JP5097145B2 - Encryption system and encryption method - Google Patents

Description

  The present invention relates to an encryption system and an encryption method for encrypting plain text, transmitting and receiving, and decrypting.

  A technique shown in Non-Patent Document 1 is known as a basic configuration of ID-based encryption. In these ID-based ciphers, the key generation server is a reliable and absolute existence, does not perform illegal acts, and is one server that does not fail and go down. Further, as the time release cipher, techniques shown in Non-Patent Documents 2 and 3 are known. In these time release ciphers, the secret information based on the designated decryption time to be delivered is stored in one time release server or in a form of secret sharing by a plurality of time release servers. Furthermore, as an application method of ID-based encryption, there is a configuration in which a specified decoding time is adapted to the ID portion.

D. Boneh and X. Boyen, “Secure Identity Based Encryption Without Random Oracles”, Proceedings of Crypto’04, LNCS 3152, 2004. J. Cathalo, B. Libert, and J.-J. Quisquater, “Efficient ans non-interactive timed-release encryption”, in Int. Conf. On Information and Communications Security, LNCS 3783, pp.291-303, Springer- Verlag, 2005. K. Chalkias and G. Stephanides, “Timed Release Cryptography from Bilinear Parings Using Hash Chains”, Communications and Multimedia Security, LNCS 4237, pp. 130-140, Springer-Verlag, 2006.

As described above, in the prior art, there is one key generation server, and it is assumed that the server does not cheat and does not fail and go down. However, in an actual system, the server may fail. In such a case, there is a problem that the entire system goes down.
Accordingly, an object of the present invention is to provide an encryption system in which the entire system does not go down even if one server fails.

  In the encryption system of the present invention, a plurality of servers that can exist independently are prepared, and if even one of them is functioning normally, the entire system can operate normally.

The first encryption system of the present invention is an encryption system including N servers, an encryption device, and a decryption device. N is an integer of 2 or more, and n is an integer of 1 to N. Each server (nth server) includes a server secret key generation unit that generates an nth server secret key s _sn , a server public key generation unit that generates and publishes an nth server public key p _sn , and an nth secret and a secret information generating unit to be transmitted to the decoding device generates the information s _an,. The encryption device includes an encryption unit and a ciphertext transmission unit. Encryption unit, every individual session information corresponding to the server _{c 1,1, ..., c 1,} N and the individual ciphertext _c 2,1, _..., obtained by using the decryption device authentication information _{c 2, N,} individual session information _{c 1,1, ..., c 1,} N and the individual ciphertext _c 2,1, _..., determine the cipher text C and a _{c 2, N.} The ciphertext transmission unit transmits the ciphertext C to the decryption device. Decoding device, a decoding device authentication information permission to publish the decryption device authentication information, the ciphertext receiving unit that receives the ciphertext C, a secret information receiving unit that receives the n-th secret information s _an, from the selected server, and a decoding unit for decoding an individual ciphertext c _{2, n} to the plaintext m using individual session information c _{1, n} and the n secret information s _an,.

The second encryption system of the present invention is an encryption system including N servers, an encryption device, and a decryption device. N is an integer of 2 or more, n is an integer of 1 to N, and j is an integer of 1 to N other than n. Each server (nth server) includes a server private key generation unit that generates an nth server private key s _sn , a server public key generation unit that generates and publishes an nth server public key p _sn , and other servers When a server private key sharing unit from the first server secret key s _s1 share the n server secret key s _sN, the secret information generating unit which transmits a first n secret information s _an, in the decoding device, the j secret to the decoder A backup secret information generation unit for transmitting the information s _aj . The encryption device includes an encryption unit and a ciphertext transmission unit. The encryption device selects one server from among the N servers (here, it is assumed that the nth server is selected). The encryption unit obtains the individual session information c _{1, n} and the individual cipher text c _{2, n} corresponding to the selected server by using the decryption device authentication information, and the individual session information c _{1, n} and the individual cipher text c _{2, A} ciphertext C including _n is obtained. The ciphertext transmission unit transmits the ciphertext C to the decryption device. Decoding device, a decoding device authentication information permission to publish the decryption device authentication information, the ciphertext receiving unit that receives the ciphertext C, the secret information reception for receiving the n-th secret information s _an, from the server to the encryption apparatus selects parts and, and backup secret information receiver encryption device receives a first n secret information s _an, from a server other than the selected server, individual session information c _{1, n} and the individual ciphertext c using the first n secret information s _{an, 2 and n} to a plaintext m. Note that the backup secret information generation unit of the server and the backup secret information reception unit of the decryption device are used when the nth server selected by the encryption device fails.

The third encryption system of the present invention is an encryption system including an upper server, N lower servers, an encryption device, and a decryption device. In the case of this encryption system, N is an integer of 1 or more, and n is an integer of 1 to N. The upper server transmits a server secret key generation unit that generates the nth server secret key s _sn for all n from 1 to N, and server secret key transmission that transmits the nth server secret key s _sn to the nth lower server, respectively. And a backup secret information generation unit that generates n-th secret information _san and transmits it to the decryption device. Each subordinate server (nth subordinate server) includes a server secret key receiving unit that receives the nth server secret key s _sn , a server public key generation unit that generates and publishes the nth server public key p _sn , a secret information generation unit that generates n secret information _san and transmits it to the decryption device. The encryption device includes an encryption unit and a ciphertext transmission unit. The encryption unit obtains the individual session information c _{1, n} and the individual cipher text c _{2, n} corresponding to the selected lower server using the decryption device authentication information, and the individual session information c _{1, n} and the individual cipher text c _{2. , N} is obtained. The ciphertext transmission unit transmits the ciphertext C to the decryption device. Secret information decoding apparatus for receiving and decoding apparatus authentication information permission to publish the decryption device authentication information, the ciphertext receiving unit that receives a ciphertext C, and n-th secret information s _an, from child servers encryptor selects a receiving unit, and backup the secret information receiver for receiving the n-th secret information s _an, from the host server, individual session information c _{1, n} and the plaintext m individual ciphertext c _{2, n} using the n-th secret information s _an, And a decoding unit for decoding. Note that the backup secret information generation unit of the upper server and the backup secret information reception unit of the decryption device are used when the nth lower server selected by the encryption device fails. Note that, here, an example of two layers, ie, an upper server and a lower server, is shown, but the server layer may be three or more layers.

  The server may be a time release server. Furthermore, you may combine a 1st encryption system, a 2nd encryption system, and a 3rd encryption system.

  Each of the encryption systems of the present invention includes a plurality of servers, an encryption device, and a decryption device. If the server has not failed, the decryption device receives secret information from the server selected by the encryption device or the decryption device and uses it for decryption.

  In the case of the first encryption system, when the selected server fails, the decryption device receives the secret information of the server from any other server. In the first encryption system, since the ciphertext includes the individual session information and the individual ciphertext for all the servers, the decryption device can decrypt if any server has the secret information.

  In the case of the second encryption system, when the selected server fails, the decryption device receives confidential information that should have been received from the failed server from any of the other servers. To do. In the second encryption system, the ciphertext contains only the individual session information and the individual ciphertext for the server selected by the encryption device, but since each server shares the server private key of all servers, Any server can generate and send confidential information that the failed server was supposed to send.

  In the case of the third encryption system, when the selected lower server fails, the decryption device receives the secret information that should have been received from the lower server that has failed from the upper server. In the third encryption system, the ciphertext includes only the individual session information for the server selected by the encryption device and the individual ciphertext. However, since the upper server records whether or not the server secret keys of all the lower servers can be generated instead of the lower server, or can be calculated, it is recorded by the lower server that has failed. Secret information that should have been generated can be generated and transmitted.

  As described above, the encryption system of the present invention prepares a plurality of servers that can exist independently, and if one of them is functioning normally, the entire system can be prevented from going down.

1 is a diagram illustrating a configuration example of an encryption system according to a first embodiment. The figure which shows the structural example of the server (time release server) of Example 1 and Example 2. FIG. 1 is a diagram illustrating a configuration example of a cryptographic device according to a first embodiment and a second embodiment. FIG. The figure which shows the structural example of the decoding apparatus of Example 1 and Example 2. FIG. FIG. 3 is a diagram illustrating a processing flow of the encryption system according to the first embodiment. FIG. 4 is a diagram illustrating a configuration example of an encryption system according to a second embodiment. The figure which shows the processing flow of the encryption system of Example 2. FIG. FIG. 10 is a diagram illustrating a configuration example of an encryption system according to a third embodiment. The figure which shows the structural example of the server (time release server) of Example 3 and Example 4. FIG. FIG. 6 is a diagram illustrating a configuration example of a cryptographic device according to a third embodiment and a fourth embodiment. The figure which shows the structural example of the decoding apparatus of Example 3 and Example 4. FIG. FIG. 10 is a diagram illustrating a processing flow of the encryption system according to the third embodiment. FIG. 10 is a diagram illustrating a configuration example of an encryption system according to a fourth embodiment. The figure which shows the processing flow of the encryption system of Example 4. FIG. FIG. 10 is a diagram illustrating a configuration example of an encryption system according to a fifth embodiment. The figure which shows the structural example of the high-order server (high-order time release server) of Example 5 and Example 6. FIG. The figure which shows the structural example of the low-order server (low-order time release server) of Example 5 and Example 6. FIG. The figure which shows the structural example of the encryption apparatus of Example 5 and Example 6. FIG. The figure which shows the structural example of the decoding apparatus of Example 5 and Example 6. FIG. FIG. 10 is a diagram illustrating a processing flow of the encryption system according to the fifth embodiment. FIG. 10 is a diagram illustrating a configuration example of an encryption system according to a sixth embodiment. The figure which shows the processing flow of the encryption system of Example 6. FIG. The figure which shows the function structural example of a computer.

  Hereinafter, embodiments of the present invention will be described in detail. Implementation of a method (corresponding to the first encryption system described in the means for solving the problem) that includes individual session information and individual ciphertext corresponding to all servers in the ciphertext in the first embodiment and the second embodiment Example 3 and Example 4 share a server secret key between servers (corresponding to the second encryption system), and Example 5 and Example 6 have a hierarchical server structure (third It corresponds to the encryption system). Examples 1, 3, and 5 are examples of ID-based encryption, and Examples 2, 4, and 6 are examples of time release encryption. In addition, the same number is attached | subjected to the structure part and process which have the same function, and duplication description is abbreviate | omitted.

