JP6095057B2 - SEARCH SYSTEM, SEARCH METHOD, AND SEARCH PROGRAM - Google Patents

Description

  The present invention relates to a search system, a search method, and a search program, and in particular, a search system, a search method, and a search system capable of not only detecting server fraud in keyword search but also updating (including deleting) files. , Related to search program.

  As is well known in this technical field, in data storage (data storage) services such as Yahoo! Data Box, user terminals store and store many files such as photos on a server (such as Yahoo! Data Box). can do. The user terminal can also perform a keyword search for the file name and acquire a desired set of files from the server. The user terminal is also called a client.

  On the other hand, Non-Patent Document 1 discloses an encrypted search method that conceals content from a server when searching for files and keywords. This encrypted search method is a method for encrypting files and keywords.

  On the other hand, a malicious server or a virus-contaminated server does not return all the corresponding files correctly when searching for keywords, but deletes, adds, alters, or replaces some of the files. It is possible to cheat.

  In response to this problem, Non-Patent Document 1 discloses a search system in which a user terminal can detect file deletion, addition, and alteration. Hereinafter, the search system disclosed in Non-Patent Document 1 will be referred to as a “first preceding search system”. However, in the first preceding search system disclosed in Non-Patent Document 1, it is not possible to detect file replacement as a server fraud.

  Therefore, the present inventors have already provided a search system that can detect not only file deletion, addition, and alteration as well as file replacement as a server fraud (Non-Patent Document 2). Hereinafter, the search system disclosed in Non-Patent Document 2 will be referred to as a “second preceding search system”. However, in the second preceding search system disclosed in Non-Patent Document 2, when a file is updated (including deletion), the verification information in the index is stored for all keywords included in the file to be updated (deleted). Must be changed. As a result, there is a problem that the amount of communication is large and becomes inefficient.

  On the other hand, Non-Patent Document 3 discloses a search system that can easily update a file. Hereinafter, the search system disclosed in Non-Patent Document 3 will be referred to as a “third preceding search system”. However, the third preceding search system disclosed in Non-Patent Document 3 cannot detect server fraud.

Y. Chang and M. Mitzenmacher, “Privacy Preserving Keyword Searches on Remote Encrypted Data”, ACNS 2005: pp. 442-455 (2005) Kaoru Kurosawa and Yasuhiro Ohtaki, “UC-Secure Searchable Symmetric Encryption”, Financial Cryptography 2012: pp. 285-298 Seny Kamara, Charalampos Papamanthou, and Tom Roeder, “Dynamic Searchable Symmetric Encryption”, ACM Conference on Computer and Communications Security 2012: pp. 965-976

  As described above, in the first preceding search system disclosed in Non-Patent Document 1, it is not possible to detect file replacement as a server fraud.

  On the other hand, the second prior search system disclosed in Non-Patent Document 2 can detect server fraud (deletion, addition, falsification, replacement), but cannot efficiently update (delete) the file.

  Furthermore, in the third preceding search system disclosed in Non-Patent Document 3, the file can be updated easily, but the file fraud cannot be detected.

  Therefore, an object of the present invention is to provide a search system, a search method, and a search program capable of detecting server fraud (deletion, addition, falsification, replacement) of a server and efficiently updating (deleting) a file. There is.

  Another object of the present invention is to provide a search system, a search method, and a search program capable of detecting a replay attack.

  In the search system according to the first aspect of the present invention, the user terminal stores a plurality of files in the server, the user terminal acquires a set of desired files from the server by keyword search, and includes update (deletion of files) ), And the user terminal stores a plurality of files together with their file numbers in a server; an index that is a correspondence table between keywords and file numbers of files corresponding to the keywords Index verification information is generated according to a predetermined generation algorithm for a generation set of a keyword and a set of file numbers of all files including the keyword, and the generated index verification An index verification information generator that stores information on the server; and sends search keywords to the server to A file acquisition means for acquiring a file including a search keyword from the file and a set of file numbers of the file and index verification information corresponding to the search keyword; the acquired index verification information is a search keyword and the file number of the acquired file; An index verification unit that checks whether or not it is index verification information of a verification pair with a set of a group, and approves if the result of the check is correct, and rejects otherwise; updates (deletes) Updating means for sending the file to be updated together with the file number to the server.

  In the search system according to the second aspect of the present invention, the user terminal stores a plurality of encrypted files in the server, the user terminal acquires a set of desired files from the server by keyword search, and updates (deletes) the encrypted file. The user terminal encrypts a plurality of files using an encryption private key, and stores the plurality of encrypted files together with the file numbers of the encrypted files on the server. The index, which is a correspondence table between the storage means and the keyword and the file number of the file corresponding to the keyword, is encrypted using a predetermined secret key, and the ciphertext of the keyword and the ciphertext of the file number of the file containing the keyword An encrypted index storage means for storing an encrypted index comprising: a keyword and a keyword An index verification information generating unit that generates index verification information according to a predetermined generation algorithm for a generation set with a set of file numbers of all files including a file, and stores the generated index verification information in a server; An encryption search keyword obtained by encrypting the search keyword using the secret key of the server is sent to the server, and the server includes the encryption file including the encryption search keyword, a set of file numbers of the encryption file, and index verification information corresponding to the search keyword An encrypted file acquisition means for acquiring the index verification information, and whether or not the acquired index verification information is index verification information of a verification set of a search keyword and a set of file numbers of the acquired encrypted files by a predetermined verification algorithm An index verification unit that checks and approves if the check result is correct, and rejects otherwise. Equipped with a; update obtained by encrypted using a secret key encryption (Delete) should do file, update the (deletion) should do encryption file together with the file number and updating means for updating is sent to the server.

  In the present invention, index verification information is generated according to a predetermined algorithm for a generation set of a keyword and a set of file numbers of all files (encrypted files) including the keyword, and the generated index verification information is stored in a server. Since it is stored, it not only detects server fraud (deletion, addition, falsification, replacement), but also sends the file (encrypted file) to be updated (deleted) along with its file number to the server. The file can be updated (deleted) efficiently.

It is a block diagram which shows the structure of the storage phase and search phase of the search system which concerns on 1st Example of this invention. It is a figure which shows one specific example of the index used for the search system shown in FIG. It is a flowchart for demonstrating operation | movement of the index verification information generation part of a client used for the search system shown in FIG. It is a figure which shows an example of an operation | movement of the index verification information generation part shown in FIG. It is a flowchart for demonstrating operation | movement of the file accumulation value calculation part of a client used for the search system shown in FIG. It is a figure which shows an example of an operation | movement of the file accumulation value calculation part shown in FIG. It is a flowchart for demonstrating operation | movement of the index verification part of a client used for the search system shown in FIG. It is a figure which shows an example of an operation | movement of the index verification part shown in FIG. It is a flowchart for demonstrating operation | movement of the file verification information generation part of a server used for the search system shown in FIG. It is a figure which shows an example of an operation | movement of the file verification information generation part shown in FIG. It is a flowchart for demonstrating operation | movement of the file verification part of a client used for the search system shown in FIG. It is a figure which shows an example of an operation | movement of the file verification part shown in FIG. It is a block diagram which shows the structure of the update phase of the search system which concerns on 1st Example of this invention. It is a flowchart for demonstrating operation | movement of the Acc update part of a client used for the search system shown in FIG. It is a block diagram which shows the structure of the storage phase and search phase of the search system which concern on 2nd Example of this invention. It is a flowchart for demonstrating operation | movement of the index encryption part of a client used for the search system shown in FIG. It is a figure which shows an example of an operation | movement of the index encryption part shown in FIG. It is a flowchart for demonstrating operation | movement of the file accumulation value calculation part of a client used for the search system shown in FIG. It is a figure which shows an example of an operation | movement of the file accumulation value calculation part shown in FIG. It is a flowchart for demonstrating operation | movement of the keyword encryption part of a client used for the search system shown in FIG. FIG. 21 is a diagram showing a specific example of the operation of the keyword encryption unit shown in FIG. 20. It is a flowchart for demonstrating operation | movement of the encryption search part of a server used for the search system shown in FIG. FIG. 23 is a diagram illustrating a specific example of the operation of the cryptographic search unit illustrated in FIG. 22. It is a flowchart for demonstrating operation | movement of the file verification information generation part of a server used for the search system shown in FIG. FIG. 25 is a diagram illustrating a specific example of the operation of the file verification information generation unit illustrated in FIG. 24. It is a flowchart for demonstrating operation | movement of the file verification part of a client used for the search system shown in FIG. FIG. 27 is a diagram illustrating a specific example of the operation of the file verification unit illustrated in FIG. 26. It is a block diagram which shows the structure of the update phase of the search system which concerns on 2nd Example of this invention. It is a flowchart for demonstrating operation | movement of the Acc update part of a client used for the search system shown in FIG.

[Overview]
Hereinafter, an outline of an embodiment of the present invention will be described.

  The search system according to the embodiment of the present invention not only detects server fraud (“deletion”, “addition”, “falsification”, “replacement” of files) in keyword search, but also updates (including deletion) files. It is a search system that can efficiently.

