JP6000207B2 - ENCRYPTION SYSTEM, SYSTEM PARAMETER GENERATION DEVICE, ENCRYPTION DEVICE, DECRYPTION DEVICE, METHOD THEREOF, AND PROGRAM - Google Patents

Description

  The present invention relates to an encryption system using an ID-based encryption method, a system parameter generation device, an encryption device, a decryption device, a method thereof, and a program.

  Conventional public key security does not assume that the information of the private key is partially leaked. However, in recent years, due to the development of an attack method called a side channel attack, it is considered necessary to consider the security when a secret key is leaked (see Non-Patent Document 1).

  Non-Patent Document 2 is known as a safe (normal) public key cryptosystem even if a secret key is leaked. The configuration of Non-Patent Document 2 achieves security against CPA (Selected Plaintext) attacks even if the secret key is leaked.

  Selective security means that the security is guaranteed when no secret key information is leaked, and complete security means that the security is guaranteed even if part of the secret key information is leaked. That means. Thus, complete safety is guaranteed higher safety than selective safety.

  Secret key leakage resistance means that security is guaranteed even if part of the secret key information is leaked. Master secret key leakage resistance means that even if part of the master secret key is leaked Security of the individual secret key is guaranteed, even if a part of the individual secret key is leaked, the security (security of encryption using the individual secret key) is guaranteed. It is. Since the individual secret key can be generated from the master secret key, the master secret key leakage resistance is more secure than the individual secret key leakage resistance.

  Non-Patent Document 3 has proposed an ID-based encryption method having selective security and leakage resistance of individual secret keys.

  Non-Patent Document 4 has proposed an ID-based encryption method having selective security and leakage resistance of individual secret keys.

  Non-Patent Document 5 has proposed an ID-based encryption method having complete security and master secret key leakage resistance. However, this method is inefficient because it uses a pairing based on the combined number of orders. Note that Non-Patent Documents 3 and 4 are more efficient than the method of Non-Patent Document 5 because they use a pairing based on prime order.

JA Halderman, SD Schoen, N. Heninger, W. Clarkson, W. Paul, JA Calandrino, AJ Feldman, J. Appelbaum, and EW Felten, "Lest we remember: cold-boot attacks on encryption keys", Commun. ACM, 2009, vol. 52, no.5, pp. 91-98. A. Akavia, S. Goldwasser, and V. Vaikuntanathan, "Simultaneous Hardcore Bits and Cryptography against Memory Attacks", In TCC, Lecture Notes in Computer Science, Springer, 2009, volume 5444, pages 474-495. S. S. M. Chow, Y. Dodis, Y. Rouselakis, and B. Waters. "Practical leakage-resilient identity-based encryption from simple assumptions", In ACM Conference on Computer and Communications Security, ACM, 2010, pages 152-161. Z. Brakerski, Y. T. Kalai, J. Katz, and V. Vaikuntanathan. "Overcoming the Hole in the Bucket: Public-Key Cryptography Resilient to Continual Memory Leakage", In FOCS, IEEE Computer Society, 2010, pages501-510. A. B. Lewko, Y. Rouselakis, and B. Waters, "Achieving Leakage Resilience through Dual System Encryption", In TCC, Lecture Notes in Computer Science, Springer, 2011, volume 6597, pages 70-88.

  In the prior art, an ID-based encryption method with secret key leakage resistance is efficient, but only achieves selective security, and does not have master secret key leakage resistance. It was either leak-resistant but inefficient. FIG. 1 is a diagram for explaining an overview of non-patent documents 3 to 5 and the ID-based encryption method of the first embodiment.

  An object of the present invention is to provide an encryption system, a system parameter generation device, an encryption device, a decryption device, a method thereof, and a program that achieve complete security and at the same time achieve secret key leakage resistance and efficiency. To do.

In order to solve the above problems, according to a first aspect of the present invention, an encryption system includes a system parameter generation device that generates system parameters common to the entire system, and a cipher that generates ciphertext from information m. And a decryption device that decrypts the ciphertext. q is a prime number, F _q is a finite field of order q, N 'is a set of natural numbers, n∈N', V is a (3n + 2) -dimensional vector space on F _q , G _T is a cyclic group of order q , A is the standard basis of V, e is non-degenerate bilinear pairing of V × V → G _T , GL (3n + 2, F _q ) is a (3n + 2) -dimensional general linear group on F _q , subscript The subscript B ^ * represents B ^* , and the system parameter generator generates param _v : = (q, V, G _T , A, e) with the security parameters λ and 3n + 2 as inputs, random number ^{_{r → 0 ∈F q (n-}} 2) generates and η ^→ ₀ ∈F _q ^n, and generates a public key pk and the master secret key msk represented by the following formula.
pk: = (param _V , B ^, B ^ ^* ),
msk: = (1,0,0, r ^→ ₀ , 0 ⁿ , η ^→ ₀ , 0) _{B ^ *}
B ^: = (B ₀ , B ₁ ,…, B _n , B _{3n + 1} ), B ^ ^* : = (B ^* ₁ ,…, B ^* _n , B ^* _{2n + 1} ,…, B ^* _{3n + 1} ),