  FIG. 1 shows a configuration example of the encryption system according to the first embodiment. The encryption system 100 includes N servers 200-n, an encryption device 300, and a decryption device 400 (where N is an integer of 2 or more and n is an integer of 1 to N). FIG. 2 shows a configuration example of the server according to the first embodiment, FIG. 3 shows a configuration example of the encryption device, and FIG. 4 shows a configuration example of the decryption device. FIG. 5 is a diagram illustrating a processing flow of the encryption system according to the first embodiment. Each server 200-n (n-th server) includes a server secret key generation unit 210-n, a server public key generation unit 220-n, a secret information generation unit 230-n, and a server recording unit 290-n. The encryption device 300 includes an encryption unit 310, a ciphertext transmission unit 320, and an encryption recording unit 390. The decryption device 400 includes a decryption device authentication information disclosure unit 410, a ciphertext reception unit 420, a secret information reception unit 430, a decryption unit 440, and a decryption recording unit 490. The server recording unit 290-n, the encryption recording unit 390, and the decryption recording unit 490 are components for recording information necessary for the operation of each device.

The server secret key generation unit 210-n of each server 200-n generates an nth server secret key s _sn (S210-n). That is, the servers 200-1 to 200-N generate the first server secret key s _s1 ,..., The Nth server secret key s _sN (S210-1 to N). The server public key generation unit 220-n of each server 200-n generates and publishes the nth server public key p _sn (S220-n). That is, the server 200-1~N is the first server's public key _{p s1,} ..., to generate a first N server public key _{p sN,} publishing (S220-1~N).

The decryption device authentication information disclosure unit 410 of the decryption device 400 discloses the decryption device authentication information p _b (or p _b1 ,..., P _bN ) (S412). The decryption device authentication information may be p _b that is the same for all servers, or may be p _b1 ,..., P _bN that is different for each server. Further, the decryption device authentication information disclosure unit 410 may record the decryption device authentication information p _b (or p _b1 ,..., P _bN ) in the decryption recording unit 490 in advance. Alternatively, the decryption device authentication information disclosure unit 410 may generate the decryption device authentication information p _b1 ,..., P _bN using the server public key p _sn or the like (S411).

The encryption unit 310 of the encryption device 300 uses the nth server public key p _sn and the decryption device authentication information p _b (or p _bn ) for all n (all servers) 1 to N as individual sessions. Information c _{1, n} and individual ciphertext c _{2, n} are obtained. And the encryption part 310 calculates _| requires the ciphertext C containing individual session information _c1,1 , ..., c1 _{, N} and individual ciphertext _c2,1 , ..., c2 _{, N} (S310). For example, C = (c _1,1 , c _2,1 ,..., C _{1, N} , c _{2, N} ) may be used. The ciphertext transmission unit 320 transmits the ciphertext C to the decryption device 400 (S320). The ciphertext receiving unit 420 of the decryption device 400 receives the ciphertext C (S420).

The secret information generating unit 230-n of the selected server 200-n to the decoding apparatus 400 generates a first n secret information _{s an,,} and transmits to the decoder 400 (S230-n). The n-th secret information s _an may be generated using the n-th server secret key s _sn and the decryption device authentication information p _b (or p _bn ). Secret information receiving unit 430 receives the n-th secret information _{s an,} from server 200-n of the selected (S430). The operation of the secret information generating unit 230-n, for example, decoding device 400 selects a server, if such decoding apparatus 400 starts by requesting a first n secret information _{s an,} to the server 200-n Good. Decoding unit 440 decodes the plaintext m individual ciphertext _{c 2, n} using separate session information _{c 1} corresponding to the server 200-n _{selected, n} and the n secret _{s an} (S440).

In the unlikely event that the server 200-n selected by the decryption device 400 is out of order, the decryption device 400 reassigns another server 200-j (where j is an integer from 1 to N other than n) again. Select the j-th secret information _saj from the server 200-j. Then, the secret information generation unit 230-j of the server 200-j generates j-th secret information _saj and transmits it to the decryption device 400 (S230-j: backup secret information generation step). The secret information receiving unit 430 receives the j-th secret information _saj (S430 ′: backup secret information receiving step). The decryption unit 440 decrypts the individual ciphertext c2 _{, j} into the plaintext m using the individual session information c1 _{, j} and the jth secret information _saj corresponding to the selected server 200-j (S440: backup decryption step) ).

As described above, in the encryption system 100 according to the first embodiment, when the selected server 200-n fails, the decryption device 400 receives the n-th secret of the server from any of the other servers 200-j. Information s _aj is received. Individual session information _c 1, 1 for all server encryption system 100, ciphertext _C, ..., _{c 1, N} and the individual ciphertext _c 2,1, _..., because it contains and _{c 2, N} The decryption apparatus 400 can decrypt the n-th secret information _san of any server 200-n. Therefore, if even one of the servers functions normally, the entire system can be prevented from going down. If the encryption device or the decryption device breaks down, individual encrypted communication cannot be performed. However, since there is no influence on the encryption communication between the other encryption devices and the decryption device, the entire system does not go down.

  FIG. 6 shows a configuration example of the encryption system according to the second embodiment. The encryption system 1100 includes N time release servers 1200-n, an encryption device 1300, and a decryption device 1400 (where N is an integer greater than or equal to 2 and n is an integer between 1 and N). FIG. 2 shows a configuration example of the time release server of the second embodiment, FIG. 3 shows a configuration example of the encryption device, and FIG. 4 shows a configuration example of the decryption device. FIG. 7 is a diagram illustrating a processing flow of the encryption system according to the second embodiment. Each time release server 1200-n (nth time release server) includes a server secret key generation unit 1210-n, a server public key generation unit 1220-n, a secret information generation unit 1230-n, and a server recording unit 1290-n. Prepare. The encryption device 1300 includes a decryption time setting unit 1350, an encryption key generation unit 1360, an encryption unit 1310, a ciphertext transmission unit 320, and an encryption recording unit 1390. The decryption device 1400 includes a decryption secret key generation unit 1460, a decryption device authentication information disclosure unit 1410, a ciphertext reception unit 420, a secret information reception unit 430, a decryption unit 1440, and a decryption recording unit 1490. The server recording unit 1290-n, the encryption recording unit 1390, and the decryption recording unit 1490 are components for recording information necessary for the operation of each device.

Here, p is a prime order, G ^ and G _T ^ are cyclic groups having a prime order p, e () is a bilinear map e: G ^ × G ^ → G _T ^, H ₁ () Is a hash function that converts information {0, 1} ^* of arbitrary length into elements of the group G ^, and H ₂ () converts information {0, 1} ^* of arbitrary length into h bits and information {0, 1} ^h . A hash function to be converted, m is a plain text, and (+) is an exclusive OR.

The server secret key generation unit 1210-n of each time release server 1200-n randomly selects an integer s _sn less than p and sets the integer s _sn as the nth server secret key s _sn (S1210-n). That is, the time release servers 1200-1 to 1200-N generate the first server secret key s _s1 ,..., The Nth server secret key s _sN (S1210-1 to N). The server public key generation unit 1220-n of each time release server 1200-n randomly selects an element G _sn of the group G ^, and publicizes it by using G _sn and s _sn G _sn as the nth server public key p _sn. (S1220-n). In other words, time release server 1200-1~N is, the first server public key _{p s1,} ..., to generate the N-th server public key _{p sN,} to publish (S1220-1~N).

The decryption secret key generation unit 1460 of the decryption device 1400 randomly selects an integer s _b less than p, and sets the integer s _b as the decryption secret key s _b (S1460). Note that step S1460 may be performed before processing of the time release server such as steps S1220-1 to S1220-1. The decryption device authentication information disclosure unit 1410 _obtains the decryption device authentication information p _b1 ,..., P _bN corresponding to the time release server for all n of 1 to N, p _bn = s _b G _sn
Is obtained (S1411) and released (S412).

The decryption time setting unit 1350 of the encryption device 1300 selects the decryption time t and sets the decryption time t for the N time release servers 1200-1 to 1200-N (S1350). Encryption key generating unit 1360, an integer _{r a} less than p randomly _selected, and _H 1 (t) and _{T a,} r a _{T a} a a _{Q a,} the encryption key K for Time Release server 1200-1~N ₁ ,..., K _N for all n from 1 to N, K _an = e (s _sn G _sn , Q _a )
(S1360). The encryption unit 1310 receives the individual session information c _1,1 ,..., C _{1, N} and the individual ciphertexts c _2,1 ,..., C _{2, N} corresponding to all the time release servers 1200-1 to 1200- _N , C _{1, n} = r _{a b bn} for all n from 1 to N
c _{2, n} = m (+) H ₂ (K _an )
The ciphertext C including the individual session information c _1,1 ,..., C _{1, N} , the individual ciphertexts c _2,1 ,..., C _{2, N} and the decryption time t is obtained (S1310). For example, C = (c _1,1 , c _2,1 ,..., C _{1, N} , c _{2, N} , t) may be used. The ciphertext transmission unit 320 transmits the ciphertext C to the decryption device 1400 (S320). The ciphertext receiving unit 420 of the decryption device 1400 receives the ciphertext C (S420).

The secret information generating unit 1230-n of Time Release servers 1200-n which is selected to the decoding device 1400, a first n secret information _{s an,} from decoding time t the encryption device 1300 is set,
s _an = s _sn H ₁ (t)
The n-th secret information _san is transmitted to the decryption device 1400 after the decryption time t (S123-n). In order to obtain the n-th secret information s _an by the above formula, H ₁ (t) is once set as T _a, and then s _an = s _sn T _a
It is sufficient to calculate as follows. The operation of the secret information generation unit 1230-n, for example, the decoding device 1400 selects a time release server, decoding device 1400 is started by requesting the first n secret information _{s an,} in time release server 1200-n What should I do? Secret information receiving unit 430 of the decoding device 1400, from the time release server 1200-n selected, since the decoding time t, to receive the n-th secret information _{s an} (S430). The decryption unit 1440 uses the decryption key K _bn corresponding to the selected time release server 1200-n as K _bn = e (s _b ⁻¹ c _{1, n} , s _an ).
And the plaintext m is determined as m = H ₂ (K _bn ) (+) c _{2, n}
(S1440).

