JP5496957B2 - ENCRYPTION SYSTEM, DECRYPTION METHOD, DECRYPTION HISTORY SERVER, RECEPTION DEVICE, TRANSMISSION DEVICE, PROGRAM - Google Patents

Description

  The present invention relates to an encryption system, a decryption method, a decryption history storage server, a reception device, a transmission device, and a program for recording a decryption history of ciphertext.

  Non-Patent Document 1 is known as an encryption method for recording a decryption history of ciphertext. Non-Patent Document 1 discloses a method for controlling decryption processing so that plaintext cannot be obtained unless a decryption history is left for a public server (see FIG. 3 of Non-Patent Document 1).

Yasumasa Hirai and Shinichiro Matsuo, “Encryption method that can record decryption history”, IEICE Technical Report, ISEC2005-109, OIS2005-72, pp.71-76, November 2005.

  However, since the public server of Non-Patent Document 1 cannot identify the decryption target that the decryption person is trying to decrypt from the evidence received from the decryption person, there is a problem that information for identifying the decryption target cannot be recorded as a log trail. .

  It is an object of the present invention to construct an encryption system that can record information identifying a ciphertext to be decrypted, information identifying a decrypted receiving apparatus, and time as a decryption history.

The encryption system of the present invention includes at least a transmission device, a reception device, and a decryption history storage server. First, p is a prime number, G ₁ is a cyclic addition group of order p, G ₂ is a cyclic group of order p, e is a bilinear pairing function that maps as G ₁ × G ₁ → G ₂ , and H is A symbol indicating a hash function that maps an element of group G ₂ to an n-bit bit string, P is a generator of group G ₁ , s is an integer of 0 to p−1, P _Pub = sP, (P, P _Pub ) the public parameters, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group _{G 1,} ID is arbitrary length bit _{string, Q ID = MaptoPoint G1 (ID} ), K 0 is determined as _K 0 = _{sQ ID} secret key that is, K 3 _'is divided random number selected from 0 or p-1 an integer, K ₁ is the secret key K ₀ dividing the random number K _3' obtained by the predetermined method 1 using receiving a secret key, K ₃ is representative calculation secret key obtained by a predetermined method 2 using the divided random number K _{3 ',} Random number selected from 0 or p-1 an integer, U is U = session information obtained as _{rP, g ID} is _{g ID = e (Q ID,} P Pub) value determined as , V is a ciphertext obtained by encrypting the plaintext M by the predetermined method 3 using H (g _ID ^r ), v is ciphertext identification information for identifying the ciphertext V, and h is a ciphertext identification for identifying the ciphertext V It is a symbol indicating a function that generates information.

  The transmission device includes an encryption unit and a ciphertext transmission unit. The receiving device includes a decryption recording unit, a request creation unit, a request transmission unit, and a decryption unit. The decryption history storage server includes a proxy recording unit, a session information storage unit, a response creation unit, a response transmission unit, and a history storage unit.

The receiving device records the reception secret key K ₁ in association with at least the receiving device identification information R _ID in the decryption recording unit. Decoding history storage server, recording the proxy calculation secret key K ₃ in association with the receiving apparatus identifying information R _ID to the proxy recording unit.

  The ciphertext transmission unit of the transmitting device transmits the ciphertext V and the ciphertext identification information v to the receiving device, and transmits the session information U and the ciphertext identification information v to the decryption history storage server. The receiving device also includes a ciphertext identification information generating unit, the ciphertext transmitting unit of the transmitting device transmits the ciphertext V to the receiving device, and the ciphertext V received by the ciphertext identification information generating unit of the receiving device. The ciphertext identification information v may be generated as v = h (V).

The decryption history storage server records the session information U received from the transmission device and the ciphertext identification information v in association with each other in the session information storage unit. Request creation unit of the receiving device creates a request Req to a predetermined method 4 using the received secret key K _1. The request transmission unit of the reception device transmits the request Req, the ciphertext identification information v, and the reception device identification information R _ID that identifies the reception device to the decryption history storage server.

The response creation unit of the decryption history storage server acquires session information U associated with the ciphertext identification information v recorded in the session information storage unit that matches the ciphertext identification information v received from the receiving device. Also obtains the received device identification information R _ID surrogate calculation secret key K ₃ associated with the receiving apparatus identifying information R _ID recorded in the proxy recording unit that matches received from the receiving apparatus. Then, a response Res performing calculation using a proxy calculation secret key K ₃ and session information U according to a predetermined method 7 is a method corresponding to a predetermined method 1 and predetermined manner 2 and a predetermined method 4 . The response transmission unit of the decryption history storage server transmits the response Res to the receiving device. The decryption history storage server records the ciphertext identification information v, the receiving device identification information R _ID, and the time t acquired according to the predetermined method 8 in association with each other in the history storage unit.

Using the response Res received from the decryption history storage server, the decryption unit of the receiving device obtains the value W of g _ID ^r according to the predetermined method 2 corresponding to the predetermined method 2 and the predetermined method 4, and H Using (W), the ciphertext V is decrypted according to the predetermined method 6 corresponding to the predetermined method 3, and is decrypted into the plaintext M ′.

  According to the encryption system of the present invention, the receiving apparatus transmits the ciphertext identification information v for identifying the ciphertext V to the decryption history storage server, and the ciphertext V cannot be decrypted without cooperation with the decryption history storage server. Therefore, the decryption history storage server can record the time when the decryption is performed after the decrypted ciphertext V and the decrypted receiving device are specified.

The figure which shows the structural example of the encryption system of Example 1, Example 1 modification 1, Example 1 modification 2, Example 1 modification 3. FIG. FIG. 6 is a diagram showing a processing flow for distributing the secret key of the encryption system according to the first embodiment, the first embodiment, the first modification, the second embodiment, and the second embodiment. The figure which shows the processing flow from the production | generation of a ciphertext of the encryption system of Example 1 and Example 1 modification 2 to decoding. The figure which shows the processing flow from the production | generation of a ciphertext of a cryptographic system of Example 1 modification 1 and Example 1 modification 3 to decoding. The figure which shows the processing flow which distributes the private key of the encryption system of Example 1 modification 2, Example 1 modification 3, Example 2 modification 2, Example 2 modification 3. FIG. The figure which shows the structural example of the encryption system of Example 2, Example 2 modification 1, Example 2 modification 2, Example 2 modification 3. FIG. The figure which shows the processing flow from the production | generation of a ciphertext of the encryption system of Example 2 and Example 2 modification 2 to decoding. The figure which shows the processing flow from the production | generation of a ciphertext of a cryptographic system of Example 2 modification 1 and Example 2 modification 3 to decoding. The figure which shows the structural example of the encryption system of Example 3, Example 3 modification 1, Example 3 modification 2, Example 3 modification 3. FIG. The figure which shows the processing flow which distributes the secret key of the encryption system of Example 3 and Example 3 modification 1. FIG. The figure which shows the processing flow from the production | generation of a ciphertext of the encryption system of Example 3 and Example 3 modification 2 to a decoding. The figure which shows the processing flow from the production | generation of a ciphertext of a cryptographic system of Example 3 modification 1 and Example 3 modification 3 to a decoding. The figure which shows the processing flow which distributes the secret key of the encryption system of Example 3 modification 2 and Example 3 modification 3. FIG.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

  FIG. 1 shows a configuration example of the encryption system according to the first embodiment. FIG. 2 shows a processing flow for distributing the secret key of the encryption system of the first embodiment, and FIG. 3 shows a processing flow from generation of ciphertext to decryption. The encryption system according to the first embodiment includes a transmission device 100, a reception device 200, a decryption history storage server 300, and a key generation device 400.

In the following description, k is a large integer, p is a prime number of k bits, G ₁ is a cyclic addition group of order p, G ₂ is a cyclic group of order p, and e is G ₁ × G ₁ → G ₂ Bi is a bilinear pairing function that maps to H, H is a symbol indicating a hash function that maps an element of group G ₂ to an n-bit bit string, P is a generator of group G ₁ , and s is 0 or more generated by key generator 400 An integer less than or equal to p−1, P _Pub = sP, (P, P _Pub ) is a public parameter, MaptoPoint _G1 is a function that maps an arbitrary length bit string to the group G ₁ , ID is an arbitrary length bit string, Q _ID = MaptoPoint _G1 (ID), (+) is a symbol indicating exclusive OR in bit units, ^ is a symbol indicating power, v is ciphertext identification information for identifying ciphertext V, and h is a cipher for identifying ciphertext V A symbol indicating a function for generating sentence identification information. If X and Y are elements of the group G ₁ and a and b are integers,
e (aX, bY) = e (X, Y) ^ab (1)
The relationship holds. For example, Weil pairing may be used as the bilinear pairing function. Further, a bit string indicating the attribute of the receiving apparatus 200 may be used as the ID.

  The transmission device 100 includes an encryption unit 110, a ciphertext transmission unit 120, and an encryption recording unit 190. The receiving device 200 includes an attribute transmission unit 210, a request creation unit 220, a request transmission unit 225, a decryption unit 230, and a decryption recording unit 290. The decryption history storage server 300 includes a response creation unit 310, a response transmission unit 315, a session information storage unit 370, a history storage unit 380, and a proxy recording unit 390. The key generation device 400 includes a key generation unit 410, a key division unit 420, a key distribution unit 430, and a key generation recording unit 490. The functions of these components will be described below while explaining the processing flow.

