JP5449040B2 - Key exchange system, key exchange device, key extraction device, key exchange method, key extraction method, and program - Google Patents

Description

  The present invention relates to an application technology of information security technology, and particularly to a key exchange technology for sharing a common session key between two parties.

  One of the conventional ID authentication key exchange methods is the SYL method (see, for example, Non-Patent Document 1). The outline of the SYL method is described below.

[Parameter]
G, G _T are cyclic groups of prime order p of κ bits, g is a generator of G, g _T = e (g, g) is a generator of G _T , and e: G × G → G _T is paired And H: {0,1} ^* → {0,1} ^κ, and H ₁ : {0,1} ^* → G as a hash function. Key generator randomly selects a master secret key λ∈Z _p, to publish a master public key Λ = g λ ^∈G.

[Key generation]
For the identifiers ID _A and ID _B ∈ {0,1} ^* of the users A and B, the key generator generates Q _A = H ₁ (ID _A ) ∈G and Q _B = H ₁ (ID _B ) ∈, respectively. calculate the G, to generate the private key D _a = Q _a ^λ ∈G, a D _B = Q _B ^λ ∈G using the master secret key lambda.

[Key exchange]
User _A with identifier ID _A and secret key D _A = Q _A ^λ ∈ G and user _B with identifier ID _B and secret key D _B = Q _B ^λ ∈ G exchange authentication keys as follows: , Share the session key (shared key) K.

User A randomly selects a short-term secret key χ _A ∈ _U Z _p , calculates a short-term public key X _A = g ^χ _A , and sends (ID _A , ID _B , X _A ) to user B.

User B receives (ID _A , ID _B , X _A ), randomly selects a short-term secret key χ _B ∈ _U Z _p , calculates a short-term public key X _B = g ^χB , and (ID _A , ID _B , X _A , X _B ) to user A. User B calculates σ ₁ = e (Q _A・ X ^A , D _B・ Λ ^χB ), σ ₂ = X _A ^χB, and ^sets the session key K = H (σ ₁ , σ ₂ , ID _A , ID _B , X _A , X _B ) is calculated.

User A receives (ID _A , ID _B , X _A , X _B ), calculates σ ₁ = e (D _A · Λ ^χA , Q _B · X _B ), σ ₂ = X _B ^χA , The key K = H (σ ₁ , σ ₂ , ID _A , ID _B , X _A , X _B ) is calculated.

Since σ ₁ = g _T ^{λ (log (QA) + χA) · (log (QB) + χB)} and σ ₂ = ^{gχA · χB} , the session keys K calculated by both coincide.

L. Chen, Z. Cheng, Nigel P. Smart, "Identity-based key agreement protocols from pairings", Int. J. Inf. Sec. 6 (4): 213-241 (2007).

  However, the SYL method is a simple method in which a session key can be generated only when the ID specified by the other party and the user's ID match, and the other party sharing the session key cannot be specified under various conditions. It was.

  The present invention has been made in view of these points, and an object of the present invention is to provide a key exchange technique capable of designating a partner sharing a session key under various conditions.

In the present invention, a session key is generated by the first key exchange device and the second key exchange device. The generators of the cyclic groups G ₁ , G ₂ , and G _T are g ₁ , g ₂ , and g _T , respectively, and the bilinear mapping that maps the direct product space G ₁ × G ₂ elements to the cyclic group G _T is e: G ₁ a × G ₂ → G _T, is a set of attribute information j is ATT, is a master secret key is λ and t (j) (j∈ATT), master public key is λ = g _T ^λ ∈G _T and T (j) = g ₂ ^{t (j)} ∈ G ₂ . Tree structure data γ _A including U _A (U _A ≧ 2) pieces of node information N (u _A ) (u _A ∈ {1,..., U _A }) corresponds to the first key exchange device, and Part of the information N (u _A ) is parent node information N (u _AP ) (u _AP ∈ {1, ..., U _A }), and the parent node information N (u _AP ) includes c (u _AP ) Child node information N (u _AC ) (u _AC ε {1,..., U _A }), and any one of the parent node information N (u _AP ) is root node information N (u _AR ) (u _AR ∈ {1, ..., U _A }), and at least part of the child node information N (u _AC ) is leaf node information N (u _AL ) (u _AL ∈ {1, ... , U _A }), the set of u _AL corresponding to the leaf node information N (u _AL ) is L (γ _A ), and each of the parent node information N (u _AP ) has 1 ≦ k (u _AP ) ≦ c (u _AP ) corresponding to the threshold k (u _AP ), each of the node information N (u _A ) corresponds to the information q (u _A , η (u _A )), and the root node The information q (u _AR , η (u _AR )) corresponding to the information N (u _AR ) is the master secret key λ, and the information q (u _AP , corresponding to the parent node information N (u _AP ) η (u _AP )) is k (u _AP ) -out-of-c (u _AP ) threshold information, and the shared node information N is the child node information N corresponding to the parent node information N (u _AP ) (u _AC ) is information q (u _AC , η (u _AC )), and leaf node information N (u _AL ) has attribute information att (u _AL ) ∈ATT and secret value D (u _AL ), respectively. = g ₁ ^{q (uAL, η (uAL)) / t (att (uAL))} ∈G ₁ corresponds to the first set of secret values D (u _AL ) (u _AL ∈L (γ _A )) The long-term secret key D _A = {D (u _AL )} _{uALεL (γA)} of the key exchange device. Tree structure data γ _B including U _B (U _B ≧ 2) pieces of node information N (u _B ) (u _B ε {1,..., U _B }) corresponds to the second key exchange device, and Part of the information N (u _B ) is parent node information N (u _BP ) (u _BP ∈ {1, ..., U _B }), and the parent node information N (u _BP ) includes c (u _BP ) Child node information N (u _BC ) (u _BC ε {1,..., U _B }), and any one of the parent node information N (u _BP ) is root node information N (u _BR ) (u _BR ∈ {1, ..., U _B }), and at least part of the child node information N (u _BC ) is leaf node information N (u _BL ) (u _BL ∈ {1, ... , U _B }), the set of u _BL corresponding to the leaf node information N (u _BL ) is L (γ _B ), and each of the parent node information N (u _BP ) has 1 ≦ k (u _BP ) ≦ c (u _BP ) corresponding to threshold k (u _BP ), node information N (u _B ) corresponds to information q (u _B , η (u _B )), and root node Information q (u _BR , η (u _BR )) corresponding to the information N (u _BR ) is the master secret key λ, and information q (u _BP , corresponding to the parent node information N (u _BP ) η (u _BP )) is k (u _BP ) -out-of-c (u _BP ) threshold information and the distributed information obtained from the distributed node information N corresponding to the parent node information N (u _BP ) (u _BC ) is information q (u _BC , η (u _BC )), and leaf node information N (u _BL ) has attribute information att (u _BL ) ∈ATT and secret value D (u _BL ), respectively. = g ₁ ^{q (uBL, η (uBL)) / t (att (uBL))} ∈G ₁ corresponds to the second set of secret values D (u _BL ) (u _BL ∈L (γ _B )) The long-term secret key D _B = {D (u _BL )} _{uBLεL (γB)} of the key exchange device.

The first key exchange apparatus generates arbitrarily short secret key s _A, using the attribute set δ _A ⊂ATT and long secret key D _A and short secret key s _A is a subset of the set of attribute information ATT, T _A = {T (w _A ) ^χ which is a set of elements T (w _A ) ^χ ∈ G ₂ (w _A ∈δ _A ) for the image χ of values including the long-term secret key D _A and the short-term secret key s _A } A first short-term public key including _wAεδA is generated, and the attribute set δ _A and the first short-term public key are output to the second key exchange device.

The second key exchange unit, short-term secret key s _B optionally generate, using the attribute set δ _B ⊂ATT and long secret key D _B and short secret key s _B is a subset of the set of attribute information ATT, T _B = {T (w _B ) ^υ which is a set of elements T (w _B ) ^υ ∈ G ₂ (w _B ∈δ _B ) for the image υ of the value including the long-term secret key D _B and the short-term secret key s _B } A second short-term public key including _wBεδB is generated, and the attribute set δ _B and the second short-term public key are output to the first key exchange device.

The first key exchange device receives the input of the attribute set δ _B and the second short-term public key, and the leaf node information N (u _AL ) corresponding to the attribute information att (u _AL ) ∈δ _B belonging to the attribute set δ _B Secret value D (u _AL ) = g ₁ ^{q (uAL, η (uAL)) / t (att (uAL))} ∈ G ₁ and element T (att (u _AL )) included in the second short-term public key ^A bilinear map e is applied to ^υ ∈ G ₂ and the restored value e (D (u _AL ), T (att (u _AL )) ^υ ) = g _{T for} leaf node information N (u _AL ) ^{υ ・ q (uAL, η (uAL))} ∈G _T is generated, and the restored value g _T ^{υ ・ q (uAC, η (uAC))} ∈G _T among the child node information N (u _AC ) corresponding to itself For the parent node information N (u _AP ) for which the total number of generated is equal to or greater than the threshold k (u _AP ) corresponding to itself, the restoration value g _T ^υ greater than or equal to the threshold k (u _AP ) ^{Q (uAC, η (uAC))} ∈ G _T is used as shared information of k (u _AP ) -out-of-c (u _AP ) threshold secret sharing method, and the restored value g corresponding to the shared information _T ^{υ · q (uAP, η (uAP))} ∈G _T is generated. Here, when the restored value g _T ^{υ · q (uAR, η (uAR))} = g _T ^{υ · λ} ∈G _T for the root node information N (u _AR ) is generated, the first key exchange device and it outputs the image of values including and ^{_{χ = g T χ · λ ∈G}} T and ^g _T υ ^· λ ∈G _T as the first session key.

The second key exchange apparatus receives the attribute set δ _A and the first short-term public key and receives leaf node information N (u _BL ) corresponding to the attribute information att (u _BL ) ∈δ _A belonging to the attribute set δ _A. Secret value D (u _BL ) = g ₁ ^{q (uBL, η (uBL)) / t (att (uBL))} ∈ G ₁ and element T (att (u _BL )) included in the first short-term public key ^A bilinear map e is applied to ^χ ∈ G ₂ and the restored value e (D (u _BL ), T (att (u _BL )) ^χ ) = g _{T for} leaf node information N (u _BL ) ^{χ ・ q (uBL, η (uBL))} ∈G _T is generated, and the restored value g _T ^{χ ・ q (uBC, η (uBC))} ∈G _T among the child node information N (u _BC ) corresponding to itself For the parent node information N (u _BP ) for which the total number of generated is equal to or greater than the threshold k (u _BP ) corresponding to itself, the restored value g _T ^{χ that is} greater than or equal to the threshold k (u _BP ) ^{Q (uBC, η (uBC))} ∈ G _T is used as shared information of k (u _BP ) -out-of-c (u _BP ) threshold secret sharing method, and the restored value g corresponding to the shared information _T ^{χ · q (uBP, η (uBP))} ∈G _T is generated. Here, reconstruction values ^{_{g T χ · q (uBR,}} η (uBR)) for the root node information N (u _BR) = If ^g _T χ ^· λ ∈G _T has been generated, the second key exchange unit, and it outputs the image values as a second session key and a ^g _T χ ^· λ ∈G _T and ^{_{Λ υ = g T υ · λ}} ∈G T.

The tree structure data γ _A and γ _B of the present invention correspond to specific logical expressions, respectively, the attribute set δ _A makes the logical expression corresponding to the tree structure data γ _B true, and the attribute set δ _B becomes the tree structure data γ _A. When the logical expression corresponding to is made true, the same session key is generated between the first key exchange device and the second key exchange device. For this reason, in the present invention, it is possible to specify a partner who shares a session key under various conditions.

FIG. 1 is a diagram for explaining the overall configuration of the key exchange system according to the embodiment. FIG. 2 is a diagram for explaining the configuration of the key exchange apparatus according to the embodiment. FIG. 3 is a diagram for explaining the configuration of the key exchange apparatus according to the embodiment. FIG. 4 is a diagram for explaining the configuration of the key extraction apparatus according to the embodiment. 5A and 5B are diagrams for explaining a key extraction method according to the embodiment. FIG. 6 is a diagram for explaining a key exchange method in the embodiment. FIG. 7 is a diagram for explaining a key exchange method in the embodiment. 8A and 8B are diagrams for illustrating tree structure data. 9A and 9B are diagrams for illustrating tree structure data. 10A and 10B are diagrams for illustrating the tree structure data. 11A and 11B are diagrams for illustrating tree structure data.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

<Definition>
Terms used in this form are defined.
∧: ∧ represents a logical product.
∨: ∨ represents a logical sum.
・⁻ : ・⁻ Indicates negation of ・.
Z: Z represents an integer set.
κ: κ represents a security parameter (κ∈Z, κ> 0).
Z _p : Z _p represents a ring of order p (p ≧ 1). An example of Z _p is a remainder ring modulo p. An example of p is a prime number of κ bits. However, these examples do not limit the present invention.
_{ξ∈ U Z p: ξ∈ U Z} p represents the selection of any original ξ of Z _p.

{0,1} ^* : {0,1} ^* represents a binary sequence having an arbitrary bit length. One example is a sequence consisting of integers 0 and 1. However, {0,1} ^* is not limited to a sequence consisting of integers 0 and 1. {0,1} ^* is synonymous with a finite field of order 2 or its extension.

{0,1} ^ζ : {0,1} ^ζ represents a binary sequence having a bit length ζ (ζ∈Z, ζ> 0). One example is a sequence consisting of integers 0 and 1. However, {0, 1} ^ζ is not limited to a sequence composed of integers 0 and 1. {0,1} ^ζ is synonymous with a finite field of order 2 (when ζ = 1) or an expanded field obtained by ζ-order expansion (when ζ> 1).