In the event that the time release server 1200-n selected by the decryption device 1400 is out of order, the decryption device 1400 has another time release server 1200-j (where j is 1 to N other than n). (Integer) is selected again, and the jth secret information _saj is requested to the time release server 1200-j. Then, the secret information generation unit 1230-j of the time release server 1200-j _obtains the jth secret information _saj from the decryption time t set by the encryption device 1300.
s _aj = s _sj H ₁ (t)
The j-th secret information s _aj is transmitted to the decryption device 1400 after the decryption time t (S1230-j: backup secret information generation step). In order to obtain the j-th secret information s _aj by the above formula, H ₁ (t) is once set as T _a, and then s _aj = s _sj T _a
It is sufficient to calculate as follows. The secret information receiving unit 430 of the decryption device 1400 receives the j-th secret information _saj after the decryption time t from the selected time release server 1200-j (S430 ′: backup secret information reception step). The decryption unit 1440 obtains the decryption key K _bj corresponding to the time release server 1200-j with K _bj = e (s _b ⁻¹ c _{1, j} , s _aj ).
The plaintext m is calculated as _follows: m = H ₂ (K _bj ) (+) c _{2, j}
(S1440: backup decryption step).

As described above, in the encryption system 1100 according to the second embodiment as well, when the selected time release server 1200-n fails, the decryption device 1400 receives the time from any other time release server 1200-j. The release server secret information s _aj is received. Individual session information _c 1, 1 for all time release server encryption in the encryption system 1100 statement _C, ..., _{c 1, N} and the individual ciphertext _c 2,1, _..., contains a _{c 2, N} because there, the decoding apparatus 1400 can be decoded if there is a secret information _{s an} of any of the time release server 1200-n. Therefore, if even one of the servers functions normally, the entire system can be prevented from going down.

  FIG. 8 shows a configuration example of the encryption system according to the third embodiment. The encryption system 2100 includes N servers 2200-n, an encryption device 2300, and a decryption device 2400 (where N is an integer of 2 or more and n is an integer of 1 to N). FIG. 9 shows a configuration example of the server according to the third embodiment, FIG. 10 shows a configuration example of the encryption device, and FIG. 11 shows a configuration example of the decryption device. FIG. 12 is a diagram illustrating a processing flow of the encryption system according to the third embodiment. Each server 2200-n (n-th server) includes a server secret key generation unit 210-n, a server public key generation unit 220-n, a secret information generation unit 230-n, a server secret key sharing unit 2240-n, and a backup secret. An information generation unit 2250-n and a server recording unit 2290-n are provided. The encryption device 2300 includes an encryption unit 2310, a ciphertext transmission unit 320, and an encryption recording unit 2390. The decryption device 2400 includes a decryption device authentication information disclosure unit 410, a ciphertext reception unit 420, a secret information reception unit 430, a decryption unit 2440, a backup secret information reception unit 2450, and a decryption recording unit 2490. The server recording unit 2290-n, the encryption recording unit 2390, and the decryption recording unit 2490 are components for recording information necessary for the operation of each device.

The server secret key generation unit 210-n of each server 2200-n generates an nth server secret key s _sn (S210-n). That is, the servers 2200-1 to N generate the first server secret key s _s1 ,..., The Nth server secret key s _sN (S210-1 to N). The server secret key sharing units 2240-1 to 2240 -N share the N-th server secret key s _sN from the first server secret key s _s1 with other servers (S _2240-1 to N). The server public key generation unit 220-n of each server 2200-n generates and publishes the nth server public key p _sn (S220-n). That is, the server 200-1~N is the first server's public key _{p s1,} ..., to generate a first N server public key _{p sN,} publishing (S220-1~N). The order of steps S2240-1 to N and steps S220-1 to N may be reversed.

The decryption device authentication information disclosing unit 410 of the decryption device 2400 discloses the decryption device authentication information p _b (or p _b1 ,..., P _bN ) (S412). The decryption device authentication information may be p _b that is the same for all servers, or may be p _b1 ,..., P _bN that is different for each server. In addition, the decryption device authentication information disclosure unit 410 may record the decryption device authentication information p _b (or p _b1 ,..., P _bN ) in the decryption recording unit 2490 in advance. Alternatively, the decryption device authentication information disclosure unit 410 may generate the decryption device authentication information p _b1 ,..., P _bN using the server public key p _sn or the like (S411).

The encryption device 2300 selects one server from the N servers (in this case, the nth server is selected), and the encryption unit 2310 receives the nth server public key p _sn and the decryption device authentication information. Using p _b (or p _bn ), the individual session information c _{1, n} and the individual ciphertext c _{2, n} corresponding to the selected server 2200-n are obtained. Then, the encryption unit 2310 obtains the ciphertext C including the individual session information c _{1, n} and the individual cipher text c _{2, n} (S2310). For example, C = (c _{1, n} , c _{2, n} ) may be set. The ciphertext transmission unit 320 transmits the ciphertext C to the decryption device 2400 (S320). The ciphertext receiving unit 420 of the decryption device 2400 receives the ciphertext C (S420).

The secret information generating unit 230-n of the server 2200-n which are selected in the encryption device 2300 generates the n-th secret information _{s an,,} and transmits to the decoding device 2400 (S230-n). The n-th secret information s _an may be generated using the n-th server secret key s _sn and the decryption device authentication information p _b (or p _bn ). Secret information receiving unit 430 receives the n-th secret information _{s an,} from the server 2200-n which are selected (S430). The operation of the secret information generating unit 230-n, for example, the decoding device 2400 to identify the server 2200-n from the ciphertext C received, the decoding apparatus 2400 is a first n secret information _{s an,} the server 2200-n It can be started by making a request. Decoding unit 2440 decodes the plaintext m individual ciphertext _{c 2, n} using selected individual session information _{c 1} corresponding to the server 2200-n _{has, n} and the n secret _{s an} (S2440).

If the server 2200-n selected by the encryption device 2300 has failed, the decryption device 2400 selects another server 2200-j (where j is an integer from 1 to N other than n). and requests a second n secret information _{s an,} the server 2200-j. Then, the backup secret information generation unit 2250-j of the server 2200-j transmits to the decoder 2400 generates the n-th secret information _{s an,} from the n server secret key _{s sn} that share (S2250-j) . Backup secret information receiving unit 2450 receives the n-th secret information _{s an} (S2450). The decryption unit 2440 uses the individual session information c _{1, n} corresponding to the server 2200-n (failed server) selected by the encryption device 2300 and the n-th secret information s _an to obtain the individual ciphertext c _{2, n} . Decrypt into plaintext m (S2440: backup decryption step).

As described above, in the encryption system 2100 according to the third embodiment, when the selected server 2200-n fails, the decryption device 2400 causes the server that has failed from any of the other servers 2200-j. The nth secret information _san that should have been received from 2200-n is received. Although the encryption system 2100 in ciphertext C only contains individual session information c _{1, n} and the individual ciphertext c _{2, n} for the server that the encryption device 2300 is selected, the server secret each server all servers Since the key is shared, any server can generate and send secret information that should have been sent by the failed server. Therefore, if even one of the servers functions normally, the entire system can be prevented from going down.

  FIG. 13 shows a configuration example of the encryption system according to the fourth embodiment. The encryption system 3100 includes N time release servers 3200-n, an encryption device 3300, and a decryption device 3400 (where N is an integer greater than or equal to 2 and n is an integer between 1 and N). FIG. 9 shows a configuration example of the time release server according to the fourth embodiment, FIG. 10 shows a configuration example of the encryption device, and FIG. 11 shows a configuration example of the decryption device. FIG. 14 is a diagram illustrating a processing flow of the encryption system according to the fourth embodiment. Each time release server 3200-n (nth time release server) includes a server secret key generation unit 1210-n, a server public key generation unit 1220-n, a secret information generation unit 1230-n, and a server secret key sharing unit 2240-. n, a backup secret information generation unit 2250-n, and a server recording unit 3290-n. The encryption device 3300 includes a decryption time setting unit 1350, an encryption key generation unit 3360, an encryption unit 3310, a ciphertext transmission unit 320, and an encryption recording unit 3390. The decryption device 3400 includes a decryption secret key generation unit 1460, a decryption device authentication information disclosure unit 1410, a ciphertext reception unit 420, a secret information reception unit 430, a decryption unit 3440, a backup secret information reception unit 2450, and a decryption recording unit 3490. The server recording unit 3290-n, the encryption recording unit 3390, and the decryption recording unit 3490 are components for recording information necessary for the operation of each device.

Here, p is a prime order, G ^ and G _T ^ are cyclic groups having a prime order p, e () is a bilinear map e: G ^ × G ^ → G _T ^, H ₁ () Is a hash function that converts information {0, 1} ^* of arbitrary length into elements of the group G ^, and H ₂ () converts information {0, 1} ^* of arbitrary length into h bits and information {0, 1} ^h . A hash function to be converted, m is a plain text, and (+) is an exclusive OR.

The server secret key generation unit 1210-n of each time release server 3200-n randomly selects an integer s _sn less than p and sets the integer s _sn as the nth server secret key s _sn (S1210-n). That is, the time release servers 3200-1 to 3200 -N generate the first server secret key s _s1 ,..., The Nth server secret key s _sN (S1210-1 to N). The server secret key sharing units 2240-1 to 2240 -N share the Nth server secret key s _sN from the first server secret key s _s1 with other time release servers (S _2240-1 to N). The server public key generation unit 1220-n of each time release server 3200-n randomly selects an element G _sn of the group G ^ and makes G _sn and s _sn G _sn as the nth server public key p _sn and publishes it. (S1220-n). In other words, time release server 1200-1~N is, the first server public key _{p s1,} ..., to generate the N-th server public key _{p sN,} to publish (S1220-1~N). Note that the order of Steps S2240-1 to N and Steps S1220-1 to N may be reversed.

