JP5469618B2 - Encryption system, decryption method, key update method, key generation device, reception device, proxy calculation device, program - Google Patents

Description

  The present invention relates to an encryption system, a decryption method, a key update method, a key generation device, a reception device, a proxy calculation device, and a program for safely delivering information.

  Non-patent document 1 is known as a conventional technique as an encryption technique using the attribute of a receiving device (recipient). The ID-based encryption method described in Non-Patent Document 1 will be briefly described as follows.

k is an integer, p is a prime number of k bits, G ₁ is a cyclic addition group of order p, G ₂ is a cyclic group of order p, and e is a bilinear pair that maps as G ₁ × G ₁ → G ₂ ring function, H is a symbol indicating a hash function that maps the original group G ₂ to the bit string of n bits, P is generator of the group G _1, s is 0 or p-1 an integer of the key generation device has generated, _{P Pub = sP, (P,} P Pub) public parameter, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group _{G 1,} ID is arbitrary length bit _{string, Q ID = MaptoPoint G1 (ID} ), ( (+) Is a symbol indicating a bitwise exclusive OR.

The transmitting device randomly selects a random number r from an integer of 0 or more and p-1 or less,
U = rP
Calculate as follows. Also, using plaintext M, g _ID = e (Q _ID , P _Pub )
Calculate
V = M (+) H (g _ID ^r )
The ciphertext C is calculated as follows: C = <U, V>
Seek like.

The receiving apparatus records d _ID = sQ _ID in advance as a decryption key. When the receiving device receives the ciphertext C,
M ′ = V (+) H (e (d _ID , U))
As shown in FIG.

D.Boneh and M.franklin, “Identity-based encryption from the Weil pairing”, CRYPT’01, Volume 2139 of LNCS, p.213-229, Springer, 2001.

  However, an encryption method for generating a secret key based on public information such as attribute information has a one-to-one correspondence between a secret key and a public key. When the decryption key is lost or the decryption key is leaked, it is necessary to update the decryption key in order to prevent decryption with the lost decryption key or the leaked decryption key. However, when a part of the recipient attribute is used as the public key, the decryption key cannot be updated unless a part of the recipient attribute as the public key is changed. In addition, it is necessary to change the public key in order to take measures against key leakage and loss, but if the public key is known to the sender, it is not always easy to tell the sender about the change of the public key. Absent.

  The present invention provides an encryption technique capable of reissuing / updating a decryption key without changing the public key even if the encryption method generates a secret key based on public information such as attribute information. For the purpose.

The encryption system of the present invention includes a transmission device, a reception device, a proxy calculation device, and a key generation device. First, p is a prime number, G ₁ is a cyclic addition group of order p, G ₂ is a cyclic group of order p, e is a bilinear pairing function that maps as G ₁ × G ₁ → G ₂ , and H is A symbol indicating a hash function that maps an element of group G ₂ to an n-bit bit string, P is a generator of group G ₁ , s is an integer between 0 and p−1 generated by the key generation device, P _Pub = sP, _{(P, P Pub)} public parameter, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group _{G 1,} ID is an arbitrary length bit _{string, Q ID = MaptoPoint G1 (ID} ).

The key generation device includes at least a key generation unit, a key division unit, and a key distribution unit. The key generation unit sets the secret key K ₀ to K ₀ = sQ _ID
Seek like.

The key division section for dividing the random number K _{3 'was} selected from 0 or p-1 an integer, the secret key K ₀ dividing the random number K _3' received secret key K ₁ according to a predetermined method 1 using Ask for. The dividing random number K ₃ ′ is desirably selected at random from an integer of 0 or more and p−1 or less, but may be selected by another predetermined method. The key distribution unit obtains the proxy calculation secret key K ₃ by the predetermined method 2 using the dividing random number K ₃ ′, transmits the reception secret key K ₁ to the receiving device, and obtains the proxy calculation secret key K ₃ . Send to proxy computing device.

The transmission device includes at least an encryption unit. The encryption unit selects the random number r from an integer of 0 to p−1, calculates the random number information U as U = rP,
g _ID = e (Q _ID , P _Pub )
And the plaintext M is encrypted by the predetermined method 3 using H (g _ID ^r ) to obtain the encrypted information V, and the information including the random number information U and the encrypted information V is output as the ciphertext C. The random number r is desirably selected at random from an integer of 0 or more and p−1 or less, but may be selected by another predetermined method.

The receiving device includes at least a decryption recording unit, a request creation unit, and a decryption unit. Decoding recording unit records at least the received secret key K _1. The request creation unit creates a request Req by a predetermined method 4 using the reception secret key K ₁ and the random number information U. The decryption unit obtains the value W of g _ID ^r using the response Res received from the proxy computing device according to the predetermined method 2 that is a method corresponding to the predetermined method 2 and the predetermined method 4. Then, H (W) is used to decrypt the encrypted information V according to a predetermined method 6 that is a method corresponding to the predetermined method 3, and decrypt it into plaintext M ′.

The proxy computing device includes at least a proxy recording unit and a response creation unit. Proxy recording section, recording at least proxy calculation for secret key K _3. The response creation unit performs a calculation using the proxy calculation private key K ₃ on the request Req in accordance with a predetermined method 7, which is a method corresponding to the predetermined method 1, the predetermined method 2, and the predetermined method 4. To obtain the response Res.

When the receiving device requests the key generating device to reissue the key, the following processing is performed to update the receiving secret key K ₁ and the proxy calculation secret key K ₃ . The key splitting unit _selects a new split random number K _3new ′ from an integer between ₀ and p−1 and uses the secret key K ₀ and the new split random number K _3new ′ according to the predetermined method 1 to receive a new receive secret _{Find the} key K _1new . The new dividing random number K _3new ′ is desirably selected at random from an integer of 0 or more and p−1 or less, but may be selected by another predetermined method. The key distribution unit _{obtains a} new proxy calculation secret key K _3new by a predetermined method 2 using the new split random number K _3new ′. Then, the new reception secret key K _1new is transmitted to the reception device, and the new proxy calculation secret key K _3new is transmitted to the proxy calculation device. Decoding recording unit updates the received secret key _{K 1} to the new receiving secret key _{K 1 NEW.} Proxy recording unit updates the proxy calculation for the secret key K ₃ to the new proxy calculation for the secret key _K 3new.

According to the encryption system of the present invention, a “method for generating a plurality of decryption keys (reception secret key K ₁ , proxy calculation secret key K ₃ ) from the secret key K ₀ ” and “part of operations involving keys” It is configured by combining a method for safely substituting the function resource to an external device (proxy computing device). Therefore, even with an encryption method that generates a secret key based on public information such as attribute information, a decryption key can be reissued / updated without changing the public key.

The figure which shows the structural example of the encryption system of this invention. FIG. 3 is a diagram illustrating a processing flow for distributing a secret key of the encryption system according to the first embodiment. The figure which shows the processing flow from the production | generation of a ciphertext of this invention to a decoding. It shows a process flow when updating the reception secret key K ₁ as a proxy calculation secret key K ₃ of Example 1. The figure which shows the processing flow which distributes the private key of the encryption system of Example 2. FIG. A is time to update the received secret key K ₁ as a proxy calculation secret key K ₃ of Example 2, illustrates a process flow for transmitting a protected private key K _2. A is time to update the received secret key K ₁ as a proxy calculation secret key K ₃ of Example 2, illustrates a process flow for transmitting information Pass to seek protection for the private key K _2. It shows a process flow when updating the protection secret key K ₂ of Example 2.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

  FIG. 1 shows a configuration example of the encryption system according to the first embodiment. FIG. 2 shows a processing flow for distributing the secret key of the encryption system of the first embodiment, and FIG. 3 shows a processing flow from generation of ciphertext to decryption. The encryption system according to the first embodiment includes a transmission device 100, a reception device 200, a proxy calculation device 300, and a key generation device 400.

