WO2015156145A1

WO2015156145A1 - Re-encryption method, re-encryption system, and re-encryption device

Info

Publication number: WO2015156145A1
Application number: PCT/JP2015/059535
Authority: WO
Inventors: 尚生坂崎; 木下　照己
Original assignee: 株式会社日立製作所
Priority date: 2014-04-09
Filing date: 2015-03-27
Publication date: 2015-10-15
Also published as: JP2015201773A; CN106031083A

Abstract

For each message sender and for each field of message, viewing of a message by a message receiver is controlled. In a user terminal (10-3) of a user C as a message sender, a secret key of a user terminal (10-1) of a user A as a message receiver and an encryption key including an ID for identifying the user terminal (10-1) as a communication partner of the user terminal (10-3) and an ID for identifying a message field (δ) are used to encrypt a message. In the user terminal (10-1) that receives the message, an encryption message generated by using a conversion key by a conversion server (20) is decrypted with the secret key of the user terminal (10-1) and a decryption key including an ID for identifying the user terminal (10-3) as the communication partner of the user terminal (10-1) and the ID for identifying the message field (δ), and an original message is extracted.

Description

Re-encryption method, re-encryption system, and re-encryption device

The present invention relates to a re-encryption method, a re-encryption system, and a re-encryption device that re-encrypt ciphertext.

Conventionally, a message can be sent safely by re-encrypting it into a ciphertext that can be decrypted with the private key of another user terminal without decrypting the ciphertext of a message addressed to a user terminal during transmission. A technique called proxy re-encryption technique is known (for example, see Patent Document 1). In recent years, this proxy re-encryption technique has attracted attention as a technique that allows data to be shared more securely on a cloud service.

WO2012 / 147869

∙ You may want to control message browsing by message recipients for each message sender and message field. As a specific example, for example, there may be a case where a certain citizen is notified only of a message regarding the tax field from the National Tax Agency or a local government, and does not want to notify a message from another message sender or a message in another field. However, in the above prior art, since the re-encryption key is registered in the server for each user device, the ciphertext generated for the specific user device can be decrypted by all user devices having the re-encryption key, The browsing of messages by message recipients cannot be controlled by message sender and message field.

Also, in actual business, the agent may perform various processes on behalf of the principal, and if the data is encrypted for the principal, the agent may not be able to perform the act of proxy. Therefore, an encryption technology is also desired in which encrypted data addressed to the principal can be viewed by the representative of the principal.

However, in the above prior art, since the re-encryption key is registered in the server for each user device, all the ciphertext addressed to the first user device can be decrypted by the second user device, and the first user Of the ciphertext addressed to the device, control such as allowing the second user device to permit only the ciphertext from a specific user device cannot be performed. Also, it is not possible to perform control such as allowing the second user device to permit decryption of only ciphertexts related to the same field among ciphertexts destined for the first user device.

More specifically, the situation of this problem will be explained using an example. For example, a user device that sends a message is a device that is managed by the NTA and local government, a first user device is a device that is managed by a taxpayer, and a second user device is a device that is managed by an agent such as a tax accountant. Assume a case. In this case, in the prior art, the agent can decrypt all the ciphertext addressed to the taxpayer regardless of the contents. Originally, when the taxpayer has given the agent the authority to act on taxes, only the ciphertext sent to the taxpayer from the National Tax Agency or the ciphertext sent to the taxpayer from the local government is related to the tax field. There is a request to allow an agent to perform decryption and act as an agent.

The present invention has been made in view of such circumstances, and a re-encryption method, a re-encryption system, and a re-encryption for controlling message viewing by a message receiver for each message sender and message field. An object is to provide an apparatus.

A typical example of the present invention is as follows. That is, the present invention is a re-encryption method in a re-encryption system including a plurality of user terminals and a re-encryption apparatus connected to the user terminals via a network. The first user terminal includes a secret key of the first user terminal, information for identifying the second user terminal of the communication partner, and information for identifying the field of the message addressed to the second user terminal An encryption key is generated, the message is encrypted using the encryption key, and the encrypted message is transmitted to the re-encryption device via the network. The re-encryption device receives the encrypted message from the first user terminal via the network, and uses the first conversion key stored in the storage unit for the received encrypted message. Re-encryption is performed, and the re-encrypted message is stored in the storage unit. The second user terminal receives the re-encrypted message from the re-encryption device via the network, the second user terminal's private key, and the communication partner's first user terminal A decryption key including information identifying the message and information identifying the field of the message is generated, and the re-encrypted message is decrypted using the decryption key to obtain the original message.

According to the present invention, it is possible to control browsing of messages by message receivers for each message sender and message field.

