JP5134555B2 - Key generation device, encryption device, decryption device, encryption system, key generation method, encryption method, decryption method, program, and recording medium - Google Patents

Description

  The present invention relates to a hierarchical ID-based encryption key generation device, encryption device, decryption device, and encryption system that encrypts and decrypts a hierarchical decryption device using the identification information of the decryption device. , A key generation method, an encryption method, a decryption method, a program, and a recording medium.

  Hierarchical ID-based encryption was first proposed in Non-Patent Document 1. However, in the method of Non-Patent Document 1, anonymity cannot be given to the ID (identification information of the decryption device). Also, the ciphertext size has increased depending on the depth of the hierarchy.

  Non-Patent Document 2 is a method in which the size of the ciphertext is constant without depending on the depth of the hierarchy. However, this method cannot conceal the ID. Further, Non-Patent Document 3 has been proposed as a method for providing confidentiality to the ID. However, with this method, the ciphertext size increases depending on the depth of the hierarchy.

C. Gentry, A. Silverberg, “Hierarchical ID-based cryptography,” in Proceedings of ASIACRYPT 2002, Lecture Notes in Computer Sience, Springer-Verlag, 2002. Dan Boneh, Xavier Boyen, and Eu-Jin Goh, “Hierarchical identity based encryption with constant size ciphertext,” Proceedings of Eurocrypt 2005, volume 3494 of LNCS, pp.440-456, 2005. Xavier Boyen and Brent Waters, “Anonymous hierarchical identity-based encryption (without random oracles),” Proceedings of CRYPTO 2006, volume 411 of LNCS, 2006.

  An object of the present invention is to provide a hierarchical ID-based encryption technique that can conceal an ID (identification information of a decryption device) and whose ciphertext size does not depend on the depth of the hierarchy.

First, p and q are prime orders, G ^ and G _T ^ are cyclic groups having order pq, G _p is a subgroup of G ^ having prime order p, and G _q is G having prime order q. A subgroup of ^, e is a bilinear map such that e: G ^ × G ^ → G _T ^, K is an integer indicating the maximum value of the hierarchy, k is an integer of 1 ≦ k ≦ K indicating the hierarchy, and D _k is An integer for identifying a decryption device in the kth hierarchy, D is identification information for identifying K decryption devices, and D = [D ₁ ,..., D _K ], and ciphertext C (k ) Is C (k) = “C ₁ , C ₂ , C ₃ , C ₄ ”. The key generation device of the present invention includes a key generation recording unit, a public key generation unit, a key generation random value selection unit, and a hierarchical secret key generation unit. Key generating recording unit, data g, _{f, v,} h 1 is an element of the group _{G p, ..., h} K, and w, data _R g is an element of the group _{G q, R f, R v} , R 1 ,..., R _K , g _q and identification information D are recorded. The public key generation unit calculates G = gR _g , F = fR _f , V = vR _v , H ₁ = h ₁ R ₁ ,..., H _K = h _K R _K , E = e (g, w) , [G, F, V, H ₁ ,..., H _K , E] are generated as public keys P. The key generation random value selector selects the integers r ₁ , r ₂ , s ₁ , s ₂ , t ₁ , t ₂ .

を満たさないように、ランダムに選択する。階層秘密鍵生成部は、復号鍵生成手段、引継情報生成手段、秘密鍵生成手段を備え、ｋ番目の階層の階層秘密鍵Ｓ（ｋ）を生成する。
復号鍵生成手段は、Ｓ_ｄ（ｋ）を、

Randomly selected so as not to satisfy. The hierarchical secret key generation unit includes a decryption key generation unit, a takeover information generation unit, and a secret key generation unit, and generates a hierarchical secret key S (k) of the kth layer.
The decryption key generation means converts S _d (k) to

のように求める。引継情報生成手段は、Ｓ_ｒ（ｋ）を、

Seek like. The takeover information generation means sets S _r (k) to

のように求める。秘密鍵生成手段は、ｋ番目の階層の階層秘密鍵Ｓ（ｋ）を
Ｓ（ｋ）←［Ｓ_ｄ（ｋ），Ｓ_ｒ（ｋ）］
のように求める。

Seek like. The secret key generation means converts the hierarchy secret key S (k) of the kth hierarchy to S (k) ← [S _d (k), S _r (k)]
Seek like.

The encryption device includes an encryption recording unit, an encryption random value selection unit, and an encryption unit. The encryption recording unit records identification information D, public key P, and plaintext M. The encryption random value selection unit randomly selects Z ₁ , Z ₂ , and Z ₃ that are elements of the integer s and the group G _q . The encryption unit obtains the ciphertext C (k) for the decryption device in the kth layer from the plaintext M that is an element of the group G _T ^.

のように求める。

Seek like.

The decryption device for the k-th (but second or later) layer includes a decryption recording unit, a decryption random value selection unit, a layer secret key generation unit, and a decryption unit. The decryption / recording unit includes a hierarchy secret key S (k−1) = [[a ₀ , a ₁ , a ₂ , b _k ,..., B _K ], [α ₀ , α ₁ , α ₂ , β _k ,..., β _K ], [α ₀ ′, α ₁ ′, α ₂ ′, β _k ′,..., β _K ′]], ciphertext C (k), self identification information D _k Record. The decoding random value selection unit calculates the integers γ ₁ , γ ₂ , γ ₃ , δ ₁ , δ ₂ , δ ₃ .