In the following description, k is a large integer, p is a prime number of k bits, G ₁ is a cyclic addition group of order p, G ₂ is a cyclic group of order p, and e is G ₁ × G ₁ → G ₂ Bi is a bilinear pairing function that maps to H, H is a symbol indicating a hash function that maps an element of group G ₂ to an n-bit bit string, P is a generator of group G ₁ , and s is 0 or more generated by key generator 400 An integer less than or equal to p−1, P _Pub = sP, (P, P _Pub ) is a public parameter, MaptoPoint _G1 is a function that maps an arbitrary length bit string to the group G ₁ , ID is an arbitrary length bit string, Q _ID = MaptoPoint _G1 (ID), (+) is a symbol indicating a bitwise exclusive OR, and ^ is a symbol indicating a power. If X and Y are elements of the group G ₁ and a and b are integers,
e (aX, bY) = e (X, Y) ^ab (1)
The relationship holds. For example, Weil pairing may be used as the bilinear pairing function. Further, a bit string indicating the attribute of the receiving apparatus 200 may be used as the ID.

  The transmission device 100 includes an encryption unit 110 and an encryption recording unit 190. The receiving apparatus 200 includes an attribute transmission unit 210, a request creation unit 220, a decryption unit 230, and a decryption recording unit 290. The proxy calculation device 300 includes a response creation unit 310 and a proxy recording unit 390. The key generation device 400 includes a key generation unit 410, a key division unit 420, a key distribution unit 430, and a key generation recording unit 490. The functions of these components will be described below while explaining the processing flow.

[Process flow for distributing private key, from generation to decryption of ciphertext]
The attribute transmission unit 210 of the reception device 200 transmits the bit string ID to the key generation device 400 (S211). The bit string ID may be a bit string indicating single attribute information such as an employee of company A, 20 years or older, or a bit string indicating a logical expression of attribute information such as an employee of company A, male, 20 years or older, or female. But you can. The key generation unit 410 of the key generation device 400 uses the secret key K ₀ as K ₀ = sQ _ID.
(S410).

The key splitting unit 420 selects a split random number K ₃ ′ from integers between 0 and p−1 (S421), and uses the secret key K ₀ and the split random number K ₃ ′ for reception according to the predetermined method 1. seek the secret key _{K 1} (S422). The dividing random number K ₃ ′ is desirably selected at random from an integer of 0 or more and p−1 or less, but may be selected by another predetermined method. The key distribution unit 430 obtains the proxy calculation secret key K ₃ by the predetermined method 2 using the dividing random number K ₃ ′ (S434), transmits the reception secret key K ₁ to the reception device 200, and performs proxy calculation. to send a secret key _{K 3} to the proxy computing device 300 (S435). Decoding the recording unit 290 of the receiving apparatus 200 records the received secret key _{K 1} (S291). Proxy recording unit 390 of the proxy computing device 300 records the proxy calculation secret key _{K 3} (S391).

The attribute transmission unit 210 transmits the bit string ID to the transmission device 100 (S212). The encryption unit 110 of the transmission device 100 selects the random number r from an integer between 0 and p−1 and calculates the random number information U as U = rP. The random number r is desirably selected at random from an integer of 0 or more and p−1 or less, but may be selected by another predetermined method. In addition, the encryption unit 110
g _ID = e (Q _ID , P _Pub )
And the plaintext M is encrypted by the predetermined method 3 using H (g _ID ^r ) to obtain the encrypted information V. Then, the encryption unit 110 outputs information including the random number information U and the encryption information V as the ciphertext C (S110).

Request creation unit 220 of the receiving device 200 generates a request Req to a predetermined method 4 using the received secret key _{K 1} and the random number information U (S222). Note that the request creation unit 220 may select the random number r _tmp from an integer between 0 and p−1 (S221), and may also use the random number r _tmp in the predetermined method 4 in step S222. In this way, it concealed the information about the received secret key K _1. The random number r _tmp is desirably selected at random from an integer of 0 or more and p−1 or less, but may be selected by another predetermined method.

Proxy response creation unit 310 of the computing device 300, the request Req, predetermined methods 1 and predetermined manner 2 and proxy calculation secret key K ₃ according to a predetermined method 7 is a method corresponding to the predetermined method 4 A response Res is obtained by calculating using (S310). The decrypting unit 230 of the receiving device 200 uses the response Res received from the proxy computing device 300 to obtain the value W of g _ID ^r according to the predetermined method 5 that is a method corresponding to the predetermined method 2 and the predetermined method 4. . Then, the encrypted information V is decrypted according to a predetermined method 6 that is a method corresponding to the predetermined method 3 using H (W), and is decrypted into plain text M ′ (S230).

Next, the predetermined methods 1 to 7 will be described. The predetermined methods 1 to 7 are “a method for generating a plurality of decryption keys (reception secret key K ₁ , proxy calculation secret key K ₃ ) from the secret key K ₀ ” and “resources of some calculation functions with keys. In order to construct a combination of “methods for safely substituting external devices (proxy computing devices)”, it is only necessary to correspond to each other. For example, the following combinations are possible. However, the “method for generating a plurality of decryption keys (reception secret key K ₁ , proxy calculation secret key K ₃ ) from the secret key K ₀ ” and “resources of some computation functions accompanied by the key are external devices (proxy It is not necessary to limit to these combinations as long as the “method of safely substituting the computing device” functions.

[Combination 1-1 of predetermined methods]
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ ′ K ₀
Seek like. In the predetermined method 2, the secret calculation private key K _{3 is set} to K ₃ = K ₃ ′ ^−1.
Seek like. In the predetermined method 3, the encryption information V is ^expressed as V = M (+) H (g _ID ^r )
Seek like. In the predetermined method 4, the request Req is req = e (K ₁ , U)
Seek like. In the predetermined method 5, the value W is set to W = Res
Seek like. In the predetermined method 6, plaintext M ′ is changed to M ′ = V (+) H (W)
Seek like. In the predetermined method 7, the response Res is Res = Req ^ K ₃
Seek like.

  A part of the combination of the predetermined methods described above may be changed as in the following example.

In the first example, the predetermined method 2 is changed to K ₃ = K ₃ ′
And the predetermined method 7 is Res = Req ^ (K ₃ ⁻¹ )
It is good.

In the second example, the predetermined method 1 is changed to K ₁ = (K ₃ ′) ⁻¹ K ₀
And the predetermined method 2 is K ₃ = K ₃ ′
And the predetermined method 7 is Res = Req ^ K ₃
It is good.

In the third example, the encrypted information V may be obtained by encrypting the plaintext M with the predetermined method 3 using H (g _ID ^r ) as a common key. In this case, the predetermined method 6 may be performed by decrypting the encrypted information V into plaintext M ′ using H (W) as a common key.

[Combination of predetermined methods 1-2]
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ ′ K ₀
Seek like. In the predetermined method 2, the secret calculation private key K _{3 is set} to K ₃ = K ₃ ′ ^−1.
Seek like. In the predetermined method 3, the encryption information V is ^expressed as V = M (+) H (g _ID ^r )
Seek like. In certain methods 4, the information including the received secret key K ₁ and the random number information U request Req. In the predetermined method 5, the value W is set to W = Res
Seek like. In the predetermined method 6, plaintext M ′ is changed to M ′ = V (+) H (W)
Seek like. In the predetermined method 7, the response Res is Res = e (K ₁ , U) ^ K ₃
Seek like. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K ₁ , U) or Res = e (K ₁ , K ₃ U)
The response Res may be obtained as follows.

  A part of the combination of the predetermined methods described above may be changed as in the following example.

In the first example, the predetermined method 2 is changed to K ₃ = K ₃ ′
And the predetermined method 7 is Res = e (K ₁ , U) ^ (K ₃ ⁻¹ )
It is good. However, since the formula (1) is established in the pairing e,
Res = e ((K ₃ ⁻¹ ) K ₁ , U) or Res = e (K ₁ , (K ₃ ⁻¹ ) U)
The response Res may be obtained as follows.

In the second example, the predetermined method 1 is changed to K ₁ = (K ₃ ′) ⁻¹ K ₀
And the predetermined method 2 is K ₃ = K ₃ ′
And the predetermined method 7 is Res = e (K ₁ , U) ^ K ₃
It is good. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K ₁ , U) or Res = e (K ₁ , K ₃ U)
The response Res may be obtained as follows.

In the third example, the encrypted information V may be obtained by encrypting the plaintext M with the predetermined method 3 using H (g _ID ^r ) as a common key. In this case, the predetermined method 6 may be performed by decrypting the encrypted information V into plaintext M ′ using H (W) as a common key.