The decryption secret key generation unit 1460 of the decryption device 3400 randomly selects an integer s _b less than p, and sets the integer s _b as the decryption secret key s _b (S1460). Note that step S1460 may be performed before processing of the time release server such as steps S1220-1 to S1220-1. Decoding device authentication information publishing unit 1410, the decoding device authentication information _{p b1} corresponding to the time release server, _..., a _{p bN,} all of the n for _p bn ₌ s _{b G sn} of 1~N
Is obtained (S1411) and released (S412).

The encryption device 3300 selects one time release server from the N time release servers (here, the nth time release server is selected), and the decryption time setting unit 1350 selects the decryption time t. Then, the decoding time t is set in the N time release servers 1200-1 to 1200-N (S1350). Encryption key generating unit 3360, an integer _{r a} less than p randomly _{selects, H} 1 (t) is a _{T a,} r a _{T a} a a _{Q a,} the encryption key K for Time Release server 3200-n selected _n ,
K _an = e (s _sn G _sn , Q _a )
(S3360). The encryption unit 3310 receives the individual session information c _{1, n} and the individual ciphertext c _{2, n} corresponding to the selected time release server 3200-n,
c _{1, n} = r _{a b bn}
c _{2, n} = m (+) H ₂ (K _an )
The ciphertext C including the individual session information c1 _{, n} , the individual ciphertext c2 _{, n,} and the decryption time t is obtained (S3310). For example, C = (c _{1, n} , c _{2, n} , t) may be used. The ciphertext transmission unit 320 transmits the ciphertext C to the decryption device 3400 (S320). The ciphertext receiving unit 420 of the decryption device 3400 receives the ciphertext C (S420).

The secret information generating unit 1230-n of are time released server 3200-n selects the encryption device 3300, a first n secret information _{s an,} from decoding time t the encryption device 3300 is set,
s _an = s _sn H ₁ (t)
The n-th secret information _san is transmitted to the decryption device 3400 after the decryption time t (S123-n). In order to obtain the n-th secret information s _an by the above formula, H ₁ (t) is once set as T _a, and then s _an = s _sn T _a
It is sufficient to calculate as follows. The operation of the secret information generation unit 1230-n specifies, for example, the time release server 3200-n from the ciphertext C received by the decryption device 3400, and the decryption device 3400 sends the nth secret information to the time release server 3200-n. It can be started by requesting _san . Secret information receiving unit 430 of the decoding device 3400, the selected time release servers 3200-n, since the decoding time t, to receive the n-th secret information _{s an} (S430). The decryption unit 3440 obtains the decryption key K _bn corresponding to the selected time release server 3200-n with K _bn = e (s _b ⁻¹ c _{1, n} , s _an ).
And the plaintext m is determined as m = H ₂ (K _bn ) (+) c _{2, n}
(S3440).

In the event that the time release server 3200-n selected by the encryption device 3300 has failed, the decryption device 3400 uses another time release server 3200-j (where j is 1 to N other than n). Integer) is selected, and the n-th secret information _san is requested from the time release server 3200-j. Then, the backup secret information generation unit 3250-j of the time release servers 3200-j is the n-th secret information _{s an,} from the n server secret key _{s sn} and decoding time t the encryption device 3300 is set to sharing,
s _an = s _sn H ₁ (t)
Calculated as transmits the j-th secret information _{s aj} to the decoding apparatus 3400 after the decoding time t (S3250-j). Backup secret information receiving unit 2450 of the decoding device 3400, from the time release server 3200-j selected, since the decoding time t, to receive the n-th secret information _{s an} (S2450). The decryption unit 3440 uses the decryption key K _bn corresponding to the time release server 3200-n as K _bn = e (s _b ⁻¹ c _{1, n} , s _an ).
And the plaintext m is determined as m = H ₂ (K _bn ) (+) c _{2, n}
(S3440: backup decryption step).

Thus, in the encryption system 3100 of the fourth embodiment, when the selected time release server 3200-n fails, the decryption device 3400 fails from any of the other time release servers 3200-j. The nth secret information _san that should have been received from the time release server 3200-n that has been received is received. Although the encryption system 3100 in ciphertext C only contains individual session information c _{1, n} and the individual ciphertext c _{2, n} for the server that the encryption device 3300 is selected, each time release servers all time release Since the server private key of the server is shared, any time release server can generate and send secret information that should have been sent by the failed time release server. Therefore, if one of the time release servers functions normally, the entire system can be prevented from going down.

  FIG. 15 shows a configuration example of the encryption system according to the fifth embodiment. The encryption system 4100 includes an upper server 4500, N lower servers 4200-n, an encryption device 4300, and a decryption device 4400 (where N is an integer of 1 or more and n is an integer of 1 to N). In the present embodiment, since there is a host server, N is 1 or more. FIG. 16 shows a configuration example of the upper server of the fifth embodiment, FIG. 17 shows a configuration example of the lower server, FIG. 18 shows a configuration example of the encryption device, and FIG. 19 shows a configuration example of the decryption device. FIG. 20 is a diagram illustrating a processing flow of the encryption system according to the fifth embodiment. The upper server 4500 includes a server secret key generation unit 4510, a server secret key transmission unit 4520, a backup secret information generation unit 4550, and an upper server recording unit 4590. Each subordinate server 4200-n (nth subordinate server) includes a server secret key receiving unit 4210-n, a server public key generating unit 220-n, a secret information generating unit 230-n, and a subordinate server recording unit 4290-n. . The encryption device 4300 includes an encryption unit 2310, a ciphertext transmission unit 320, and an encryption recording unit 4390. Decryption device 4400 includes decryption device authentication information disclosure unit 410, ciphertext reception unit 420, secret information reception unit 430, decryption unit 2440, backup secret information reception unit 4450, and decryption recording unit 2490. The upper server recording unit 4590, the lower server recording unit 4290-n, the encryption recording unit 4390, and the decryption recording unit 4490 are components for recording information necessary for the operation of each device.

The server secret key generation unit 4510 of the upper server 4500 generates the nth server secret key s _sn for all n from 1 to N (S4510). The server secret key transmission unit 4520 transmits the nth server secret key s _sn to the nth lower server 4200-n (S4520). The server private key receiving unit 4210-n of each lower server 4200-n (nth lower server) receives the nth server private key s _sn (S4210-n). That is, the lower servers 4200-1 to 4200 -N receive the first server secret key s _s1 ,..., The Nth server secret key s _sN (S _4210-1 to N). The server public key generation unit 220-n of each lower server 4200-n generates and publishes the nth server public key p _sn (S220-n). That is, the lower servers 4200-1 to _{4200 -N} generate and publish the first server public key p _s1 ,..., The Nth server public key p _sN (S220-1 to N).

The decryption device authentication information disclosing unit 410 of the decryption device 4400 discloses the decryption device authentication information p _b (or p _b1 ,..., P _bN ) (S412). Note that the decryption device authentication information may be p _b that is the same for all the lower servers, or may be p _b1 ,..., P _bN that is different for each lower server. In addition, the decryption device authentication information disclosure unit 410 may record the decryption device authentication information p _b (or p _b1 ,..., P _bN ) in the decryption recording unit 4490 in advance. Alternatively, the decryption device authentication information disclosure unit 410 may generate the decryption device authentication information p _b1 ,..., P _bN using the server public key p _sn or the like (S411).

The encryption device 4300 selects one subordinate server from the N subordinate servers (assuming that the nth subordinate server is selected here), and the encryption unit 2310 decrypts the nth server public key p _sn. Using the device authentication information p _b (or p _bn ), the individual session information c _{1, n} and the individual ciphertext c _{2, n} corresponding to the selected lower server 4200-n are obtained. Then, the encryption unit 2310 obtains the ciphertext C including the individual session information c _{1, n} and the individual cipher text c _{2, n} (S2310). For example, C = (c _{1, n} , c _{2, n} ) may be set. The ciphertext transmission unit 320 transmits the ciphertext C to the decryption device 4400 (S320). The ciphertext receiving unit 420 of the decryption device 4400 receives the ciphertext C (S420).

The secret information generating unit 230-n of the subordinate server 4200-n which are selected in the encryption device 4300 generates the n-th secret information _{s an,,} and transmits to the decoding device 4400 (S230-n). The n-th secret information s _an may be generated using the n-th server secret key s _sn and the decryption device authentication information p _b (or p _bn ). Secret information receiving unit 430 receives the n-th secret information _{s an,} from child servers 4200-n which are selected (S430). The operation of the secret information generation unit 230-n is performed, for example, by the decryption device 4400 specifying the lower server 4200-n from the received ciphertext C, and the decryption device 4400 sends the nth secret information s to the lower server 4200-n. _It can be started by requesting _an . Decoding unit 2440 decodes the plaintext m individual ciphertext _{c 2, n} using selected individual session information _{c 1} corresponding to the subordinate server 4200-n _{has, n} and the n secret _{s an} (S2440).

Then, the event that the subordinate server 4200-n to the cryptographic unit 3300 selects had failed, the decoding device 4400 requests a first n secret information _{s an,} in host server 4500. Then, the backup secret information generating unit 4550 of the host server 4500 from the n server secret key _{s sn} it holds to generate the n-th secret information _{s an,} be transmitted to the decoding apparatus 4400 (S4550). Backup secret information receiving unit 4450 receives the n-th secret information _{s an} (S4450). The decryption unit 2440 uses the individual session information c _{1, n} and the n-th secret information s _an corresponding to the server 2200-n (failed server) selected by the encryption device 4300 to generate the individual ciphertext c _{2, n} . Decrypt into plaintext m (S2440: backup decryption step).

In the case of the encryption system 4100, when the selected lower server 4200-n fails, the decryption device 4400 receives the secret information that should have been received from the lower server that has failed from the upper server 4500. Receive. Encryption system in 4100 the ciphertext C only contains individual session information c _{1, n} and the individual ciphertext c _{2, n} for child servers cryptographic unit 4300 has selected. However, since the upper server records whether or not the server secret keys of all the lower servers can be generated instead of the lower server, or can be calculated, it is recorded by the lower server that has failed. Secret information that should have been generated can be generated and transmitted. Therefore, if the upper server or the lower server functions normally, it is possible to prevent the entire system from going down. In the present embodiment, an example of two layers, ie, an upper server and a lower server, is shown, but the server layer may be three or more layers. Further, the encryption systems of the first, third, and fifth embodiments may be combined.