を満たさないように、ランダムに選択する。階層秘密鍵生成部は、復号鍵生成手段、引継情報生成手段、秘密鍵生成手段を備え、ｋ番目の階層の階層秘密鍵Ｓ（ｋ）を生成する。復号鍵生成手段は、Ｓ_ｄ（ｋ）を、

Randomly selected so as not to satisfy. The hierarchical secret key generation unit includes a decryption key generation unit, a takeover information generation unit, and a secret key generation unit, and generates a hierarchical secret key S (k) of the kth layer. The decryption key generation means converts S _d (k) to

のように求める。引継情報生成手段は、Ｓ_ｒ（ｋ）を、

Seek like. The takeover information generation means sets S _r (k) to

のように求める。秘密鍵生成手段はｋ番目の階層の階層秘密鍵Ｓ（ｋ）を
Ｓ（ｋ）←［Ｓ_ｄ（ｋ），Ｓ_ｒ（ｋ）］
のように求める。復号化部は、階層秘密鍵Ｓ（ｋ）のはじめの３つの要素をＡ_０，Ａ_１，Ａ_２とすると、暗号文Ｃ（ｋ）を

Seek like. The secret key generation means obtains the hierarchy secret key S (k) of the kth hierarchy as S (k) ← [S _d (k), S _r (k)]
Seek like. When the first three elements of the hierarchical secret key S (k) are A ₀ , A ₁ and A ₂ , the decryption unit converts the ciphertext C (k)

のように平文Ｍに復号する。
１番目の階層の復号化装置は、復号化記録部と復号化部とを備える。復号化記録部は、１番目の階層の階層秘密鍵Ｓ（１）、暗号文Ｃ（１）を記録する。復号化部は、階層秘密鍵Ｓ（１）のはじめの３つの要素をＡ_０，Ａ_１，Ａ_２とし、暗号文Ｃ（１）を

As shown in FIG.
The first layer decoding apparatus includes a decoding recording unit and a decoding unit. The decryption recording unit records the hierarchical secret key S (1) and the ciphertext C (1) of the first hierarchy. The decryption unit sets the first three elements of the hierarchical secret key S (1) as A ₀ , A ₁ , A ₂ , and the ciphertext C (1)

のように平文Ｍに復号する。なお、１番目の階層の復号化部は鍵生成装置と同一でもよい。

As shown in FIG. Note that the decryption unit in the first layer may be the same as the key generation device.

  According to the present invention, it is not necessary to transmit the ID (identification information of the decryption device) together with the ciphertext C (k). Therefore, the ID can be concealed. The length of the ciphertext C (k) does not depend on the hierarchy.

The figure which shows the structural example of the encryption system of this invention. The figure which shows the function structural example of the key generation apparatus of this invention, and the decoding apparatus of the 1st hierarchy. The figure which shows the example of the processing flow of the key generation apparatus of this invention. The figure which shows the function structural example of the encryption apparatus of this invention. The figure which shows the example of the processing flow of the encryption apparatus of this invention. The figure which shows the function structural example of the decoding apparatus of the kth (however, 2nd or later) hierarchy of this invention. The figure which shows the example of the processing flow of the decoding apparatus of the kth (however, 2nd or later) hierarchy of this invention. The figure which shows the function structural example of a computer.

  The present invention will be described below with reference to the drawings. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

FIG. 1 shows a configuration example of an encryption system of the present invention. The encryption system according to the present invention includes a key generation device 100 (decryption device 300-1), an encryption device 200, decryption devices 300-2,. First, p and q are prime orders, G ^ and G _T ^ are cyclic groups having order pq, G _p is a subgroup of G ^ having prime order p, and G _q is G having prime order q. A subgroup of ^, e is a bilinear map such that e: G ^ × G ^ → G _T ^, K is an integer indicating the maximum value of the hierarchy, k is an integer of 1 ≦ k ≦ K indicating the hierarchy, and D _k is An integer for identifying the decoding device 300-k of the k-th layer, D is identification information for identifying the K decoding devices 300-1,..., K, and D = [D ₁ ,. , D _K ], and the ciphertext C (k) is C (k) = “C ₁ , C ₂ , C ₃ , C ₄ ”. Incidentally, defining in this way, any group G ^ elements g and h and arbitrary integers a and b for ^{e (g a, h b)} = e (g, h) ab, and any group _{G p} The relationship of e (h _p , h _q ) = 1 holds for the element h _p of the group G and the arbitrary element h _q of the group G _q .

The key generation device 100 records the master secret key S _m and the IDs of the decryption devices 300-1,..., K (identification information D = [D ₁ ,..., D _K ]). The hierarchical secret key S (k) of all hierarchies can be generated. The encryption device 200 records the public key P and the ID (identification information D = [D ₁ ,..., D _K ]) of the decryption device 300-k. The encryption device 200 encrypts the plaintext M using the public key P and the identification information D ₁ ,..., D _k of the decryption devices 300-1,. A ciphertext C (k) for k is obtained. The decryption device 300-1 in the first hierarchy (same as the key generation device 100 in FIG. 1) decrypts the received ciphertext C (1) using the hierarchical secret key S (1), and converts the plaintext M into obtain. The decryption device 300-k in the k-th (but second or later) layer uses the received ciphertext C (k) as the hierarchical secret key S (k) of the (k-1) -th decryption device 300-k-1. −1) = [[a ₀ , a ₁ , a ₂ , b _k ,..., B _K ], [α ₀ , α ₁ , α ₂ , β _k ,..., Β _K ], [α ₀ ′, α ₁ ', Α ₂ ', β _k ',..., Β _K ']], ciphertext C (k), and self-identification information _Dk are used for decryption to obtain plaintext M. In the encryption system of the present invention, since the identification information of the decryption device is not transmitted together with the ciphertext C (k), the ID can be concealed.

