _i and a _i x _i , and a control unit 170 that performs overall control connected thereto.
・ Verification server V _{i, j}
FIG. 3 shows a functional configuration of the verification server. The verification server V _{i, j} includes an input unit 210, an output unit 220, a key selection unit 230, a decryption unit 240, a replacement unit 250 that performs replacement based on a replacement function sent from the decryption server, and a list comparison that performs list comparison 260, a memory 270 storing the decryption keys a _i and a _i x _i of the decryption block B _i to which it belongs, and a control unit 280 connected to these and controlling the whole.
Decoding Unit FIG. 4 shows functional configurations of the decoding unit 140 of the decoding server and the decoding unit 240 of the verification server. These decryption units belonging to the decryption block B _i receive (G, C) and secret information a _i , a _i x _{i taken} in the decryption block, calculate G ^ai , and output transformed key information G ′ power calculator 42 for calculating a power calculator 41, G ^Aixi that, the hash unit 43 which generates the G ^Aixi in by applying a hash function decryption key ^{_{K i = H (G aixi)}} , decryption key K _i that generated And a decryption operation unit 44 that decrypts the ciphertext C that has been encrypted multiple times using the above and outputs a partial decryption result C ′.
Key Selection Unit FIG. 5 shows functional configurations of the key selection unit 130 of the decryption server and the key selection unit 230 of the verification server. These key selection units belonging to the decryption block B _i are displayed on the bulletin board 12 and the public information corresponding to each set of a _i and a _i x _i output to the bulletin board 12 by the verification server belonging to the decryption block B _i-1. h _i-1 , h _i , y _i as inputs, a power calculator 31 for calculating h _i-1 ^ai , a power calculator 32 for calculating h _i-1 ^aixi , these calculation results and the decoding block B _i− A comparator 33 that compares ₁ public keys h _i and y _i respectively and outputs _ai and a _i x _i that match each other as correct secret information.
Shuffle unit FIG. 6 shows a functional configuration of the shuffle unit 150 of the decryption server. The shuffle unit 150 belonging to the decryption block B _i receives the ciphertext and key information list L _i ′ obtained from the decryption unit 140 corresponding to all the lists for the input list, and uses a random number generator as a replacement generator 51. The replacement (rearrangement) of the list is performed by the replacer 52 based on the replacement function π _i composed of n random numbers output from the above, and the replaced list _Li and the replacement function π _i are output.
Replacement unit FIG. 7 shows a functional configuration of the replacement unit 250 of the verification server. The replacement unit belonging to the decryption block B _i receives a list of ciphertext and key information obtained from the decryption unit of the verification server corresponding to all lists for the input list, and is sent from the decryption server M _i . Based on the replacement function π _i , list replacement (rearrangement) is performed by the replacer, and the replaced list L _i is output.
[0010]
Anonymous channel which receives the input, B ₁ from the first decoded block B _1, B _2, ..., perform the following in the order of B _m.
The decryption server M _i of the decryption block B _i operates as follows. The processing procedure is shown in FIG.
Input unit 110 always monitors whether decoding server M _i-1 lists from L _i-1 of the immediately preceding decoded block B ₁ is published (output) to the bulletin board _{12 (S1), L i-} 1 to the message board 12 Is released, it is checked whether the secret information a _i-1 , a _i-1 x _i-1 has been released to the bulletin board 12 from the verification server of the decryption block B _i-1 (S2). The list L _i-1 is fetched from the bulletin board 12 and temporarily stored in the operation memory in the control unit 170 (S3).
[0011]
The secret information a _i and a _i x _i stored in the memory 160 is extracted and input to the decryption unit 140 (S4), and _one ciphertext (G, C) in the list L _{i-1 is} extracted and the decryption unit 140 is extracted. (S5). As shown in FIG. 4, the decryption unit 140 first inputs G and a _i to the power calculator 41 for key information, and generates key information G ′ = G ^ai (S6). Next, G and a _i x _i are input to the power calculator 42 for the decryption key to calculate G ^aixi (S7), and the result G ^aixi is input to the hash unit 43, and the result H (G ^aixi ) It is referred to as decryption key K _i (S8). The obtained decryption key K _i and the inputted C are inputted to the decryption computing unit 44 to perform one-time decryption processing, and the result is expressed as C ′ = ε (ε (... (Ε (msg, K _m ), K _m-1 ),..., K _i-1 ) (S9).