  The search system according to the present embodiment can be applied to both a case where a file is encrypted and a case where a file is not encrypted. As is well known in this technical field, the message authentication function includes a case where a digital signature is used and a case where an authenticator is generated using a message authentication code (Message Authentication Code, MAC). The digital signature and the authenticator are collectively referred to as verification information.

  In general, the verification information is generated by a predetermined generation algorithm and verified (checked) by the predetermined verification algorithm. When the verification information is a digital signature, the predetermined generation algorithm is a signature generation algorithm, and the predetermined verification algorithm is a signature verification algorithm. On the other hand, when the verification information is an authenticator, the predetermined generation algorithm is a MAC generation algorithm, and the predetermined verification algorithm is a MAC verification algorithm.

  The search system according to the present embodiment is divided into the following first and second embodiments.

  The search system according to the first embodiment of the present invention is a search system in which a user terminal stores a file in a server without encryption and also updates (including deletion) the file.

  In the search system according to the first embodiment, a user terminal generates index verification information according to a predetermined algorithm for a generation set of a keyword and a set of file numbers of all files including the keyword, The index verification information is stored on the server. This not only detects server fraud (deletion, addition, falsification, replacement), but also sends the file to be updated (deleted) to the server along with its file number. Can be done efficiently.

  The search system according to the second embodiment of the present invention is a search system in which a user terminal encrypts a file and a keyword and stores them in a server, and also updates (deletes) the encrypted file.

  In the search system according to the second embodiment, the user terminal generates index verification information according to a predetermined algorithm for a generation set of a keyword and a set of file numbers of all files including the keyword, and the generation The index verification information is stored on the server. As a result, not only the server's fraud (deletion, addition, falsification, replacement), but also the encryption file to be updated (deletion) can be updated (deletion) by sending it to the server along with its file number. ) Can also be performed efficiently.

  The operation of the search system includes a “storage phase” in which the user terminal stores the file (encrypted file) in the server, a “search phase” in which the user terminal searches for a desired file from the server, and the user terminal in the file (encrypted file). It is divided into “update phase” in which (file) is updated (including deletion).

  Further, “replay attack” is known as a problem specific to file update. Here, replay attack means that an unauthorized server returns an old file instead of an updated new file.

  In the embodiments of the present invention described later, this “replay attack” is solved by using an RSA (Rivest-Shamir-Adleman) accumulator.

  Therefore, in order to facilitate understanding of the embodiments of the present invention, an outline of the RSA accumulator will be described below.

  p = 2p ′ + 1 and q = 2q ′ + 1 are prime numbers. However, p ′ and q ′ are also prime numbers, and pq is 3λ bits. Let N = pq.

In mod N, let g be the element whose order is p'q '. That is,
g ^{p'q '} = 1 mod N
It is.

A positive integer a of 3λ bits is selected at random.
For a positive integer x of 3λ bits, h _a (x) is
Defined as lower λ bits of h _a (x) = a × x The multiplication x is multiplication on a finite field (or Galois field) GF (2 ^3λ ).

At this time, for an arbitrary y of λ bits,
h _a (x) = y
The prime number x of 3λ bits can be obtained efficiently.
Such a prime number x is written prime (y).

A set of y _i of λ bits is assumed to be E = {y ₁ ,..., y _n } (1 ≦ i ≦ n).

Alice is the accumulated value of E Acc (E) = g ^{prime (y1) ×... * Prime (yn)} mod N
To Bob.

When we want to prove y _i ∈E, Alice has prime (y _j ) and
π = g ^{Πi ≠ j prime (yi)} mod N
And sent to Bob.

Bob
Acc (E) = (π) ^{prime (yj)} mod N
Check if is true.

Assume that strong RSA assumptions hold.
When public information N, g, set _E = the _{h a} and λ bits of _{y i {y 1, ···,} y n} is given,
Acc (E) = (π) ^{prime (y)} mod N
It is difficult to find y and π that do not belong to E that satisfy.

  With reference to FIG. 1, a storage phase and a search phase of the search system 100 according to the first embodiment of the present invention will be described. FIG. 1 is a block diagram of a storage phase and a search phase of the search system 100 according to the first embodiment of the present invention. The illustrated search system 100 is a verification system corresponding to the above-described search system according to the first embodiment of the present invention. The search system 100 includes a client 200 and a server 300. The client 200 is also called a user terminal.

  The illustrated search system 100 is a system in which a client (user terminal) 200 stores a plurality of files in a server 300, and the client (user terminal) 200 acquires a set of desired files from the server 300 by keyword search.

  A block diagram of an update phase in which the client (user terminal) 200 updates (including deletion) a file stored in the server 300 will be described later with reference to FIG.

  The client 200 includes a key generation unit 202, a key holding unit 204, an index verification information generation unit 206, an index verification unit 208, first to third signal lines (transmission lines) 210, 212, and 214, a file The accumulated value calculation unit 216, the Acc holding unit 218, and the file verification unit 220 are configured.

  On the other hand, the server 300 includes a storage area 302, a search unit 304, a key holding unit 306, and a file verification information generation unit 308.

The key generation unit 202, the secret key K and secret information p for verification, q and the public information N, g, to generate a _{h a.} Key holding unit 204 of the client 200 stores the secret key K and secret information p for verification which are those generated, q and public information N, g, and h _a. Also, public information N, which is held in the key holding unit 204, g, _{h a} is sent to the key holding part 306 of the server 300. Therefore, the key holding unit 306 of the server 300 stores the public information N, g, and _{h a.}

  The client 200 transmits a plurality of files together with their file numbers to the server 300 via a first signal line (transmission line) 210. The server 300 stores the plurality of sent files in the storage area 302 together with their file numbers. Therefore, the first signal line (transmission line) 210 serves as a file storage unit that stores a plurality of files together with their file numbers in the server 300.

  In addition, the client 200 generates an index (described later), and transmits the generated index to the server 300 via the second signal line (transmission line) 212. The server 300 stores the sent index in the storage area 302. Therefore, the second signal line (transmission line) 212 serves as an index storage unit that stores the generated index in the server 300.

  FIG. 2 shows a specific example of the index. The index is a correspondence table of keywords and corresponding file numbers (file numbers).

  In the illustrated example, “information engineering” is stored as a keyword in index number 1 and “1”, “6”, “8”, and “11” are stored as file numbers corresponding to the keyword. Yes. In index number 2, “Ibaraki University” is stored as a keyword, and “3”, “6”, and “10” are stored as file numbers corresponding to the keyword.

  The operation of the index verification information generation unit 206 of the client 200 will be described with reference to FIG.

The index verification information generation unit 206 reads the index and the verification secret key K (S102). Next, the index verification information generation unit 206 executes the following process for each keyword _{W i} (S104). Here, regarding the set of files {D _j1 , D _j2 ,...} Including the keyword W _i , the set of subscripts (that is, file numbers) is { _{j 1} , _{j 2} ,. In this case, the index verification information generation unit 206 uses the verification secret key K to calculate the index verification information tag _i corresponding to the generation set (W _i , j1, j2,.
tag _i = f _K (W _i , j1, j2,...)
Here, f is a predetermined generation algorithm comprising a MAC generation algorithm or a signature generation algorithm.

Assume that the predetermined generation algorithm is a MAC generation algorithm. In this case, the index verification information generation unit 206 uses the MAC secret key as the verification secret key K, and generates the generation group (W _i , j1, j2,...) As the index verification information tag _i according to the MAC generation algorithm. Generate an authenticator for.

On the other hand, it is assumed that the predetermined algorithm is a signature generation algorithm. In this case, the index verification information generation unit 206 uses the digital signature private key as the verification private key K, and generates the generation group (W _i , j1, j2,...) As the index verification information tag _i according to the signature generation algorithm. ).

The index verification information generation unit 206 outputs the index verification information (tag ₁ , tag ₂ ,...) Obtained by calculation (step S106). The index verification information is sent to the server 300, and the server 300 stores the index verification information in the storage area 302.

  Next, the operation of the index verification information generation unit 206 will be described with a specific example with reference to FIG. Here, a case where the keyword is “Ibaraki University” with index number 2 will be described as an example.

  In this case, the index verification information generation unit 206 refers to the index and selects the file number of the corresponding file including the keyword “Ibaraki University”. In this case, since “3”, “6”, and “10” are stored in the file number of index number 2, the index verification information generation unit 206 sets “3” and “6” as the corresponding file numbers. , “10” is selected.

Then, the index verification information generation unit 206 uses the verification secret key K to indicate the verification information tag ₂ for the generation set (Ibaraki University, 3, 6, 10) according to the following expression according to a predetermined generation algorithm f. To be generated.
tag ₂ = f _K (University of Ibaraki, 3, 6, 10)

In this manner, the index verification information generation unit 206 generates the index verification information tag _i for each keyword i. The generated index verification information tag _i is sent to the server 300, and the server 300 stores the sent index verification information tag _i in the storage area 302.