The attribute transmitting unit 210 of the processing flow receiving apparatus 200 that distributes the secret key transmits the bit string ID to the key generating apparatus 400 (S211). The bit string ID may be a bit string indicating single attribute information such as an employee of company A, 20 years or older, or a bit string indicating a logical expression of attribute information such as an employee of company A, male, 20 years or older, or female. But you can. The key generation unit 410 of the key generation device 400 uses the secret key K ₀ as K ₀ = sQ _ID.
And is recorded in the key generation recording unit 490 (S410).

The key splitting unit 420 selects a split random number K ₃ ′ from integers between 0 and p−1 (S421), and uses the secret key K ₀ and the split random number K ₃ ′ for reception according to the predetermined method 1. It obtains the secret key _{K 1,} and records the key generation recording unit 490 (S422). The dividing random number K ₃ ′ is desirably selected at random from an integer of 0 or more and p−1 or less, but may be selected by another predetermined method. The key distribution unit 430 obtains the proxy calculation secret key K ₃ by the predetermined method 2 using the dividing random number K ₃ ′, and records it in the key generation recording unit 490 (S434). Then, the key distribution unit 430 transmits the received secret key K ₁ to the receiving apparatus 200, the receiving device identification information R _ID surrogate calculation secret key K that identifies the receiving device 200 that transmitted the received secret key K _{1 3} is transmitted to the decryption history storage server 300 (S435). Decoding the recording unit 290 of the receiving apparatus 200 records the received secret key _{K 1} (S291). Proxy recording unit 390 of the decoding history storage server 300 records the proxy calculation secret key _{K 3} in association with the receiving apparatus identifying information _{R ID} (S391).

The processing flow attribute transmission unit 210 from generation of ciphertext to decryption transmits the bit string ID to the transmission device 100 (S212). The encryption unit 110 of the transmission device 100 selects the random number r from an integer between 0 and p−1 and calculates the session information U as U = rP. The random number r is desirably selected at random from an integer of 0 or more and p−1 or less, but may be selected by another predetermined method. In addition, the encryption unit 110
g _ID = e (Q _ID , P _Pub )
And plaintext M is encrypted by a predetermined method 3 using H (g _ID ^r ) to obtain ciphertext V. The encryption unit 110 further generates the ciphertext identification information v as v = h (V). The function h may be a hash function, for example. However, the function h need not be limited to the hash function, and may be any function that can generate information that can uniquely identify the ciphertext. Then, the ciphertext transmitting unit 120 transmits the ciphertext V and the ciphertext identification information v to the receiving device 200, and transmits the session information U and the ciphertext identification information v to the decryption history storage server 300 (S120).

The decryption history storage server 300 records the session information U received from the transmission device 100 and the ciphertext identification information v in the session information storage unit 370 in association with each other (S370). Request creation unit 220 of the receiving apparatus 200, creates a request Req to a predetermined method 4 using the received secret key _{K 1.} Note that the request creation unit 220 may select the random number r _tmp from an integer between 0 and p−1 (S221), and may also use the random number r _{tmp by the} predetermined method 4. In this way, it concealed the information about the received secret key K _1. The random number r _tmp is desirably selected at random from an integer of 0 or more and p−1 or less, but may be selected by another predetermined method. Then, the request transmission unit 225 transmits the request Req, the ciphertext identification information v, and the reception device identification information R _ID that identifies the reception device to the decryption history storage server (S222).

The response creation unit 310 of the decryption history storage server 300 acquires the session information U associated with the ciphertext identification information v recorded in the session information storage unit 370 that matches the ciphertext identification information v received from the receiving device 200. To do. In addition, the response creation unit 310 uses the proxy calculation secret key K ₃ associated with the reception device identification information R _ID recorded in the proxy recording unit 390 that matches the reception device identification information R _ID received from the reception device 200. get. Then, the response creation unit 310 performs a calculation using the session information U and the proxy calculation secret key K ₃ according to the predetermined method 7, which is a method corresponding to the predetermined method 1, the predetermined method 2, and the predetermined method 4. Go to find the response Res. The response transmission unit 315 transmits the response Res to the reception device 200 (S310).

The decryption history storage server 300 records the ciphertext identification information v, the receiving device identification information R _ID, and the time t acquired according to the predetermined method 8 in the history storage unit 380 in association with each other (S380). For example, the predetermined method 8 may acquire the time t from the time server when the request Req is received, or may acquire the time t from the timer of the decoding history storage server itself when the response Res is transmitted. . Moreover, the timing which acquires the time t is good also when the process of the response preparation part 310 is complete | finished. The time t may be acquired from a time server or may be acquired from the timer of the decryption history storage server 300 itself. The timing of obtaining the time t and the acquisition destination may be arbitrarily combined, and may be determined when the predetermined method 8 is determined.

The decrypting unit 230 of the receiving device 200 obtains the value W of g _ID ^r using the response Res received from the decryption history storage server according to the predetermined method 2 that is a method corresponding to the predetermined method 2 and the predetermined method 4. . Then, the ciphertext V is decrypted according to the predetermined method 6 which is a method corresponding to the predetermined method 3 using H (W), and is decrypted into the plaintext M ′ (S230).

As described above, the encryption system according to the first embodiment has the following characteristics.
(1) The transmission device 100 transmits the ciphertext V to the reception device 200 and transmits the session information U and the ciphertext identification information v to the decryption history storage server 300. That is, session information U necessary for decoding is not transmitted to receiving apparatus 200.
(2) Session information storage section 370 of decryption history storage server 300 records session information U and ciphertext identification information v in association with each other.
(3) The reception device 200 transmits the ciphertext identification information v and the reception device identification information R _ID to the decryption history storage server 300, so that the decryption history storage server 300 and the session information U necessary for decryption of the ciphertext V and the proxy to get the calculation for the secret key K _3. Therefore, the decryption history storage server 300 can grasp which receiving device 200 is trying to decrypt which ciphertext V.
(4) The decryption history storage server 300 records the ciphertext identification information v, the receiving device identification information R _ID, and the time t in the history storage unit 380 in association with each other. Therefore, every time decryption is performed, the decryption history storage server can record the time when the decryption is performed after identifying the ciphertext V and the decrypted receiving device.

Next, the predetermined methods 1 to 7 will be described. The predetermined methods 1 to 7 are “a method for generating a plurality of decryption keys (reception secret key K ₁ , proxy calculation secret key K ₃ ) from the secret key K ₀ ” and “resources of some calculation functions with keys. In order to configure a combination of “a method for safely proxying an external device (decoding history storage server)”, it is only necessary to correspond to each other. For example, the following combinations are possible. However, the “method for generating a plurality of decryption keys (reception private key K ₁ , proxy calculation private key K ₃ ) from the private key K ₀ ” and “partial operation function resources with the key are external devices (decryption It is not necessary to limit to these combinations as long as the “method for safely substituting the history storage server” functions.

Combination of predetermined methods 1-1
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ ′ K ₀
Seek like. In the predetermined method 2, the proxy calculation private key K _{3 is set} to K ₃ = K ₃ ' ⁻¹
Seek like. In the predetermined method 3, the ciphertext V is changed to V = M (+) H (g _ID ^r )
Seek like. In certain methods 4, the information including the received secret key K ₁ a request Req. In the predetermined method 5, the value W is set to W = Res
Seek like. In the predetermined method 6, plaintext M ′ is changed to M ′ = V (+) H (W)
Seek like. In the predetermined method 7, the response Res is Res = e (K ₁ , U) ^ K ₃
Seek like. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K ₁ , U) or Res = e (K ₁ , K ₃ U)
The response Res may be obtained as follows.

  In addition, you may change a part of combination of the above-mentioned predetermined method like the following examples.

In the first example, the predetermined method 2 is changed to K ₃ = K ₃ ′
And the predetermined method 7 is Res = e (K ₁ , U) ^ (K ₃ ⁻¹ )
It is good. However, since the formula (1) is established in the pairing e,
Res = e ((K ₃ ⁻¹ ) K ₁ , U) or Res = e (K ₁ , (K ₃ ⁻¹ ) U)
The response Res may be obtained as follows.

In the second example, the predetermined method 1 is changed to K ₁ = (K ₃ ′) ⁻¹ K ₀
And the predetermined method 2 is K ₃ = K ₃ ′
And the predetermined method 7 is Res = e (K ₁ , U) ^ K ₃
It is good. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K ₁ , U) or Res = e (K ₁ , K ₃ U)
The response Res may be obtained as follows.

In the third example, the ciphertext V may be obtained by encrypting the plaintext M using the predetermined method 3 with H (g _ID ^r ) as a common key. In this case, the predetermined method 6 may decrypt the ciphertext V into the plaintext M ′ using H (W) as a common key.