i ′ is any value of 0, 1,..., 3n + 1, random numbers ζ, ω, ψ∈F _q , ID (d) is the identifier on the decryption side, and the encryption device uses the public key pk. Then, ciphertext (c ₀ , C) is generated by encrypting the information m by the following equation.
C: = (ζ, ω, ω ・ ID (d), 0 ^n-2 , 0 ⁿ , 0 ⁿ , ψ) _B ,
c ₀ : = g _T ^ζ・ m
g _T : = e (B _{i '} , B ^* _i' )
Random numbers σ, η, r ′ _i ∈ F _q (i = 3,4,…, n), individual secret key

The decryption apparatus obtains the decryption result m ′ from the ciphertext (c ₀ , C) using the individual secret key sk _{ID (d)} by the following formula.
m ': = c ₀ (e (C, sk _{ID (d)} )) ^-1 .

In order to solve the above problems, according to another aspect of the present invention, a system parameter generation device generates system parameters common to the entire encryption system using an ID-based encryption scheme. q is a prime number, F _q is a finite field of order q, N 'is a set of natural numbers, n∈N', V is a (3n + 2) -dimensional vector space on F _q , G _T is a cyclic group of order q , A is the standard basis of V, e is non-degenerate bilinear pairing of V × V → G _T , GL (3n + 2, F _q ) is a (3n + 2) -dimensional general linear group on F _q , subscript The subscript B ^ * represents B ^* , receives the security parameters λ and 3n + 2, generates param _v : = (q, V, G _T , A, e), and generates a random number r ^→ ₀ ∈F _q ^(n-2) generates and η ^→ ₀ ∈F _q ^n, and generates a public key pk expressed by the following equation and the master secret key msk.
pk: = (param _V , B ^, B ^ ^* ),
msk: = (1,0,0, r ^→ ₀ , 0 ⁿ , η ^→ ₀ , 0) _{B ^ *}
B ^: = (B ₀ , B ₁ ,…, B _n , B _{3n + 1} ), B ^ ^* : = (B ^* ₁ ,…, B ^* _n , B ^* _{2n + 1} ,…, B ^* _{3n + 1} ),

In order to solve the above problem, according to another aspect of the present invention, an encryption device generates a ciphertext from information m in an encryption system using an ID-based encryption scheme. q is a prime number, F _q is a finite field of order q, N 'is a set of natural numbers, n∈N', V is a (3n + 2) -dimensional vector space on F _q , G _T is a cyclic group of order q , A is the standard basis of V, e is non-degenerate bilinear pairing of V × V → G _T , GL (3n + 2, F _q ) is a (3n + 2) -dimensional general linear group on F _q , subscript The subscript B ^ * is B ^* , param _v : = (q, V, G _T , A, e), random number r ^→ ₀ ∈F _q ^(n-2) , η ^→ ₀ ∈F _q ⁿ ,
pk: = (param _V , B ^, B ^ ^* ),
B ^: = (B ₀ , B ₁ ,…, B _n , B _{3n + 1} ), B ^ ^* : = (B ^* ₁ ,…, B ^* _n , B ^* _{2n + 1} ,…, B ^* _{3n + 1} ),

i ′ is a value of 0, 1,..., 3n + 1, random numbers ζ, ω, ψ∈F _q , ID (d) is an identifier on the decryption side, and public key pk is used to obtain information by Encrypts m to generate ciphertext (c ₀ , C).
C: = (ζ, ω, ω ・ ID (d), 0 ^n-2 , 0 ⁿ , 0 ⁿ , ψ) _B ,
c ₀ : = g _T ^ζ・ m
g _T : = e (B _{i ′} , B ^* _{i ′} ).

In order to solve the above problem, according to another aspect of the present invention, a decryption device decrypts a ciphertext in an encryption system using an ID-based encryption scheme. q is a prime number, F _q is a finite field of order q, N 'is a set of natural numbers, n∈N', V is a (3n + 2) -dimensional vector space on F _q , G _T is a cyclic group of order q , A is the standard basis of V, e is non-degenerate bilinear pairing of V × V → G _T , GL (3n + 2, F _q ) is a (3n + 2) -dimensional general linear group on F _q , subscript The subscript B ^ * is B ^* , param _v : = (q, V, G _T , A, e), random number r ^→ ₀ ∈F _q ^(n-2) , η ^→ ₀ ∈F _q ⁿ ,
pk: = (param _V , B ^, B ^ ^* ),
B ^: = (B ₀ , B ₁ ,…, B _n , B _{3n + 1} ), B ^ ^* : = (B ^* ₁ ,…, B ^* _n , B ^* _{2n + 1} ,…, B ^* _{3n + 1} ),

i ′ is any value of 0, 1,..., 3n + 1, random numbers ζ, ω, ψ∈F _q , ID (d) is an identifier on the decryption side, and ciphertext (c ₀ , C) is
C: = (ζ, ω, ω ・ ID (d), 0 ^n-2 , 0 ⁿ , 0 ⁿ , ψ) _B ,
c ₀ : = g _T ^ζ・ m
g _T : = e (B _{i '} , B ^* _i' )
And random numbers σ, η, r ′ _i ∈ F _q (i = 3,4,..., N), and individual secret key