It is a figure which shows the function structural example of each computer which comprises the re-encryption system whole structure example and re-encryption system which concern on one Embodiment of this invention. FIG. 10 is a sequence diagram showing a conversion key registration method used when the conversion server 20 re-encrypts the ciphertext relating to the message field δ. The user terminal 10-3 generates a message M related to the message field δ addressed to the user terminal 10-1 and its ciphertext, transmits the generated ciphertext to the conversion server 20, and the conversion server 20 re-encrypts the ciphertext. It is a sequence diagram which shows the flow of a process until it encrypts. FIG. 6 is a sequence diagram showing a flow from decrypting a re-ciphertext by the user terminal 10-1 to obtaining a message M in the message field δ. 6 is a sequence diagram showing a flow until registration of a conversion key for proxy browsing of a message M in the conversion server 20. FIG. FIG. 6 is a sequence diagram showing a flow from when a re-ciphertext is received as a proxy by the user terminal 10-2 to obtain a message M in the message field δ. It is a figure for demonstrating the meaning of the operator used by this embodiment.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. However, this does not limit the present invention.

FIG. 1 is a diagram showing an example of the overall configuration of a re-encryption system according to an embodiment of the present invention and an example of the functional configuration of each computer constituting the re-encryption system.

In the re-encryption system according to the present embodiment, a plurality of user terminals (10-1, 10-2, 10-3) and a conversion server (re-encryption device) 20 are mutually connected via a network 30 such as the Internet. A computer network system configured to be connected. In the following, first, the functional configuration of each user terminal (10-1, 10-2, 10-3) and the conversion server 20 and the meaning of the operator used in this embodiment will be described. The user terminal 10-3 encrypts data (hereinafter referred to as a message) addressed to the user terminal 10-1 of the user A regarding a specific field (hereinafter referred to as a message field δ), and the encrypted message (hereinafter referred to as a message). A mechanism for re-encrypting the ciphertext in the conversion server 20, decrypting the re-ciphertext in the user terminal 10-1 and obtaining the message, and proxying the message by the user A A mechanism for the user terminal 10-2 of the user B who is permitted to browse to acquire the message will be described.

First, the functional configuration of each user terminal (10-1, 10-2, 10-3) will be described. As shown in FIG. 1, each user terminal (10-1, 10-2, 10-3) generates a secret key managed by each user terminal (10-1, 10-2, 10-3). Secret key generation unit 101 generates information for dynamically generating an encryption key / decryption key, etc., and registering an encryption key (hereinafter referred to as a conversion key) necessary for generating a re-encrypted text related to the message field δ. A key calculation unit 102 that performs communication, a public ID storage unit 103 that stores message attribute information such as an ID (identification) that identifies a communication partner terminal and an ID that identifies a message field δ, and a secret generated by the secret key generation unit 101 A key storage unit 104 that securely manages a key; an information generation unit 105 that generates a message to a communication partner terminal; an encryption processing unit 106 that generates a ciphertext by encrypting a message using an encryption key; Send and receive ciphertext And parts 107, a primary storage device 108 using a semiconductor (also referred to as memory), can be configured from the information display unit 109 to display a message. The ID for identifying the communication partner is not limited as long as it can identify the individual publicly, such as an e-mail address or identification number, and is assumed to be notified to the user in advance for each system to be used. The ID for identifying the message field δ is information for identifying the field to which the message belongs, such as the tax field and the social welfare field, and is notified to the user in advance for each system to be used. Each user terminal (10-1, 10-2, 10-3) having such a function can be realized by a general computer. For example, the secret key generation unit 101, the key calculation unit 102, the information generation unit 105, the cryptographic processing unit 106, and the ciphertext transmission / reception unit 107 can be realized as a computer program executed by a control unit such as a CPU (Central Processing Unit). The computer program can be distributed via a recording medium such as the network 30, a hard disk, or a flash memory device. The public ID storage unit 103 and the key storage unit 104 can be realized as, for example, a hard disk or a flash memory device. The information display unit 109 can be realized as a liquid crystal display device or an organic EL (Electro Luminescence) display, for example.

Next, the functional configuration of the conversion server 20 will be described. As shown in FIG. 1, the conversion server 20 includes a ciphertext transmission / reception unit 201 that transmits and receives ciphertext, a ciphertext uploaded to the conversion server 20 from which user terminal to which user terminal, and which A sender / receiver control unit 202 that controls whether the message is in a message field, a conversion key storage unit 203 that manages a conversion key used for re-encryption, a re-ciphertext storage unit 204 that stores a re-ciphertext, and a conversion key From a key calculation unit 205 that generates information for registering a random number, a re-encryption processing unit 206 that performs re-encryption processing, and a primary storage device 207 (also referred to as a memory) using a semiconductor. Can be configured. The conversion server 20 having such a function can be realized by a general computer. For example, the ciphertext transmission / reception unit 201, the sender / receiver control unit 202, the key calculation unit 205, and the re-encryption processing unit 206 can be realized as a computer program executed by a control unit such as a CPU. This computer program can be distributed via a recording medium such as the network 30, a hard disk, or a flash memory device. The conversion key storage unit 203 and the re-ciphertext storage unit 204 can be realized as, for example, a hard disk or a flash memory device.