  With reference to FIG. 5, the operation of the file accumulation value calculation unit 216 of the client 200 will be described. Here, it is assumed that the total number of files is n.

First, the file accumulation value calculation unit 216 reads _a set of all files {(1, D ₁ ), (2, D ₂ ),...} And public information N, g, ha (Step S202). Next, the file accumulation value calculation unit 216 obtains a prime number p _i for each file D _i (1 ≦ i ≦ n) by the following mathematical formula (step S204).
p _i = prime (H (i, D _i ))
Here, H is a hash function.

Then, the file accumulation value calculation unit 216 calculates the file accumulation value Acc according to the following mathematical formula (step S206).
Acc = g ^{p1p2p3. . . pn} mod N

  The file accumulation value calculation unit 216 outputs the accumulation value Acc of the file obtained by this calculation (step S208). The accumulated value Acc of the file is held in the Acc holding unit 218.

  FIG. 6 shows a specific example of the operation of the file accumulation value calculation unit 216.

That is, the file storage value calculating unit 216, each file _{D 1,} D 2, · · ·, for _{D n,} respectively, a prime number _{p 1 = prime (H (1} , D 1)), p 2 = prime (H ( 2, D ₂ )),..., P _n = prime (H (n, D _n )), and the accumulated value of the file Acc = g ^{p1p2p3. . . pn} mod N is calculated and the accumulated value Acc of the file is output.

At the time of search, the client 200 sends the search keyword W to the server 300 via the third signal line (transmission line) 214. In the server 300, in response to the search keyword W, the search unit 304 includes a set (i1, D _i1 ), (i2, D _i2 ),... The index verification information tag is returned to the client 200. Therefore, the client 200 acquires a set of files and file numbers (i1, D _i1 ), (i2, D _i2 ),... And their index verification information tag. That is, the second signal line (transmission line) 214 sends the search keyword W to the server 300, and the server 300 includes a set of files and file numbers including the search keyword W (i1, D _i1 ), (i2, D _i2 ),... and the index verification information tag.

In the following description, a set (i1, D _i1 ), (i2, D _i2 ),... Of a file including the search keyword W and file numbers are simply abbreviated as a set of files including the search keyword W. .

  Next, the operation of the index verification unit 208 of the client 200 will be described with reference to FIG.

First, the index verification unit 208 reads the search keyword W and the verification secret key K held in the key holding unit 204 (S302). Next, the search verification unit 208 receives from the server 300 a set of files (i1, D _i1 ), (i2, D _i2 ),... Including the search keyword W, and the index verification information tag (step) S304).

The index verification unit 208 uses the verification secret key K to determine whether the index verification information tag is the index verification information of the verification pair (W, i1, i2,...) According to a predetermined verification algorithm. Calculation is performed as shown in the equation (step S306).
Verify _K (W, i1, i2, ..., tag) = accept or reject
Here, Verify is a predetermined verification algorithm including a MAC verification algorithm or a signature verification algorithm.

  Assume that the predetermined verification algorithm comprises a MAC verification algorithm. In this case, the index verification unit 208 uses the MAC secret key as the verification secret key K, and the acquired authenticator is the authenticator of the verification pair (W, i1, i2,...) According to the MAC verification algorithm. Check if it exists.

  On the other hand, it is assumed that the predetermined verification algorithm is a signature verification algorithm. In this case, the index verification unit 208 checks whether or not the acquired digital signature is a digital signature of the verification pair (W, i1, i2,...) Using the public key of the digital signature according to the signature verification algorithm. To do.

  The index verification unit 208 outputs accept (approval) if accept (step S310), and outputs reject (reject) if reject (step S312).

  Next, the operation of the index verification unit 208 will be described with a specific example with reference to FIG. Here, a case where the search keyword W is “Ibaraki University” with index number 2 will be described as an example.

In this case, the index verification unit 208 reads the verification secret key K from the key holding unit 204, reads “Ibaraki University” as a search keyword, and sends a set of files (D ₃ , D ₆₎ sent from the server 300. , D ₁₀ ), a set of file numbers (3, 6, ₁₀ ) corresponding to D ₁₀ ) and index verification information tag are read.

Then, the index verification unit 208 uses the verification secret key K and determines whether the index verification information tag is index verification information of the verification group (Ibaraki University 3, 6, 10). According to the following formula.
Verify _K (Ibaraki University, 3, 6, 10, tag) = accept or reject

  The index verification unit 208 outputs accept (approval) if accept, and outputs reject (reject) if reject.

  The operation of the file verification information generation unit 308 of the server 300 will be described with reference to FIG.

First, the file verification information generation unit 308 reads a set of files S = {(j1, D _j1 ), (j2, D _j2 ),...} From the search unit 304 (step S402). Subsequently, the file verification information generation unit 308 reads all files {(1, D ₁ ), (2, D ₂ ),...} From the storage area 302 (step S404). The file verification information generating unit 308 reads the public information N, g, the _{h a} from the key storage unit 306 (step S406).

Next, the file verification information generation unit 308 calculates a prime number p _i (i = i1, i2,...) According to the following formula for each subscript (i1, i2,...) Not included in the file set S. Further, the file verification information π is calculated according to the following formula (step S408).
p _i = prime (H (i, D _i ))
π = g ^pi1pi2... mod N

  Then, the file verification information generation unit 308 outputs file verification information π (step S410). This file verification information π is sent to the client 200.

FIG. 10 shows a specific example of the operation of the file verification information generation unit 308. In this example, a case where a set of files S = {(2, D ₂ ), (4, D ₄ )} is output from the search unit 304 is shown.

In this case, the file search information generation unit 308 performs p ₁ = prime (H (1, D ₁ )) and p ₃ = prime (H (3, D ₃ ) for all files other than the file numbers 2 and 4. ), P ₅ = prime (H (5, D ₅ )), p ₆ = prime (H (6, D ₆ )),..., And file verification information π = g ^p1p3p5p6. Calculate and output.

  The operation of the file verification unit 220 of the client 200 will be described with reference to FIG.

  The file verification unit 220 first determines whether or not the result of the index verification unit 208 is accept (approval) (step S502). If accept (approval), the file verification unit 220 proceeds to step S504. If reject (rejection), the file verification unit 220 outputs reject (rejection) (step S514).

In step S504, the file verification unit 220 reads the set of files S = {(i1, D _i1 ), (i2, D _i2 ),... Then, the file verification unit 220 reads the public information N, g, and _{h a} from the key storage unit 204.

Subsequently, the file verification unit 220 calculates a prime p _i for each file D _i (D _i1 , D _i2 ,...) Included in the file set S according to the following mathematical formula (step S506).
p _i = prime (H (i, D _i ))

Next, the file verification unit 220 calculates the accumulated value A of the file according to the following mathematical formula (step S508).
A = π ^pi1pi2... Mod N

  Then, the file verification unit 220 determines whether or not the calculated file accumulation value A is equal to the accumulation value Acc of all files held in the Acc holding unit 218 (step S510).

When A = Acc (Yes in step S510), the file verification unit 220 selects a set of files S = {(i1, D _i1 ), (i2, D _i2 ) _,. Output as a set of files (step S512). If A ≠ Acc (No in step S510), the file verification unit 220 outputs reject (rejection) (step S514).

FIG. 12 shows a specific example of the operation of the file verification unit 220. In this example, an example in which a set of files S = {(2, D ₂ ), (4, D ₄ )} is received from the server 300 is shown.

In this case, the file verification unit 220 calculates the prime numbers p ₂ = prime (H (2, D ₂ )) and p ₄ = prime (H (4, D ₄ )), and then the accumulated value A of the file A = π ^p2p4 mod N is calculated, and it is determined whether or not the calculated accumulated value A of the file is equal to the accumulated value Acc of all the stored files. If they are equal, the acquired file sets D ₂ and D ₄ are obtained from the desired file. Get as a set, reject if not equal.

  With reference to FIG. 13, the update phase of the search system 100 according to the first embodiment of the present invention will be described. FIG. 13 is a block diagram of the update phase of the search system 100 according to the first embodiment of the present invention.

  As illustrated in FIG. 13, the client (user terminal) 200 further includes fourth and fifth signal lines (transmission lines) 222 and 224 and an Acc update unit 226.

In this example, the current file D _j having the file number j is updated to a new file D _j ′ or deleted. That is, in this example, the file having the file number j is the file to be updated (or deleted), and the current file D _j is the file before the update.

In this case, the client 200 transmits data indicating the new file D _j ′ or “deletion” to the server 300 via the fourth signal line (transmission line) 222 and transmits the file number j to the fifth signal line ( Transmission line) 224 to server 300. The server 300 stores the received new file D _j ′ or data indicating “delete” in the storage area 302 together with the file number j.

  Therefore, the combination of the fourth and fifth signal lines (transmission lines) 222 and 224 serves as an updating unit that sends (updates) a file to be updated (deleted) to the server 300 together with the file number j.