[Combination 1-3 of predetermined methods]
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ ′ K ₀
Seek like. In the predetermined method 2, the secret calculation private key K _{3 is set} to K ₃ = K ₃ ′ ^−1.
Seek like. In the predetermined method 3, the encryption information V is ^expressed as V = M (+) H (g _ID ^r )
Seek like. In the predetermined method 4, the request creation unit 220 selects a random number r _tmp from integers between 0 and p−1 (S221), and requests Req as Req = e (r _tmp K ₁ , U).
Seek like. However, since the formula (1) is established in the pairing e,
Req = e (K ₁ , U) ^ r _tmp
The request Req may be obtained as follows. In the predetermined method 5, the value W is set to W = Res ^ r _tmp ⁻¹
Seek like. In the predetermined method 6, plaintext M ′ is changed to M ′ = V (+) H (W)
Seek like. In the predetermined method 7, the response Res is Res = Req ^ K ₃
Seek like.

  In this combination, a part of the combination may be changed in the same manner as the predetermined combination 1-1.

[Combination 1-4 of predetermined methods]
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ ′ K ₀
Seek like. In the predetermined method 2, the secret calculation private key K _{3 is set} to K ₃ = K ₃ ′ ^−1.
Seek like. In the predetermined method 3, the encryption information V is ^expressed as V = M (+) H (g _ID ^r )
Seek like. In the predetermined method 4, the request creation unit 220 selects a random number r _tmp from integers between 0 and p−1 (S221), and sets the concealment key K _tmp as K _tmp = r _tmp K ₁
And the request Req is information including the concealment key K _tmp and the random number information U. In the predetermined method 5, the value W is set to W = Res ^ r _tmp ⁻¹
Seek like. In the predetermined method 6, plaintext M ′ is changed to M ′ = V (+) H (W)
Seek like. In the predetermined method 7, the response Res is Res = e (K _tmp , U) ^ K _3.
Seek like. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K _tmp , U) or Res = e (K _tmp , K ₃ U)
The response Res may be obtained as follows.

  A part of the combination of the predetermined methods described above may be changed as in the following example.

In the first example, the predetermined method 2 is changed to K ₃ = K ₃ ′
And the predetermined method 7 is Res = e (K _tmp , U) ^ (K ₃ ⁻¹ )
It is good. However, since the formula (1) is established in the pairing e,
Res = e ((K ₃ ⁻¹ ) K _tmp , U) or Res = e (K _tmp , (K ₃ ⁻¹ ) U)
The response Res may be obtained as follows.

In the second example, the predetermined method 1 is changed to K ₁ = (K ₃ ′) ⁻¹ K ₀
And the predetermined method 2 is K ₃ = K ₃ ′
And the predetermined method 7 is Res = e (K _tmp , U) ^ K ₃
It is good. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K _tmp , U) or Res = e (K _tmp , K ₃ U)
The response Res may be obtained as follows.

In the third example, the encrypted information V may be obtained by encrypting the plaintext M with the predetermined method 3 using H (g _ID ^r ) as a common key. In this case, the predetermined method 6 may be performed by decrypting the encrypted information V into plaintext M ′ using H (W) as a common key.

[Renewal of private key K ₁ for reception and private key K ₃ for proxy calculation]
FIG. 4 shows a processing flow for updating the reception private key K ₁ and the proxy calculation private key K ₃ . The receiving device 200 requests the key generation device 400 to reissue a key (S214). The key splitting unit 420 of the key generation device 400 _selects a new split random number K _3new ′ from an integer between 0 and p−1 (S424), and uses the secret key K ₀ and the new split random number K _3new ′ to determine A new reception secret key K _1new is _obtained according to method 1 of (S422). The new dividing random number K _3new ′ may be randomly selected from an integer of 0 or more and p−1 or less, or may be selected by a predetermined method. The key distribution unit 430 _{obtains a} new proxy calculation private key K _3new by the predetermined method 2 using the new division random number K _3new ′ (S434). Then, the new reception secret key K _1new is transmitted to the reception device, and the new proxy calculation secret key K _3new is transmitted to the proxy calculation device (S435). Decoding the recording unit 290 updates the received secret key _{K 1} to the new receiving secret key _{K 1new} (S292). Proxy recording unit 390, to update the proxy calculation for the secret key _{K 3} to the new proxy calculation for the secret key _{K 3new} (S392).

According to the encryption system of the first embodiment, “a method for generating a plurality of decryption keys (reception secret key K ₁ , proxy calculation secret key K ₃ ) from the secret key K ₀ ” It is configured by combining a “method for safely substituting resources for computing functions to an external device (proxy computing device)”. Therefore, even with an encryption method that generates a secret key based on public information such as attribute information, a decryption key can be reissued / updated without changing the public key.

  A configuration example of the encryption system of the second embodiment is also shown in FIG. FIG. 5 shows a processing flow for distributing the secret key of the encryption system of the second embodiment, and FIG. 3 shows a processing flow from generation of ciphertext to decryption. The encryption system according to the second embodiment also includes a transmission device 100, a reception device 200, a proxy calculation device 300, and a key generation device 400.

In the following description, k is a large integer, p is a prime number of k bits, G ₁ is a cyclic addition group of order p, G ₂ is a cyclic group of order p, and e is G ₁ × G ₁ → G ₂ Bi is a bilinear pairing function that maps to H, H is a symbol indicating a hash function that maps an element of group G ₂ to an n-bit bit string, P is a generator of group G ₁ , and s is 0 or more generated by key generator 400 An integer less than or equal to p−1, P _Pub = sP, (P, P _Pub ) is a public parameter, MaptoPoint _G1 is a function that maps an arbitrary length bit string to the group G ₁ , ID is an arbitrary length bit string, Q _ID = MaptoPoint _G1 (ID), (+) is a symbol indicating a bitwise exclusive OR, and ^ is a symbol indicating a power. Note that a bit string indicating the attribute of the receiving apparatus 200 may be used as the ID.

  The transmission device 100 includes an encryption unit 110 and an encryption recording unit 190. The receiving apparatus 200 includes an attribute transmission unit 210, a request creation unit 220, a decryption unit 230, a protection private key update unit 240, and a decryption recording unit 290. The proxy calculation device 300 includes a response creation unit 310, a proxy calculation private key update unit 320, and a proxy recording unit 390. The key generation device 400 includes a key generation unit 410, a key division unit 420, a key distribution unit 430, and a key generation recording unit 490. The functions of these components will be described below while explaining the processing flow.

[Process flow for distributing private key, from generation to decryption of ciphertext]
The attribute transmission unit 210 of the reception device 200 transmits the bit string ID to the key generation device 400 (S211). The bit string ID may be individual attribute information such as an employee of company A, 20 years or older, or may be information indicating a logical expression of attribute information such as an employee of company A, male, 20 years of age or older, or female. The key generation unit 410 of the key generation device 400 uses the secret key K ₀ as K ₀ = sQ _ID.
(S410).

The key splitting unit 420 selects a split random number K ₃ ′ from integers between 0 and p−1 (S421), and uses the secret key K ₀ and the split random number K ₃ ′ for reception according to the predetermined method 1. seek the secret key _{K 1} (S422). The dividing random number K ₃ ′ is desirably selected at random from an integer of 0 or more and p−1 or less, but may be selected by another predetermined method. The key distribution unit 430 obtains the proxy calculation secret key K ₃ by the predetermined method 2 using the dividing random number K ₃ ′. In certain methods 2 of the present embodiment, the protective secret key _{K 2} selected from 0 or p-1 an integer (S431). A proxy calculation secret key K ₃ is obtained according to a predetermined method 2 ′ using the split random number K ₃ ′ and the protection secret key K ₂ (S432). The protective secret key K ₂ is other than the method key distribution unit 430 obtains a simply random, may be determined as follows. The key distribution unit 430 receives information Pass for obtaining the protection secret key K ₂ from the receiving device 200. Then, the key distribution unit 430 may seek protection for the private key _{K 2} with the information Pass. For example, it may be obtained with a protective secret key K ₂ with the information Pass and the hash function, the information Pass itself may protect secret key K _2. Further, as the information Pass, for example, a password set by a user (recipient) of the receiving device 200 may be used. The protective secret key K _2, it is desirable to randomly selected from 0 or p-1 an integer, may be selected in a predetermined other methods.