Next, the meaning of the operators used in this embodiment will be described. FIG. 7 is a diagram for explaining the meaning of the operators used in this embodiment. As shown in FIG. 7, in the present embodiment, three operators of ● (901), f (,) (902), and h (,,) (903) are used. The operator ● (901) is an operator for commutative mask processing. For example, performing mask processing of data A with data B is represented as B • A. Here, the mask process refers to a process in which data B is applied to data A and converted to another value. Further, the operator ● (901) has the following properties.

(A) B ● A = A ● B
(I) C ● (B ● A) = (C ● B) ● A
(C) A ^-1 ● A = 1 (However, "1" is the unit element)
An example of an operator having such a property is xor.

, Operator f (,) (902) is an encryption processing operator that is commutative with respect to the encryption key. For example, the encryption of data A with the encryption key K (f (K, A) ). The operator f (,) (902) has the following properties.

(A) f (K1, f (K2, A)) = f ((K1 ● K2), A) = f ((K2 ● K1), A) = f (K2, f (K1, A))
(A) f (K1 ● K2, f (K3, A)) = f (K1 ● K2 ● K3, A) = f (K1, f (K2 ● K3, A)
(C) f (K ⁻¹ , f (K, A)) = f (K ⁻¹ ● K, A) = f (1, A) = A As an operator having such a property, for example, xor is is there. The operator ● (901) and the operator f (,) (902) may be used as operators for performing the same arithmetic processing, or may be used as operators for performing different arithmetic processing satisfying the above properties. Also good. Regarding the decryption process, the data A can be decrypted by re-encrypting the ciphertext using the reciprocal number (also referred to as the inverse element) of the encryption key due to the property (c).

An operator h (,,) (903) is an operator representing a hash function that receives a plurality of data as input, and for example, generating a hash value of data A, data B, and data C (h ( A, B, C)). For example, when a hash value for a value obtained by xoring data A, data B, and data C is output, h (A, B, C) = H ((A xor Bxor C)). However, H () is a hash function that receives one piece of data, for example, SHA256. If the data to be input to h () increases, the input value is further calculated by xor and input to H () (h (A, B, C, D) = H ((A （xor B xor Cxor D))).

It should be noted that these operators need only satisfy their properties, and it is not always necessary to use the example xor.

Next, the user terminal 10-3 encrypts the message addressed to the user terminal 10-1 regarding the message field δ, re-encrypts the ciphertext in the conversion server 20, and converts the re-ciphertext into the user terminal. A mechanism for obtaining the message by decoding in 10-1 will be described. FIG. 2 is a sequence diagram showing a conversion key registration method used when the conversion server 20 re-encrypts the ciphertext relating to the message field δ.

First, the user terminal 10-3 of the user C notifies the user terminal 10-1 of the user A of the content of the message related to the message field δ. An application for registration of a conversion key used when re-encrypting the ciphertext is made (step S001).

Upon receiving the conversion key registration application information, the conversion server 20 generates a random number p (step S002) and transmits the random number p to the user terminal 10-3 that is the conversion key registration application source (step S003).

Next, the conversion server 20 has its own private key Kc managed by the key storage unit 104, IDa which is a public ID for identifying the user terminal 10-1 managed by the public ID storage unit 103, and hash value h by entering the ID _[delta] identifies the hash function areas [delta] of the user terminal 10-1 addressed message (Kc, IDa, ID _[delta]) were calculated, and generates an encryption key (step S004). Next, the user terminal 10-3 masks the reciprocal number h (Kc, IDa, ID _δ ) ⁻¹ of the encryption key using the random number p received in step S003, and the value p ● h (Kc, IDa, ID _δ ) ⁻¹ is generated and transmitted to the user terminal 10-1 (step S005). In this embodiment, since the operator f (,) to be used is described as an xor function, the reciprocal number of the encryption key is masked using the random number p. However, the reciprocal number of the encryption key is not necessarily required. If the operator f (,) to be used is different, the value generated from the encryption key may be masked using the random number p as necessary.

Upon receiving the value p－１h (Kc, IDa, ID _δ ) ⁻¹ obtained by masking the value generated from the encryption key using the random number p, the user terminal 10-1 manages it in the key storage unit 104. Own secret key Ka, IDc which is a public ID for identifying the user terminal 10-3 managed by the public ID storage unit 103, and ID _δ for identifying the message field δ are input to the hash function. A hash value h (Ka, IDc, ID _δ ) is calculated and a decryption key is generated (step S006). Next, the user terminal 10-1 masks the value h (Ka, IDc, ID) obtained by masking ph (Kc, IDa, ID _δ ) ⁻¹ received from the user terminal 10-3 using the decryption key. _δ ) ● p ● h (Kc, IDa, ID _δ ) ⁻¹ is generated and transmitted to the conversion server 20 (step S007).

