JP5103095B2 - Key generation device, terminal device, storage server, and computer program - Google Patents

Description

  The present invention relates to a key generation device, a terminal device, a storage server, and a computer program.

Conventionally, a method of encrypting shared data and sharing it within a group is known (see, for example, Patent Document 1). When sharing certain shared data within a group, first, the data (M _G ) desired to be shared within the group is encrypted (E _KM (M _G )) with the common key encryption using the encryption key (K _M ). Then, K _M is encrypted (E _pk1 (K _M ),..., _P K _N ) with public keys (pk ₁ ,..., _{Pk N} ) owned by all members (U ₁ ,..., U _N ) of the group. , E _pkN (K _M )), list it, and store it together with E _KM (M _G ) in a server or the like. The group member (U _i ) who refers to the data obtains K _M (E _pki (K _M ) and E _KM (M _G ) encrypted with his / her public key (pk _i ) from the list, and encrypts it. by decoding using its own secret key (sk _i) have been _{K M,} obtaining a _{K M.} then, it decrypts the _E KM _{(M G)} in _{K M,} to obtain the original data _{M G.}
Japanese Patent Application Laid-Open No. 2005-223953

  However, in the technique described in Patent Document 1, when a terminal device owned by a group member is used by a malicious third party, the terminal device holds a secret key used for encryption of shared data. The private key may be leaked. Therefore, even if the shared data is encrypted by another group member, there is a problem that a third party may be able to decrypt the content of the shared data using the leaked secret key. In addition, when a group member publishes shared data for the first time, it is necessary to encrypt the key used to encrypt the shared data with a public key owned by the group member, that is, to perform key encryption processing for the number of group members. there were. Therefore, there has been a problem that the processing load when the shared data is first disclosed is large. In addition, even when the shared data is made public for the first time after the encryption key used for encrypting the shared data is updated, it is necessary to perform the key encryption process for the number of group members. Therefore, there has been a problem that the processing load when the shared data is made public for the first time after updating the encryption key used for encrypting the shared data is large.

  The present invention has been made to solve the above-described problems. Even if a terminal device owned by a group member is used by a malicious third party and a key held by the terminal device is leaked, It is possible to reduce the possibility that the shared data encrypted by a group member will be decrypted by a third party, and to reduce the processing load when the shared data is published for the first time. An object of the present invention is to provide a key generation device, a terminal device, a storage server, and a computer program that can reduce the processing load when sharing data is first disclosed after updating the encryption key used for encryption.

The present invention provides a second distributed key (corresponding to a distributed key sk ₂ in an embodiment described later) essential for decrypting encrypted shared data (corresponding to shared data M _G , M _G ′ in an embodiment described later). In the key generation device included in a data sharing system comprising: a storage server that stores the encrypted shared data; and N (N is an integer of 1 or more) terminal devices; and a key generation device. A group key generation unit that generates a public key and a secret key, a distributed key generation unit that generates a first distributed key (corresponding to a distributed key sk ₁ in an embodiment described later), and the first distributed key and secret key Based on the first distributed key and the second distributed key, a second distributed key generation unit that generates the second distributed key capable of generating the secret key, and the first distributed key, The distributed key is divided into N + 1 different divided keys (divided in the embodiment described later). (Corresponding to keys sk _1,1 , sk _1,2 ,..., Sk _{1, N} , sk _{1, S} )) and N + 1 divided keys divided by the distributed key dividing unit A key distribution unit that distributes one each to the N terminal devices and the storage server, distributes the public key to each of the N terminal devices, and distributes the second distributed key to the storage server; , And the first distributed key can be generated from two or more types of the split keys.

Further, the present invention provides migration source terminal device information that uniquely identifies a migration source terminal device that is an original terminal device that migrates the environment of the terminal device, and a terminal device that is a migration destination of the environment of the migration source terminal device. A receiving unit that receives terminal device migration information including migration destination terminal device information that uniquely identifies a certain migration destination terminal device, and for updating a split key when the receiving unit receives the terminal device migration information Generated by the split key update information generating unit that generates split key update information (corresponding to split key update shares SR _{, 1} , SR _{, S} in embodiments described later), and the split key update information generating unit An update information distribution unit that distributes the split key update information to a terminal device and a storage server that are not included in the terminal device transfer information, and the distributed key split unit is used by the transfer destination terminal device Generate a split key And the divided key the distributed key dividing unit has generated the distribution unit, a key generation device and transmits the said public key to said destination terminal device.

The present invention also provides a storage server for storing a second distributed key essential for decrypting encrypted shared data and the encrypted shared data, a terminal device, and data including a key generation device in the terminal device included in the shared system, from said public key sent from the key generation apparatus (corresponding to the encryption key K _M embodiments to be described later) encryption key with the first key recovery information (in embodiments described later The key recovery information C _0,1 ), an encryption unit that encrypts shared data using the encryption key, the encrypted shared data, and the first a transmission unit for transmitting the key recovery information to the storage server, the encrypted shared data, and second key recovery information (corresponding to the key recovery information C ₁ embodiment to be described later), a third Key recovery information (key recovery in the embodiment described later) A receiving unit and use information corresponding to C ₂₎ received from the storage server, a division key sent from the key generation device, and the second key recovery information received by the receiving unit, the third An encryption key restoring unit for restoring an encryption key based on the key restoration information, and decrypting the encrypted shared data received by the receiving unit using the encryption key restored by the encryption key restoring unit And a decoding unit.

  The present invention also provides an update information receiving unit that receives split key update information from the key generation device, and a split key update that updates the split key based on the split key update information received by the update information receiving unit. A terminal device.

Further, the present invention provides a first share (corresponding to shares S1 and 1 in the embodiments described later) and a second share (information in the embodiments described later), which are information that can generate the encryption key using only two pieces of information. Share generation unit for generating the share S1, 2), and the transmission unit transmits the encrypted shared data, the first key recovery information, and the second share to the storage server. transmitted to, the receiver, if the encryption key the encryption unit is used in the encryption of the shared data is updated, the shared data and the second key recovery information encrypted when, and said third key recovery information received from the storage server, if the encryption key has not been updated, and receives the shared data the encrypted, and said second share of the The encryption key restoration unit is configured so that the encryption unit When the encryption key used for encryption of the data is updated, the split key sent from the key generation device, the second key restoration information received by the receiving unit, and the third key It restores the encryption key on the basis of on the key recovery information, if the encryption key is not updated, and Turkey restore the encryption key on the basis of the second share between the first share Is a terminal device.

Further, the present invention is to restore a storage unit for storing the master share the information of the group that produces the encryption key (corresponding to the master share SM embodiments to be described later), the master share only two pieces of information Is a split share generation unit that generates a first split share (corresponding to a split share SM1 in an embodiment described later) and a second split share (corresponding to a split share SM2 in an embodiment described later). If, before SL on the basis of the encryption key and said master share the master share the encryption key two only cryptographic key shares embodiment of the encryption key shares (described later is capable of generating information the encryption key information share SKM, 1 to and a share generator for generating a corresponding), and the transmission unit, the a shared data encrypted, and the first key recovery information, the storage server and the encryption key shares Transmitted to, the receiver, if the encryption key the encryption unit is used in the encryption of the shared data is updated, the shared data and the second key recovery information encrypted when, and said third key recovery information received from the storage server, if the encryption key has not been updated, and receives the shared data the encrypted, and the encryption key shares, the cryptographic When the encryption key used by the encryption unit for encryption of the shared data is updated, the key restoration unit is configured to transmit the split key sent from the key generation device and the first received by the reception unit. 2 based on the key recovery information and the third key recovery information, and when the encryption key has not been updated , based on the master share and the encryption key share. terminal and wherein the benzalkonium restore the encryption key Te A.

  Further, the present invention provides a storage server included in a data sharing system including a storage server, a terminal device, and a key generation device, and the shared data encrypted by the terminal device and the first key recovery information. And a second distributed key essential for decrypting the encrypted shared data, storing the associated data received by the receiving unit and the first key recovery information in association with each other, and A second key restoration information and a third key based on the storage unit for storing the division key, the first key restoration information, the division key, and the second distributed key. A key recovery information generating unit that generates recovery information, a transmission unit that transmits the encrypted shared data, the second key recovery information, and the third key recovery information to the terminal device And a storage server characterized by comprising:

  Further, the present invention is based on an update information receiving unit that receives split key update information that is information for updating a split key from the key generation device, and the split key update information received by the update information receiving unit. And a split key update unit that updates the split key.

Further, the storage server of the present invention, the receiving unit, said a shared data encrypted from the terminal device, the first key recovery information, and receives a second share, the storage unit, The shared data received by the receiving unit, the first key recovery information, and the second share are stored in association with each other, and the second distribution essential for decrypting the encrypted shared data A key and the split key, and the key recovery information generation unit, when the encryption key used for encryption of the shared data is updated in the terminal device, the first key recovery Generating the second key recovery information and the third key recovery information based on the information for use, the split key, and the second distributed key, and the transmitting unit includes the terminal if the encryption key used to encrypt the shared data in device is updated, And Goka been the shared data, and the second key recovery information, transmits the said third key recovery information to the terminal device, when the encryption key has not been updated, encrypting wherein the shared data, and said second share it characterized and Turkey be transmitted to the terminal device.

Further, the storage server of the present invention, the receiving unit, said a shared data encrypted from the terminal device, the first key recovery information, and receives the encryption key shares, the storage unit, the Storing the shared data received by the reception unit, the first key recovery information, and the encryption key share in association with each other , and a second distributed key essential for decrypting the encrypted shared data; Storing the split key, and when the encryption key used for encrypting the shared data in the terminal device is updated , the key recovery information generation unit and the first key recovery information , Generating the second key recovery information and the third key recovery information based on the split key and the second distributed key, and the transmitting unit is configured to if the encryption key used to encrypt the shared data is updated, encryption And the shared data, and the second key recovery information, transmits the said third key recovery information to the terminal device, when the encryption key has not been updated, the encrypted and the shared data, it characterized that you send and the encryption key shares to the terminal device.

  The present invention also provides a storage server for storing the second distributed key essential for decrypting encrypted shared data and the encrypted shared data, and N terminals (N is an integer of 1 or more). In a data sharing system comprising an apparatus and a key generation apparatus, a group key generation step for generating a public key and a secret key, a distribution key generation step for generating a first distribution key, and the first distribution key A second distributed key generation step of generating the second distributed key capable of generating the secret key from the first distributed key and the second distributed key based on a secret key; A distributed key dividing step of dividing one distributed key into N + 1 different divided keys, and N + 1 divided keys divided in the distributed key dividing step, one for each of the N terminal devices and the storage server Distribute and N said terminals Said distributed public key to each location, is a computer program for executing a key distribution step of distributing said second distributed key to the storage server, to the computer.