FIG. 2 shows a functional configuration example of the key generation device 100. FIG. 3 shows an example of the processing flow of the key generation device 100. The key generation device 100 includes a key generation recording unit 110, a public key generation unit 120, a key generation random value selection unit 130, and a hierarchical secret key generation unit 140. Key generating recording unit 110, data g, _{f, v,} h 1 is an element of the group _{G p, ..., h K,} w and the data _R g is an element of the group _{G q, R f, R v} , R ₁ ,..., R _K , g _q and identification information D are recorded. It should be noted that the data _{g, f, v, h 1} , ..., h K, w is, the master secret key _{S m = [g, f,} v, h 1, ..., h K, w] is recorded as. The public key generation unit 120 calculates G = gR _g , F = fR _f , V = vR _v , H ₁ = h ₁ R ₁ ,..., H _K = h _K R _K , E = e (g, w) [G, F, V, H ₁ ,..., H _K , E] are generated as the public key P (S120). The key generation random value selection unit 130 calculates the integers r ₁ , r ₂ , s ₁ , s ₂ , t ₁ , t ₂ ,

を満たさないように、ランダムに選択する（Ｓ１３０）。
階層秘密鍵生成部１４０は、復号鍵生成手段１５０、引継情報生成手段１６０、秘密鍵生成手段１７０を備え、ｋ番目の階層の階層秘密鍵Ｓ（ｋ）を生成する（Ｓ１４０）。復号鍵生成手段１５０は、Ｓ_ｄ（ｋ）を、

Is selected at random (S130).
The hierarchical secret key generation unit 140 includes a decryption key generation means 150, a takeover information generation means 160, and a secret key generation means 170, and generates a hierarchical secret key S (k) of the kth hierarchy (S140). The decryption key generation means 150 converts S _d (k) to

のように求める（Ｓ１５０）。引継情報生成手段１６０は、Ｓ_ｒ（ｋ）を、

(S150). The takeover information generation means 160 replaces S _r (k) with

のように求める（Ｓ１６０）。秘密鍵生成手段１７０は、ｋ番目の階層の階層秘密鍵Ｓ（ｋ）を
Ｓ（ｋ）←［Ｓ_ｄ（ｋ），Ｓ_ｒ（ｋ）］
のように求める（Ｓ１７０）。

(S160). The secret key generation means 170 obtains the hierarchy secret key S (k) of the kth hierarchy as S (k) ← [S _d (k), S _r (k)].
(S170).

FIG. 4 shows a functional configuration example of the encryption apparatus. FIG. 5 shows an example of the processing flow of the encryption apparatus. The encryption device 200 includes an encryption recording unit 210, an encryption random value selection unit 230, and an encryption unit 280. The encryption recording unit 210 records identification information D for identifying K (K layer) decryption devices, a public key P disclosed by the key generation device 100, and plaintext M to be transmitted. The encryption random value selection unit 230 randomly selects Z ₁ , Z ₂ , and Z ₃ that are elements of the integer s and the group G _q (S230). The encryption unit 280 obtains the ciphertext C (k) for the decryption device 300-k in the k-th layer from the plaintext M that is an element of the group G _T ^

のように求め（Ｓ２８０）、ｋ番目の階層の復号化装置３００−ｋに暗号文Ｃ（ｋ）を送信する。

(S280), and the ciphertext C (k) is transmitted to the decryption apparatus 300-k in the kth layer.

FIG. 6 shows an example of the functional configuration of the decoding device in the k-th (but second or later) layer. FIG. 7 shows an example of the processing flow of the decoding device in the k-th (however, the second and subsequent layers) hierarchy. The decryption apparatus 300-k for the k-th (but second or later) layer includes a decryption recording unit 310-k, a decryption random value selection unit 330-k, a layer secret key generation unit 340-k, and a decryption unit. 390-k. The decryption recording unit 310-k receives the hierarchical secret key S (k−1) = [[a ₀ , a ₁ , a ₂ , b _k of the received decryption apparatus 300-k-1 of the (k−1) th layer. , ..., b _K ], [α ₀ , α ₁ , α ₂ , β _k , ..., β _K ], [α ₀ ', α ₁ ', α ₂ ', β _k ', ..., β _K ']] The received ciphertext C (k) and its own identification information _Dk are recorded. The decoding random value selection unit 330-k converts the integers γ ₁ , γ ₂ , γ ₃ , δ ₁ , δ ₂ , and δ ₃ .

を満たさないように、ランダムに選択する（Ｓ３３０−ｋ）。例えば、復号化ランダム値選択部３３０−ｋは、整数γ_１，γ_２，γ_３，δ_１，δ_２，δ_３をランダムに選択し（Ｓ３３１−ｋ）、上記の式を満たすかを確認する（Ｓ３３２−ｋ）。Ｙｅｓの場合には、整数γ_１，γ_２，γ_３，δ_１，δ_２，δ_３をランダムに選択する処理を繰り返す。Ｎｏの場合には、次の処理に進む。

Is selected at random so as not to satisfy (S330-k). For example, the decoding random value selection unit 330-k randomly selects integers γ ₁ , γ ₂ , γ ₃ , δ ₁ , δ ₂ , and δ ₃ (S331-k), and confirms whether the above equation is satisfied. (S332-k). In the case of Yes, the process of randomly selecting the integers γ ₁ , γ ₂ , γ ₃ , δ ₁ , δ ₂ , and δ ₃ is repeated. In No, it progresses to the next process.

