JP5079479B2 - ID-based encryption system and method - Google Patents

Description

  The present invention relates to an ID-based encryption system and method using a decryptor's name, address, or an arbitrary bit string as a decryptor's public key.

  A conventional ID-based encryption method will be described (for example, see Non-Patent Document 1).

"Advance preparation"
(1) The sender registers account information corresponding to the ID of the receiver in a private key generator (PKG). Here, the account information is an account and a password that are necessary for the recipient to access the secret key generation device in order to obtain the secret key.
(2) The sender sends the account information to the receiver in a manner that is not known to anyone other than the receiver.

  In this advance preparation, the sender registers the account information in the secret key generation apparatus, but the receiver may register the account information in the secret key generation apparatus. In this case, the sender need not send account information to the recipient.

"encryption"
(1) The sender obtains public information necessary for encryption from the secret key generation device. Here, the public information is an encryption program, an elliptic curve parameter, a generation source P, and a result s · P of an operation obtained by multiplying the generation source P on the elliptic curve by the master secret key s. Here, the operation [·] means scalar multiplication on an elliptic curve.
(2) The sender creates a ciphertext C using plaintext M using ID, random number r and s · P. Specifically, c1 and c2 defined by the following equations are calculated, respectively, and c1 and c2 are combined into a ciphertext C. The function e is a so-called pairing function and satisfies the relationship e (aP, bQ) = e (P, Q) ^ab = e (bP, aQ). “Xor” means exclusive OR.
c1 = r · P
c2 = e (ID, s · P) xor M
(3) The sender sends the ciphertext C to the receiver.

"Decryption"
(1) The recipient accesses the secret key generation device using the account information. After authenticating the recipient, the secret key generation device generates a secret key R necessary for decrypting the ciphertext C, that is, a secret key R corresponding to the ID, and sends the secret key R to the recipient. Specifically, R defined by the following formula is generated as a secret key.
R = s ・ ID

(2) The recipient decrypts the ciphertext C using the secret key to obtain plaintext M. Specifically, plaintext M is generated by calculating the following equation.
M = e (R, c1) xor c2
D. Boneh, M. Franklin, “Identity based encryption from the Weil pairing”, Crypto 2001, Lecture Notes in Computer Science, Vol. 2139, Springer-Verlag, pp.213-229, 2001

As described in << Preparation >> above, in the conventional ID-based encryption method, the sender or receiver who is the user of the ID-based encryption method needs to register the account information in the secret key generation device in advance. There is a problem that the burden on the user is large.
Further, the secret key generation apparatus has a problem that it is necessary to prevent leakage of account information as well as the secret key, and the burden on the secret key generation apparatus is large.

  The object of the present invention is to reduce the burden on the ID-based encryption system and method users and administrators.

According to this invention, the encryption means encrypts the plaintext using at least the decryptor's ID to generate a ciphertext. As a communication path that can be accessed only by a user who officially has the ID, and that it is difficult for other users to impersonate users who have the ID, the secret key requesting means A secret key request signal for requesting a secret key for decrypting the ciphertext is output through a communication path unique to the decryptor's ID. When the secret key request signal is output, the secret key management means can obtain the decryptor's ID obtained from the channel related information related to the channel unique to the decryptor's ID, which is information capable of extracting the decryptor's ID . The secret key corresponding to the ID is output. Decryption means receives the ciphertext and the output secret key, and decrypts the ciphertext using the secret key.

  The account information becomes unnecessary by verifying the identity of the decryption person using the communication path related information related to the communication path unique to the ID. This can reduce the burden on the user and administrator of the ID-based encryption system and method.

[First embodiment]
The first embodiment is an example in which an ID is used as communication path related information to be described later. With reference to FIGS. 1 and 2, the ID-based encryption system 1 of the first embodiment will be described. FIG. 1 is a diagram illustrating a functional configuration of the ID-based cryptographic system 1, and FIG. 2 is a flowchart illustrating a processing flow of the ID-based cryptographic system 1.

<Step S1>
The encryption unit 21 of the encryption device 20 encrypts the plaintext M using the ID and the public information to generate a ciphertext (step S1). The generated ciphertext is sent to the decryption device 40 through an electronic mail or a portable recording medium such as a USB memory.

  In this example, the ID is communication path related information to be described later, for example, the decryption person's mobile phone number.