Key distribution unit 430 transmits the received secret key _{K 1} and the protective secret key _{K 2} to the receiving apparatus 200 transmits the proxy calculation secret key _{K 3} to the proxy computing device 300 (S433). Decoding the recording unit 290 of the receiving apparatus 200 records the received secret key _{K 1} and the protective secret key _{K 2} (S291). Note that the decryption recording unit 290 may be configured by two or more physically different recording devices. For example, the decryption / recording unit 290 may be composed of an IC card and a personal computer hard disk. Then, record the receiving secret key K ₁ to the IC card, may be recorded in a protective secret key K ₂ in the computer's hard disk. Thus physically separately records the received secret key K ₁ and the protective secret key K _2, both simultaneously reduce the risk of leakage or lost. In addition, only the leaked / lost key needs to be updated even in the key update described later. Proxy recording unit 390 of the proxy computing device 300 records the proxy calculation secret key _{K 3} (S391).

The attribute transmission unit 210 transmits the bit string ID to the transmission device 100 (S212). The encryption unit 110 of the transmission device 100 selects the random number r from an integer between 0 and p−1 and calculates the random number information U as U = rP. The random number r is desirably selected at random from an integer of 0 or more and p−1 or less, but may be selected by another predetermined method. In addition, the encryption unit 110
g _ID = e (Q _ID , P _Pub )
And the plaintext M is encrypted by the predetermined method 3 using H (g _ID ^r ) to obtain the encrypted information V. Then, the encryption unit 110 outputs information including the random number information U and the encryption information V as the ciphertext C (S110).

Request creation unit 220 of the receiving device 200 generates a request Req to a predetermined method 4 using the received secret key _{K 1} and the random number information U (S222). Note that the request creation unit 220 may select the random number r _tmp from an integer between 0 and p−1 (S221), and may also use the random number r _tmp in the predetermined method 4 in step S222. In this way, it concealed the information about the received secret key K _1. The random number r _tmp is desirably selected at random from an integer of 0 or more and p−1 or less, but may be selected by another predetermined method.

Proxy response creation unit 310 of the computing device 300, the request Req, predetermined methods 1 and predetermined manner 2 and proxy calculation secret key K ₃ according to a predetermined method 7 is a method corresponding to the predetermined method 4 A response Res is obtained by calculating using (S310). The decrypting unit 230 of the receiving device 200 uses the response Res received from the proxy computing device 300 to obtain the value W of g _ID ^r according to the predetermined method 5 that is a method corresponding to the predetermined method 2 and the predetermined method 4. . Then, the encrypted information V is decrypted according to a predetermined method 6 that is a method corresponding to the predetermined method 3 using H (W), and is decrypted into plain text M ′ (S230).

Next, the predetermined methods 1 to 7 will be described. The predetermined methods 1 to 7 include “a method for generating a plurality of decryption keys (reception secret key K ₁ , protection secret key K ₂ , proxy calculation secret key K ₃ ) from the secret key K ₀ ” and “with key It is only necessary to correspond to each other in order to configure a combination of “methods for safely substituting resources for some arithmetic functions to an external device (proxy computing device)”. For example, the following combinations are possible. However, “a method for generating a plurality of decryption keys (reception secret key K ₁ , protection secret key K ₂ , proxy calculation secret key K ₃ ) from the secret key K ₀ ” and “partial calculation function with key” It is not necessary to limit to these combinations as long as the “method of safely substituting resources for the external device (proxy computing device)” functions.

[Combination 2-1 of predetermined methods]
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ 'K ₀
Seek like. In the predetermined method 2 ′, the proxy calculation private key K _{3 is set} to K ₃ = (K ₂ K ₃ ′) ^−1.
Seek like. In the predetermined method 3, the encryption information V is ^expressed as V = M (+) H (g _ID ^r )
Seek like. In the predetermined method 4, the request Req is req = e (K ₁ , U)
Seek like. In the predetermined method 5, the value W is set to W = Res ^ K ₂
Seek like. In the predetermined method 6, plaintext M ′ is changed to M ′ = V (+) H (W)
Seek like. In the predetermined method 7, the response Res is Res = Req ^ K ₃
Seek like.

  A part of the combination of the predetermined methods described above may be changed as in the following example.

In the first example, the predetermined method 2 ′ is changed to K ₃ = (K ₂ ) ⁻¹ K ₃ ′.
And the predetermined method 7 is Res = Req ^ (K ₃ ⁻¹ )
It is good.

In the second example, the predetermined method 1 is changed to K ₁ = (K ₃ ′) ⁻¹ K ₀
And the predetermined method 2 ′ is K ₃ = (K ₂ ) ⁻¹ K ₃ ′
And the predetermined method 7 is Res = Req ^ K ₃
It is good.

In the third example, the encrypted information V may be obtained by encrypting the plaintext M with the predetermined method 3 using H (g _ID ^r ) as a common key. In this case, the predetermined method 6 may be performed by decrypting the encrypted information V into plaintext M ′ using H (W) as a common key.

[Combination 2-2 of predetermined methods]
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ 'K ₀
Seek like. In the predetermined method 2 ′, the proxy calculation private key K _{3 is set} to K ₃ = (K ₂ K ₃ ′) ^−1.
Seek like. In certain methods 3, the encrypted information _{V V = M (+) H} (g ID r)
Seek like. In certain methods 4, the information including the received secret key K ₁ and the random number information U request Req. In the predetermined method 5, the value W is set to W = Res ^ K ₂
Seek like. In the predetermined method 6, plaintext M ′ is changed to M ′ = V (+) H (W)
Seek like. In the predetermined method 7, the response Res is Res = e (K ₁ , U) ^ K ₃
Seek like. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K ₁ , U) or Res = e (K ₁ , K ₃ U)
The response Res may be obtained as follows.

  A part of the combination of the predetermined methods described above may be changed as in the following example.

In the first example, the predetermined method 2 ′ is changed to K ₃ = (K ₂ ) ⁻¹ K ₃ ′.
And the predetermined method 7 is Res = e (K ₁ , U) ^ (K ₃ ⁻¹ )
It is good. However, since the formula (1) is established in the pairing e,
Res = e ((K ₃ ⁻¹ ) K ₁ , U) or Res = e (K ₁ , (K ₃ ⁻¹ ) U)
The response Res may be obtained as follows.

In the second example, the predetermined method 1 is changed to K ₁ = (K ₃ ′) ⁻¹ K ₀
And the predetermined method 2 ′ is K ₃ = (K ₂ ) ⁻¹ K ₃ ′
And the predetermined method 7 is Res = e (K ₁ , U) ^ K ₃
It is good. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K ₁ , U) or Res = e (K ₁ , K ₃ U)
The response Res may be obtained as follows.

In the third example, the encrypted information V may be obtained by encrypting the plaintext M with the predetermined method 3 using H (g _ID ^r ) as a common key. In this case, the predetermined method 6 may be performed by decrypting the encrypted information V into plaintext M ′ using H (W) as a common key.

[Combination 2-3 of predetermined methods]
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ 'K ₀
Seek like. In the predetermined method 2 ′, the proxy calculation private key K _{3 is set} to K ₃ = (K ₂ K ₃ ′) ^−1.
Seek like. In the predetermined method 3, the encryption information V is ^expressed as V = M (+) H (g _ID ^r )
Seek like. In the predetermined method 4, the request creation unit 220 selects a random number r _tmp from integers between 0 and p−1 (S221), and requests Req as Req = e (r _tmp K ₁ , U).
Seek like. However, since the formula (1) is established in the pairing e,
Req = e (K ₁ , U) ^ r _tmp
The request Req may be obtained as follows. In the predetermined method 5, the value W is set to W = Res ^ (r _tmp ⁻¹ K ₂ )
Seek like. In the predetermined method 6, plaintext M ′ is changed to M ′ = V (+) H (W)
Seek like. In the predetermined method 7, the response Res is Res = Req ^ K ₃
Seek like.

  In this combination, a part of the combination may be changed in the same manner as the predetermined combination 1-1.

[Combination of predetermined methods 2-4]
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ 'K ₀
Seek like. In the predetermined method 2 ′, the proxy calculation private key K _{3 is set} to K ₃ = (K ₂ K ₃ ′) ^−1.
Seek like. In the predetermined method 3, the encryption information V is ^expressed as V = M (+) H (g _ID ^r )
Seek like. In the predetermined method 4, the request creation unit 220 selects a random number r _tmp from integers between 0 and p−1 (S221), and sets the concealment key K _tmp as K _tmp = r _tmp K ₁
And the request Req is information including the concealment key K _tmp and the random number information U. In the predetermined method 5, the value W is set to W = Res ^ (r _tmp ⁻¹ K ₂ )
Seek like. In the predetermined method 6, plaintext M ′ is changed to M ′ = V (+) H (W)
Seek like. In the predetermined method 7, the response Res is Res = e (K _tmp , U) ^ K _3.
Seek like. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K _tmp , U) or Res = e (K _tmp , K ₃ U)
The response Res may be obtained as follows.