G ₁ , G ₂ , G _T : Each of G ₁ , G ₂ , G _T represents a predetermined cyclic group, and each of g ₁ , g ₂ , g _T represents a cyclic group G ₁ , G ₂ , G _T Represents the origin of the. In the example of the present embodiment, it is assumed that G ₁ , G ₂ , and G _T are cyclic groups having a prime order p of κ bits. Note that G ₁ = G ₂ or G ₁ ≠ G ₂ may be satisfied. A specific example of the cyclic groups G ₁ and G ₂ is a finite set consisting of equal points of elliptic curves and its subgroups. Specific examples of the cyclic group G _T is a group consisting of a finite set constituting the extension field. In this embodiment, operations defined on the cyclic groups G ₁ , G ₂ , and G _T are expressed in a multiplicative manner. That, [psi ^beta ∈G ₁ for Beta∈Z _p and Pusai∈G ₁ means that applying operation defined in the cyclic group G ₁ with respect ψ∈G ₁ β times, ψ _1, ψ ₂ ∈ ψ ₁ · ψ ₂ ∈G for G _{1 1} is meant to carry out the operation defined in the cyclic group G ₁ a and [psi ₁ ∈G ₁ and [psi ₂ ∈G ₁ as operand. The same applies to the cyclic groups G ₂ and G _T.

e: e represents a bilinear mapping G ₁ × G ₂ → G _T View daylight former direct product space G ₁ × G ₂ in the cyclic group G _T, it satisfies the _{e (g 1, g 2)} = g T. The bilinear map e satisfies the following properties.

[Bilinearity] For all ψ ₁ εG ₁ , ψ ₂ εG ₂ and ε, ζεZ _p , the following relationship is satisfied.
e (ψ ₁ ^ε , ψ ₂ ^ζ ) = e (ψ ₁ , ψ ₂ ) ^{ε ・ ζ} … (1)
[Non-degenerative] all
ψ ₁ ∈G ₁ , ψ ₂ ∈G ₂ (2)
Not a mapping which maps the identity element of the cyclic group G _T a.
[Computability] There is an algorithm for efficiently calculating e (ψ ₁ , ψ ₂ ) for every ψ ₁ εG ₁ , ψ ₂ εG ₂ .

A specific example of the bilinear map e is a function for performing pairing operations such as Weil pairing and Tate pairing (for example, Reference 1 “Alfred. J. Menezes, ELLIPTIC CURVE PUBLIC KEY CRYPTOSYSTEMS, KLUWER ACADEMIC PUBLISHERS , ISBN0-7923-9368-6, pp. 61-81 etc.). Also, a modified pairing function e (ψ ₁ , phi (ψ ₂ )) (ψ ₁ ∈G) that combines a function for performing pairing operations such as Tate pairing and a predetermined function phi according to the type of elliptic curve ₁ , ψ ₂ ∈G ₂ ) may be used as the bilinear map e (for example, Reference 2 “RFC 5091: Identity-Based Cryptography Standard (IBCS) # 1: Supersingular Curve Implementations of the BF and BB1 Cryptosystems”) reference). Also, as algorithms for performing pairing operations on a computer, there are well-known Miller's algorithms, etc., and elliptic curves and cyclic groups G ₁ , G ₂ , G _T for efficiently performing pairing operations The construction method is well known.

Attribute information: Attribute information means a value representing some attribute. A set of attribute information j: {0,1} ^Φ is represented as ATT. In the example of the present embodiment, it is assumed that the attribute information j is an integer from 1 to J (J is a positive integer), and ATT = {1,..., J}. However, this does not limit the present invention.

  Ω: Ω represents a protocol ID, which is a unique identifier corresponding to the use of the protocol.

k-out-of-c threshold secret sharing method: k-out-of-c threshold secret sharing method is an arbitrarily different k pieces of distributed information SH (φ ₁ ), ..., SH ( Secret information SK can be restored if φ _k ) (1 ≦ k ≦ c) is given, but given k-1 pieces of shared information SH (φ ₁ ), ..., SH (φ _k-1 ) The secret information SK information is not obtained at all (for example, Reference 3 “Adi Shamir,“ How to share a secret ”, Communications of the ACM, Volume 22, No. 11, pp.612- 613 (November 1979) "). An example is shown below.

(1) k-1 order polynomial q (α) = ξ ₀ + ξ ₁・ α + ξ ₂・ α ² + ... + for indefinite element α satisfying q (η) = SK (η is a constant) Choose ξ _K-1・ α ^k-1 at random. That is, q (η) = SK, and ξ ₁ ,..., Ξ _K-1 are selected at random. An example of the constant η is η = 0. Then, the distributed information is SH (ρ) = q (index (ρ)) (ρ∈ {1,..., C}). Note that index (ρ) is a different index corresponding to each ρ, and an example thereof is index (ρ) = ρ.

(2) Arbitrarily different k pieces of distributed information q (φ ₁ ), ..., q (φ _k ) (S = {φ ₁ , ..., φ _k } ⊂ {index (1), ... ., index (c)}) is obtained, for example, the Lagrange interpolation formula can be used to restore the secret information SK by the following restoration process.

SK = q (η) = Δ (φ ₁ , q (η)) ・ q (φ ₁ ) + ... + Δ (φ _k , q (η)) ・ q (φ _k )… (3)
Where Δ (ι, q (η)) (ι∈S) is a Lagrange coefficient expressed as follows.

は先頭からι番目の被演算子〔分母の要素(φ_ι-φ_ι)、分子の要素(η-φ_ι)〕が存在しないことを意味する。すなわち、式(4)の分母は、
(φ_ι-φ₁)・...・(φ_ι-φ_ι-1)・(φ_ι-φ_ι+1)・...・(φ_ι-φ_k)
であり、式(4)の分子は
(η-φ₁)・...・(η-φ_ι-1)・(η-φ_ι+1)・...・(η-φ_k)
である。

Means that there is no ι-th operand from the top [element of denominator (φ _ι -φ _ι ), element of numerator (η-φ _ι )]. That is, the denominator of equation (4) is
(φ _ι -φ ₁ ) ・ ... ・ (φ _ι -φ _ι-1 ) ・ (φ _ι -φ _{ι + 1} ) ・ ... ・ (φ _ι -φ _k )
And the numerator of formula (4) is
(η-φ ₁ ) ・ ・ ・ ・ ・ (η-φ _ι-1 ) ・ (η-φ _{ι + 1} ) ・ ... ・ (η-φ _k )
It is.

H: H represents a hash function H: {0,1} ^* → {0,1} ^κ that moves {0,1} ^* to {0,1} ^k .
H ': H' is a hash function H moves the {0,1} ^* to Z _p: represents the {0, 1} ^* → Z _p.

<Principle>
Next, the principle of this embodiment will be described. In this embodiment, a session key is generated between the first key exchange device and the second key exchange device. Each of the first and second key exchange apparatuses is associated with tree structure data γ _A and γ _B representing a logical expression for attribute information. The first key exchange device sets an attribute set δ _A ⊂ATT, which is a subset of the attribute information set ATT, and outputs the set to the second key exchange device. The second key exchange device sets the attribute information j An attribute set δ _B ⊂ATT, which is a subset of ATT, is set and output to the first key exchange device. Here, when the attribute set δ _A makes the logical expression corresponding to the tree structure data γ _B true and the attribute set δ _B makes the logical expression corresponding to the tree structure data γ _A true, the first key exchange device The same session key is generated with the second key exchange device. First, the basic configuration of the tree structure data will be described.

[Tree structure data γ _A ]
The tree structure data γ _A corresponding to the first key exchange device is data of a rooted tree structure, and U _A (U _A ≧ 2) pieces of node information N (u _A ) (u _A ∈ {1,. , U _A }). Part of the node information N (u _A ) is parent node information N (u _AP ) (u _AP ∈ {1, ..., U _A }), and the parent node information N (u _AP ) includes c (u _AP ) (c (u _AP ) ≧ 1) pieces of child node information N (u _AC ) (u _AC ε {1,..., U _A }) correspond. Any one of the parent node information N (u _AP ) is the root node information N (u _AR ) (u _AR ∈ {1,..., U _A }), and at least one of the child node information N (u _AC ). Part is leaf node information N (u _AL ) (u _AL ∈ {1, ..., U _A }), and the set of u _AL corresponding to leaf node information N (u _AL ) is L (γ _A ) is there. Each of the parent node information N (u _AP ) corresponds to a threshold value k (u _AP ) that satisfies 1 ≦ k (u _AP ) ≦ c (u _AP ). Information q (u _A , η (u _A )) corresponds to each node information N (u _A ). Information q (u _AR , 0) corresponding to the root node information N (u _AR ) is the master secret key λ. Also, the information q (u _AP , η (u _AP )) corresponding to the parent node information N (u _AP ) is obtained by k (u _AP ) -out-of-c (u _AP ) threshold secret sharing. The distributed information is information q (u _AC , η (u _AC )) corresponding to the child node information N (u _AC ) corresponding to the parent node information N (u _AP ). The leaf node information N (u _AL ) has one attribute information att (u _AL ) ∈ATT and a secret value D (u _AL ) = g ₁ ^{q (uAL, η (uAL)) / t (att (uAL))} ∈ G ₁ corresponds, and the set of secret values D (u _AL ) (u _AL ∈L (γ _A )) is the long-term secret key D _A = {D (u _AL )} _{uAL∈L of} the first key exchange device _(γA) . Note that t (j) (j∈ATT) is a master secret key. Incidentally, uA subscript represents u _A.

For example, when the method described in Reference 3 is used as the threshold secret sharing method, each child node information N (u _AC ) corresponds to an identifier index (u _AC ), and the leaf node information N (u _AL) to the threshold k (u _AL) = 1 corresponds, degree d (u _a) of indeterminate α each node information _{N (u a) = k (} u a) Corresponds to the polynomial q (u _A , α) of -1. Here, η (u _A ) is a constant corresponding to the node information N (u _A ). The information q (u _A , η (u _A )) is a value obtained by substituting the constant η (u _A ) into the polynomial q (u _A , α) and corresponds to the child node information N (u _AC ) Information q (u _AC , η (u _AC )) is the child node information in the polynomial q (u _AP , α) corresponding to the parent node information N (u _AP ) corresponding to the child node information N (u _AC ) Q (u _AP , index (u _AC )) obtained by substituting the identifier index (u _AC ) corresponding to N (u _AC ).

[Tree structure data γ _B ]
The tree structure data γ _B corresponding to the second key exchange device is configured in the same manner as the tree structure data γ _A. That is, the tree structure data γ _B is data of a rooted tree structure, and U _B (U _B ≧ 2) pieces of node information N (u _B ) (u _B ∈ {1, ..., U _B }) Including. Part of the node information N (u _B ) is parent node information N (u _BP ) (u _BP ∈ {1, ..., U _B }), and the parent node information N (u _BP ) includes c (u _BP ) (c (u _BP ) ≧ 1) pieces of child node information N (u _BC ) (u _BC ε {1,..., U _B }) correspond to each other. Any one of the parent node information N (u _BP ) is the root node information N (u _BR ) (u _BR ε {1,..., U _B }), and at least one of the child node information N (u _BC ). Part is leaf node information N (u _BL ) (u _BL ∈ {1, ..., U _B }), and the set of u _BL corresponding to leaf node information N (u _BL ) is L (γ _B ) is there. Each of the parent node information N (u _BP ) corresponds to a threshold value k (u _BP ) that satisfies 1 ≦ k (u _BP ) ≦ c (u _BP ). Information q (u _B , η (u _B )) corresponds to each node information N (u _B ). Information q (u _BR , η (u _BR )) corresponding to the root node information N (u _BR ) is the master secret key λ. Also, information q (u _BP , η (u _BP )) corresponding to parent node information N (u _BP ) is obtained by k (u _BP ) -out-of-c (u _BP ) threshold secret sharing The distributed information is information q (u _BC , η (u _BC )) corresponding to the child node information N (u _BC ) corresponding to the parent node information N (u _BP ). The leaf node information N (u _BL ) has one attribute information att (u _BL ) ∈ATT and secret value D (u _BL ) = g ₁ ^{q (uBL, η (uBL)) / t (att (uBL))} ∈ G ₁ corresponds, and the set of secret values D (u _BL ) (u _BL ∈L (γ _B )) is the long-term secret key D _B = {D (u _BL )} _{uBL∈L of} the second key exchange device _(γB) . Incidentally, uB subscript represents the u _B.

For example, when the method described in Reference 3 is used as the threshold secret sharing method, each child node information N (u _BC ) corresponds to an identifier index (u _BC ), and the leaf node information N (u _BL) to the threshold k (u _BL) = 1 corresponds, degree d (u _B) of indeterminate α each node information _{N (u B) = k (} u B) Corresponds to the polynomial q (u _B , α) of -1. Here, η (u _B ) is a constant corresponding to the node information N (u _B ). Also, information q (u _B , η (u _B )) is a value obtained by substituting constant η (u _B ) into polynomial q (u _B , α) and corresponds to child node information N (u _BC ) Information q (u _BC , η (u _BC )) is the child node information in the polynomial q (u _BP , α) corresponding to the parent node information N (u _BP ) corresponding to the child node information N (u _BC ) Q (u _BP , index (u _BC )) obtained by substituting the identifier index (u _BC ) corresponding to N (u _BC ).

[Key exchange]
The first key exchange device corresponding to the tree structure data γ _A and the second key exchange device corresponding to the tree structure data γ _B generate a session key by the following processing.