  The public information is, for example, information such as an encryption program, an elliptic curve parameter, a generation source P, and a result s · P of a master secret s-fold operation on the generation source P's elliptic curve. It depends on the method. The encryption device 20 obtains public information from a trusted authority (TA). In this example, it is obtained from the secret key management device 10.

The encryption method is arbitrary, and an encryption method based on an arbitrary ID-based encryption method can be used. For example, similarly to the method described in the background art section, c1 and c2 defined by the following formulas are calculated, respectively, and c1 and c2 are combined into a ciphertext C. r is a random number generated by the encryption device 20, function e is a so-called pairing function, “xor” is exclusive OR, and M is plaintext.
c1 = r · P
c2 = e (ID, s · P) xor M

<Step S2>
The secret key request unit 31 outputs a secret key request signal for requesting a secret key for decrypting the ciphertext through a communication path unique to the ID (step S2). The secret key request signal is sent to the secret key management device 10.

  The secret key request unit 31 is, for example, a mobile phone in which an application for outputting a secret key request signal and obtaining a secret key from the secret key management apparatus 10 is installed. In this case, a decryptor who intends to decrypt the ciphertext received by the decryption device 40 activates the application on the mobile phone. As a result, a secret key request signal is output from the secret key request means 31 which is a mobile phone.

  A communication path unique to an ID is a communication path that can be accessed only by a user who has an official ID, and it is difficult for another user to impersonate a user who has the official ID.

The secret key request means 31 which is a mobile phone includes an IC card in which a unique number for specifying a telephone number such as a SIM card (Subscriber Identity Module Card) is recorded. The telephone number recorded on the SIM card is difficult for the user to modify, and it is difficult for other users to impersonate. Therefore, the communication path between the secret key requesting means 31 that is a mobile phone and the base station is specified by the telephone number stored in the SIM card included in the mobile phone, and is unique to the telephone number. . In this example, since ID = phone number of the mobile phone, the communication path is unique to the ID.
Of course, as the secret key request means 31, a device other than a mobile phone (for example, PHS, PC, etc.) may be used.

<Step S3>
When the secret key request signal is output, the secret key management unit 11 of the secret key management apparatus 10 obtains the secret key corresponding to the ID obtained from the communication path related information related to the communication path through which the secret key request signal has passed. Output (step S3).

  The communication path related information is information related to the communication path necessary for the secret key management unit 11 to obtain an ID. As described above, in this example, the communication path related information is an ID, that is, a mobile phone number.

  For example, communication path related information (= ID = phone number of mobile phone) is output from the secret key request means 31 together with the secret key request signal. The secret key management unit 11 receives communication path related information that is an ID together with a secret key request signal, generates a secret key corresponding to the ID, and sends it to the secret key request unit 31.

  In the present invention, the secret key request signal is output through a communication path unique to the ID. Therefore, if the secret key management apparatus 10 obtains an ID from the communication path related information related to the communication path through which the secret key request signal has passed, the user who has output the secret key request signal will formally have the ID. It can be judged that.

The generation method of the secret key corresponding to the ID is arbitrary and depends on the ID-based encryption method adopted. For example, the secret key R may be generated by calculating the following equation in the same manner as the ID-based encryption method described in the background art column. s is a master secret key.
R = s ・ ID

<Step S4>
The decryption means 41 of the decryption device 40 receives the ciphertext generated by the encryption means 21 and the secret key output by the secret key management means 11, and decrypts the ciphertext using the secret key. The plain text is output (step S4).

In this example, the secret key output from the secret key management unit 11 is sent to the secret key request unit 31. The secret key request unit 31 sends the received secret key to the decryption device 40 by an arbitrary method. For example, the secret key is sent to the decryption device 40 using a communication technology for a non-contact type IC such as FeliCa (registered trademark) or a wireless technology such as Bluetooth (registered trademark). The secret key may be sent to the decryption device 40 through a portable recording medium such as a USB memory or a flash memory.
The secret key may be sent from the secret key management unit 11 to the decryption device 40 without going through the secret key request unit 31.

The ciphertext decryption method is arbitrary and depends on the ID-based encryption method employed. For example, similarly to the ID-based encryption method described in the background art section, the plaintext M is generated by calculating the following equation.
M = e (R, c1) xor c2

  In this way, the private key management apparatus 10 is accessed in order to obtain the private key corresponding to the ID by confirming the identity of the decryptor using the communication path related information related to the communication path unique to the ID. Account information, which is information including an account and a password required for authentication, is not necessary. This reduces the burden on the user of the ID-based encryption system 1 in that it is not necessary to pre-register account information. In addition, a certain level of security can be maintained regardless of the password strength and the update frequency. Furthermore, the administrator of the ID-based encryption system 1 can reduce the management operation cost in that only the secret key needs to be prevented from being leaked and the account information need not be prevented from being leaked.