In the server 300, when the file number j is passed through the fifth signal line (transmission line) 224, the search unit 304 uses the current file (file before update) D _j already stored in the storage area 302. The current file (j, D _j ) with the file number j added thereto is returned to the client 200.

  The operation of the Acc update unit 226 of the client 200 will be described with reference to FIG.

First, the Acc update unit 226 reads the file number j, the current file D _j , and the new file D _j ′ (or data indicating “delete”), reads the accumulated value Acc of all files from the Acc holding unit 218, and holds the key. secret information p from the section 204, q and the public information N, g, reads _{h a} (step S602).

Subsequently, the Acc updating unit 226 calculates x, x ′, and d according to the following mathematical formula (step S604).
x = prime (H (j, D _j ))
x ′ = prime (H (j, D _j ′))
d = x ′ / x mod (p−1) (q−1)

Next, the Acc update unit 226 calculates an accumulation value Acc ′ of all new files according to the following mathematical formula (step S606).
Acc '= Acc ^d mod N

  Finally, the Acc updating unit 226 updates the accumulated value Acc ′ of all new files in the Acc holding unit 218 to update the accumulated value Acc of all old files to the accumulated value Acc ′ of all new files ( Step S608).

  In this way, when updating (or deleting) a file, the client 200 sends the file to be updated (or data indicating “deletion”) to the server 300 together with the file number, and stores the accumulated values of all the files. Since it is only necessary to update, the file can be updated efficiently.

  Next, effects of the first embodiment will be described.

The first effect of the search system 100 according to the first embodiment is not only capable of detecting fraud (deletion, addition, falsification, replacement) of the server 300, but also efficiently updates (including deletion) files. Be able to. This is because, as a client a set of file numbers for all files (user terminal) 200 containing each keyword W _i and the keyword W _i (j1, j2, ...) and a set (generating sets), thereto This is because the index verification information tag _i is generated and the generated index verification information tag _i is stored in the server 300.

  The second effect of the search system 100 according to the first embodiment is that a replay attack can be detected. This is because the accumulated value Acc of the file is checked using the RSA accumulator.

  If the replay attack is not detected, the file accumulated value calculation unit 216, the Acc holding unit 218, the file verification unit 220, and the Acc updating unit 226 are omitted from the client 200, and the key holding unit 306 and the server 300 are omitted. The file verification information generation unit 308 can be omitted.

  The search system 100 according to the first embodiment of the present invention can be realized as a search method. Furthermore, the part implemented by the client (user terminal) 200 in the search system 100 according to the first embodiment of the present invention is stored in a memory (ROM or the like) included in the client (user terminal) 200. It may be executed by a search program.

  With reference to FIG. 15, the storage phase and the search phase of the search system 100A according to the second embodiment of the present invention will be described. FIG. 15 is a block diagram of the storage phase and the search phase of the search system 100A according to the second embodiment of the present invention. The illustrated search system 100A is a search system corresponding to the above-described search system according to the second embodiment of the present invention. The search system 100A includes a client 200A and a server 300A. The client 200A is also called a user terminal.

  The search system 100A is a system in which a client (user terminal) 200A stores a plurality of encrypted files in the server 300A, and the client (user terminal) 200A acquires a desired set of files from the server 300A by keyword search.

  Note that a block diagram of an update phase in which the client (user terminal) 200A updates the encrypted file stored in the server 300A will be described later with reference to FIG.

  The client 200A includes a key generation unit 202A, a key holding unit 204A, an index verification information generation unit 206A, an index verification unit 208A, a file encryption unit 210A, an index encryption unit 212A, and a keyword encryption unit 214A. , A file accumulation value calculation unit 216A, an Acc holding unit 218A, and a file verification unit 220A.

  On the other hand, the server 300A includes a storage area 302A, an encryption search unit 304A, a key holding unit 306A, and a file verification information generation unit 308A.

Key generating unit 202A the generated secret key _{K e} encryption, and a secret key K for verification, and a predetermined secret key K0, K1, secret information p, and q, public information N, g, and _{h a} To do. Key storage unit 204A includes a secret key _{K e} of the generated encrypted, and a private key K for verification, and a predetermined secret key K0, K1, secret information p, q and the public information N, g, _{h a} And hold. Also, the public information stored in the key storage unit 204A N, g, _{h a} is sent to the key holding part 306A of the server 300A. Therefore, the key holding portion 306A of the server 300A stores public information N, g, and _{h a.}

The file encryption unit 210A, using the secret key _{K e} of encryption, the file is a ciphertext of a plurality of files _{{E (D 1), E} (D 2), ...} is calculated. These encrypted files {E (D ₁ ), E (D ₂ ),...} Are sent to the server 300A together with their file numbers, and the server 300A sends the encrypted files {E (D ₁ ), E (D ₂ ),...} Are stored in the storage area 302 A together with their file numbers. Thus, the file encryption unit 210A uses the secret key K _e encryption respectively encrypt multiple files, work plurality of cryptographic file as encrypted file storage means for storing the server 300A along with their file numbers.

  In addition, the client 200A generates an index. A specific example of the index is the same as in FIG. As described above, the index is a correspondence table of keywords and file numbers (file numbers) corresponding to the keywords.

  As shown in FIG. 2, in the illustrated example, “information engineering” is stored as a keyword in index number 1, and “1”, “6”, “8” are stored as file numbers corresponding to the keyword. , “11” is stored. In index number 2, “Ibaraki University” is stored as a keyword, and “3”, “6”, and “10” are stored as file numbers corresponding to the keyword.

  The index encryption unit 212A encrypts the generated index using predetermined secret keys K0 and K1, and transmits the encrypted index to the server 300A. The server 300A stores the sent encrypted index in the storage area 302A. Therefore, the index encryption unit 212A functions as an encrypted index storage unit that encrypts the generated index and stores the encrypted index in the server 300A.

  The operation of the index encryption unit 212A of the client 200A will be described with reference to FIG.

  Here, before describing the operation of the index encryption unit 212A, the notation will be described first.

PRF _k (·) represents a pseudo-random function. However, k is a key.
[PRF _k (W)] _u represents the first u bits of PRF _k (W).
Let n be the total number of documents (files).
If the keyword W _i is included in the file D _j , e _{i, j} = 1, otherwise e _{i, j} = 0.

  First, the index encryption unit 212A reads an index and predetermined secret keys K0 and K1 (step S702).

Subsequently, the index encryption unit 212A calculates label _i , PAD _i , and OTP _i represented by the following formula for each keyword Wi (step S704).
label _i = [PRF _K0 (W _i )] ₁₂₈
PAD _i = [PRF _K1 (W _i )] _n
OTP _i = PAD _i + (e _{i, 1} ,..., E _{i, n} ) mod 2
Here, label _i represents the ciphertext of the keyword W _i , and OTP _i represents the ciphertext of the file number of the file including the keyword W _i .

Then, the index encryption unit 212A outputs the encryption index = {(label ₁ , OTP ₁ ), (label ₂ , OTP ₂ ),...} (Step S706).

Thus, the index encryption unit 212A, an index is a correspondence table between the file number of the file that corresponds to the keyword W _i and the keyword W _i, and encrypted using a predetermined secret key K0, K1, keyword W _i cipher text label _i of the work the encrypted index consisting of a cipher text OTP _i of the file number of the file that contains the keyword _{W i} as encrypted index storage means for storing the server 300A.

  Next, the operation of the index encryption unit 212A will be described with a specific example with reference to FIG. Here, a case where the total number of files (documents) n = 12, and the keyword is “Ibaraki University” with index number 2 will be described as an example. Therefore, in this case, “3”, “6”, and “10” are stored in the file number of index number 2.

In this case, the index encryption unit 212A, to calculate the cipher text label ₂ of the keyword _{W 2,} the file number and the ciphertext OTP _2.

However, the ciphertext label ₂ keyword _{W 2} is represented by the following equation.
label ₂ = [PRF _K0 (Ibaraki University)] ₁₂₈

Further, (e _2,1 ,..., E _2,12 ) is equal to (001001000100). Further, PAD ₂ is represented by the following mathematical formula, and is assumed to be (110101011110) here.
PAD ₂ = [PRF _K1 (Ibaraki University)] ₁₂
= (110101011110)

Therefore, the ciphertext OTP ₂ of the file number is the exclusive OR (xor) thereof, and is represented by the following mathematical formula in this example.
OTP ₂ = (111100011010)

  Since the operation of the index verification information generation unit 206A of the client 200A is the same as that shown in FIGS. 3 and 4, the description thereof is omitted to avoid duplication.

  With reference to FIG. 18, the operation of the file accumulation value calculation unit 216A of the client 200A will be described.

First, the file accumulating value calculation unit 216A, the set of all encrypted files _{{(1, E (D 1} )), (2, E (D 2)), ···} and public information N, g, and _{h a} Read (step S202A). Next, the file accumulation value calculation unit 216A calculates a prime number p _i for each encrypted file E (D _i ) (1 ≦ i ≦ n) by the following mathematical formula (step S204A).
p _i = prime (H (i, E (D _i )))
Here, H is a hash function.