The first key exchange apparatus generates arbitrarily short secret key s _A, using the attribute set δ _A ⊂ATT and long secret key D _A and short secret key s _A is a subset of the set of attribute information ATT, T _A = {T (w _A ) ^χ which is a set of elements T (w _A ) ^χ ∈ G ₂ (w _A ∈δ _A ) for the image χ of values including the long-term secret key D _A and the short-term secret key s _A } A first short-term public key including _wAεδA is generated, and the attribute set δ _A and the first short-term public key are output to the second key exchange device. Note that T (j) = g ₂ ^{t (j)} ∈ G ₂ is a master public key. Also, subscripts wA, .delta.A each represent w _A, [delta] _A.

The second key exchange unit, short-term secret key s _B optionally generate, using the attribute set δ _B ⊂ATT and long secret key D _B and short secret key s _B is a subset of the set of attribute information ATT, T _B = {T (w _B ) ^υ which is a set of elements T (w _B ) ^υ ∈ G ₂ (w _B ∈δ _B ) for the image υ of the value including the long-term secret key D _B and the short-term secret key s _B } A second short-term public key including _wBεδB is generated, and the attribute set δ _B and the second short-term public key are output to the first key exchange device. Note that subscripts wB, .delta.B each represent w _B, [delta] _B.

The first key exchange device receives the input of the attribute set δ _B and the second short-term public key, and the leaf node information N (u _AL ) corresponding to the attribute information att (u _AL ) ∈δ _B belonging to the attribute set δ _B Secret value D (u _AL ) = g ₁ ^{q (uAL, η (uAL)) / t (att (uAL))} ∈ G ₁ and element T (att (u _AL )) included in the second short-term public key ^A bilinear map e is applied to ^υ ∈ G ₂ and the restored value e (D (u _AL ), T (att (u _AL )) ^υ ) = g _{T for} leaf node information N (u _AL ) ^{υ · q (uAL, η (} uAL)) to generate a ∈G _T. The first key exchange apparatus, reconstruction value ^g _T υ ^{· q} of themselves to the corresponding child node information ^{_{N (u AC) (uAC,}} η (uAC)) Total number itself but ∈G _T is generated parent node information becomes corresponding threshold k (u _AP) or more with respect to N (u _AP), the threshold k (u _AP) or reconstruction values ^{_{g T υ · q (uAC,}} η (uAC) ⁾ ∈ G _T is used as shared information of k (u _AP ) -out-of-c (u _AP ) threshold secret sharing scheme, and the restored value g _T ^{υ ・ q (uAP, η ( uAP))} to generate a ∈G _T. Here, when the restored value g _T ^{υ · q (uAR, η (uAR))} = g _T ^{υ · λ} ∈G _T for the root node information N (u _AR ) is generated, the second key exchange apparatus and it outputs the image of values including and ^{_{χ = g T χ · λ ∈G}} T and ^g _T υ ^· λ ∈G _T as the first session key. It should be ^noted, Λ = g _T λ ∈G _T represents the master public key.

The second key exchange device receives the input of the attribute set δ _A and the first short-term public key, and the leaf node information N (u _BL ) corresponding to the attribute information att (u _BL ) ∈δ _A belonging to the attribute set δ _A Secret value D (u _BL ) = g ₁ ^{q (uBL, η (uBL)) / t (att (uBL))} ∈ G ₁ and element T (att (u _BL )) included in the first short-term public key ^A bilinear map e is applied to ^χ ∈ G ₂ and the restored value e (D (u _BL ), T (att (u _BL )) ^χ ) = g _{T for} leaf node information N (u _BL ) ^{χ · q (uBL, η (uBL))} ∈G _T is generated. In addition, the second key exchange device has its own total number of the child node information N (u _BC ) corresponding to itself for which the restoration value g _T ^{χ · q (uBC, η (uBC))} ∈G _T is generated. parent node information becomes corresponding threshold k (u _BP) above with respect to N (u _BP), the threshold k (u _BP) or reconstruction values ^{_{g T χ · q (uBC,}} η (uBC) ⁾ ∈ G _T is used as shared information of k (u _BP ) -out-of-c (u _BP ) threshold secret sharing method, and the restored value g _T ^{χ ・ q (uBP, η ( uBP))} ∈ G _T is generated. Here, if the restored value ^{_{g T χ · q (uBR,}} η (uBR)) for the root node information _{N (u BR) = g T} χ · λ ∈G T is generated, the second key exchange unit, g and it outputs the image of the values, including the _{^T χ} ^· _λ ∈G _T and ^{_{Λ υ = g T υ · λ}} ∈G T as the second session key.

[Feature]
The tree structure data γ _{A in} this embodiment represents a logical expression for the attribute information att (u _AL ) ⊂δ _B corresponding to each leaf node information N (u _AL ), and the first key exchange device uses the given attribute set. [delta] _B generates a first session key when a true logical expression represented in the tree structure data gamma _a. In other words, (referred to as "u _AL is satisfied") when the attribute information corresponding to a given attribute set [delta] _B in the leaf node information N (u _AL) att (u _AL) were included, the attribute information att (u _AL ) ⊂δ _B Restored value g _T ^{υ · q (uAL, η (uAL)} corresponding to information q (u _AL , η (u _AL )) corresponding to leaf node information N (u _AL ) corresponding to _B ⁾ Is restored. The information corresponding to the information q (u _AC , η (u _AC )) corresponding to the child node information N (u _AC ) is the threshold value k (u corresponding to the parent node information N (u _AP ). If obtained _AP) or more (referred to as "u _AP is satisfied"), the restored value ^g _T υ ^{· q (uAP} corresponding to the parent node information N (u ^{_AP), eta (UAP))} is obtained. Then, the restored value ^{_{g T υ · q (uAC,}} η (uAC)) corresponding to the child node information N (u _AC) of the root node information N (u _AR) corresponds to the root node information N (u _{AR) A} restoration value g _T ^{υ · q (uAR, η (uAR} ) corresponding to the root node information N (u _AR ) obtained by obtaining a threshold value k (u _AR ) or more (referred to as “the tree structure data γ _A is satisfied”). ⁾⁾ = g _T ^{υ · λ} is obtained, the _{second one} corresponding to the obtained g _T ^{υ · λ} = σ ₂ and Λ ^χ = g _T ^{χ · λ} = σ ₁ generated from the master public key Λ One session key is generated.

Similarly, the tree structure data γ _B of this embodiment represents a logical expression for the attribute information att (u _BL ) ⊂δ _B corresponding to each leaf node information N (u _BL ), and the second key exchange device is given. The second session key is generated when the attribute set δ _A makes the logical expression represented by the tree structure data γ _B true. In other words, (referred to as "u _BL is satisfied") when the attribute information corresponding to a given attribute set [delta] _A leaf node information N (u _BL) att (u _BL) were included, the attribute information att _A restored value g _T ^{χ · q (uBL, η (uBL))} corresponding to leaf node information N (u _BL ) corresponding to (u _BL ) ⊂δ _A is restored. Also, the restored value g _T ^{χ · q (uBC, η (uBC))} corresponding to the information q (u _BC , η (u _BC )) corresponding to the child node information N (u _BC ) is the parent node information thereof. When the threshold value k (u _BP ) or more corresponding to N (u _BP ) is obtained (referred to as “u _BP is satisfied”), the restored value g _T ^{χ ·} corresponding to the parent node information N (u _BP ) ^{q (uBP, η (uBP))} is obtained. Then, the restored value ^{_{g T χ · q (uBC,}} η (uBC)) corresponding to the child node information N (u _BC) of the root node information N (u _BR) corresponds to the root node information N (u _BR) The threshold value k (u _BR ) or more is obtained (referred to as “γ _B is satisfied”), and the restored value g _T ^{χ · q (uBR, η (uBR))} corresponding to the root node information N (u _BR ⁾ = When g _T ^{χ · λ} is obtained, the obtained g _T ^{χ · λ} = σ ₁ ∈G _T and Λ ^υ = g _T ^{υ ・ λ} = σ ₂ ∈G _T generated from the master public key Λ A corresponding second session key is generated.

Here, Λ ^χ = g _T ^{χ · λ} = σ ₁ generated by the first key exchange device is equal to g _T ^{χ · λ} = σ ₁ generated by the second key exchange device, and is generated by the first key exchange device. g _T ^{υ · λ} = σ ₂ is equal to Λ ^υ = g _T ^{υ · λ} = σ ₂ generated by the second key exchange apparatus. Therefore, the first and second key exchange devices can share the same session key. In other words, in this embodiment, gamma _A is satisfied for the attribute set [delta] _B, when the gamma _B are satisfied for the attribute set [delta] _A, can share the same session key in the first and second key exchange unit . This predicate expresses the proposition that "the attribute set satisfies the tree structure data"
P: {0,1} ^Φ × {0,1} ^Φ → {0,1}… (5)
In other words, when P (δ _B , γ _A ) = 1 and P (δ _A , γ _B ) = 1, the first and second key exchange devices can share the same session key. Note that P (δ, γ) = 1 means that the predicate representing the proposition that “attribute set δ satisfies the tree structure data γ” is true, and P (δ, γ) = 0 means “attribute set It represents that the predicate representing the proposition “δ satisfies the tree structure data γ” is false.

The first key exchange apparatus further generates the original X = g ₁ ^chi ∈G _1, first short public key comprises further a source X = g ₁ ^chi ∈G _1, second key exchange apparatus further element Y = generates a g ₁ ^upsilon ∈G _1, second comprise short-term public key is further based on ^{_{Y = g 1 υ ∈G 1,}} P (δ B, γ a) = 1 first key exchange apparatus in the case of the σ ₁ = Λ ^χ = g _T ^{χ · λ} ∈G _T and σ ₂ = g _T ^{υ · λ} ∈G _T and σ ₃ = Y ^χ ∈G ₁ are output as the first session key. When (δ _A , γ _B ) = 1, the second key generator is σ ₁ = g _T ^{χ · λ} ∈G _T and σ ₂ = Λ ^υ = g _T ^{υ · λ} ∈G _T and σ ₃ = X ^υ An image of a value including εG ₁ may be output as the second session key. In this case (referred to as “limited form”), security is secured in a model called eCK that takes into account that the short-term secret key has been leaked to a third party.

  For example, in the conventional SYL method, when a short-term secret key is leaked to an attacker, the attacker can impersonate a legitimate user B by performing the following attack.

(1) The attacker obtains user A's short-term secret key χ _A.
(2) the attacker, upon receiving the (ID _A, ID _B, X _A) from the user A, and calculates the Q _B = H ₁ from ID _B (ID _B), and χ _B = Q _B ^(-1) , (ID _A , ID _B , X _A , X _B ) are sent to user A. In this case, sigma ₁ user A calculation _{σ 1 = e (D A ·} Λ χA, Q B · Q B (-1)) = e (D A · Λ χA, Q B) 0 = 1∈G T Therefore, the attacker can know the value of σ ₁ without knowing other values. The attacker can also calculate σ ₂ = X _B ^χA using the short-term secret key χ _A. Thus, the attacker can calculate the session key K and impersonate user B.

On the other hand, in the case of the above limited form, even if the short-term secret key is leaked to the attacker, the attacker cannot obtain the session key information. Because υ and χ are calculated using the short-term secret key and the long-term secret key, even if only the short-term secret key is leaked to the attacker, the attacker cannot know υ and χ, and σ ₃ This is because = X ^υ and σ ₃ = Y ^χ cannot be calculated.

Embodiment
Next, an embodiment of the present invention will be described. In the following, the method described in reference 3 is used as a threshold secret sharing scheme, the constant η (u _A) corresponding to the node information N (u _A) is 0, the node information N (u _A case where the constant η (u _B ) corresponding to _B ) is 0 will be described as an example. However, this does not limit the present invention.

<Configuration>
As illustrated in FIG. 1, the key exchange system 1 according to the embodiment includes key exchange devices 110 and 120, a key generation device 130, and a key extraction device 140, and a network or a portable recording medium (hereinafter “network or the like”). ) To communicate information between devices. Each of the key exchange devices 110 and 120, the key generation device 130, and the key extraction device 140 is a known or dedicated computer having a CPU (central processing unit), a RAM (random-access memory), and the like, and a special program. Each function is realized by the CPU configured and executing the processing according to the special program when the special program is read. The special program may be configured by a single program sequence, or may be a program that reads out another program or library and achieves a target function. Further, at least a part of the processing unit may be configured by an integrated circuit.

[Key exchange device 110]
As illustrated in FIG. 2, the key exchange device 110 according to the embodiment includes an input unit 111a, an output unit 111b, a storage unit 112, a control unit 113, a determination unit 114, a short-term secret key generation unit 115a, The hash calculation unit 115b, the short-term public key generation units 115c and 115d, the leaf node restoration value generation unit 116, the parent node restoration value generation unit 117, the calculation unit 118, and the key generation unit 119 are included. The input unit 111a and the output unit 111b are, for example, a communication device, an input / output interface, an input / output port, and the like. The storage unit 112 is a storage area including, for example, a RAM, a register, a cache memory, a hard disk, and the like. A control unit 113, a determination unit 114, a short-term secret key generation unit 115a, a hash calculation unit 115b, short-term public key generation units 115c and 115d, a leaf node restoration value generation unit 116, a parent node restoration value generation unit 117, a calculation unit 118, and The key generation unit 119 is a CPU or an integrated circuit in which a special program is read. Note that the key exchange device 110 executes each process under the control of the storage unit 112.