[Second Example]
The second embodiment is different from the first embodiment in that information that can extract an ID unique to the communication path is used as communication path related information instead of an ID. Moreover, it differs from a 1st Example by the point which has the database 51 used in order to obtain ID from communication path relevant information. Other points are the same as in the first embodiment.

  The ID-based encryption system 2 of the second embodiment will be described with reference to FIG. The same parts as those in the first embodiment are denoted by the same reference numerals, and redundant description is omitted. The same applies to the other drawings. Steps S1, S2 and S4 are the same as in the first embodiment. Below, step S31 and step S32 different from step S3 of the first embodiment will be described.

  The secret key management device 10 of the second embodiment includes an ID acquisition unit 12 in addition to the secret key management unit 11.

  The ID-based encryption system 2 includes a database 51 that associates communication path related information with IDs. That is, the database 51 stores a plurality of sets including communication path related information and IDs corresponding to the communication path related information.

  The secret key request signal output from the secret key request means 31 is received, and the communication path related information of the communication path through which the secret key request signal passes is received. The communication path related information is input to the ID acquisition unit 12 of the secret key management apparatus 10.

  In this example, the communication path related information is, for example, an identification number assigned to the secret key request unit 31 and a manufacturing number of the secret key request unit 31.

The ID acquisition means 12 that has received the communication path related information refers to the database 51 using the communication path related information as a key, and obtains an ID corresponding to the communication path related information, that is, an ID unique to the communication path ( Step S31). The ID is sent to the secret key management means 11.
The secret key management unit 11 generates a secret key corresponding to the obtained ID as in the first embodiment (step S32).

As described above, information that can extract an ID unique to the communication path may be used as the communication path related information.
In this example, the database 51 is provided outside the secret key management apparatus 10, but may be provided inside the secret key management apparatus 10.

[Third embodiment]
In the third embodiment, the communication path related information is not output from the secret key requesting means 31, but from a communication device (in this example, the SIP client 61) other than the secret key requesting means 31 arranged on the communication path. And the point from which the private key request | requirement means 31 is contained in the decryption apparatus 40 differs from a 1st Example. Other points are the same as in the first embodiment.

  Below, with reference to FIG. 3, FIG. 6, a different part from 1st Example is demonstrated. Similar parts are denoted by the same reference numerals, and redundant description is omitted. FIG. 3 is a diagram illustrating a functional configuration of the ID-based cryptographic system 3, and FIG. 6 is a flowchart illustrating a processing flow of the ID-based cryptographic system 3.

  The encryption means 21 uses the address (telephone number or the like) of the SIP client 61 as the ID, generates a ciphertext as in the first embodiment, and sends it to the decryption means 41.

  The decryption device 40 that has received the ciphertext outputs a secret key request signal from the secret key request means 31 to the SIP client 61 (step S21). The SIP client 61 is, for example, an optical telephone compatible router. It is difficult for the user to modify the address of the SIP client 61, and it is difficult for other users to impersonate. Therefore, it can be considered that the secret key request signal output from the secret key request unit 31 to the SIP client 61 is output through a communication channel unique to the SIP client 61 as the ID.

  The case where the decryption apparatus 40 is a PC and opens a ciphertext received by electronic mail software will be described as an example. When the user of the decryption device 40 clicks the ciphertext on the mail software, a secret key request signal is output to the SIP client 61. In this case, the PC that executes the program that outputs the secret key request signal corresponds to the secret key request means 31. The address of the SIP client 61 is set in advance by the user or automatically set in advance by a framework such as UPnP (Universal Plug & Play).

  The SIP client 61 that has received the secret key request signal communicates with the SIP client 63 of the secret key management apparatus 10 using the SIP (Session Initiation Protocol) protocol to obtain a secret key. See RFC 3261 for details of the SIP protocol. Hereinafter, a specific example of communication using this SIP protocol will be described.