Then, the file accumulation value calculation unit 216A calculates the accumulation value Acc of the file by the following mathematical formula (step S206A).
Acc = g ^{p1p2p3. . . pn} mod N

  The file accumulation value calculation unit 216A outputs the accumulation value Acc of the file obtained by this calculation (step S208A). The accumulated value Acc of the file is held by the Acc holding unit 218A.

  FIG. 19 shows a specific example of the operation of the file accumulation value calculation unit 216A.

That is, the file accumulation value calculation unit 216 has prime numbers p ₁ = prime (H (1, E () for each encrypted file E (D ₁ ), E (D ₂ ),..., E (D _n ). D ₁ ))), p ₂ = prime (H (2, E (D ₂ ))),..., _Pn = prime (H (n, E (D _n )))) Acc = g ^{p1p2p3. . . pn} mod N is calculated and the accumulated value Acc of the file is output.

At the time of the search, in the client 200A, the keyword encryption unit 214A encrypts the search keyword W using predetermined secret keys K0 and K1, and sends the encrypted search keyword (label ^* , PAD ^* ) to the server 300A.

  The operation of the keyword encryption unit 214A of the client 200A will be described with reference to FIG.

The keyword encryption unit 214A first reads the search keyword W and predetermined secret keys K0 and K1 (step S802). Subsequently, the keyword encryption unit 214A calculates an encryption search keyword (label ^* , PAD ^* ) according to the following mathematical formula (step S804).
label ^* = [PRF _K0 (W)] ₁₂₈
PAD ^* = [PRF _K1 (W)] _n

Then, the keyword encryption unit 214A transmits the encryption search keyword (label ^* , PAD ^* ) obtained by the calculation to the server 300A (step S806).

  FIG. 21 shows a specific example of the operation of the keyword encryption unit 214A. In this example, the search keyword W is “Ibaraki University” and the total number n of files is equal to 12.

In this case, the keyword encryption unit 214A calculates the encryption search keyword (label ^* , PAD ^* ) according to the following mathematical formula.
label ^* = [PRF _K0 (Ibaraki University)] ₁₂₈
PAD ^* = [PRF _K1 (Ibaraki University)] ₁₂
(= 110101011110)

The keyword encryption unit 214A transmits the encryption search keyword (label ^* , PAD ^* ) obtained by the calculation to the server 300A.

In the server 300A, in response to the encryption search keyword (label ^* , PAD ^* ), the encryption search unit 304A sends a set of encryption files {(j1, E (D _j1 )), (j2, E (D _j2 )),...} And its index verification information tag _j are returned to the client 200A.

  With reference to FIG. 22, the operation of the cryptographic search unit 304A of the server 300A will be described.

First, the cryptographic search unit 304A reads the cryptographic search keyword (label ^* , PAD ^* ) transmitted from the client 200A as search data (step S902).

Subsequently, the cipher search unit 304A finds j satisfying label ^* = label _j from the encrypted index stored in the storage area 302A, and finds (label _j , OTP _j , tag _j ) (step S904). ).

Next, the cryptographic search unit 304A calculates the following mathematical formula (step S906).
(E ₁ ,..., E _n ) = OTP _j + PAD ^* mod 2

Then, the cipher search unit 304A obtains a set {j1, j2,...} Of j for which e _j = 1 (step S908).

Next, the cipher search unit 304A sets a set of cipher files {(j1, E (D _j1 )), (j2, E (D _j2 )),... Including the search keyword W and its index verification information tag _j. Are output (step S910).

Therefore, the client 200A obtains a set of encrypted files {(j1, E (D _j1 )), (j2, E (D _j2 )),...} And its index verification information tag _j .

  FIG. 23 shows a specific example of the operation of the cryptographic search unit 304A. In this example, j is equal to 2 and n is equal to 12.

Since j = 2, the cryptographic search unit 304A finds (label ₂ , OTP ₂ , tag ₂ ) from the encrypted index. Then, the cryptographic search unit 304A calculates the following mathematical formula.
(E ₁ ,..., E ₁₂ ) = OTP ₂ + PAD ^* mod 2

In this example, it is assumed that PAD ^* and OTP ₂ are equal to the following mathematical expressions, respectively.
PAD ^* = (110101011110)
OTP ₂ = (111100011010)

In this case, since (e ₁ ,..., E ₁₂ ) is their exclusive OR xor, it is expressed by the following mathematical formula.
(E ₁ ,..., E ₁₂ ) = (001010100100)

Therefore, since e ₃ = 1, e ₆ = 1, and e ₁₀ = 1, the corresponding document number (file number is ( ₃ , ₆ , ₁₀ ).

Therefore, the cryptographic search unit 304A includes a set of cryptographic files {(3, E (D ₃ )), (6, E (D ₆ )), (10, E (D ₁₀ ))} including the search keyword W and The index verification information tag ₂ is output.

As described above, the keyword encryption unit 214A sends the encrypted search keywords (label ^* , PAD ^* ) obtained by encrypting the search keyword W using the predetermined secret keys K0 and K1 to the server 300A. To obtain a set of encrypted files {(j1, E (D _j1 )), (j2, E (D _j2 )),...} And index verification information tag _j corresponding to the search keyword W Work as a means.

  Since the operation of the index verification unit 208A of the client 200A is substantially the same as that of FIGS. 7 and 8, detailed description of the operation will be omitted. The only difference is that the “file set” in step S304 in FIG. 7 is changed to “encrypted file set”.

  The operation of the file verification information generation unit 308A of the server 300A will be described with reference to FIG.

First, the file verification information generation unit 308A reads the set S = {(j1, E (D _j1 )), (j2, E (D _j2 )) _,. S402A). Subsequently, the file verification information generation unit 308A reads all encrypted files {(1, E (D ₁ )), (2, E (D ₂ )),...} From the storage area 302A (step S404A). Then, the file verification information generating section 308A reads public information N, g, and _{h a} from the key storage unit 306A (step S406A).

Next, the file verification information generation unit 308A uses the prime number p _i (i = i1, i1, i2,...) For each subscript (ie, file number) (i1, i2,. i2,...) and file verification information π is calculated according to the following formula (step S408A).
p _i = prime (H (i, E (D _i )))
π = g ^pi1pi2... mod N

  Then, the file verification information generation unit 308A outputs file verification information π (step S410A). This file verification information π is sent to the client 200A.

FIG. 25 shows a specific example of the operation of the file verification information generation unit 308A. In this example, an example in which a set of encrypted files S = {(2, E (D ₂ )), (4, E (D ₄ ))} is output from the encryption search unit 304A.

In this case, the file search information generation unit 308A determines that p ₁ = prime (H (1, E (D ₁ ))) and p ₃ = prime (H (3) for all encrypted files with file numbers other than 2 and 4. , E (D ₃ ))), p ₅ = prime (H (5, E (D ₅ ))), p ₆ = prime (H (6, E (D ₆ ))),. File verification information π = g ^p1p3p5p6... Mod N is calculated and output.

  The operation of the file verification unit 220A of the client 200A will be described with reference to FIG.

  First, the file verification unit 220A determines whether or not the result of the index verification unit 208A is accept (approval) (step S502A). If accept (approval), the file verification unit 220A proceeds to step S504A. If reject (rejection), the file verification unit 220A outputs reject (rejection) (step S514A).

In step S504A, the file verification unit 220A sends a set of encrypted files S = {(i1, E (D _i1 )), (i2, E (D _i2 )),... Read π. Then, the file verification unit 220A reads public information N, g, and _{h a} from the key holding portion 204A.

Subsequently, the file verification unit 220A applies the prime p according to the following formula for each encrypted file E (D _i ) (E (D _i1 ), E (D _i2 ),...) Included in the set S of encrypted files. _i is calculated (step S506A).
p _i = prime (H (i, E (D _i )))

Next, the file verification unit 220A calculates the accumulated value A of the file according to the following mathematical formula (step S508A).
A = π ^pi1pi2... Mod N

  Then, the file verification unit 220A determines whether or not the calculated file accumulation value A is equal to the accumulation value Acc of all the files held in the Acc holding unit 218A (step S510A).

When A = Acc (Yes in step S510A), the file verification unit 220A determines that the set of encrypted files S = {(i1, E (D _i1 )), (i2, E (D _i2 )) acquired from the server 300A. ... Are decoded and output as a set of desired files {(i1, D _i1 ), (i2, D _i2 ),...} (Step S512A). When A ≠ Acc (No in step S510A), the file verification unit 220A outputs reject (rejection) (step S514A).

FIG. 27 shows a specific example of the operation of the file verification unit 220A. In this example, a case where a set of encrypted files S = {(2, E (D ₂ )), (4, E (D ₄ ))} is received from the server 300A is shown.