  A part of the combination of the predetermined methods described above may be changed as in the following example.

In the first example, the predetermined method 2 ′ is changed to K ₃ = (K ₂ ) ⁻¹ K ₃ ′.
And the predetermined method 7 is Res = e (K _tmp , U) ^ (K ₃ ⁻¹ )
It is good. However, since the formula (1) is established in the pairing e,
Res = e ((K ₃ ⁻¹ ) K _tmp , U) or Res = e (K _tmp , (K ₃ ⁻¹ ) U)
The response Res may be obtained as follows.

In the second example, the predetermined method 1 is changed to K ₁ = (K ₃ ′) ⁻¹ K ₀
And the predetermined method 2 ′ is K ₃ = (K ₂ ) ⁻¹ K ₃ ′
And the predetermined method 7 is Res = e (K _tmp , U) ^ K ₃
It is good. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K _tmp , U) or Res = e (K _tmp , K ₃ U)
The response Res may be obtained as follows.

In the third example, the encrypted information V may be obtained by encrypting the plaintext M with the predetermined method 3 using H (g _ID ^r ) as a common key. In this case, the predetermined method 6 may be performed by decrypting the encrypted information V into plaintext M ′ using H (W) as a common key.

[Renewal 1 of the private key K ₁ for reception and the private key K ₃ for proxy calculation]
A is time to update the received secret key K ₁ as a proxy calculation secret key K ₃ in FIG. 6 shows a processing flow for transmitting a protected private key K _2. Receiving apparatus 200 transmits a protective secret key _{K 2} to the key generation device 400, it requests a reissue of a key (S213). The key splitting unit 420 of the key generation device 400 _selects a new split random number K _3new ′ from an integer between 0 and p−1 (S424), and uses the secret key K ₀ and the new split random number K _3new ′ to determine A new reception secret key K _1new is _obtained according to method 1 of (S422). The new dividing random number K _3new ′ is desirably selected at random from an integer of 0 or more and p−1 or less, but may be selected by another predetermined method. The key distribution unit 430 _{obtains a} new proxy calculation secret key K _3new according to a predetermined method 2 ′ using the new split random number K _3new ′ and the received protection secret key K ₂ (S432). Then, a new reception secret key K _1new is transmitted to the reception device, and a new proxy calculation secret key K _3new is transmitted to the proxy calculation device (S435). Decoding the recording unit 290 updates the received secret key _{K 1} to the new receiving secret key _{K 1new} (S292). Proxy recording unit 390, to update the proxy calculation for the secret key _{K 3} to the new proxy calculation for the secret key _{K 3new} (S392).

[Update 2 of receiving secret key _{K 1} as a proxy calculation for the secret key _{K 3]}
A is time to update the received secret key K ₁ as a proxy calculation secret key K ₃ in FIG. 7 shows a processing flow for transmitting information Pass to seek protection for the private key K _2. Receiving device 200 may transmit information Pass to seek protection for the private key _{K 2} to the key generation device 400, it requests a reissue of a key (S215). The key splitting unit 420 of the key generation device 400 _selects a new split random number K _3new ′ from an integer between 0 and p−1 (S424), and uses the secret key K ₀ and the new split random number K _3new ′ to determine A new reception secret key K _1new is _obtained according to method 1 of (S422). The new dividing random number K _3new ′ is desirably selected at random from an integer of 0 or more and p−1 or less, but may be selected by another predetermined method. The key distribution unit 430 _{obtains a} protection secret key K ₂ from the information Pass, and uses the new split random number K _3new ′ and the protection secret key K ₂ to create a new proxy calculation secret key K according to the predetermined method 2 ′. _3new is obtained (S432 '). For example, it may be obtained with a protective secret key K ₂ with the information Pass and the hash function, the information Pass itself may protect secret key K _2. Then, a new reception secret key K _1new is transmitted to the reception device, and a new proxy calculation secret key K _3new is transmitted to the proxy calculation device (S435). Decoding the recording unit 290 updates the received secret key _{K 1} to the new receiving secret key _{K 1new} (S292). Proxy recording unit 390, to update the proxy calculation for the secret key _{K 3} to the new proxy calculation for the secret key _{K 3new} (S392).

[Update of protection for the secret key _{K 2]}
Figure 8 shows a processing flow when updating the protection secret key K _2. The protection private key update unit 240 of the reception device 200 _selects a new protection secret key K _2new from integers of 0 to p−1 (S241). For example, the receiver may set new information Pass and use the information Pass and a hash function to obtain the protection secret key K _2new , or the information Pass itself may be _used as the protection secret key K _2new . The new protective secret key K _2new is preferably selected at random from an integer of 0 or more and p−1 or less as described above, but may be selected by another predetermined method. Next, the protection private key updating unit 240 determines _{whether the} protection private key K ₂ recorded by the decryption recording unit and the new protection private key K _2new are recorded according to the predetermined method 8 corresponding to the predetermined method 2 ′. The updater Upd which is a value corresponding to the difference is obtained, and the updater Upd is sent to the proxy computing device (S242).

The proxy calculation private key update unit 320 of the proxy calculation device uses the proxy calculation secret key K ₃ and the updater Upd recorded in the proxy recording unit 390 according to the predetermined method 9 corresponding to the predetermined method 8. A new proxy calculation secret key _K3new is obtained (S320). Decryption recording unit 290, to update the protection for the secret key _{K 2} to the new protection for the secret key _{K 2new} (S293). Proxy recording unit updates the proxy calculation for the secret key _{K 3} to the new proxy calculation for the secret key _{K 3new} (S293).

For example, if a password set by the user (recipient) of the receiving apparatus 200 is used as the information Pass, the protection private key K ₂ and the proxy calculation private key K ₃ are updated each time the recipient changes the password. It is also possible.

Further, for example, in the predetermined method 8, the update data Upd is updated as Upd = K _2new ⁻¹ K _2.
Seek like. In the predetermined method 9, a new proxy calculation secret key K _3new is _set to K _3new = Upd · K ₃
You can ask as follows. The predetermined method 8 and the predetermined method 9 may be a combination associated with each other as described above, and need not be limited to the above-described method.

According to the encryption system of the second embodiment, “a method of generating a plurality of decryption keys (reception secret key K ₁ , protection secret key K ₂ , proxy calculation secret key K ₃ ) from the secret key K ₀ ” It is configured by combining a “method of safely substituting resources of some computation functions with keys to an external device (proxy computing device)”. Therefore, even with an encryption method that generates a secret key based on public information such as attribute information, a decryption key can be reissued / updated without changing the public key.

[Program, recording medium]
The various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  The present invention can be used in the field of cryptographic communication.

DESCRIPTION OF SYMBOLS 100 Transmission apparatus 110 Encryption part 190 Encryption recording part 200 Reception apparatus 210 Attribute transmission part 220 Request creation part 230 Decryption part 240 Protection private key update part 290 Decryption recording part 300 Proxy calculation apparatus 310 Response creation part 320 Secret for secret calculation Key update unit 390 Proxy recording unit 400 Key generation device 410 Key generation unit 420 Key division unit 430 Key distribution unit 490 Key generation recording unit

Claims (23)