The hierarchical secret key generation unit 340-k includes a decryption key generation unit 350-k, a takeover information generation unit 360-k, and a secret key generation unit 370-k. A hierarchical secret key S (k) is generated. The decryption key generation means 350-k converts S _d (k) to

のように求める（Ｓ３５０−ｋ）。引継情報生成手段３６０−ｋは、Ｓ_ｒ（ｋ）を、

(S350-k). The takeover information generating means 360-k converts S _r (k) to

のように求める（Ｓ３６０−ｋ）。秘密鍵生成手段３７０−ｋは自己の（ｋ番目の階層の復号化装置３００−ｋ用の）階層秘密鍵Ｓ（ｋ）を
Ｓ（ｋ）←［Ｓ_ｄ（ｋ），Ｓ_ｒ（ｋ）］
のように求める（Ｓ３７０−ｋ）。復号化部３９０−ｋは、階層秘密鍵Ｓ（ｋ）のはじめの３つの要素をＡ_０，Ａ_１，Ａ_２とすると、暗号文Ｃ（ｋ）を

(S360-k). The secret key generation means 370-k obtains its own hierarchy secret key S (k) (for the kth hierarchy decryption apparatus 300-k) S (k) ← [S _d (k), S _r (k) ]
(S370-k). When the first three elements of the hierarchical secret key S (k) are A ₀ , A ₁ , and A ₂ , the decryption unit 390-k converts the ciphertext C (k).

のように平文Ｍに復号する（Ｓ３９０−ｋ）。

The plaintext M is decrypted as follows (S390-k).

The decryption device 300-1 in the first hierarchy is the same device as the key generation device 100 in the example of FIG. The components indicated by dotted lines in FIG. 2 are components that function as the first layer decoding apparatus 300-1. Specifically, the decoding recording unit 310-1 and the decoding unit 390-1. The decryption recording unit 310 records the hierarchical secret key S (1) for the first-level decryption device generated by the hierarchical secret key generation unit 140 and the received ciphertext C (1). The decryption unit 390-1 sets the first three elements of the hierarchical secret key S (1) as A ₀ , A ₁ , A _2, and converts the ciphertext C (1).

のように平文Ｍに復号する（Ｓ３９０−１）。なお、図１の例は１番目の階層の復号化装置は鍵生成装置と同一としたが、別の装置としてもよい。別の装置とする場合には、復号化装置３００−１は鍵生成装置１００から、１番目の階層の復号化装置用の階層秘密鍵Ｓ（１）を受け取っておく必要がある。
検証

Is decrypted into plaintext M (S390-1). In the example of FIG. 1, the decryption device in the first layer is the same as the key generation device, but may be a different device. In the case of using another device, the decryption device 300-1 needs to receive the hierarchical secret key S (1) for the first layer decryption device from the key generation device 100.
Validation

によって平文Ｍが求められることを確認する。
まず、鍵生成装置１００の階層秘密鍵生成部１４０で求める階層秘密鍵Ｓ（ｋ）で確認する。階層秘密鍵生成部１４０で求める階層秘密鍵Ｓ（ｋ）の最初の３つの要素Ａ_０，Ａ_１，Ａ_２は、次のとおりである。

To confirm that plaintext M is obtained.
First, the hierarchical secret key S (k) obtained by the hierarchical secret key generation unit 140 of the key generation device 100 is confirmed. The first three elements A ₀ , A ₁ , A ₂ of the hierarchical secret key S (k) obtained by the hierarchical secret key generation unit 140 are as follows.

また、Ｃ_１，Ｃ_２，Ｃ_３，Ｃ_４は、次のとおりである。

C ₁ , C ₂ , C ₃ , and C ₄ are as follows.

したがって、

Therefore,

は、次のようになる。

Is as follows.

Also, the hierarchical secret key generation unit 340-k uses its own (hierarchical secret key S (k) for the k-th hierarchy decryption apparatus 300-k) as the decryption apparatus 300- for the (k-1) th hierarchy. It is generated from the hierarchical secret key S (k-1) for k-1. Also,
S (k-1) is

であり、階層秘密鍵生成部３４０−ｋが求める階層秘密鍵Ｓ（ｋ）の最初の３つの要素Ａ_０，Ａ_１，Ａ_２は、次のとおりである。

The first three elements A ₀ , A ₁ , A ₂ of the hierarchical secret key S (k) obtained by the hierarchical secret key generation unit 340-k are as follows.

したがって、

Therefore,

となる。これらは、階層秘密鍵生成部１４０で求める階層秘密鍵Ｓ（ｋ）の最初の３つの要素Ａ_０，Ａ_１，Ａ_２

It becomes. These are the first three elements A ₀ , A ₁ , A _{2 of the} hierarchical secret key S (k) obtained by the hierarchical secret key generation unit 140.

と同じである。
つまり、ｋ番目（ただし、２番目以降）の階層の復号化装置は、自己（ｋ番目）よりも上位の階層の復号化装置の識別情報Ｄ_１，…，Ｄ_ｋ−１を知らなくても暗号文Ｃ（ｋ）を復号化できる。よって、暗号文Ｃ（ｋ）と一緒にＩＤ（復号化装置の識別情報）を送信する必要がなく、ＩＤ（復号化装置の識別情報）を秘匿化できる。また、暗号文Ｃ（ｋ）は、

Is the same.
That is, the decoding device in the k-th (but second or later) layer does not need to know the identification information D ₁ ,..., D _k−1 of the decoding device in the higher layer than itself (k-th). The ciphertext C (k) can be decrypted. Therefore, it is not necessary to transmit the ID (identification information of the decryption device) together with the ciphertext C (k), and the ID (identification information of the decryption device) can be concealed. The ciphertext C (k) is

なので、暗号文Ｃ（ｋ）の長さは階層に依存しない。

Therefore, the length of the ciphertext C (k) does not depend on the hierarchy.