[Key exchange device 120]
As illustrated in FIG. 3, the key exchange device 120 according to the embodiment includes an input unit 121a, an output unit 121b, a storage unit 122, a control unit 123, a determination unit 124, a short-term secret key generation unit 125a, The hash calculation unit 125b, the short-term public key generation units 125c and 125d, the leaf node restoration value generation unit 126, the parent node restoration value generation unit 127, the calculation unit 128, and the key generation unit 129 are included. The input unit 121a and the output unit 121b are, for example, a communication device, an input / output interface, an input / output port, and the like. The storage unit 122 is a storage area including, for example, a RAM, a register, a cache memory, a hard disk, and the like. A control unit 123, a determination unit 124, a short-term secret key generation unit 125a, a hash calculation unit 125b, short-term public key generation units 125c and 125d, a leaf node restoration value generation unit 126, a parent node restoration value generation unit 127, a calculation unit 128, and The key generation unit 129 is a CPU or an integrated circuit in which a special program is read. Note that the key exchange device 120 executes each process under the control of the storage unit 122.

[Key Extractor 140]
As illustrated in FIG. 4, the key extraction device 140 includes an input unit 141, an output unit 142, a storage unit 143, a control unit 144, setting units 145 and 146, and a secret value generation unit 147. The setting unit 145 includes an information setting unit 145a and a polynomial setting unit 145b. The setting unit 146 includes an information setting unit 146a and a polynomial setting unit 146b. The input unit 141 and the output unit 142 are, for example, a communication device, an input / output interface, an input / output port, and the like. The storage unit 143 is a storage area including, for example, a RAM, a register, a cache memory, a hard disk, and the like. The control unit 144, the setting units 145 and 146, and the secret value generation unit 147 are a CPU or an integrated circuit in which a special program is read. The key extraction device 140 executes each process under the control of the storage unit 143.

<Public parameter setting process>
As pre-processing, the protocol ID Ω, security parameter κ, cyclic group G ₁ , G ₂ , G _T , generators g ₁ , g ₂ , g _T , hash functions H, H ′, Z _p , “attribute set is Public parameters such as a predicate P representing a proposition “satisfying tree structure data” and a set of attribute information ATT = {1,..., J} are transmitted to the key exchange devices 110 and 120, the key generation device 130, and the key extraction device 140. Shared and available for use by each device.

<Key generation process>
The key generation device 130 (FIG. 1) randomly selects the master secret key λε _U Z _p , and randomly selects t (j) ε _U Z _p for all the attribute information jεATT, A set of t (j) for the attribute information j∈ATT is a master secret key {t (j)} _j∈ATT . Further, the key generation device 130 generates a master public key ^Λ = g _T λ ∈G _T, further generates a ^{_{T (j) = g 2 t}} (j) ∈G 2 for all of the attribute information j∈ATT A set of T (j) for all attribute information j∈ATT is a master public key {T (j)} _j∈ATT . The master secret key λ, {t (j)} _jεATT is securely sent to the key extraction device 140 (FIG. 4), input to the input unit 141, and stored in the storage unit 143. On the other hand, the master public key Λ, {T (j)} _j∈ATT is sent to the key exchange devices 110 and 120 (FIGS. 2 and 3), and is input to the input units 111a and 121a, respectively, and the storage units 112 and 122. Stored in

<Key extraction process>
As pre-processing, tree structure data γ _A representing a logical expression for the selected attribute information att (u _AL ) εATT is stored in the storage unit 112 of the key exchange apparatus 110, and the selected attribute information att (u _BL ) Tree-structured data γ _B representing a logical expression for εATT is stored in the storage unit 122 of the key exchange device 120. These logical expressions are determined in advance. Also, the tree structure data γ _A and γ _B are attached with information for specifying the corresponding logical expressions.

The tree structure data γ _{A in} this embodiment includes U _A (U _A ≧ 2) pieces of node information N (u _A ) (u _A ∈ {1,..., U _A }), and node information N (u _A ) is part of the parent node information N (u _AP ) (u _AP ∈ {1, ..., U _A }), and the parent node information N (u _AP ) has c (u _AP ) children. Node information N (u _AC ) (u _AC ε {1,..., U _A }) corresponds, and each child node information N (u _AC ) corresponds to an identifier index (u _AC ). Any one of the parent node information N (u _AP ) is the root node information N (u _AR ) (u _AR ∈ {1,..., U _A }), and at least one of the child node information N (u _AC ). Part is leaf node information N (u _AL ) (u _AL ∈ {1, ..., U _A }), and the set of u _AL corresponding to leaf node information N (u _AL ) is L (γ _A ) is there. Each of the parent node information N (u _AP ) corresponds to a threshold value k (u _AP ) that satisfies 1 ≦ k (u _AP ) ≦ c (u _AP ), and the leaf node information N (u _AL ) The threshold value k (u _AL ) = 1 corresponds. Each piece of leaf node information N (u _AL ) corresponds to one piece of attribute information att (u _AL ) ∈ATT. In this way, the tree structure data γ _A is data in which node information N (u _A ), threshold value k (u _A ), identifier index (u _AC ), and attribute information att (u _AL ) are associated with each other. It is.

The tree structure data γ _{B in} this embodiment includes U _B (U _B ≧ 2) pieces of node information N (u _B ) (u _B ∈ {1, ..., U _B }), and the node information N (u _B ) is part of parent node information N (u _BP ) (u _BP ∈ {1, ..., U _B }), and the parent node information N (u _BP ) has c (u _BP ) children. Node information N (u _BC ) (u _BC ε {1,..., U _B }) corresponds, and each child node information N (u _BC ) corresponds to an identifier index (u _BC ). Any one of the parent node information N (u _BP ) is the root node information N (u _BR ) (u _BR ε {1,..., U _B }), and at least one of the child node information N (u _BC ). Part is leaf node information N (u _BL ) (u _BL ∈ {1, ..., U _B }), and the set of u _BL corresponding to leaf node information N (u _BL ) is L (γ _B ) is there. Each of the parent node information N (u _BP ) corresponds to a threshold value k (u _BP ) that satisfies 1 ≦ k (u _BP ) ≦ c (u _BP ), and the leaf node information N (u _BL ) The threshold value k (u _BL ) = 1 corresponds. Each piece of leaf node information N (u _BL ) corresponds to one piece of attribute information att (u _BL ) εATT. In this way, the tree structure data γ _B is data in which the node information N (u _B ), threshold value k (u _B ), identifier index (u _BC ), and attribute information att (u _BL ) are associated with each other. It is.

[Specific example of tree structure data]
Hereinafter, specific examples of the tree structure data will be shown by taking the tree structure data γ _A as an example. Although a specific example of the tree structure data γ _A is shown here, the tree structure data γ _B can be configured in the same manner.

《Example of logical expression (1∧2) ∨4》
The tree structure data γ _A illustrated in FIGS. 8A and 8B corresponds to the logical expression (1∧2) ∨4 for the attribute information 1, 2, and 4. The tree structure data γ _{A in} this example includes five pieces of node information N (u _A ) (u _A ε {1,..., 5}). Part of the node information N (u _A ) is parent node information N (1), N (2), and the parent node information N (1) includes c (1) = 2 pieces of child node information N (2) , N (5) and c (2) = 2 pieces of child node information N (3) and N (4) correspond to the parent node information N (2). Each of the child node information N (2), N (5) corresponds to the identifier index (2) = 1, index (5) = 2, and each of the child node information N (3), N (4) Identifiers index (3) = 1 and index (4) = 2 correspond. One of the parent node information N (1) and N (2) is the root node information N (1), and part of the child node information N (2), N (3), N (4), and N (5) Is leaf node information N (3), N (4), N (5). _A set of u _AL = 3, 4, 5 corresponding to leaf node information N (3), N (4), N (5) is L (γ _A ) = {3, 4, 5}. The threshold value k (1) = 1 that satisfies 1 ≦ k (1) ≦ 2 corresponds to the parent node information N (1), and 1 ≦ k (2) ≦ 2 corresponds to the parent node information N (2). The threshold k (2) = 2 to be satisfied corresponds to the leaf node information N (3), N (4), N (5), and the threshold k (3) = k (4) = k (5) = 1 corresponds. The leaf node information N (3), N (4), and N (5) correspond to attribute information att (3) = 1, att (4) = 2, and att (5) = 4∈ATT, respectively.

《Example of logical expression (1∧2) ∨ (2∧3) ∨ (1∧3) ∨4 ⁻
Tree structure data gamma _A illustrated in FIGS. 10A and 10B, the attribute information 1, 2, 3, logical expression for 4 (1∧2) ∨ (2∧3) ∨ (1∧3) ∨4 - a represents ing. Here, the attribute information 4 ^- represents a negation of the attribute information 4, the attribute information 4 ^- is represented as attribute information 5. Thus, by adding attribute information indicating negation of specific attribute information to the ATT, it is also possible to set tree structure data representing a logical expression including negation.

The tree structure data γ _{A in} FIGS. 10 and 10B includes six pieces of node information N (u _A ) (u _A ε {1,..., 6}). Part of the node information N (u _A ) is parent node information N (1), N (2), and the parent node information N (1) includes c (1) = 2 pieces of child node information N (2) , N (6), and c (2) = 3 child node information N (3), N (4), N (5) corresponds to the parent node information N (2). Each of the child node information N (2) and N (6) corresponds to the identifier index (2) = 1, index (6) = 2, and the child node information N (3), N (4), N (5 ) Correspond to identifiers index (3) = 1, index (4) = 2, index (5) = 3. One of the parent node information N (1) and N (2) is the root node information N (1), and the child node information N (2), N (3), N (4), N (5), N ( Part of 6) is leaf node information N (3), N (4), N (5), N (6). The set of u _AL = 3, 4, 5, 6 corresponding to leaf node information N (3), N (4), N (5), N (6) is L (γ _A ) = {3, 4, 5 , 6}. The threshold value k (1) = 1 that satisfies 1 ≦ k (1) ≦ 2 corresponds to the parent node information N (1), and 1 ≦ k (2) ≦ 2 corresponds to the parent node information N (2). The threshold value k (2) = 2 to be satisfied corresponds to the leaf node information N (3), N (4), N (5), N (6), and the threshold value k (3) = k (4) = k (5) = k (6) = 1 corresponds (end of description of [specific example of tree structure data]).

Next, a key extraction process corresponding to the tree structure data γ _A will be described. Hereinafter, only the key extraction process corresponding to the structure data γ _A will be described, but the key extraction process corresponding to the tree structure data γ _B is the same. In the key extraction process of this embodiment, first, the master secret key λ is set as information q (u _AR , η (u _AR )) corresponding to the root node information N (u _AR ). After that, the information q (u _AP , η (u _AP )) corresponding to the parent node information N (u _AP ) is obtained by k (u _AP ) -out-of-c (u _AP ) threshold secret sharing. The process of setting the distributed information as information q (u _AC , η (u _AC )) corresponding to the child node information N (u _AC ) corresponding to the parent node information N (u _AP ) is recursively repeated. Then, for attribute information att (u _AL ) ∈ATT corresponding to leaf node information N (u _AL ), secret value D (u _AL ) = g ₁ ^{q (uAL, η (uAL)) / t (att (uAL ))} ∈ G ₁ and the long-term secret key D _A = {D (u _AL )} _{uAL∈L (γA)} , which is a set of secret values D (u _AL ) (u _AL ∈L (γ _A )) Output. These specific processing procedures are not limited. An example of the key extraction process corresponding to the tree structure data γ _A will be described below with reference to FIGS. 5A and 5B.

First, the tree structure data γ _A read from the storage unit 112 of the key exchange device 110 (FIG. 2) is output from the output unit 111b. The tree structure data γ _A is input to the input unit 141 of the key extraction device 140 (FIG. 4) via a network or the like and stored in the storage unit 143 (step S1411).

Next, the setting unit 145 sets the master secret key λ as information q (u _AR , 0) corresponding to the root node information N (u _AR ) of the tree structure data γ _A. In this embodiment, first, the information setting unit 145a of the setting unit 145 sets the master secret key λ read from the storage unit 143 as information q (u _AR , 0) for the root node information N (u _AR ), and the information q (u _AR , 0) is stored in the storage unit 143 (step S1412). Next, the polynomial setting unit 145b of the setting unit 145 reads the information q (u _AR , 0) = λ and the threshold value k (u _AR ) corresponding to the root node information N (u _AR ) from the storage unit 143. , A polynomial q (u of degree d (u _AR ) = k (u _AR ) -1 for an indefinite element α whose constant term (function value when α = 0) is q (u _AR , 0) = λ _AR , α) is set for the root node information N (u _AR ). For example, the polynomial setting unit 145b randomly selects d (u _AR ) different arbitrary points (α ₁ , β ₁ ) (α ₁ , β ₁ ∈ _U Z _p , α ₁ ≠ 0), respectively, A polynomial q (u _AR , α) with a constant term q (u _AR , 0) = λ passing through is specified. As a result, the polynomial q (u _AR , α) corresponding to the root node information N (u _AR ) is uniquely determined. The determined polynomial q (u _AR , α) is stored in the storage unit 143 (step S1413).

Next, the setting unit 146 distributes the information q (u _AP , 0) corresponding to the parent node information N (u _AP ) by k (u _AP ) -out-of-c (u _AP ) threshold secret sharing. The obtained distributed information is set as information q (u _AC , 0) corresponding to the child node information N (u _AC ) corresponding to the parent node information N (u _AP ). In this embodiment, the setting unit 146 sets u _AP as u _AR (u _AP ← u _AR ), and executes the loop processing of FIG. 5B with the parent node information N (u _AP ) in that case as a processing target (step S1414). ).

[Loop processing of FIG. 5B]
In the loop processing of FIG. 5B, the following steps S1421 and S1422 are executed for all the child node information N (u _AC ) corresponding to the parent node information N (u _AP ) to be processed.

