WO2015050030A1

WO2015050030A1 - Cryptographic processing method, cryptographic system, and server

Info

Publication number: WO2015050030A1
Application number: PCT/JP2014/075428
Authority: WO
Inventors: 尚生坂崎; 安細　康介; 健三森本
Original assignee: 株式会社日立製作所
Priority date: 2013-10-04
Filing date: 2014-09-25
Publication date: 2015-04-09
Also published as: CN105556890A; JP2015073238A; CN105556890B; JP6058514B2

Abstract

Provided is cryptographic technology that is excellent in reducing the burden of management of confidential information on each user while ensuring appropriate high-speed performance of cryptographic processing. A cryptographic processing method, wherein each of terminals (10) which communicate with each other uses, as a key, an output value of a one-way function with respect to public information relating to a communication partner and secret information relating to the terminal itself, in message transmission, encrypts an object message with the key and transmits the message to a predetermined server (20), and in message reception, receives the message re-encrypted with commutativity for the terminal from the server (20), and decrypts the received message with its own key.

Description

Cryptographic processing method, cryptographic system, and server

The present invention relates to a cryptographic processing method, a cryptographic system, and a server. Specifically, the cryptographic technique is excellent in reducing the burden of managing confidential information on each user while ensuring appropriate high speed of cryptographic processing. About.

There is a data encryption technique using a key as a mechanism for safely sending and receiving data via a network such as the Internet without eavesdropping by others. Such encryption technologies are roughly classified into two types: a protocol based on public key cryptography and a protocol based on common key cryptography.

Generally, the common key cryptosystem has a higher cryptographic processing speed than the public key cryptosystem, but each user must manage the same number of secret keys as the number of communication partners “n”. Therefore, in the entire system using the common key cryptosystem, there are “n (n−1) / 2” secret keys, and the risk of secret key leakage increases depending on the number of keys. . In the common key cryptosystem, each user needs to distribute the secret key and share the key with all communication partners in advance. large.

On the other hand, in the public key cryptosystem, each user only needs to manage one private key regardless of the number “n” of communication partners, and the key management is easy. However, the encryption processing speed is not high, and it is not suitable for a situation where large size data is encrypted.

Therefore, in general, in the situation of encrypting large size data, the encryption of the corresponding data is encrypted with the common key encryption, and the secret key (the data size is small) used there is encrypted with the public key encryption, In many cases, a hybrid method is used in which the encrypted data and the secret key are transmitted to the communication partner as described above.

On the other hand, in the hybrid method, although it is true that only the secret key with a small data size is to be encrypted with the public key, compared to the case where the encryption process is performed using only the common key encryption method, It cannot be denied that the hybrid method takes more time for cryptographic processing.

Therefore, a method has been proposed that facilitates key management based on a common key cryptosystem and suppresses the risk of secret key leakage in the entire system. As such a technique, for example, an encryption key management system (see Patent Document 1) that has a small amount of confidential information held in the entire system and that allows different encryption keys to be set for each communication has been proposed.

Japanese Patent Laid-Open No. 2-122745

However, the following problems remain in the above-described conventional technology. That is, when the number of communication partners is “n ≧ 4”, the number of confidential information in the entire system can be reduced from “n (n−1) / 2” to “n + 1”. Each user needs to manage “n” secret information for all users and secret rules common to the system. In this case, the number of confidential information that each user must manage is “n + 1”. Therefore, the burden on the user's confidential information management is not sufficiently reduced.

Therefore, an object of the present invention is to provide an encryption technique that is excellent in reducing the burden of managing confidential information for each user while ensuring an appropriate high speed of encryption processing.

The encryption processing method of the present invention that solves the above-mentioned problems is based on the output value of a one-way function related to the public information of the communication partner and its own secret information as a key at each terminal that communicates with each other. The message is encrypted with the key and transmitted to the predetermined server, and when the message is received, the message re-encrypted with commutability for the terminal is received from the server, and the received message is transmitted to the own server. It is characterized by decrypting with a key.

In addition, the encryption system of the present invention provides a one-way communication device that communicates with other terminals, a storage device that stores its own secret information, public information relating to a communication partner, and the secret information read from the storage device. A process of inputting to the function and acquiring the output value of the one-way function as a key, a process of encrypting a target message with the key and transmitting the message to a predetermined server when transmitting a message to a communication partner terminal, and communication. Arithmetic apparatus for receiving a message re-encrypted with commutability from the server and receiving the message from the partner terminal and decrypting the received message with the key Including a terminal.

Further, the server of the present invention, when transmitting and receiving a message, a communication device that communicates with a terminal that uses a key that is an output value of a one-way function related to public information of a communication partner and its own secret information for encryption and decryption of the message; A message stored with a storage device storing a conversion key that is a commutative function corresponding to each combination of terminals, and public information of a communication partner of the predetermined terminal and the secret information of the predetermined terminal itself. The conversion key stored for the combination of the process received from the terminal, the predetermined terminal, and the destination terminal indicated by the received message is specified in the storage device, and the corresponding conversion key is used for the destination terminal. An arithmetic device that executes re-encryption of the message and executes processing for transmitting the re-encrypted message to the destination terminal. And features.

According to the present invention, it is possible to provide an encryption technique that is excellent in reducing the burden of managing confidential information for each user while ensuring an appropriate high-speed encryption process.

It is a network block diagram containing the encryption system of this embodiment. It is a figure which shows the structural example of the conversion server which the encryption system of this embodiment contains. It is a figure which shows the structural example of the user terminal which the encryption system of this embodiment contains. It is a figure explaining the arithmetic symbol in this embodiment. It is a sequence diagram which shows process sequence example 1 of the encryption processing method of this embodiment. It is a sequence diagram which shows process sequence example 2 of the encryption processing method of this embodiment. It is a figure which shows the conceptual example of the encryption processing method of this embodiment. It is a sequence diagram which shows process sequence example 3 of the encryption processing method of this embodiment. It is a sequence diagram which shows process sequence example 4 of the encryption processing method of this embodiment. It is a sequence diagram which shows process sequence example 5 of the encryption processing method of this embodiment. It is a sequence diagram which shows process sequence example 6 of the encryption processing method of this embodiment. It is a sequence diagram which shows process sequence example 7 of the encryption processing method of this embodiment.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a network configuration diagram including the cryptographic system 1 of the present embodiment. The cryptographic system 1 shown in FIG. 1 is a computer system that implements a cryptographic technique that is excellent in reducing the burden of managing confidential information for each user while ensuring appropriate high-speed encryption processing.

The encryption system 1 in the present embodiment includes a user terminal A10_1, a user terminal B10_2, a user terminal C10_3 (hereinafter simply referred to as the user terminal 10 when these user terminals are collectively shown), and a conversion server 20 ( Server) are connected to each other via a communication network (hereinafter referred to as a network) 30 such as the Internet. In the configuration illustrated in FIG. 1, three user terminals 10 are connected to the network 30, but even if a larger number of user terminals 10 are connected to the network 30. No problem. In the present embodiment, the conversion server 20 and the user terminal 10 are included as an example of the encryption system 1, but only the conversion server 20 or only the user terminal 10 can be regarded as the encryption system 1.