Combination of predetermined methods 1-2
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ ′ K ₀
Seek like. In the predetermined method 2, the proxy calculation private key K _{3 is set} to K ₃ = K ₃ ' ⁻¹
Seek like. In the predetermined method 3, the ciphertext V is changed to V = M (+) H (g _ID ^r )
Seek like. In the predetermined method 4, the request creation unit 220 selects a random number r _tmp from integers between 0 and p−1 (S221), and sets the concealment key K _tmp as K _tmp = r _tmp K ₁
And request Req as information including concealment key K _tmp . In the predetermined method 5, the value W is set to W = Res ^ r _tmp ⁻¹
Seek like. In the predetermined method 6, plaintext M ′ is changed to M ′ = V (+) H (W)
Seek like. In the predetermined method 7, the response Res is Res = e (K _tmp , U) ^ K _3.
Seek like. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K _tmp , U) or Res = e (K _tmp , K ₃ U)
The response Res may be obtained as follows.

  In addition, you may change a part of combination of the above-mentioned predetermined method like the following examples.

In the first example, the predetermined method 2 is changed to K ₃ = K ₃ ′
And the predetermined method 7 is Res = e (K _tmp , U) ^ (K ₃ ⁻¹ )
It is good. However, since the formula (1) is established in the pairing e,
Res = e ((K ₃ ⁻¹ ) K _tmp , U) or Res = e (K _tmp , (K ₃ ⁻¹ ) U)
The response Res may be obtained as follows.

In the second example, the predetermined method 1 is changed to K ₁ = (K ₃ ′) ⁻¹ K ₀
And the predetermined method 2 is K ₃ = K ₃ ′
And the predetermined method 7 is Res = e (K _tmp , U) ^ K ₃
It is good. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K _tmp , U) or Res = e (K _tmp , K ₃ U)
The response Res may be obtained as follows.

In the third example, the ciphertext V may be obtained by encrypting the plaintext M using the predetermined method 3 with H (g _ID ^r ) as a common key. In this case, the predetermined method 6 may decrypt the ciphertext V into the plaintext M ′ using H (W) as a common key.

[Modification 1]
FIG. 1 shows a configuration example of an encryption system according to a first modification of the first embodiment. FIG. 2 shows a processing flow for distributing the secret key of the encryption system of the first modification of the first embodiment, and FIG. 4 shows a processing flow from generation of ciphertext to decryption. The difference from the first embodiment is that the receiving device 200 itself generates the ciphertext identification information v (does not receive the ciphertext identification information v). The processing flow for distributing the secret key is the same as in the first embodiment.

In this modification, the receiving device 200 also includes a ciphertext identification information generation unit 240. Then, the ciphertext transmission unit 121 of the transmission device 100 transmits the ciphertext V to the reception device 200 and transmits the session information U and the ciphertext identification information v to the decryption history storage server 300 (S121). Then, the ciphertext identification information generation unit 240 of the receiving device 200 generates the ciphertext identification information v as v = h (V) (S240). Other components and processes are the same as those in the first embodiment, and whether to generate the concealing random number r _tmp and variations of the predetermined methods 1 to 8 are the same as those in the first embodiment. Therefore, the same effect as in the first embodiment can be obtained.

[Modification 2]
FIG. 1 shows a configuration example of an encryption system according to a first modification of the first embodiment. FIG. 5 shows a processing flow for distributing the secret key of the encryption system of the first embodiment and FIG. 3 shows a processing flow from generation of ciphertext to decryption. The difference from the first embodiment, the key generation device 400, protective secret key K ₂ is also a point to be generated. Therefore, the processing of the key distribution unit 430 and the decryption unit 230 and the information recorded in the decryption recording unit 290 are different from those in the first embodiment.

Processing flow steps S211 to S422 for distributing the secret key are the same as those in the first embodiment. When step S422 ends, the key distribution unit 430 obtains the proxy calculation secret key K ₃ by the predetermined method 2 using the dividing random number K ₃ ′. In certain methods 2 of this modification, the protective secret key _{K 2} selected from 0 or p-1 an integer (S431). A proxy calculation secret key K ₃ is obtained according to a predetermined method 2 ′ using the split random number K ₃ ′ and the protection secret key K ₂ (S432). The protective secret key K ₂ is other than the method key distribution unit 430 obtains a simply random, may be determined as follows. The key distribution unit 430 receives information Pass for obtaining the protection secret key K ₂ from the receiving device 200. Then, the key distribution unit 430 may seek protection for the private key _{K 2} with the information Pass. For example, it may be obtained with a protective secret key K ₂ with the information Pass and the hash function, the information Pass itself may protect secret key K _2. Further, as the information Pass, for example, a password set by a user (recipient) of the receiving device 200 may be used. The protective secret key K _2, it is desirable to randomly selected from 0 or p-1 an integer, may be selected in a predetermined other methods.

Key distribution unit 430 transmits the received secret key K ₁ and the protective secret key K ₂ to the receiving apparatus 200, receiving identifying the receiving device 200 that transmitted the received secret key K ₁ and the protective secret key K ₂ transmitting the device identification information _{R ID} surrogate calculation secret key _{K 3} to decode history storage server 300 (S433). Decoding the recording unit 290 of the receiving apparatus 200 records the received secret key _{K 1} and the protective secret key _{K 2} (S292). Note that the decryption recording unit 290 may be configured by two or more physically different recording devices. For example, the decryption / recording unit 290 may be composed of an IC card and a personal computer hard disk. Then, record the receiving secret key K ₁ to the IC card, may be recorded in a protective secret key K ₂ in the computer's hard disk. Thus physically separately records the received secret key K ₁ and the protective secret key K _2, both simultaneously reduce the risk of leakage or lost. Proxy recording unit 390 of the decoding history storage server 300 records the proxy calculation secret key _{K 3} in association with the receiving apparatus identifying information _{R ID} (S391).

Except for the processing flow step S230 from generation of ciphertext to decryption, it is the same as the first embodiment. In step S230, the decryption unit 230 of the reception device 200 uses the response Res received from the decryption history storage server 300 according to the predetermined method 2 that is a method corresponding to the predetermined method 2 and the predetermined method 4, and performs protection. determine the value W of _{g ID} ^r using the secret key _{K 2.} Then, the ciphertext V is decrypted according to the predetermined method 6 which is a method corresponding to the predetermined method 3 using H (W), and is decrypted into the plaintext M ′ (S230). Since the present modification has such a configuration, the same effect as in the first embodiment can be obtained.

Next, the predetermined methods 1 to 7 will be described. The predetermined methods 1 to 7 include “a method for generating a plurality of decryption keys (reception secret key K ₁ , protection secret key K ₂ , proxy calculation secret key K ₃ ) from the secret key K ₀ ” and “with key In order to configure a combination of “methods for safely substituting resources of some arithmetic functions to an external device (decoding history storage server)”, they need only correspond to each other. For example, the following combinations are possible. However, “a method for generating a plurality of decryption keys (reception secret key K ₁ , protection secret key K ₂ , proxy calculation secret key K ₃ ) from the secret key K ₀ ” and “partial calculation function with key” It is not necessary to limit to these combinations as long as the “method of safely substituting resources for the external device (decoding history storage server)” functions.

Combination of predetermined methods 1-3
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ 'K ₀
Seek like. In the predetermined method 2 ′, the proxy calculation private key K _{3 is set} to K ₃ = (K ₂ K ₃ ′) ^−1.
Seek like. In the predetermined method 3, the ciphertext V is changed to V = M (+) H (g _ID ^r )
Seek like. In certain methods 4, the information including the received secret key K ₁ a request Req. In the predetermined method 5, the value W is set to W = Res ^ K ₂
Seek like. In the predetermined method 6, plaintext M ′ is changed to M ′ = V (+) H (W)
Seek like. In the predetermined method 7, the response Res is Res = e (K ₁ , U) ^ K ₃
Seek like. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K ₁ , U) or Res = e (K ₁ , K ₃ U)
The response Res may be obtained as follows.

  In addition, you may change a part of combination of the above-mentioned predetermined method like the following examples.

In the first example, the predetermined method 2 ′ is changed to K ₃ = (K ₂ ) ⁻¹ K ₃ ′.
And the predetermined method 7 is Res = e (K ₁ , U) ^ (K ₃ ⁻¹ )
It is good. However, since the formula (1) is established in the pairing e,
Res = e ((K ₃ ⁻¹ ) K ₁ , U) or Res = e (K ₁ , (K ₃ ⁻¹ ) U)
The response Res may be obtained as follows.

In the second example, the predetermined method 1 is changed to K ₁ = (K ₃ ′) ⁻¹ K ₀
And the predetermined method 2 ′ is K ₃ = (K ₂ ) ⁻¹ K ₃ ′
And the predetermined method 7 is Res = e (K ₁ , U) ^ K ₃
It is good. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K ₁ , U) or Res = e (K ₁ , K ₃ U)
The response Res may be obtained as follows.

In the third example, the ciphertext V may be obtained by encrypting the plaintext M using the predetermined method 3 with H (g _ID ^r ) as a common key. In this case, the predetermined method 6 may decrypt the ciphertext V into the plaintext M ′ using H (W) as a common key.