  FIG. 8 shows a functional configuration example of a computer. Note that the key generation device, encryption device, and decryption device of the present invention causes the recording unit 2020 of the computer 2000 to read a program that causes the computer 2000 to operate as each component of the present invention, and the processing unit 2010 and the input unit 2030. This can be realized by operating the output unit 2040 or the like. In addition, as a method of causing the computer to read, the program is recorded on a computer-readable recording medium, and the program recorded on the server or the like is read into the computer through a telecommunication line or the like. There is a method to make it.

  The present invention can be used in a case where information is encrypted and communicated between two or more communication devices.

DESCRIPTION OF SYMBOLS 100 Key generation apparatus 110 Key generation recording part 120 Public key generation part 130 Key generation random value selection part 140 Hierarchical secret key generation part 150 Decryption key generation means 160 Takeover information generation means 170 Private key generation means 200 Encryption apparatus 210 Encryption recording Unit 230 encrypted random value selection unit 280 encryption unit 300 decryption device 310 decryption recording unit 330 decryption random value selection unit 340 hierarchical secret key generation unit 350 decryption key generation unit 360 takeover information generation unit 370 secret key generation unit 390 Decryption unit

Claims (14)

p and q are prime orders, G ^ and G _T ^ are cyclic groups with order pq, G _p is a subgroup of G ^ with prime order p, and G _q is G ^ with prime order q. Subgroup, e is a bilinear map e: G ^ × G ^ → G _T ^, K is an integer indicating the maximum value of the hierarchy, k is an integer of 1 ≦ k ≦ K indicating the hierarchy, and D _k is the kth , D is identification information for identifying K decoding devices, and D = [D ₁ ,..., D _K ],
Data _g, f, _v, h 1 is an element of the group _{G p,} ..., _h K, and w, data _R g is an element of the group _{G q, R f, R v} , R 1, ..., R K, g _q , a key generation recording unit for recording the identification information D,
G = gR _g , F = fR _f , V = vR _v , H ₁ = h ₁ R ₁ ,..., H _K = h _K R _K , E = e (g, w) are calculated, and [G, F, V, H ₁ ,..., H _K , E] as public keys P;
Integers r ₁ , r ₂ , s ₁ , s ₂ , t ₁ , t ₂

A key generation random value selection unit that randomly selects under a condition that does not satisfy
A hierarchical secret key generation unit that generates a hierarchical secret key S (1);
With
The hierarchical secret key generation unit
S _d (1)

Decryption key generation means to be obtained as follows:
S _r (1)

A takeover information generation means to obtain,
The hierarchical secret key S (1) is changed to S (1) ← [S _d (1), S _r (1)]
And a secret key generating means for obtaining the key. p and q are prime orders, G ^ and G _T ^ are cyclic groups with order pq, G _p is a subgroup of G ^ with prime order p, and G _q is G ^ with prime order q. Subgroup, e is a bilinear map e: G ^ × G ^ → G _T ^, K is an integer indicating the maximum value of the hierarchy, k is an integer of 1 ≦ k ≦ K indicating the hierarchy, and D _k is the kth , D is identification information for identifying K decoding devices, and D = [D ₁ ,..., D _K ],
Data _g, f, _v, h 1 is an element of the group _{G p,} ..., _h K, and w, data _R g is an element of the group _{G q, R f, R v} , R 1, ..., R K, g _q , a key generation recording unit for recording the identification information D,
G = gR _g , F = fR _f , V = vR _v , H ₁ = h ₁ R ₁ ,..., H _K = h _K R _K , E = e (g, w) are calculated, and [G, F, V, H ₁ ,..., H _K , E] as public keys P;
Integers r ₁ , r ₂ , s ₁ , s ₂ , t ₁ , t ₂

A key generation random value selection unit that randomly selects so as not to satisfy
a hierarchical secret key generation unit that generates a hierarchical secret key S (k) of the kth hierarchy;
With
The hierarchical secret key generation unit
S _d (k)

Decryption key generation means to be obtained as follows:
S _r (k)

A takeover information generation means to obtain,
The hierarchical secret key S (k) of the kth hierarchy is _expressed as S (k) ← [S _d (k), S _r (k)]
And a secret key generation means for obtaining the key. p and q are prime orders, G ^ and G _T ^ are cyclic groups with order pq, G _q is a subgroup of G ^ with prime order q, K is an integer indicating the maximum value of the hierarchy, and k is An integer of 1 ≦ k ≦ K indicating a hierarchy, D _k is an integer for identifying a decoding device of the k th layer, D is identification information for identifying K decoding devices, and D = [ D ₁ ,..., D _K ], and the public key P is P = [G, F, V, H ₁ ,..., H _K , E],
An encryption recording unit for recording the identification information D, the public key P, and the plaintext M;
An encryption random value selection unit for randomly selecting Z ₁ , Z ₂ , Z ₃ which are elements of the integer s and the group G _q ;
From the plaintext M that is an element of the group G _T ^, the ciphertext C (k) for the decryption device of the k-th hierarchy is obtained.