And using the individual secret key sk _{ID (d)} , obtain the decryption result m ′ from the ciphertext (c ₀ , C) by the following equation:
m ': = c ₀ (e (C, sk _{ID (d)} )) ^-1
Random number ^{_{σ'∈F q, r '→ 0 ∈F}} q (n-2), η' → 0 ∈F q n, subscript B ^ * is assumed to represent the _{^{B *, sk 'ID (d}} ) : = sk _{ID (d)} + σ '・ ID (d) ・ B ^* ₁ -σ' ・ B ^* ₂ + (0,0,0, r ' ^→ ₀ , 0 ⁿ , η' ^→ ₀ , 0) _{B ^ *} was calculated, to update sk _'ID and _(d) as a new individual private key.

In order to solve the above problems, according to another aspect of the present invention, an encryption method includes a system parameter generation device that generates system parameters common to the entire system, and an encryption that generates ciphertext from information m. A device and a decryption device that decrypts a ciphertext are used. q is a prime number, F _q is a finite field of order q, N 'is a set of natural numbers, n∈N', V is a (3n + 2) -dimensional vector space on F _q , G _T is a cyclic group of order q , A is the standard basis of V, e is non-degenerate bilinear pairing of V × V → G _T , GL (3n + 2, F _q ) is a (3n + 2) -dimensional general linear group on F _q , subscript The subscript B ^ * represents B ^* , and the system parameter generator generates param _v : = (q, V, G _T , A, e) with the security parameters λ and 3n + 2 as inputs, Generating random numbers r ^→ ₀ ∈ F _q ^(n-2) and η ^→ ₀ ∈ F _q ^n, and generating a public key pk and a master secret key msk represented by the following expressions:
pk: = (param _V , B ^, B ^ ^* ),
msk: = (1,0,0, r ^→ ₀ , 0 ⁿ , η ^→ ₀ , 0) _{B ^ *}
B ^: = (B ₀ , B ₁ ,…, B _n , B _{3n + 1} ), B ^ ^* : = (B ^* ₁ ,…, B ^* _n , B ^* _{2n + 1} ,…, B ^* _{3n + 1} ),

i ′ is any value of 0, 1,..., 3n + 1, random numbers ζ, ω, ψ∈F _q , ID (d) is the identifier on the decryption side, and the encryption device uses the public key pk. A step of encrypting information m by the following formula to generate ciphertext (c ₀ , C);
C: = (ζ, ω, ω ・ ID (d), 0 ^n-2 , 0 ⁿ , 0 ⁿ , ψ) _B ,
c ₀ : = g _T ^ζ・ m
g _T : = e (B _{i '} , B ^* _i' )
Random numbers σ, η, r ′ _i ∈ F _q (i = 3,4,…, n), individual secret key

And the decryption device obtains the decryption result m ′ from the ciphertext (c ₀ , C) using the individual secret key sk _{ID (d)} by the following equation.
m ': = c ₀ (e (C, sk _{ID (d)} )) ^-1 .

According to the present invention, if the DLIN assumption (see Reference 1 and Reference 2) holds, complete security can be achieved, and secret key leakage resistance and efficiency can be achieved at the same time.
[Reference 1] T. Okamoto and K. Takashima, "Fully Secure Functional Encryption with General Relations from the Decisional Linear Assumption", In CRYPTO, Springer, 2010, volume 6223 of LNCS, pages 191-208.
[Reference 2] T. Okamoto and K. Takashima, "Adaptively Attribute-Hiding (Hierarchical) Inner Product Encryption", In EUROCRYPT, Lecture Notes in Computer Science, Springer, 2012, volume 7237, pages 591-608.

The figure for demonstrating the characteristic of a prior art and 1st embodiment. The layout of the encryption system of 1st embodiment. The figure which shows the processing flow of the encryption system of 1st embodiment. The functional block diagram of the system parameter generation apparatus of the encryption system of 1st embodiment. The functional block diagram of the transmitter of the encryption system of 1st embodiment. The functional block diagram of the receiver of the encryption system of 1st embodiment.