  Further, the present invention provides migration source terminal device information that uniquely identifies a migration source terminal device that is an original terminal device that migrates the environment of the terminal device, and a terminal device that is a migration destination of the environment of the migration source terminal device. A receiving step for receiving terminal device migration information including migration destination terminal device information for uniquely identifying a certain migration destination terminal device, and for updating a split key when receiving the terminal device migration information in the receiving step A split key update information generation step for generating split key update information as information, and a terminal device and a storage server that do not include the split key update information generated in the split key update information generation step in the terminal device migration information; An update information distribution step to be distributed to the computer, and the distributed key splitting step generates a split key used by the transfer destination terminal device, and the key distribution step. Is a computer program, wherein said split key that the distributed key dividing step has generated, to send said public key to said destination terminal device.

  The present invention also provides a storage server for storing a second distributed key essential for decrypting encrypted shared data and the encrypted shared data, a terminal device, and data including a key generation device In a shared system, an encryption key generation step for generating an encryption key and first key recovery information from a public key sent from the key generation device, and an encryption step for encrypting shared data using the encryption key; Transmitting the encrypted shared data and the first key recovery information to the storage server, the encrypted shared data, the second key recovery information, and a third key A receiving step for receiving restoration information from the storage server; a split key sent from the key generation device; the second key restoration information received in the receiving step; and the third key restoration use. Affection A decryption step for decrypting the encrypted shared data received in the reception step using the encryption key restored in the encryption key restoration step; Is a computer program for causing a computer to execute.

In addition, the present invention includes a share generation step of generating a first share and a second share, which is information capable of generating the encryption key with only two pieces of information, and the transmission step includes encryption. The shared data, the first key recovery information, and the second share are transmitted to the storage server, and in the receiving step, the encryption unit step used for encrypting the shared data. If the encryption key is updated, the the encrypted shared data, and the second key recovery information, and the third key recovery information received from the storage server, the encryption key is If not updated, the shared data the encrypted, receives the second share, in the encryption key restoring step, the encryption key used in the encryption of the shared data in the encryption step Updated In this case, the encryption key is restored based on the split key sent from the key generation device, the second key restoration information received by the receiving unit, and the third key restoration information. and, when the encryption key has not been updated is a computer program which is characterized that you recover the encryption key on the basis of the second share between the first share.

Further, the present invention includes: a storage step of storing the master share the information of the group that produces the encryption key is information capable of restoring the master share only two information, the first split share When the split share generation step of generating a second split share before SL on the basis of the encryption key and said master share the master share and two only can generate information the encryption key information of the cryptographic key shares A share generating step for generating an encryption key share , wherein the transmitting step transmits the encrypted shared data, the first key recovery information, and the encryption key share to the storage server. and, in said receiving step, when the encryption key used in the encryption of the shared data in the encryption step is updated, and the encrypted shared data, the second key The original information, and the third key recovery information received from the storage server, if the encryption key has not been updated, and receives the shared data the encrypted, and the encryption key shares In the encryption key restoration step, when the encryption key used in the encryption of the shared data is updated in the encryption step, the split key sent from the key generation device and the reception unit receive An encryption key is restored based on the second key restoration information and the third key restoration information, and when the encryption key is not updated, the master share and the encryption key share a computer program characterized that you recover the encryption key based on and.

  In addition, the present invention provides a data sharing system including a storage server, a terminal device, and a key generation device, and receives the encrypted shared data and the first key recovery information from the terminal device. And storing the shared data received in the receiving step and the first key recovery information in association with each other, a second distributed key essential for decrypting the encrypted shared data, and a split key Based on the storing step, the first key recovery information, the split key, and the second distributed key, the second key recovery information and the third key recovery information are stored. A key recovery information generation step to be generated, a transmission step of transmitting the encrypted shared data, the second key recovery information, and the third key recovery information to the terminal device; Computer program for execution A gram.

Further, in the program of the present invention, in the receiving step, the the encrypted shared data from the terminal device, the first key recovery information, and receives a second share, in the storing step, wherein The shared data received in the receiving step, the first key recovery information, and the second share are stored in association with each other, and the second distributed key essential for decrypting the encrypted shared data And the split key, and in the key recovery information generation step, when the encryption key used for encryption of the shared data is updated in the terminal device, the first key recovery Based on the information, the split key, and the second distributed key, the second key recovery information and the third key recovery information are generated, and in the transmission step, the terminal device Used to encrypt the shared data If the serial encryption key is updated, and transmits the corresponding shared data encrypted, and the second key recovery information, and the third key recovery information to the terminal device, the encryption key There if not updated, characterized said the encrypted shared data, that you send a second share of the terminal device.

Further, in the program of the present invention, in the receiving step, the the encrypted shared data from the terminal device, the first key recovery information, and receives the encryption key shares, in the storing step, the received Storing the shared data received in step, the first key recovery information, and the encryption key share in association with each other, the second distributed key essential for decrypting the encrypted shared data, A split key, and in the key recovery information generation step, when the encryption key used for encryption of the shared data in the terminal device is updated, the first key recovery information; Based on the split key and the second distributed key, the second key recovery information and the third key recovery information are generated. In the transmission step, the shared information is generated by the terminal device. Used for data encryption When the No. key is updated, and the encrypted shared data, and the second key recovery information, transmits the said third key recovery information to the terminal device, the encryption key is If not updated, the encrypted shared data and the encryption key share are transmitted to the terminal device .

  According to the present invention, even if a terminal device owned by a group member is used by a malicious third party and the key held by the terminal device leaks, the shared data encrypted by another group member is It is possible to reduce the possibility of decryption by the three parties, it is possible to reduce the processing load when sharing data is first disclosed, and for the first time after updating the encryption key used for encryption of shared data It is possible to reduce the processing load when releasing shared data.

  Hereinafter, the first to third embodiments of the present invention will be described. First, the secret sharing method used in the first to third embodiments of the present invention will be described. The secret sharing method is a method for securely storing original secret information by distributing and storing secret information by several people. The (k, n) threshold secret sharing method is a kind of secret sharing method, and the secret information is divided into n pieces of divided information (shares) and stored, and k or more pieces of divided information are obtained. If possible, the original secret information can be restored. (Reference: “A. Shamir,“ How to share a secret, ”Communications of the ACM, Vol. 22, No. 11, pp. 612-613, 1979”)

In addition, RSA-KEM based on RSA (RSA) cipher, which is a key encapsulation technique (KEM) for securely delivering a cipher key used in common key cipher using public key cipher. Will be described. The outline of the procedure of RSA-KEM is as follows.
[Key Generation Procedure] An RSA private key (e, n) and a public key (d, (n)) are generated. Here, n = pq (p and q are prime numbers), ed≡1 (mod λ (n)) (e and λ (n) are prime and λ (n) = LCM (p−1, q−1) (LCM (a, b) is the least common multiple of a and b)).
[Encryption and Encryption Key Generation Procedure] (Step S101) A random number r is generated. Here, r satisfies the formula (1).

  (Step S102) r is converted into a character string using equation (2). Here, I2OSP is an inter-to-octet string conversion.

(Step S103) generated in the ciphertext _{C 0} (3) expression.

  (Step S104) The encryption key K is generated by equation (4). Here, KDF is (Key Delivery Function), and KeyLen is the key length of the encryption key.

[Decryption and Encryption Key Restoration Procedure] (Step S110) The character string R is restored by the equation (5).

(Step S111) The encryption key K is restored by the equation (6).

(Reference: “V. Shop,“ FCD 18033-2 Encryption algorithms-Part 2: Asymmetric ciphers ”, http://shoop.net/iso/std6.pdf”)

(First embodiment)
Next, a first embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a configuration diagram showing a data sharing system 100 according to the present embodiment. In the illustrated example, the data sharing system 100 includes group member terminals (terminal devices) 1-1, 1-2,..., 1-N, a storage server 2, a certificate authority (key generation device) 3, and communication. And a network 4. The group member terminals 1-1, 1-2,..., 1 -N can access the storage server 2 via the communication network 4 and send / receive data to / from the storage server 2. The communication network 4 may be a wireless network or a wired network. For example, the communication network 4 may be composed of the Internet, a fixed telephone network, a mobile telephone network, and the like.

  The group member terminals 1-1, 1-2,..., 1-N may be devices that can be used while moving (for example, portable devices), or devices that are used in a fixed manner ( For example, a stationary apparatus such as a personal computer may be used. Examples of the portable terminal device include a mobile communication network terminal device provided by a mobile communication carrier (for example, a mobile phone having a data communication function, a data communication terminal device, etc.), a PDA (Personal Digital Assistants: personal). Information equipment). In the case of a PDA, a communication unit may be built in or a communication unit may be connected from the outside.

  The group member terminals 1-1, 1-2,..., 1-N include an arithmetic processing unit, a storage unit, a communication unit, an input unit, a display unit, an external interface, and the like. The arithmetic processing unit includes a CPU (central processing unit), a memory, and the like. The storage unit stores, for example, a hard disk device, a magneto-optical disk device, an optical disk device such as a DVD (Digital Versatile Disk), a nonvolatile memory such as a flash memory, and a volatile memory such as a DRAM (Dynamic Random Access Memory). It is comprised by the apparatus or those combination. The storage unit stores various data such as a computer program executed by the CPU. The communication unit performs data communication via the communication network 4. The input unit includes input devices such as a keyboard, a numeric keypad, and a mouse, and performs data input according to user operations. The display unit includes a display device such as a CRT (Cathode Ray Tube) or a liquid crystal display device, and performs data display. The external interface directly transmits / receives data to / from an external device by wire or wireless.

  The group member terminals 1-1, 1-2,..., 1 -N execute an encryption program generation function, a transmission function, a reception function, an encryption key restoration function, A decryption function, an update information reception function, a split key update function, and a share generation function are realized. The computer program may be fixedly installed in the group member terminals 1-1, 1-2,..., 1-N, or a communication line when a computer program on the server is required. It may be downloaded via.

  The storage server 2 includes an arithmetic processing unit, a storage unit, a communication unit, an input unit, a display unit, an external interface, and the like. The arithmetic processing unit includes a CPU and a memory. The storage unit includes, for example, a hard disk device, a magneto-optical disk device, an optical disk device such as a DVD, a nonvolatile memory such as a flash memory, a storage device such as a volatile memory such as a DRAM, or a combination thereof. The storage unit stores various data such as a computer program executed by the CPU. The communication unit performs data communication via the communication network 4. The input unit includes input devices such as a keyboard, a numeric keypad, and a mouse, and performs data input according to user operations. The display unit is composed of a display device such as a CRT or a liquid crystal display device, and displays data. The external interface directly transmits / receives data to / from an external device by wire or wireless. Further, the storage unit has a data management function for storing various data transmitted from the group member terminals 1-1, 1-2, ..., 1-N. The reception function, storage function, key recovery information generation function, transmission function, and split key update function of the storage server 2 execute a computer program for the CPU of the storage server 2 to realize the above functions. It is realized by.