In step S1421, the information setting unit 146a of the setting unit 146 adds the polynomial q (u _AP , α) and the child node information N (u _AC ) of the parent node information N (u _AP ) to be processed from the storage unit 143. Reads the corresponding identifier index (u _AC ). Information setting unit 146a is polynomial q (u _AP, α) corresponding to the parent node information of the processed N (u _AP), the said parent node information N (u _AP) in the corresponding child node information N (u _AC) Q (u _AP , index (u _AC )) obtained by assigning the identifier index (u _AC ) corresponding to is set as information q (u _AC , 0) corresponding to the child node information N (u _AC ) To do. Information q (u _AC , 0) corresponding to each child node information N (u _AC ) is stored in the storage unit 143 (step S1421).

In step S1422, the polynomial setting portion 146b of the setting unit 146 reads the setting information q from the storage unit 143 in step S1421 (u _AC, 0), the information q (u _AC, 0) child node is set For information N (u _AC ), the order of the indefinite element α, where q (u _AC , 0) = q (u _AP , index (u _AC )) is a constant term (function value when α = 0) A polynomial q (u _AC , α) of d (u _AC ) = k (u _AC ) −1 is set. For example, the polynomial setting unit 146b randomly selects d (u _AC ) different arbitrary points (α ₂ , β ₂ ) (α ₂ , β ₂ ∈ _U Z _p , α ₂ ≠ 0), and selects them. The polynomial q (u _AC , α) of the constant term q (u _AC , 0) passing through is specified. The determined polynomial q (u _AC , α) is stored in the storage unit 143 (step S1422) (end of description of [loop processing in FIG. 5B)).

When the process of step S1414 ends, the setting unit 146 next determines whether there is further child node information corresponding to the child node information N (u _AC ) for which the polynomial q (u _AC , α) is set. Determination is made (step S1415). Here, when it is determined that further child node information exists, the setting unit 146 sets u _AP as u _AC (for each child node information N (u _AC ) determined to include additional child node information. u _AP ← u _AC ), the loop processing of FIG. 5B is executed for all the parent node information N (u _AP ) in that case, and then the process returns to step S1415 (step S1416).

On the other hand, if it is determined in step S1415 that there is no further child node information, the secret value generation unit 147 sends attribute information att (u _AL ) corresponding to all leaf node information N (u _AL ) from the storage unit 143. Read ∈ATT and information q (u _AL , 0)
D (u _AL ) = g ₁ ^{q (uAL, 0) / t (att (uAL))} ∈G ₁ … (6)
Is generated. _A long-term secret key D _A = {D (u _AL )} _{uALεL (γA),} which is a set of generated secret values D (u _AL ) (u _AL εL (γ _A )), is stored in the storage unit 143. (Step S1417). The long-term secret key D _A = {D (u _AL )} _{uALεL (γA)} is sent to the output unit 142, from which it is securely sent to the key exchange device 110 (FIG. 2), and the input unit of the key exchange device 110 The data is input to 111a and stored in the storage unit 112 (step S1418).

As a result, the node information N (u _A ) of the tree structure data γ _A corresponds to the polynomial q (u _A , α) of degree d (u _A ) = k (u _A ) -1 for the indefinite element α. As a result, information (constant term) q (u _A , 0) corresponds to each node information N (u _A ). The information q (u _AR , 0) corresponding to the root node information N (u _AR ) is the master secret key λ, and the information q (u _AP , 0) corresponding to the parent node information N (u _AP ) is k (u _AP ) -out-of-c (u _AP ) Information q () corresponding to the child node information N (u _AC ) corresponding to the parent node information N (u _AP ) u _AC , 0), and leaf node information N (u _AL ) corresponds to secret value D (u _AL ) = g ₁ ^{q (uAL, 0) / t (att (uAL))} ∈ G ₁ A set of secret values D (u _AL ) (u _AL εL (γ _A )) is a long-term secret key D _A = {D (u _AL )} _{uALεL (γA)} .

For example, in the case of the tree structure data γ _A exemplified in the above-described FIGS. 8A and 8B (an example of the logical expression (1∧2) ∨4), as illustrated in FIGS. 9A and 9B, the tree structure data γ _{A A} polynomial q (u _A , α) of degree d (u _A ) = k (u _A ) -1 with respect to the indefinite element α for each of the node information N (u _A ) (u _A = 1, ..., 5) As a result, information q (u _A , 0) corresponds to each of the node information N (u _A ). Information q (1, 0) corresponding to the root node information N (1) is the master secret key λ. Parent node information (root node information) Information q (1, 0) corresponding to N (1) is k (1) -out-of-c (1) (1-out-of-2) threshold secret sharing Information q (1,1) and q (1,2), which are distributed information obtained by the above, are information q (2,0) and q ( 5,0). In addition, information q (2, 0) corresponding to parent node information N (2) is obtained by k (2) -out-of-c (2) (2-out-of-2) threshold secret sharing. Information q (2,1), q (2,2), which are distributed information, are information q (3,0), q (4,0) corresponding to child node information N (3), N (4), respectively. ). The leaf node information N (3), N (4), N (5) has secret values D (3) = g ₁ ^{q (3, 0) / t (1)} , D (4) = g ₁ ^{q (4, 0) / t (2)} , D (5) = g ₁ ^{q (5, 0) / t (4)} ∈ G ₁ corresponds to D (3), D (4), D (5 set of) becomes the long-term secret key D _a.

Further, for example, tree-structure data gamma _A illustrated in FIGS. 10A and 10B described above (formulas (1∧2) ∨ (2∧3) ∨ (1∧3) ∨4 - example), the Fig 11A and as illustrated in FIG. 11B, the node information of the tree structure data _{γ a N (u a) (} u a = 1, ..., 6) degree d (u _a) of indeterminate α to each = k _A polynomial q (u _A , α) of (u _A ) -1 corresponds, and as a result, information q (u _A , 0) corresponds to each node information N (u _A ). Information q (1, 0) corresponding to the root node information N (1) is the master secret key λ. Parent node information (root node information) Information q (1, 0) corresponding to N (1) is k (1) -out-of-c (1) (1-out-of-2) threshold secret sharing Information q (1,1), q (1,2), which are distributed information obtained by the above, is information q (2,0), q ( 6,0). Also, information q (2, 0) corresponding to the parent node information N (2) is obtained by k (2) -out-of-c (2) (2-out-of-3) threshold secret sharing. Information q (2,1), q (2,2), q (2,3) corresponding to the distributed node information corresponding to the child node information N (3), N (4), N (5), respectively q (3,0), q (4,0), q (5,0). The leaf node information N (3), N (4), N (5), and N (6) has secret values D (3) = g ₁ ^{q (3, 0) / t (1)} , D ( 4) = g ₁ ^{q (4, 0) / t (2)} , D (5) = g ₁ ^{q (5, 0) / t (3)} , D (6) = g ₁ ^{q (6, 0) / t (5)} ∈ G ₁ corresponds, and the set of D (3), D (4), D (5), and D (6) is the long-term secret key D _A.

<Key exchange process>
Next, the key exchange processing of this embodiment will be described with reference to FIG. 6 showing the processing of the key exchange device 110 and FIG. 7 showing the processing of the key exchange device 120. In this embodiment, an example is shown in which the key exchange device 110 functions as an initiator and the key exchange device 120 functions as a responder.

First, an attribute set δ _A ⊂ATT, which is a subset of the attribute information set ATT, is input to the input unit 111a of the key exchange device 110 (FIG. 2). The attribute set δ _A is arbitrarily selected. For example, if the attribute set δ _A satisfies the tree structure data of the key exchange device 120, the attribute set δ _A arbitrarily selected with the expectation that the authentication is successful and the session key can be shared with the key exchange device 120 is 111a. The attribute set δ _A is stored in the storage unit 112 (FIG. 6 / step S1111).

Next, the short-term secret key generation unit 115a arbitrarily generates a short-term secret key s _A ε _U Z _p and sends it to the hash calculation unit 115b (step S1112). Hash calculator 115b reads the long-term private key D _A from the storage unit 112, a hash value (image values, including long-term private key D _A and short secret key s _A)
χ = H '(D _A , s _A ) ∈Z _p … (7)
And the hash value χ is stored in the storage unit 112 (step S1113). H ′ (D _A , s _A ) represents a binary sequence hash value corresponding to the long-term secret key D _A and the short-term secret key s _A. There is no limitation on the function for copying the pair of the long-term secret key D _A and the short-term secret key s _A into a binary sequence, but the key generators 110 and 120 need to use the same function. Examples of binary sequences corresponding to the long-term private key D _A and short secret key s _A is a bit combination of the long-term private key D _A and short secret key s _A.

Next, the short-term public key generation unit 115d uses the hash value χ read from the storage unit 112 to
X = g ₁ ^χ ∈ G ₁ … (8)
Is stored in the storage unit 112 (step S1114). Further, the short-term public key generation unit 115c uses the master public key {T (j)} _jεATT stored in the storage unit 112 to _calculate T (w _A ) (w _A εδ _A ) corresponding to the attribute set δ _A. Read the set and hash value χ. The short-term public key generation unit 115c generates an element for the hash value χ
T (w _A ) ^χ ∈ G ₂ (w _A ∈δ _A )… (9)
Is a set of
T _A = {T (w _A ) ^χ } _wA∈δA (10)
Is stored in the storage unit 112 (step S1115). In this embodiment, the original X and the set T _A is the short-term public key.

The attribute set δ _A and the short-term public keys X and T _A stored in the storage unit 112 are input to the output unit 111b, and the output unit 111b converts the attribute set δ _A and the short-term public keys X and T _A into a key exchange device. It outputs to 120 (step S1116).

The attribute set δ _A and the short-term public keys X and T _A are input to the input unit 121a of the key exchange device 120 (FIG. 3) and stored in the storage unit 122 (FIG. 7 / step S1211). Then, if the determination unit 124 reads out the information specifying the logical expression corresponding to the stored attribute set [delta] _A and a tree structure data gamma _B in the storage unit 122, the attribute set [delta] _A satisfies the tree structure data gamma _B It is determined whether or not (step S1212). If it is determined that the attribute set δ _A does not satisfy the tree structure data γ _B , the process ends in error. On the other hand, when it is determined that the attribute set δ _A satisfies the tree structure data γ _B , the determination unit 124 stores the master public key {T (j)} _j∈ATT and the short-term public key X, stored in the storage unit 122. for _{T a = {T (w a} ) χ} reads the _wA∈δA and attribute set [delta] _a, all the attribute information w _a ∈δ _a belonging to the attribute set [delta] _a,
e (X, T (w _A )) = e (g ₁ , T (w _A ) ^χ ) (11)
It is determined whether or not holds (step S1213). Here, if it is determined that Equation (11) does not hold for at least a part of the attribute information w _A ∈δ _A , the process ends in error. On the other hand, when it is determined that the expression (11) holds for all the attribute information w _A ∈δ _A , the input unit 121a receives an input of the attribute set δ _B ⊂ATT which is a subset of the attribute information set ATT. As with the attribute set [delta] _A, the attribute set [delta] _B is one selected arbitrarily. The input attribute set δ _B is stored in the storage unit 122 (step S1214).

Next, the short-term secret key generation unit 125a arbitrarily generates a short-term secret key s _B ε _U Z _p and sends it to the hash calculation unit 125b (step S1215). Hash calculator 125b reads the long-term secret key D _B from the storage unit 122, a hash value (long-term secret key D _B and the image values including the short-term secret key s _B)
υ = H '(D _B , s _B ) ∈Z _p … (12)
And the hash value υ is stored in the storage unit 122 (step S1216). H ′ (D _B , s _B ) represents a binary sequence hash value corresponding to the long-term secret key D _B and the short-term secret key s _B. There is no limitation on the function for copying the pair of the long-term secret key D _B and the short-term secret key s _B into a binary sequence, but it is necessary for the key generation devices 110 and 120 to use the same function. Examples of long-term private key D _B and short secret key s _B and corresponding binary sequence to is a bit combination of the long-term secret key D _B and short secret key s _B.

Next, the short-term public key generation unit 125d uses the hash value υ read from the storage unit 122 to
Y = g ₁ ^υ ∈G ₁ (13)
Is stored in the storage unit 122 (step S1217). Further, the short-term public key generation unit 125c determines the T (w _B ) (w _B εδ _B ) corresponding to the attribute set δ _B from the master public key {T (j)} _jεATT stored in the storage unit 122. Read the set and hash value υ. The short-term public key generation unit 125c generates an element for the hash value υ.
T (w _B ) ^υ ∈ G ₂ (w _B ∈δ _B )… (14)
Is a set of
T _B = {T (w _B ) ^υ } _wB∈δB (15)
Is stored in the storage unit 122 (step S1218). In this embodiment, the element Y and the set T _B is the short-term public key.

Stored in the storage unit 122 the attribute set [delta] _B and short public key Y, the T _B is input to the output section 121b, the output unit 121b is the attribute set [delta] _B and short public key Y, the key exchange apparatus and T _B 110 is output (step S1219).

Further, the leaf node restoration value generation unit 126 refers to the attribute set δ _A and the tree structure data γ _B stored in the storage unit 122, and sets the attribute information att (u _BL ) ∈δ _A belonging to the attribute set δ _A. corresponding private value D (u _BL) corresponding to the leaf node information N (u _BL) of the tree structure data ^{_{γ B = g 1 q (uBL}} , η (uBL)) a ^{/ t (att (uBL))} ∈G 1 extracting from stored in the storage unit 122 long-term private key D _B. Further, the leaf node restoration value generation unit 126 converts the element T (att (u _BL )) ^χ corresponding to the attribute information att (u _BL ) ∈ATT corresponding to the leaf node information N (u _BL ) into the short-term public key T Extract from _A. Leaf node restoring value generating unit 126, for each said leaf node information N (u _BL), a secret value D (u _BL) and source _{T (att (u BL))} χ and reacted with each leaf node information N ( u _BL )
e (D (u _BL ), T (att (u _BL )) ^χ ) = g _T ^{χ ・ q (uBL, 0)} ∈G _T … (16)
Is stored in the storage unit 122 (step S1220).