  The SIP client 61 is registered in the SIP server 62 by the REGISTER message transmitted in advance from the SIP client 61 to the SIP server 62 (step S201). Similarly, the SIP client 63 is registered in the SIP server 62 by the REGISTER message transmitted in advance from the SIP client 63 to the SIP server 62 (step S202). Note that the processes of step S201 and step S202 may be performed between the processes of step S21 and step S2, respectively.

  In the SIP client 61, an address (telephone number or the like) of the secret key management device 10 is set. When the SIP client 61 receives the secret key request signal from the decryption means 41, the SIP client 61 sends an INVITE message as a secret key request signal to the SIP server 62 (step S22). This INVITE message can be considered as a secret key request signal in that the “Session Description” column indicates that a secret key is requested.

  The INVITE message includes an ID (in this example, the address of the SIP client 61) that is communication path related information as a parameter. For this reason, in this example, the communication path related information is not output from the secret key requesting means 31 but from the SIP client 61 which is a communication device other than the secret key requesting means 31 arranged on the communication path.

  In the INVITE message received from the SIP client 61, the address of the secret key management device 10 is designated as the transmission destination address, and the SIP server 62 sends the INVITE message to the designated address (step S23).

  Upon receiving the INVITE message, the SIP client 63 sends the communication path related information included in the INVITE message to the secret key management apparatus 10 (step S24).

  As in the first embodiment, the secret key management device 10 generates a secret key corresponding to the ID obtained from the communication path related information (step S33) and sends it to the SIP client 63 (step S34).

  When the SIP client 63 receives the INVITE message, the SIP client 63 sends an OK message as a response message to the SIP server 62 (step S25). The SIP server 62 that has received the OK message sends the OK message to the SIP client 61 (step S26). The SIP client 61 that has received the OK message sends an ACK message to the SIP server 62 (step S27). The SIP server 62 that has received the ACK message sends the ACK message to the SIP client 63 (step S28).

  The SIP client 63 that has received the ACK message sends the received secret key to the SIP client 61 without going through the SIP server 62 (step S35).

  The SIP client 61 sends the received secret key to the decryption device 40 (step S36).

  Similarly to the first embodiment, the decrypting means 41 decrypts the ciphertext using the received secret key to generate plaintext (step S4).

  Thus, the communication path related information may be output not from the secret key requesting means 31 but from a communication device other than the secret key requesting means 31 arranged on the communication path.

  In this example, the communication path related information output from the SIP client 61 is an ID as in the first embodiment. However, as in the second embodiment, information that can be used to extract an ID unique to the communication path. It may be. In this case, as in the second embodiment, as illustrated in FIG. 4, the secret key management apparatus 10 includes an ID acquisition unit 12, and the ID acquisition unit 12 stores the communication path related information. The ID is acquired with reference to the database 51 as a key. Using the acquired ID, the secret key management unit 11 generates a secret key corresponding to the ID.

[Modification]
As the ID, an ID obtained by adding information other than the decryptor ID to the decryptor ID may be used. The ID of the decryption person, for example, decoding's telephone number, a mobile phone numbered etc., and the information other than the ID of the decryption person, for example, date, time, location information (latitude, longitude, building name, Floor name, address, etc.) and position identifier (department manager, section manager, root, etc.).

  For example, it is assumed that an ID obtained by adding a date as information other than the decryption person ID to the decryption person ID is used as the ID. In this case, the secret key management apparatus 10 obtains the decryptor ID from the communication path related information, as in the above example. Also, the secret key management apparatus 10 obtains a secret key corresponding to an ID obtained by adding the current date to the decryptor ID, obtained from an external device such as a clock or an ntp server having the current date therein. . In this case, the ciphertext can be decrypted only on the date added to the decryptor ID by the encryption device 20. As described above, by using an ID obtained by adding information other than the decryption person ID to the decryption person ID, the ciphertext can be decrypted only when a predetermined condition is satisfied.

  In the above example, the secret key management unit 11 generates a secret key every time it receives a secret key request signal. However, a secret key is generated in advance in a storage unit (not shown), and the secret key request signal is Each time it is received, the corresponding secret key may be read from the storage means and output.

  In the ID-based encryption systems 1, 2, 3, and 4 illustrated in FIGS. 1 to 4, there are locations where data is directly sent between devices and between means, but a server or storage unit not shown is used. The data may be sent indirectly through the network.

  When the above-described configuration is realized by a computer, the processing contents of the functions that should be included in each part of the secret key management device 10, the encryption device 20, and the decryption device 40 and the secret key requesting unit 31 are described by programs. By executing this program on a computer, the functions of the above-described units are realized on the computer.