Hereinafter, embodiments of the present invention will be described. In the drawings used for the following description, constituent parts having the same function and steps for performing the same process are denoted by the same reference numerals, and redundant description is omitted. In the following explanation, the symbols “^”, “ ^→ ”, etc. used in the text should be described immediately above the character immediately before, but are described immediately after the character due to restrictions on text notation. . In the formula, these symbols are written in their original positions. Further, the processing performed for each element of a vector or matrix is applied to all elements of the vector or matrix unless otherwise specified.

<Outline of First Embodiment>
The notation used in this specification will be described below.

  λ represents a security parameter. For a finite set S,

This means that the element r is uniformly selected from the set S. For a probabilistic polynomial time algorithm A,

The algorithm A takes x as an input, operates using a random number, and indicates that a is output. If you want to operate using the random number r for the input x and explicitly output a, we will write a: = A (x; r) (see below for the symbol: =). When a: = b is written for a value a and b, it means that b is substituted for a or a is defined by b.

A finite field of order _q is written as F _q , and F _q ^× represents F _q \ {0}. A vector symbol is a vector representation on a finite field _Fq . For example, x ^→ represents (x ₁ , x ₂ ,..., X _n ) ∈F _q ⁿ . For two vectors x ^→ = (x ₁ , x ₂ ,…, x _n ) and v ^→ = (v ₁ , v ₂ ,…, v _n ), x ^→ · v ^→ and <x ^→ , v ^→ > Is inner product

Represents. Z ^T represents the transpose of the matrix Z. I _l represents a unit matrix of l × l (Roman L). When X∈V, X represents an element of the vector space V. When B _i ∈V (i = 1,…, n), span <B ₁ ,…, B _n > ⊆V (resp.span <x ^→ ₁ ,…, x ^→ _n >) is B ₁ ,…, It is a subspace generated by B _n (resp.x ^→ ₁ , ..., x ^→ _n ). Span <> represents a linear combination, and resp. Represents that each process is performed. For bases B: = (B ₁ ,…, B _N ) and B ^* : = (B ^* ₁ ,…, B ^* _N ),

And Vector e ^→ _j is the standard basis vector

It is. GL (n, F _q ) is an n-dimensional general linear group on F _q . The present embodiment uses the dual pairing vector space of Reference 1 and Reference 2. The details of the dual pairing vector space and the function encryption method related to the dual pairing vector space are described in Reference Document 1, Reference Document 2, and the like, and thus the description thereof is omitted here.

The symmetric pairing group (q, g, G, G _T , e) is a prime q, a cyclic additive group G of order q, a cyclic multiplicative group G of order q, a generator g of a cyclic multiplicative group G, polynomial time Non-degenerate bilinear pairing e: = G × G → G _T that can be calculated by: e (sg, tg) = e (g, g) ^st and e (g, g) ≠ 1.

Dual pairing vector spaces (hereinafter referred to as “DPVS”) (q, V, G _T , A, e) by symmetric pairing group (q, g, G, G _T , e) N-dimensional vector space on prime numbers q and F _q

Cyclic group G _T of order q, standard basis A of V: = (A ₁ ,…, A _N ), where

, And pairing e: is a set of V × V → G _T. Pairing is

It is. Where X: = (g ₁ ,..., G _N ) ∈V and Y: = (h ₁ ,..., H _N ) ∈V. This is a non-degenerate bilinear type. That is, if e (sX, tY) = e (X, Y) ^st and e (X, Y) = 1 for all Y∈V, X = 0. For all i and j, e (A _i , A _j ) = e (g, g) ^{δ_i, j} . However, the superscript δ_i, j represents δ _{i, j} , δ _{i, j} = 1 if i = j, and δ _{i, j} = 0 otherwise. Also, e (g, g) ≠ 1.

The DPVS generation algorithm G _dpvs takes 1 ^λ (λ∈N ′, where N ′ represents a set of natural numbers) and N∈N ′ as inputs, and params ′ _V : = (q, V, G _T , A, e). Where N is the dimension of V. The symmetrical pairing group (q, g, G, G _T , e) can be configured using BMSetup ().

  In the dual pairing vector space, a method for constructing a dual basis is as follows. At first

Produces the dual orthogonal basis

Is generated. However,

It is.

Due to the nature of DPVS:
(Pairing operation)
For DPVS element X, Y∈V,

Is established. Where X: = (x ₁ g,..., X _N g) and Y: = (y ₁ g,..., Y _N g). Here, X and Y can be expressed as coefficient vectors on the base A. That is, (x ₁ ,..., X _N ) _A = (x ^→ ) _A : = X and (y ₁ ,..., Y _N ) _A = (y ^→ ) _A : = Y.
(Base change)
Standard basis A is a uniform random regular matrix

Can be converted to the basis B of V: = (B ₁ ,..., B _N ). However,

It is. A can also be converted to the basis of V B ^* : = (B ^* ₁ , ..., B ^* _N ). Where (θ _{i, j} ): = (Z ^T ) ^-1 ,