An encryption device comprising: an encryption unit to be obtained as described above. A decoding device for the second and subsequent layers,
p and q are prime orders, G ^ and G _T ^ are cyclic groups with order pq, G _p is a subgroup of G ^ with prime order p, and G _q is G ^ with prime order q. Subgroup, e is a bilinear map e: G ^ × G ^ → G _T ^, K is an integer indicating the maximum value of the hierarchy, k is an integer of 2 ≦ k ≦ K indicating the hierarchy, k−1th The hierarchical secret key S (k−1) of the hierarchy is represented by S (k−1) = [[a ₀ , a ₁ , a ₂ , b _k ,..., B _K ], [α ₀ , α ₁ , α ₂ , β _k ,..., β _K ], [α ₀ ′, α ₁ ′, α ₂ ′, β _k ′,..., β _K ′]], and the ciphertext C (k) C (k) = “C ₁ , C ₂ , C ₃ , C ₄ ”
a decryption recording unit that records a hierarchical secret key S (k−1), a ciphertext C (k), and identification information D _k of the k−1th hierarchy;
Integers γ ₁ , γ ₂ , γ ₃ , δ ₁ , δ ₂ , δ ₃

A decoding random value selection unit that randomly selects so as not to satisfy
a hierarchical secret key generation unit that generates a hierarchical secret key S (k) of the kth hierarchy;
A decryption unit that decrypts the ciphertext C into plaintext M using the hierarchical secret key S (k),
The hierarchical secret key generation unit
S _d (k)

Decryption key generation means to be obtained as follows:
S _r (k)

A takeover information generation means to obtain,
The hierarchical secret key S (k) of the kth hierarchy is _expressed as S (k) ← [S _d (k), S _r (k)]
And a secret key generation means for obtaining
The decoding unit
If A ₀ , A ₁ and A ₂ are the first three elements of the hierarchical secret key S (k),
Ciphertext C (k)

A decryption device characterized by decrypting into plaintext M as follows. A decoding device of the first hierarchy,
p and q are prime orders, G ^ and G _T ^ are cyclic groups with order pq, G _p is a subgroup of G ^ with prime order p, and G _q is G ^ with prime order q. The subgroup, e is a bilinear map in which e: G ^ × G ^ → G _T ^, and the ciphertext C (k) is C (k) = “C ₁ , C ₂ , C ₃ , C ₄ ”, A ₀ , A ₁ , A ₂ are the first three elements of the hierarchical secret key S (1),
A decryption recording unit for recording a first layer hierarchical secret key S (1) and ciphertext C (1);
Ciphertext C (1)

And a decrypting unit for decrypting into plaintext M as shown in FIG.
Integers r ₁ , r ₂ , s ₁ , s ₂ , t ₁ , t ₂ ,

It is a randomly selected integer under the condition that does not satisfy
S _d (1)

age,
S _r (1)

age,
The hierarchical secret key S (1) is
S (1) ← [S _d (1), S _r (1)]
A decoding apparatus characterized by being obtained as follows. An encryption system including a key generation device, an encryption device, and K-1 decryption devices layered,
p and q are prime orders, G ^ and G _T ^ are cyclic groups with order pq, G _p is a subgroup of G ^ with prime order p, and G _q is G ^ with prime order q. Subgroup, e is a bilinear map e: G ^ × G ^ → G _T ^, K is an integer indicating the maximum value of the hierarchy, k is an integer of 1 ≦ k ≦ K indicating the hierarchy, and D _k is the kth , D is identification information for identifying K decoding devices, and D = [D ₁ ,..., D _K ],
The key generation device includes:
Data _g, f, _v, h 1 is an element of the group _{G p,} ..., _h K, and w, data _R g is an element of the group _{G q, R f, R v} , R 1, ..., R K, g _q , a key generation recording unit for recording the identification information D,
G = gR _g , F = fR _f , V = vR _v , H ₁ = h ₁ R ₁ ,..., H _K = h _K R _K , E = e (g, w) are calculated, and [G, F, V, H ₁ ,..., H _K , E] as public keys P;
Integers r ₁ , r ₂ , s ₁ , s ₂ , t ₁ , t ₂

A key generation random value selection unit that randomly selects under a condition that does not satisfy
A first hierarchical secret key generation unit that generates a hierarchical secret key S (1);
With
The first layer private key generation unit
S _d (1)

First decryption key generation means to be obtained as follows:
S _r (1)

First takeover information generating means for obtaining as follows:
The hierarchical secret key S (1) is changed to S (1) ← [S _d (1), S _r (1)]
And a first secret key generation means for obtaining
The encryption device is:
An encryption recording unit for recording the identification information D, the public key P, and the plaintext M;
An encryption random value selection unit that randomly selects Z ₁ , Z ₂ , and Z ₃ that are elements of the integer s and the group G _q ;
From the plaintext M that is an element of the group G _T ^, the ciphertext C (k) for the decryption device of the k-th hierarchy is obtained.

And the required encryption part
The decoding devices in the second and subsequent kth layers are:
The hierarchical secret key S (k−1) of the (k−1) th hierarchy is expressed as S (k−1) = [[a ₀ , a ₁ , a ₂ , b _k ,..., b _K ], [α ₀ , α ₁ , Α ₂ , β _k ,..., Β _K ], [α ₀ ′, α ₁ ′, α ₂ ′, β _k ′,..., Β _K ′]], and the ciphertext C (k) C (k) = “C ₁ , C ₂ , C ₃ , C ₄ ”,
a decryption recording unit that records a hierarchical secret key S (k−1), a ciphertext C (k), and identification information D _k of the k−1th hierarchy;
Integers γ ₁ , γ ₂ , γ ₃ , δ ₁ , δ ₂ , δ ₃

A decoding random value selection unit that randomly selects so as not to satisfy
a second hierarchy secret key generation unit for generating a k-th hierarchy secret key S (k);
A decryption unit that decrypts the ciphertext C (k) into plaintext M using the hierarchical secret key S (k),
The second tier secret key generation unit
S _d (k)

Second decryption key generation means to be obtained as follows:
S _r (k)