When the conversion server 20 receives h (Ka, IDc, ID _δ ) • p • h (Kc, IDa, ID _δ ) ⁻¹ from the user terminal 10-1, this value is masked using the inverse of the random number p. Processed and converted key p ⁻¹ ● h (Ka, IDc, ID _δ ) ● p ● h (Kc, IDa, ID _δ ) ⁻¹ = h (Ka, IDc, ID _δ ) ● h (Kc, IDa, ID _δ ) ⁻¹ is calculated (step S008). Next, the conversion server 20 sends the conversion key h (Ka, IDc, ID _δ ) ● h (Kc, IDa, ID _δ ) ⁻¹ to the field of the message addressed to the user terminal 10-1 from the user terminal 10-3. The conversion key relating to δ is registered in the conversion key storage unit 203 (step S009).

By the conversion key registration method described above, it is possible to prevent the secret key Ka managed by the user terminal 10-1 and the secret key Kc managed by the user terminal 10-3 from leaking to the conversion server 20. Thereby, it is possible to prevent the content of the message from leaking to a third party. When the conversion server 20 receives the conversion key deletion application from the user terminal 10-1 or the user terminal 10-3, the conversion server 20 deletes the corresponding conversion key from the conversion key storage unit 203.

In FIG. 3, the message M related to the message field δ addressed to the user terminal 10-1 and its ciphertext are generated by the user terminal 10-3, the generated ciphertext is transmitted to the conversion server 20, and the conversion server 20 It is a sequence diagram which shows the flow of a process until it re-encrypts a ciphertext.

First, the user terminal 10-3 generates a message M related to the message field δ addressed to the user terminal 10-1 (step S201). Next, the user terminal 10-3 has its own private key Kc managed by the key storage unit 104 and a public ID for identifying the user terminal 10-1 managed by the public ID storage unit 103. there IDa and message M hash value h by entering the ID _[delta] identifies the hash function message field [delta] of (Kc, IDa, ID _[delta]) were calculated, and generates an encryption key (step S202). Next, the user terminal 10-3 encrypts the message M using the generated encryption key h (Kc, IDa, ID _δ ), and generates a ciphertext f (h (Kc, IDa, ID _δ ), M). (Step S203). Next, the user terminal 10-3 transmits the ciphertext relating to the message field δ addressed to the user terminal 10-1 to the conversion server 20 (step S204).

When the conversion server 20 receives the ciphertext f (h (Kc, IDa, ID _δ ), M), the conversion server 20 sends the field of the message addressed to the user terminal 10-1 from the user terminal 10-3 from the conversion key storage unit 203. A conversion key h (Ka, IDc, ID _δ ) ● h (Kc, IDa, ID _δ ) ⁻¹ for _δ is acquired (step S205), and ciphertext f (h (Kc, IDa, ID _δ ), M) is re-encrypted (step S206). The re-ciphertext generated at this time is as follows due to the nature of each operator. f (h (Ka, IDc, ID _δ )) h (Kc, IDa, ID _δ ) ⁻¹ , f (h (Kc, IDa, ID _δ ), M)) = f ((((h (Ka, IDc, ID [ _delta] ) h (Kc, IDa, ID [ _delta] ) ^-1 ) h (Kc, IDa, ID [ _delta] )), M) = f (h (Ka, IDc, ID [ _delta] ), M). After generating the re-ciphertext, the conversion server 20 stores the re-ciphertext in the re-ciphertext storage unit 204.

FIG. 4 shows a flow from the user terminal 10-1 to decrypting the re-ciphertext including the message in the message field δ addressed to the user terminal 10-1 from the user terminal 10-3 and acquiring the message M. FIG.

First, the user terminal 10-1 checks whether or not a new arrival message exists in the conversion server 20 (step S301). If there is a new message, the user terminal 10-1 acquires the re-ciphertext f (h (Ka, IDc, ID _δ ), M) from the re-ciphertext storage unit 204 of the conversion server 20 (step S302). This ciphertext includes the message M in the message field δ addressed from the user terminal 10-3 to the user terminal 10-1. Next, the user terminal 10-1 generates a decryption key for decrypting the re-ciphertext (step S303). Specifically, the user terminal 10-1 identifies its own secret key Ka managed by the key storage unit 104 and the user terminal 10-3 managed by the public ID storage unit 103. A decryption key is generated by calculating a hash value h (Ka, IDc, ID _δ ) obtained by inputting IDc, which is a public ID, and ID _δ identifying the message field into a hash function. Next, the user terminal 10-1 decrypts the reciphered text f (h (Ka, IDc, ID _δ ), M) using the reciprocal h (Ka, IDc, ID _δ ) ⁻¹ of the generated decryption key. Then, the message M is acquired (step S304). At this time, the re-ciphertext decryption process is as follows. f (h (Ka, IDc, ID _δ ) ⁻¹ , f (h (Ka, IDc, ID _δ ), M)) = f (h (Ka, IDc, ID _δ ) ⁻¹ ● h (Ka, IDc, ID _δ )), M) = f (1, M) = M.