It is. What should be noted here is that the following holds.
e (B _i , B ^* _j ) = e (g, g) ^{δ_i, j} (δ _{i, j} = 1 if i = j, and δ _{i, j} = 0 if i ≠ j),
That is, B and B ^* are dual orthogonal bases of V. Where X: = x ₁ B ₁ +… + x _N B _N ∈V and Y: = y ₁ B ^* ₁ +… + y _N B ^* _N ∈V can be expressed as coefficient vectors of bases B and B ^* is there. That is, (x ₁ ,…, x _N ) _B = (x ^→ ) _B : = X, (y ₁ ,…, y _N ) _{B ^ *} = (y ^→ ) _{B ^ *} : = Y (but subscript Subscript B ^ * represents B ^* ),

It is.

<Encryption system 1 according to the first embodiment>
The encryption system 1 which concerns on 1st embodiment is demonstrated using FIG.2 and FIG.3. The encryption system 1 includes a system parameter generation device 10, C transmission devices 20c, and D reception devices 30d. However, C and D are integers of 1 or more, and c = 1, 2,..., C, d = 1, 2,. The encryption system 1 uses an ID-based encryption method.

<Pre-processing>
The system parameter generation device 10 includes a parameter generation unit 11, a transmission unit 12, an individual secret key generation unit 13, an update unit 14, and a storage unit 15 (see FIG. 4).

  The parameter generation unit 11 generates system parameters common to the entire system (s11). For example, the parameter generation unit 11 receives the security parameter λεN ′ (as an input) and sets a symmetric pairing group

Is generated. Further, the parameter generation unit 11 receives N = 3n + 2 (where n∈N ′) (input) and receives the dual orthogonal basis.

Is generated. However,

It is. g _T : = e (B _{i ′} , B ^* _{i ′} ) (where the subscript i ′ is one of 0, 1,..., 3n + 1), B ^: = (B ₀ , B ₁ ,..., B _n , B _{3n + 1} ), B ^ ^* : = (B ^* ₁ ,..., B ^* _n , B ^* _{2n + 1} ,..., B ^* _{3n + 1} ). Generate random numbers r ^→ ₀ ∈ F _q ^(n-2) and η ^→ ₀ ∈ F _q ⁿ , and S ₁ : = (1,0,0, r ^→ ₀ , 0 ⁿ , η ^→ ₀ , 0) _{B ^ *} (Where the subscript B ^ * represents B ^* ). Here, the public key _{pk: = (param V, B} ^, B ^ *) user in the storage unit 15 is accessible stored as, the master secret key msk: = to manage the secret in the storage unit 15 as S ₁ .

  The transmission unit 12 transmits the generated system parameter (public key pk) to the user (s12).

Next, the individual secret key generation unit 13 generates an individual secret key sk _{ID (d)} for each receiving device 30d (s13).

For example, the individual secret key generation unit 13 extracts the master secret key msk from the storage unit 15, receives the identifier ID (d) sent from the receiving device 30d, and receives random numbers σ, η, r ′ _i εF _q (i KID _(d) is generated by the following formula using = 3,4, ..., n).

The identifier ID (d) may be an identifier on the decryption side, may be a decryption user identifier including a name and an email address, or may be a decryption receiving device identifier such as a mac address or a smartphone phone number. But you can.

The transmission unit 12 transmits the generated individual secret key sk _{ID (d)} : = K _{ID (d)} to the reception device 30d (s14).

<Encryption processing>
The transmission device 20c includes a random number generation unit 21, an encryption unit 22, and a transmission unit 23 (see FIG. 5). The transmitting device 20c receives the public key pk from the parameter generating device 10, receives the identifier ID (d ′) of the receiving device 30d ′ and the information m, generates a ciphertext of the information m, and outputs it. Note that d ′ is any one of 1, 2,..., D, and the transmission device is also referred to as an encryption device in the sense that encryption processing is performed.

  The random number generation unit 21 generates a random number (s21) and outputs it to the encryption unit 22.

  The encryption unit 22 receives the generated random number and generates a ciphertext (s22).

For example, for ciphertext generation, a random number ζ, ω, ψ∈F _q is selected to encrypt information m using the public key pk, and C: = (ζ, ω, ω · ID (d '), 0 ^n-2 , 0 ⁿ , 0 ⁿ , ψ) _B and c ₀ : = g _T ^ζ · m are generated, and the ciphertext is (c ₀ , C).

The transmitting unit 23 transmits the generated ciphertext (c ₀ , C) to the receiving device 30d ′ (s23).

<Decryption process>
The receiving device 30d includes a storage unit 31, a decoding unit 32, and an updating unit 33 (see FIG. 6). The receiving device 30d decrypts the ciphertext (c ₀ , C) using the individual secret key sk _{ID (d)} , and obtains a decryption result m ′ from the ciphertext (c ₀ , C).