Next, the determination unit 124 refers to the restoration value stored in the storage unit 122 and the tree structure data γ _B, and among the child node information N (u _BC ) corresponding to itself, the restoration value g _T ^{χ · q ( UBC, 0)} although ∈G _T is generated the total number determines whether the threshold value k corresponding to itself (u _BP) or more and becomes the parent node information N (u _BP) is present. That is, the determination unit 124, the restored value of the parent node information N (u _BP) in the corresponding child node information ^{_{N (u BC) g T χ}} · q (uBC, 0) although ∈G _T is generated u _BC S (u _BP ) '
| S (u _BP ) '| ≧ k (u _BP )… (17)
It is determined whether or not there is parent node information N (u _BP ) that satisfies the condition (step S1221). However, | S (u _BP ) ′ | represents the number of elements of the set S (u _BP ) ′. Here, when it is determined that there is no parent node information N (u _BP ) that satisfies Expression (17), the process ends in error. On the other hand, when it is determined that there is parent node information N (u _BP ) that satisfies Expression (17), the parent node restoration value generation unit 127 corresponds to the parent node information N (u _BP ) that satisfies Expression (17). restored value ^g _T χ ^{· q} threshold k (u _BP) or more child node information ^{_{N (u BC) (uBC,}} 0) to _{∈G T, k (u BP)} -out-of-c (u BP ) Restored value corresponding to the shared information used as shared information in the threshold secret sharing method
g _T ^{χ · q (uBP, 0)} ∈G _T … (18)
Is generated and stored in the storage unit 122. For example, the parent node restoring value generating unit 127 selects a set S (u _BP) 'k is a subset of (u _BP) set consisting of pieces of ^{_{u BC S (u BP) ~}} ⊂S (u BP)' and, using a set S (u _BP) is an element of ^~ k (u _BP) pieces of u _BC ∈S (u _BP) corresponding respectively to the ^~ restored value ^{_{g T χ · q (uBC,}} 0), Lagrangian According to the interpolation formula (Equation (3), (4))

を計算する。ただし、q(u_BC,0)=q(u_BP,index(u_BC))を満たす。この処理は、式(17)を満たすすべての親ノード情報N(u_BP)に対して実行される。これにより、式(17)を満たすすべての親ノード情報N(u_BP)に対応する復元値g_T ^{χ・q(uBP, 0)}がそれぞれ得られる（ステップＳ１２２２）。

Calculate However, q (u _BC , 0) = q (u _BP , index (u _BC )) is satisfied. This process is executed for all parent node information N (u _BP ) that satisfies Expression (17). As a result, restoration values g _T ^{χ · q (uBP, 0)} corresponding to all parent node information N (u _BP ) satisfying Expression (17) are obtained (step S1222).

Next, the determination unit 124 determines whether or not the restoration value g _T ^{χ · q (uAR, 0)} corresponding to the root node information N (u _AR ⁾ is obtained in step S1222 (step S1223). If it is determined that the restoration value g _T ^{χ · q (uAR, 0)} corresponding to the root node information N (u _AR ) has not been obtained, the process returns to step S1221. On the other hand, when it is determined that the restored value g _T ^{χ · q (uAR, 0)} corresponding to the root node information N (u _AR ) has been obtained, the arithmetic unit 128 ^reads g _T ^{χ · q (uAR, 0)} = g _T ^{χ · λ} ∈ G _T , master public key Λ, short-term public key X and hash value υ are read,
σ ₁ = g _T ^{χ ・ λ} ∈G _T (20)
σ ₂ = Λ ^υ = g _T ^{υ ・ λ} ∈G _T (21)
σ ₃ = X ^υ ∈G ₁ (22)
Is generated (step S1224). The generated σ ₁ , σ ₂ , σ ₃ are sent to the key generation unit 129. The key generation unit 129 reads the short-term public keys X, Y, T _A , and T _B and the attribute sets δ _A and δ _B from the storage unit 122, and further uses the predicate P and the protocol ID Ω to determine the session key.
K = H (σ ₁ , σ ₂ , σ ₃ , Ω, P, (δ _A , X, T _A ), (δ _B , Y, T _B ))… (23)
Is generated and output. H (σ ₁ , σ ₂ , σ ₃ , Ω, P, (δ _A , X, T _A ), (δ _B , Y, T _B )) is σ ₁ , σ ₂ , σ ₃ , Ω, It represents a hash value of a binary sequence corresponding to P, (δ _A , X, T _A ), (δ _B , Y, T _B ). There is no limitation on the function for copying these sets of information to the binary series, but the same function must be used in the key generation devices 110 and 120 (step S1225).

On the other hand, the attribute set [delta] _B and short public key Y outputted from the key exchange apparatus 120 in step S1219, the T _B, is input to the input portion 111a of the key exchange device 110 (FIG. 2) is stored in the storage unit 112 (FIG. 6 / step S1117). Then, if the determination unit 114 reads the information identifying the logical expression corresponding to the stored attribute set [delta] _B and tree structure data gamma _A in the storage unit 112, the attribute set [delta] _B satisfies the tree structure data gamma _A It is determined whether or not (step S1118). Here, if the attribute set [delta] _B is judged not to satisfy the tree structure data gamma _A, the processing is terminated due to the error. On the other hand, when it is determined that the attribute set δ _B satisfies the tree structure data γ _A , the determination unit 114 includes the master public key {T (j)} _j∈ATT and the short-term public key Y, stored in the storage unit 112. for _{T B = {T (w B} ) υ} reads the _wB∈δB and attribute set [delta] _B, all the attribute information w _B ∈δ _B belonging to the attribute set [delta] _B,
e (Y, T (w _B )) = e (g ₁ , T (w _B ) ^υ )… (24)
It is determined whether or not holds (step S1119). Here, if for at least part of the attribute information w _B ∈δ _B is formula (24) is determined not hold, the processing is terminated due to the error. On the other hand, when it is determined that the expression (24) holds for all the attribute information w _B ∈δ _B , the leaf node restoration value generation unit 116 stores the attribute set δ _B and the tree structure data γ _A stored in the storage unit 112. And the secret value D (u _AL ) = g corresponding to the leaf node information N (u _AL ) of the tree structure data γ _A corresponding to the attribute information att (u _AL ) ∈δ _B belonging to the attribute set δ _{B ^{1 q (uAL, η (uAL}} )) extracted from ^{/ t (att (uAL))} the ∈G ₁ stored in the storage unit 112 long-term private key D _a. Further, the leaf node restoration value generation unit 116 converts the element T (att (u _AL )) ^υ corresponding to the attribute information att (u _AL ) ∈ATT corresponding to the leaf node information N (u _AL ) into the short-term public key T Extract from _B. Leaf node restoration value generator 116, for each said leaf node information N (u _AL), the secret value D (u _AL) to the original _{T (att (u AL))} υ and reacted with each leaf node information N ( u _AL )
e (D (u _AL ), T (att (u _AL )) ^υ ) = g _T ^{υ ・ q (uAL, 0)} ∈G _T … (25)
Is stored in the storage unit 112 (step S1120).

Next, the determination unit 114 refers to the restoration value stored in the storage unit 112 and the tree structure data γ _A, and among the child node information N (u _AC ) corresponding to itself, the restoration value g _T ^{υ · q ( UAC, 0)} although ∈G _T is generated the total number determines whether the threshold value k corresponding to itself (u _AP) or more and becomes the parent node information N (u _AP) is present. That is, the determination unit 114, the restored value of the parent node information N (u _AP) in the corresponding child node information ^{_{N (u AC) g T υ}} · q (uAC, 0) u AC although ∈G _T is generated S (u _AP ) '
| S (u _AP ) '| ≧ k (u _AP )… (26)
It is determined whether or not there is parent node information N (u _AP ) that satisfies the condition (step S1121). However, | S (u _AP ) ′ | represents the number of elements of the set S (u _AP ) ′. Here, if it is determined that there is no parent node information N (u _AP ) that satisfies Expression (26), the process ends in error. On the other hand, when it is determined that there is parent node information N (u _AP ) that satisfies Expression (26), the parent node restoration value generation unit 117 corresponds to the parent node information N (u _AP ) that satisfies Expression (26). The restoration value g _T ^{υ · q (uAC, 0)} ∈G _T of child node information N (u _AC ) equal to or greater than the threshold k (u _AP ) is k (u _AP ) -out-of-c (u _AP ) Restored value corresponding to the shared information used as shared information in the threshold secret sharing method
g _T ^{υ · q (uAP, 0)} ∈G _T (27)
Is generated and stored in the storage unit 112. For example, the parent node restoring value generating unit 117 selects a set S (u _AP) 'k is a subset of (u _AP) pieces of u an _AC set ^{_{S (u AP) ~ ⊂S (}} u AP)' and, using a set S (u _AP) is an element of ^~ k (u _AP) pieces of u _AC ∈S (u _AP) respectively ^- corresponding reconstructed value ^{_{g T υ · q (uAC,}} 0), Lagrangian According to the interpolation formula (Equation (3), (4))

を計算する。ただし、q(u_AC,0)=q(u_AP,index(u_AC))を満たす。この処理は、式(26）を満たすすべての親ノード情報N(u_AP)に対して実行される。これにより、式(26）を満たすすべての親ノード情報N(u_AP)に対応する復元値g_T ^{υ・q(uAP, 0)}がそれぞれ得られる（ステップＳ１１２２）。

Calculate However, q (u _AC , 0) = q (u _AP , index (u _AC )) is satisfied. This process is executed for all parent node information N (u _AP ) that satisfies Expression (26). As a result, restoration values g _T ^{υ · q (uAP, 0)} corresponding to all parent node information N (u _AP ) satisfying Expression (26) are obtained (step S1122).

Next, the determination unit 114 determines whether or not the restoration value g _T ^{υ · q (uBR, 0)} corresponding to the root node information N (u _BR ⁾ is obtained in step S1122 (step S1123). If it is determined that the restoration value g _T ^{υ · q (uBR, 0)} corresponding to the root node information N (u _BR ) has not been obtained, the process returns to step S1121. On the other hand, when it is determined that the restored value g _T ^{υ · q (uBR, 0)} corresponding to the root node information N (u _BR ) is obtained, the calculation unit 118 ^reads g _T ^{υ · q (uBR, 0)} = g _T ^{υ · λ} ∈G _T , master public key Λ, short-term public key X, and hash value υ are read,
σ ₁ = Λ ^χ = g _T ^{χ ・ λ} ∈G _T (29)
σ ₂ = g _T ^{υ ・ λ} ∈G _T (30)
σ ₃ = Y ^χ ∈G ₁ (31)
Is generated (step S1124). The generated σ ₁ , σ ₂ , σ ₃ are sent to the key generation unit 119. The key generation unit 119 reads the short-term public keys X, Y, T _A , T _B and the attribute sets δ _A and δ _B from the storage unit 112, and further uses the predicate P and the protocol ID Ω to obtain the session key
K = H (σ ₁ , σ ₂ , σ ₃ , Ω, P, (δ _A , X, T _A ), (δ _B , Y, T _B ))… (32)
Is generated and output. H (σ ₁ , σ ₂ , σ ₃ , Ω, P, (δ _A , X, T _A ), (δ _B , Y, T _B )) is σ ₁ , σ ₂ , σ ₃ , Ω, It represents a hash value of a binary sequence corresponding to P, (δ _A , X, T _A ), (δ _B , Y, T _B ). There is no limitation on the function for copying these information sets to the binary series, but the same function must be used in the key generation devices 110 and 120 (step S1125).

Here, σ ₁ , σ ₂ , and σ ₃ respectively generated by the key exchange devices 110 and 120 are
σ ₁ = g _T ^{χ · λ} ∈G _T (33)
σ ₂ = g _T ^{υ ・ λ} ∈G _T (34)
σ ₃ = g ₁ ^{χ ・ υ} ∈G ₁ (35)
It becomes. Therefore, when P (δ _B , γ _A ) = 1 and P (δ _A , γ _B ) = 1, the key exchange apparatuses 110 and 120 can share the same session key K. As described above, in this embodiment, safety in the eCK model is ensured.

[Modifications, etc.]
The present invention is not limited to the embodiment described above. For example, in the above embodiments, sigma _1, sigma _2, an example is shown in which the session key K is generated corresponding to sigma _3, without the key exchange device 110 and 120 to generate a sigma _3, sigma _1, A configuration may be used in which a session key K corresponding to σ ₂ is generated. In this case, the generation of elements X and Y is not necessary, the short-term public key generated by the key exchange device 110 is the set T _A , and the short-term public key generated by the key exchange device 120 is the set T _B.

In the above embodiment,
K = H (σ ₁ , σ ₂ , σ ₃ , Ω, P, (δ _A , X, T _A ), (δ _B , Y, T _B ))
Is a session key, but depends on σ ₁ , σ ₂ , σ ₃ , Ω, P, (δ _A , X, T _A ), (δ _B , Y, T _B ) and certain additional information The hash value may be used as the session key. Further, a hash value of a binary sequence depending on σ ₁ , σ ₂ and predetermined additional information may be used as a session key, and a hash value of a binary sequence depending on σ ₁ , σ ₂ , σ ₃ and predetermined additional information May be used as a session key. Examples of the additional information include information for specifying the cyclic groups G ₁ , G ₂ , and G _T , information for specifying the generation sources g ₁ , g ₂ , and g _T , information for specifying the order p, and the like. However, the additional information when generating the session key in the key exchange apparatuses 110 and 120 needs to be the same.

  Further, instead of the hash function H used in the above embodiment, another function (common key encryption function or the like) having the same hash function H, domain, and region may be used. Similarly, instead of the hash function H ′, other functions having the same hash function H ′, domain, and region may be used.