As described with reference to FIGS. 2 to 4, in this embodiment, the user terminal 10-3 identifies the secret key Kc of the user terminal 10-3 and the user terminal 10-1 that is the communication partner. to IDa and the user generates an encryption key and a ID _[delta] identifies the message field [delta] of the terminal 101 addressed message M, encrypts the message M using the encryption key, the conversion server 20 and the ciphertext Send to. The conversion server 20 re-encrypts the ciphertext using the conversion key generated in advance, and stores the re-ciphertext in the re-ciphertext storage unit 204. When the user terminal 10-1 confirms the existence of the new message M addressed to the user terminal 10-1 at the conversion server 20, the user terminal 10-1 acquires the ciphertext from the re-ciphertext storage unit 204 of the conversion server 20. The user terminal 10-1 then transmits the secret key Ka of the user terminal 10-1, the IDc for identifying the user terminal 10-3 that is the communication partner, and the message field δ of the message M addressed to the user terminal 10-1. A decryption key including ID _δ for identifying is generated, and the re-ciphertext is decrypted using this decryption key to obtain the original message M.

The user terminal 10-3 of the user C encrypts the message M addressed to the user terminal 10-1 of the user A related to the specific message field δ, and the ciphertext is re-encrypted by the conversion server 20. The mechanism for acquiring the message M by decrypting the re-ciphertext at the user terminal 10-1 has been described. By such a mechanism, only the message M related to the specific message field δ addressed to the user terminal 10-1 among the messages generated by the user terminal 10-3 is not leaked to a third party. It can be acquired at the user terminal 10-1. *

Next, a mechanism for the user terminal 10-2 of the user B who is permitted to perform proxy browsing of the message M by the user A to acquire the message M will be described with reference to FIGS.

FIG. 5 is a sequence diagram showing a flow until registration of the conversion key for proxy browsing of the message M in the conversion server 20.

First, the user terminal 10-1 of the user A gives the conversion server 20 the authority to proxy-receive the message M in the message field δ from the user terminal 10-3 to the user terminal 10-2 of the user B. An agent registration application is sent to inform the effect (step S401).

Upon receiving the agent registration application information, the conversion server 20 generates a random number p ′ (step S402) and transmits the random number p ′ to the user terminal 10-1 (step S403).

When the user terminal 10-1 receives the random number p ′, the user terminal 10-1 stores its own private key Ka managed by the key storage unit 104 and the user terminal 10-3 managed by the public ID storage unit 103. a public ID identifying IDc and message fields hash value by inputting the ID _[delta] identifies the hash function [delta] h calculated (Ka, IDc, ID _[delta]), and generates an encryption key (step S404). Next, the user terminal 10-1 uses the random number p ′ received from the conversion server 20 to generate a value p ′ · h (Ka, IDc, ID _δ ) ⁻¹ by masking the reciprocal of the decryption key, This is transmitted to the user terminal 10-2 (step S405).

When the user terminal 10-2 receives p ′ • h (Ka, IDc, ID _δ ) ⁻¹ , the user terminal 10-2 receives its own private key Kb managed by the key storage unit 104 and the public ID storage unit 103. A hash value h (Kb, IDa, ID _δ ) is calculated by inputting IDa, which is a public ID that identifies the managed user terminal 10-1, and ID _δ , which identifies the message field δ, into a hash function, and decryption A key is generated (step S406). Next, the user terminal 10-2 masks the value p ′ ● h (Ka, IDc, ID _δ ) ⁻¹ received from the user terminal 10-1 using the decryption key h (Kb, IDa). , ID _δ ) • p ′ • h (Ka, IDc, ID _δ ) ⁻¹ is generated and transmitted to the conversion server 20 (step S407).

When the conversion server 20 receives h (Kb, IDa, ID _δ ) • p ′ • h (Ka, IDc, ID _δ ) ⁻¹ , h (Kb, IDa, ID _δ ) is used using the reciprocal of the random number p ′. ● p ′ ● h (Ka, IDc, ID _δ ) ⁻¹ is masked and the conversion key p ′ ⁻¹ ● h (Kb, IDa, ID _δ ) ● p ′ ● h (Ka, IDc, ID _δ ) ^{− 1} = h (Kb, IDa, ID _δ ) ● h (Ka, IDc, ID _δ ) ⁻¹ is calculated (step S408) and registered in the conversion key storage unit 203 (step S409). Note that the conversion server 20 deletes the corresponding conversion key from the conversion key storage unit 203 when receiving the application for deleting the conversion key for proxy browsing of the message M from the user terminal 10-1 or the user terminal 10-3.