An encryption system having at least a receiving device and a proxy computing device,
p is a prime number, G ₁ is a cyclic addition group of order p, G ₂ is a cyclic group of order p, e is a bilinear pairing function that maps as G ₁ × G ₁ → G ₂ , and H is a group G A symbol indicating a hash function that maps an element of ₂ to an n-bit bit string, P is a generator of the group G ₁ , s is an integer of 0 to p−1, P _Pub = sP, (P, P _Pub ) is public parameter, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group _{G 1,} ID is arbitrary length bit _{string, Q ID = MaptoPoint G1 (ID} ), K 0 was determined as _K 0 = _{sQ ID} The secret key, K ₃ ′ is a random number for division selected from an integer between 0 and p−1, and K ₁ is for reception obtained by the predetermined method 1 using the secret key K ₀ and the random number for division K ₃ ′. secret key, K ₃ is representative calculation secret key obtained by a predetermined method 2 using the divided random number K _{3 ',} r is 0 Random number chosen from the upper p-1 an integer, U is U = random number information obtained as _{rP, g ID} is _{g ID = e (Q ID,} P Pub) values were obtained as, V Is encrypted information obtained by encrypting plaintext M by a predetermined method 3 using H (g _ID ^r ),
The receiving device is:
A decryption recording unit for recording the reception private key K ₁ ;
A request creation unit that creates a request Req by a predetermined method 4 using the reception secret key K ₁ and the random number information U;
Using the response Res received from the proxy computing device, the value W of g _ID ^r is obtained according to the predetermined method 2 corresponding to the predetermined method 2 and the predetermined method 4, and H (W) is used. A decryption unit that decrypts the encrypted information V into plaintext M ′ according to the predetermined method 6 that is a method corresponding to the predetermined method 3;
With
The proxy computing device is:
And proxy recording unit for recording the proxy calculation for the secret key K _3,
The request Req, response by performing a calculation using a proxy calculation secret key K ₃ according to the predetermined method 1 and predetermined manner 7 is a method wherein the predetermined method 2 corresponds to the predetermined method 4 An encryption system comprising a response creation unit for obtaining Res. The encryption system according to claim 1,
In the predetermined method 2,
The protection secret key K ₂ is selected from an integer between 0 and p−1, and the proxy calculation secret key K ₃ is selected according to the predetermined method 2 ′ using the split random number K ₃ ′ and the protection secret key K _2. Seeking
The decryption recording unit also records a protective secret key K ₂ ,
The predetermined method 5 is a method corresponding to the predetermined method 2 ′, and the value W is obtained using the protective secret key K _{2 as} well. The encryption system according to claim 1,
(+) Is a symbol indicating a bitwise exclusive OR, ^ is a symbol indicating a power,
In the predetermined method 1, the reception private key K ₁ is set as K ₁ = K ₃ 'K ₀
Asking,
In the predetermined method 2, the proxy calculation private key K _{3 is set} to K ₃ = K ₃ ′ ^−1.
Asking,
In the predetermined method 3, the encryption information V is changed to V = M (+) H (g _ID ^r )
Asking,
In the predetermined method 4, the request Req is changed to Req = e (K ₁ , U)
Asking,
In the predetermined method 5, the value W is set to W = Res
Asking,
In the predetermined method 6, the plaintext M ′ is changed to M ′ = V (+) H (W)
Asking,
In the predetermined method 7, the response Res is set to Res = Req ^ K ₃
An encryption system characterized by The encryption system according to claim 1,
(+) Is a symbol indicating a bitwise exclusive OR, ^ is a symbol indicating a power,
In the predetermined method 1, the reception private key K ₁ is set as K ₁ = K ₃ 'K ₀
Asking,
In the predetermined method 2, the proxy calculation private key K _{3 is set} to K ₃ = K ₃ ′ ^−1.
Asking,
In the predetermined method 3, the encryption information V is changed to V = M (+) H (g _ID ^r )
Asking,
In the predetermined method 4, the information including the received secret key K ₁ and the random number information U request Req,
In the predetermined method 5, the value W is set to W = Res
Asking,
In the predetermined method 6, the plaintext M ′ is changed to M ′ = V (+) H (W)
Asking,
In the predetermined method 7, the response Res is set to Res = e (K ₁ , U) ^ K ₃
An encryption system characterized by The encryption system according to claim 1,
(+) Is a symbol indicating a bitwise exclusive OR, ^ is a symbol indicating a power,
In the predetermined method 1, the reception private key K ₁ is set as K ₁ = K ₃ 'K ₀
Asking,
In the predetermined method 2, the proxy calculation private key K _{3 is set} to K ₃ = K ₃ ′ ^−1.
Asking,
In the predetermined method 3, the encryption information V is changed to V = M (+) H (g _ID ^r )
Asking,
In the predetermined method 4, the request creation unit selects a random number r _tmp from integers not less than 0 and not more than p−1, and requests Req as Req = e (r _tmp K ₁ , U).
Asking,
In the predetermined method 5, the value W is set to W = Res ^ r _tmp ⁻¹
Asking,
In the predetermined method 6, the plaintext M ′ is changed to M ′ = V (+) H (W)
Asking,
In the predetermined method 7, the response Res is set to Res = Req ^ K ₃
An encryption system characterized by The encryption system according to claim 1,
(+) Is a symbol indicating a bitwise exclusive OR, ^ is a symbol indicating a power,
In the predetermined method 1, the reception private key K ₁ is set as K ₁ = K ₃ 'K ₀
Asking,
In the predetermined method 2, the proxy calculation private key K _{3 is set} to K ₃ = K ₃ ′ ^−1.
Asking,
In the predetermined method 3, the encryption information V is changed to V = M (+) H (g _ID ^r )
Asking,
In the predetermined method 4, the request creation unit selects a random number r _tmp from an integer of 0 to p−1 and sets a concealment key K _tmp as K _tmp = r _tmp K ₁
And request Req as information including concealment key K _tmp and random number information U,
In the predetermined method 5, the value W is set to W = Res ^ r _tmp ⁻¹
Asking,
In the predetermined method 6, the plaintext M ′ is changed to M ′ = V (+) H (W)
Asking,
In the predetermined method 7, the response Res is Res = e (K _tmp , U) ^ K _3.
An encryption system characterized by The encryption system according to claim 2, wherein
(+) Is a symbol indicating a bitwise exclusive OR, ^ is a symbol indicating a power,
In the predetermined method 1, the reception private key K ₁ is set as K ₁ = K ₃ 'K ₀
Asking,
In the predetermined method 2 ′, the proxy calculation private key K _{3 is set} to K ₃ = (K ₂ K ₃ ′) ^−1.
Asking,
In the predetermined method 3, the encryption information V is changed to V = M (+) H (g _ID ^r )
Asking,
In the predetermined method 4, the request Req is changed to Req = e (K ₁ , U)
Asking,
In the predetermined method 5, the value W is set to W = Res ^ K ₂
Asking,
In the predetermined method 6, the plaintext M ′ is changed to M ′ = V (+) H (W)
Asking,
In the predetermined method 7, the response Res is set to Res = Req ^ K ₃
An encryption system characterized by The encryption system according to claim 2, wherein
(+) Is a symbol indicating a bitwise exclusive OR, ^ is a symbol indicating a power,
In the predetermined method 1, the reception private key K ₁ is set as K ₁ = K ₃ 'K ₀
Asking,
In the predetermined method 2 ′, the proxy calculation private key K _{3 is set} to K ₃ = (K ₂ K ₃ ′) ^−1.
Asking,
In the predetermined method 3, the encryption information V is changed to V = M (+) H (g _ID ^r )
Asking,
In the predetermined method 4, the information including the received secret key K ₁ and the random number information U request Req,
In the predetermined method 5, the value W is set to W = Res ^ K ₂
Asking,
In the predetermined method 6, the plaintext M ′ is changed to M ′ = V (+) H (W)
Asking,
In the predetermined method 7, the response Res is set to Res = e (K ₁ , U) ^ K ₃
An encryption system characterized by The encryption system according to claim 2, wherein
(+) Is a symbol indicating a bitwise exclusive OR, ^ is a symbol indicating a power,
In the predetermined method 1, the reception private key K ₁ is set as K ₁ = K ₃ 'K ₀
Asking,
In the predetermined method 2 ′, the proxy calculation private key K _{3 is set} to K ₃ = (K ₂ K ₃ ′) ^−1.
Asking,
In the predetermined method 3, the encryption information V is changed to V = M (+) H (g _ID ^r )
Asking,
In the predetermined method 4, the request creation unit selects a random number r _tmp from integers not less than 0 and not more than p−1, and requests Req as Req = e (r _tmp K ₁ , U).
Asking,
In the predetermined method 5, the value W is changed to W = Res ^ r _tmp ⁻¹ K _2.
Asking,
In the predetermined method 6, the plaintext M ′ is changed to M ′ = V (+) H (W)
Asking,
In the predetermined method 7, the response Res is set to Res = Req ^ K ₃
An encryption system characterized by The encryption system according to claim 2, wherein
(+) Is a symbol indicating a bitwise exclusive OR, ^ is a symbol indicating a power,
In the predetermined method 1, the reception private key K ₁ is set as K ₁ = K ₃ 'K ₀
Asking,
In the predetermined method 2 ′, the proxy calculation private key K _{3 is set} to K ₃ = (K ₂ K ₃ ′) ^−1.
Asking,
In the predetermined method 3, the encryption information V is changed to V = M (+) H (g _ID ^r )
Asking,