In this case, the file verification unit 220A calculates the prime numbers p ₂ = prime (H (2, E (D ₂ ))) and p ₄ = prime (H (4, E (D ₄ ))), and then The accumulated value A = π ^p2p4 mod N is calculated, and it is determined whether or not the calculated accumulated value A of the file is equal to the accumulated value Acc of all the held files. If they are equal, the set E (D ₂ ), E (D ₄ ) is decrypted to obtain a desired set of files D ₂ , D ₄ , and if they are not equal, reject (reject).

  With reference to FIG. 28, the update phase of the search system 100A according to the second embodiment of the present invention will be described. FIG. 28 is a block diagram of the update phase of the search system 100A according to the second embodiment of the present invention.

  As illustrated in FIG. 28, the client (user terminal) 200A further includes first and second signal lines (transmission lines) 222A and 224A, and an Acc updating unit 226A.

In this example, the current encryption file E (D _j ) having the file number j is updated to a new encryption file E (D _j ′) or deleted. That is, in this example, the encryption file having the file number j is an encryption file to be updated (or deleted), and the current encryption file E (D _j ) is the encryption file before being updated.

In this case, the client 200A transmits the new encrypted file E (D _j ′) or data indicating “deletion” to the server 300A via the first signal line (transmission line) 222A, and sets the file number j to the second Is transmitted to the server 300A via the signal line (transmission line) 224A. The server 300A stores the sent new encrypted file E (D _j ′) or data indicating “deletion” together with the file number j in the storage area 302A.

  Therefore, the combination of the first and second signal lines (transmission lines) 222A and 224A serves as an updating unit that sends the encrypted file to be updated (deleted) together with the file number j to the server 300A and updates (deletes) it.

The new encryption file E (D _j ′) may be generated by encrypting the new file D _j ′ using the file encryption unit 210A shown in FIG.

In the server 300A, when the file number j is passed through the second signal line (transmission line) 224A, the cipher search unit 304A causes the current cipher file (the cipher file before update) already stored in the storage area 302A. E (D _j ) is searched, and the current encrypted file (j, E (D _j )) to which the file number j is added is returned to the client 200A.

  With reference to FIG. 29, the operation of the Acc updating unit 226A of the client 200A will be described.

First, the Acc updating unit 226A reads the file number j, the current encrypted file E (D _j ), the new encrypted file E (D _j ′) (or data indicating “deleted”), and all the encrypted files from the Acc holding unit 218A. It reads the accumulated values Acc, reads secret information p from the key storage unit 204A, q and public information N, g, and _{h a} (step S602a).

Subsequently, the Acc updating unit 226A calculates x, x ′, and d according to the following mathematical formula (step S604A).
x = prime (H (j, E (D _j )))
x ′ = prime (H (j, E (D _j ′)))
d = x ′ / x mod (p−1) (q−1)

Next, the Acc updating unit 226A calculates the accumulated value Acc ′ of all new encrypted files according to the following mathematical formula (step S606A).
Acc '= Acc ^d mod N

  Finally, the Acc update unit 226A holds the calculated accumulated value Acc ′ of all new encrypted files in the Acc holding unit 218A, thereby changing the accumulated value Acc of all old encrypted files to the accumulated value Acc ′ of all new encrypted files. Update (step S608A).

  In this way, when updating (or deleting) an encrypted file, the client 200A sends the encrypted file to be updated (or data indicating “deleted”) to the server 300A together with the file number, and all of the encrypted files are transmitted. Since it is only necessary to update the accumulated value, the encryption file can be efficiently updated (deleted).

  Next, the effect of the second embodiment will be described.

The first effect of the search system 100A of the second embodiment is not only capable of detecting server fraud (deletion, addition, falsification, replacement) of files, but also efficiently updating files (including deletion). Is that it can be done. The reason is that the encrypted file {E (D _j1 ), E (D _j2 ),...} Obtained by the client (user terminal) 200A encrypting each keyword W _i and a set of all files including the keyword W _i . The set of file numbers (j1, j2,...) As a set (set for generation), index verification information tag _i for the set is generated, and the generated index verification information tag _i is stored in the server 300A. It is.

  A second effect of the search system 100A of the second embodiment is that a replay attack can be detected. This is because the accumulated value Acc of the file is checked using the RSA accumulator.

  If the replay attack is not detected, the file accumulation value calculation unit 216A, the Acc holding unit 218A, the file verification unit 220A, and the Acc updating unit 226A are omitted from the client 200A, and the key holding unit 306A and the server 300A are omitted. The file verification information generation unit 308A can be omitted.

  The search system 100A according to the second embodiment of the present invention can be realized as a search method. Further, the part implemented by the client (user terminal) 200A in the search system 100A according to the second embodiment of the present invention is stored in a memory (ROM or the like) included in the client (user terminal) 200A. It may be executed by a search program.

  As mentioned above, although this invention was demonstrated with reference to embodiment (Example), this invention is not limited to the said embodiment (Example). Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

  Part or all of the above-described embodiments (examples) can be described as in the following supplementary notes, but are not limited thereto.

(Supplementary note 1) A search system in which a user terminal stores a plurality of files in a server, and the user terminal acquires a set of desired files from the server by keyword search, and also updates a file, the user terminal The terminal
File storage means for storing the plurality of files together with their file numbers in the server;
Index storage means for storing an index, which is a correspondence table of keywords and file numbers of files corresponding to the keywords, in the server;
Index verification information for generating index verification information according to a predetermined generation algorithm for a generation set of the keyword and a set of file numbers of all files including the keyword, and storing the generated index verification information in the server A generator,
A file acquisition means for sending a search keyword to the server, and acquiring a file including the search keyword and a set of file numbers of the file and index verification information corresponding to the search keyword from the server;
Whether the acquired index verification information is index verification information of a verification set of the search keyword and the set of file numbers of the acquired files is checked by a predetermined verification algorithm, and if the check result is correct An index verifier to approve or otherwise reject;
Update means for sending the file to be updated together with its file number to the server for updating;
Search system having

(Supplementary note 2) The search system according to supplementary note 1, wherein the file to be updated includes data indicating deletion.

(Supplementary Note 3) The user terminal is
A user key holding unit that holds a secret key and predetermined public information;
A file accumulation value calculation unit for calculating accumulation values of all files from the predetermined public information and the plurality of files;
An accumulated value holding unit for holding accumulated values of all the files;
Further comprising
The server
A server key holding unit for holding the predetermined public information;
A file that generates file verification information by using a file other than the set of files including the search keyword among all files stored in the server based on the predetermined public information, and sends the file verification information to the user terminal A verification information generation unit;
With
The user terminal is
When approved by the index verification unit, based on the predetermined public information, using the acquired set of files and the file verification information, calculate a storage value of the file, and store the calculated file A file verification unit that obtains the set of the obtained files as the set of the desired files if the value is equal to the accumulated value of all the held files, and rejects otherwise.
The search system according to appendix 1 or 2.

(Supplementary Note 4) The user terminal
Based on the predetermined public information, the file to be updated, the file before update, the file number thereof, and the accumulated value of all the files held in the accumulated value holding unit, was calculated, further comprising a storage value updating unit that holds the accumulated value of the calculated new full file on the storage value holding unit,
The search system according to attachment 3.

(Supplementary Note 5) The predetermined generation algorithm includes a signature generation algorithm,
The predetermined verification algorithm comprises a signature verification algorithm;
The index verification information generation unit generates a digital signature for the generation set as the index verification information according to the signature generation algorithm using a digital signature private key,
The index verification unit checks whether the acquired digital signature is a digital signature of the verification set according to the signature verification algorithm using a public key of the digital signature.
The search system according to any one of supplementary notes 1 to 4.

(Supplementary Note 6) The predetermined generation algorithm includes a MAC (Message Authentication Code) generation algorithm,
The predetermined verification algorithm comprises a MAC verification algorithm;
The index verification information generation unit generates an authenticator for the generation set as the index verification information according to the MAC generation algorithm using a MAC secret key,
The index verification unit checks whether the acquired authenticator is the authenticator of the verification set according to the MAC verification algorithm, using the MAC secret key.
The search system according to any one of supplementary notes 1 to 4.

(Supplementary note 7) A search method in which a user terminal stores a plurality of files in a server, the user terminal acquires a set of desired files from the server by keyword search, and also updates the file,
The user terminal storing the plurality of files together with their file numbers in the server;
The user terminal storing an index, which is a correspondence table of keywords and file numbers of files corresponding to the keywords, in the server;
The user terminal generating index verification information according to a predetermined generation algorithm for a generation set of the keyword and a set of file numbers of all files including the keyword;
The user terminal storing the generated index verification information in the server;
The user terminal sends a search keyword to the server, and acquires from the server a file including the search keyword and a set of file numbers of the file and index verification information corresponding to the search keyword;
The user terminal checks whether or not the acquired index verification information is index verification information of a verification set of the search keyword and a set of file numbers of the acquired files by a predetermined verification algorithm; ,
The user terminal approves if the result of the check is correct, and rejects otherwise;
The user terminal sends a file to be updated to the server together with the file number for updating;
Search method including

(Supplementary note 8) The search method according to supplementary note 7, wherein the file to be updated includes data indicating deletion.