  That is, the functions of the secret key management unit 11, the ID acquisition unit 12, the encryption unit 21, the secret key request unit 31, the decryption unit 41, and the like are realized by the CPU sequentially reading and executing each program. The storage unit such as the database 51 and a storage unit (not shown) is realized by a storage unit such as a memory or a hard disk.

The program describing the processing contents can be recorded on a computer-readable recording medium. The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory. Specifically, for example, the magnetic recording device may be a hard disk device or a flexible Discs, magnetic tapes, etc. as optical discs, DVD (Digital Versatile Disc), DVD-RAM (Random Access Memory), CD-ROM (Compact Disc Read Only Memory), CD
-R (Recordable) / RW (ReWritable), etc., MO (Magneto-Optical disc), etc. as a magneto-optical recording medium, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory), etc. as a semiconductor memory it can.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  As an execution form different from the above-described embodiment, the computer may read the program directly from the portable recording medium and execute processing according to the program. Each time is transferred, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to a computer but has a property that is based on computer processing).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. For example, in FIG. 6, the processing from step S25 to step S28 and the processing of step S24, step S33, and step S34 may be performed in parallel.
Needless to say, other modifications are possible without departing from the spirit of the present invention.

The figure which illustrates the function structure of the ID base encryption base encryption system of a 1st Example. The figure which illustrates the function structure of the ID base encryption base encryption system of a 2nd Example. The figure which illustrates the function structure of the ID base encryption base encryption system of a 3rd Example. The figure which illustrates the function structure of the modification of the ID base encryption base encryption system of 3rd Example. The flowchart which illustrates the flow of a process of the ID base encryption base encryption system of a 1st Example and a 2nd Example. The flowchart which illustrates the flow of processing of the ID base encryption base encryption system of a 3rd Example.

Explanation of symbols

1, 2, 3, 4 ID-based encryption system 10 Secret key management device 11 Secret key management unit 12 ID acquisition unit 20 Encryption device 21 Encryption unit 31 Secret key request unit 40 Decryption device 41 Decryption unit 51 Database

Claims (4)

Encryption means for encrypting plaintext using at least the decryptor's ID to generate ciphertext;
The ciphertext is decrypted as a communication path that is unique to an ID and that is accessible only to users who formally have the ID and is difficult for other users to impersonate users who formally have the ID. A secret key requesting means for outputting a secret key request signal for requesting a secret key for use through a communication path unique to the decryptor ID;
When the secret key request signal is output, the decryptor ID is obtained from communication path related information related to the communication path unique to the decryptor ID, which is information that can be used to extract the decryptor ID. A secret key management means for outputting a corresponding secret key;
Decryption means for receiving the ciphertext and the output secret key, and decrypting the ciphertext using the secret key;
Database storage means for associating communication path related information and ID,
The secret key management means further includes ID acquisition means for obtaining the ID of the decryptor by referring to the database using the received communication path related information as a key,
The secret key request means and the decryption means are held by the decryptor;
An ID-based cryptosystem characterized by that. The ID-based encryption system according to claim 1,
The communication path related information is output from the secret key request means together with the secret key request signal.
An ID-based cryptosystem characterized by that. In the ID-based encryption system according to claim 1 or 2,
The decryptor ID further includes information other than the decryptor ID in addition to the decryptor ID.
An ID-based cryptosystem characterized by that. An encryption step in which the encryption means encrypts the plaintext using at least the decryptor's ID to generate a ciphertext;
As a communication path that can be accessed only by a user who officially has the ID, and that it is difficult for other users to impersonate users who have the ID, the secret key requesting means A secret key requesting step for outputting a secret key request signal for requesting a secret key for decrypting the ciphertext through a communication path unique to the decryptor ID;
When the secret key request signal is output, the secret key management means obtains the communication path related information related to the communication path unique to the decryptor ID, which is information that can be used to extract the decryptor ID. A secret key management step for outputting a secret key corresponding to the ID of the decryptor;
A decrypting means for receiving the ciphertext and the output secret key, and decrypting the ciphertext using the secret key ,
The secret key management step further includes an ID acquisition step of obtaining the decryptor's ID by referring to the database storage means that associates the communication path related information with the ID using the received communication path related information as a key. Including
The secret key request means and the decryption means are held by the decryptor;
ID-based encryption method.

Images