Further, the hardware configuration of the conversion server 20 constituting the encryption system 1 is as follows. FIG. 2 is a diagram illustrating a configuration example of the conversion server 20 included in the cryptographic system 1 of the present embodiment. The conversion server 20 reads out a storage device 201 configured with an appropriate non-volatile storage device such as a hard disk drive, a memory 203 configured with a volatile storage device such as a RAM, and a program 202 held in the storage device 201 to the memory 203. A central processing unit 204 such as a CPU for performing overall control of the server device itself and performing various determinations, computations and control processing, and a communication device 207 connected to the network 30 and responsible for communication processing with the user terminal 10, Is provided. In the storage device 201, in addition to the program 102 for implementing functions necessary as a server constituting the encryption system 1 of the present embodiment, a conversion key storage unit 225 that holds a conversion key, and re-encryption using the conversion key At least a re-ciphertext storage unit 226 that stores the converted message is stored.

Subsequently, functions provided in the conversion server 20 in the present embodiment will be described. The functions described below can be said to be functions that are implemented, for example, by executing the program 202 provided in the storage device 201 by the conversion server 20.

The conversion server 20 receives a message encrypted with the encryption key from the user terminal 10 and converts the conversion key of the storage device 201 with respect to the combination of the user terminal 10 and the destination user terminal 10 indicated by the above message. The conversion key stored in the storage unit 225 is identified, and the corresponding message is re-encrypted with the corresponding conversion key for the destination user terminal 10 indicated by the message received from the user terminal 10 described above. And a function of transmitting the re-encrypted message to the destination user terminal 10. The above-mentioned encryption key is an output value obtained by the user terminal 10 applying the public information of the other user terminal 10 as the communication partner and its own secret key to the hash function (one-way function). .

Also, the conversion server 20 generates a random number (predetermined value) in response to a conversion key registration request from a predetermined user terminal 10, returns the random number to the user terminal 10, and masks it with the random number. Received from the other user terminal 10 is a masked conversion key obtained by further masking the reciprocal of the processed encryption key of the predetermined user terminal 10 with the encryption key of the other user terminal 10; The exchange rule based on the above random number is applied to the received masked conversion key, and the reciprocal number of the encryption key of the user terminal 10 that issued the above registration request is the encryption key of the above other user terminal 10. It has a function of calculating the masked conversion key and storing the conversion key in the conversion key storage unit 225 of the storage device 201.

Moreover, the conversion server 20 is a predetermined other user who is paired with the corresponding user terminal 10 among the conversion keys held in the conversion key storage unit 225 from any one of the user terminals 10. A deletion request related to the terminal 10 is received, a search is performed in the conversion key storage unit 225 of the storage device 201 using the combination information of the user terminal 10 and the other user terminal 10 indicated by the deletion request as a key, A function of deleting the conversion key specified by the search from the conversion key storage unit 225 is provided.

Further, the conversion server 20 generates a random number in response to a request for registering a conversion key related to the other user terminal 10 that the user terminal 10 recognizes as a proxy, that is, the proxy user terminal 10, from the user terminal 10. The random number is returned to the above-described user terminal 10, and the encryption key (the first key of the user terminal 10 based on the public information of the proxy user terminal 10 and the secret key of the user terminal 10 masked with the random number). The masked conversion key obtained by further masking the reciprocal of 1 key) with the encryption key (second key) of the proxy user terminal 10 based on the public information of the user terminal 10 and the secret information of the proxy user terminal 10 (Third key) is received from the proxy user terminal 10 and the exchange rule based on the random number is applied to the received masked conversion key, and the encryption key (first key) of the user terminal 10 is applied. ) Is converted into a masked conversion key (third ) An agent for conversion key which is masked calculated in, has a function of storing the agent for conversion key to the conversion key storage unit 225 of the storage device 201.

Further, the conversion server 20 holds the combination of the proxy user terminal 10 and the above-described user terminal 10 in response to a request for browsing the message addressed to the above-described user terminal 10 from the proxy user terminal 10. The conversion key storage unit 225 of the storage device 201 is identified, and the message re-encrypted for the above-described user terminal 10 is exchanged with the conversion key storage unit 225 for the user terminal 10 described above. Further, it has a function of encrypting and transmitting the re-re-encrypted message to the proxy user terminal 10.

Moreover, the conversion server 20 is a proxy user who is paired with the corresponding user terminal 10 among the conversion keys held in the conversion key storage unit 225 from any one of the user terminals 10. A deletion request related to the terminal 10 is received, a search is performed in the conversion key storage unit 225 using the combination information of the user terminal 10 and the proxy user terminal 10 indicated by the deletion request as a key, and the search is specified The agent conversion key is deleted from the conversion key storage unit 225.

Also, the hardware configuration of the user terminals 10 constituting the cryptographic system 1 is as follows. FIG. 3 is a diagram illustrating a configuration example of the user terminal 10 included in the encryption system 1 of the present embodiment. The user terminal 10 reads out to the memory 103 a storage device 101 composed of a suitable non-volatile storage device such as a hard disk drive, a memory 103 composed of a volatile storage device such as a RAM, and a program 102 held in the storage device 101. For example, a CPU 104 for performing various determinations, calculations and control processing, an input device 105 for receiving key input and voice input from a user, and a display for displaying processing data. And an output device 106 such as a communication device 107 connected to a network and responsible for communication processing with the conversion server 20. In addition, in the storage device 101, in addition to the program 102 for implementing functions necessary as a terminal constituting the encryption system 1 of the present embodiment, the ID for each user terminal disclosed for each user terminal 10 is disclosed. At least a public ID storage unit 125 that holds the secret key and a key storage unit 126 that holds the secret key of the user terminal 10 are stored. Each user terminal 10 holds a program 110 corresponding to a hash function as one of the programs 102 in the storage device 101, and can be called and executed as necessary.

Subsequently, functions provided in the user terminal 10 in the present embodiment will be described. As described above, the functions described below can be said to be functions implemented by executing the program 102 provided in the user terminal 10, for example.

The user terminal 10 extracts the ID (public information) of the other user terminal 10 to be a communication partner from the public ID storage unit 125, and this ID and its own private key (secret information) held in the key storage unit 126. ) To a hash function (one-way function) to generate an encryption key.

Also, the user terminal 10 has a function of encrypting a target message with the above encryption key and transmitting it to the conversion server 20 when transmitting a message addressed to the other user terminal 10 described above.

Further, when receiving a message addressed to the user terminal 10, the user terminal 10 receives a message re-encrypted from the conversion server 20 for the user terminal 10 and receives the message. It has a function to decrypt a message with its own encryption key.