For example, the receiving device 30d receives the ciphertext (c ₀ , C) from the transmitting device 20c and stores it in the storage unit 31 (s31).

Prior to use, the receiving device 30d receives the individual secret key sk _{ID (d)} from the system parameter generation device 10 and stores it in the storage unit 31 in a secret manner.

Decoding unit 32, after receiving the ciphertext (c _0, C), taken out to the storage unit 31 from the individual secret key sk _{ID (d),} the ciphertext using the individual secret key _{sk ID (d) (c 0} , C) is decrypted (s32). For example, for the decryption method, the decryption unit 32 receives the ciphertext (c ₀ , C) and the individual secret key sk _{ID (d)} and inputs m ′: = c ₀ (e (C, sk _{ID (d)} ) ) ^-1 is calculated and output as plain text (decryption result). The receiving device is also referred to as a decoding device in the sense that the decoding process is performed.

<Update process>
The update unit 14 of the system parameter generation device 10 updates the master secret key msk. When the master secret key msk information about the (part of the master secret key msk) is leaked, the update unit 14, the random number _{^{r '→ 0 ∈F q (n}} -2), η' a ^→ ₀ ∈F _q ⁿ generated, msk '= msk + (0,0,0 , r' → 0, 0 n, η '→ 0, 0) to calculate the _{B ^ *,} a new master secret key msk' and, in the storage unit 15 Remember. The updating unit 14 deletes the old master secret key msk from the storage unit 15.

  With such a configuration, it is possible to update the master secret key msk, achieve complete security, and achieve master secret key leakage resistance. Even if the master secret key is updated, it is not necessary to update the public key or the individual secret key, and efficient operation is possible.

The updating unit 33 of the receiving device 30d updates the individual secret key sk _{ID (d)} . Information about an individual secret key sk _{ID (d)} when (part of a separate secret key sk _{ID (d))} is leaked, the random number ^{_{σ'∈F q, r '→ 0 ∈F}} q (n-2), η ' ^→ ₀ ∈ F _q ⁿ is generated and sk' _{ID (d)} : = sk _{ID (d)} + σ '・ ID (d) ・ B ^* ₁ -σ' ・ B ^* ₂ + (0,0, _{^{0, r '→ 0, 0}} n, η' → 0, 0) to calculate the _{B ^ *,} a new individual secret key sk _{'ID (d).} The updating unit 33 deletes the old individual secret key sk ′ _{ID (d)} .

With this configuration, it is possible to update the individual secret key sk ′ _{ID (d)} , achieve complete security, and achieve individual secret key leakage resistance. Even if the individual secret key is updated, it is not necessary to update the public key, the individual secret key of another receiving device, or the master secret key, and efficient operation is possible. Further, since the individual secret key can be updated on the receiving device 30d side, the processing of the system parameter generating device 10 can be reduced.

<Effect>
With such a configuration, complete security can be achieved, and secret key leakage resistance and efficiency can be achieved at the same time.

<Modification>
The transmission device may be configured to have a decryption processing function in addition to the encryption processing function. Similarly, the receiving device may be configured to have an encryption processing function in addition to the decryption processing function. Further, the system parameter generation device may be configured to have an encryption processing function and a decryption processing function in addition to the pre-processing function.

  The individual secret key generation unit is not necessarily provided in the system parameter generation device, but may be provided in the reception device. In that case, the system parameter generation device secretly transmits the generated secret key to the reception device.

  The present invention is not limited to the above-described embodiments and modifications. For example, the various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. In addition, it can change suitably in the range which does not deviate from the meaning of this invention.

<Program and recording medium>
In addition, various processing functions in each device described in the above embodiments and modifications may be realized by a computer. In that case, the processing contents of the functions that each device should have are described by a program. Then, by executing this program on a computer, various processing functions in each of the above devices are realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Further, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its storage unit. When executing the process, this computer reads the program stored in its own storage unit and executes the process according to the read program. As another embodiment of this program, a computer may read a program directly from a portable recording medium and execute processing according to the program. Further, each time a program is transferred from the server computer to the computer, processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program includes information provided for processing by the electronic computer and equivalent to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In addition, although each device is configured by executing a predetermined program on a computer, at least a part of these processing contents may be realized by hardware.