Combination of predetermined methods 1-4
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ 'K ₀
Seek like. In the predetermined method 2 ′, the proxy calculation private key K _{3 is set} to K ₃ = (K ₂ K ₃ ′) ^−1.
Seek like. In the predetermined method 3, the ciphertext V is changed to V = M (+) H (g _ID ^r )
Seek like. In the predetermined method 4, the request creation unit 220 selects a random number r _tmp from integers between 0 and p−1 (S221), and sets the concealment key K _tmp as K _tmp = r _tmp K ₁
And request Req as information including concealment key K _tmp . In the predetermined method 5, the value W is set to W = Res ^ (r _tmp ⁻¹ K ₂ )
Seek like. In the predetermined method 6, plaintext M ′ is changed to M ′ = V (+) H (W)
Seek like. In the predetermined method 7, the response Res is Res = e (K _tmp , U) ^ K _3.
Seek like. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K _tmp , U) or Res = e (K _tmp , K ₃ U)
The response Res may be obtained as follows.

  In addition, you may change a part of combination of the above-mentioned predetermined method like the following examples.

In the first example, the predetermined method 2 ′ is changed to K ₃ = (K ₂ ) ⁻¹ K ₃ ′.
And predetermined method 7 is Res = e (K _tmp , U) ^ (K ₃ ⁻¹ )
It is good. However, since the formula (1) is established in the pairing e,
Res = e ((K ₃ ⁻¹ ) K _tmp , U) or Res = e (K _tmp , (K ₃ ⁻¹ ) U)
The response Res may be obtained as follows.

In the second example, the predetermined method 1 is changed to K ₁ = (K ₃ ′) ⁻¹ K ₀
And the predetermined method 2 ′ is K ₃ = (K ₂ ) ⁻¹ K ₃ ′
And the predetermined method 7 is Res = e (K _tmp , U) ^ K ₃
It is good. However, since the formula (1) is established in the pairing e,
Res = e (K ₃ K _tmp , U) or Res = e (K _tmp , K ₃ U)
The response Res may be obtained as follows.

In the third example, the ciphertext V may be obtained by encrypting the plaintext M using the predetermined method 3 with H (g _ID ^r ) as a common key. In this case, the predetermined method 6 may decrypt the ciphertext V into the plaintext M ′ using H (W) as a common key.

[Modification 3]
FIG. 1 shows a configuration example of an encryption system according to a first modification of the first embodiment. FIG. 5 shows a processing flow for distributing the secret key of the encryption system according to the first modification of the first embodiment, and FIG. 4 shows a processing flow from generation of ciphertext to decryption. The difference from the first embodiment and the second modification is that the receiving device 200 itself generates the ciphertext identification information v (the ciphertext identification information v is not received). The processing flow for distributing the secret key is the same as that in the first embodiment and the second modification.

In this modification, the receiving device 200 also includes a ciphertext identification information generation unit 240. Then, the ciphertext transmission unit 121 of the transmission device 100 transmits the ciphertext V to the reception device 200 and transmits the session information U and the ciphertext identification information v to the decryption history storage server 300 (S121). Then, the ciphertext identification information generation unit 240 of the receiving device 200 generates the ciphertext identification information v as v = h (V) (S240). The other components and processing are the same as in the first modification example 2, and whether to generate the concealing random number r _tmp and variations of the predetermined methods 1 to 8 are the same as in the first modification example 2. . Therefore, the same effect as in the first embodiment can be obtained.

In the first embodiment, the decryption history storage server records the decryption history in the history storage unit when the response Res is transmitted. However, if the receiver did not have the correct reception secret key K ₁ (i.e., actually if it can not decrypt the ciphertext V) would be a decoding history is recorded. In a second embodiment, an example of functions provided to check whether the decoding history storage server owns the received secret key K ₁ received has transmitted device is correct request Req.

  FIG. 6 shows a configuration example of the encryption system according to the second embodiment. FIG. 2 shows a processing flow for distributing the secret key of the encryption system according to the second embodiment, and FIG. 7 shows a processing flow from generation of ciphertext to decryption. The encryption system according to the second embodiment includes a transmission device 100, a reception device 500, a decryption history storage server 600, and a key generation device 400.

In the following description, k is a large integer, p is a prime number of k bits, G ₁ is a cyclic addition group of order p, G ₂ is a cyclic group of order p, and e is G ₁ × G ₁ → G ₂ Bi is a bilinear pairing function that maps to H, H is a symbol indicating a hash function that maps an element of group G ₂ to an n-bit bit string, P is a generator of group G ₁ , and s is 0 or more generated by key generator 400 An integer less than or equal to p−1, P _Pub = sP, (P, P _Pub ) is a public parameter, MaptoPoint _G1 is a function that maps an arbitrary length bit string to the group G ₁ , ID is an arbitrary length bit string, Q _ID = MaptoPoint _G1 (ID), (+) is a symbol indicating exclusive OR in bit units, ^ is a symbol indicating power, v is ciphertext identification information for identifying ciphertext V, and h is a cipher for identifying ciphertext V A symbol indicating a function that generates sentence identification information, and ‖ is a symbol indicating a combination of bit strings. The

  The transmission device 100 includes an encryption unit 110, a ciphertext transmission unit 120, and an encryption recording unit 190. The receiving device 500 includes an attribute transmission unit 210, a request creation unit 220, a request transmission unit 225, a decryption unit 230, a second request creation unit 520, a second decryption unit 530, a hash value calculation unit 550, and a decryption recording unit 290. The decryption history storage server 600 includes a response generation unit 310, a response transmission unit 315, an authentication key generation unit 610, a challenge generation unit 620, a second response generation unit 630, an authentication unit 640, a session information storage unit 370, a history storage unit 380, A proxy recording unit 390 is provided. The key generation device 400 includes a key generation unit 410, a key division unit 420, a key distribution unit 430, and a key generation recording unit 490. The functions of these components will be described below while explaining the processing flow. Since the processing flow for distributing the secret key is the same as in the first embodiment, the description thereof is omitted.

Processing flow from generation of ciphertext to decryption The processing from step S212 to S222 is the same as in the first embodiment. After step S222, the authentication key generation unit 610 of the decryption history storage server 600 generates an authentication key A and a random number a that is an integer between 0 and p−1. Also, the authentication key generation unit 610 obtains an encrypted authentication key V ′ by encrypting the authentication key A by a predetermined method 3 ′ using H (g _ID ^a ). The authentication key generation unit 610 further calculates session information U ′ such that U ′ = aP, and transmits only the encrypted authentication key V ′ or the encrypted authentication key V ′ and the session information U ′ to the receiving device 500 ( S610).

The second request creation unit 520, using the received secret key _{K 1} to create a 'request Req in' a predetermined method 4, and transmits the decoding history storage server 600 (S520). The second response creation unit 630 of the decryption history storage server 600 performs session information U ′ and proxy calculation according to a predetermined method 7 ′ that is a method corresponding to the predetermined method 1, the predetermined method 2, and the predetermined method 4 ′. seeking a response Res' performs calculation using the secret key _{K 3,} and transmits to the receiving apparatus 500 (S630). The second decryption unit 530 of the receiving device 500 uses the response Res ′ received from the decryption history storage server 600 to perform g _ID according to the predetermined method 5 ′ that is a method corresponding to the predetermined method 2 and the predetermined method 4 ′. determine the value W of ^a. Then, using H (W), the encrypted authentication key V ′ is decrypted according to the predetermined method 6 ′, which is a method corresponding to the predetermined method 3 ′, and is decrypted into the authentication key A ′ (S530). In the following, when it is necessary to distinguish between the authentication key before encryption and the decrypted authentication key, the authentication key before encryption is described as A, and the decrypted authentication key is described as A ′. To do.

  The challenge generation unit 620 of the decryption history storage server 600 generates a challenge B and transmits it to the receiving device 500 (S620). Note that step S620 may be performed before steps S610 to S530 or in parallel. The hash value calculation unit 550 of the receiving device 500 obtains the hash value D ′ as D ′ = H ′ (A′‖B) and transmits it to the decryption history storage server 600.

  The authentication unit 640 of the decryption history storage server obtains the hash value D as D = H ′ (A‖B), confirms that D = D ′, and stops processing if D ≠ D ′. (S640). If D = D ', the process proceeds to step S310. Steps S310, S230, and S380 are the same as those in the first embodiment.

  Since the second embodiment is such a process, the decoding history can be recorded only when the receiving apparatus can actually perform decoding after obtaining the effects of the first embodiment. For example, even when there is an attack such as a large amount of request Req being transmitted from a device impersonating a receiving device, the history accumulation unit 380 does not record the decryption history for these requests Req.

The predetermined methods 1 to 7 of the second embodiment are the same as the predetermined methods 1 to 7 described in the first embodiment. The predetermined methods 3 ′, 4 ′, 5 ′, 6 ′, and 7 ′ described in the second embodiment also use “a plurality of decryption keys (reception secret key K ₁ , proxy calculation secret key”) from the secret key K _0. K ₃ ) ”and“ method for safely substituting resources of some computing functions with keys to an external device (decryption history storage server) ”need only be compatible with each other. . For example, there are the following variations.