Also, the user terminal 10 has a function of transmitting a conversion key registration request to the conversion server 20 regarding the combination of the predetermined user terminal 10 and another user terminal 10 that can be a communication partner.

Further, the user terminal 10 masks the reciprocal number of the encryption key generated for the user terminal 10 and the other user terminal 10 that is the communication partner with the random number sent from the conversion server 20. A function of transmitting the masked encryption key to another user terminal 10 that is a communication partner is provided. In this case, the other user terminal 10 generates a decryption key by applying the ID of the user terminal 10 as a communication partner and its own secret key to the hash function, and the above-described user terminal 10 with the decryption key. The masked encryption key sent from the server is masked to generate a masked conversion key, and the masked conversion key is transmitted to the conversion server 20.

In addition, the user terminal 10 has a function of transmitting to the conversion server 20 an erasure request related to a predetermined other user terminal 10 paired with the corresponding user terminal 10 among the conversion keys managed by the conversion server 20. It has.

In addition, the user terminal 10 transmits a conversion key registration request regarding the proxy user terminal 10 of the predetermined user terminal 10 to the conversion server 20, and uses the random number transmitted from the conversion server 20 in response to the registration request. Has the ability to get. The proxy user terminal 10 is also one of the user terminals 10 and can be in any position depending on the situation. Therefore, even if the function or configuration described as the proxy user terminal 10 is provided as a function or configuration common to the user terminal 10 (hereinafter the same).

Further, the user terminal 10 generates a masked encryption key by masking the reciprocal of the encryption key based on the ID of the proxy user terminal 10 and the secret key of the predetermined user terminal 10 with the above random number, A function of transmitting the masked encryption key to the proxy user terminal 10 is provided. In this case, the proxy user terminal 10 receives the masked encryption key from the user terminal 10 described above, and uses the masked encryption key as the ID of the user terminal 10 and the secret key of the proxy user terminal 10. Further, a masking conversion key is generated by performing a mask process with a decryption key based on the above and a function of transmitting the masking conversion key to the conversion server 20 is provided.

Further, the proxy user terminal 10 transmits a browsing record request to the conversion server 20 for a message addressed to the user terminal 10 that is permitted to browse messages on the proxy. In this case, in the conversion server 20, the conversion key storage unit 225 specifies the conversion key for the agent held for the combination of the proxy user terminal 10 and the user terminal 10 described above, and the conversion key for the agent uses the conversion key for the agent. Then, the message re-encrypted with commutability for the above-described user terminal 10 is further encrypted, and the re-encrypted message is transmitted to the proxy user terminal 10. Therefore, the proxy user terminal 10 has a function of receiving the re-re-encrypted message transmitted from the conversion server 20 and decrypting the received re-re-encrypted message with its own decryption key.

Here, examples of operators corresponding to various processes based on commutability in the cryptographic system 1 are shown. FIG. 4 is a diagram illustrating a specific example of an operator used for processing by the cryptographic system 1 according to the present embodiment. In this embodiment, three operators are used. The first operator is the “●” operator. The operator “●” is an operator for commutative mask processing, and is an operator that performs processing for masking data A with data B. This calculation is referred to as “B • A”. Note that the mask processing here refers to processing in which data B is applied to data A and converted to another value. The operator “●” has the following properties.

(A) B ● A = A ● B
(B) C ● (B ● A) = (C ● B) ● A
(C) A ⁻¹ ● A = 1 (where “1” is the unit element)
As an operator having such a property, for example, there is “xor”.

The second operator is an “f (,)” operator. The operator “f (,)” is an encryption processing operator that is commutative with respect to the encryption key, and is an operator that encrypts the data A with the encryption key K. This calculation is referred to as “f (K, A)”. The operator “f (,)” has the following properties.

(A) f (K ₁ , f (K ₂ , A)) = f ((K ₁ * K ₂ ), A) = f ((K ₂ * K ₁ ), A) = f (K ₂ , f ( K _1, A))
(B) f (K ₁ ＫK ₂ , f (K ₃ , A)) = f (K ₁ ＫK ₂ ＫK ₃ , A) = f (K ₁ , f (K ₂ ＫK ₃ , A)
(C) f (K ⁻¹ , f (K, A)) = f (K ⁻¹ ● K, A) = f (1, A) = A
As an operator having such a property, for example, there is “xor”.

Note that the operator “●” and the operator “f (,)” may perform the same arithmetic processing, or may perform different arithmetic processing satisfying the above-described properties. Regarding the decryption process, the data A can be decrypted by re-encrypting the ciphertext using the reciprocal of the encryption key due to the property (c).

Also, the third operator is the “h (,)” operator. The operator “h (,)” is an operator representing a hash function having two data as inputs, and is an operator that generates a hash value of data A and data B. This calculation is written as “(h (A, B)”. For example, when outputting a hash value for a value obtained by xoring data A and data B, “h (A, B) = H ((AxorB))” However, “H (,)” is a hash function with one piece of data as an input, for example, “SHA256”.

Hereinafter, the actual procedure of the cryptographic processing method according to this embodiment will be described with reference to the drawings. Various operations corresponding to the cryptographic processing method described below are realized by programs that are read and executed by the conversion server 20 and each user terminal 10 constituting the cryptographic system 1 in a memory or the like. And this program is comprised from the code | cord | chord for performing the various operation | movement demonstrated below.

FIG. 5 is a sequence diagram showing a processing procedure example 1 of the cryptographic processing method according to the present embodiment. Specifically, in order to send a message from the user terminal C10_3 to the user terminal A10_1, the conversion server 20 is notified in advance. It is a sequence diagram which shows the flow until registering a conversion key. As shown in the sequence diagram of FIG. 5, the user terminal 10 can make a conversion key registration request to the conversion server 20. The start timing of this process may be any time before the corresponding user terminal 10 starts communication with the communication partner.

In this case, among the plurality of user terminals 10 included in the encryption system 1, for example, the user terminal C10_3 sends a message to the other user terminal A10_1. A conversion key registration application is made to notify that the conversion key with the terminal A10_1 is to be registered (S001).

On the other hand, the conversion server 20 receives the above-described conversion key registration application via the network 30, and generates a random number p triggered by this reception (S002). An existing technique may be adopted as a random number generation method. The conversion server 20 sends the generated random number p to the transmission source of the conversion key registration application, that is, the above-described user terminal C10_3 (S003).

On the other hand, the user terminal C10_3 that has received the random number p from the conversion server 20 generates its own private key managed by the key storage unit 126 in order to generate an encryption key with the user terminal A10_1 that is the communication partner. “K _c ” and “ID _a ”, which is the public ID of the user terminal A10_1 managed in the public ID storage unit 125, are input to the hash function, and the hash value “h (K _c , ID _a )” is input. Is calculated (S004). This hash value becomes an encryption key when the user terminal C10_3 uses the user terminal A10_1 as a communication partner.