Claims (8)

An encryption system including a system parameter generation device that generates system parameters common to the entire system, an encryption device that generates ciphertext from information m, and a decryption device that decrypts ciphertext,
q is a prime number, F _q is a finite field of order q, N 'is a set of natural numbers, n∈N', V is a (3n + 2) -dimensional vector space on F _q , G _T is a cyclic group of order q , A is the standard basis of V, e is non-degenerate bilinear pairing of V × V → G _T , GL (3n + 2, F _q ) is a (3n + 2) -dimensional general linear group on F _q , subscript The subscript B ^ * represents B ^* , and the system parameter generator generates param _v : = (q, V, G _T , A, e) with the security parameters λ and 3n + 2 as inputs. , Generate a random number r ^→ ₀ ∈ F _q ^(n-2) and η ^→ ₀ ∈ F _q ^n, and generate a public key pk and a master secret key msk represented by the following equations:
pk: = (param _V , B ^, B ^ ^* ),
msk: = (1,0,0, r ^→ ₀ , 0 ⁿ , η ^→ ₀ , 0) _{B ^ *}
B ^: = (B ₁ , B ₂ ,…, B _n , B _{3n + 2} ), B ^ ^* : = (B ^* ₂ ,…, B ^* _{n +1} , B ^* _{2n + 2} ,…, B ^* _{3n + 2} ),

i ′ is any one of 1, 2,..., 3n + 2 , random numbers ζ, ω, ψ∈F _q , ID (d) is an identifier on the decryption side, and the encryption device uses the public key pk And encrypting the information m by the following formula to generate a ciphertext (c ₀ , C),
C: = (ζ, ω, ω ・ ID (d), 0 ^n-2 , 0 ⁿ , 0 ⁿ , ψ) _B ,
c ₀ : = g _T ^ζ・ m
g _T : = e (B _{i '} , B ^* _i' )
Random numbers σ, η, r ' _i ∈ F _q (i = 4, 5, ..., n + 1 ), individual secret key

And the decryption device obtains the decryption result m ′ from the ciphertext (c ₀ , C) using the individual secret key sk _{ID (d) according} to the following equation:
m ': = c ₀ (e (C, sk _{ID (d)} )) ^-1
Encryption system. The encryption system of claim 1, comprising:
Random number ^{_{r '→ 0 ∈F q (n}} -2), η' and ^→ ₀ ∈F _q ^n, the system parameter generation apparatus, msk '= msk + (0,0,0 , r' → 0, 0 n, η ' ^→ ₀ , 0) _{B ^ *} and update msk' as the new master secret key,
Encryption system. A system parameter generation device that generates system parameters common to the entire encryption system using an ID-based encryption method,
q is a prime number, F _q is a finite field of order q, N 'is a set of natural numbers, n∈N', V is a (3n + 2) -dimensional vector space on F _q , G _T is a cyclic group of order q , A is the standard basis of V, e is non-degenerate bilinear pairing of V × V → G _T , GL (3n + 2, F _q ) is a (3n + 2) -dimensional general linear group on F _q , subscript The subscript B ^ * represents B ^* , receives the security parameters λ and 3n + 2, generates param _v : = (q, V, G _T , A, e), and generates a random number r ^→ ₀ ∈F _q ^(n-2) and η ^→ ₀ ∈ F _q ⁿ are generated, and a public key pk and a master secret key msk represented by the following equations are generated:
pk: = (param _V , B ^, B ^ ^* ),
msk: = (1,0,0, r ^→ ₀ , 0 ⁿ , η ^→ ₀ , 0) _{B ^ *}
B ^: = (B ₁ , B ₂ ,…, B _n , B _{3n + 2} ), B ^ ^* : = (B ^* ₂ ,…, B ^* _{n +1} , B ^* _{2n + 2} ,…, B ^* _{3n + 2} ),

System parameter generator. The system parameter generation device according to claim 3, wherein
Random number _{^{r '→ 0 ∈F q (n}} -2), η' and _{^{→ 0 ∈F q n, msk '}} = msk + (0,0,0, r' → 0, 0 n, η '→ 0, 0) Calculate _{B ^ *} and update msk 'as the new master secret key,
System parameter generator. In an encryption system using an ID-based encryption method, an encryption device that generates ciphertext from information m,
q is a prime number, F _q is a finite field of order q, N 'is a set of natural numbers, n∈N', V is a (3n + 2) -dimensional vector space on F _q , G _T is a cyclic group of order q , A is the standard basis of V, e is non-degenerate bilinear pairing of V × V → G _T , GL (3n + 2, F _q ) is a (3n + 2) -dimensional general linear group on F _q , subscript Subscript B ^ * is B ^* , param _v : = (q, V, G _T , A, e), random number r ^→ ₀ ∈ F _q ^(n-2) , η ^→ ₀ ∈ F _q ⁿ , pk: = (param _V , B ^, B ^ ^* ),
B ^: = (B ₁ , B ₂ ,…, B _n , B _{3n + 2} ), B ^ ^* : = (B ^* ₂ ,…, B ^* _{n +1} , B ^* _{2n + 2} ,…, B ^* _{3n + 2} ),