Second take- over information generation means for obtaining as follows:
The hierarchical secret key S (k) of the kth hierarchy is _expressed as S (k) ← [S _d (k), S _r (k)]
Second secret key generation means to obtain as follows,
The decoding unit
If A ₀ , A ₁ and A ₂ are the first three elements of the hierarchical secret key S (k),
Ciphertext C (k)

The encryption system characterized by decrypting into plaintext M like this. p and q are prime orders, G ^ and G _T ^ are cyclic groups with order pq, G _p is a subgroup of G ^ with prime order p, and G _q is G ^ with prime order q. Subgroup, e is a bilinear map e: G ^ × G ^ → G _T ^, K is an integer indicating the maximum value of the hierarchy, k is an integer of 1 ≦ k ≦ K indicating the hierarchy, and D _k is the kth , D is identification information for identifying K decoding devices, and D = [D ₁ ,..., D _K ],
In advance key generation recording unit, data g, _{f, v,} h 1 is an element of the group _{G p, ..., h} K, and w, data _R g is an element of the group _{G q, R f, R v} , R ₁ ,..., R _K , g _q and identification information D are recorded,
The public key generation unit calculates G = gR _g , F = fR _f , V = vR _v , H ₁ = h ₁ R ₁ ,..., H _K = h _K R _K , E = e (g, w) , [G, F, V, H ₁ ,..., H _K , E] as public keys P;
In the public key generation unit, integers r ₁ , r ₂ , s ₁ , s ₂ , t ₁ , t ₂ are converted to

A public key generation step that is randomly selected under a condition not satisfying
A hierarchical secret key generation step of generating a hierarchical secret key S (1) in the hierarchical secret key generation unit;
Have
The hierarchical secret key generation step includes:
S _d (1)

A decryption key generation sub-step obtained as follows:
S _r (1)

The takeover information generation substep to be obtained as follows:
The hierarchical secret key S (1) is changed to S (1) ← [S _d (1), S _r (1)]
And a secret key generation sub-step to be obtained as follows. p and q are prime orders, G ^ and G _T ^ are cyclic groups with order pq, G _p is a subgroup of G ^ with prime order p, and G _q is G ^ with prime order q. Subgroup, e is a bilinear map e: G ^ × G ^ → G _T ^, K is an integer indicating the maximum value of the hierarchy, k is an integer of 1 ≦ k ≦ K indicating the hierarchy, and D _k is the kth , D is identification information for identifying K decoding devices, and D = [D ₁ ,..., D _K ],
In advance key generation recording unit, data g, _{f, v,} h 1 is an element of the group _{G p, ..., h} K, and w, data _R g is an element of the group _{G q, R f, R v} , R ₁ ,..., R _K , g _q and identification information D are recorded,
The public key generation unit calculates G = gR _g , F = fR _f , V = vR _v , H ₁ = h ₁ R ₁ ,..., H _K = h _K R _K , E = e (g, w) , [G, F, V, H ₁ ,..., H _K , E] as public keys P;
In the hierarchical secret key generation unit, integers r ₁ , r ₂ , s ₁ , s ₂ , t ₁ , t ₂

Key generation random value selection step that randomly selects so as not to satisfy
A hierarchical secret key generation step of generating a hierarchical secret key S (k) of the kth hierarchy in the hierarchical secret key generation unit;
Have
The hierarchical secret key generation step includes:
S _d (k)

A decryption key generation sub-step obtained as follows:
S _r (k)

The takeover information generation substep to be obtained as follows:
The hierarchical secret key S (k) of the kth hierarchy is _expressed as S (k) ← [S _d (k), S _r (k)]
And a secret key generation substep to be obtained as described above. p and q are prime orders, G ^ and G _T ^ are cyclic groups with order pq, G _q is a subgroup of G ^ with prime order q, K is an integer indicating the maximum value of the hierarchy, and k is An integer of 1 ≦ k ≦ K indicating a hierarchy, D _k is an integer for identifying a decoding device of the k th layer, D is identification information for identifying K decoding devices, and D = [ D ₁ ,..., D _K ], and the public key P is P = [G, F, V, H ₁ ,..., H _K , E],
The identification information D, the public key P, and the plaintext M are recorded in advance in the encryption recording unit,
An encryption random value selection step of randomly selecting Z ₁ , Z ₂ , Z ₃ which are elements of the integer s and the group G _{q in} the encryption random value selection unit;
In the encryption unit, from the plaintext M that is an element of the group G _T ^, the ciphertext C (k) for the decryption device of the kth hierarchy is obtained.

An encryption method comprising: obtaining an encryption step as follows. A decoding method for the second and subsequent layers,
p and q are prime orders, G ^ and G _T ^ are cyclic groups with order pq, G _p is a subgroup of G ^ with prime order p, and G _q is G ^ with prime order q. Subgroup, e is a bilinear map e: G ^ × G ^ → G _T ^, K is an integer indicating the maximum value of the hierarchy, k is an integer of 2 ≦ k ≦ K indicating the hierarchy, k−1th The hierarchical secret key S (k−1) of the hierarchy is represented by S (k−1) = [[a ₀ , a ₁ , a ₂ , b _k ,..., B _K ], [α ₀ , α ₁ , α ₂ , β _k ,..., β _K ], [α ₀ ′, α ₁ ′, α ₂ ′, β _k ′,..., β _K ′]], and the ciphertext C (k) C (k) = “C ₁ , C ₂ , C ₃ , C ₄ ”
In the decryption recording unit, the hierarchical secret key S (k-1) of the (k-1) th hierarchy, the ciphertext C (k), and its own identification information _Dk are recorded in advance.
In the decoding random value selection unit, integers γ ₁ , γ ₂ , γ ₃ , δ ₁ , δ ₂ , δ ₃ are converted to