Combination of predetermined methods 2-1
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ ′ K ₀
Seek like. In the predetermined method 2, the proxy calculation private key K _{3 is set} to K ₃ = K ₃ ' ⁻¹
Seek like. In such a case, in the predetermined method 3 ′, the encrypted authentication key V ′ is changed to V ′ = A (+) H (g _ID ^r ).
Seek like. ', The request Req' predetermined method 4, information including the reception secret key K ₁ a. In the predetermined method 5 ′, the value W is set to W = Res ′
Seek like. In the predetermined method 6 ′, the authentication key A ′ is set to A ′ = V ′ (+) H (W)
Seek like. In the predetermined method 7 ′, the response Res ′ is set to Res ′ = e (K ₁ , U ′) ^ K _3.
Seek like. However, since the formula (1) is established in the pairing e,
Res ′ = e (K ₃ K ₁ , U ′) or Res ′ = e (K ₁ , K ₃ U ′)
The response Res ′ may be obtained as follows.

  In addition, you may change a part of combination of the above-mentioned predetermined method like the following examples.

In the first example, the predetermined method 2 is changed to K ₃ = K ₃ ′
And the predetermined method 7 ′ is Res ′ = e (K ₁ , U ′) ^ (K ₃ ⁻¹ )
It is good. However, since the formula (1) is established in the pairing e,
Res ′ = e ((K ₃ ⁻¹ ) K ₁ , U ′) or Res ′ = e (K ₁ , (K ₃ ⁻¹ ) U ′)
The response Res ′ may be obtained as follows.

In the second example, the predetermined method 1 is changed to K ₁ = (K ₃ ′) ⁻¹ K ₀
And the predetermined method 2 is K ₃ = K ₃ ′
And the predetermined method 7 ′ is Res ′ = e (K ₁ , U ′) ^ K ₃
It is good. However, since the formula (1) is established in the pairing e,
Res ′ = e (K ₃ K ₁ , U ′) or Res ′ = e (K ₁ , K ₃ U ′)
The response Res ′ may be obtained as follows.

In the third example, a predetermined method 3 ′ may be used to encrypt the authentication key A using H (g _ID ^r ) as a common key to obtain the encrypted authentication key V ′. In this case, the predetermined method 6 ′ may decrypt the encrypted authentication key V ′ into the authentication key A ′ using H (W) as a common key.

In the fourth example, the session information U ′ is also transmitted to the receiving device 500 in step S610, and in the predetermined method 4 ′, the request Req ′ is Req ′ = e (K ₁ , U ′).
Seek like. Then, in the predetermined method 7 ′, the response Res ′ is changed to Res ′ = Req ′ ^ K ₃
You may ask as follows.

Combination of predetermined methods 2-2
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ ′ K ₀
Seek like. In the predetermined method 2, the proxy calculation private key K _{3 is set} to K ₃ = K ₃ ' ⁻¹
Seek like. In the predetermined method 3 ′, the encrypted authentication key V ′ is set to V ′ = A (+) H (g _ID ^r )
Seek like. In the predetermined method 4 ′, the second request creation unit 520 selects a random number r _tmp from integers not less than 0 and not more than p−1, and sets the concealment key K _tmp as K _tmp = r _tmp K ₁
And request Req ′ as information including concealment key K _tmp . In the predetermined method 5 ′, the value W is changed to W = Res ′ ^ r _tmp ⁻¹
Seek like. In the predetermined method 6 ′, the authentication key A ′ is set to A ′ = V ′ (+) H (W)
Seek like. In the predetermined method 7 ′, the response Res ′ is set to Res ′ = e (K _tmp , U ′) ^ K _3.
Seek like. However, since the formula (1) is established in the pairing e,
Res ′ = e (K ₃ K _tmp , U ′) or Res ′ = e (K _tmp , K ₃ U ′)
The response Res may be obtained as follows.

  In addition, you may change a part of combination of the above-mentioned predetermined method like the following examples.

In the first example, the predetermined method 2 is changed to K ₃ = K ₃ ′
And the predetermined method 7 ′ is Res ′ = e (K _tmp , U ′) ^ (K ₃ ⁻¹ )
It is good. However, since the formula (1) is established in the pairing e,
Res ′ = e ((K ₃ ⁻¹ ) K _tmp , U ′) or Res ′ = e (K _tmp , (K ₃ ⁻¹ ) U ′)
The response Res ′ may be obtained as follows.

In the second example, the predetermined method 1 is changed to K ₁ = (K ₃ ′) ⁻¹ K ₀
And the predetermined method 2 is K ₃ = K ₃ ′
And the predetermined method 7 ′ is Res ′ = e (K _tmp , U ′) ^ K ₃
It is good. However, since the formula (1) is established in the pairing e,
Res ′ = e (K ₃ K _tmp , U ′) or Res ′ = e (K _tmp , K ₃ U ′)
The response Res ′ may be obtained as follows.

In the third example, a predetermined method 3 ′ may be used to encrypt the authentication key A using H (g _ID ^r ) as a common key to obtain the encrypted authentication key V ′. In this case, the predetermined method 6 ′ may decrypt the encrypted authentication key V ′ into the authentication key A ′ using H (W) as a common key.

In the fourth example, the session information U ′ is also transmitted to the receiving apparatus 500 in step S610, and in the predetermined method 4 ′, the request Req ′ is Req ′ = e (r _tmp K ₁ , U ′).
Seek like. Then, in the predetermined method 7 ′, the response Res ′ is changed to Res ′ = Req ′ ^ K ₃
You may ask as follows.

[Modification 1]
The second embodiment is different from the first embodiment in that the receiving device is authenticated before the ciphertext V is decrypted. However, the process of distributing the secret key and the generation and decryption of the ciphertext V to be decrypted are the same as in the first embodiment. Therefore, the first to third modifications described in the first embodiment can be applied to the second embodiment.

  Embodiment 2 Modification 1 is an encryption system in which the receiving device 500 itself generates the ciphertext identification information v (the point that the ciphertext identification information v is not received) is changed (corresponding to the first embodiment modification 1). To do). Example 2 FIG. 6 shows a configuration example of an encryption system according to a first modification. In this case, the receiving device 500 also includes a ciphertext identification information generation unit 240. FIG. 2 shows a processing flow for distributing a secret key, and FIG. 8 shows a processing flow from generation of ciphertext to decryption. The differences between the second embodiment and the second variation of the second embodiment are the same as the differences between the first embodiment and the first variation of the first embodiment, and thus the description thereof is omitted.

[Modification 2]
Embodiment 2 Modification 2 is an encryption system in which the key generation device 400 also generates a protection secret key K ₂ (corresponding to Modification 2 of Embodiment 1). Embodiment 2 FIG. 6 shows a configuration example of an encryption system according to a second modification. Second Embodiment In the second modification, the receiving device 500 does not include the ciphertext identification information generation unit 240. FIG. 5 shows a processing flow for distributing a secret key, and FIG. 7 shows a processing flow from generation of ciphertext to decryption. Since the difference between the second embodiment and the second variation is the same as the first embodiment and the second variation, the process flow for distributing the secret key and the process from generation to decryption of ciphertext are described. Description of the processing flow is omitted. In addition, since the predetermined methods 1 to 7 are the same as those in the first modification 2 of the first embodiment, description thereof is omitted. Specific examples of the predetermined methods 3 ′, 4 ′, 5 ′, 6 ′, and 7 ′ will be described below. However, “a method for generating a plurality of decryption keys (reception secret key K ₁ , protection secret key K ₂ , proxy calculation secret key K ₃ ) from the secret key K ₀ ” and “partial calculation function with key” It is not necessary to limit to these combinations as long as the “method of safely substituting resources for the external device (decoding history storage server)” functions.

Combination 2-3 of predetermined methods
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ 'K ₀
Seek like. In the predetermined method 2 ′, the proxy calculation private key K _{3 is set} to K ₃ = (K ₂ K ₃ ′) ^−1.
Seek like. In the predetermined method 3 ′, the encrypted authentication key V ′ is set to V ′ = A (+) H (g _ID ^r )
Seek like. ', The request Req' predetermined method 4, information including the reception secret key K ₁ a. In the predetermined method 5 ′, the value W is set to W = Res ′ ^ K ₂
Seek like. In the predetermined method 6 ′, the authentication key A ′ is set to A ′ = V ′ (+) H (W)
Seek like. In the predetermined method 7 ′, the response Res ′ is set to Res ′ = e (K ₁ , U ′) ^ K _3.
Seek like. However, since the formula (1) is established in the pairing e,
Res ′ = e (K ₃ K ₁ , U ′) or Res ′ = e (K ₁ , K ₃ U ′)
The response Res ′ may be obtained as follows.

  In addition, you may change a part of combination of the above-mentioned predetermined method like the following examples.

In the first example, the predetermined method 2 ′ is changed to K ₃ = (K ₂ ) ⁻¹ K ₃ ′.
And the predetermined method 7 ′ is Res ′ = e (K ₁ , U ′) ^ (K ₃ ⁻¹ )
It is good. However, since the formula (1) is established in the pairing e,
Res ′ = e ((K ₃ ⁻¹ ) K ₁ , U ′) or Res ′ = e (K ₁ , (K ₃ ⁻¹ ) U ′)
The response Res ′ may be obtained as follows.

In the second example, the predetermined method 1 is changed to K ₁ = (K ₃ ′) ⁻¹ K ₀
And the predetermined method 2 ′ is K ₃ = (K ₂ ) ⁻¹ K ₃ ′
And the predetermined method 7 ′ is Res ′ = e (K ₁ , U ′) ^ K ₃
It is good. However, since the formula (1) is established in the pairing e,
Res ′ = e (K ₃ K ₁ , U ′) or Res ′ = e (K ₁ , K ₃ U ′)
The response Res ′ may be obtained as follows.