  Further, in the embodiment, the processing after step S1120 is executed only when the determination in steps S1118 and S1119 is yes, and the processing after step S1214 is executed only when the determination in steps S1212 and S1213 is yes. It was decided to be done. However, the processes after step S1120 and the processes after step S1214 may be executed without performing the determinations of steps S1118, S1119 and steps S1212, S1213.

In addition, the tree structure data γ _A and γ _B are not stored in the key exchange devices 110 and 120, but information such as threshold values included in the tree structure data γ _A and γ _B is required each time. The information may be provided to the key exchange devices 110 and 120. Further, the threshold secret sharing method is not limited, and any known method may be used. Further, an arithmetic operation with an integer may be performed instead of the arithmetic operation with the ring Z _p .

  In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, this computer reads the program stored in its own recording device and executes the process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

1 Key exchange system 110, 120 Key exchange device

Claims (10)

A first key exchange device and a second key exchange device;
The generators of the cyclic groups G ₁ , G ₂ , and G _T are g ₁ , g ₂ , and g _T , respectively, and the bilinear mapping that maps the direct product space G ₁ × G ₂ elements to the cyclic group G _T is e: G ₁ a × G ₂ → G _T, is a set of attribute information j is ATT, is a master secret key is λ and t (j) (j∈ATT), master public key is λ = g _T ^λ ∈G _T and T (j) = g ₂ ^{t (j)} ∈ G ₂
Tree structure data γ _A including U _A (U _A ≧ 2) pieces of node information N (u _A ) (u _A ∈ {1,..., U _A }) corresponds to the first key exchange device, Part of the node information N (u _A ) is parent node information N (u _AP ) (u _AP ∈ {1,..., U _A }), and the parent node information N (u _AP ) includes c (u _AP ) child node information N (u _AC ) (u _AC ∈ {1,..., U _A }) corresponds, and any one of the parent node information N (u _AP ) is root node information. N (u _AR ) (u _AR ∈ {1, ..., U _A }), and at least a part of the child node information N (u _AC ) is leaf node information N (u _AL ) (u _AL ∈ { 1, ..., U _A }), and the set of u _AL corresponding to the leaf node information N (u _AL ) is L (γ _A ), and each of the parent node information N (u _AP ) Corresponds to a threshold k (u _AP ) satisfying 1 ≦ k (u _AP ) ≦ c (u _AP ), and each of the node information N (u _A ) has information q (u _A , η (u _A )) corresponds, the root node information N (u _AR) corresponding to the information _{q (u AR, η (u} AR)) is the master secret key λ der Obtained the parent node information N (u _AP) to corresponding information _{q (u AP, η (u} AP)) and _{k (u AP) -out-of} -c (u AP) with a threshold secret sharing The distributed information is information q (u _AC , η (u _AC )) corresponding to the child node information N (u _AC ) corresponding to the parent node information N (u _AP ), and the leaf node information N (u _AL ) Corresponds to attribute information att (u _AL ) ∈ATT and secret value D (u _AL ) = g ₁ ^{q (uAL, η (uAL)) / t (att (uAL))} ∈G ₁ A set of secret values D (u _AL ) (u _AL ∈L (γ _A )) is the long-term secret key D _A = {D (u _AL )} _{uAL∈L (γA)} of the first key exchange device,
Tree structure data γ _B including U _B (U _B ≧ 2) pieces of node information N (u _B ) (u _B ε {1,..., U _B }) corresponds to the second key exchange device, Part of the node information N (u _B ) is parent node information N (u _BP ) (u _BP ∈ {1,..., U _B }), and the parent node information N (u _BP ) includes c (u _BP ) child node information N (u _BC ) (u _BC ε {1,..., U _B }) corresponds, and any one of the parent node information N (u _BP ) is root node information. N (u _BR ) (u _BR ∈ {1, ..., U _B }), and at least a part of the child node information N (u _BC ) is leaf node information N (u _BL ) (u _BL ∈ { 1, ..., U _B }), the set of u _BL corresponding to the leaf node information N (u _BL ) is L (γ _B ), and each of the parent node information N (u _BP ) Corresponds to a threshold k (u _BP ) satisfying 1 ≦ k (u _BP ) ≦ c (u _BP ), and each of the node information N (u _B ) has information q (u _B , η (u _B )) corresponds, the root node information N (u _BR) corresponding to the information _{q (u BR, η (u} BR)) is the master secret key λ der Obtained the parent node information N (u _BP) in the corresponding information _{q (u BP, η (u} BP)) and _{k (u BP) -out-of} -c (u BP) with a threshold secret sharing The distributed information is information q (u _BC , η (u _BC )) corresponding to the child node information N (u _BC ) corresponding to the parent node information N (u _BP ), and the leaf node information N (u _BL ) Corresponds to attribute information att (u _BL ) ∈ATT and secret value D (u _BL ) = g ₁ ^{q (uBL, η (uBL)) / t (att (uBL))} ∈G ₁ A set of secret values D (u _BL ) (u _BL ∈L (γ _B )) is the long-term secret key D _B = {D (u _BL )} _{uBL∈L (γB)} of the second key exchange device;
The first key exchange device includes:
_A first short-term secret key generation unit that arbitrarily generates a short-term secret key s _A ;
Using the attribute set δ _A ⊂ATT that is a subset of the attribute information set ATT, the long-term secret key D _A and the short-term secret key s _A , the long-term secret key D _A and the short-term secret key s _A are Generate a first short-term public key containing T _A = {T (w _A ) ^χ } _wA∈δA , which is a set of elements T (w _A ) ^χ ∈G ₂ (w _A ∈δ _A ) for the image χ of the containing value A first short-term public key generation unit,
_A first output unit that outputs the attribute set δ _A and the first short-term public key to the second key exchange device;
The second key exchange device
A second short-term secret key generation unit that arbitrarily generates a short-term secret key s _B ;
It using said attribute information attribute set δ _B ⊂ATT a set is a subset of the ATT and the long-term secret key D _B and the short-term secret key s _B, and the long-term secret key D _B and the short-term secret key s _B generating a second short-term public key that contains the original ^{_{T (w B) υ ∈G 2}} (w B ∈δ B) is the set of _{T B = {T (w B} ) υ} wB∈δB to the image upsilon values including A second short-term public key generation unit,
A second output unit that outputs the attribute set δ _B and the second short-term public key to the first key exchange device;
The first key exchange device includes:
A first input unit that receives input of the attribute set δ _B and the second short-term public key;
Secret value D (u _AL ) = g ₁ ^{q (uAL, η (uAL} ) corresponding to the leaf node information N (u _AL ) corresponding to the attribute information att (u _AL ) ∈δ _B belonging to the attribute set δ _B ^{)) / t (att (uAL))} ∈ G ₁ and the element T (att (u _AL )) ^υ ∈ G ₂ included in the second short-term public key, the bilinear map e is applied to the leaf ^Generate restoration value e (D (u _AL ), T (att (u _AL )) ^υ ) = g _T ^{υ ・ q (uAL, η (uAL))} ∈G _T for node information N (u _AL ) A first leaf node restoration value generation unit;
It said threshold k restored value ^g _T υ ^{· q} of corresponding to itself child node information ^{_{N (u AC) (uAC,}} η (uAC)) the total number although ∈G _T was generated corresponding to itself to (u _AP) or more and becomes the parent node information N (u _AP), the threshold k (u _AP) or more of the restored value ^{_{g T υ · q (uAC,}} η (uAC)) the ∈G _T k (u _AP ) -out-of-c (u _AP ) Restored value g _T ^{υ ・ q (uAP, η (uAP))} ∈G _A first parent node restoration value generation unit for generating _T ;
When the first parent node restoration value generation unit generates a restoration value g _T ^{υ · q (uAR, η (uAR))} = g _T ^{υ · λ} ∈G _T for the root node information N (u _AR ), A first key generation unit that outputs an image of a value including Λ ^χ = g _T ^{χ · λ} ∈G _T and g _T ^{υ · λ} ∈G _T as a first session key;
The second key exchange device
_A second input unit for receiving input of the attribute set δ _A and the first short-term public key;
Secret value D (u _BL ) = g ₁ ^{q (uBL, η (uBL} ) corresponding to the leaf node information N (u _BL ) corresponding to the attribute information att (u _BL ) ∈δ _A belonging to the attribute set δ _A ^{)) / t (att (uBL))} ∈ G ₁ and the element T (att (u _BL )) ^χ ∈ G ₂ included in the first short-term public key, the bilinear map e is applied to the leaf ^Generate restoration value e (D (u _BL ), T (att (u _BL )) ^χ ) = g _T ^{χ ・ q (uBL, η (uBL))} ∈G _T for node information N (u _BL ) A second leaf node restoration value generation unit;
It said threshold k restored value ^g _T χ ^{· q} of corresponding to itself child node information ^{_{N (u BC) (uBC,}} η (uBC)) the total number although ∈G _T was generated corresponding to itself to (u _BP) or more and becomes the parent node information N (u _BP), the threshold k (u _BP) or more of the restored value ^{_{g T χ · q (uBC,}} η (uBC)) the ∈G _T k (u _BP ) -out-of-c (u _BP ) Restored value g _T ^{χ q (uBP, η (uBP))} ∈ G _A second parent node restoration value generation unit for generating _T ;
If the second parent node restoring value generation unit to generate a reconstruction value ^{_{g T χ · q (uBR,}} η (uBR)) = g T χ · λ ∈G T with respect to the root node information N (u _BR), a second key generation unit that outputs an image of a value including g _T ^{χ · λ} ∈G _T and Λ ^υ = g _T ^{υ · λ} ∈G _T as a second session key;
A key exchange system characterized by that. The key exchange system of claim 1,
The first short-term public key generation unit further generates an original X = g ₁ ^chi ∈G _1, wherein the first short-term public key further comprises the original X = g ₁ ^chi ∈G _1,
The second short-term public key generation unit further generates an original ^Y = g ₁ υ ∈G _1, the second short-term public key further comprises the original ^Y = g ₁ υ ∈G _1,
The first key generation unit outputs an image of a value including Λ ^χ = g _T ^{χ · λ} ∈ G _T , g _T ^{υ · λ} ∈ G _T and Y ^χ ∈ G ₁ as the first session key;
The second key generation unit outputs an image of a value including g _T ^{χ · λ} ∈ G _T and Λ ^υ = g _T ^{υ · λ} ∈ G _T and X ^υ ∈ G ₁ as the second session key;
A key exchange system characterized by that. The key exchange system according to claim 1 or 2,
Each of the child node information N (u _AC ) corresponds to an identifier index (u _AC ), the leaf node information N (u _AL ) corresponds to a threshold k (u _AL ) = 1, and the node Each piece of information N (u _A ) corresponds to a polynomial q (u _A , α) of degree d (u _A ) = k (u _A ) -1 for the indefinite element α, and η (u _A ) is the node _A constant corresponding to the information N (u _A ), and the information q (u _A , η (u _A )) is obtained by substituting the constant η (u _A ) for the polynomial q (u _A , α) and in the information corresponding to the child node information _{N (u AC) q (u} AC, η (u AC)) the parent node information corresponds to the child node information _{N (u AC) N (u} AP) Q (u _AP , index (u _AC )) obtained by substituting the identifier index (u _AC ) corresponding to the child node information N (u _AC ) into the polynomial q (u _AP , α) corresponding to ,
Each of the child node information N (u _BC ) corresponds to an identifier index (u _BC ), the leaf node information N (u _BL ) corresponds to a threshold k (u _BL ) = 1, and the node Each of the information N (u _B ) corresponds to a polynomial q (u _B , α) of degree d (u _B ) = k (u _B ) -1 with respect to the indefinite element α, and η (u _B ) is the node A constant corresponding to the information N (u _B ), and the value obtained by substituting the constant η (u _B ) into the polynomial q (u _B , α) for the information q (u _B , η (u _B )) and in the information corresponding to the child node information _{N (u BC) q (u} BC, η (u BC)) is the parent node information N (u _BP) corresponding to the child node information N (u _BC) Q (u _BP , index (u _BC )) obtained by substituting the identifier index (u _BC ) corresponding to the child node information N (u _BC ) into the polynomial q (u _BP , α) corresponding to ,
A key exchange system characterized by that. The generators of the cyclic groups G ₁ , G ₂ , and G _T are g ₁ , g ₂ , and g _T , respectively, and the bilinear mapping that maps the direct product space G ₁ × G ₂ elements to the cyclic group G _T is e: G ₁ a × G ₂ → G _T, is a set of attribute information j is ATT, is a master secret key is λ and t (j) (j∈ATT), master public key is λ = g _T ^λ ∈G _T and T (j) = g ₂ ^{t (j)} ∈ G ₂ and U _A (U _A ≧ 2) pieces of node information N (u _A ) (u _A ∈ {1, ..., U _A }) The tree structure data to be included is γ _A , part of the node information N (u _A ) is parent node information N (u _AP ) (u _AP ∈ {1, ..., U _A }), and the parent information The node information N (u _AP ) corresponds to c (u _AP ) child node information N (u _AC ) (u _AC ε {1, ..., U _A }), and the parent node information N (u _AP ) is root node information N (u _AR ) (u _AR ε {1, ..., U _A }), and at least a part of the child node information N (u _AC ) is leaf node information. _{N (u AL) (u AL} ∈ {1, ..., U a}) is a set of u _AL corresponding to the leaf node information N (u _AL) is L (gamma _a), wherein Node information N (u _AP) of the threshold value k that satisfies _{1 ≦ k (u AP) ≦} c (u AP) Each (u _AP) corresponds to each of the node information N (u _A) is Information q (u _A , η (u _A )), information q (u _AR , η (u _AR )) corresponding to the root node information N (u _AR ) is the master secret key λ, and Distributed information obtained by k (u _AP ) -out-of-c (u _AP ) threshold secret sharing of information q (u _AP , η (u _AP )) corresponding to parent node information N (u _AP ) Is information q (u _AC , η (u _AC )) corresponding to the child node information N (u _AC ) corresponding to the parent node information N (u _AP ), and the leaf node information N (u _AL ) Corresponds to attribute information att (u _AL ) ∈ATT and secret value D (u _AL ) = g ₁ ^{q (uAL, η (uAL)) / t (att (uAL))} ∈G ₁ , respectively. The set of D (u _AL ) (u _AL ∈L (γ _A )) is the long-term secret key D _A = {D (u _AL )} _{uAL∈L (γA)} ,