i ′ is any one of 1, 2,..., 3n + 2 , random numbers ζ, ω, ψ∈F _q , ID (d) is an identifier on the decryption side, and public key pk is used to obtain information by Encrypt m to generate ciphertext (c ₀ , C),
C: = (ζ, ω, ω ・ ID (d), 0 ^n-2 , 0 ⁿ , 0 ⁿ , ψ) _B ,
c ₀ : = g _T ^ζ・ m
g _T : = e (B _{i '} , B ^* _i' )
Encryption device. In an encryption system using an ID-based encryption method, a decryption device for decrypting ciphertext,
q is a prime number, F _q is a finite field of order q, N 'is a set of natural numbers, n∈N', V is a (3n + 2) -dimensional vector space on F _q , G _T is a cyclic group of order q , A is the standard basis of V, e is non-degenerate bilinear pairing of V × V → G _T , GL (3n + 2, F _q ) is a (3n + 2) -dimensional general linear group on F _q , subscript The subscript B ^ * is B ^* , param _v : = (q, V, G _T , A, e), random number r ^→ ₀ ∈F _q ^(n-2) , η ^→ ₀ ∈F _q ⁿ ,
pk: = (param _V , B ^, B ^ ^* ),
B ^: = (B ₁ , B ₂ ,…, B _n , B _{3n + 2} ), B ^ ^* : = (B ^* ₂ ,…, B ^* _{n +1} , B ^* _{2n + 2} ,…, B ^* _{3n + 2} ),

i ′ is any one of 1, 2,..., 3n + 2 , random numbers ζ, ω, ψ∈F _q , ID (d) is an identifier on the decryption side, and ciphertext (c ₀ , C) is
C: = (ζ, ω, ω ・ ID (d), 0 ^n-2 , 0 ⁿ , 0 ⁿ , ψ) _B ,
c ₀ : = g _T ^ζ・ m
g _T : = e (B _{i '} , B ^* _i' )
And random numbers σ, η, r ′ _i ∈ F _q (i = 4, 5,..., N + 1 ), and the individual secret key

And using the individual secret key sk _{ID (d)} , obtain the decryption result m ′ from the ciphertext (c ₀ , C) by the following equation:
m ': = c ₀ (e (C, sk _{ID (d)} )) ^-1
Random number ^{_{σ'∈F q, r '→ 0 ∈F}} q (n-2), η' → 0 ∈F q n, subscript B ^ * is assumed to represent the _{^{B *, sk 'ID (d}} ) : = sk _{ID (d)} + σ '・ ID (d) ・ B ^* ₁ -σ' ・ B ^* ₂ + (0,0,0, r ' ^→ ₀ , 0 ⁿ , η' ^→ ₀ , 0) _{B ^ *} was calculated, to update sk _'ID and _(d) as a new individual private key,
Decoding device. An encryption method using a system parameter generation device that generates system parameters common to the entire system, an encryption device that generates ciphertext from information m, and a decryption device that decrypts ciphertext,
q is a prime number, F _q is a finite field of order q, N 'is a set of natural numbers, n∈N', V is a (3n + 2) -dimensional vector space on F _q , G _T is a cyclic group of order q , A is the standard basis of V, e is non-degenerate bilinear pairing of V × V → G _T , GL (3n + 2, F _q ) is a (3n + 2) -dimensional general linear group on F _q , subscript The subscript B ^ * represents B ^* , and the system parameter generator generates param _v : = (q, V, G _T , A, e) with the security parameters λ and 3n + 2 as inputs. Generating random numbers r ^→ ₀ ∈ F _q ^(n-2) and η ^→ ₀ ∈ F _q ^n, and generating a public key pk and a master secret key msk represented by the following equations:
pk: = (param _V , B ^, B ^ ^* ),
msk: = (1,0,0, r ^→ ₀ , 0 ⁿ , η ^→ ₀ , 0) _{B ^ *}
B ^: = (B ₁ , B ₂ ,…, B _n , B _{3n + 2} ), B ^ ^* : = (B ^* ₂ ,…, B ^* _{n +1} , B ^* _{2n + 2} ,…, B ^* _{3n + 2} ),

i ′ is any one of 1, 2,..., 3n + 2 , random numbers ζ, ω, ψ∈F _q , ID (d) is an identifier on the decryption side, and the encryption device uses the public key pk And encrypting the information m by the following formula to generate a ciphertext (c ₀ , C);
C: = (ζ, ω, ω ・ ID (d), 0 ^n-2 , 0 ⁿ , 0 ⁿ , ψ) _B ,
c ₀ : = g _T ^ζ・ m
g _T : = e (B _{i '} , B ^* _i' )
Random numbers σ, η, r ' _i ∈ F _q (i = 4, 5, ..., n + 1 ), individual secret key

And the decryption device includes the step of obtaining the decryption result m ′ from the ciphertext (c ₀ , C) using the individual secret key sk _{ID (d) according} to the following equation:
m ': = c ₀ (e (C, sk _{ID (d)} )) ^-1
Encryption method. A program for causing a computer to function as any one of the system parameter generation device according to claim 3, the encryption device according to claim 5, and the decryption device according to claim 6.

Images