  The certificate authority 3 includes an arithmetic processing unit, a storage unit, a communication unit, an input unit, a display unit, an external interface, and the like. The arithmetic processing unit includes a CPU and a memory. The storage unit includes, for example, a hard disk device, a magneto-optical disk device, an optical disk device such as a DVD, a nonvolatile memory such as a flash memory, a storage device such as a volatile memory such as a DRAM, or a combination thereof. The storage unit stores various data such as a computer program executed by the CPU. The communication unit performs data communication via the communication network 4. The input unit includes input devices such as a keyboard, a numeric keypad, and a mouse, and performs data input according to user operations. The display unit is composed of a display device such as a CRT or a liquid crystal display device, and displays data. The external interface directly transmits / receives data to / from an external device by wire or wireless. The group key generation function, the distributed key generation function, the distributed key division function, the key distribution function, the reception function, the divided key update information generation function, and the update information distribution function of the certificate authority 3 This is realized by the CPU executing a computer program for realizing the above functions.

[Advance preparation]
Next, preparations in the present embodiment will be described with reference to FIG. FIG. 2 is a sequence diagram showing a preparatory processing operation in the present embodiment. In advance preparation, the certificate authority 3 creates a key for encryption, and distributes the created key to the group member terminals 1-1 and 1-2 and the storage server 2.

(Step P1-1) The certificate authority 3 generates a pair (pk _G , sk _G ) of a group public key and a secret key. Hereinafter, the public key of RSA encryption will be described as pk _G and the secret key will be described as sk _G. That is, pk _G = (e, n), sk _G = (d), where n = pq (p and q are prime numbers, p = 2p ′ + 1, q = 2q ′ + 1, p ′ and q ′ are prime numbers) Ed≡1 (mod λ (n)) (e and λ (n) are relatively prime and λ (n) = LCM (p−1, q−1) = 2p′q ′).
(Step P1-2) the certificate authority 3 generates randomly distributed key sk _1. Here, the distributed key sk ₁ is an even number that satisfies 1 ≦ sk ₁ ≦ λ (n) −1. Note that it is possible to generate sk _G generated in step P1-1 using the distributed key sk ₁ and a distributed key sk ₂ described later. Subsequently, the certificate authority 3 uses the distributed key sk ₁ and the sk _G generated in step P1-1 to obtain a distributed key sk ₂ that satisfies the following expression (7).

(Step P1-3) The certification authority 3 divides the distributed key sk ₁ into N + 1 pieces by using the (2, N + 1) threshold secret sharing method, and sk _1,1 , sk ₁ , ₂ ,. _{1, N} , sk _{1, S} split keys are generated. Here, N is the number of group member terminals included in the data sharing system, and N is an integer of 1 or more. Also, since the distributed key sk ₁ is divided using the (2, N + 1) threshold secret sharing scheme, sk _1,1 , sk _1,2 ,..., Sk obtained by dividing the distributed key sk ₁ into N + 1 pieces. It is possible to generate the distributed key sk ₁ using at least two types of split keys among _{1, N} , sk _{1, and S} split keys. sk _{1, i} (i = 1,..., N) satisfies the following expression (8). Here, f (x) = sk ₁ + ax (a is a random number), and f (x) is a polynomial over a finite field GF (λ (n)). Further, X _i = 2 × ID _i (ID _i is the ID of the group member terminal 1-i). sk _{1, S} satisfies the following expression (9).

Subsequently, the certificate authority 3 distributes the group public key pk _G and sk _{1, i} (i = 1,..., N) to each group member terminal included in the data sharing system, and the storage server 2. Distribute sk _{1, s} and sk ₂ . In the example shown in FIG. 2, the data sharing system includes two group member terminals. Pk _G and sk _1,1 are distributed to the group member terminal 1-1, and the group member terminal 1-2 is distributed. Distributes pk _G and sk ₁ and ₂ , and distributes sk _{1, s} and sk ₂ to the storage server 2.

[Shared data storage processing: Shared data new storage, shared data update storage (with key update)]
Next, processing for newly saving shared data or updating and saving shared data in the present embodiment when there is a key update will be described with reference to FIGS. FIG. 3 is a diagram showing a data format (hereinafter referred to as a member terminal format) of a list of data (local data list) stored in the storage unit of the group member terminal in the present embodiment. In the illustrated example, the member terminal format has four attributes of data ID, data label, last reference time, and encrypted data. The data ID is an identifier for uniquely identifying data within the data sharing system. The data label is a name representing the content and form of data such as a file name. The last reference time is the time when shared data was last referenced. Encrypted data is data obtained by encrypting shared data.

  FIG. 4 is a diagram showing a data format (hereinafter referred to as a storage server format) of data stored in the storage unit of the storage server 2 in the present embodiment. In the illustrated example, the storage server format has six attributes: a data ID, a user ID, a data label, a last update time, encrypted data, and key recovery information. The three attributes of data ID, data label, and encrypted data are the same as the attributes of the member terminal format. The user ID is an identifier for uniquely identifying the group member terminal that generated the encrypted data. The last update time is the time when the shared data was last updated. The key recovery information is information used when creating a key used when decrypting encrypted data.

  FIG. 5 is a diagram illustrating an example of data stored in the storage unit of the storage server 2 in the present embodiment. In the illustrated example, the storage unit of the storage server 2 stores X data from the data record 1 to the data record X. The format of each data record is the same as in FIG.

  FIG. 6 is a sequence diagram illustrating a processing operation in which the group member terminal 1-1 stores group shared data in the storage server 2 in the present embodiment.

User using the (step W1-1) group member terminal 1-1 operates the group member terminal 1-1, to prepare a shared data _{M G} to group member terminal 1-1. In addition, the file name of _{M G} and the data label _{L 1.}
(Step W1-2) Using the key encapsulation technique, the group member terminal 1-1 generates the encryption key K _M and the key recovery information C _0,1 from pk _G.

(Step W1-3) common key encryption, the group member terminal 1-1, encrypts the shared data _{M G} with _{K M.} The shared data after encryption (encrypted data) is E _KM (M _G ). After encryption completion, the group member terminal 1-1 deletes the _{M G} and _{K M} for the group member terminal 1-1 stores.
(Step W1-4) The group member terminal 1-1 prompts the user to input information for user authentication, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step W1-5) The group member terminal 1-1 has the ID (ID ₁ ), E _KM (M _G ), C ₀ , ₁ , L ₁ , and UID possessed by the group member terminal 1-1. The PN is sent to the storage server 2.
(Step W1-6) The storage server 2 collates whether the set of UID and PN transmitted from the group member terminal 1-1 matches the previously stored set of UID and PN. If they match, the storage server 2 assigns a data ID (D ₁ ) to the data set received from the group member terminal 1-1. Also, the storage server 2 stores ID ₁ , E _KM (M _G ), C _0,1 , L ₁ , D _1, and the last update time (T _{S, 1} ) according to the storage server format. Stored in the storage unit. The latest update time (T _{S, 1} ) is the time at the time of storage.

(Step W1-7) The storage server 2 transmits an ACK (Acknowledgement) message to the user terminal 1 in order to notify the group member terminal 1-1 that the storage process in Step W1-6 has been completed. The ACK message includes D ₁ and T _{S, 1} .
(Step W1-8) After receiving the ACK message from the storage server 2, the group member terminal 1-1 deletes C _0,1 stored in the group member terminal 1-1. The group member terminal 1-1 creates an entry for the data to the local data list to the new, the _{D 1} as the data ID, and _{L 1} as the data _label, T 1, 1 a _{(= T S, 1)} As the last reference time, E _KM (M _G ) is stored as encrypted data according to the member terminal format. Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

[Shared data storage processing: Shared data update storage (no key update)]
Next, shared data update storage processing in the present embodiment when there is no key update will be described with reference to FIG. As an example of the case of updating and storing shared data without a key update, there is a case where a group member terminal that updates shared data updates shared data previously registered in the storage server. In this case, by using the encryption key K _M was used when you save the shared data before, it is possible to encrypt the shared data again updated, omitted key generation procedure.

  FIG. 7 is a sequence diagram illustrating a processing operation in which the group member terminal 1-1 updates and saves the group shared data in the storage server 2 without updating the encryption key in the present embodiment.

(Step Wa1-1) The user who uses the group member terminal 1-1 operates the group member terminal 1-1 to prepare shared data M _G ′ on the group member terminal 1-1. In addition, to 'the file name of the data label _{L 1' M G} and.
(Step Wa1-2) common key encryption, the group member terminal 1-1, encrypts the shared data _{M G} 'using a _{K M.} Shared data encrypted (encrypted data) and _E KM _{(M G} '). After completing the encryption, the group member terminal 1-1 deletes M _G ′ stored in the group member terminal 1-1.
(Step Wa1-3) The group member terminal 1-1 prompts the user to input information for user authentication, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step W1a-4) group member terminal 11, the ID (ID ₁₎ of the group member terminal 1-1 _{has, 'and, L 1 E KM (M G} )' and, a data ID _{(D 1)} UID and PN are sent to the storage server 2.
(Step W1a-5) The storage server 2 collates whether or not the set of UID and PN transmitted from the group member terminal 1-1 matches the set of UID and PN stored in advance. If they match, the storage server 2 sets ID ₁ , E _KM (M _G '), L ₁ ', and the last update time (T _{S, 1} ') according to the format of the storage server format. The storage unit of the storage server 2 to be stored is overwritten. The latest update time (T _{S, 1} ′) is the time at the time of the overwriting.

(Step W1a-6) The storage server 2 transmits an ACK message to the user terminal 1 in order to notify the group member terminal 1-1 that the storage process in Step W1a-5 has been completed. The ACK message includes T _{S, 1} '.
(Step W1a-7) After receiving the ACK message from the storage server 2, the group member terminal 1-1 uses D ₁ as the data ID and L ₁ ′ as the data label in the entry for the data in the local data list. Store T _1,1 ′ (= T _{S, 1} ′) as the last reference time and E _KM (M _G ′) as encrypted data according to the member terminal format. Note that E _KM (M _G ′) may or may not be deleted, and may be selected by setting of a setting file or the like.

[Shared data reference processing]
Next, processing when the group member terminal 1-2 refers to the shared data registered in the storage server 2 by the group member terminal 1-1 will be described with reference to FIGS.

FIG. 8 is a diagram showing a data list transmitted from the storage server to each group member terminal in the present embodiment. The data list stores data labels of data stored in the storage unit of the storage server 2. The data list stores the data label and the last update time of the data label in association with each other. In the illustrated example, the data labels of data stored in the storage server 2 are data label 1 (D ₁ ), data label 2 (D ₂ ),..., Data label X (D _X ). Further, the last update time of the data label 1 (D ₁ ) is the last update time 1 (L ₁ ), the last update time of the data label 2 (D ₂ ) is the last update time 2 (L ₂ ),. The last update time of the data label X (D _X ) is the last update time X (L _X ).

  FIG. 9 is a sequence diagram showing processing operations when the group member terminal 1-2 refers to the shared data registered in the storage server 2 by the group member terminal 1-1 in the present embodiment.

  (Step R1-0) The storage server 2 sends a data list to the group member terminal 1-1 and the group member terminal 1-2. For example, the data list transmission timing may be transmitted every time the data list is updated. Further, it may be transmitted only when there is a data access request from the user terminal.