[0012]
It is checked whether or not there is an unprocessed (G, C) in the list _Li-1 (S10).
A pair of ciphertext and key information output from the decryption unit 140 is (G ′, C ′). The same decryption process is performed on all ciphertexts in the list L _i−1 to obtain a list L ′ _{i of} (G ′, C ′) obtained. When L ′ _i is obtained, L ′ _i is input to the shuffle unit 150. The shuffle unit 150 drives the random permutation generator 51 (FIG. 6) to generate a random permutation function π _i (S11), inputs the random permutation function π _i and the list L ′ _i to the permuter 52, and replaces the permutation function. A list L _i replaced (reordered) according to π _i is obtained (S12).
[0013]
The output unit 120 is driven to publish L _i on the bulletin board 12, and the replacement function π _i is transmitted to each verification server V _{i, 1} ... V _{i, m} in the same decryption block B _i using the secret communication path 11. (S13).
Each verification server V _{i, 1} ... V _{i, m} of the decoding block B _i operates as follows. The processing procedure is shown in FIG.
The input unit 210 waits for reception from the decoding server L _i (S1), when there is a reception, checks whether alternate process (S2), and temporarily stores the permutation function [pi _i received if not alternate process, also The output list L _i-1 of the decryption servers L _i and M _i-1 is fetched from the bulletin board 12 and stored in the operation memory (S3).
[0014]
The same process as the decryption process of the decryption server M _i is performed on this L _i−1 . That is, steps S4 to S10 in FIG. 8 are executed to obtain a list L ′ _i (S4). This L ′ _i is replaced (reordered) by using the π _i received from the decryption server M _i by the replacement unit 250, and is output as a list L ″ _i (S5).
The output list L _i of the decryption server M _i is fetched from the bulletin board 12 (S6), and this L _i and L ″ _i are input to the list comparison unit 260, and whether or not both L ″ _i and L _i match. If it matches, “1” is output to the bulletin board 12 (S8), otherwise “0” and the secret information a _i in the memory 270 held by the verification server and a _i x _i is output to the bulletin board 12 (S9). Uptake of L _i in step S6 may be previously carried out simultaneously in the step S3. Or from the decoding server M _i along with the π _i L _i may also be sent to the verification server. In addition, when outputting (disclosing) to the bulletin board 12, information indicating which decoding block is output is added.
[0015]
In step S2 in FIG. 8, a _i-1, a _i-1 x if _i-1 set is published on the bulletin board 12 even one, decryption server M _i-1 of the decoded block B _i-1 This is a case in which there is an output that does not match in the verification by the verification server for the list L _i-1 created and output, and it is not verified as correct. Therefore, in this embodiment, a case in which so as to intercept the processing of the decoded block B _i-1 by the decoding block B _i.
[0016]
That is, the decryption server M _i takes in the list L _i-2 to be processed in the decryption block B _i-1 from the bulletin board 12 and selects public information h _i-2 , h _i-1 for selection of correct secret information. , Y _i-1 are fetched from the bulletin board 12 and all secret information a _i-1 , a _i-1 x _i-1 published on the bulletin board 12 are fetched and temporarily stored (S14). The secret information a _i-1 , a _i-1 x _i-1 and the public information h _i-2 , h _i-1 , y _i-1 are input by the key selection unit 130 and the process shown in 5, each a _i-1, a _i-1 x conducted on _i-1 set, a _i-1 match is obtained in the comparator 33, a _i-1 x _i-1 Is selected as correct secret information (S15).
[0017]
Next, using this correct secret information a _i-1 , a _i-1 x _i-1 , a decryption process is performed on L _{i-2 in the same} manner as in steps S5 to S12, and a replacement list L _i-1 is acquired (S16). Publish this list L _i-1 to the bulletin board 12, verifies the permutation function [pi _i-1 which was used to replace the list server V _{i, 1} ... V _i, to _m, and adds information indicating that the alternate process (S17).