(Supplementary Note 9) A search program for storing a plurality of files on a server, obtaining a desired set of files from the server by keyword search, and causing a user terminal, which is a computer, to execute processing for updating the files. And the computer
Storing the plurality of files together with their file numbers on the server;
A procedure for storing an index, which is a correspondence table of keywords and file numbers of files corresponding to the keywords, in the server;
Generating index verification information according to a predetermined generation algorithm for a generation set of the keyword and a set of file numbers of all files including the keyword;
A procedure for storing the generated index verification information in the server;
Sending a search keyword to the server, and obtaining from the server a file containing the search keyword and a set of file numbers of the file and index verification information corresponding to the search keyword;
A procedure for checking whether or not the acquired index verification information is index verification information of a verification set of the search keyword and a set of file numbers of the acquired files by a predetermined verification algorithm;
Approve if the result of the check is correct, otherwise reject it,
Sending the file to be updated together with its file number to the server for updating;
Search program to execute.

(Supplementary note 10) The search program according to supplementary note 9, wherein the file to be updated includes data indicating deletion.

(Supplementary note 11) A search system in which a user terminal stores a plurality of encrypted files in a server, and the user terminal acquires a set of desired files from the server by keyword search, and also updates an encrypted file, The user terminal is
Encrypted file storage means for encrypting each of a plurality of files using an encryption private key, and storing the plurality of encrypted files together with file numbers of the encrypted files on the server;
An index, which is a correspondence table between a keyword and a file number of a file corresponding to the keyword, is encrypted using a predetermined secret key, and includes a ciphertext of the keyword and a ciphertext of the file number of the file including the keyword Encrypted index storage means for storing an encrypted index in the server;
Index verification information for generating index verification information according to a predetermined generation algorithm for a generation set of the keyword and a set of file numbers of all files including the keyword, and storing the generated index verification information in the server A generator,
An encryption search keyword obtained by encrypting a search keyword using the predetermined secret key is sent to the server, and an encryption file including the encryption search keyword from the server, a set of file numbers of the encryption file, and the search keyword Encrypted file acquisition means for acquiring index verification information corresponding to
Whether or not the acquired index verification information is index verification information of a verification set of the search keyword and the set of file numbers of the acquired encrypted files is checked by a predetermined verification algorithm, and the check result is correct. An index validation unit that approves and rejects otherwise,
Updating means for encrypting a file to be updated using the encryption private key and sending the encrypted file to be updated together with the file number to the server for updating;
Search system having

(Supplementary note 12) The search system according to supplementary note 11, wherein the encrypted file to be updated is composed of data indicating deletion.

(Supplementary note 13) The user terminal
A user key holding unit that holds the encryption secret key, the predetermined secret key, and predetermined public information;
A file accumulation value calculation unit for calculating accumulation values of all encrypted files from the predetermined public information and the plurality of encrypted files;
An accumulated value holding unit for holding accumulated values of all the encrypted files;
Further comprising
The server
A server key holding unit for holding the predetermined public information;
Based on the predetermined public information, out of all the encrypted files stored in the server, an encrypted file other than the set of encrypted files including the encrypted search keyword is used to generate file verification information to generate the user terminal A file verification information generator to be sent to
With
The user terminal is
When approved by the index verification unit, based on the predetermined public information, using the acquired set of encrypted files and the file verification information, calculate an accumulated value of the encrypted file, and calculate the calculated encryption A file verification unit that decrypts the acquired set of encrypted files to obtain the desired set of files if the stored value of the files is equal to the stored value of all the stored encrypted files; Have
The search system according to appendix 11 or 12.

(Supplementary Note 14) The user terminal
Based on the predetermined public information, a new all-encryption code is obtained by using the encrypted file to be updated, the encrypted file before the update, the file number thereof, and the accumulated value of all the encrypted files held in the accumulated value holding unit. It calculates the accumulation value of the file, further comprising a storage value updating unit that holds the accumulated value of the new total cipher files the computed the accumulation value holding unit,
The search system according to attachment 13.

(Supplementary Note 15) The predetermined generation algorithm includes a signature generation algorithm,
The predetermined verification algorithm comprises a signature verification algorithm;
The index verification information generation unit generates a digital signature for the generation set as the index verification information according to the signature generation algorithm using a digital signature private key,
The index verification unit checks whether the acquired digital signature is a digital signature of the verification set according to the signature verification algorithm using a public key of the digital signature.
The search system according to any one of appendices 11 to 14.

(Supplementary Note 16) The predetermined generation algorithm includes a MAC (Message Authentication Code) generation algorithm,
The predetermined verification algorithm comprises a MAC verification algorithm;
The index verification information generation unit generates an authenticator for the generation set as the index verification information according to the MAC generation algorithm using a MAC secret key,
The index verification unit checks whether the acquired authenticator is the authenticator of the verification set according to the MAC verification algorithm, using the MAC secret key.
The search system according to any one of appendices 11 to 14.

(Supplementary note 17) A search method in which a user terminal stores a plurality of encrypted files in a server, and the user terminal acquires a set of desired files from the server by keyword search, and also updates an encrypted file,
The user terminal encrypts each of a plurality of files using an encryption private key, and stores the plurality of encrypted files together with file numbers of the encrypted files on the server;
The user terminal encrypts an index, which is a correspondence table between a keyword and a file number of a file corresponding to the keyword, using a predetermined secret key, and the ciphertext of the keyword and the file number of the file including the keyword Storing an encrypted index comprising ciphertext on the server;
The user terminal generating index verification information according to a predetermined generation algorithm for a generation set of the keyword and a set of file numbers of all files including the keyword;
The user terminal storing the generated index verification information in the server;
The user terminal sends an encrypted search keyword obtained by encrypting a search keyword using the predetermined secret key to the server, and an encrypted file including the encrypted search keyword and a file number of the encrypted file are transmitted from the server. Obtaining a set and index verification information corresponding to the search keyword;
A step in which the user terminal checks whether or not the acquired index verification information is index verification information of a verification set of the search keyword and a set of file numbers of the acquired encrypted files by a predetermined verification algorithm; When,
The user terminal approves if the result of the check is correct, and rejects otherwise;
The user terminal sends the encrypted file to be updated to the server together with the file number obtained by encrypting the file to be updated using the encryption secret key;
Search method including

(Supplementary note 18) The search method according to supplementary note 17, wherein the encrypted file to be updated consists of data indicating deletion.

(Supplementary Note 19) A search program that stores a plurality of encrypted files in a server, acquires a desired set of files from the server by keyword search, and causes a user terminal, which is a computer, to execute processing for updating the encrypted files And the computer
Encrypting each of a plurality of files using an encryption private key, and storing the plurality of encrypted files together with the file numbers of the encrypted files on the server;
An index, which is a correspondence table between a keyword and a file number of a file corresponding to the keyword, is encrypted using a predetermined secret key, and includes a ciphertext of the keyword and a ciphertext of the file number of the file including the keyword Storing an encrypted index on the server;
Generating index verification information according to a predetermined generation algorithm for a generation set of the keyword and a set of file numbers of all files including the keyword;
A procedure for storing the generated index verification information in the server;
An encrypted search keyword obtained by encrypting a search keyword using the predetermined secret key is sent to the server, and an encrypted file including the encrypted search keyword from the server, a set of file numbers of the encrypted file, and the search keyword Obtaining index verification information corresponding to
A procedure for checking whether or not the acquired index verification information is index verification information of a verification set of the search keyword and a set of file numbers of the acquired encrypted files by a predetermined verification algorithm;
Approve if the result of the check is correct, otherwise reject it,
A procedure for transmitting the encrypted file to be updated together with the file number obtained by encrypting the file to be updated using the encryption private key to the server and updating the encrypted file;
Search program to execute.

(Supplementary note 20) The search program according to supplementary note 19, wherein the encrypted file to be updated comprises data indicating deletion.

  The present invention can be used for a method of detecting a server fraud in keyword search and updating (including deleting) a file.