  (Step R1-1) The group member terminal 1-2 receives an input of a reference request for shared data from the user. Subsequently, the group member terminal 1-2 prompts the user to input user authentication information, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step R1-2) group member terminal 1-2, the data ID of the reference data _{M G (D 1),} the ID of the group member terminal 1-2 has (ID _2), UID and data and a PN The message is sent to the storage server 2 as a request message. If the data has been referred to in the past, the last reference time (T _2,1 ) of the data is added to the data request message. Information indicating the presence / absence of encrypted data E _KM (M _G ) in the group member terminal may be added to the data request message. In the illustrated example, since the group member terminal 1-2 refers to the data _MG for the first time, the last reference time (T _2,1 ) is not included in the request message.

(Step R1-3) The storage server 2 collates whether the set of UID and PN transmitted from the group member terminal 1-2 matches the set of UID and PN stored in advance. If they match, the storage server 2 uses C _0,1 , sk _{1, S} and sk ₂ to obtain the key recovery information C ₁ = C _0,1 ^W1 and C ₂ = C _0,1 Generate. W1 satisfies the following expression (10).

(Step R1-4) The storage server 2 sends E _KM (M _G ), the last update time (T _{S, 1} ), C ₁ and C ₂ to the group member terminal 1-2. In step R1-0, processing for not sending E _KM (M _G ) when information notifying that “the encrypted data exists in the group member terminal” is added to the request message and there is no update of the data. It is also good. Here, as a method for determining whether or not the data has been updated, for example, the last reference time (T _2,1 ) sent from the group member terminal and the last update time (TS _{, 1} ), and if the values are different, there is a method of determining that the value has been updated.

(Step R1-5) group member terminal _1-2, and _{sk 1, 2,} and _{C 1,} to restore the _{K M} by using a _{C 2.} The last reference time (T _2,1 ) is updated to T _{S, 1} . Incidentally, restoration method of K _M are as follows. First, r is restored from the following equation (11). Subsequently, _KM is restored from the following equation (12).

(Step R1-6) group member terminal 1-2 uses the _{K M} decrypts the _E KM _{(M G),} to obtain the _{M G.}
(Step R1-7) after reference _{M G,} group member terminal 1-2 and _{K M,} and _{M G,} and _{C 1,} to remove the _{C 2.} Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

[Environment migration process]
Next, a procedure for shifting the environment of the group member terminal 1-2 to the group member terminal 1-3 when the group member terminal 1-2 is lost will be described with reference to FIG. The environment migration means that an environment capable of executing encryption / decryption of shared data possessed by a certain group member terminal is migrated to another group member terminal. In this embodiment, the transfer source terminal device is the group member terminal 1-2, and the transfer destination terminal device is the group member terminal 1-3. FIG. 10 is a sequence showing a processing operation for migrating an environment capable of executing encryption / decryption of shared data of the group member terminal 1-2 to the group member terminal 1-3 in the present embodiment. FIG.

  (Step RE1-1) The group member terminal 1-3 receives terminal device transition information including the loss of the group member terminal 1-2 and a request to migrate the environment of the group member terminal 1-2 to the group member terminal 1-3. To the certificate authority 3. The terminal device migration information includes the terminal ID of the group member terminal 1-2 as the original terminal device that migrates the environment of the terminal device, and the terminal of the group member terminal 1-3 as the destination terminal device that migrates the environment of the terminal device. ID is included. The notification method may be notified online or may be notified offline.

(Step RE1-2) The certificate authority 3 receives terminal transition information from the group member terminal 1-3. Subsequently, the certification authority 3 updates the split key update share (split key update information) SR _, which updates the existing split key to the group member terminal 1-1 not included in the terminal environment information and the storage server _{. 1} and _{S R,} generates and _S, and sends the split key update shares _{S R, 1} in the group member terminal 1-1, share a split key update to the storage server 2 _{S R,} and sends the _S. S _{R, i} (i = 1,..., N) satisfies the following expression (13). S _{R and S} satisfy the following expression (14). Here, f _k (x) = a _k x (a _k is a random number), and f _k (x) is a polynomial over a finite field GF (λ (n)).

(Step RE1-3) group member terminal 1-1 receives the split key update shares _{S R, 1} from the authentication station 3, using the received _{S R, 1} to update an existing split key _{sk 1, 1} , Sk ′ _1,1 are generated. After the generation, the group member terminal 1-1 deletes S _{R, 1} and sk _1,1 . The storage server 2 receives the split key update shares S _{R, S} from the certificate authority 3, updates the existing split keys sk _{1, S} using the received S _{R, S ,} and generates sk ' _{1, S.} . After generation, the storage server 2 deletes S _{R, S} and sk _{1, S.} Note that sk ′ _{1, i} (i = 1,..., N) is generated using the following equation (15). sk ′ _{1, S} is generated using the following equation (16).

(Step RE1-4) The certificate authority 3 generates secret key shares sk ′ _1,3 for the group member terminals 1-3. The generation is performed using the above equation (15).
(Step RE1-5) The certification authority 3 sends the secret key shares sk ′ _1,3 for the group member terminal 1-3 and the public key pk _G to the group member terminal 1-3.
(Step RE1-6) The certification authority 3 notifies the storage server 2 that the environment of the group member terminal 1-2 has been shifted to the group member terminal 1-3.

As described above, since the shared key sk ₂ held by the storage server is necessary for decryption of the encrypted shared data, the terminal device owned by the group member is used by a malicious third party, and the terminal Even if the key held by the apparatus is leaked, it is possible to reduce the possibility that shared data encrypted by other group members can be decrypted by a third party. In addition, the key used for encrypting the shared data, which was conventionally required when publicly sharing the shared data for the first time, is encrypted with the public key owned by the group member, that is, the key encryption process for the number of group members. It is possible to reduce the processing load when sharing data is first disclosed. In addition, since it is not necessary to perform key encryption processing for the number of group members, which was necessary when the shared data was released for the first time after updating the encryption key used to encrypt the shared data, It is possible to reduce the processing load when the shared data is made public for the first time after updating the encryption key used for encryption.

(Second Embodiment)
Next, a second embodiment of the present invention will be described with reference to the drawings. In this embodiment, in addition to the key exchange process by the key encapsulation technique of the first embodiment, a key exchange process by secret sharing is added. Specifically, when newly registering shared data in the storage server or referring to shared data for the first time, the group member terminal uses the secret sharing method to set the encryption key of the data to ₂ of S ₁ and S 2. Divide into two shares. Note that the encryption key can be generated using only two shares S ₁ and dispersed S _2. Then, the group member terminal may send the shares S ₁ to the storage server holds shares S ₂ in the own terminal. The data sharing system according to the present embodiment is the same as the data sharing system according to the first embodiment.

[Advance preparation]
Next, advance preparation in the present embodiment will be described. The preparatory processing operation in the present embodiment is performed in the same manner as the preparatory processing operation of the first embodiment.

[Shared data storage processing: Shared data new storage, shared data update storage (with key update)]
Next, processing for newly saving shared data or updating and saving shared data in the present embodiment when there is a key update will be described with reference to FIGS. FIG. 11 is a diagram showing a data format (hereinafter referred to as a member terminal format) of a list of data (local data list) stored in the storage unit of the group member terminal in the present embodiment. In the illustrated example, the member terminal format has six attributes: data ID, data label, last reference time, last key reference time, encryption key share, and encrypted data. The data ID is an identifier for uniquely identifying data within the data sharing system. The data label is a name representing the content and form of data such as a file name. The last reference time is the time when shared data was last referenced. The last key reference time is the time when the encryption key was last referenced. The encryption key share is a share created by group member terminals by distributing an encryption key by a secret sharing method. Encrypted data is data obtained by encrypting shared data.

  FIG. 12 is a diagram showing a data format (hereinafter referred to as a storage server format) of data stored in the storage unit of the storage server 2 in the present embodiment. In the illustrated example, the storage server format has eight data IDs, data labels, last update time, last key update time, encrypted data, key recovery information, user ID, and encryption key share. Has attributes. The four attributes of data ID, data label, encrypted data, and encryption key share are the same as those of the member terminal format. The user ID is an identifier for uniquely identifying the group member terminal. The last update time is the time when the shared data was last updated. The last key update time is the time when the encryption key was last updated. The key recovery information is information used when creating a key used when decrypting encrypted data.

  FIG. 13 is a sequence diagram illustrating a processing operation in which the group member terminal 1-1 stores group shared data in the storage server 2 in the present embodiment.

User using the (step W2-1) group member terminal 1-1 operates the group member terminal 1-1, to prepare a shared data _{M G} to group member terminal 1-1. In addition, the file name of _{M G} and the data label _{L 1.}
Using (step W2-2) key encapsulation technique, group member terminal 1-1 generates the encryption key _{K M} and the key decoding information _{C 0, 1} from pk _G.

(Step W2-3) common key encryption, the group member terminal 1-1, encrypts the shared data _{M G} with _{K M.} The shared data after encryption (encrypted data) is E _KM (M _G ). After encryption completion, the group member terminal 1-1 deletes the _{M G} group members terminal 1-1 stores.
(Step W2-4) group member terminal 1-1 creates the share _{S 1,1} and share _{S 1, 2} corresponding to the _{K M} with (2,2) threshold dispersion method. Incidentally, _{K M} can be generated using only two shares _{S 1,1} and share _{S 1, 2} dispersed. After creating a share, to remove the _{K M.} The share S _{i, 1} is generated using the following equation (17). Here, X _{i, 1} = h (ID _i ) (h is a hash function), u ₁ (x) = c ₁ x + K _M , u ₁ (x) is a polynomial on a finite field GF (2 ^b −1) ( b is the key length of the encryption key).

The share S _{i, 2} is generated using the following equation (18). Here, X _{i, 2} = h (ID _i ‖r ₁ ) (where r ₁ is a random number and h is a hash function).

  (Step W2-5) The group member terminal 1-1 prompts the user to input user authentication information, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step W2-6) The group member terminal 1-1 has the ID (ID ₁ ), S _1,1 , E _KM (M _G ), C _0,1 , and L held by the group member terminal 1-1. ₁ , UID, and PN are sent to the storage server 2.
(Step W2-7) The storage server 2 collates whether or not the pair of UID and PN transmitted from the group member terminal 1-1 matches the pair of UID and PN stored in advance. If they match, the storage server 2 assigns a data ID (D ₁ ) to the data. Also, the storage server 2 has ID ₁ , L ₁ , E _KM (M _G ), C ₀ , ₁ , S ₁ , ₁ , D ₁ , last update time (T _{S, 1} ), and last The key update time (TK _{S, 1} ) is stored in the storage unit of the storage server 2 according to the format of the storage server format. The latest update time (T _{S, 1} ) and the last key update time (TK _{S, 1} ) are the times at the time of storage.