In the predetermined method 4, the request creation unit selects a random number r _tmp from an integer of 0 to p−1 and sets a concealment key K _tmp as K _tmp = r _tmp K ₁
And request Req as information including concealment key K _tmp and random number information U,
In the predetermined method 5, the value W is changed to W = Res ^ r _tmp ⁻¹ K _2.
Asking,
In the predetermined method 6, the plaintext M ′ is changed to M ′ = V (+) H (W)
Asking,
In the predetermined method 7, the response Res is Res = e (K _tmp , U) ^ K _3.
An encryption system characterized by An encryption system having at least a receiving device, a proxy computing device, and a key generation device,
p is a prime number, G ₁ is cyclic addition group of order p, s is 0 or p-1 an integer, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group G _1, ID is a bit string of arbitrary length , Q _ID = MaptoPoint _G1 (ID), K ₀ is a secret key obtained as K ₀ = sQ _ID , K ₃ ′ is a random number for division selected from an integer of 0 to p−1, and K ₁ is The reception private key obtained by the predetermined method 1 using the secret key K ₀ and the dividing random number K ₃ ′, and K ₃ for proxy calculation obtained by the predetermined method 2 using the dividing random number K ₃ ′ Private key
The key generation device includes:
Upon receiving a key reissue request from the receiving device,
A new splitting random number K _3new ′ is selected from integers between ₀ and p−1, and a new receiving secret key K _1new is _selected according to the predetermined method 1 using the secret key K ₀ and the new split random number K _3new ′. A key splitting unit to be obtained;
A new proxy calculation secret key K _3new is obtained by the predetermined method 2 using the new division random number K _3new ′, the new reception secret key K _1new is transmitted to the receiving device, and a new proxy calculation secret key K _{3new is obtained.} A key distribution unit for transmitting to the proxy computing device;
With
The receiving device is:
A decryption recording unit for updating the reception private key K ₁ recorded in advance to a new reception private key K _1new ;
The proxy computing device is:
Encryption system that includes a proxy recording unit to update the proxy calculation for the secret key K _3, which had been pre-recorded in a new proxy calculation for the secret key _K 3new. An encryption system having at least a receiving device, a proxy computing device, and a key generation device,
p is a prime number, G ₁ is cyclic addition group of order p, s is 0 or p-1 an integer, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group G _1, ID is a bit string of arbitrary length , Q _ID = MaptoPoint _G1 (ID), K ₀ is a secret key obtained as K ₀ = sQ _ID , K ₃ ′ is a random number for division selected from an integer of 0 to p−1, and K ₁ is The reception private key obtained by the predetermined method 1 using the private key K ₀ and the dividing random number K ₃ ′, K ₂ is a protection private key selected from an integer of 0 to p−1, and K ₃ is A proxy calculation private key obtained by a predetermined method 2 ′ using a dividing random number K ₃ ′ and a protective private key K ₂ ;
The key generation device includes:
From the receiving apparatus, when receiving the protection request for reissuing the secret key K ₂ and the key,
A new splitting random number K _3new ′ is selected from integers between ₀ and p−1, and a new receiving secret key K _1new is _selected according to the predetermined method 1 using the secret key K ₀ and the new split random number K _3new ′. A key splitting unit to be obtained;
A new proxy calculation secret key K _3new is obtained according to the predetermined method 2 ′ using the new split random number K _3new ′ and the received protection secret key K ₂ , and the new reception secret key K _1new is _sent to the receiving device. A key distribution unit for transmitting and transmitting a new proxy calculation private key K _3new to the proxy calculation device;
With
The receiving device is:
A decryption recording unit for updating the reception private key K ₁ recorded in advance to a new reception private key K _1new ;
The proxy computing device is:
Encryption system that includes a proxy recording unit to update the proxy calculation for the secret key K _3, which had been pre-recorded in a new proxy calculation for the secret key _K 3new. An encryption system having at least a receiving device and a proxy computing device,
p is a prime number, K ₃ ′ is a split random number selected from an integer between 0 and p−1, K ₂ is a protection secret key selected from an integer between 0 and p−1, and K ₃ is a split random number A proxy calculation secret key obtained by a predetermined method 2 ′ using K ₃ ′ and the protection secret key K ₂ ,
The receiving device is:
A new protection secret key K _2new is selected from integers between 0 and p−1, and the protection secret key K ₂ recorded according to the predetermined method 8 corresponding to the predetermined method 2 ′ and the new protection key A protection secret key update unit that obtains an updater Upd that is a value corresponding to a difference from the secret key _K2new, and sends the updater Upd to the proxy computing device;
And decoding the recording unit to update the protection for the secret key K _2, which had been pre-recorded in a new protection for the secret key _K 2new,
With
The proxy computing device is:
A proxy calculation secret key update unit for _{obtaining a} new proxy calculation secret key K _3new according to a predetermined method 9 corresponding to the predetermined method 8 using the recorded proxy calculation secret key K ₃ and the updater Upd; ,
And proxy recording unit to update the proxy calculation for the secret key K _3, which had been pre-recorded in a new proxy calculation for the secret key _K 3new,
An encryption system comprising: The encryption system according to claim 13, comprising:
In the predetermined method 8, the updater Upd is updated as Upd = K _2new ⁻¹ K _2.
Asking,
In the predetermined method 9, a new proxy calculation private key K _3new is _set to K _3new = Upd · K ₃
An encryption system characterized by A decryption method using a receiving device and a proxy computing device,
p is a prime number, G ₁ is a cyclic addition group of order p, G ₂ is a cyclic group of order p, e is a bilinear pairing function that maps as G ₁ × G ₁ → G ₂ , and H is a group G A symbol indicating a hash function that maps an element of ₂ to an n-bit bit string, P is a generator of the group G ₁ , s is an integer of 0 to p−1, P _Pub = sP, (P, P _Pub ) is public parameter, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group _{G 1,} ID is arbitrary length bit _{string, Q ID = MaptoPoint G1 (ID} ), K 0 was determined as _K 0 = _{sQ ID} The secret key, K ₃ ′ is a random number for division selected from an integer between 0 and p−1, and K ₁ is for reception obtained by the predetermined method 1 using the secret key K ₀ and the random number for division K ₃ ′. secret key, K ₃ is representative calculation secret key obtained by a predetermined method 2 using the divided random number K _{3 ',} r is 0 Random number chosen from the upper p-1 an integer, U is U = random number information obtained as _{rP, g ID} is _{g ID = e (Q ID,} P Pub) values were obtained as, V Is encrypted information obtained by encrypting plaintext M by a predetermined method 3 using H (g _ID ^r ),
A decryption recording step in which the receiving device records a reception secret key K ₁ ;
Said proxy computing device, the proxy recording step of recording the proxy calculation secret key K _3,
A request creating step in which the receiving device creates a request Req by a predetermined method 4 using the reception secret key K ₁ and the random number information U;
The proxy calculation device uses the proxy calculation secret key K ₃ in response to the request Req according to a predetermined method 7 that is a method corresponding to the predetermined method 1, the predetermined method 2, and the predetermined method 4. A response creation step for calculating a response Res by performing
The receiving device uses the response Res received from the proxy computing device to determine the value W of g _ID ^r according to the predetermined method 2 that is a method corresponding to the predetermined method 2 and the predetermined method 4, and H A decrypting step of decrypting the encrypted information V into plaintext M ′ by decrypting the encrypted information V according to the predetermined method 6 which is a method corresponding to the predetermined method 3 using (W);
A decryption method. A key update method using a receiving device, a proxy computing device, and a key generation device,
p is a prime number, G ₁ is cyclic addition group of order p, s is 0 or p-1 an integer, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group G _1, ID is a bit string of arbitrary length , Q _ID = MaptoPoint _G1 (ID), K ₀ is a secret key obtained as K ₀ = sQ _ID , K ₃ ′ is a random number for division selected from an integer of 0 to p−1, and K ₁ is The reception private key obtained by the predetermined method 1 using the secret key K ₀ and the dividing random number K ₃ ′, and K ₃ for proxy calculation obtained by the predetermined method 2 using the dividing random number K ₃ ′ Private key
When the key generation device receives a key reissue request from the receiving device, the key generation device _selects a new split random number K _3new ′ from an integer between ₀ and p−1, the secret key K ₀ and the new split random number A key splitting step for obtaining a new reception secret key K _1new according to the predetermined method 1 using K _3new ';