Further, the user terminal C10_3 that has calculated the encryption key in this way uses the random number p transmitted by the conversion server 20 in step S003 described above, and masks the reciprocal number of the encryption key “p ● h (K _c , ID _a ) ^-1 "is calculated and transmitted to the user terminal A10_1 as a masked encryption key (S005).

On the other hand, as the user terminal A10_1 receives the above-described masked encryption key, the user terminal A10_1 has its own private key managed by its own key storage unit 126 in order to generate a decryption key with the user terminal C10_3. “K _a ” and “ID _c ” which is the public ID of the user terminal C10_3 managed by the public ID storage unit 125 are input to the hash function, and the hash value “h (K _a , ID _c )” is input. Is calculated (S006). This hash value becomes a decryption key when the user terminal A10_1 uses the user terminal C10_3 as a communication partner.

In addition, the user terminal A10_1 that has calculated the decryption key as described above masks the masked encryption key sent from the user terminal C10_3 using the decryption key to obtain “h (K _a , ID _c ) ● p ● h (K _c , ID _a ) ^-1 "is calculated and sent to the conversion server 20 as a masked conversion key (S007).

On the other hand, the conversion server 20 receives the information processing apparatus masked conversion key transmitted from the user terminal A10_1, masks the masked conversion key using the reciprocal of the random number p, and converts the conversion key “p ^-1 ● h (K _a , ID _c ) ● p ● h (K _c , ID _a ) ⁻¹ = h (K _a , ID _c ) ● h (K _c , ID _a ) ⁻¹ ”is calculated (S008) ).

Thus, the conversion server 20 that has calculated the conversion key registers the conversion key in the conversion key storage unit 225 of the storage device 201 as “a conversion key from the user terminal C10_3 to the user terminal A10_1” (S009).

In this way, the conversion key is registered in the conversion server 20, but after that, the conversion key registered in the conversion server 20 may be unnecessary for the user. For example, when there is a request to quickly delete a conversion key related to a contract partner whose previous business relationship has been canceled and the future contact schedule has disappeared, or a communication partner suspected of information leakage, etc. Is applicable.

Therefore, the processing related to the deletion of the conversion key will be described with reference to the drawings. FIG. 6 is a sequence diagram showing a processing procedure example 2 of the cryptographic processing method of the present embodiment. Specifically, the conversion key registered in the conversion server 20 by the conversion key deletion application from the user terminal A10_1. FIG. 6 is a sequence diagram showing a flow until deleting a conversion key and a flow until deleting a conversion key by a conversion key deletion application from a user terminal C10_3.

In this case, for example, it is assumed that the user terminal A10_1 has transmitted to the conversion server 20 a conversion key deletion application including a request to delete the “conversion key for the user terminal A10_1 from the user terminal C10_3” ( S101).

On the other hand, the conversion server 20 that has received this conversion key deletion application from the user terminal A10_1 searches the conversion key storage unit 225 for a corresponding conversion key corresponding to the combination of the user terminal C10_3 and the user terminal A10_1, The corresponding conversion key “h (K _a , ID _c ) ● h (K _c , ID _a ) ⁻¹ ” is identified and deleted (S102).

Similarly, it is assumed that the user terminal C10_3 transmits to the conversion server 20 a conversion key deletion application including a request to delete the “conversion key for the user terminal A10_1 from the user terminal C10_3” ( S103).

On the other hand, the conversion server 20 that has received the conversion key deletion application from the user terminal C10_3 searches the conversion key storage unit 225 for a corresponding conversion key corresponding to the combination of the user terminal A10_1 and the user terminal C10_3, and The corresponding conversion key “h (K _a , ID _c ) ● h (K _c , ID _a ) ⁻¹ ” is identified and deleted (S104).

Next, processing when performing secure communication between the user terminals 10 via the above-described conversion server 20 will be described. FIG. 7 is a schematic diagram showing the overall flow of the process described above until the message M is sent from the user terminal C10_3 via the conversion server 20 to the user terminal A10_1. FIG. 8 is a sequence diagram showing a processing procedure example 3 of the encryption processing method according to the present embodiment. Specifically, an encryption message addressed to the user terminal A10_1 is uploaded from the user terminal C10_3 to the conversion server 20. FIG. 10 is a sequence diagram showing a flow until the conversion server 20 re-encrypts the encrypted message for the user terminal A10_1.

In this case, the user terminal C10_3 that has received a communication start instruction or the like by the user with the input device 105 creates a message M addressed to the user terminal A10_1 that is the communication partner indicated by the above instruction (S201). For example, the message M is created by processing the user-derived text data or text file received by the input device 105 in accordance with a predetermined communication protocol in the network 30, and processing the communication packet. It corresponds to the process to generate.

Next, the user terminal C10_3 generates its own private key “K _c ” managed by the key storage unit 126 and the public ID storage unit 125 in order to generate an encryption key used for communication with the user terminal A10_1. “ID _a ”, which is the public ID of the user terminal A10_1 managed in FIG. 1, is input to the hash function, and a hash value “h (K _c , ID _a )” as an encryption key is calculated (S202). .

Further, the user terminal C10_3 encrypts the message M created in step S201 described above using the encryption key “h (K _c , ID _a )” calculated in step S202, and the ciphertext “f (h (K ( _c , ID _a ), M) "are generated (S203).

The user terminal C10_3 sends the ciphertext “f (h (K _c , ID _a ), M)” addressed to the user terminal A10_1 generated in step S203 described above to the conversion server 20 (S204).

On the other hand, the conversion server 20 that has received the ciphertext “f (h (K _c , ID _a ), M)” uses the combination of the user terminal C10_3 and the user terminal A10_1 as a key, and the conversion key storage unit 225 converts the conversion key. And a “conversion key h (K _a , ID _c ) ● h (K _c , ID _a ) ⁻¹ ” from the user terminal C10_3 to the user terminal A10_1 is specified (S205).

Also, the conversion server 20 re-encrypts the ciphertext sent from the user terminal C10_3 using the conversion key specified in step S205 described above (S206). The recipher text obtained by this re-encryption has the following configuration due to the nature of each operator.

Reciphertext: f (h (K _a , ID _c ) h (K _c , ID _a ) ⁻¹ , f (h (K _c , ID _a ), M)) = f ((((h (K _a , ID _c ) ● h (K _c , ID _a ) ⁻¹ ) ● h (K _c , ID _a )), M) = f (h (K _a , ID _c ), M)
The conversion server 20 that has obtained the re-ciphertext saves the re-ciphertext in the re-ciphertext storage unit 226 in the storage device 201 and prepares for transfer to the user terminal A10_1 that is the communication partner of the user terminal C10_3.

Therefore, the flow in which the user terminal A10_1 decrypts the re-ciphertext stored in the conversion server 20 for the user terminal A10_1 and acquires the message will be described. FIG. 9 is a sequence diagram showing a processing procedure example 4 of the cryptographic processing method of the present embodiment. Specifically, the user terminal A10_1 decrypts the re-encrypted text re-encrypted for the user terminal A10_1. FIG. 11 is a sequence diagram showing a flow until a message is acquired.