(Step W2-8) The storage server 2 transmits an ACK (Acknowledgement) message to the user terminal 1 in order to notify the group member terminal 1-1 that the storage process in Step W2-7 has been completed. The ACK message includes D ₁ and T _{S, 1} and TK _{S, 1} .
(Step W2-9) After receiving the ACK message from the storage server 2, the group member terminal 1-1 deletes C _0,1 and S _1,1 stored in the group member terminal 1-1. The group member terminal 1-1 creates an entry for the data to the local data list to the new, the _{D 1} as the data ID, and _{L 1} as the data _label, T 1, 1 a _{(= T S, 1)} As the final reference time, TK _1,1 (= TK _{S, 1} ) is stored as the final key reference time, S _1,2 is stored as the encryption key share, and E _KM (M _G ) is stored as the encrypted data according to the member terminal format. To do. Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

[Shared data storage processing: Shared data update storage (no key update)]
Next, shared data update storage processing in the present embodiment when there is no key update will be described. The shared data update storage processing operation in the present embodiment when there is no key update is performed in the same manner as the shared data update storage processing operation in the first embodiment when there is no key update.

[Shared data reference processing]
Next, processing when the group member terminal 1-2 refers to the shared data registered in the storage server 2 by the group member terminal 1-1 will be described with reference to FIG. FIG. 14 is a sequence diagram showing processing operations when the group member terminal 1-2 refers to the shared data registered in the storage server 2 by the group member terminal 1-1 in the present embodiment.

  (Step R2-0) The storage server 2 sends the data list to the group member terminal 1-1 and the group member terminal 1-2. For example, the data list transmission timing may be transmitted every time the data list is updated. Further, it may be transmitted only when there is a data access request from the user terminal.

  (Step R2-1) The group member terminal 1-2 receives an input of a reference request for shared data from the user. Subsequently, the group member terminal 1-2 prompts the user to input user authentication information, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step R2-2) group member terminal 1-2, the data ID of the reference data _{M G (D 1),} the ID of the group member terminal 1-2 has (ID _2), UID and data and a PN The message is sent to the storage server 2 as a request message. If the data has been referred to in the past, the last reference time (T _2,1 ) and the last key reference time (TK _2,1 ) of the data are added to the data request message. Information indicating the presence / absence of encrypted data E _KM (M _G ) in the group member terminal may be added to the data request message. In the illustrated example, since the group member terminal 1-2 refers to the data _MG for the first time, the last reference time (T _2,1 ) and the last key reference time (TK _2,1 ) are included in the request message. Not.

(Step R2-3) The storage server 2 collates whether the set of UID and PN transmitted from the group member terminal 1-2 matches the previously stored set of UID and PN. If they match, the storage server 2 determines whether or not the encryption key for the data held by the storage server 2 has been updated after the group member terminal 1-2 refers to the data. Here, as a method for determining whether or not the encryption key for the data is updated, for example, the last key reference time (TK _2,1 ) of the encryption key sent from the group member terminal and the storage server 2 store the data. There is a method of comparing the last update time (T _{S, 1} ) of the encryption key for the data and determining that it has been updated if the values are different.

(Step R2-4) When the shared data is newly referred to or when the shared data with the key update is referred to, the group member terminal creates a key and refers to the shared data. The reference method will be described later.
(Step R2-5) The group member terminal refers to shared data that has no key update. The reference method will be described later.

  Next, a procedure when the group member terminal creates a key and refers to the shared data in step R2-4 will be described with reference to FIG. FIG. 15 is a sequence diagram showing a processing operation in which a group member terminal creates a key and refers to shared data.

(Step R2-4a) The storage server 2 uses C _0,1 , sk _{1, S} , and sk ₂ to use key recovery information C ₁ = C _0,1 ^W1 and C ₂ = C _0,1. ^W2 is generated. Note that W1 satisfies the above equation (10). Further, W2 satisfies the above equation (11).

(Step R2-4b) The storage server 2 has D ₁ , E _KM (M _G ), last update time (T _{S, 1} ), last key update time (TK _{S, 1} ), C ₁ , to send a C ₂ to group members terminal 1-2.
(Step R2-4c) group member terminal _1-2, and _{sk 1, 2,} and _{C 1,} to restore the _{K M} by using a _{C 2.} Incidentally, restoration method of K _M are as follows. First, r is restored from the above equation (13). Subsequently, _KM is restored from the above equation (14).

(Step R2-4d) group member terminal 1-2 uses the _{K M} decrypts the _E KM _{(M G),} to obtain the _{M G.}
(Step R2-4e) The group member terminal 1-2 creates a share S _2,1 and a share S _2,2 corresponding to K _M using the (2,2) threshold distribution method.
(Step R2-4f) group member terminal 1-2, and _{D 1,} and ID _2, it sends a _{S 2,1} to the storage server 2. Moreover, after the reference of _{M G,} group member terminal 1-2 and _{K M,} and _{M G,} and _{C 1,} and _{C 2,} to remove the _{S 2,1.} In addition, TK ′ _{2,1 is} an entry for the data in the local data list, D ₁ is a data ID, L ₁ is a data label, and T ′ _2,1 (= T _{S, 1} ) is a final reference time. Store (= TK _{S, 1} ) as the last key reference time, S _2,2 as the encryption key share, and E _KM (M _G ) as the encrypted data according to the member terminal format. Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

  Next, the procedure when the group member terminal refers to the shared data with no key update in step R2-5 will be described with reference to FIG. FIG. 16 is a sequence diagram showing a processing operation in which a group member terminal refers to shared data with no key update.

(Step R2-5a) The storage server 2 sends the encryption key shares S _2,1 , E _KM (M _G ), and the last update time (T _{S, 1} ) to the group member terminal 1-2. In step R2-1, information notifying that “the encrypted data exists in the group member terminal” is added to the request message, and if there is no update of the data, processing for not sending E _KM (M _G ) It is also good. Here, as a method for determining whether or not the data has been updated, for example, the last reference time (T _2,1 ) sent from the group member terminal and the last update time (TS _{, 1} ), and if the values are different, there is a method of determining that the value has been updated.

(Step R2-5b) group member terminal _1-2, restores the _{K M} with the _{S 2, 2,} and _{S 2,1.}
(Step R2-5c) group member terminal 1-2 uses the _{K M} decrypts the _E KM _{(M G),} to obtain the _{M G.}
(Step R2-5d) after reference _{M G,} group member terminal 1-2 deletes the _{K M,} and _{M G,} and _{S 2,1.} Further, the group member terminal 1-2 overwrites the value of _T′2,1 of the entry for the data in the local data list as the value of TS _{, 1} . Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

[Environment migration process]
Next, a procedure for shifting the environment of the group member terminal 1-2 to the group member terminal 1-3 when the group member terminal 1-2 is lost will be described. The migration procedure in this embodiment is performed in the same manner as the migration procedure in the first embodiment.

As described above with respect to the second embodiment, in this embodiment, a key exchange process based on secret sharing is added to the key exchange process based on the key encapsulation technique of the first embodiment. Therefore, when the group member terminal refers to the encrypted data using the same encryption key, it is not necessary to acquire the key recovery information C ₁ and C ₂ from the storage server, and only the share S ₁ needs to be sent. Therefore, the message size between the user terminal and the storage server can be reduced. For example, if the key length of the public key encryption is 1024 bits and the key length of the common key encryption is 256 bits, 1792 bits can be reduced per data reference. Moreover, since it is not necessary to perform exponentiation and multiplication on the user terminal side, the load on the user terminal is reduced.

(Third embodiment)
Next, a third embodiment of the present invention will be described with reference to the drawings. In the present embodiment, information called a master share, which is basic information for generating an encryption key, is generated in a group member terminal, and an encryption key and an encryption key share are generated using the generated master share. The encryption key can be generated using only the encryption key share and the master share. Further, the master share is distributed to two divided shares of the divided share _{SMS, 1} (first divided share) and the divided share _{SMS, 2} (second divided share) by the secret sharing method. The master share can be generated using only two divided shares _{SMS, 1} and _{SMS, 2} distributed. The data sharing system according to the present embodiment is the same as the data sharing system according to the first embodiment.

[Advance preparation]
Next, advance preparation in the present embodiment will be described.
(Step P3-1) The certificate authority 3 generates a pair (pk _G , sk _G ) of a group public key and a secret key. Hereinafter, the public key of RSA encryption will be described as pk _G and the secret key will be described as sk _G.
(Step P3-2) the certificate authority 3 generates randomly distributed key sk _1. Subsequently, the certificate authority 3 uses the distributed key sk ₁ and the sk _G generated in step P1-1 to obtain a distributed key sk ₂ that satisfies the equation (7).

(Step P3-3) The certificate authority 3 divides the distributed key sk ₁ into N + 1 pieces by using the (2, N + 1) threshold secret sharing method, and sk _1,1 , sk ₁ , ₂ ,. _{1, N} , sk _{1, S} are generated. Here, N is the number of group member terminals included in the data sharing system, and S = N + 1. Subsequently, the certificate authority 3 distributes the group public key pk _G and sk _{1, i} (i = 1,..., N) to each group member terminal included in the data sharing system, and the storage server 2. Distribute sk _{1, S} and sk ₂ .
(Step P3-4) Each group member terminal performs an initial setting of the master share, and holds the master share (MS _i ) in its own terminal. An initial setting method of the master share will be described later.

  Next, the procedure in which the group member terminal performs the initial setting of the master share in step P3-4 will be described with reference to FIG. FIG. 17 is a sequence diagram showing the processing operation in which the group member terminal performs the initial setting of the master share.

(Step P3-4a) The group member terminal 1-1 generates a master share MS ₁ . The master share MS _i is generated from the following equation (19). Here, X _{MS, i} = h (ID _i ) (h is a hash function, i = 1,..., N + 1), g (x) is a polynomial over a finite field GF (2 ^b −1) (b is an encryption key) Key length).

(Step P3-4b) The group member terminal 1-1 uses the (2, 2) threshold distribution method _, and the split share SMS _{, 1, 1} and the split share SMS _{, 1 , 2} , corresponding to the master share MS ₁ , Is generated. Incidentally, the master share MS ₁ is divided share _{S MS, 1, 1} and the split share _{S MS,} can be generated using only _1,2. Further, the divided share _{SMS, i, 1} is generated using the following equation (20).

Further, the divided share _{SMS, i, 2} is generated using the following equation (21). Here, XMS _{, 1,2} = h (ID _i ‖r ₃ ) (r ₃ is a random number, h is a hash function, i = 1,..., N + 1).

(Step P3-4c) The group member terminal 1-1 sends the ID (ID ₁ ) of the group member terminal 1-1 and the SMS _{, 1, 2} to the storage server 2.
(Step P3-4d) The group member terminal 1-1 sends SMS _{, 1, 1} to the external device. The external device is, for example, a storage device such as a USB memory.
(Step P3-4e) The group member terminal 1-1 deletes SMS _{, 1, 1} and SMS _{, 1 , 2} .

[Shared data storage processing: Shared data new storage]
Next, shared data new storage processing will be described with reference to FIGS. FIG. 18 is a diagram showing a data format (hereinafter referred to as a member terminal format) of a list of data (local data list) stored in the storage unit of the group member terminal in the present embodiment. In the illustrated example, the member terminal format has four attributes of data ID, data label, last reference time, and encrypted data. The data ID is an identifier for uniquely identifying data within the data sharing system. The data label is a name representing the content and form of data such as a file name. The last reference time is the time when shared data was last referenced. Encrypted data is data obtained by encrypting shared data.