  FIG. 21 shows a configuration example of the encryption system according to the sixth embodiment. The encryption system 5100 includes an upper time release server 5500, N lower time release servers 5200-n, an encryption device 5300, and a decryption device 5400 (where N is an integer greater than or equal to 1, and n is an integer between 1 and N) ). In this embodiment, since there is a higher time release server, N is 1 or more. FIG. 16 shows a configuration example of the upper time release server of the sixth embodiment, FIG. 17 shows a configuration example of the lower time release server, FIG. 18 shows a configuration example of the encryption device, and FIG. 19 shows a configuration example of the decryption device. FIG. 22 is a diagram illustrating a processing flow of the encryption system according to the sixth embodiment. The upper time release server 5500 includes a server secret key generation unit 5510, a server secret key transmission unit 5520, a backup secret information generation unit 5550, and an upper server recording unit 5590. Each lower time release server 5200-n (nth lower time release server) includes a server secret key reception unit 5210-n, a server public key generation unit 1220-n, a secret information generation unit 1230-n, and a lower server recording unit 5290. -N is provided. The encryption device 5300 includes a decryption time setting unit 5350, an encryption key generation unit 3360, an encryption unit 2310, a ciphertext transmission unit 320, and an encryption recording unit 5390. The decryption device 5400 includes a decryption secret key generation unit 1460, a decryption device authentication information disclosure unit 1410, a ciphertext reception unit 420, a secret information reception unit 430, a decryption unit 3440, a backup secret information reception unit 5450, and a decryption recording unit 5490. The upper server recording unit 5590, the lower server recording unit 5290-n, the encryption recording unit 5390, and the decryption recording unit 5490 are components for recording information necessary for the operation of each device.

Here, p is a prime order, G ^ and G _T ^ are cyclic groups having a prime order p, e () is a bilinear map e: G ^ × G ^ → G _T ^, H ₁ () Is a hash function that converts information {0, 1} ^* of arbitrary length into elements of the group G ^, and H ₂ () converts information {0, 1} ^* of arbitrary length into h bits and information {0, 1} ^h . A hash function to be converted, m is a plain text, and (+) is an exclusive OR.

The server secret key generation unit 5510 of the upper time release server 5500 randomly selects an integer s _sn less than p for all n from 1 to N, and sets the integer s _sn as the nth server secret key s _sn (S5510). . The server secret key transmission unit 5520 transmits the nth server secret key s _sn to the nth lower time release server 5200-n (S5520). The server private key receiving unit 5210-n of each lower time release server 5200-n (nth lower server) receives the nth server private key s _sn (S5210-n). In other words, the lower time release server 5200-1~N is, the first server secret key _{s s1,} ..., to receive the N-th server secret key _{s sN (S5210-1~N).} The server public key generation unit 1220-n of each lower time release server 5200-n randomly selects an element G _sn of the group G ^, makes G _sn and s _sn G _sn the nth server public key p _sn, and makes it public (S1220-n). In other words, the lower time release server 5200-1~N is, the first server public key _{p s1,} ..., to generate the N-th server public key _{p sN,} to publish (S1220-1~N).

The decryption secret key generation unit 1460 of the decryption device 5400 randomly selects an integer s _b less than p, and sets the integer s _b as the decryption secret key s _b (S1460). Note that step S1460 may be performed before the processing of the lower time release server or the processing of the higher time release server such as steps S1220-1 to S1220-1. Decoding device authentication information publishing unit 1410, the decoding device authentication information _{p b1} corresponding to the lower time release server, _..., a _{p bN,} all of the n for _p bn ₌ s _{b G sn} of 1~N
Is obtained (S1411) and released (S412).

The encryption device 5300 selects one lower time release server from among the N lower time release servers (assuming that the nth lower time release server is selected here), and the decryption time setting unit 5350 t is selected, and the decoding time t is set to the upper time release server 5500 and the selected lower time release server 5200-n (S5350). Encryption key generating unit 3360, an integer _{r a} less than p randomly _{selects, H} 1 (t) is a _{T a,} a r a _{T a} and _{Q a,} an encryption key for the lower Time Release server 5200-n selected the K _n,
K _an = e (s _sn G _sn , Q _a )
(S3360). The encryption unit 3310 obtains the individual session information c _{1, n} and the individual ciphertext c _{2, n} corresponding to the selected lower time release server 5200-n,
c _{1, n} = r _{a b bn}
c _{2, n} = m (+) H ₂ (K _an )
The ciphertext C including the individual session information c1 _{, n} , the individual ciphertext c2 _{, n,} and the decryption time t is obtained (S3310). For example, C = (c _{1, n} , c _{2, n} , t) may be used. The ciphertext transmission unit 320 transmits the ciphertext C to the decryption device 5400 (S320). The ciphertext receiving unit 420 of the decryption device 5400 receives the ciphertext C (S420).

The secret information generating unit 1230-n of lower Time Release server 5200-n which are selected in the encryption device 5300, a first n secret information _{s an,} from decoding time t the encryption device 5300 is set,
s _an = s _sn H ₁ (t)
The n-th secret information _san is transmitted to the decryption device 5400 after the decryption time t (S123-n). In order to obtain the n-th secret information s _an by the above formula, H ₁ (t) is once set as T _a, and then s _an = s _sn T _a
It is sufficient to calculate as follows. Note that the operation of the secret information generation unit 1230-n specifies, for example, the lower time release server 5200-n from the ciphertext C received by the decryption device 5400, and the decryption device 3400 sends the nth time release server 5200-n to the nth time. may be started by requesting the secret information s _an,. Further, when there is only one lower time release server, no request is required, and the secret information generation unit 1230-n may start operation without request. Secret information receiving unit 430 of the decoding device 5400, from the lower Time Release server 5200-n which are selected, since the decoding time t, to receive the n-th secret information _{s an} (S430). The decryption unit 5440 uses the decryption key K _bn corresponding to the selected lower time release server 5200-n as K _bn = e (s _b ⁻¹ c _{1, n} , s _an ).
And the plaintext m is determined as m = H ₂ (K _bn ) (+) c _{2, n}
(S3440).

The event, the cryptographic device 5300 when a lower Time Release server 5200-n selected had failed, the decoding device 5400 requests a first n secret information _{s an,} to a higher Time Release server 5500. Then, the backup secret information generation unit 5550 of the upper time release server 5500 _obtains the nth secret information s _an from the nth server secret key s _sn and the decryption time t set by the encryption device 5300.
s _an = s _sn H ₁ (t)
Calculated as transmits the n-th secret information _{s an,} to the decoding apparatus 5400 after the decoding time t (S5550). Backup secret information receiving unit 5450 of the decoding device 5400 from the host Time Release server 5500, since the decoding time t, to receive the n-th secret information _{s an} (S5450). The decryption unit 3440 uses the decryption key K _bn corresponding to the lower time release server 5200-n as K _bn = e (s _b ⁻¹ c _{1, n} , s _an ).
And the plaintext m is determined as m = H ₂ (K _bn ) (+) c _{2, n}
(S3440: backup decryption step).

In the case of the encryption system 5100, when the selected lower time release server 5200-n fails, the decryption device 5400 receives from the upper time release server 5500 from the lower time release server that has failed. Receive secret information that was supposed to be. The encryption system 5100 in ciphertext C only contains individual session information c _{1, n} and the individual ciphertext c _{2, n} for lower time release server cryptographic unit 5300 has selected. However, the upper time release server records whether the server secret key of all the lower time release servers can be generated instead of the lower time release server, or can be calculated, so it fails. It is possible to generate and send confidential information that should have been sent by the lower time release server. Therefore, if the upper time release server or the lower time release server functions normally, the entire system can be prevented from going down. In the present embodiment, an example of two layers of the upper time release server and the lower time release server is shown, but the time release server may have three or more layers. Further, the encryption systems of Embodiments 2, 4, and 6 may be combined.

  FIG. 23 shows a functional configuration example of a computer. The server, time release server, upper server, lower server, upper time release server, lower time release server, encryption device, and decryption device of the present invention are stored in the recording unit 9020 of the computer 9000 as each component of the present invention. This can be realized by reading a program that operates 9000 and operating the processing unit 9010, the input unit 9030, the output unit 9040, and the like. In addition, as a method of causing the computer to read, the program is recorded on a computer-readable recording medium, and the program recorded on the server or the like is read into the computer through a telecommunication line or the like. There is a method to make it.

  The present invention relates to information security technology, and can be used for communications such as information that is encrypted, transmitted and received, and decrypted.

DESCRIPTION OF SYMBOLS 100 Encryption system 200 Server 210 Server private key generation part 220 Server public key generation part 230 Secret information generation part 290 Server recording part 300 Encryption apparatus 310 Encryption part 320 Ciphertext transmission part 390 Encryption recording part 400 Decryption apparatus 410 Decryption apparatus Authentication information disclosure unit 420 Ciphertext reception unit 430 Secret information reception unit 440 Decryption unit 490 Decryption recording unit 1100 Encryption system 1200 Time release server 1210 Server secret key generation unit 1220 Server public key generation unit 1230 Secret information generation unit 1290 Server recording unit 1300 Encryption Device 1310 Encryption Unit 1350 Decryption Time Setting Unit 1360 Encryption Key Generation Unit 1390 Encryption Recording Unit 1400 Decryption Device 1410 Decryption Device Authentication Information Disclosure Unit 1440 Decryption Unit 1460 Decryption Secret Key Generation Unit 1490 Decryption Recording Unit 21 0 Encryption System 2200 Server 2240 Server Secret Key Sharing Unit 2250 Backup Secret Information Generation Unit 2290 Server Recording Unit 2300 Encryption Device 2310 Encryption Unit 2390 Encryption Recording Unit 2400 Decryption Device 2440 Decryption Unit 2450 Backup Secret Information Receiving Unit 2490 Decryption Recording Unit 3100 encryption system 3200 time release server 3250 backup secret information generation unit 3290 server recording unit 3300 encryption device 3310 encryption unit 3360 encryption key generation unit 3390 encryption recording unit 3400 decryption device 3440 decryption unit 3490 decryption recording unit 4100 encryption system 4200 Lower server 4210 Server secret key receiving unit 4290 Lower server recording unit 4300 Encryption device 4390 Encryption recording unit 4400 Decryption device 4450 Backup secret Information receiving unit 4490 Decryption recording unit 4500 Upper server 4510 Server secret key generation unit 4520 Server secret key transmission unit 4550 Backup secret information generation unit 4590 Upper server recording unit 5100 Encryption system 5200 Lower time release server 5210 Server secret key reception unit 5290 Lower Server recording unit 5300 Encryption device 5350 Decryption time setting unit 5390 Encryption recording unit 5400 Decryption device 5440 Decryption unit 5450 Backup secret information reception unit 5490 Decryption recording unit 5500 Upper time release server 5510 Server secret key generation unit 5520 Server secret key transmission unit 5550 Backup secret information generation unit 5590 Host server recording unit