In this case, the user terminal A10_1 transmits a confirmation request as to whether or not there is a new message addressed to itself to the conversion server 20 (S300). This confirmation request may be transmitted when the user terminal A10_1 receives an instruction from the user through the input device 105, or when the arrival of a predetermined period is detected by a clock function or the like. Good.

On the other hand, the conversion server 20 that has received the confirmation request from the user terminal A10_1 searches the re-ciphertext storage unit 226 of the storage device 201 for a message addressed to the user terminal A10_1 based on the ID of the user terminal A10_1. The search result is returned (S301).

The user terminal A10_1 that has received the search result from the conversion server 20 notifies the conversion server 20 of an acquisition instruction for the corresponding message when the search result indicates the presence of a new message addressed to the user terminal A10_1. Then, the re-ciphertext “f (h (K _a , ID _c ), M)” from the user terminal C10_3 is acquired (S302).

The user terminal A10_1 that has obtained the re-encrypted text from the user terminal C10_3 generates its own private key “K _a that is managed by the key storage unit 126 in order to generate a decryption key with the user terminal C10_3. And “ID _c ”, which is the public ID of the user terminal C10_3 managed by the public ID storage unit 125, is input to the hash function, and the hash value “h (K _a , ID _c )” is used as the decryption key. Is calculated (S303).

In addition, the user terminal C10_3 uses the reciprocal “h (K _a , ID _c ) ⁻¹ ” of the decryption key obtained in step S303 described above to use the re-ciphertext “f (h) obtained in step S302 described above. The message M is acquired by decrypting (K _a , ID _c ), M) ”(S304). At this time, the decoding process is as follows.

f (h (K _a , ID _c ) ⁻¹ , f (h (K _a , ID _c ), M)) = f (h (K _a , ID _c ) ⁻¹ ● h (K _a , ID _c )) , M) = f (1, M) = M
In the above description, the data communication between the two parties, the user terminal C10_3 that is the message transmission source and the user terminal A10_1 that is the reception destination of the message, has been described. On the other hand, the encryption system 1 of the present embodiment is also used in a situation where the user terminal B10_2 browses a re-encrypted text addressed to the user terminal A10_1 as a proxy for the user terminal A10_1 at the receiving destination, that is, a situation where proxy browsing is required. Is available. Therefore, processing relating to such proxy browsing will be described with reference to FIGS.

FIG. 10 is a sequence diagram illustrating a processing procedure example 5 of the cryptographic processing method according to the present embodiment. Specifically, the user terminal B10_2 browses the re-ciphertext sent to the user terminal A10_1 as a proxy. FIG. 6 is a sequence diagram showing a flow until registration of a conversion key for proxy browsing in the conversion server 20 in order to do so.

In this case, the user terminal A10_1 makes an agent registration application to notify the conversion server 20 that the user terminal B10_2 is a proxy user terminal (S401). This agent registration application is for granting authority that the user terminal B10_2 can perform proxy browsing for messages addressed to the user terminal A10_1 from the user terminal C10_3.

On the other hand, the conversion server 20 that has received such agent registration application information generates a random number p '(S402) and sends the random number p' to the user terminal A10_1 (S403).

On the other hand, the user terminal A10_1 that has received the random number p ′ described above has its own secret key “K _a ” managed by the key storage unit 126 in order to generate an encryption key with the user terminal B10_2, “ID _c ”, which is the public ID of the user terminal C10_3 managed by the public ID storage unit 125, is input to the hash function, and a hash value “h (K_a, ID_c)”, which is a decryption key, is calculated ( S404). This hash value becomes a decryption key when the user terminal A10_1 uses the user terminal C10_3 as a communication partner.
The user terminal A10_1 that has calculated the decryption key masks the reciprocal number of the decryption key using the random number p ′ sent from the conversion server 20, and uses the masked encryption key “p ′ ● h ( K _a , ID _c ) ^-1 "is calculated and sent to the user terminal B10_2 (S405).

On the other hand, the user terminal B10_2 that has received the masked encryption key described above has its own private key “K” managed by the key storage unit 126 in order to generate a decryption key used for communication with the user terminal A10_1. _b ”and“ ID _a ”which is the public ID of the user terminal A10_1 managed by the public ID storage unit 125 are input to the hash function, and the hash value“ h (K _b , ID _a) which is the decryption key is input. ) "Is calculated (S406). This hash value becomes a decryption key when the user terminal B10_2 uses the user terminal A10_1 as a communication partner.

The user terminal B10_2 that has calculated the decryption key in this way uses the decryption key to mask the masked encryption key sent from the user terminal A10_1, and the value “h (K _b , ID _a ) ●. p ′ ● h (K _a , ID _c ) ⁻¹ ”is calculated and sent to the conversion server 20 as a masked conversion key (S407).

On the other hand, the conversion server 20 receives the above-described masked conversion key from the user terminal B10_2, performs a mask process on the masked conversion key using the reciprocal number of the random number p ′, and converts the conversion key “p ′ ⁻¹ ”. ● h (K _b , ID _a ) ● p ′ ● h (K _a , ID _c ) ⁻¹ = h (K _b , ID _a ) ● h (K _a , ID _c ) ⁻¹ ”is calculated (S408) .

The conversion server 20 registers the conversion key (agent conversion key) calculated in this way in the conversion key storage unit 225 of the storage device 201 as a “conversion key for the user terminal A10_1 to the user terminal B10_2” (S409). ). The process of deleting the conversion key for proxy browsing from the conversion server 20 will be described later.

Next, a process in which the above-described user terminal B10_2, which is a proxy user terminal having proxy browsing authority, performs proxy browsing of a message addressed to the user terminal A10_1 will be described with reference to the drawings. FIG. 11 is a sequence diagram showing a processing procedure example 6 of the cryptographic processing method according to the present embodiment. Specifically, the user terminal B10_2 browses the re-ciphertext sent to the user terminal A10_1 as a proxy. It is a sequence diagram which shows the flow until it does.

In this case, the user terminal B10_2 having the authority of proxy browsing makes a proxy browsing application including a confirmation request as to whether there is a new message addressed to the user terminal A10_1 to the conversion server 20 (S501). The transmission of the proxy browsing application including the confirmation request may be executed by the user terminal B10_2 in response to the user's instruction at the input device 105, or the arrival of a predetermined period is detected by a clock function or the like. May be executed.

On the other hand, the conversion server 20 that has received the proxy browsing application from the user terminal B10_2 searches the re-ciphertext storage unit 226 of the storage device 201 for a message addressed to the user terminal A10_1 based on the ID of the user terminal A10_1. (S502).