  FIG. 19 is a diagram showing a data format (hereinafter referred to as a storage server format) of data stored in the storage unit of the storage server 2 in the present embodiment. In the illustrated example, the storage server format has seven attributes: data ID, data label, last update time, encrypted data, key recovery information, user ID, and encryption key share. The four attributes of data ID, data label, encrypted data, and encryption key share are the same as those of the member terminal format. The user ID is an identifier for uniquely identifying the group member terminal. The last update time is the time when the shared data was last updated. The key recovery information is information used when creating a key used when decrypting encrypted data.

  FIG. 20 is a sequence diagram illustrating a processing operation in which the group member terminal 1-1 stores group shared data in the storage server 2 in the present embodiment.

User using the (step W3-1) group member terminal 1-1 operates the group member terminal 1-1, to prepare a shared data _{M G} to group member terminal 1-1. In addition, the file name of _{M G} and the data label _{L 1.}
(Step W3-2) Using the key encapsulation technique, the group member terminal 1-1 generates the encryption key K _M and the key decryption information C _0,1 from pk _G.

(Step W3-3) common key encryption, the group member terminal 1-1, encrypts the shared data _{M G} with _{K M.} The shared data after encryption (encrypted data) is E _KM (M _G ). After encryption completion, the group member terminal 1-1 deletes the _{M G} group members terminal 1-1 stores.
(Step W3-4) group member terminal 11, generates an encryption key shares _{S KM, 1} corresponding to the _{K M} using the master share MS _1. The encryption key share S _{KM, 1} is generated using the following equation (22). Here, X _{KM, 1} = h (ID ₁ ‖r ₂ ) (r ₂ is a random number and h is a hash function). Incidentally, _{K M} can be generated using only the master share MS ₁ and the encryption key shares _{S KM, 1.}

  (Step W3-5) The group member terminal 1-1 prompts the user to input information for user authentication, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step W3-6) The group member terminal 1-1 receives the ID (ID ₁ ), E _KM (M _G ), C _0,1 , L ₁ , and S _{KM, which the} group member terminal 1-1 has _{. 1} , UID, and PN are sent to the storage server 2.
(Step W3-7) The storage server 2 collates whether or not the pair of UID and PN transmitted from the group member terminal 1-1 matches the pair of UID and PN stored in advance. If they match, the storage server 2 assigns a data ID (D ₁ ) to the data. The storage server 2 also stores ID ₁ , L ₁ , E _KM (M _G ), C _{0 , 1} , S _{KM, 1} , D ₁ and the last update time (T _{S, 1} ). The data is stored in the storage unit of the storage server 2 according to the server format. The latest update time (T _{S, 1} ) is the time at the time of storage.

(Step W3-8) In order to notify the group member terminal 1-1 that the storage process in step W3-7 has been completed, the storage server 2 transmits an ACK (acknowledgement) message to the user terminal 1. The ACK message includes D ₁ and T _{S, 1} and TK _{S, 1} .
(Step W3-9) After receiving the ACK message from the storage server 2, the group member terminal 1-1 deletes C _0,1 and S _{KM, 1} stored in the group member terminal 1-1. The group member terminal 1-1 creates an entry for the data to the local data list to the new, the _{D 1} as the data ID, and _{L 1} as the data _label, T 1, 1 a _{(= T S, 1)} As the last reference time, E _KM (M _G ) is stored as encrypted data according to the member terminal format. Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

[Shared data storage processing: Shared data update storage (with key update)]
Next, update storage processing in the present embodiment when there is a key update will be described with reference to FIG. FIG. 21 is a sequence diagram illustrating a processing operation in which the group member terminal 1-1 stores group shared data in the storage server 2 in the present embodiment.

(Step W3a-1) The user who uses the group member terminal 1-1 operates the group member terminal 1-1 to prepare the shared data M _G ′ on the group member terminal 1-1. In addition, the file name of _{M G} 'with the data label _{L 1.}
(Step W3a-2) Using the key encapsulation technique, the group member terminal 1-1 generates the encryption key K _M ′ and key decryption information C _0,1 ′ from pk _G.

(Step W3a-3) By the common key encryption, the group member terminal 1-1 encrypts the shared data M _G ′ using K _M ′. The encrypted shared data (encrypted data) is E _{KM ′} (M _G ′). After completing the encryption, the group member terminal 1-1 deletes M _G ′ stored in the group member terminal 1-1.
(Step W3a-4) group member terminal 11, generates the 'encryption key shares _{S KM, 1} corresponding to' _{K M} using the master share MS _1. The encryption key share S _{KM, 1} ′ is generated using the above equation (22).

  (Step W3a-5) The group member terminal 1-1 prompts the user to input information for user authentication, and accepts the input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step W3a-6) group member terminal 11, the ID of the group member terminal 1-1 has (ID _{1), E KM} and _{'(M G'),} and _{C 0, 1} ', and _{L 1,} S _{KM, 1} ′, UID, and PN are sent to the storage server 2.
(Step W3a-7) The storage server 2 collates whether or not the pair of UID and PN transmitted from the group member terminal 1-1 matches the pair of UID and PN stored in advance. If they match, the storage server 2 assigns a data ID (D ₁ ) to the data. Further, the storage server 2 to the ID _1, and _{L 1, E KM} and _{'(M G'), 'and, S KM, 1' C 0,1} and, as _{D 1,} last update time _{(T S, 1} ') Is stored in the storage unit of the storage server 2 in accordance with the format of the storage server format. The latest update time (T _{S, 1} ′) is the time at the time of storage.

(Step W3a-8) The storage server 2 transmits an ACK (acknowledgement) message to the user terminal 1 in order to notify the group member terminal 1-1 that the storage process in step W3a-7 has been completed. The ACK message includes D ₁ and T _{S, 1} ′.
(Step W3a-9) After receiving the ACK message from the storage server 2, the group member terminal 1-1 deletes C _0,1 ′ and S _{KM, 1} ′ stored in the group member terminal 1-1. The group member terminal 1-1 creates an entry for the data to the local data list to the new, the _{D 1} as the data ID, and _{L 1} as the data _{label, T 1,1 '(= T S} , 1' ) As the last reference time and E _{KM ′} (M _G ′) as encrypted data according to the member terminal format. Note that E _{KM ′} (M _G ′) may or may not be deleted, and may be selected according to settings such as a setting file.
(Step W3a-10) The storage server _{2, S KM,} based on ₁ and _{S KM, 1} ', the encryption key shares _{S KM} another user (ID _i) is used with respect to _{M G,} a _{i S KM, i} Update to '. The encryption key share S _{KM, i} ′ is generated using the following equation (23). Here, X _{MS, i} = h (ID _{MS, i} ) is the x coordinate of the master share MS _i of the member terminal i, and X _{KM, i} = h (ID _i ‖r ₂ ) is the encryption key share S _{KM, i} X ₂ and r ₂ are random numbers (i = 1,..., N + 1).

[Shared data storage processing: Shared data update storage (no key update)]
Next, shared data update storage processing in the present embodiment when there is no key update will be described. The shared data update storage processing operation in the present embodiment when there is no key update is performed in the same manner as the shared data update storage processing operation in the first embodiment when there is no key update.

[Shared data reference processing (new reference)]
Next, processing when the group member terminal 1-2 refers to the shared data registered in the storage server 2 by the group member terminal 1-1 for the first time will be described with reference to FIG. FIG. 22 is a sequence diagram showing a processing operation when the group member terminal 1-2 refers to the shared data registered in the storage server 2 by the group member terminal 1-1 for the first time in this embodiment.

  (Step R3-0) The storage server 2 sends a data list to the group member terminal 1-1 and the group member terminal 1-2. For example, the data list transmission timing may be transmitted every time the data list is updated. Further, it may be transmitted only when there is a data access request from the user terminal.

  (Step R3-1) The group member terminal 1-2 receives an input of a reference request for shared data from the user. Subsequently, the group member terminal 1-2 prompts the user to input user authentication information, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step R3-2) group member terminal 1-2, the data ID of the reference data _{M G (D 1),} the ID of the group member terminal 1-2 has (ID _2), UID and data and a PN The message is sent to the storage server 2 as a request message.

(Step R3-3) The storage server 2 collates whether the set of UID and PN transmitted from the group member terminal 1-2 matches the set of UID and PN stored in advance. If they match, the storage server 2 uses C _0,1 , sk _{1, S} , and sk ₂ to recover the key recovery information C ₁ = C _0,1 ^W1 , C ₂ = C _0,1 ^W2 Is generated. W1 satisfies the above expression (10). W2 satisfies the above expression (11).

(Step R3-4) the storage server 2, and _{D 1,} and E KM _{(M G),} a last update time _{(T S, 1),} sending a _{C 1,} and _{C 2} to the group member terminal 1-2 To do.
(Step R 35) group member terminal _1-2, and _{sk 1, 2,} and _{C 1,} to restore the _{K M} by using a _{C 2.} Incidentally, restoration method of _{K M} is the same as the method restored in the step R2-4c.
(Step R3-6) group member terminal 1-2 uses the _{K M} decrypts the _E KM _{(M G),} to obtain the _{M G.}
(Step R3-7) group member terminal 1-2, to generate an encrypted share _{S KM, 2} corresponding to the _{K M} using the master share MS _2.

(Step R3-8) group member terminal 1-2, and _{D 1,} and ID _2, sends the _{S KM, 2} to the storage server 2. Moreover, after the reference of _{M G,} group member terminal 1-2 and _{K M,} and _{M G,} and _{C 1,} and _{C 2,} to remove the _{S KM, 2.} In addition, in the entry for the data in the local data list, D ₁ is a data ID, L ₁ is a data label, T _2,1 (= T _{S, 1} ) is a final reference time, and E _KM (M _G ) Is stored as encrypted data in accordance with the member terminal format. Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

[Shared data reference processing (re-reference)]
Next, processing when the group member terminal 1-2 refers again to the shared data registered in the storage server 2 by the group member terminal 1-1 will be described with reference to FIG. FIG. 23 is a sequence diagram showing processing operations when the group member terminal 1-2 refers again to the shared data registered in the storage server 2 by the group member terminal 1-1 in the present embodiment.

  (Step R3a-0) The storage server 2 sends a data list to the group member terminal 1-1 and the group member terminal 1-2. For example, the data list transmission timing may be transmitted every time the data list is updated. Further, it may be transmitted only when there is a data access request from the user terminal.

  (Step R3a-1) The group member terminal 1-2 receives an input of a shared data reference request from the user. Subsequently, the group member terminal 1-2 prompts the user to input user authentication information, and accepts input of authentication information from the user. The user authentication information is a user ID (UID) and authentication information (PN). The authentication information is, for example, a password.

(Step R3a-2) group member terminal 1-2, the data ID of the data _{M G} reference _{(D 1),} the ID of the group member terminal 1-2 has (ID _2), the UID, the PN, the The data last reference time (T _2,1 ) is sent to the storage server 2 as a data request message. Information indicating the presence / absence of encrypted data E _KM (M _G ) in the group member terminal may be added to the data request message.