In the third example, a predetermined method 3 ′ may be used to encrypt the authentication key A using H (g _ID ^r ) as a common key to obtain the encrypted authentication key V ′. In this case, the predetermined method 6 ′ may decrypt the ciphertext V into the plaintext M ′ using H (W) as a common key.

In the fourth example, the session information U ′ is also transmitted to the receiving device 500 in step S610, and in the predetermined method 4 ′, the request Req ′ is Req ′ = e (K ₁ , U ′).
Seek like. Then, in the predetermined method 7 ′, the response Res ′ is changed to Res ′ = Req ′ ^ K ₃
You may ask as follows.

Combination of predetermined methods 2-4
In the predetermined method 1, the reception private key K _{1 is set} to K ₁ = K ₃ 'K ₀
Seek like. In the predetermined method 2 ′, the proxy calculation private key K _{3 is set} to K ₃ = (K ₂ K ₃ ′) ^−1.
Seek like. In the predetermined method 3 ′, the encrypted authentication key V ′ is set to V ′ = A (+) H (g _ID ^r )
Seek like. In the predetermined method 4 ′, the second request creation unit 520 selects a random number r _tmp from integers not less than 0 and not more than p−1, and sets the concealment key K _tmp as K _tmp = r _tmp K ₁
And request Req ′ as information including concealment key K _tmp . In the predetermined method 5 ′, the value W is set to W = Res ′ ^ (r _tmp ⁻¹ K ₂ )
Seek like. In the predetermined method 6 ′, the authentication key A ′ is set to A ′ = V ′ (+) H (W)
Seek like. In the predetermined method 7 ′, the response Res ′ is set to Res ′ = e (K _tmp , U ′) ^ K _3.
Seek like. However, since the formula (1) is established in the pairing e,
Res ′ = e (K ₃ K _tmp , U ′) or Res ′ = e (K _tmp , K ₃ U ′)
The response Res ′ may be obtained as follows.

  In addition, you may change a part of combination of the above-mentioned predetermined method like the following examples.

In the first example, the predetermined method 2 ′ is changed to K ₃ = (K ₂ ) ⁻¹ K ₃ ′.
And the predetermined method 7 ′ is Res = e (K _tmp , U ′) ^ (K ₃ ⁻¹ )
It is good. However, since the formula (1) is established in the pairing e,
Res ′ = e ((K ₃ ⁻¹ ) K _tmp , U ′) or Res ′ = e (K _tmp , (K ₃ ⁻¹ ) U ′)
The response Res ′ may be obtained as follows.

In the second example, the predetermined method 1 is changed to K ₁ = (K ₃ ′) ⁻¹ K ₀
And the predetermined method 2 ′ is K ₃ = (K ₂ ) ⁻¹ K ₃ ′
And the predetermined method 7 ′ is Res ′ = e (K _tmp , U ′) ^ K ₃
It is good. However, since the formula (1) is established in the pairing e,
Res ′ = e (K ₃ K _tmp , U ′) or Res ′ = e (K _tmp , K ₃ U ′)
The response Res ′ may be obtained as follows.

In the third example, the predetermined method 3 may be such that the authentication key A is encrypted using H (g _ID ^r ) as a common key to obtain the encrypted authentication key V ′. In this case, the predetermined method 6 ′ may decrypt the encrypted authentication key V ′ into the authentication key A ′ using H (W) as a common key.

In the fourth example, the session information U ′ is also transmitted to the receiving apparatus 500 in step S610, and in the predetermined method 4 ′, the request Req ′ is Req ′ = e (r _tmp K ₁ , U ′).
Seek like. Then, in the predetermined method 7 ′, the response Res ′ is changed to Res ′ = Req ′ ^ K ₃
You may ask as follows.

[Modification 3]
Example 2 Modification 3 are that the receiving apparatus 500 itself generates a ciphertext identifier v and (that does not receive the encrypted identification information v), that the key generation device 400 also generates protecting secret key K ₂ Is an encryption system (corresponding to the third modification of the first embodiment). Embodiment 2 FIG. 6 shows a configuration example of an encryption system according to a third modification. In this case, the receiving device 500 also includes a ciphertext identification information generation unit 240. FIG. 5 shows a processing flow for distributing a secret key, and FIG. 8 shows a processing flow from generation of ciphertext to decryption. Since the difference between the second modification example and the second modification example 3 is the same as the difference between the first modification example 2 and the first modification example 3, the description thereof will be omitted.

  The third embodiment shows an encryption system in which the decryption history storage server authenticates by a method different from that of the second embodiment. FIG. 9 shows a configuration example of the encryption system according to the third embodiment. FIG. 10 shows a processing flow for distributing the secret key of the encryption system according to the third embodiment, and FIG. 11 shows a processing flow from generation of ciphertext to decryption. The encryption system according to the third embodiment includes a transmission device 100, a reception device 501, a decryption history storage server 601, and a key generation device 700.

In the following description, k is a large integer, p is a prime number of k bits, G ₁ is a cyclic addition group of order p, G ₂ is a cyclic group of order p, and e is G ₁ × G ₁ → G ₂ Bi is a bilinear pairing function that maps to H, H is a symbol indicating a hash function that maps an element of group G ₂ to an n-bit bit string, P is a generator of group G ₁ , and s is 0 or more generated by key generator 400 An integer less than or equal to p−1, P _Pub = sP, (P, P _Pub ) is a public parameter, MaptoPoint _G1 is a function that maps an arbitrary length bit string to the group G ₁ , ID is an arbitrary length bit string, Q _ID = MaptoPoint _G1 (ID), (+) is a symbol indicating exclusive OR in bit units, ^ is a symbol indicating power, v is ciphertext identification information for identifying ciphertext V, and h is a cipher for identifying ciphertext V A symbol indicating a function that generates sentence identification information, and ‖ is a symbol indicating a combination of bit strings. The

  The transmission device 100 includes an encryption unit 110, a ciphertext transmission unit 120, and an encryption recording unit 190. The receiving device 501 includes an attribute transmission unit 210, a request creation unit 220, a request transmission unit 225, a decryption unit 230, a key identifier transmission unit 560, and a decryption recording unit 295. The decryption history storage server 601 includes a response creation unit 310, a response transmission unit 315, a key identifier verification unit 660, a session information storage unit 370, a history storage unit 380, and a proxy recording unit 395. The key generation device 700 includes a key generation unit 410, a key division unit 420, a key distribution unit 730, a key identifier generation unit 740, and a key generation recording unit 490. The functions of these components will be described below while explaining the processing flow.

Processing flow steps S211 to S434 for distributing the secret key are the same as those in the first embodiment. After step S434, the key identifier generation unit 740 generates a key identifier K _ID from the reception secret key K ₁ and the proxy calculation secret key K ₃ (S740). The key identifier K _ID may be any information that can be specified from the reception secret key K ₁ and the proxy calculation secret key K ₃ . For example, a hash value of _{K 1} ‖K ₃ may be a key identifier _{K ID,} other information X as _{K 1} ‖K ₃ ‖X (e.g., the bit string ID that indicates the attribute of the receiving apparatus 200) was also added A hash value of the bit string may be used as the key identifier K _ID . Further, when the protection secret key K ₂ is also generated as in the second modification of the third embodiment described later, the hash value of K ₁ ‖K ₂ ‖K ₃ may be used as the key identifier K _ID .

Then, the key distribution unit 730 transmits the reception private key K ₁ and the key identifier K _ID to the reception device 501, and receives the reception device identification information R _ID that identifies the reception device 501 that has transmitted the reception private key K ₁ and the proxy. transmitting the calculated secret key _{K 3} and the key identifier _{K ID} to the decoding history storage server 601 (S735). Decoding the recording unit 295 of the receiving apparatus 501 records the received secret key _{K 1} (S293). Proxy recording unit 395 of the decoding history storage server 601 records the proxy calculation secret key _{K 3} in association with the receiving apparatus identifying information _{R ID} (S393).

Processing flow from generation of ciphertext to decryption The processing from step S212 to S222 is the same as in the first embodiment. The key identifier transmission unit 560 of the reception device 501 transmits the key identifier K _ID to the decryption history storage server 601 (S560). The key identifier K _ID may be transmitted together with the request Req. Any safe communication means may be used. The key identifier verification unit 660 of the decryption history storage server 601 verifies whether the key identifier K _ID is correct (confirms whether the reception device 501 owns the correct reception private key K ₁ ) (S560). If verification fails, stop processing. If the verification is successful, the process proceeds to step S310. Steps S310, S230, and S380 are the same as those in the first embodiment.

It is not necessary to limit to the above-described method, and collation in which the receiving device 501 and the decryption history storage server 601 share the key identifier K _ID in advance, and the receiving device 501 and the decryption history storage server 601 collate the key identifier K _ID. What is necessary is just to have a means. Since the third embodiment is such a process, the decoding history can be recorded only when the receiving apparatus can actually perform decoding after obtaining the effects of the first embodiment.