Note decoded block B _i-1 of the decoding server M _i-1 is verified be made illegal process due failed server V _{i-1, 1,} ..., if V _{i-1, m} are all correct, and decoding the server If M _i performs the correct process, the secret information a _i-1 and a _i-1 x _i-1 used for this is guaranteed to be correct by the public information. L _i-1 is correct. Also in this case, in order to verify whether or not the decryption server M _i has performed the correct process, each verification server V _{i, 1} ,..., V _{i, m of} the decryption block B _i is a substitute process in step S2 in FIG. Is received, the received π _i-1 is stored, and L _i-2 , h _i-2 , h _i-1 , y _i-1 , all a _i-1 , a _{i- 1} x _i-1 is taken in and stored (S10).
[0018]
About the taken _{a i-1, a i-} 1 x i-1 by the key selecting unit 230 performs a key selection processing shown in FIG. 5, select the correct _{a i-1, a i-} 1 x i-1 (S11). Using the correct a _i-1 , a _i-1 x _i-1 , the decoding process is performed on L _i-2 , and the decoding result is replaced with the received π _i-1 to obtain a list L ″ _{i. -2} is obtained, L ″ _i−2 is compared with L _i−2 obtained by the proxy server M _i , and the comparison result is processed in the same manner as in steps S8 and S9 (S13). ).
[0019]
As a result, all the verification servers V _{i, 1} ... V _{i, m} have a match, and a _i−1 , a _i−1 x _i−1 are not output, so decoding is performed in step S1 in FIG. since the server M _i by detecting the L _i-1, published, and a _i-1 from the verification server decoded block B _i in step _{S2, a i-1 x i} -1 is not exposed, the L _i The process from step S3 onward can be executed for _-1 .
By performing the above-described processing sequentially for decoding block B _i from i = 1 to i = m, if there is no illegal processing or if correct processing is performed by proxy processing even if there is illegal processing, the last decoding is performed. The input list L ₀ is rearranged from the server M _m to obtain a correctly decrypted plaintext list L _m . That Ultimately, e.g. either server or particularly provided a server of a predetermined final decoded block B _m is, after the processing of the decoded block B _m has been completed, the verification server for each decoded block B _i " If 0 ″ is output, the output secret information a _i , a _i x _i is verified with the public information h _i−1 , h _i , y _i , and the local decryption is performed using the correct secret information. If the verification server outputs all “1” in the decoding block B _i , the final correct decoding result L _m is obtained by using the output L _i of the decoding block (decoding server M _i ). Ask.
[0020]
In each decoding block B ₁ ... B _m, decryption server, at least the validation server one always correct and if correct decoded block B ₁ ... At least one but need of B _m, the anonymous channel is normally Operate. That is, even if a fraud is performed in a block other than the decryption block that operates correctly, if the decryption server is fraudulent, the correct secret information a _i , a _i x _i must be obtained from at least one normal verification server. Since it is output, the correct key K _i can be created from the public information h _i−1 , h _i , y _i, and decryption processing can be performed. Since one decryption block is always normal, an output list in which the input list is randomly rearranged is obtained, and since the decryption server and each verification server are connected by the secret communication path 11, the replacement function π _It acts as an anonymous communication path because there is no risk of _i being stolen. On the other hand, when the secret information a _i and a _i x _i is released from all the verification servers of one decryption block, and the key selection processing is not performed for these secret information, the correct one cannot be selected. will be decoded server for the decoded block are correct may be utilizing the output list L _i.
[0021]
As shown in FIG. 1, each decoding block B _i is provided with m−1 verification servers V _{i, 1} ... V _{i, m−1} in one decoding server M _i , and the number of decoding blocks is m. In this case, even if there are frauds in (m-1) servers in total, the server operates correctly. As described above, the anonymous communication path of the present invention operates normally if there is no fraud in at least one of the decryption blocks and there is no fraud in at least one of the decryption servers and verification servers in each decryption block. The number of verification servers belonging to each decoding block may be at least one.
[0022]
In the above description, the substitution process for the decoding block B _i-1 is performed in the next decoding block B _i . However, as described above, the substitution process is performed using the information published on the bulletin board 12. Any of the decoding blocks B _{i to} B _m other than the block B _i-1 may be performed. In this case, determined in advance decoding block for performing proxy processing monitors whether the secret information a _i, is a _i x _i is published from the same decoded block on the bulletin board 12 in addition to the list L _i, L The proxy process for L _i may be performed in a state where _{i + 1} is disclosed.