(Step R3a-3) The storage server 2 collates whether the set of UID and PN transmitted from the group member terminal 1-2 matches the set of UID and PN stored in advance. If they match, the storage server 2 sends the encryption key share S _{KM, 2} , E _KM (M _G ), and the last update time (T _{S, 1} ) to the group member terminal 1-2. Incidentally, Step R3a-2 and information indicating the added "encrypted data perforated in the group member terminals" request in the message, in the case yet no updating of the data does not send E _{KM (M G)} process It is also good. Here, as a method for determining whether or not the data has been updated, for example, the last reference time (T _{i, 1} ) sent from the group member terminal 1-i and the last update time stored in the storage server 2 ( T _{S, 1} ) is compared, and if the values are different, there is a method of determining that the value has been updated.

(Step R3a-4) group member terminal _1-2, restores the _{K M} with the _{S KM, 2,} and MS _2.
(Step R3a-5) group member terminal 1-2 uses the _{K M} decrypts the _E KM _{(M G),} to obtain the _{M G.}
(Step R3a-6) after reference _{M G,} group member terminal 1-2 deletes the _{K M,} and _{M G,} and _{S KM, 2.} Further, T _2,1 (= T _{S, 1} ) is stored in the entry for the data in the local data list as the last reference time according to the member terminal format. Note that E _KM (M _G ) may or may not be deleted, and may be selected by setting a setting file or the like.

[Environment migration process]
Next, a procedure for shifting the environment of the group member terminal 1-2 to the group member terminal 1-3 when the group member terminal 1-2 is lost will be described with reference to FIG. FIG. 24 is a sequence diagram showing a processing operation for shifting the environment of the group member terminal 1-2 to the group member terminal 1-3 in the present embodiment.

(Step RE3-1) The group member terminal 1-3 notifies the certificate authority 3 of the loss of the group member terminal 1-2 and a request to move the environment of the group member terminal 1-2 to the group member terminal 1-3. To do. Further, the group member terminal 1-3 acquires the SMS _{, 2, 1} stored in the external device in step P3-4d.
(Step RE 3-2) The certification authority 3 sends the split key update share S _{R, 1} to the group member terminal 1-1 and sends the split key update share S _{R, S} to the storage server 2. S _{R, i} satisfies the above equation (15).

(Step RE3-3) The group member terminal 1-1 updates sk _1,1 using SR _{, 1} , and generates sk ' _1,1 . After the generation, the group member terminal 1-1 deletes S _{R, 1} and sk _1,1 . The storage server 2 updates sk _{1 and S} using S _{R and S} to generate sk ′ _{1 and S.} After generation, the storage server 2 deletes S _{R, S} and sk _{1, S.} Note that sk ′ _{1, i} is generated using the above equation (16).

(Step RE3-4) The certificate authority 3 generates secret key shares sk ′ _1,3 for the group member terminals 1-3. The generation is performed using the above equation (16).
(Step RE3-5) The certification authority 3 sends the secret key shares sk ′ _1,3 for the group member terminal 1-3 and the public key pk _G to the group member terminal 1-3.

(Step RE3-6) The storage server 2 generates a divided share S ′ _{MS, 2, 2} and sends it to the group member terminal 1-3. The divided share S ′ _{MS, i, 2} is generated using the following equation (24). Here, g _k (x) = b _k x (b _k is a random number).

The group member terminal 1-3 generates MS ₃ from S ′ _{MS, 2,2} and _{SMS, 2,1} . MS ₃ satisfies the following formula (25).

  (Step RE3-7) The certification authority 3 notifies the storage server 2 that the environment of the group member terminal 1-2 has been shifted to the group member terminal 1-3.

  As described above with respect to the third embodiment, in this embodiment, information called a master share, which is information on the basis for generating the encryption key, is generated in the group member terminal, and the generated key share is used to generate the encryption key. The encryption key share is generated. When the group member terminal changes the encryption key and updates and saves the shared data, the storage server, based on the updated encryption key information, stores all the group member terminals stored in the storage server in step Wa-10. Update the encryption key share for. Therefore, after the group member terminal changes the encryption key and updates and saves the shared data, when the group member terminal refers to the data once referenced again, the secret sharing is performed without performing the key restoration again by the key encapsulation technique. Key recovery by law can be used.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes designs and the like that do not depart from the gist of the present invention.

  The key update determination in step R2-3 may be performed using the hash value HK = h (KM) of the encryption key. Specifically, the group member terminal generates a hash value during data storage processing and transmits it to the storage server 2. Thereafter, at the time of data reference processing, the group member terminal sends the hash value of the encryption key to the storage server 2 in step R2-2. The storage server 2 may compare the hash value of the encryption key at the time of data storage processing with the hash value of the encryption key in step R2-2, and if they match, may determine that the encryption key has not been updated.

  In addition, the entire processing functions of the encryption key generation function, transmission function, reception function, encryption key restoration function, decryption function, update information reception function, split key update function, share generation function of the group member terminal in the above-described embodiment or its Part of storage server reception function, storage function, key recovery information generation function, transmission function, split key update function as a whole or part of it, certificate authority group key generation function, distributed key generation function, distributed All or some of the processing functions of the key splitting function, key distribution function, receiving function, split key update information generation function, and update information distribution function are recorded on a computer-readable recording medium. Then, the program recorded on the recording medium may be read by the computer system and executed. Here, the “computer system” includes an OS and hardware such as peripheral devices.

Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Further, the “computer-readable recording medium” refers to a computer program that is dynamically stored for a short time, such as a communication line when a computer program is transmitted via a network such as the Internet or a communication line such as a telephone line. What is held, and what holds a computer program for a certain period of time, such as volatile memory inside a computer system serving as a server or client in that case, are included. Further, the computer program may be for realizing a part of the functions described above, and may be implemented in combination with a computer program already recorded in the computer system. good.

1 is a configuration diagram illustrating a data sharing system according to a first embodiment. FIG. It is a sequence diagram which shows the processing operation of the preparatory in 1st Embodiment. It is a figure showing the data format of the list of the data which the storage part of a group member terminal memorizes in a 1st embodiment. It is a figure showing the data format of the data which the storage part of a storage server memorizes in a 1st embodiment. FIG. 3 is a diagram illustrating an example of data stored in a storage unit of a storage server in the first embodiment. FIG. 5 is a sequence diagram illustrating a processing operation in which a group member terminal stores group shared data in a storage server in the first embodiment. FIG. 5 is a sequence diagram illustrating a processing operation in which a group member terminal updates and stores group shared data in a storage server without updating the encryption key in the first embodiment. FIG. 6 is a diagram illustrating a data list transmitted from the storage server to each group member terminal in the first embodiment. FIG. 6 is a sequence diagram showing processing operations when the group member terminal 1-2 refers to the shared data registered in the storage server by the group member terminal 1-1 in the first embodiment. FIG. 6 is a sequence diagram illustrating a processing operation for shifting the environment of the group member terminal 1-2 to the group member terminal 1-3 in the first embodiment. In 2nd Embodiment, it is the figure which showed the data format of the list | wrist of the data which the memory | storage part of a group member terminal memorize | stores. In 2nd Embodiment, it is the figure which showed the data format of the data which the memory | storage part of a storage server memorize | stores. FIG. 10 is a sequence diagram illustrating a processing operation in which a group member terminal 1-1 stores group shared data in a storage server in the second embodiment. FIG. 10 is a sequence diagram illustrating a processing operation when a group member terminal 1-2 refers to shared data registered in a storage server by a group member terminal 1-1 in the second embodiment. FIG. 10 is a sequence diagram illustrating a processing operation in which a group member terminal creates a key and refers to shared data in the second embodiment. FIG. 10 is a sequence diagram illustrating a processing operation in which a group member terminal refers to shared data with no key update in the second embodiment. In the third embodiment, a group member terminal is a sequence diagram showing a processing operation for initial setting of a master share. In 3rd Embodiment, it is the figure which showed the data format of the list | wrist of the data which the memory | storage part of a group member terminal memorize | stores. In 3rd Embodiment, it is the figure which showed the data format of the data which the memory | storage part of a storage server memorize | stores. FIG. 10 is a sequence diagram illustrating a processing operation in which a group member terminal 1-1 stores group shared data in a storage server in the third embodiment. FIG. 10 is a sequence diagram illustrating a processing operation in which a group member terminal 1-1 stores group shared data in a storage server in the third embodiment. FIG. 15 is a sequence diagram illustrating processing operations when a group member terminal 1-2 refers to shared data registered in a storage server by a group member terminal 1-1 for the first time in the third embodiment. FIG. 15 is a sequence diagram showing processing operations when the group member terminal 1-2 refers again to the shared data registered in the storage server by the group member terminal 1-1 in the third embodiment. FIG. 10 is a sequence diagram illustrating a processing operation for shifting the environment of the group member terminal 1-2 to the group member terminal 1-3 in the third embodiment.

Explanation of symbols

1-1 to 1-N: Group member terminal, 2 ... Storage server, 3 ... Certificate authority, 4 ... Communication network, 100 ... Data sharing system

Claims (18)