Claims (12)

An encryption system including N servers, an encryption device, and a decryption device,
N is an integer of 2 or more, n is an integer of 1 to N,
The nth server is
A server secret key generation unit for generating an nth server secret key s _sn ;
A server public key generation unit that generates and publishes an nth server public key p _sn ;
A secret information generation unit that generates n-th secret information _san and transmits it to the decryption device,
The encryption device is:
Individual session information c _1,1 ,..., C _{1, N} and individual ciphertexts c _2,1 ,..., C _{2, N} corresponding to all servers are obtained using the decryption device authentication information, and individual session information c _{1 , 1} ,..., C _{1, N} and an individual ciphertext c _2,1 ,..., C _{2, N,} and a ciphertext transmitting unit for transmitting the ciphertext C. ,
The decoding device
A decryption device authentication information disclosing unit for disclosing the decryption device authentication information;
A ciphertext receiving unit that receives the ciphertext C;
From the selected server, and the secret information receiving unit that receives the n-th secret information s _an,,
Encryption system, characterized in that it comprises a decoding unit using separate session information c _{1, n} and the n secret information s _an,, decrypts the individual ciphertext c _{2, n} plaintext m. An encryption system including N time release servers, an encryption device, and a decryption device,
N is an integer of 2 or more, n is an integer of 1 to N, p is a prime number, G ^ and G _T ^ are cyclic groups having a prime number p, e () is e: G ^ × G ^ → G _T ^ become bilinear _{mapping, H} 1 () is a hash function that converts the arbitrary length information {0, ^{1} *} to the group G ^ _{elements, H} 2 () is an arbitrary length of the information {0, ^{1} *} Is a hash function that converts ^h into bits and information {0,1} ^h , m as plain text, and (+) as an exclusive OR,
The nth time release server is
a server secret key generator that randomly selects an integer s _sn less than p, and uses the integer s _sn as the nth server secret key;
A server public key generation unit that publicly selects an element G _sn of the group G ^, _sets G _sn and s _sn G _sn as the nth server public key p _sn ;
From the decryption time t set by the encryption device, the nth secret information _san is
s _an = s _sn H ₁ (t)
Obtained as, a secret information generating unit which transmits a first n secret information s _an, the decoding device since the decoding time t,
The encryption device is:
A decoding time setting unit that selects a decoding time t and sets the decoding time t in N time release servers;
an integer _{r a} less than p selected at _{random, H} 1 (t), and _{T a,} a r _{a T} a and _{Q a,} the encryption key _K 1 for the time release server, ..., a _{K N,} from 1 to N K _an = e (s _sn G _sn , Q _a ) for all n
An encryption key generation unit to be obtained as follows:
Individual session information corresponding to all time releases server _c 1, 1, _{..., c 1, N} and the individual ciphertext _c 2,1, _..., the _{c 2, N, c 1} for all n of N from _{1, n} = r _a p _bn
c _{2, n} = m (+) H ₂ (K _an )
Determined as individual session information _{c 1,1, ..., c 1,} N and the individual ciphertext _c 2,1, _..., an encryption unit for obtaining a ciphertext C including the _{c 2, N} and decoding time t ,
A ciphertext transmission unit that transmits the ciphertext C, and
The decoding device
a decryption secret key generation unit that randomly selects an integer s _b less than p and uses the integer s _b as a decryption secret key;
The decryption device authentication information p _b1 ,..., P _bN corresponding to each time release server is set to p _bn = s _b G _sn
Decryption device authentication information disclosure unit to be obtained and disclosed as follows:
A ciphertext receiving unit that receives the ciphertext C;
From selected time release server, since the decoding time t, and the secret information receiving unit that receives the n-th secret information s _an,,
The decryption key K _bn corresponding to the selected time release server is represented by K _bn = e (s _b ⁻¹ c _{1, n} , s _an )
And the plaintext m is determined as m = H ₂ (K _bn ) (+) c _{2, n}
An encryption system comprising: a decrypting unit that is obtained as follows. An encryption system including N servers, an encryption device, and a decryption device,
N is an integer of 2 or more, n is an integer of 1 to N, j is an integer of 1 to N other than n,
The nth time release server is
A server secret key generation unit for generating an nth server secret key s _sn ;
A server public key generation unit that generates and publishes an nth server public key p _sn ;
A server secret key sharing unit that shares the Nth server secret key s _sN with the other server from the first server secret key s _s1 ;
And secret information generation unit for transmitting a first n secret information s _an, in the decoding device,
A backup secret information generation unit that transmits the j-th secret information _saj to the decryption device,
The encryption device is:
The individual session information c _{1, n} and the individual cipher text c _{2, n} corresponding to the selected server are obtained using the decryption device authentication information _, and the cipher text including the individual session information c _{1, n} and the individual cipher text c _{2, n} is obtained. An encryption unit for obtaining C, and a ciphertext transmission unit for transmitting the ciphertext C,
The decoding device
A decryption device authentication information disclosing unit for disclosing the decryption device authentication information;
A ciphertext receiving unit that receives the ciphertext C;
From the server where the cryptographic unit has selected, and the secret information receiving unit that receives the n-th secret information s _an,,
From a server other than the server that the encryption device is selected, the backup secret information receiving unit that receives the n-th secret information s _an,,
Encryption system, characterized in that it comprises a decoding unit using separate session information c _{1, n} and the n secret information s _an,, decrypts the individual ciphertext c _{2, n} plaintext m. An encryption system including N time release servers, an encryption device, and a decryption device,
N is an integer of 2 or more, n is an integer of 1 to N, j is an integer of 1 to N other than n, p is a prime order, G ^ and G _T ^ are cyclic groups having a prime order p, e ( ) Is a bilinear map e: G ^ × G ^ → G _T ^, H ₁ () is a hash function that converts arbitrary length information {0,1} ^* into elements of the group G ^, H ₂ () Is a hash function that converts information {0, 1} ^* of arbitrary length into h bits and information {0, 1} ^h , m is plaintext, and (+) is an exclusive OR,
The nth time release server is
a server secret key generator that randomly selects an integer s _sn less than p, and uses the integer s _sn as the nth server secret key;
A server public key generation unit that publicly selects an element G _sn of the group G ^, _sets G _sn and s _sn G _sn as the nth server public key p _sn ;
A server secret key sharing unit that shares the first server secret key s _s1 to the Nth server secret key s _sN with other time release servers;
From the decryption time t set by the encryption device, the nth secret information _san is
s _an = s _sn H ₁ (t)
Calculated as the secret information generation unit for transmitting a first n secret information s _an, the decoding device since the decoding time t,
The j-th secret information s _aj from the decryption time t set by the encryption device,
s _aj = s _sj H ₁ (t)
And a backup secret information generation unit that transmits the j-th secret information _saj to the decryption device after the decryption time t,
The encryption device is:
A decoding time setting unit that selects a decoding time t and sets the decoding time t in N time release servers;
an integer _{r a} less than p selected at _{random, H} 1 (t), and _{T a,} a r _{a T} a and _{Q a,} the encryption key _{K n} for the time release server selected,
K _an = e (s _sn G _sn , Q _a )
An encryption key generation unit to be obtained as follows:
The individual session information c _{1, n} and the individual ciphertext c _{2, n} corresponding to the selected time release server are changed to c _{1, n} = r _a p _bn
c _{2, n} = m (+) H ₂ (K _an )
An encryption unit that obtains ciphertext C including individual session information c _{1, n} , individual ciphertext c _{2, n,} and decryption time t,
A ciphertext transmission unit that transmits the ciphertext C, and
The decoding device
a decryption secret key generation unit that randomly selects an integer s _b less than p and uses the integer s _b as a decryption secret key;
The decryption device authentication information p _b1 ,..., P _bN corresponding to each time release server is set to p _bn = s _b G _sn
Decryption device authentication information disclosure unit to be obtained and disclosed as follows:
A ciphertext receiving unit that receives the ciphertext C;
From Time Release server the encryption device is selected, since the decoding time t, and the secret information receiving unit that receives the n-th secret information s _an,,
When the cryptographic unit can not receive the n-th secret information s _an, from Time Release server selected, and backup secret information receiving unit that receives the n-th secret information s _an, from other time release server,
The decryption key K _bn corresponding to the selected time release server is represented by K _bn = e (s _b ⁻¹ c _{1, n} , s _an )
And the plaintext m is determined as m = H ₂ (K _bn ) (+) c _{2, n}
An encryption system comprising: a decrypting unit that is obtained as follows. An encryption system including an upper server, N lower servers, an encryption device, and a decryption device,
N is an integer of 1 or more, n is an integer of 1 to N,
The upper server is
A server secret key generation unit that generates an nth server secret key s _sn for all n of 1 to N;
A server secret key transmitter that transmits the nth server secret key s _sn to the nth subordinate server;
A backup secret information generation unit for generating n-th secret information _san and transmitting it to the decryption device,
The nth subordinate server is
A server secret key receiving unit for receiving the nth server secret key s _sn ;
A server public key generation unit that generates and publishes an nth server public key p _sn ;
A secret information generation unit that generates n-th secret information _san and transmits it to the decryption device,
The encryption device is:
The individual session information c _{1, n} and the individual cipher text c _{2, n} corresponding to the selected lower server are obtained using the decryption device authentication information _, and the cipher including the individual session information c _{1, n} and the individual cipher text c _{2, n} is obtained. An encryption unit for obtaining the sentence C, and a ciphertext transmission unit for transmitting the ciphertext C.
The decoding device
A decryption device authentication information disclosing unit for disclosing the decryption device authentication information;
A ciphertext receiving unit that receives the ciphertext C;
From child servers the encryptor selects a secret information receiving unit that receives the n-th secret information s _an,,
From the host server, and the backup secret information receiving unit that receives the n-th secret information s _an,,
Encryption system, characterized in that it comprises a decoding unit using separate session information c _{1, n} and the n secret information s _an,, decrypts the individual ciphertext c _{2, n} plaintext m. An encryption system including an upper time release server, N lower time release servers, an encryption device, and a decryption device,