FIG. 6 is a sequence diagram showing a flow from when the user terminal 10-2 receives the re-ciphertext including the message M in the message field δ addressed to the user terminal 10-1 as a proxy and acquires the message M. .

First, the user terminal 10-2 confirms whether or not a new message M regarding the message field δ addressed to the user terminal 10-1 from the user terminal 10-3 exists in the conversion server 20 (application for proxy browsing). (Step S501).

When there is a new message M, the conversion server 20 converts the conversion key h (Kb, IDa, ID _δ ) 代理 h (Ka, IDc, ID _δ ) ⁻¹ for proxy browsing of the message M from the conversion key storage unit 203. (Step S502), and using this conversion key, the re-ciphertext relating to the message field δ addressed to the user terminal 10-1 generated in step S207 of FIG. Re-encryption is performed again to generate a ciphertext (step S503). The re-ciphertext generated at this time is as follows due to the nature of each operator. f (h (Kb, IDa, ID _δ )) h (Ka, IDc, ID _δ ) ⁻¹ , f (h (Ka, IDc, ID _δ ), M)) = f ((((h (Kb, IDa, ID [ _delta] ) h (Ka, IDc, ID [ _delta] ) ^-1 ) h (Ka, IDc, ID [ _delta] )), M) = f (h (Kb, IDa, ID [ _delta] ), M).

After confirming the new arrival message M, the user terminal 10-2 acquires the ciphertext f (h (Kb, IDa, ID _δ ), M) again from the conversion server 20 (step S504). Next, the user terminal 10-2 has its own private key Kb managed by the key storage unit 104 and a public ID for identifying the user terminal 10-1 managed by the public ID storage unit 103. hash enter the ID _[delta] identifies the hash function IDa and message fields [delta] value h (Kb, IDa, ID _[delta]) were calculated, and generates the decryption key (step S505). Next, the user terminal 10-2 decrypts the ciphertext again using the reciprocal h (Kb, IDa, ID _δ ) ⁻¹ of the decryption key, and obtains the message M (step S506). At this time, the decoding process is as follows. f (h (Kb, IDa, ID _δ ) ⁻¹ , f (h (Kb, IDa, ID _δ ), M)) = f (h (Kb, IDa, ID _δ ) ⁻¹ ● h (Kb, IDa, ID _δ )), M) = f (1, M) = M.

Thus, the ciphertext of the message M addressed to the user terminal 10-1 from the user terminal 10-3 is re-encrypted by the conversion server 20, and the re-ciphertext is sent from the user terminal 10-2. In response to the proxy browsing application, the encrypted message is re-encrypted to generate a re-encrypted text, and the user terminal 10-2 decrypts the re-encrypted text without using the private key of the user terminal 10-1, and the original message M Can be obtained. Also, by using such a method, the ciphertext of the message M addressed to the user terminal 10-1 is not decrypted in the middle of transmission, so that information is prevented from being leaked due to third party fraud. it can.

In the foregoing, the mechanism in which the user terminal 10-2 receives the re-ciphertext including the message M in the message field δ addressed to the user terminal 10-1 as a proxy and acquires the message M has been described.

According to the present embodiment shown in FIGS. 5 and 6, a specific message field addressed to the user terminal 10-1 of the user A among the messages generated by the user terminal 10-3 of the user C. Only the message M relating to δ can be acquired at the user terminal 10-2 of the user B who is the agent of the user A without leaking to a third party.

According to the embodiment described above, when encrypting the generated message, the user terminal of the message generating source does not encrypt the message only with the encryption key of the own user terminal, but instead of encrypting the generated message. Data including an encryption key, information for identifying a communication partner terminal, and information for identifying a message field is generated as an encryption key, and the message is encrypted using the encryption key. Thus, in order to decrypt the ciphertext at the communication partner terminal, the decryption key of the own terminal, information for identifying the user terminal of the message generation source that is the communication partner terminal, and information for identifying the message field are included. Necessary. Therefore, the message receiving terminal and its proxy terminal cannot decrypt the ciphertext if the communication partner and the message field are different.

Moreover, since each user terminal only needs to manage its own secret key, it becomes easy to manage the secret key.

The embodiment of the present invention has been specifically described above. However, the present invention is not limited to this, and various modifications can be made without departing from the spirit of the present invention.