[0023]
Although the public information h _i-1 , h _i , y _i has been disclosed on the bulletin board 12, information corresponding to the memory of each server may be stored. When a broadcast communication channel with caller authentication is used, each decoding server M _i performs processing after receiving the list L _i-1 from the previous decoding server M _i-1. The secret information a _i-1 , a _i-1 x _i-1 from the verification server of the decryption block B _i-1 and the list L _i-2 from the decryption server M _i-2 may also be received. .
[0024]
【The invention's effect】
As described above, according to the present invention, for each decryption server, a verification server that can confirm that the decryption server is functioning normally is provided, and the verification server recognizes that the output of the decryption server is normal. However, if the output of the decryption server is correct and it cannot be confirmed that it has functioned normally, the secret information of the verification server is output, so that at least one decryption block operates normally and all decryption If the server operates normally at least once in a block, a correct plaintext list that retains anonymity can be obtained as an output even if there is an unauthorized process such as failure or data rewriting.
[Brief description of the drawings]
FIG. 1 is a block diagram showing an embodiment of the present invention.
FIG. 2 shows a functional configuration example of a decoding server M _i in FIG.
FIG. 3 is a diagram showing a functional configuration example of a verification server V _{i, j} in FIG. 1;
4 is a diagram showing a specific example of a decoding unit in FIGS. 2 and 3. FIG.
5 is a diagram showing a specific example of a key selection unit in FIGS. 2 and 3. FIG.
6 is a diagram showing a specific example of a shuffle portion in FIG. 2. FIG.
7 is a diagram showing an example of a replacement unit in FIG. 3;
Figure 8 is a flow diagram illustrating an example of a processing procedure of decoding server M _i.
FIG. 9 is a flowchart showing an example of a processing procedure of the verification server V _{i, j} .

Claims (1)

A plurality of decryption servers connected by an information communication network;
Each decryption server holds a different partial decryption key,
As an input, a list L ₀ composed of n encrypted ciphertexts (n is an integer of 2 or more) encrypted in duplicate,
Each input ciphertext in the list is sequentially decrypted with the partial decryption key held by each decryption server, and a randomly replaced plaintext list is output,
An anonymous communication path that hides the correspondence between the output and the input,
Each decoding server is configured with a decoding block provided with at least one verification server,
The verification server in each decryption block holds the same partial decryption key as the decryption server in the same block,
The decryption server and the verification server in each decryption block are connected by a secret channel,
Assuming that the number of decoding blocks is m (m is an integer of 2 or more) , for i = 1 to m,
The decryption server belonging to the i-th decryption block B _i includes means for partially decrypting each ciphertext of the list L _i-1 published by the i-1th decryption block with its partial decryption key, and the n Means for rearranging partial decryption results according to a random permutation function π _i and publishing them as a list L _i ; and means for transmitting the permutation function π _i to each verification server in the block via a secret channel,
The verification server belonging to the i-th decryption block includes means for partially decrypting each ciphertext of the list L _i-1 with its partial decryption key, and the n partial decryption results according to the replacement function π _i. Means for rearranging the list L ″ _i and means for verifying whether or not the list L ″ _i matches the list L _i and, if not, releasing the partial decryption key and stopping the operation; equipped with a,
When partial decryption key is published from the top Symbol i th decoded block B _i, the decoding server of the i-th non-decoded block, L _i-1 to be processed by the decoding block B _i, and publishing decoded block B _i The public information corresponding to the partial decryption key and all the public partial decryption keys are taken in, the correct partial decryption key in these public partial decryption keys is selected using the fetched public information, and the selected partial decryption key is A decoding proxy means for performing decoding processing and replacement processing on the list L _i-1 , disclosing the list L _i ′, and transmitting the replacement function π _i ′ to the verification server in the decoding block, and the i th When the decryption proxy means operates, the verification server in the other decryption block takes in the list L _i ′, the public partial decryption key corresponding to the public partial decryption key of the decryption block B _i , and all the public partial decryption keys. Public There is provided verification proxy means for selecting a correct partial decryption key in these public partial decryption keys using open information and performing verification processing on the list L _i ′ using the selected partial decryption key and the replacement function π _i. anonymous channel, characterized in that is.

Images