[Modification 1]
The third embodiment also differs from the first embodiment in that the receiving device is authenticated before the ciphertext V is decrypted. However, the process of distributing the secret key and the generation and decryption of the ciphertext V to be decrypted are the same as in the first embodiment. Therefore, the first to third modifications described in the first embodiment can be applied to the third embodiment.

  Embodiment 3 Modification 1 is an encryption system in which the receiving device 501 itself generates the ciphertext identification information v (the point that the ciphertext identification information v is not received) is changed (corresponding to the first embodiment modification 1). To do). Embodiment 3 FIG. 9 shows a configuration example of an encryption system according to a first modification. In this case, the receiving device 501 also includes a ciphertext identification information generation unit 240. FIG. 10 shows a processing flow for distributing a secret key, and FIG. 12 shows a processing flow from generation of ciphertext to decryption. The differences between the third embodiment and the third variation of the third embodiment are the same as the differences between the first embodiment and the first variation of the first embodiment.

[Modification 2]
Embodiment 3 Modification 2 is an encryption system in which the key generation device 700 also generates a protection secret key K ₂ (corresponding to Modification 2 of Embodiment 1). Embodiment 3 FIG. 9 shows a configuration example of an encryption system according to a second modification. Third Embodiment In the second modification, the receiving device 501 does not include the ciphertext identification information generation unit 240. FIG. 13 shows a processing flow for distributing a secret key, and FIG. 11 shows a processing flow from generation of ciphertext to decryption. The differences between the third embodiment and the third modification of the third embodiment are the same as the differences between the first embodiment and the second modification of the first embodiment, and the description thereof will be omitted.

[Modification 3]
Example 3 Modification 3 are that the receiving apparatus 501 itself generates a ciphertext identifier v and (that does not receive the encrypted identification information v), that the key generation apparatus 700 generates also protect secret key K ₂ Is an encryption system (corresponding to the third modification of the first embodiment). Embodiment 3 FIG. 9 shows a configuration example of an encryption system according to a third modification. In this case, the receiving device 501 also includes a ciphertext identification information generation unit 240. FIG. 13 shows a processing flow for distributing a secret key, and FIG. 12 shows a processing flow from generation of ciphertext to decryption. Since the difference between the third modification example 2 and the third modification example 3 is the same as the difference between the first modification example 2 and the first modification example 3, the description thereof will be omitted.

[Program, recording medium]
The various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

DESCRIPTION OF SYMBOLS 100 Transmission apparatus 110 Encryption part 120, 121 Ciphertext transmission part 190 Encryption recording part 200, 500, 501 Reception apparatus 210 Attribute transmission part 220 Request creation part 225 Request transmission part 230 Decryption part 240 Ciphertext identification information generation part 290, 295 Decryption recording unit 300, 600, 601 Decryption history accumulation server 310 Response creation unit 315 Response transmission unit 370 Session information accumulation unit 380 History accumulation unit 390, 395 Proxy recording unit 400, 700 Key generation device 410 Key generation unit 420 Key division unit 430, 730 Key distribution unit 490 Key generation recording unit 520 Second request generation unit 530 Second decryption unit 550 Hash value calculation unit 560 Key identifier transmission unit 610 Authentication key generation unit 620 Challenge generation unit 630 Second response generation unit 640 Authentication unit 660 keys Besshi collating section 740 key identifier generating unit

Claims (10)