As a result of this search, if there is a corresponding new message in the re-ciphertext storage unit 226, the conversion server 20 reads from the conversion key storage unit 225 "the conversion key for the user terminal A10_1 to the user terminal B10_2" h ( K _b , ID _a ) ● h (K _a , ID _c ) ^-1 "is searched (S502).

The conversion server 20 further re-encrypts, that is, re-re-encrypts the re-encrypted text addressed to the user terminal A10_1 searched for as a new arrival message using the conversion key searched in step S502 (S503). . The re-re-ciphertext obtained in this way is as follows due to the nature of each operator.

f (h (K _b , ID _a ) ● h (K _a , ID _c ) ⁻¹ , f (h (K _a , ID _c ), M)) = f ((((h (K _b , ID _a ) ● h (K _a , ID _c ) ⁻¹ ) • h (K _a , ID _c )), M) = f (h (K _b , ID _a ), M)
On the other hand, the user terminal B10_2 requests the conversion server 20 for a re-re-encrypted text “f (h (K _b , ID _a ), M)” addressed to the user terminal A10_1 and acquires it (S504). ). Also, the user terminal B10_2 manages its own private key “K _b ” managed by the key storage unit 126 and the public ID storage unit 125 in order to generate a decryption key for the user terminal A10_1. The public ID “ID _a ” of the user terminal A10_1 is input to the hash function, and the hash value “h (K _b , ID _a )” that is the decryption key is calculated (S505).

The user terminal B10_2 that has calculated the decryption key decrypts the above-mentioned re-re-encrypted text using the reciprocal number “h (K _b , ID _a ) ⁻¹ ” of the decryption key, and acquires the message M (S506). . This decoding process is as follows.

f (h (K _b , ID _a ) ⁻¹ , f (h (K _b , ID _a ), M)) = f (h (K _b , ID _a ) ⁻¹ ● h (K _b , ID _a )) , M) = f (1, M) = M
In this way, the user terminal B10_2 having proxy browsing authority can securely browse the message addressed to the user terminal A10_1.

Next, the agent conversion key deletion process will be described. FIG. 12 is a sequence diagram showing a processing procedure example 7 of the cryptographic processing method according to the present embodiment. Specifically, it is registered in the conversion server 20 by an agent conversion key deletion application from the user terminal A10_1. From the flow until the agent conversion key related to the user terminal B10_2 as the proxy terminal is deleted and the application for deleting the agent conversion key from the user terminal B10_2, It is a sequence diagram which shows a flow.

In this case, for example, the user terminal A10_1 sends a conversion key deletion application including a request to delete the “conversion key for the agent relating to the combination of the user terminal B10_2 and the user terminal A10_1” to the conversion server 20. (S601).

On the other hand, the conversion server 20 that has received the conversion key deletion application from the user terminal A10_1 searches the conversion key storage unit 225 for a corresponding conversion key corresponding to the combination of the user terminal B10_2 and the user terminal A10_1. The corresponding conversion key “h (K _b , ID _a ) ● h (K _a , ID _c ) ⁻¹ ” is identified and deleted (S602).

Similarly, the conversion terminal 20 applies a conversion key deletion application including a request for the user terminal B10_2 to delete the “conversion key for the agent relating to the combination of the user terminal A10_1 and the user terminal B10_2”. (S603).

On the other hand, the conversion server 20 that has received the conversion key deletion application from the user terminal B10_2 searches the conversion key storage unit 225 for a corresponding conversion key corresponding to the combination of the user terminal B10_2 and the user terminal A10_1. The corresponding conversion key “h (K _b , ID _a ) ● h (K _a , ID _c ) ⁻¹ ” is identified and deleted (S604).

The best mode for carrying out the present invention has been specifically described above. However, the present invention is not limited to this, and various modifications can be made without departing from the scope of the present invention. For example, the present invention can be applied to the My Portal system in the social security / tax number system that the Japanese government is considering. When applying to My Portal, the function of the conversion server 20 of the present invention may be built on the same physical device as one function of My Portal, or physically separated from My Portal. The function of the conversion server 20 of the present invention may be constructed on another device simply by bridging data.

According to the present embodiment, the encryption key and the decryption key for encrypting and decrypting data are dynamically generated from the user's own private key and the public ID information of the communication partner. Each user can have only one secret information (secret key) that should be constantly managed. In other words, even in a common key encryption-based protocol where encryption processing is relatively fast, the confidential information (secret key) to be managed by each user is made one as in the case of the public key encryption-based protocol. Can be improved.

Therefore, it is possible to provide an encryption technology excellent in reducing the burden of managing confidential information for each user while ensuring an appropriate high speed of the encryption processing.

記載 At least the following will be made clear by the description in this specification. That is, in the cryptographic processing method of the present embodiment, the server receives a message encrypted with the key from the terminal, and uses the conversion key that is a commutative function held for each combination of terminals, The message may be re-encrypted for the destination terminal indicated by the received message, and the re-encrypted message may be transmitted to the destination terminal.

According to this, the server can efficiently mediate secure communication between terminals, and the number of secret keys managed as secret information at each terminal can be minimized. In addition, the server itself is configured not to decrypt messages from the intermediary terminal, and the risk of information leakage on the server side is also suppressed.

Further, in the cryptographic processing method according to the present embodiment, the server returns a predetermined value to the predetermined terminal in response to the conversion key registration request from the predetermined terminal, and the predetermined terminal masked with the predetermined value. A predetermined key obtained by further masking the reciprocal number of the key with the key of the other terminal is received from the other terminal, and an exchange law based on the predetermined value is applied to the received predetermined key to obtain the key of the predetermined terminal. A conversion key obtained by masking the reciprocal with the key of the other terminal may be calculated, and the conversion key may be stored in the storage device.

According to this, in the server, it is possible to hold a conversion key for each combination according to the request of the terminal user for each terminal that is a communication mediation target. Accordingly, the server does not hold unnecessary conversion keys between terminals that are not scheduled to perform communication, and waste of resources used for conversion key management in the server can be eliminated, and efficient conversion key management can be realized.

Further, in the cryptographic processing method according to the present embodiment, the predetermined terminal transmits a conversion key registration request to the server regarding the combination of the predetermined terminal and another terminal that can be a communication partner, and the server When a value is returned to the predetermined terminal, a random number corresponding to the predetermined value is generated in response to a registration request from the predetermined terminal, the random number is returned to the predetermined terminal, and the predetermined terminal is the other terminal serving as a communication partner The public information and its own secret information are applied to a one-way function to generate an output value as an encryption key, and a masked encryption key obtained by masking the reciprocal of the encryption key with the random number is transmitted to the other terminal. The other terminal applies the public information of the predetermined terminal as a communication partner and its own secret information to a one-way function, generates an output value as a decryption key, and masks the masked encryption key with the decryption key Process The masked conversion key is transmitted to the server, and the server applies an exchange law using the random number to the masked conversion key received from the other terminal, and masks the encryption key with the decryption key. It is also possible to calculate the converted key and store the converted key in a storage device.