N is an integer of 1 or more, n is an integer of 1 to N, p is a prime order, G ^ and G _T ^ are cyclic groups having a prime order p, e () is e: G ^ × G ^ → G _T ^ become bilinear _{mapping, H} 1 () is a hash function that converts the arbitrary length information {0, ^{1} *} to the group G ^ _{elements, H} 2 () is an arbitrary length of the information {0, ^{1} *} Is a hash function that converts ^h into bits and information {0,1} ^h , m as plain text, and (+) as an exclusive OR,
The upper time release server is
A server secret key generator that randomly selects an integer s _sn less than p for all n from 1 to N, and uses the integer s _sn as the nth server secret key;
A server secret key transmitter for transmitting the nth server secret key s _sn to the nth lower time release server,
From the decryption time t set by the encryption device, the nth secret information _san is
s _an = s _sn H ₁ (t)
Obtained as, a backup secret information generation unit for transmitting a first n secret information s _an, the decoding device since the decoding time t,
The nth subordinate time release server is
A server secret key receiving unit for receiving the nth server secret key s _sn ;
A server public key generation unit that publicly selects an element G _sn of the group G ^, _sets G _sn and s _sn G _sn as the nth server public key p _sn ;
From the decryption time t set by the encryption device, the nth secret information _san is
s _an = s _sn H ₁ (t)
Obtained as, a secret information generating unit which transmits a first n secret information s _an, the decoding device since the decoding time t,
The encryption device is:
A decoding time setting unit that selects a decoding time t and sets the decoding time t in an upper time release server and an nth lower time release server;
an integer _{r a} less than p selected at _{random, H} 1 (t), and _{T a,} a r _{a T} a and _{Q a,} the encryption key _{K n} for the lower time release server selected,
K _an = e (s _sn G _sn , Q _a )
An encryption key generation unit to be obtained as follows:
The individual session information c _{1, n} and the individual ciphertext c _{2, n} corresponding to the selected nth lower time release server are changed to c _{1, n} = r _{a b bn}
c _{2, n} = m (+) H ₂ (K _an )
An encryption unit that obtains ciphertext C including individual session information c _{1, n} , individual ciphertext c _{2, n,} and decryption time t,
A ciphertext transmission unit that transmits the ciphertext C, and
The decoding device
a decryption secret key generation unit that randomly selects an integer s _b less than p and uses the integer s _b as a decryption secret key;
The decryption device authentication information p _b1 ,..., P _bN corresponding to each lower time release server is set to p _bn = s _b G _sn for all n of 1 to _N.
Decryption device authentication information disclosure unit to be obtained and disclosed as follows:
A ciphertext receiving unit that receives the ciphertext C;
From the lower Time Release server the encryption device is selected, since the decoding time t, and the secret information receiving unit that receives the n-th secret information s _an,,
When the cryptographic unit can not receive the n-th secret information s _an, from the lower Time Release server selected, and backup secret information receiving unit that receives the n-th secret information s _an, from the host Time Release server,
The decryption key K _bn corresponding to the selected lower time release server is represented by K _bn = e (s _b ⁻¹ c _{1, n} , s _an )
And the plaintext m is determined as m = H ₂ (K _bn ) (+) c _{2, n}
An encryption system comprising: a decrypting unit that is obtained as follows. An encryption method by an encryption system including N servers, an encryption device, and a decryption device,
N is an integer of 2 or more, n is an integer of 1 to N, j is an integer of 1 to N other than n,
All the servers
A server secret key generation step of generating an nth server secret key s _sn ;
A server public key generation step of generating and publicizing an nth server public key p _sn ;
The decoding device is
A decryption device authentication information disclosing step for disclosing the decryption device authentication information;
The encryption device is
All individual session information corresponding to the server _{c 1,1, ..., c 1,} N and the individual ciphertext _c 2,1, _..., obtained by using the decryption device authentication information _{c 2, N,} individual session information _{c 1 , 1, ..., c 1,} N and the individual ciphertext _c 2,1, _..., an encryption step of obtaining the ciphertext C including the _{c 2, N,}
A ciphertext transmission step of transmitting the ciphertext C;
The decoding device is
A ciphertext receiving step for receiving ciphertext C;
The nth server selected by the decryption device is:
A secret information generating step of generating n-th secret information _san and transmitting it to the decryption device;
From the selected server, and secret information receiving step of receiving the n-th secret information s _an,,
A decryption step of decrypting the individual ciphertext c2 _{, n} into the plaintext m using the individual session information c1 _{, n} and the nth secret information s _an ;
If the selected server fails, the decryption device reselects a server other than the selected server,
The jth server reselected by the decryption device is:
A backup secret information generating step of generating n-th secret information _san and transmitting it to the decryption device
A backup secret information receiving step of receiving j-th secret information s _aj from the re-selected j-th server;
A backup decryption step of decrypting the individual ciphertext c2 _{, j} into a plaintext m using the individual session information c1 _{, j} and the jth secret information _saj ;
An encryption method characterized by comprising: An encryption method by an encryption system including N time release servers, an encryption device, and a decryption device,
N is an integer of 2 or more, n is an integer of 1 to N, j is an integer of 1 to N other than n, p is a prime order, G ^ and G _T ^ are cyclic groups having a prime order p, e ( ) Is a bilinear map e: G ^ × G ^ → G _T ^, H ₁ () is a hash function that converts arbitrary length information {0,1} ^* into elements of the group G ^, H ₂ () Is a hash function that converts information {0, 1} ^* of arbitrary length into h bits and information {0, 1} ^h , m is plaintext, and (+) is an exclusive OR,
All said time release servers
a server secret key generating step of randomly selecting an integer s _sn less than p and using the integer s _sn as the nth server secret key;
A server public key generation step of publicly selecting an element G _sn of the group G ^, making G _sn and s _sn G _sn as the nth server public key p _sn ;
The decoding device is
a decryption secret key generation step of randomly selecting an integer s _b less than p and using the integer s _b as a decryption secret key;
The decryption device authentication information p _b1 ,..., P _bN corresponding to each time release server is set to p _bn = s _b G _sn
Decryption device authentication information disclosure step to be obtained and disclosed as follows:
The encryption device is
A decoding time setting step of selecting a decoding time t and setting the decoding time t in N time release servers;
an integer _{r a} less than p selected at _{random, H} 1 (t), and _{T a,} a r _{a T} a and _{Q a,} the encryption key _K 1 for the time release server, ..., a _{K N,} from 1 to N K _an = e (s _sn G _sn , Q _a ) for all n
Encryption key generation step to be obtained as follows:
Individual session information corresponding to all time releases server _c 1, 1, _{..., c 1, N} and the individual ciphertext _c 2,1, _..., the _{c 2, N, c 1} for all n of N from _{1, n} = r _a p _bn
c _{2, n} = m (+) H ₂ (K _an )
Determined as individual session information _{c 1,1, ..., c 1,} N and the individual ciphertext _c 2,1, _..., an encryption step of obtaining the ciphertext C including the _{c 2, N} and decoding time t ,
A ciphertext transmission step of transmitting the ciphertext C;
The decoding device is
A ciphertext receiving step for receiving ciphertext C;
The nth time release server selected by the decryption device is:
From the decryption time t set by the encryption device, the nth secret information _san is
s _an = s _sn H ₁ (t)
Calculated as the secret information generation step of transmitting a first n secret information s _an, the decoding device since the decoding time t,
The decoding device is
From selected time release server, since the decoding time t, the secret information receiving step of receiving the n-th secret information s _an,,
The decryption key K _bn corresponding to the selected time release server is represented by K _bn = e (s _b ⁻¹ c _{1, n} , s _an )
And the plaintext m is determined as m = H ₂ (K _bn ) (+) c _{2, n}
The decoding step to be obtained as follows:
When the selected time release server fails, the decoding device reselects a time release server other than the selected time release server,
The nth time release server selected by the decryption device is:
From the decryption time t set by the encryption device, the nth secret information _san is
s _an = s _sn H ₁ (t)
Calculated as the secret information generation step of transmitting a first n secret information s _an, the decoding device since the decoding time t,
The decoding device is
From selected time release server, since the decoding time t, the secret information receiving step of receiving the n-th secret information s _an,,
The decryption key K _bn corresponding to the selected time release server is represented by K _bn = e (s _b ⁻¹ c _{1, n} , s _an )
And the plaintext m is determined as m = H ₂ (K _bn ) (+) c _{2, n}
The decoding step to be obtained as follows:
When the selected time release server fails, the decoding device reselects a time release server other than the selected time release server,
The nth time release server reselected by the decryption device is:
The j-th secret information s _aj from the decryption time t set by the encryption device,
s _aj = s _sj H ₁ (t)
Backup secret information generation step for transmitting the j-th secret information s _aj to the decryption device after the decryption time t,
The decoding device is
A backup secret information receiving step of receiving the j-th secret information s _aj from the reselected time release server after the decryption time t;
The decryption key K _bj corresponding to the reselected time release server is represented by K _bj = e (s _b ⁻¹ c _{1, j} , s _aj )
The plaintext m is calculated as _follows: m = H ₂ (K _bj ) (+) c _{2, j}
Backup decryption step,
An encryption method characterized by comprising: An encryption method by an encryption system including N servers, an encryption device, and a decryption device,
N is an integer of 2 or more, n is an integer of 1 to N, j is an integer of 1 to N other than n,
All said time release servers
A server secret key generation step of generating an nth server secret key s _sn ;
A server public key generation step of generating and publicizing an nth server public key p _sn ;
A server secret key sharing step of sharing the Nth server secret key s _sN with the other server from the first server secret key s _s1 ;
The decoding device is
A decryption device authentication information disclosing step for disclosing the decryption device authentication information;
The cryptographic device selects any time release server,
The individual session information c _{1, n} and the individual cipher text c _{2, n} corresponding to the selected server are obtained using the decryption device authentication information _, and the cipher text including the individual session information c _{1, n} and the individual cipher text c _{2, n} is obtained. An encryption step for obtaining C; a ciphertext transmission step for transmitting the ciphertext C;