A decoding random value selection step of randomly selecting so as not to satisfy
A hierarchical secret key generation step of generating a hierarchical secret key S (k) of the kth hierarchy in the hierarchical secret key generation unit;
A decrypting unit for decrypting the ciphertext C into plaintext M using the hierarchical secret key S (k);
The hierarchical secret key generation step includes:
S _d (k)

A decryption key generation sub-step obtained as follows:
S _r (k)

The takeover information generation substep to be obtained as follows:
The hierarchical secret key S (k) of the kth hierarchy is _expressed as S (k) ← [S _d (k), S _r (k)]
And a secret key generation substep to obtain,
The decoding step includes
If A ₀ , A ₁ and A ₂ are the first three elements of the hierarchical secret key S (k),
Ciphertext C (k)

A decryption method characterized by decrypting into plaintext M as follows. A first layer decoding method,
p and q are prime orders, G ^ and G _T ^ are cyclic groups with order pq, G _p is a subgroup of G ^ with prime order p, and G _q is G ^ with prime order q. The subgroup, e is a bilinear map in which e: G ^ × G ^ → G _T ^, and the ciphertext C (k) is C (k) = “C ₁ , C ₂ , C ₃ , C ₄ ”, A ₀ , A ₁ , A ₂ are the first three elements of the hierarchical secret key S (1),
First, the hierarchical secret key S (1) and ciphertext C (1) of the first hierarchy are recorded in the decryption recording unit,
In the decryption unit, the ciphertext C (1) is

And a decrypting step for decrypting into plaintext M as follows:
Integers r ₁ , r ₂ , s ₁ , s ₂ , t ₁ , t ₂ ,

It is a randomly selected integer under the condition that does not satisfy
S _d (1)

age,
S _r (1)

age,
The hierarchical secret key S (1) is
S (1) ← [S _d (1), S _r (1)]
A decoding method characterized in that the decoding method is obtained as follows. An encryption method comprising a key generation device, an encryption device, and K-1 decryption devices layered,
p and q are prime orders, G ^ and G _T ^ are cyclic groups with order pq, G _p is a subgroup of G ^ with prime order p, and G _q is G ^ with prime order q. Subgroup, e is a bilinear map e: G ^ × G ^ → G _T ^, K is an integer indicating the maximum value of the hierarchy, k is an integer of 1 ≦ k ≦ K indicating the hierarchy, and D _k is the kth , D is identification information for identifying K decoding devices, and D = [D ₁ ,..., D _K ],
The key generation device includes:
Data _g, f, _v, h 1 is an element of the group _{G p,} ..., _h K, and w, data _R g is an element of the group _{G q, R f, R v} , R 1, ..., R K, g _q and identification information D are recorded,
G = gR _g , F = fR _f , V = vR _v , H ₁ = h ₁ R ₁ ,..., H _K = h _K R _K , E = e (g, w) are calculated, and [G, F, V, H ₁ ,..., H _K , E] as public keys P,
Integers r ₁ , r ₂ , s ₁ , s ₂ , t ₁ , t ₂

A key generation random value selection step for randomly selecting under a condition not satisfying
A first layer secret key generation step of generating a hierarchical secret key S (1),
Have
The first layer private key generation step includes:
S _d (1)

A first decryption key generation substep obtained as follows:
S _r (1)

A first takeover information generation sub-step to be obtained as follows:
The hierarchical secret key S (1) is changed to S (1) ← [S _d (1), S _r (1)]
A first secret key generation substep to be obtained as follows:
The encryption device is:
Record identification information D, public key P, plaintext M,
An encryption random value selection step of randomly selecting Z ₁ , Z ₂ , Z ₃ which are elements of an integer s and a group G _q ;
From the plaintext M that is an element of the group G _T ^, the ciphertext C (k) for the decryption device of the k-th hierarchy is obtained.

And an encryption step to be obtained as follows,
The decoding devices in the second and subsequent kth layers are:
The hierarchical secret key S (k−1) of the (k−1) th hierarchy is expressed as S (k−1) = [[a ₀ , a ₁ , a ₂ , b _k ,..., b _K ], [α ₀ , α _{1 , α 2, β k, ...} , β K], [α 0 ', α 1', α 2 ', β k', ..., β K ']], the ciphertext C (k) C (k) = “C ₁ , C ₂ , C ₃ , C ₄ ”,
record the hierarchy secret key S (k-1), ciphertext C (k), and self identification information _Dk of the (k-1) th hierarchy,
Integers γ ₁ , γ ₂ , γ ₃ , δ ₁ , δ ₂ , δ ₃

A decoding random value selection step of randomly selecting so as not to satisfy
a second hierarchical secret key generation step of generating a k-th hierarchical secret key S (k);
Decrypting the ciphertext C (k) into plaintext M using the hierarchical secret key S (k),
The second hierarchical secret key generation step includes:
S _d (k)

A second decryption key generation sub-step obtained as follows:
S _r (k)

A second takeover information generation sub-step obtained as follows:
The hierarchical secret key S (k) of the kth hierarchy is _expressed as S (k) ← [S _d (k), S _r (k)]
A second secret key generation sub-step to be obtained as follows:
The decoding step includes
If A ₀ , A ₁ and A ₂ are the first three elements of the hierarchical secret key S (k),
Ciphertext C (k)

An encryption method characterized by decrypting into plaintext M as follows.   A program for operating a computer as the apparatus according to claim 1.   A computer-readable recording medium on which the program according to claim 13 is recorded.

Images