According to this, it is possible to securely perform the process of generating and registering the conversion key according to the user request, and it is possible to improve the degree of security as a whole encryption processing method.

Further, in the cryptographic processing method of the present embodiment, the server receives a deletion request regarding a predetermined other terminal paired with the corresponding terminal among the conversion keys from any one of the terminals, A search may be executed in the storage device using the combination information of the terminal indicated by the deletion request and the predetermined other terminal as a key, and the conversion key specified in the search may be deleted from the storage device.

According to this, in the server, between terminals that are not scheduled to communicate or other users who want to cut off communication as a terminal user, the risk of information leakage is not in line with user intentions due to holding unnecessary conversion keys. You can avoid the risk of intermediary of invited communications. In addition, it is possible to realize efficient conversion key management by eliminating waste of resources used for conversion key management in the server.

Further, in the cryptographic processing method of the present embodiment, the server returns a predetermined value to the predetermined terminal in response to a registration request for the commutative function related to the proxy terminal of the predetermined terminal from the predetermined terminal, and the predetermined terminal The reciprocal number of the first key based on the public information of the proxy terminal and the secret information of the predetermined terminal, masked with a value, is the second key based on the public information of the predetermined terminal and the secret information of the proxy terminal. Further, the masked third key is received from the proxy terminal, an exchange law based on the predetermined value is applied to the received third key, and the reciprocal of the first key is masked by the third key. Calculate the processed agent commutability function, store the agent commutability function in a storage device, and in response to a request for browsing the message addressed to the predetermined terminal from the proxy terminal, A combination of a proxy terminal and the predetermined terminal The proxy commutability function that is stored in relation to the message is specified in the storage device, and the re-encrypted message having the commutability for the predetermined terminal is further encrypted by the agent commutability function. The re-encrypted message is transmitted to the proxy terminal, the proxy terminal receives the re-re-encrypted message transmitted from the server, and the received re-re-encrypted message is transmitted to the proxy terminal. It is also possible to decrypt with two keys.

According to this, it is possible to securely view a message addressed to the relevant party not only between the terminals of the parties that are the original communication partners but also by the terminal operated by the agent.

Further, in the cryptographic processing method of the present embodiment, the predetermined terminal transmits a registration request for the agent commutability function to the server regarding the combination of the proxy predetermined terminal and the proxy terminal, and the server When the predetermined value is returned to the predetermined terminal, a random number corresponding to the predetermined value is generated in response to the registration request, and the random number is returned to the predetermined terminal. The predetermined terminal receives the public information of the proxy terminal and Applying its own secret information to a one-way function, generating an encryption key as the first key, transmitting a masked encryption key obtained by masking the reciprocal of the encryption key with the random number to the proxy terminal, and The terminal applies public information of the predetermined terminal and its own secret information to a one-way function, generates a decryption key as the second key, and performs masking conversion by masking the masked encryption key with the decryption key Key to the server And the server applies the exchange rule using the random number to the masked conversion key received from the proxy terminal, and masks the encryption key with the decryption key. Alternatively, the proxy conversion key may be calculated, and the proxy conversion key may be stored in the storage device.

According to this, it becomes possible to generate and manage the conversion key in the server not only between the terminals of the parties that are the original communication partners but also the combination of the terminal operated by the agent and the corresponding party. . Therefore, the conversion key generation and registration processing relating to the proxy terminal in response to the user request can be performed securely, and the overall encryption processing method can be improved while allowing message browsing by the proxy terminal. .

Further, in the cryptographic processing method according to the present embodiment, the server receives, from any one of the terminals, a deletion request related to the proxy terminal associated with the corresponding terminal among the conversion keys, and A search may be performed in the storage device using the combination information of the terminal and the proxy terminal indicated by the deletion request as a key, and the conversion key specified in the search may be deleted from the storage device.

According to this, in the server, the conversion key that is no longer needed is securely deleted between the proxy terminal and the terminal of the party that has permitted message browsing by the proxy terminal, and the unnecessary conversion key is retained in the server. Accordingly, it is possible to avoid the risk of mediating communication by a proxy terminal that does not follow the user's intention and invites even the risk of information leakage. In addition, it is possible to realize efficient conversion key management by eliminating waste of resources used for conversion key management in the server.

Further, in the encryption system of the present embodiment, a message encrypted with the key is received from a storage device storing a conversion key that is a commutative function corresponding to each combination of terminals, and the predetermined terminal, and the predetermined The storage device identifies a conversion key stored for the combination of the terminal and the destination terminal indicated by the received message, and re-encrypts the message for the destination terminal using the corresponding conversion key. The server may further include an arithmetic unit that executes and transmits the re-encrypted message to the destination terminal.

According to this, in the cryptographic system, secure communication between terminals can be efficiently mediated by the server, and the number of secret keys managed as secret information at each terminal can be suppressed to the minimum. In addition, the server itself is configured not to decrypt messages from the intermediary terminal, and the risk of information leakage on the server side is also suppressed.

In the encryption system according to the present embodiment, the server returns a predetermined value to the predetermined terminal in response to the conversion key registration request from the predetermined terminal, and the key of the predetermined terminal masked with the predetermined value. A predetermined key obtained by further masking the reciprocal number of the key with the key of the other terminal is received from the other terminal, and the reciprocal number of the key of the predetermined terminal is applied to the received predetermined key based on the exchange rule based on the predetermined value. The conversion key obtained by masking with the key of the other terminal may be calculated, and the conversion key may be stored in the storage device.

According to this, in the cryptographic system, the server can hold the conversion key for each combination according to the request of the terminal user with respect to each terminal that is a communication mediation target. Accordingly, the server does not hold unnecessary conversion keys between terminals that are not scheduled to perform communication, and waste of resources used for conversion key management in the server can be eliminated, and efficient conversion key management can be realized.

Further, in the server according to the present embodiment, the arithmetic device returns a predetermined value to the predetermined terminal in response to the conversion key registration request from the predetermined terminal, and the key of the predetermined terminal masked with the predetermined value. A predetermined key obtained by further masking the reciprocal number of the key with the key of the other terminal is received from the other terminal, and the reciprocal number of the key of the predetermined terminal is applied to the received predetermined key based on the exchange rule based on the predetermined value. The conversion key obtained by masking with the key of the other terminal may be calculated, and the conversion key may be stored in the storage device.