The decoding device is
A ciphertext receiving step for receiving ciphertext C;
The nth time release server is
A secret information generation step of transmitting a first n secret information s _an, in the decoding device,
The decoding device is
From a server the encryption apparatus selects a secret information receiving step of receiving the n-th secret information s _an,,
Using the individual session information c _{1, n} and the n-th secret information s _an , a decrypting step for decrypting the individual cipher text c _{2, n} into a plain text m, and when the selected server fails, The encryption device reselects a server other than the selected server,
The j th time release server reselected by the decryption device is:
A backup secret information generating step of transmitting the nth secret information _san to the decryption device;
From the server where the decoder is re-selected, and backup secret information receiving step of receiving the n-th secret information s _an,,
Encryption method; and a backup decoding step using separate session information c _{1, n} and the n secret information s _an,, it decrypts the individual ciphertext c _{2, n} plaintext m. An encryption method by an encryption system including N time release servers, an encryption device, and a decryption device,
N is an integer of 2 or more, n is an integer of 1 to N, j is an integer of 1 to N other than n, p is a prime order, G ^ and G _T ^ are cyclic groups having a prime order p, e ( ) Is a bilinear map e: G ^ × G ^ → G _T ^, H ₁ () is a hash function that converts arbitrary length information {0,1} ^* into elements of the group G ^, H ₂ () Is a hash function that converts information {0, 1} ^* of arbitrary length into h bits and information {0, 1} ^h , m is plaintext, and (+) is an exclusive OR,
All said time release servers
a server secret key generating step of randomly selecting an integer s _sn less than p and using the integer s _sn as the nth server secret key;
A server public key generation step of publicly selecting an element G _sn of the group G ^, making G _sn and s _sn G _sn as the nth server public key p _sn ;
A server secret key sharing step of sharing the Nth server secret key s _sN with the other time release server from the first server secret key s _s1 ;
The decoding device is
a decryption secret key generation step of randomly selecting an integer s _b less than p and using the integer s _b as a decryption secret key;
The decryption device authentication information p _b1 ,..., P _bN corresponding to each time release server is set to p _bn = s _b G _sn
Decryption device authentication information disclosure step to be obtained and disclosed as follows:
The encryption device selects one of the servers,
A decoding time setting step of selecting a decoding time t and setting the decoding time t in N time release servers;
an integer _{r a} less than p selected at _{random, H} 1 (t), and _{T a,} a r _{a T} a and _{Q a,} the encryption key _{K n} for the time release server selected,
K _an = e (s _sn G _sn , Q _a )
Encryption key generation step to be obtained as follows:
The individual session information c _{1, n} and the individual ciphertext c _{2, n} corresponding to the selected time release server are changed to c _{1, n} = r _a p _bn
c _{2, n} = m (+) H ₂ (K _an )
An encryption step for obtaining ciphertext C including individual session information c _{1, n} , individual ciphertext c _{2, n} and decryption time t,
A ciphertext transmission step of transmitting the ciphertext C;
The decoding device is
A ciphertext receiving step for receiving ciphertext C;
The nth time release server selected by the encryption device is:
From the decryption time t set by the encryption device, the nth secret information _san is
s _an = s _sn H ₁ (t)
Calculated as the secret information generation step of transmitting a first n secret information s _an, the decoding device since the decoding time t,
The decoding device is
From Time Release server the encryption device is selected, since the decoding time t, the secret information receiving step of receiving the n-th secret information s _an,,
The decryption key K _bn corresponding to the selected time release server is represented by K _bn = e (s _b ⁻¹ c _{1, n} , s _an )
And the plaintext m is determined as m = H ₂ (K _bn ) (+) c _{2, n}
And when the selected server fails, the decryption device reselects a server other than the server selected by the encryption device,
The j th time release server reselected by the decryption device is:
From the decryption time t set by the encryption device, the nth secret information _san is
s _an = s _sn H ₁ (t)
Determined as a backup secret information generation step of transmitting a first n secret information s _an, the decoding device since the decoding time t,
The decoding device is
And backup secret information receiving step of receiving the n-th secret information s _an, from j-th the time release servers that the decoding device is re-selected,
The decryption key K _bn corresponding to the selected time release server is represented by K _bn = e (s _b ⁻¹ c _{1, n} , s _an )
And the plaintext m is determined as m = H ₂ (K _bn ) (+) c _{2, n}
And a backup decryption step obtained as follows. An encryption method by an encryption system including an upper server, N lower servers, an encryption device, and a decryption device,
N is an integer of 1 or more, n is an integer of 1 to N,
The upper server is
A server secret key generation step for generating an nth server secret key s _sn for all n from 1 to N;
A server secret key transmitting step of transmitting the nth server secret key s _sn to each of the nth subordinate server;
All subordinate servers
A server secret key receiving step of receiving the nth server secret key s _sn ;
A server public key generation step of generating and publicizing an nth server public key p _sn ;
The decoding device is
A decryption device authentication information disclosing step for disclosing the decryption device authentication information;
The encryption device selects any lower server,
The individual session information c _{1, n} and the individual cipher text c _{2, n} corresponding to the selected lower server are obtained using the decryption device authentication information _, and the cipher including the individual session information c _{1, n} and the individual cipher text c _{2, n} is obtained. An encryption step for sentence C;
A ciphertext transmission step of transmitting the ciphertext C;
The decoding device is
A ciphertext receiving step for receiving ciphertext C;
The nth subordinate server selected by the encryption device is
A secret information generation step of generating n-th secret information _san and transmitting it to the decryption device;
The decoding device is
From child servers the encryptor selects a secret information receiving step of receiving the n-th secret information s _an,,
Using the individual session information c _{1, n} and the nth secret information s _an , a decrypting step for decrypting the individual cipher text c _{2, n} into a plain text m, and when the selected server fails,
The upper server is
A backup secret information generation step of generating n-th secret information _san and transmitting it to the decryption device;
The decoding device is
From the host server, and the backup secret information receiving step of receiving the n-th secret information s _an,,
A backup decryption step of decrypting the individual ciphertext c2 _{, n} into the plaintext m using the individual session information c1 _{, n} and the nth secret information s _an ;
An encryption method characterized by comprising: An encryption method by an encryption system including an upper time release server, N lower time release servers, an encryption device, and a decryption device,
N is an integer of 1 or more, n is an integer of 1 to N, p is a prime order, G ^ and G _T ^ are cyclic groups having a prime order p, e () is e: G ^ × G ^ → G _T ^ become bilinear _{mapping, H} 1 () is a hash function that converts the arbitrary length information {0, ^{1} *} to the group G ^ _{elements, H} 2 () is an arbitrary length of the information {0, ^{1} *} Is a hash function that converts ^h into bits and information {0,1} ^h , m as plain text, and (+) as an exclusive OR,
The upper time release server is
A server secret key generating step of randomly selecting an integer s _sn less than p for all n from 1 to N, and using the integer s _sn as an nth server secret key;
A server secret key transmitting step of transmitting each of the nth server secret key s _sn to the nth lower time release server;
All subordinate time release servers
A server secret key receiving step of receiving the nth server secret key s _sn ;
A server public key generation step of publicly selecting an element G _sn of the group G ^, making G _sn and s _sn G _sn as the nth server public key p _sn ;
The decoding device is
a decryption secret key generation step of randomly selecting an integer s _b less than p and using the integer s _b as a decryption secret key;
The decryption device authentication information p _b1 ,..., P _bN corresponding to each lower time release server is set to p _bn = s _b G _sn for all n of 1 to _N.
Decryption device authentication information disclosure step to be obtained and disclosed as follows:
The encryption device is
A decoding time setting step of selecting a decoding time t and setting the decoding time t in the upper time release server and the nth lower time release server;
an integer _{r a} less than p selected at _{random, H} 1 (t), and _{T a,} a r _{a T} a and _{Q a,} the encryption key _{K n} for the lower time release server selected,
K _an = e (s _sn G _sn , Q _a )
Encryption key generation step to be obtained as follows:
The individual session information c _{1, n} and the individual ciphertext c _{2, n} corresponding to the selected nth lower time release server are changed to c _{1, n} = r _{a b bn}
c _{2, n} = m (+) H ₂ (K _an )
An encryption step for obtaining ciphertext C including individual session information c _{1, n} , individual ciphertext c _{2, n} and decryption time t,
A ciphertext transmission step of transmitting the ciphertext C;
The decoding device is
A ciphertext receiving step for receiving ciphertext C;
The nth lower time release server selected by the encryption device is:
From the decryption time t set by the encryption device, the nth secret information _san is
s _an = s _sn H ₁ (t)
Calculated as the secret information generation step of transmitting a first n secret information s _an, the decoding device since the decoding time t,
The decoding device is
From the lower Time Release server the encryption device is selected, since the decoding time t, the secret information receiving step of receiving the n-th secret information s _an,,
The decryption key K _bn corresponding to the selected lower time release server is represented by K _bn = e (s _b ⁻¹ c _{1, n} , s _an )
And the plaintext m is determined as m = H ₂ (K _bn ) (+) c _{2, n}
When the decoding step obtained as described above and the selected lower time release server fail,
The upper time release server is
From the decryption time t set by the encryption device, the nth secret information _san is
s _an = s _sn H ₁ (t)
Determined as a backup secret information generation step of transmitting a first n secret information s _an, the decoding device since the decoding time t,
The decoding device is
And backup secret information receiving step of receiving the n-th secret information s _an from the upper-time release server,
The decryption key K _bn corresponding to the selected lower time release server is represented by K _bn = e (s _b ⁻¹ c _{1, n} , s _an )
And the plaintext m is determined as m = H ₂ (K _bn ) (+) c _{2, n}
And a backup decryption step obtained as follows.

Images