A storage server for storing a second distributed key essential for decrypting encrypted shared data and the encrypted shared data, N (N is an integer of 1 or more) terminal devices, and a key generation device In the key generation device included in the data sharing system comprising:
A group key generation unit for generating a public key and a secret key;
A distributed key generation unit for generating a first distributed key;
Based on the first distributed key and the secret key, a second distribution that generates the second distributed key that can generate the secret key from the first distributed key and the second distributed key A key generation unit;
A distributed key splitting unit that splits the first shared key into N + 1 different split keys;
N + 1 divided keys divided by the distributed key dividing unit are distributed to N terminal devices and the storage server one by one, the public key is distributed to each of the N terminal devices, and the storage server A key distribution unit for distributing the second distributed key to
With
The key generation apparatus characterized in that the first distributed key can be generated from two or more types of the split keys. Migration source terminal device information that uniquely identifies a migration source terminal device that is an original terminal device that migrates the environment of the terminal device, and a migration destination terminal device that is a migration destination terminal device of the environment of the migration source terminal device. A receiving unit for receiving terminal device transition information including the destination terminal device information uniquely specified;
A split key update information generating unit that generates split key update information that is information for updating a split key when the receiving unit receives the terminal device transition information;
An update information distribution unit that distributes the split key update information generated by the split key update information generation unit to a terminal device and a storage server that are not included in the terminal device migration information;
With
The distributed key splitting unit generates a split key used by the transfer destination terminal device,
The key generation device according to claim 1, wherein the key distribution unit transmits the split key generated by the distributed key splitting unit and the public key to the transfer destination terminal device. The data sharing system includes a storage server that stores a second distributed key essential for decrypting encrypted shared data and the encrypted shared data, a terminal device, and a key generation device. In the terminal device,
An encryption key generation unit that generates an encryption key and first key recovery information from a public key sent from the key generation device;
An encryption unit for encrypting shared data using the encryption key;
A transmitting unit that transmits the encrypted shared data and the first key recovery information to the storage server;
A receiving unit that receives the encrypted shared data, the second key recovery information, and the third key recovery information from the storage server;
An encryption key restoration unit for restoring an encryption key based on the split key sent from the key generation device, the second key restoration information received by the reception unit, and the third key restoration information; ,
A decryption unit for decrypting the encrypted shared data received by the reception unit using the encryption key restored by the encryption key restoration unit;
A terminal device comprising: An update information receiving unit for receiving split key update information from the key generation device;
A split key update unit that updates the split key based on the split key update information received by the update information receiving unit;
The terminal device according to claim 3, further comprising: A share generation unit that generates a first share and a second share, which is information capable of generating the encryption key with only two pieces of information
With
The transmitting unit transmits the the shared data encrypted, and the first key recovery information, and said second share of the storage server,
The receiving unit, when the encryption key the encryption unit is used in the encryption of the shared data is updated, the the encrypted shared data, and the second key recovery information, the first 3 of the key recovery information received from the storage server, if the encryption key has not been updated, and receives the shared data the encrypted, and said second share
When the encryption key used by the encryption unit to encrypt the shared data is updated, the encryption key restoration unit receives the split key sent from the key generation device and the reception unit. An encryption key is restored based on the second key restoration information and the third key restoration information, and when the encryption key is not updated, the first share and the second key restore the encryption key on the basis of the share
Terminal device according to claim 3, wherein the this. A storage unit for storing the master share the information of the group that produces the encryption key,
A split share generating unit that generates a first split share and a second split share, which is information capable of restoring the master share with only two pieces of information ;
Wherein the front Symbol encryption key based on the master share a share generator for generating an encryption key shares are only two pieces of information in generating information that can be the encryption key of the master share a cryptographic key shares,
With
The transmitter is
Send the the shared data encrypted, and the first key recovery information, and the encryption key shares to the storage server,
The receiving unit, when the encryption key the encryption unit is used in the encryption of the shared data is updated, the the encrypted shared data, and the second key recovery information, the first 3 of the key recovery information received from the storage server, if the encryption key has not been updated, and receives the shared data the encrypted, and the encryption key shares,
When the encryption key used by the encryption unit to encrypt the shared data is updated, the encryption key restoration unit receives the split key sent from the key generation device and the reception unit. An encryption key is restored based on the second key restoration information and the third key restoration information, and when the encryption key is not updated, the master share, the encryption key share, restore the encryption key based on the
Terminal device according to claim 3, wherein the this. In a storage server included in a data sharing system including a storage server, a terminal device, and a key generation device,
A receiving unit that receives the encrypted shared data and the first key recovery information from the terminal device;
The shared data received by the receiving unit and the first key recovery information are stored in association with each other, and a second distributed key essential for decrypting the encrypted shared data and a split key are stored A storage unit;
Key recovery information for generating second key recovery information and third key recovery information based on the first key recovery information, the split key, and the second distributed key. A generator,
A transmitting unit that transmits the encrypted shared data, the second key recovery information, and the third key recovery information to the terminal device;
A storage server comprising: An update information receiving unit that receives split key update information that is information for updating the split key from the key generation device;
A split key update unit that updates the split key based on the split key update information received by the update information receiving unit;
The storage server according to claim 7, further comprising: The receiving unit receives the the encrypted shared data from the terminal device, the first key recovery information, and a second share,
The storage unit stores the shared data received by the receiving unit, the first key recovery information, and the second share in association with each other, and is essential for decrypting the encrypted shared data Storing the second distributed key and the split key ;
The key recovery information generation unit, when the encryption key used for encryption of the shared data in the terminal device is updated, the first key recovery information, the split key, and the first key Generating the second key recovery information and the third key recovery information based on the two distributed keys;
And the transmission unit, when the encryption key used to encrypt the shared data in the terminal device is updated, and the encrypted shared data, and the second key recovery information, the first 3 of the key recovery information is transmitted to the terminal device, when the encryption key has not been updated, that sends the the encrypted shared data, and said second share of the terminal device
The storage server according to claim 7, wherein the this. The receiving unit receives the the encrypted shared data from the terminal device, the first key recovery information, a cryptographic key shares,
The storage unit stores the shared data received by the receiving unit, the first key recovery information, and the encryption key share in association with each other, and is essential for decrypting the encrypted shared data. 2 distributed keys and the split key are stored ,
The key recovery information generation unit, when the encryption key used for encryption of the shared data in the terminal device is updated, the first key recovery information, the split key, and the first key Generating the second key recovery information and the third key recovery information based on the two distributed keys;
And the transmission unit, when the encryption key used to encrypt the shared data in the terminal device is updated, and the encrypted shared data, and the second key recovery information, the first 3 is transmitted to the terminal device, and if the encryption key is not updated, the encrypted shared data and the encryption key share are transmitted to the terminal device.
The storage server according to claim 7, wherein the this. A storage server for storing a second distributed key essential for decrypting encrypted shared data and the encrypted shared data, N (N is an integer of 1 or more) terminal devices, and a key generation device In a data sharing system with
A group key generation step for generating a public key and a private key;
A distributed key generation step of generating a first distributed key;
Based on the first distributed key and the secret key, a second distribution that generates the second distributed key that can generate the secret key from the first distributed key and the second distributed key A key generation step;
A distributed key splitting step of splitting the first distributed key into N + 1 different split keys;
The N + 1 divided keys divided in the distributed key dividing step are distributed one by one to the N terminal devices and the storage server, and the public key is distributed to each of the N terminal devices, and the storage server A key distribution step of distributing the second distributed key to:
A computer program for causing a computer to execute. Migration source terminal device information that uniquely identifies a migration source terminal device that is an original terminal device that migrates the environment of the terminal device, and a migration destination terminal device that is a migration destination terminal device of the environment of the migration source terminal device. A receiving step for receiving terminal device transition information including uniquely specifying destination terminal device information;
A split key update information generating step for generating split key update information, which is information for updating the split key when receiving the terminal device transition information in the receiving step;
An update information distribution step for distributing the split key update information generated in the split key update information generation step to a terminal device and a storage server not included in the terminal device migration information;
To the computer,
The distributed key splitting step generates a split key used by the transfer destination terminal device,
The computer program according to claim 11, wherein the key distribution step transmits the split key generated by the distributed key split step and the public key to the transfer destination terminal device. In a data sharing system comprising a storage server for storing a second distributed key essential for decrypting encrypted shared data and the encrypted shared data, a terminal device, and a key generation device,
An encryption key generation step of generating an encryption key and first key restoration information from a public key sent from the key generation device;
An encryption step of encrypting shared data using the encryption key;
A transmission step of transmitting the encrypted shared data and the first key recovery information to the storage server;
Receiving the encrypted shared data, the second key recovery information, and the third key recovery information from the storage server;
An encryption key restoring step for restoring an encryption key based on the split key sent from the key generation device, the second key restoration information received in the receiving step, and the third key restoration information; ,
A decryption step of decrypting the encrypted shared data received in the reception step using the encryption key restored in the encryption key restoration step;
A computer program for causing a computer to execute. A share generation step of generating a first share and a second share, which is information that can generate the encryption key only with two pieces of information;
Including
In the transmission step, the encrypted shared data, the first key recovery information, and the second share are transmitted to the storage server,
In the receiving step, when the encryption key used in the encryption of the shared data in the encryption unit step is updated, the the encrypted shared data, and the second key recovery information, the and a third key recovery information received from the storage server, if the encryption key has not been updated, and receives the shared data the encrypted, and said second share
In the encryption key restoration step, when the encryption key used in the encryption of the shared data is updated in the encryption step, the split key sent from the key generation device and the reception unit have received An encryption key is restored based on the second key restoration information and the third key restoration information, and when the encryption key is not updated, the first share and the second key restore the encryption key on the basis of the share
The computer program according to claim 13 . A storage step of storing the master share the information of the group that produces the encryption key,
A split share generation step of generating a first split share and a second split share, which is information capable of restoring the master share with only two pieces of information ;
Wherein the front Symbol encryption key based on the master share a share generation step of generating a cryptographic key shares are only two pieces of information in generating information that can be the encryption key of the master share a cryptographic key shares,
Including
In the transmission step, the encrypted shared data, the first key recovery information, and the encryption key share are transmitted to the storage server,
In the receiving step, when the encryption key used in the encryption of the shared data in the encryption step is updated, the the encrypted shared data, and the second key recovery information, the first 3 of the key recovery information received from the storage server, if the encryption key has not been updated, and receives the shared data the encrypted, and the encryption key shares,
In the encryption key restoration step, when the encryption key used in the encryption of the shared data is updated in the encryption step, the split key sent from the key generation device and the reception unit have received An encryption key is restored based on the second key restoration information and the third key restoration information, and when the encryption key is not updated, the master share, the encryption key share, restore the encryption key based on the
The computer program according to claim 13 . In a data sharing system including a storage server, a terminal device, and a key generation device,
Receiving the encrypted shared data and the first key recovery information from the terminal device;
The shared data received in the receiving step and the first key recovery information are stored in association with each other, and a second distributed key essential for decrypting the encrypted shared data and a split key are stored. A memory step;
Key recovery information for generating second key recovery information and third key recovery information based on the first key recovery information, the split key, and the second distributed key. Generation step;
A transmission step of transmitting the encrypted shared data, the second key recovery information, and the third key recovery information to the terminal device;
A computer program for causing a computer to execute. In the receiving step, receiving said the encrypted shared data from the terminal device, the first key recovery information, and a second share,
In the storing step, the shared data received in the receiving step, the first key recovery information, and the second share are stored in association with each other , and indispensable for decrypting the encrypted shared data Storing the second distributed key and the split key ;
In the key recovery information generation step, when the encryption key used for encryption of the shared data is updated in the terminal device, the first key recovery information, the split key, and the first key are updated. Generating the second key recovery information and the third key recovery information based on the two distributed keys;
Wherein the transmitting step, when the encryption key used to encrypt the shared data in the terminal device is updated, and the encrypted shared data, and the second key recovery information, the first 3 of the key recovery information is transmitted to the terminal device, when the encryption key has not been updated, that sends the the encrypted shared data, and said second share of the terminal device
The computer program according to claim 16 . In the receiving step, receiving said the encrypted shared data from the terminal device, the first key recovery information, a cryptographic key shares,
In the storing step, the shared data received in the receiving step, the first key recovery information, and the encryption key share are stored in association with each other , and the indispensable for decrypting the encrypted shared data 2 distributed keys and the split key are stored ,
In the key recovery information generation step, when the encryption key used for encryption of the shared data is updated in the terminal device, the first key recovery information, the split key, and the first key are updated. Generating the second key recovery information and the third key recovery information based on the two distributed keys;
Wherein the transmitting step, when the encryption key used to encrypt the shared data in the terminal device is updated, and the encrypted shared data, and the second key recovery information, the first 3 is transmitted to the terminal device, and if the encryption key is not updated, the encrypted shared data and the encryption key share are transmitted to the terminal device.
The computer program according to claim 16 .

Images