The key generation device _{obtains a} new proxy calculation secret key K _3new by the predetermined method 2 using the new division random number K _3new ′, transmits the new reception secret key K _1new to the reception device, and _creates a new proxy A key distribution step of transmitting a calculation private key _K3new to the proxy calculation device;
A decryption recording step in which the reception device updates the reception private key K ₁ recorded in advance to a new reception private key K _1new ;
The proxy computing device, and the proxy recording step to update the proxy calculation for the secret key K _3, which had been pre-recorded in a new proxy calculation for the secret key _K 3new,
A key update method comprising: A key update method using a receiving device, a proxy computing device, and a key generation device,
p is a prime number, G ₁ is cyclic addition group of order p, s is 0 or p-1 an integer, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group G _1, ID is a bit string of arbitrary length , Q _ID = MaptoPoint _G1 (ID), K ₀ is a secret key obtained as K ₀ = sQ _ID , K ₃ ′ is a random number for division selected from an integer of 0 to p−1, and K ₁ is The reception private key obtained by the predetermined method 1 using the private key K ₀ and the dividing random number K ₃ ′, K ₂ is a protection private key selected from an integer of 0 to p−1, and K ₃ is A proxy calculation private key obtained by a predetermined method 2 ′ using a dividing random number K ₃ ′ and a protective private key K ₂ ;
The key generating apparatus, from the receiving apparatus, when receiving the protection request for reissuing the secret key K ₂ and the key, and select a new split random number _K 3new _'from 0 or p-1 an integer, the secret key A key division step of _{obtaining a} new reception secret key K _1new according to the predetermined method 1 using K ₀ and a new division random number K _3new ′;
The key generation device _{obtains a} new proxy calculation secret key K _3new according to the predetermined method 2 ′ using the new division random number K _3new ′ and the received protection secret key K _2, and a new reception secret key K A key distribution step of transmitting _1new to the receiving device and transmitting a new proxy calculation private key _K3new to the proxy calculation device;
A decryption recording step in which the reception device updates the reception private key K ₁ recorded in advance to a new reception private key K _1new ;
It said proxy computing device, key update process and a proxy record updating the proxy calculation secret key K ₃ that was previously recorded in the new proxy calculation secret key _K 3new. A key update method using a receiving device and a proxy computing device,
p is a prime number, K ₃ ′ is a split random number selected from an integer between 0 and p−1, K ₂ is a protection secret key selected from an integer between 0 and p−1, and K ₃ is a split random number A proxy calculation secret key obtained by a predetermined method 2 ′ using K ₃ ′ and the protection secret key K ₂ ,
The receiving device, a new protective secret key K _2NEW selected from 0 or p-1 an integer, the predetermined method 2 'private key protection is recorded according to a predetermined method 8 corresponding to K ₂ And _{updating the} private key for protection to obtain the update data Upd, which is a value corresponding to the difference between the new private key for protection K _2new and sending the update data Upd to the proxy computing device;
The receiving apparatus, and decoding recording step of updating the protection secret key K ₂ had previously recorded in a new protective secret key K _2NEW,
The proxy calculation device uses the recorded proxy calculation secret key K ₃ and the updater Upd to determine a new proxy calculation secret key K _3new according to a predetermined method 9 corresponding to the predetermined method 8. Private key update step,
The proxy computing device, and the proxy recording step to update the proxy calculation for the secret key K _3, which had been pre-recorded in a new proxy calculation for the secret key _K 3new,
A key update method comprising: A key generating device for configuring an encryption system together with a receiving device and a proxy computing device,
p is a prime number, _{G 1} is cyclic addition group of order p, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group _{G 1,} ID is an arbitrary length bit _{string, Q ID = MaptoPoint G1 (ID} ) ,
Generate an integer s between 0 and p−1 and set the secret key K ₀ to K ₀ = sQ _ID
A key generation unit to be obtained as follows:
Splitting the random number K _{3 'was} selected from 0 or p-1 an integer, the secret key K ₀ dividing the random number K _3' key dividing unit for obtaining the reception secret key K ₁ according to a predetermined method 1 using When,
The proxy calculation secret key K ₃ is obtained by the predetermined method 2 using the dividing random number K ₃ ′, the reception secret key K ₁ is transmitted to the reception device, and the proxy calculation secret key K ₃ is transmitted to the proxy calculation device. A key distribution part to send to
A key generation device comprising: The key generation device according to claim 19, wherein
In the predetermined method 2,
The protection secret key K ₂ is selected from an integer between 0 and p−1, and the proxy calculation secret key K ₃ is selected according to the predetermined method 2 ′ using the split random number K ₃ ′ and the protection secret key K _2. Seeking
The key distribution unit, a key generation device characterized by also protected secret key K ₂ is transmitted to the receiving device. A receiving device for configuring an encryption system together with a proxy computing device,
p is a prime number, G ₁ is a cyclic addition group of order p, G ₂ is a cyclic group of order p, e is a bilinear pairing function that maps as G ₁ × G ₁ → G ₂ , and H is a group G A symbol indicating a hash function that maps an element of ₂ to an n-bit bit string, P is a generator of the group G ₁ , s is an integer of 0 to p−1, P _Pub = sP, (P, P _Pub ) is public parameter, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group _{G 1,} ID is arbitrary length bit _{string, Q ID = MaptoPoint G1 (ID} ), K 0 was determined as _K 0 = _{sQ ID} The secret key, K ₃ ′ is a random number for division selected from an integer between 0 and p−1, and K ₁ is for reception obtained by the predetermined method 1 using the secret key K ₀ and the random number for division K ₃ ′. secret key, K ₃ is representative calculation secret key obtained by a predetermined method 2 using the divided random number K _{3 ',} r is 0 Random number chosen from the upper p-1 an integer, U is U = random number information obtained as _{rP, g ID} is _{g ID = e (Q ID,} P Pub) values were obtained as, V Is encrypted information obtained by encrypting plaintext M by a predetermined method 3 using H (g _ID ^r ),
A decryption recording unit for recording the reception private key K ₁ ;
A request creation unit that creates a request Req by a predetermined method 4 using the reception secret key K ₁ and the random number information U;
Using the response Res received from the proxy computing device, the value W of g _ID ^r is obtained according to the predetermined method 2 corresponding to the predetermined method 2 and the predetermined method 4, and H (W) is used. A decryption unit that decrypts the encrypted information V into plaintext M ′ according to the predetermined method 6 that is a method corresponding to the predetermined method 3;
A receiving device. A proxy computing device for configuring an encryption system together with a receiving device,
p is a prime number, G ₁ is a cyclic addition group of order p, P is a generator of the group G ₁ , s is an integer of 0 to p−1, P _Pub = sP, (P, P _Pub ) are public parameters, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group _{G 1,} ID is arbitrary length bit _{string, Q ID = MaptoPoint G1 (ID} ), the secret key _{K 0} is determined as _K 0 = _{sQ ID} , K ₃ ′ is a split random number selected from an integer between 0 and p−1, and K ₁ is a receive secret key obtained by the predetermined method 1 using the secret key K ₀ and the split random number K ₃ ′. , K ₃ is a proxy calculation secret key obtained by the predetermined method 2 using the dividing random number K ₃ ′, r is a random number selected from an integer of 0 to p−1, and U is U = rP random number information obtained, the Riku created Req by using the received secret key K ₁ and the random number information U by a predetermined method 4 Is a strike,
And proxy recording unit for recording the proxy calculation for the secret key K _3,
The request Req, response by performing a calculation using a proxy calculation secret key K ₃ according to the predetermined method 1 and predetermined manner 7 is a method wherein the predetermined method 2 corresponds to the predetermined method 4 A proxy computing device comprising a response creation unit for obtaining Res.   The receiving device or proxy computing device of the encryption system according to any one of claims 1 to 10 or claim 13 or 14, or the receiving device, proxy computing device, or key of the encryption system according to claim 11 or 12 A program for causing a computer to function as one of the generation devices.

Images