An encryption system having at least a transmission device, a reception device, and a decryption history storage server,
p is a prime number, G ₁ is a cyclic addition group of order p, G ₂ is a cyclic group of order p, e is a bilinear pairing function that maps as G ₁ × G ₁ → G ₂ , and H is a group G A symbol indicating a hash function that maps an element of ₂ to an n-bit bit string, P is a generator of the group G ₁ , s is an integer of 0 to p−1, P _Pub = sP, (P, P _Pub ) is public parameter, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group _{G 1,} ID is arbitrary length bit _{string, Q ID = MaptoPoint G1 (ID} ), K 0 was determined as _K 0 = _{sQ ID} The secret key, K ₃ ′ is a random number for division selected from an integer between 0 and p−1, and K ₁ is for reception obtained by the predetermined method 1 using the secret key K ₀ and the random number for division K ₃ ′. secret key, K ₃ is representative calculation secret key obtained by a predetermined method 2 using the divided random number K _{3 ',} r is 0 Random number chosen from the upper p-1 an integer, U is U = session information obtained as _{rP, g ID} is _{g ID = e (Q ID,} P Pub) values were obtained as, V Is the ciphertext obtained by encrypting the plaintext M by the predetermined method 3 using H (g _ID ^r ), v is the ciphertext identification information for identifying the ciphertext V, and h is the ciphertext identification information for identifying the ciphertext V A symbol indicating the function to be generated,
The transmitting device includes a ciphertext transmitting unit that transmits ciphertext V to at least the receiving device and transmits session information U and ciphertext identification information v to the decryption history storage server,
The receiving device is:
A decryption recording unit for recording the reception private key K ₁ ;
A request creation unit that creates a request Req by a predetermined method 4 using the reception private key K ₁ ;
A request transmission unit that transmits the request Req, ciphertext identification information v that satisfies v = h (V), and reception device identification information R _ID that identifies the reception device, to the decryption history storage server;
Using the response Res received from the decryption history storage server, the value W of g _ID ^r is determined according to the predetermined method 2 corresponding to the predetermined method 2 and the predetermined method 4, and H (W) is obtained. A decryption unit that decrypts the ciphertext V according to the predetermined method 6 that is a method corresponding to the predetermined method 3 and decrypts it into the plaintext M ′;
With
The decryption history storage server
A proxy recording unit that records the proxy calculation secret key K ₃ in association with the receiving device identification information R _ID ;
A session information storage unit that records session information U and ciphertext identification information v received from the transmission device in association with each other;
Receiving device identification information received from the receiving device by acquiring session information U associated with the ciphertext identifying information v recorded in the session information storage unit that matches the ciphertext identifying information v received from the receiving device. A proxy calculation secret key K ₃ associated with the receiving device identification information R _ID recorded in the proxy recording unit that matches the R _ID is acquired, and the predetermined method 1, the predetermined method 2, and the predetermined A response creation unit that calculates a response Res by performing calculation using the session information U and the proxy calculation secret key K ₃ according to a predetermined method 7 that is a method corresponding to the method 4;
A response transmitter for transmitting the response Res to the receiving device;
When the response Res is transmitted to the receiving device, the history storage unit records the ciphertext identification information v, the receiving device identification information R _ID, and the time in association with each other,
An encryption system comprising: The encryption system according to claim 1,
In the predetermined method 2,
The protection secret key K ₂ is selected from an integer between 0 and p−1, and the proxy calculation secret key K ₃ is selected according to the predetermined method 2 ′ using the split random number K ₃ ′ and the protection secret key K _2. Seeking
The decryption recording unit also records a protective secret key K ₂ ,
The predetermined method 5 is a method corresponding to the predetermined method 2 ′, and the value W is obtained using the protective secret key K _{2 as} well. The encryption system according to claim 1,
(+) Is a symbol indicating a bitwise exclusive OR, ^ is a symbol indicating a power,
In the predetermined method 1, the reception private key K ₁ is set as K ₁ = K ₃ 'K ₀
Asking,
Wherein the predetermined method 2, the proxy calculation secret key _{K 3 K 3 = K 3 '} -1
Asking,
In the predetermined method 3, the ciphertext V is changed to V = M (+) H (g _ID ^r )
Asking,
In the predetermined method 4, the request creation unit selects a random number r _tmp from an integer of 0 to p−1 and sets a concealment key K _tmp as K _tmp = r _tmp K ₁
And request Req as information including the concealment key K _tmp ,
In the predetermined method 5, the value W is set to W = Res ^ r _tmp ⁻¹
Asking,
In the predetermined method 6, the plaintext M ′ is changed to M ′ = V (+) H (W)
Asking,
In the predetermined method 7, the response Res is Res = e (K _tmp , U) ^ K _3.
An encryption system characterized by The encryption system according to claim 2, wherein
(+) Is a symbol indicating a bitwise exclusive OR, ^ is a symbol indicating a power,
In the predetermined method 1, the reception private key K ₁ is set as K ₁ = K ₃ 'K ₀
Asking,
In the predetermined method 2 ′, the proxy calculation private key K _{3 is set} to K ₃ = (K ₂ K ₃ ′) ^−1.
Asking,
In the predetermined method 3, the ciphertext V is changed to V = M (+) H (g _ID ^r )
Asking,
In the predetermined method 4, the request creation unit selects a random number r _tmp from an integer of 0 to p−1 and sets a concealment key K _tmp as K _tmp = r _tmp K ₁
And request Req as information including the concealment key K _tmp ,
In the predetermined method 5, the value W is changed to W = Res ^ r _tmp ⁻¹ K _2.
Asking,
In the predetermined method 6, the plaintext M ′ is changed to M ′ = V (+) H (W)
Asking,
In the predetermined method 7, the response Res is Res = e (K _tmp , U) ^ K _3.
An encryption system characterized by The encryption system according to any one of claims 1 to 4,
‖ Is a symbol indicating a combination of bit strings, H ′ is a symbol indicating a hash function for obtaining a hash value for the bit strings,
The decryption history storage server
An authentication key A and a random number a that is an integer between 0 and p−1 are generated, and an encrypted authentication key V ′ is obtained by encrypting the authentication key A by a predetermined method 3 ′ using H (g _ID ^a ). , U ′ = aP, and calculates the session information U ′ and sends only the encrypted authentication key V ′ or the encrypted authentication key V ′ and the session information U ′ to the receiving device; ,
A challenge generator for generating challenge B and transmitting it to the receiving device;
The receiving device further includes a second request creating unit that creates a request Req ′ by a predetermined method 4 ′ using the reception secret key K ₁ ;
Using the response Res ′ received from the decryption history storage server, ^a value W of g _ID ^a is obtained according to a predetermined method 5 ′ that is a method corresponding to the predetermined method 2 and the predetermined method 4 ′, and H ( A second decryption unit that decrypts the encrypted authentication key V ′ into the authentication key A ′ according to a predetermined method 6 ′ that is a method corresponding to the predetermined method 3 ′ using W);
A hash value calculation unit that obtains a hash value D ′ as D ′ = H ′ (A′‖B) and transmits the hash value D ′ to the decryption history storage server,
The decryption history storage server further includes the session information U ′ and the proxy calculation secret according to a predetermined method 7 ′ that is a method corresponding to the predetermined method 1, the predetermined method 2, and the predetermined method 4 ′. A second response creation unit for calculating a response Res ′ by performing a calculation using the key K ₃ ;
An encryption system comprising: an authentication unit that obtains a hash value D as D = H ′ (A‖B) and confirms that D = D ′. A decoding method using a transmission device, a reception device, and a decoding history storage server,
p is a prime number, G ₁ is a cyclic addition group of order p, G ₂ is a cyclic group of order p, e is a bilinear pairing function that maps as G ₁ × G ₁ → G ₂ , and H is a group G A symbol indicating a hash function that maps an element of ₂ to an n-bit bit string, P is a generator of the group G ₁ , s is an integer of 0 to p−1, P _Pub = sP, (P, P _Pub ) is public parameter, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group _{G 1,} ID is arbitrary length bit _{string, Q ID = MaptoPoint G1 (ID} ), K 0 was determined as _K 0 = _{sQ ID} The secret key, K ₃ ′ is a random number for division selected from an integer between 0 and p−1, and K ₁ is for reception obtained by the predetermined method 1 using the secret key K ₀ and the random number for division K ₃ ′. secret key, K ₃ is representative calculation secret key obtained by a predetermined method 2 using the divided random number K _{3 ',} r is 0 Random number chosen from the upper p-1 an integer, U is U = session information obtained as _{rP, g ID} is _{g ID = e (Q ID,} P Pub) values were obtained as, V Is the ciphertext obtained by encrypting the plaintext M by the predetermined method 3 using H (g _ID ^r ), v is the ciphertext identification information for identifying the ciphertext V, and h is the ciphertext identification information for identifying the ciphertext V A symbol indicating the function to be generated,
The receiving device records the reception secret key K ₁ in the decryption recording unit,
The decryption history storage server records the proxy calculation secret key K ₃ in the proxy recording unit in association with the receiving device identification information R _ID ,
A ciphertext transmitting step in which the transmitting device transmits ciphertext V to at least the receiving device and transmits session information U and ciphertext identification information v to the decryption history storage server;
A session information storage step in which the decryption history storage server records the session information U received from the transmission device and the ciphertext identification information v in association with each other in a session information storage unit;
A request creating step in which the receiving device creates a request Req by a predetermined method 4 using the reception private key K ₁ ;
A request transmission step in which the receiving device transmits ciphertext identification information v satisfying the request Req, v = h (V), and receiving device identification information R _ID specifying the receiving device to the decryption history storage server;
The decryption history storage server acquires session information U associated with the ciphertext identification information v recorded in the session information storage unit that matches the ciphertext identification information v received from the receiving device, and the receiving device It said proxy recording unit acquires the proxy computing for the secret key K ₃ associated with the recorded received device identification information R _ID to the said predetermined method 1 given that matches the received device identification information R _ID received from A response creation step of calculating a response Res by performing calculation using the session information U and the proxy calculation private key K ₃ according to the predetermined method 7 corresponding to the method 2 and the predetermined method 4;
A response sending step in which the decryption history storage server sends the response Res to the receiving device;
A history accumulation step in which the decryption history accumulation server records the ciphertext identification information v, the reception device identification information R _ID, and the time in association with each other in the history accumulation unit;
The receiving device obtains a value W of g _ID ^r according to a predetermined method 5 that is a method corresponding to the predetermined method 2 and the predetermined method 4 using the response Res received from the decryption history storage server, A decrypting step of decrypting the ciphertext V according to a predetermined method 6 that is a method corresponding to the predetermined method 3 using H (W) and decrypting it into a plaintext M ′;
A decryption method. p is a prime number, G ₁ is cyclic addition group of order p, P is generator of the group G _1, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group G _1, ID is arbitrary length bit string, Q _ID = MaptoPoint _G1 (ID), K ₀ is a secret key obtained as K ₀ = sQ _ID , K ₃ ′ is a random number for division selected from integers of 0 to p−1, and K ₁ is a secret key The reception private key obtained by the predetermined method 1 using K ₀ and the dividing random number K ₃ ′, and K ₃ the proxy calculation private key obtained by the predetermined method 2 using the dividing random number K ₃ ′ , R is a random number selected from integers between 0 and p−1, U is session information obtained as U = rP, v is ciphertext identification information for identifying ciphertext V, and Req is a reception private key A request made by the predetermined method 4 using K ₁ ,
A proxy recording unit that records the proxy calculation secret key K ₃ in association with the receiving device identification information R _ID ;
A session information storage unit that records session information U and ciphertext identification information v received from the transmission device in association with each other;
The request Req, the ciphertext identification information v, and the reception device identification information R _ID are received from the receiving device, and the ciphertext identification information v recorded in the session information storage unit that matches the ciphertext identification information v received from the receiving device. The proxy information secret key K associated with the receiving device identification information R _ID recorded in the proxy recording unit that matches the receiving device identification information R _ID of the receiving device is obtained. ₃ and using the session information U and the proxy calculation private key K ₃ according to a predetermined method 7 corresponding to the predetermined method 1, the predetermined method 2 and the predetermined method 4. A response creation unit that calculates and obtains a response Res;
A response transmitter for transmitting the response Res to the receiving device;
When the response Res is transmitted to the receiving device, the history storage unit records the ciphertext identification information v, the receiving device identification information R _ID, and the time in association with each other,
A decryption history storage server comprising: p is a prime number, G ₁ is a cyclic addition group of order p, G ₂ is a cyclic group of order p, e is a bilinear pairing function that maps as G ₁ × G ₁ → G ₂ , and H is a group G A symbol indicating a hash function that maps an element of ₂ to an n-bit bit string, P is a generator of the group G ₁ , s is an integer of 0 to p−1, P _Pub = sP, (P, P _Pub ) is public parameter, MaptoPoint _G1 function which maps a bit string of arbitrary length to the original group _{G 1,} ID is arbitrary length bit _{string, Q ID = MaptoPoint G1 (ID} ), K 0 was determined as _K 0 = _{sQ ID} The secret key, K ₃ ′ is a random number for division selected from an integer between 0 and p−1, and K ₁ is for reception obtained by the predetermined method 1 using the secret key K ₀ and the random number for division K ₃ ′. secret key, K ₃ is representative calculation secret key obtained by a predetermined method 2 using the divided random number K _{3 ',} r is 0 Random number chosen from the upper p-1 an integer, U is U = session information obtained as _{rP, g ID} is _{g ID = e (Q ID,} P Pub) values were obtained as, V Is a ciphertext obtained by encrypting the plaintext M by the predetermined method 3 using H (g _ID ^r ), v is ciphertext identification information for identifying the ciphertext V,
A decryption recording unit for recording the reception private key K ₁ ;
A request creation unit that creates a request Req by a predetermined method 4 using the reception private key K ₁ ;
A request transmission unit that transmits the request Req, ciphertext identification information v, and reception device identification information R _ID to a decryption history storage server;
Obtained by performing a calculation using the session information U and the proxy calculation secret key K ₃ according to a predetermined method 7 corresponding to the predetermined method 1, the predetermined method 2 and the predetermined method 4. The response Res received is received from the decryption history storage server, and the value W of g _ID ^r is obtained using the response Res according to the predetermined method 2 that is a method corresponding to the predetermined method 2 and the predetermined method 4. A decryption unit that decrypts the ciphertext V according to a predetermined method 6 that is a method corresponding to the predetermined method 3 using H (W), and decrypts it into a plaintext M ′;
A receiving device. A transmission device included in the encryption system according to any one of claims 1 to 5,
An encryption unit for encrypting the plaintext M by the predetermined method 3 to obtain the ciphertext V;
A transmission apparatus comprising: a ciphertext transmission unit that transmits at least ciphertext V to a reception apparatus and transmits session information U and ciphertext identification information v to a decryption history storage server. A program for causing a computer to function as any one of the decoding history storage server according to claim 7, the receiving device according to claim 8, and the transmitting device according to claim 9.

Images