For example, in the above embodiment, when generating the encryption key and the decryption key, the ID for identifying the communication partner and the message field are used as the identifier ID, but other IDs indicating the validity period of the message are also used. For example, a user terminal that performs proxy browsing of messages by using a plurality of IDs that identify message attributes may be used to finely control the range in which proxy browsing is possible. *

In addition, the key generation process may be dynamically generated at the time of message encryption / decryption, or may be generated in advance and managed by each user terminal.

The above embodiment can also be applied to the My Portal system in the social security / tax number system that the Japanese government is considering. When applying to My Portal, the function of the conversion server 20 according to the present embodiment may be constructed on the same physical device as one function of My Portal, or physically separated from My Portal. The portal may construct the function of the conversion server 20 according to the present embodiment on another device only by bridging data.

The above embodiment can also be applied to a system for sharing data on a cloud service.

10-1, 10-2, 10-3 ... user terminal, 20 ... conversion server (re-encryption device), 30 ... network.

Claims

A re-encryption method in a re-encryption system comprising a plurality of user terminals and a re-encryption device connected to the user terminals via a network,
The first user terminal includes a secret key of the first user terminal, information for identifying the second user terminal of the communication partner, and information for identifying the field of the message addressed to the second user terminal. Generating an encryption key, encrypting the message using the encryption key, and transmitting the encrypted message to the re-encryption device via the network;
The re-encryption device receives the encrypted message from the first user terminal via the network, and re-encrypts the encrypted message using the first conversion key stored in the storage unit. Storing the re-encrypted message in the storage unit;
The second user terminal receives the re-encrypted message from the re-encryption device via the network, the second user terminal's private key, and the communication partner's first user terminal Generating a decryption key including information identifying the message and information identifying the field of the message, and decrypting the re-encrypted message using the decryption key to obtain the original message,
A re-encryption method characterized by the above.
The first user terminal transmits registration application information for the first conversion key to the re-encryption device via the network, and a first random number is transmitted from the re-encryption device via the network. Receiving the first calculation result obtained by masking the inverse element of the encryption key using the first random number and transmitting the second user terminal via the network;
The second user terminal receives the first calculation result from the first user terminal via the network, generates the decryption key, and uses the decryption key to perform the first calculation. A second operation result obtained by masking the result is transmitted to the re-encryption device via the network;
The re-encryption device receives the first conversion key registration application information from the first user terminal via the network, generates the first random number, and generates the first random number Transmitting to the first user terminal via the network, receiving the second calculation result from the second user terminal via the network, and using the inverse of the first random number Storing the third calculation result obtained by masking the second calculation result in the storage unit as the first conversion key;
The re-encryption method according to claim 1.
The second user terminal transmits registration application information of the first user terminal user's agent to the re-encryption device via the network, and the re-encryption device sends a second random number. And generating a cryptographic key including a secret key of the second user terminal, information for identifying the first user terminal, and information for identifying the field of the message, A fourth computation result obtained by masking the inverse element of the key using the second random number is transmitted to the third user terminal, which is the user terminal of the agent, via the network;
The third user terminal receives the fourth calculation result from the second user terminal via the network, and receives the secret key of the third user terminal, the second user terminal And a decryption key for identifying the field of the message, and using the decryption key, the fifth operation result obtained by masking the third operation result is transmitted via the network to the re-encryption device. To
The re-encryption device receives the proxy registration application information from the second user terminal via the network, generates the second random number, and transmits the second random number via the network. To the second user terminal, receive the fifth calculation result from the third user terminal via the network, and use the inverse of the second random number to A sixth calculation result obtained by masking the calculation result is stored in the storage unit as a second conversion key;
The re-encryption method according to claim 2.
The re-encryption device receives proxy browsing application information of the message from the third user terminal via the network, and acquires the second conversion key and the re-encrypted message from the storage unit. , Further re-encrypting the re-encrypted message using the second conversion key, and transmitting the re-encrypted message to the third user terminal via the network,
The third user terminal receives the re-encrypted message from the re-encryption device via the network, and identifies the secret key of the third user terminal and the second user terminal Generating a decryption key for identifying information and the field of the message, and decrypting the encrypted message again using the decryption key to obtain the original message;
The re-encryption method according to claim 3.
A re-encryption system comprising a plurality of user terminals and a re-encryption device connected to the user terminals via a network,
The first user terminal includes a secret key of the first user terminal, information for identifying the second user terminal of the communication partner, and information for identifying the field of the message addressed to the second user terminal Generating an encryption key, encrypting the message using the encryption key, and transmitting the encrypted message to the re-encryption device via the network;
The re-encryption device receives the encrypted message from the first user terminal via the network, and re-encrypts the encrypted message using a first conversion key stored in a storage unit. Storing the re-encrypted message in the storage unit;