Claims

At each terminal that communicates with each other, the output value of the one-way function related to the public information of the communication partner and its own secret information is used as a key. When sending a message, the target message is encrypted with the key and transmitted to a predetermined server. And, when receiving a message, an encryption processing method for receiving a message re-encrypted for the terminal from the server and decrypting the received message with its own key.
In the server, a message encrypted with the key is received from the terminal, and a conversion key that is a commutative function held for each combination of terminals is used for a destination terminal indicated by the received message. The cryptographic processing method according to claim 1, wherein re-encryption of the message is executed, and the re-encrypted message is transmitted to the destination terminal.
In the server, a predetermined value is returned to the predetermined terminal in response to the conversion key registration request from the predetermined terminal, and the reciprocal number of the key of the predetermined terminal masked with the predetermined value is further masked with the key of the other terminal The processed predetermined key is received from the other terminal, the exchange rule based on the predetermined value is applied to the received predetermined key, and the reciprocal number of the key of the predetermined terminal is masked with the key of the other terminal Calculating a conversion key and storing the conversion key in a storage device;
The cryptographic processing method according to claim 2.
In the predetermined terminal, regarding the combination of the predetermined terminal and another terminal that can be a communication partner, the registration request for the conversion key is transmitted to the server,
In the server, when returning the predetermined value to the predetermined terminal, a random number corresponding to the predetermined value is generated in response to a registration request from the predetermined terminal, and the random number is returned to the predetermined terminal.
In the predetermined terminal, the public information of the other terminal as a communication partner and its own secret information are applied to a one-way function, an output value as an encryption key is generated, and the reciprocal number of the encryption key is masked with the random number. Send the masked encryption key to the other terminal,
In the other terminal, the public information of the predetermined terminal as a communication partner and its own secret information are applied to a one-way function, an output value is generated as a decryption key, and the masked encryption key is masked with the decryption key Send the masked conversion key to the server,
In the server, the conversion key using the random number is applied to the masked conversion key received from the other terminal, the conversion key obtained by masking the encryption key with the decryption key is calculated, and the conversion key is Store in storage device,
The encryption processing method according to claim 3.
In the server, from one of the terminals, a deletion request related to a predetermined other terminal that is paired with the corresponding terminal among the conversion keys is received, and the terminal indicated by the deletion request and the predetermined other 5. The encryption processing method according to claim 4, wherein a search is executed in the storage device using the combination information with the terminal as a key, and the conversion key specified in the search is deleted from the storage device.
In the server,
In response to a registration request for the commutability function related to the proxy terminal of the predetermined terminal from the predetermined terminal, a predetermined value is returned to the predetermined terminal, and the public information of the proxy terminal masked with the predetermined value and the public information Receive from the proxy terminal a third key further masked with a second key based on the public information of the predetermined terminal and the second key based on the secret information of the proxy terminal, based on the reciprocal of the first key based on the secret information of the predetermined terminal Then, an exchange law based on the predetermined value is applied to the received third key, and a proxy commutability function for masking the reciprocal of the first key with the third key is calculated. Storing the human commutative function in a storage device;
In response to a request for a record of a message addressed to the predetermined terminal from the proxy terminal, a proxy function for the proxy held for the combination of the proxy terminal and the predetermined terminal is specified in the storage device, Further encrypt the message re-encrypted with commutability for the predetermined terminal by the agent commutability function, and send the re-encrypted message to the proxy terminal.
In the proxy terminal,
Receiving the re-re-encrypted message sent from the server and decrypting the received re-re-encrypted message with the second key;
The cryptographic processing method according to claim 1.
In the predetermined terminal, regarding the combination of the proxy predetermined terminal and the proxy terminal, a registration request for the proxy commutability function is transmitted to the server,
In the server, when the predetermined value is returned to the predetermined terminal, a random number corresponding to the predetermined value is generated in response to the registration request, and the random number is returned to the predetermined terminal.
In the predetermined terminal, the public information of the proxy terminal and its own secret information are applied to a one-way function, an encryption key as the first key is generated, and masking is performed by masking the reciprocal number of the encryption key with the random number. Send the encryption key to the proxy terminal;
In the proxy terminal, a mask obtained by applying the public information of the predetermined terminal and its own secret information to a one-way function, generating a decryption key as the second key, and masking the masked encryption key with the decryption key Send the conversion key to the server,
In the server, an agent that is a commutative function for an agent that masks the encryption key with the decryption key by applying an exchange rule using the random number to the masked conversion key received from the agent terminal Calculate the conversion key for the agent and store the conversion key for the agent in the storage device.
The cryptographic processing method according to claim 6.
In the server, from one of the terminals, a deletion request related to a proxy terminal associated with the corresponding terminal among the conversion keys is received, and the terminal indicated by the deletion request and the proxy terminal The cryptographic processing method according to claim 7, wherein a search is executed in the storage device using the combination information as a key, and the agent conversion key specified in the search is deleted from the storage device.
A communication device for communicating with other terminals;
A storage device storing its own secret information;
A process of inputting public information about a communication partner and the secret information read from the storage device into a one-way function, and obtaining an output value of the one-way function as a key;
When transmitting a message to a communication partner terminal, a process of encrypting a target message with the key and transmitting it to a predetermined server;
When receiving a message from a terminal of a communication partner, an operation for receiving a message re-encrypted for the terminal from the server and decrypting the received message with the key Equipment,
A cryptographic system including a terminal comprising:
A storage device that stores a conversion key that is a commutative function corresponding to each combination of terminals;
A message encrypted with the key is received from a predetermined terminal, and a conversion key stored for a combination of the predetermined terminal and a destination terminal indicated by the received message is specified in a storage device, An arithmetic device that performs re-encryption of the message for the destination terminal with the corresponding conversion key, and transmits the re-encrypted message to the destination terminal;
The encryption system according to claim 9, further comprising a server comprising:
The server returns a predetermined value to the predetermined terminal in response to the conversion key registration request from the predetermined terminal, and further masks the reciprocal number of the key of the predetermined terminal masked with the predetermined value with the key of the other terminal. The processed predetermined key is received from the other terminal, the exchange rule based on the predetermined value is applied to the received predetermined key, and the reciprocal number of the key of the predetermined terminal is masked with the key of the other terminal A conversion key is calculated and the conversion key is stored in a storage device.
The cryptographic system according to claim 10.
A communication device that communicates with a terminal that uses a key, which is an output value of a one-way function related to the public information of the communication partner and its own secret information, for message encryption and decryption,
A storage device that stores a conversion key that is a commutative function corresponding to each combination of terminals;
A process of receiving, from the predetermined terminal, a message encrypted with the key relating to the public information of the communication partner of the predetermined terminal and the secret information of the predetermined terminal itself;
The storage device identifies a conversion key stored for the combination of the predetermined terminal and the destination terminal indicated by the received message, and re-encrypts the message for the destination terminal using the corresponding conversion key And a processing unit that executes processing for transmitting the re-encrypted message to the destination terminal;
A server comprising
The computing device returns a predetermined value to the predetermined terminal in response to the conversion key registration request from the predetermined terminal, and further uses the key of the other terminal for the reciprocal number of the key of the predetermined terminal masked with the predetermined value. Receiving the masked predetermined key from the other terminal, applying an exchange law based on the predetermined value to the received predetermined key, and masking the reciprocal of the key of the predetermined terminal with the key of the other terminal The calculated conversion key is calculated, and the conversion key is stored in the storage device.
The server according to claim 12.