100, 100A Search system 200, 200A Client (user terminal)
202, 202A Key generation unit 204, 204A Key holding unit 206, 206A Index verification information generation unit 208, 208A Index verification unit 210 First signal line (file storage means)
210A File encryption unit (encrypted file storage means)
212 Second signal line (index storage means)
212A Index encryption unit (cryptographic index storage means)
214 Third signal line (file acquisition means)
214A Keyword encryption unit (encrypted file acquisition means)
216, 216A File accumulated value calculation unit 218, 218A Acc holding unit 220, 220A File verification unit 222, 222A Signal line 224, 224A Signal line 226, 226A Acc update unit 300, 300A Server 302, 302A Storage area 304 Search unit 304A Encryption Search unit 306, 306A Key holding unit 308, 308A File verification information generation unit

Claims (10)

A user terminal stores a plurality of files in a server, and the user terminal acquires a set of desired files from the server by keyword search, and also updates a file.
File storage means for storing the plurality of files together with their file numbers in the server;
Index storage means for storing an index, which is a correspondence table of keywords and file numbers of files corresponding to the keywords, in the server;
Index verification information for generating index verification information according to a predetermined generation algorithm for a generation set of the keyword and a set of file numbers of all files including the keyword, and storing the generated index verification information in the server A generator,
A file acquisition means for sending a search keyword to the server, and acquiring a file including the search keyword and a set of file numbers of the file and index verification information corresponding to the search keyword from the server;
Whether the acquired index verification information is index verification information of a verification set of the search keyword and the set of file numbers of the acquired files is checked by a predetermined verification algorithm, and if the check result is correct An index verifier to approve or otherwise reject;
Update means for sending the file to be updated together with its file number to the server for updating;
Search system having The user terminal is
A user key holding unit that holds a secret key and predetermined public information;
A file accumulation value calculation unit for calculating accumulation values of all files from the predetermined public information and the plurality of files;
An accumulated value holding unit for holding accumulated values of all the files;
Further comprising
The server
A server key holding unit for holding the predetermined public information;
A file that generates file verification information by using a file other than the set of files including the search keyword among all files stored in the server based on the predetermined public information, and sends the file verification information to the user terminal A verification information generation unit;
With
The user terminal is
When approved by the index verification unit, based on the predetermined public information, using the acquired set of files and the file verification information, calculate a storage value of the file, and store the calculated file A file verification unit that obtains the set of the obtained files as the set of the desired files if the value is equal to the accumulated value of all the held files, and rejects otherwise.
The search system according to claim 1. The user terminal is
Based on the predetermined public information, the file to be updated, the file before update, the file number thereof, and the accumulated value of all the files held in the accumulated value holding unit, was calculated, further comprising a storage value updating unit that holds the accumulated value of the calculated new full file on the storage value holding unit,
The search system according to claim 2. A search method in which a user terminal stores a plurality of files in a server, and the user terminal acquires a desired set of files from the server by keyword search, and also updates a file,
The user terminal storing the plurality of files together with their file numbers in the server;
The user terminal storing an index, which is a correspondence table of keywords and file numbers of files corresponding to the keywords, in the server;
The user terminal generating index verification information according to a predetermined generation algorithm for a generation set of the keyword and a set of file numbers of all files including the keyword;
The user terminal storing the generated index verification information in the server;
The user terminal sends a search keyword to the server, and acquires from the server a file including the search keyword and a set of file numbers of the file and index verification information corresponding to the search keyword;
The user terminal checks whether or not the acquired index verification information is index verification information of a verification set of the search keyword and a set of file numbers of the acquired files by a predetermined verification algorithm; ,
The user terminal approves if the result of the check is correct, and rejects otherwise;
The user terminal sends a file to be updated to the server together with the file number for updating;
Search method including A search program for storing a plurality of files in a server, obtaining a set of desired files from the server by keyword search, and causing a user terminal, which is a computer, to execute processing for updating the files, the computer In addition,
Storing the plurality of files together with their file numbers on the server;
A procedure for storing an index, which is a correspondence table of keywords and file numbers of files corresponding to the keywords, in the server;
Generating index verification information according to a predetermined generation algorithm for a generation set of the keyword and a set of file numbers of all files including the keyword;
A procedure for storing the generated index verification information in the server;
Sending a search keyword to the server, and obtaining from the server a file containing the search keyword and a set of file numbers of the file and index verification information corresponding to the search keyword;
A procedure for checking whether or not the acquired index verification information is index verification information of a verification set of the search keyword and a set of file numbers of the acquired files by a predetermined verification algorithm;
Approve if the result of the check is correct, otherwise reject it,
Sending the file to be updated together with its file number to the server for updating;
Search program to execute. A search system in which a user terminal stores a plurality of encrypted files in a server, the user terminal acquires a desired set of files from the server by keyword search, and also updates an encrypted file, wherein the user terminal includes: ,
Encrypted file storage means for encrypting each of a plurality of files using an encryption private key, and storing the plurality of encrypted files together with file numbers of the encrypted files on the server;
An index, which is a correspondence table between a keyword and a file number of a file corresponding to the keyword, is encrypted using a predetermined secret key, and includes a ciphertext of the keyword and a ciphertext of the file number of the file including the keyword Encrypted index storage means for storing an encrypted index in the server;
Index verification information for generating index verification information according to a predetermined generation algorithm for a generation set of the keyword and a set of file numbers of all files including the keyword, and storing the generated index verification information in the server A generator,
An encryption search keyword obtained by encrypting a search keyword using the predetermined secret key is sent to the server, and an encryption file including the encryption search keyword from the server, a set of file numbers of the encryption file, and the search keyword Encrypted file acquisition means for acquiring index verification information corresponding to
Whether or not the acquired index verification information is index verification information of a verification set of the search keyword and the set of file numbers of the acquired encrypted files is checked by a predetermined verification algorithm, and the check result is correct. An index validation unit that approves and rejects otherwise,
Updating means for encrypting a file to be updated using the encryption private key and sending the encrypted file to be updated together with the file number to the server for updating;
Search system having The user terminal is
A user key holding unit that holds the encryption secret key, the predetermined secret key, and predetermined public information;
A file accumulation value calculation unit for calculating accumulation values of all encrypted files from the predetermined public information and the plurality of encrypted files;
An accumulated value holding unit for holding accumulated values of all the encrypted files;
Further comprising
The server
A server key holding unit for holding the predetermined public information;
Based on the predetermined public information, out of all the encrypted files stored in the server, an encrypted file other than the set of encrypted files including the encrypted search keyword is used to generate file verification information to generate the user terminal A file verification information generator to be sent to
With
The user terminal is
When approved by the index verification unit, based on the predetermined public information, using the acquired set of encrypted files and the file verification information, calculate an accumulated value of the encrypted file, and calculate the calculated encryption A file verification unit that decrypts the acquired set of encrypted files to obtain the desired set of files if the stored value of the files is equal to the stored value of all the stored encrypted files; Have
The search system according to claim 6. The user terminal is
Based on the predetermined public information, a new all-encryption code is obtained by using the encrypted file to be updated, the encrypted file before the update, the file number thereof, and the accumulated value of all the encrypted files held in the accumulated value holding unit. It calculates the accumulation value of the file, further comprising a storage value updating unit that holds the accumulated value of the new total cipher files the computed the accumulation value holding unit,
The search system according to claim 7. A search method in which a user terminal stores a plurality of encrypted files in a server, the user terminal acquires a desired set of files from the server by keyword search, and also updates the encrypted file,
The user terminal encrypts each of a plurality of files using an encryption private key, and stores the plurality of encrypted files together with file numbers of the encrypted files on the server;
The user terminal encrypts an index, which is a correspondence table between a keyword and a file number of a file corresponding to the keyword, using a predetermined secret key, and the ciphertext of the keyword and the file number of the file including the keyword Storing an encrypted index comprising ciphertext on the server;
The user terminal generating index verification information according to a predetermined generation algorithm for a generation set of the keyword and a set of file numbers of all files including the keyword;
The user terminal storing the generated index verification information in the server;
The user terminal sends an encrypted search keyword obtained by encrypting a search keyword using the predetermined secret key to the server, and an encrypted file including the encrypted search keyword and a file number of the encrypted file are transmitted from the server. Obtaining a set and index verification information corresponding to the search keyword;
A step in which the user terminal checks whether or not the acquired index verification information is index verification information of a verification set of the search keyword and a set of file numbers of the acquired encrypted files by a predetermined verification algorithm; When,
The user terminal approves if the result of the check is correct, and rejects otherwise;
The user terminal sends the encrypted file to be updated to the server together with the file number obtained by encrypting the file to be updated using the encryption secret key;
Search method including A search program for storing a plurality of encrypted files in a server, obtaining a set of desired files from the server by keyword search, and causing a user terminal that is a computer to execute processing for updating the encrypted file, In the computer,
Encrypting each of a plurality of files using an encryption private key, and storing the plurality of encrypted files together with the file numbers of the encrypted files on the server;
An index, which is a correspondence table between a keyword and a file number of a file corresponding to the keyword, is encrypted using a predetermined secret key, and includes a ciphertext of the keyword and a ciphertext of the file number of the file including the keyword Storing an encrypted index on the server;
Generating index verification information according to a predetermined generation algorithm for a generation set of the keyword and a set of file numbers of all files including the keyword;
A procedure for storing the generated index verification information in the server;
An encrypted search keyword obtained by encrypting a search keyword using the predetermined secret key is sent to the server, and an encrypted file including the encrypted search keyword from the server, a set of file numbers of the encrypted file, and the search keyword Obtaining index verification information corresponding to
A procedure for checking whether or not the acquired index verification information is index verification information of a verification set of the search keyword and a set of file numbers of the acquired encrypted files by a predetermined verification algorithm;
Approve if the result of the check is correct, otherwise reject it,
A procedure for transmitting the encrypted file to be updated together with the file number obtained by encrypting the file to be updated using the encryption private key to the server and updating the encrypted file;
Search program to execute.

Images