The second user terminal receives the re-encrypted message from the re-encryption device via the network, the second user terminal's private key, and the communication partner's first user terminal Generating a decryption key including information identifying the message and information identifying the field of the message, and decrypting the re-encrypted message using the decryption key to obtain the original message,
A re-encryption system characterized by that.
The first user terminal transmits registration application information of the first conversion key to the re-encryption device via the network, and a first random number is transmitted from the re-encryption device via the network. Receiving the first calculation result obtained by masking the inverse element of the encryption key using the first random number and transmitting the second user terminal via the network;
The second user terminal receives the first calculation result from the first user terminal via the network, generates the decryption key, and uses the decryption key to perform the first calculation. A second operation result obtained by masking the result is transmitted to the re-encryption device via the network;
The re-encryption device receives registration application information of the first conversion key from the first user terminal via the network, generates the first random number, and generates the first random number. Transmitting to the first user terminal via the network, receiving the second calculation result from the second user terminal via the network, and using the inverse of the first random number The re-encryption system according to claim 5, wherein a third calculation result obtained by masking the second calculation result is stored in the storage unit as the first conversion key.
The second user terminal transmits registration application information of the proxy of the first user terminal user to the re-encryption device via the network, and the second random number is transmitted from the re-encryption device. And generating a cryptographic key including a secret key of the second user terminal, information for identifying the first user terminal of the communication partner, and information for identifying the field of the message , Transmitting the fourth calculation result obtained by masking the inverse element of the encryption key using the second random number to the third user terminal which is the user terminal of the agent via the network,
The third user terminal receives the fourth calculation result from the second user terminal via the network, and receives the secret key of the third user terminal, the second user terminal And a decryption key for identifying the field of the message, and using the decryption key, the fifth operation result obtained by masking the third operation result is transmitted via the network to the re-encryption device. To
The re-encryption device receives the proxy registration application information from the second user terminal via the network, generates the second random number, and transmits the second random number via the network. To the second user terminal, receive the fifth calculation result from the third user terminal via the network, and use the inverse of the second random number to A sixth calculation result obtained by masking the calculation result is stored in the storage unit as a second conversion key;
The re-encryption system according to claim 6.
The re-encryption device receives the proxy browsing application information of the message from the third user terminal via the network, and acquires the second conversion key and the re-encrypted message from the storage unit. , Further re-encrypting the re-encrypted message using the second conversion key, and transmitting the re-encrypted message to the third user terminal via the network,
The third user terminal receives the re-encrypted message from the re-encryption device via the network, and identifies the secret key of the third user terminal and the second user terminal Generating a decryption key for identifying information and the field of the message, and decrypting the encrypted message again using the decryption key to obtain the original message;
The re-encryption system according to claim 7.
A re-encryption device connected to a plurality of user terminals via a network,
An arithmetic processing unit and a storage unit;
The arithmetic processing unit is
From the first user terminal, including the secret key of the first user terminal, information for identifying the second user terminal of the communication partner, and information for identifying the field of the message addressed to the second user terminal Receiving an encrypted message over the network;
Re-encrypting the received encrypted message using the first conversion key stored in the storage unit;
Storing the re-encrypted message in the storage unit;
In response to a request from the second user terminal, obtain the re-encrypted message from the storage unit,
Sending the acquired re-encrypted message to the second user terminal via the network;
A re-encryption device.
The arithmetic processing unit generates a first random number and transmits the first random number to the first user terminal via the network, the secret key of the first user terminal, the second user terminal of the communication partner And a secret of the second user terminal with respect to the first calculation result obtained by masking the inverse element of the encryption key including the information identifying the message field and the information identifying the field of the message using the first random number. From the second user terminal, a second calculation result further masked using a decryption key including a key, information identifying the first user terminal of the communication partner, and information identifying the field of the message is sent from the second user terminal. A third operation result received through the network and masked using the inverse of the first random number is stored in the storage unit as the first conversion key;
The re-encryption apparatus according to claim 9.
The arithmetic processing unit generates a second random number and transmits the second random number to the second user terminal via the network, and identifies the secret key of the second user terminal and the first user terminal Proxy for the second user terminal user for the fourth calculation result obtained by masking the inverse element of the encryption key including the information to identify and the information identifying the field of the message using the second random number. A fifth calculation result further masked using a decryption key including a secret key of the third user terminal of the person, information identifying the second user terminal, and information identifying the field of the message, The sixth calculation result received from the third user terminal via the network and masked using the inverse of the second random number as the fifth calculation result is used as the second conversion key. Store in storage,
The re-encryption apparatus according to claim 10.
The arithmetic processing unit receives the proxy browsing application information of the message from the third user terminal via the network, acquires the second conversion key and the re-encrypted message from the storage unit, Re-encrypting the re-encrypted message with the second conversion key and transmitting the re-encrypted message to the third user terminal via the network;
The re-encryption device according to claim 11.