_A short-term secret key generation unit that arbitrarily generates a short-term secret key s _A ;
Using the attribute set δ _A ⊂ATT that is a subset of the attribute information set ATT, the long-term secret key D _A and the short-term secret key s _A , the long-term secret key D _A and the short-term secret key s _A are Generate a first short-term public key containing T _A = {T (w _A ) ^χ } _wA∈δA , which is a set of elements T (w _A ) ^χ ∈G ₂ (w _A ∈δ _A ) for the image χ of the containing value A short-term public key generation unit,
An output unit for outputting the attribute set δ _A and the first short-term public key to another key exchange device;
An input unit for receiving input of the attribute set δ _B and the second short-term public key;
Secret value D (u _AL ) = g ₁ ^{q (uAL, η (uAL} ) corresponding to the leaf node information N (u _AL ) corresponding to the attribute information att (u _AL ) ∈δ _B belonging to the attribute set δ _B ^{)) / t (att (uAL))} ∈ G ₁ and the element T (att (u _AL )) ^υ ∈ G ₂ included in the second short-term public key, the bilinear map e is applied to the leaf ^Generate restoration value e (D (u _AL ), T (att (u _AL )) ^υ ) = g _T ^{υ ・ q (uAL, η (uAL))} ∈G _T for node information N (u _AL ) A leaf node restoration value generation unit;
It said threshold k restored value ^g _T υ ^{· q} of corresponding to itself child node information ^{_{N (u AC) (uAC,}} η (uAC)) the total number although ∈G _T was generated corresponding to itself to (u _AP) or more and becomes the parent node information N (u _AP), the threshold k (u _AP) or more of the restored value ^{_{g T υ · q (uAC,}} η (uAC)) the ∈G _T k (u _AP ) -out-of-c (u _AP ) Restored value g _T ^{υ ・ q (uAP, η (uAP))} ∈G A parent node restoration value generation unit for generating _T ;
When the parent node restoration value generation unit generates a restoration value g _T ^{υ · q (uAR, η (uAR))} = g _T ^{υ · λ} ∈G _T for the root node information N (u _AR ), Λ ^χ a key generation unit that outputs an image of a value including g _T ^{χ · λ} ∈G _T and g _T ^{υ · λ} ∈G _T as a session key;
A key exchange device. The generators of the cyclic groups G ₁ , G ₂ , and G _T are g ₁ , g ₂ , and g _T , respectively, and the bilinear mapping that maps the direct product space G ₁ × G ₂ elements to the cyclic group G _T is e: G ₁ × G ₂ → G _T , set of attribute information j is ATT, master secret key is λ and t (j) (j∈ATT), and T (j) = g ₂ ^{t (j)} ∈G ₂ and the tree structure data including U _A (U _A ≧ 2) pieces of node information N (u _A ) (u _A ∈ {1,..., U _A }) is γ _A , and the node information _A part of N (u _A ) is parent node information N (u _AP ) (u _AP ∈ {1, ..., U _A }), and c (u _AP ) is included in the parent node information N (u _AP ). ) Child node information N (u _AC ) (u _AC ε {1,..., U _A }), and any one of the parent node information N (u _AP ) is root node information N (u _AR ) (u _AR ∈ {1, ..., U _A }), and at least part of the child node information N (u _AC ) is leaf node information N (u _AL ) (u _AL ∈ {1,. .., a U _a}), the set of leaf node information N (u _AL) to the corresponding u _AL is L (gamma _a), each of the parent node information N (u _{AP) 1 ≦ k (u AP) ≦} c threshold k (u _AP) satisfying (u _AP) corresponds,
A first setting unit that sets the master secret key λ as information q (u _AR , η (u _AR )) corresponding to the root node information N (u _AR );
Dispersion obtained by distributing the information q (u _AP , η (u _AP )) corresponding to the parent node information N (u _AP ) by k (u _AP ) -out-of-c (u _AP ) threshold secret A second setting unit that sets information as information q (u _AC , η (u _AC )) corresponding to the child node information N (u _AC ) corresponding to the parent node information N (u _AP );
For attribute information att (u _AL ) ∈ATT corresponding to the leaf node information N (u _AL ), the secret value D (u _AL ) = g ₁ ^{q (uAL, η (uAL)) / t (att (uAL) )} ∈ G ₁
An output unit that outputs a long-term secret key D _A = {D (u _AL )} _{uALεL (γA)} that is a set of the secret values D (u _AL ) (u _AL εL (γ _A ));
A key extraction device. The key extraction device according to claim 5, comprising:
Each of the child node information N (u _AC ) corresponds to an identifier index (u _AC ), the leaf node information N (u _AL ) corresponds to a threshold k (u _AL ) = 1, and the node Each piece of information N (u _A ) corresponds to a polynomial q (u _A , α) of degree d (u _A ) = k (u _A ) -1 for the indefinite element α, and η (u _A ) is the node _A constant corresponding to the information N (u _A ), and the information q (u _A , η (u _A )) is obtained by substituting the constant η (u _A ) for the polynomial q (u _A , α) And
The first setting unit includes:
A first setting unit that sets the master secret key λ as information q (u _AR , η (u _AR )) for the root node information N (u _AR );
The function value q (u _AR , η (u _AR )) when α = η (u _AR ) is the degree d (u _AR ) = k (u _AR ) − for the indefinite element α whose master secret key λ is A first polynomial setting unit that sets a polynomial q (u _AR , α) of 1 for the root node information N (u _AR ),
The second setting unit includes:
The parent node information N (u _AP) to the corresponding polynomial q (u _AP, α), the said parent node information N the identifier corresponding to the child node information corresponding to _{(u AP) N (u AC} ) index ( u _AC) q obtained by substituting (u _AP, index (u _AC) a), (information q (u _AC corresponding to u _AC), eta (u _AC) child node information N first set as) 2 setting part;
alpha = eta function value q when a _{(u AC) (u AC,} η (u AC)) is _{q (u AP, index (u} AC)) degree d (u _AC) for indeterminate alpha is = a second polynomial setting unit that sets a polynomial q (u _AC , α) of k (u _AC ) −1 for the child node information N (u _AC ),
A key extraction device characterized by that. The generators of the cyclic groups G ₁ , G ₂ , and G _T are g ₁ , g ₂ , and g _T , respectively, and the bilinear mapping that maps the direct product space G ₁ × G ₂ elements to the cyclic group G _T is e: G ₁ a × G ₂ → G _T, is a set of attribute information j is ATT, is a master secret key is λ and t (j) (j∈ATT), master public key is λ = g _T ^λ ∈G _T and T (j) = g ₂ ^{t (j)} ∈ G ₂ and U _A (U _A ≧ 2) pieces of node information N (u _A ) (u _A ∈ {1, ..., U _A }) The tree structure data to be included is γ _A , part of the node information N (u _A ) is parent node information N (u _AP ) (u _AP ∈ {1, ..., U _A }), and the parent information The node information N (u _AP ) corresponds to c (u _AP ) child node information N (u _AC ) (u _AC ε {1, ..., U _A }), and the parent node information N (u _AP ) is root node information N (u _AR ) (u _AR ε {1, ..., U _A }), and at least a part of the child node information N (u _AC ) is leaf node information. _{N (u AL) (u AL} ∈ {1, ..., U a}) is a set of u _AL corresponding to the leaf node information N (u _AL) is L (gamma _a), wherein Node information N (u _AP) of the threshold value k that satisfies _{1 ≦ k (u AP) ≦} c (u AP) Each (u _AP) corresponds to each of the node information N (u _A) is Information q (u _A , η (u _A )), information q (u _AR , η (u _AR )) corresponding to the root node information N (u _AR ) is the master secret key λ, and Distributed information obtained by k (u _AP ) -out-of-c (u _AP ) threshold secret sharing of information q (u _AP , η (u _AP )) corresponding to parent node information N (u _AP ) Is information q (u _AC , η (u _AC )) corresponding to the child node information N (u _AC ) corresponding to the parent node information N (u _AP ), and the leaf node information N (u _AL ) Corresponds to attribute information att (u _AL ) ∈ATT and secret value D (u _AL ) = g ₁ ^{q (uAL, η (uAL)) / t (att (uAL))} ∈G ₁ , respectively. The set of D (u _AL ) (u _AL ∈L (γ _A )) is the long-term secret key D _A = {D (u _AL )} _{uAL∈L (γA)} ,
_A step of arbitrarily generating a short-term secret key s _A in the short-term secret key generation unit;
In short public key generation unit, using said attribute set δ _A ⊂ATT and the long-term private key D _A short private key s _A is a subset of the set ATT of the attribute information, the said long-term private key D _A Contains T _A = {T (w _A ) ^χ } _wA∈δA , which is the set of elements T (w _A ) ^χ ∈ G ₂ (w _A ∈δ _A ) for the image χ of values including the short-term secret key s _A Generating a first short-term public key;
In the output unit, outputting the attribute set δ _A and the first short-term public key to another key exchange device;
Receiving an input of the attribute set δ _B and the second short-term public key in the input unit;
In the leaf node restoration value generation unit, the secret value D (u _AL ) = g corresponding to the leaf node information N (u _AL ) corresponding to the attribute information att (u _AL ) ∈δ _B belonging to the attribute set δ _{B 1} ^{q (uAL, η (uAL)) / t (att (uAL))} ∈ G ₁ and element T (att (u _AL )) ^υ ∈ G ₂ included in the second short-term public key The mapping e is applied to the leaf node information N (u _AL ), and the restored value e (D (u _AL ), T (att (u _AL )) ^υ ) = g _T ^{υ · q (uAL, η (uAL ))} Generating ∈G _T ;
In the parent node restoration value generator, reconstruction value ^g _T υ ^{· q} of the child node information corresponding to its own ^{_{N (u AC) (uAC,}} η (uAC)) Total number itself but ∈G _T is generated corresponding to the threshold value k to (u _AP) or more and becomes the parent node information N (u _AP), the threshold value k (u _AP) or more of the restored value ^{_{g T υ · q (uAC,}} η ^(uAC)) ∈G _T is used as shared information of k (u _AP ) -out-of-c (u _AP ) threshold secret sharing method, and the restored value g _T ^{υ q (uAP , η (uAP))} ∈G _T ;
Wherein if said parent node restoration value generator root node information N restored value ^{_{g T υ · q (uAR,}} η (uAR)) for ^{_{(u AR) = g T υ}} · λ ∈G T is generated, the key generation A step of outputting an image of a value including Λ ^χ = g _T ^{χ · λ} ∈G _T and g _T ^{υ · λ} ∈G _T as a session key;
A key exchange method. The generators of the cyclic groups G ₁ , G ₂ , and G _T are g ₁ , g ₂ , and g _T , respectively, and the bilinear mapping that maps the direct product space G ₁ × G ₂ elements to the cyclic group G _T is e: G ₁ × G ₂ → G _T , set of attribute information j is ATT, master secret key is λ and t (j) (j∈ATT), and T (j) = g ₂ ^{t (j)} ∈G ₂ and the tree structure data including U _A (U _A ≧ 2) pieces of node information N (u _A ) (u _A ∈ {1,..., U _A }) is γ _A , and the node information _A part of N (u _A ) is parent node information N (u _AP ) (u _AP ∈ {1, ..., U _A }), and c (u _AP ) is included in the parent node information N (u _AP ). ) Child node information N (u _AC ) (u _AC ε {1,..., U _A }), and any one of the parent node information N (u _AP ) is root node information N (u _AR ) (u _AR ∈ {1, ..., U _A }), and at least part of the child node information N (u _AC ) is leaf node information N (u _AL ) (u _AL ∈ {1,. .., a U _a}), the set of leaf node information N (u _AL) to the corresponding u _AL is L (gamma _a), each of the parent node information N (u _{AP) 1 ≦ k (u AP) ≦} c threshold k (u _AP) satisfying (u _AP) corresponds,
In the first setting unit, setting the master secret key λ as information q (u _AR , η (u _AR )) corresponding to the root node information N (u _AR );
In the second setting unit, information q (u _AP , η (u _AP )) corresponding to the parent node information N (u _AP ) is set to k (u _AP ) -out-of-c (u _AP ) threshold secret Setting the distributed information obtained by distribution as information q (u _AC , η (u _AC )) corresponding to the child node information N (u _AC ) corresponding to the parent node information N (u _AP );
In the secret value generation unit, for the attribute information att (u _AL ) ∈ATT corresponding to the leaf node information N (u _AL ), the secret value D (u _AL ) = g ₁ ^{q (uAL, η (uAL)) / generating t (att (uAL))} ∈ G ₁ ;
In the output unit, outputting a long-term secret key D _A = {D (u _AL )} _{uALεL (γA)} that is a set of the secret values D (u _AL ) (u _AL εL (γ _A )); ,
A key extraction method.   The program for making a computer perform the process of the key exchange method of Claim 7.   A program for causing a computer to execute the processing of the key extraction method according to claim 8.

Images